openwrt/target/linux/ramips/image/mt7621.mk

2889 lines
83 KiB
Makefile
Raw Normal View History

#
# MT7621 Profiles
#
ramips: add support for Beeline SmartBox GIGA Beeline SmartBox GIGA is a wireless WiFi 5 router manufactured by Sercomm company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB, Nanya NT5CC128M16JR-EK Flash: 128 MiB, Macronix MX30LF1G18AC Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2 Wireless 5 GHz (MT7613BE): a/n/ac, 2x2 Ethernet: 3 ports - 2xGbE (WAN, LAN1), 1xFE (LAN2) USB ports: 1xUSB3.0 Button: 1 button (Reset/WPS) PCB ID: DBE00B-1.6MM LEDs: 1 RGB LED Power: 12 VDC, 1.5 A Connector type: barrel Bootloader: U-Boot Installation ----------------- 1. Downgrade stock (Beeline) firmware to v.1.0.02; 2. Give factory OpenWrt image a shorter name, e.g. 1001.img; 3. Upload and update the firmware via the original web interface. Remark: You might need make the 3rd step twice if your running firmware is booted from the Slot 1 (Sercomm0 bootflag). The stock firmware reverses the bootflag (Sercomm0 / Sercomm1) on each firmware update. Revert to stock --------------- 1. Change the bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 2. Optional: Update with any stock (Beeline) firmware if you want to overwrite OpenWrt in Slot 0 completely. MAC Addresses ------------- +-----+-----------+---------+ | use | address | example | +-----+-----------+---------+ | LAN | label | *:16 | | WAN | label + 1 | *:17 | | 2g | label + 4 | *:1a | | 5g | label + 5 | *:1b | +-----+-----------+---------+ The label MAC address was found in Factory 0x21000 Notes ----- 1. The following scripts are required for the build: sercomm-crypto.py - already exists in OpenWrt sercomm-partition-tag.py - already exists in OpenWrt sercomm-payload.py - already exists in OpenWrt sercomm-pid.py - new, the part of this pull request sercomm-kernel-header.py - new, the part of this pull request 2. This device (same as other Sercomm S2,S3-based devices) requires special LZMA and LOADADDR settings for successful boot: LZMA_TEXT_START=0x82800000 KERNEL_LOADADDR=0x81001000 LOADADDR=0x80001000 3. This device (same as several other Sercomm-based devices - Beeline, Netgear, Etisalat, Rostelecom) has partition map (mtd1) containing real partition offsets, which may differ from device to device depending on the number and location of bad blocks on NAND. "fixed-partitions" is used if the partition map is not found or corrupted. This behavour (it's the same as on stock firmware) is provided by MTD_SERCOMM_PARTS module. Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-03-18 18:09:45 +00:00
include ./common-sercomm.mk
include ./common-tp-link.mk
DEFAULT_SOC := mt7621
DEVICE_VARS += ELECOM_HWNAME LINKSYS_HWNAME DLINK_HWID
define Build/arcadyan-trx
ramips: add support for Beeline SmartBox Flash Beeline SmartBox Flash is a wireless AC1300 (WiFi 5) router manufactured by Arcadyan company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB, Winbond W632GU6NB Flash: 128 MiB (NAND), Winbond W29N01HVSINF Wireless 2.4 GHz (MT7615DN): b/g/n, 2x2 Wireless 5 GHz (MT7615DN): a/n/ac, 2x2 Ethernet: 3xGbE (WAN, LAN1, LAN2) USB ports: 1xUSB3.0 Button: 1 (Reset/WPS) LEDs: 1 RGB LED Power: 12 VDC, 1.5 A Connector type: Barrel Bootloader: U-Boot (Ralink UBoot Version: 5.0.0.2) OEM: Arcadyan WE42022 Installation ------------ 1. Place *factory.trx on any web server (192.168.1.2 in this example) 2. Connect to the router using telnet shell (no password required) 3. Save MAC adresses to U-Boot environment: uboot_env --set --name eth2macaddr --value $(ifconfig | grep eth2 | \ awk '{print $5}') uboot_env --set --name eth3macaddr --value $(ifconfig | grep eth3 | \ awk '{print $5}') uboot_env --set --name ra0macaddr --value $(ifconfig | grep ra0 | \ awk '{print $5}') uboot_env --set --name rax0macaddr --value $(ifconfig | grep rax0 | \ awk '{print $5}') 4. Ensure that MACs were saved correctly: uboot_env --get --name eth2macaddr uboot_env --get --name eth3macaddr uboot_env --get --name ra0macaddr uboot_env --get --name rax0macaddr 5. Download and write the OpenWrt images: cd /tmp wget http://192.168.1.2/factory.trx mtd_write erase /dev/mtd4 mtd_write write factory.trx /dev/mtd4 6. Set 1st boot partition and reboot: uboot_env --set --name bootpartition --value 0 reboot Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv bootpartition 1 reboot 2. Optional step. Upgrade the stock firmware with any version to overwrite the OpenWrt in Slot 1. MAC addresses ------------- +-----------+-------------------+----------------+ | Interface | MAC | Source | +-----------+-------------------+----------------+ | label | 30:xx:xx:51:xx:09 | No MACs was | | LAN | 30:xx:xx:51:xx:09 | found on Flash | | WAN | 30:xx:xx:51:xx:06 | [1] | | WLAN_2g | 30:xx:xx:51:xx:07 | | | WLAN_5g | 32:xx:xx:41:xx:07 | | +-----------+-------------------+----------------+ [1]: a. Label wasb't found neither in factory nor in other places. b. MAC addresses are stored in encrypted partition "glbcfg". Encryption key hasn't known yet. To ensure the correct MACs in OpenWrt, a hack with saving of the MACs to u-boot-env during the installation was applied. c. Default Ralink ethernet MAC address (00:0C:43:28:80:36) was found in "Factory" 0xfff0. It's the same for all Smartbox Flash devices. OEM firmware also uses this MAC when initialazes ethernet driver. In OpenWrt we use it only as internal GMAC (eth0), all other MACs are unique. Therefore, there is no any barriers to the operation of several Smartbox Flash devices even within the same broadcast domain. Stock firmware image format --------------------------- +--------------+---------------+----------------------------------------+ | Offset | 1.0.15 | Description | +==============+===============+========================================+ | 0x0 | 5d 43 6f 74 | TRX magic "]Cot" | +--------------+---------------+----------------------------------------+ | 0x4 | 00 70 ff 00 | Length (reverse) | +--------------+---------------+----------------------------------------+ | | | htonl(~crc) from 0xc ("flag_version") | | 0x8 | 72 b3 93 16 | to "Length" | +--------------+---------------+----------------------------------------+ | 0xc | 00 00 01 00 | Flags | +--------------+---------------+----------------------------------------+ | | | Offset (reverse) of Kernel partition | | 0x10 | 1c 00 00 00 | from the start of the header | +--------------+---------------+----------------------------------------+ | | | Offset (reverse) of RootFS partition | | 0x14 | 00 00 42 00 | from the start of the header | +--------------+---------------+----------------------------------------+ | 0x18 | 00 00 00 00 | Zeroes | +--------------+---------------+----------------------------------------+ | 0x1c | 27 05 19 56 … | Kernel data + zero padding | +--------------+---------------+----------------------------------------+ | | | RootFS data (starting with "hsqs") + | | 0x420000 | 68 73 71 73 … | zero padding to "Length" | +--------------+---------------+----------------------------------------+ | | | Some signature data (format is | | | | unknown). Necessary for the fw | | "Lenght" | 00 00 00 00 … | update via oem fw web interface. | +--------------+---------------+----------------------------------------+ | "Lenght" + | | TRX magic "HDR0". U-Boot is | | 0x10c | 48 44 52 30 | checking it at every boot. | +--------------+---------------+----------------------------------------+ | | | 1.00: | | | | Zero padding to ("Lenght" + 0x23000) | | | | 1.0.12: | | | | Zero padding to ("Lenght" + 0x2a000) | | "Lenght" + | | 1.0.13, 1.0.15, 1.0.16: | | 0x110 | 00 00 00 00 | Zero padding to ("Lenght" + 0x10000) | +--------------+---------------+----------------------------------------+ Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-01-05 13:11:56 +00:00
echo -ne "hsqs" > $@.hsqs
$(eval trx_magic=$(word 1,$(1)))
$(STAGING_DIR_HOST)/bin/otrx create $@.trx -M $(trx_magic) -f $@ \
ramips: add support for Beeline SmartBox Flash Beeline SmartBox Flash is a wireless AC1300 (WiFi 5) router manufactured by Arcadyan company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB, Winbond W632GU6NB Flash: 128 MiB (NAND), Winbond W29N01HVSINF Wireless 2.4 GHz (MT7615DN): b/g/n, 2x2 Wireless 5 GHz (MT7615DN): a/n/ac, 2x2 Ethernet: 3xGbE (WAN, LAN1, LAN2) USB ports: 1xUSB3.0 Button: 1 (Reset/WPS) LEDs: 1 RGB LED Power: 12 VDC, 1.5 A Connector type: Barrel Bootloader: U-Boot (Ralink UBoot Version: 5.0.0.2) OEM: Arcadyan WE42022 Installation ------------ 1. Place *factory.trx on any web server (192.168.1.2 in this example) 2. Connect to the router using telnet shell (no password required) 3. Save MAC adresses to U-Boot environment: uboot_env --set --name eth2macaddr --value $(ifconfig | grep eth2 | \ awk '{print $5}') uboot_env --set --name eth3macaddr --value $(ifconfig | grep eth3 | \ awk '{print $5}') uboot_env --set --name ra0macaddr --value $(ifconfig | grep ra0 | \ awk '{print $5}') uboot_env --set --name rax0macaddr --value $(ifconfig | grep rax0 | \ awk '{print $5}') 4. Ensure that MACs were saved correctly: uboot_env --get --name eth2macaddr uboot_env --get --name eth3macaddr uboot_env --get --name ra0macaddr uboot_env --get --name rax0macaddr 5. Download and write the OpenWrt images: cd /tmp wget http://192.168.1.2/factory.trx mtd_write erase /dev/mtd4 mtd_write write factory.trx /dev/mtd4 6. Set 1st boot partition and reboot: uboot_env --set --name bootpartition --value 0 reboot Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv bootpartition 1 reboot 2. Optional step. Upgrade the stock firmware with any version to overwrite the OpenWrt in Slot 1. MAC addresses ------------- +-----------+-------------------+----------------+ | Interface | MAC | Source | +-----------+-------------------+----------------+ | label | 30:xx:xx:51:xx:09 | No MACs was | | LAN | 30:xx:xx:51:xx:09 | found on Flash | | WAN | 30:xx:xx:51:xx:06 | [1] | | WLAN_2g | 30:xx:xx:51:xx:07 | | | WLAN_5g | 32:xx:xx:41:xx:07 | | +-----------+-------------------+----------------+ [1]: a. Label wasb't found neither in factory nor in other places. b. MAC addresses are stored in encrypted partition "glbcfg". Encryption key hasn't known yet. To ensure the correct MACs in OpenWrt, a hack with saving of the MACs to u-boot-env during the installation was applied. c. Default Ralink ethernet MAC address (00:0C:43:28:80:36) was found in "Factory" 0xfff0. It's the same for all Smartbox Flash devices. OEM firmware also uses this MAC when initialazes ethernet driver. In OpenWrt we use it only as internal GMAC (eth0), all other MACs are unique. Therefore, there is no any barriers to the operation of several Smartbox Flash devices even within the same broadcast domain. Stock firmware image format --------------------------- +--------------+---------------+----------------------------------------+ | Offset | 1.0.15 | Description | +==============+===============+========================================+ | 0x0 | 5d 43 6f 74 | TRX magic "]Cot" | +--------------+---------------+----------------------------------------+ | 0x4 | 00 70 ff 00 | Length (reverse) | +--------------+---------------+----------------------------------------+ | | | htonl(~crc) from 0xc ("flag_version") | | 0x8 | 72 b3 93 16 | to "Length" | +--------------+---------------+----------------------------------------+ | 0xc | 00 00 01 00 | Flags | +--------------+---------------+----------------------------------------+ | | | Offset (reverse) of Kernel partition | | 0x10 | 1c 00 00 00 | from the start of the header | +--------------+---------------+----------------------------------------+ | | | Offset (reverse) of RootFS partition | | 0x14 | 00 00 42 00 | from the start of the header | +--------------+---------------+----------------------------------------+ | 0x18 | 00 00 00 00 | Zeroes | +--------------+---------------+----------------------------------------+ | 0x1c | 27 05 19 56 … | Kernel data + zero padding | +--------------+---------------+----------------------------------------+ | | | RootFS data (starting with "hsqs") + | | 0x420000 | 68 73 71 73 … | zero padding to "Length" | +--------------+---------------+----------------------------------------+ | | | Some signature data (format is | | | | unknown). Necessary for the fw | | "Lenght" | 00 00 00 00 … | update via oem fw web interface. | +--------------+---------------+----------------------------------------+ | "Lenght" + | | TRX magic "HDR0". U-Boot is | | 0x10c | 48 44 52 30 | checking it at every boot. | +--------------+---------------+----------------------------------------+ | | | 1.00: | | | | Zero padding to ("Lenght" + 0x23000) | | | | 1.0.12: | | | | Zero padding to ("Lenght" + 0x2a000) | | "Lenght" + | | 1.0.13, 1.0.15, 1.0.16: | | 0x110 | 00 00 00 00 | Zero padding to ("Lenght" + 0x10000) | +--------------+---------------+----------------------------------------+ Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-01-05 13:11:56 +00:00
-a 0x20000 -b 0x420000 -f $@.hsqs -a 1000
mv $@.trx $@
dd if=/dev/zero bs=1024 count=1 >> $@.tail
echo -ne "HDR0" | dd of=$@.tail bs=1 seek=$$((0x10c)) count=4 \
conv=notrunc 2>/dev/null
dd if=$@.tail >> $@ 2>/dev/null
rm $@.hsqs $@.tail
endef
ramips: add support for Linksys E5600 This submission relied heavily on the work of Linksys EA7300 v1/ v2. Specifications: * SoC: MediaTek MT7621A (880 MHz 2c/4t) * RAM: 128M DDR3-1600 * Flash: 128M NAND * Eth: MediaTek MT7621A (10/100/1000 Mbps x5) * Radio: MT7603E/MT7613BE (2.4 GHz & 5 GHz) * Antennae: 2 internal fixed in the casing and 2 on the PCB * LEDs: Blue (x4 Ethernet) Blue+Orange (x2 Power + WPS and Internet) * Buttons: Reset (x1) WPS (x1) Installation: Flash factory image through GUI. This device has 2 partitions for the firmware called firmware and alt_firmware. To successfully flash and boot the device, the device should have been running from alt_firmware partition. To get the device booted through alt_firmware partition, download the OEM firmware from Linksys website and upgrade the firmware from web GUI. Once this is done, flash the OpenWrt Factory firmware from web GUI. Reverting to factory firmware: 1. Boot to 'alt_firmware'(where stock firmware resides) by doing one of the following: Press the "wps" button as soon as power LED turns on when booting. (OR) Hard-reset the router consecutively three times to force it to boot from 'alt_firmware'. 2. To remove any traces of OpenWRT from your router simply flash the OEM image at this point. Signed-off-by: Aashish Kulkarni <aashishkul@gmail.com> [fix hanging indents and wrap to 74 characters per line, add kmod-mt7663-firmware-sta package for 5GHz STA mode to work, remove sysupgrade.bin and concatenate IMAGES instead in mt7621.mk, set default-state "on" for power LED] Signed-off-by: Sannihith Kinnera <digislayer@protonmail.com> [move check-size before append-metadata, remove trailing whitespace] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-03-02 05:10:14 +00:00
define Build/gemtek-trailer
printf "%s%08X" ".GEMTEK." "$$(cksum $@ | cut -d ' ' -f1)" >> $@
endef
ramips: add support for H3C TX1800 Plus / TX1801 Plus / TX1806 H3C TX180x series WiFi6 routers are customized by different carrier. While these three devices look different, they use the same motherboard inside. Another minor difference comes from the model name definition in the u-boot environment variable. Specifications: SOC: MT7621 + MT7915 ROM: 128 MiB RAM: 256 MiB LED: status *2 Button: reset *1 + wps/mesh *1 Ethernet: lan *3 + wan *1 (10/100/1000Mbps) TTL Baudrate: 115200 TFTP server IP: 192.168.124.99 MAC Address: use address(sample 1) address(sample 2) source label 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 u-boot-env@ethaddr lan 88:xx:xx:98:xx:13 88:xx:xx:a2:xx:a6 $label +1 wan 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 $label WiFi4_2G 8a:xx:xx:58:xx:14 8a:xx:xx:52:xx:a7 (Compatibility mode) WiFi5_5G 8a:xx:xx:b8:xx:14 8a:xx:xx:b2:xx:a7 (Compatibility mode) WiFi6_2G 8a:xx:xx:18:xx:14 8a:xx:xx:12:xx:a7 WiFi6_5G 8a:xx:xx:78:xx:14 8a:xx:xx:72:xx:a7 Compatibility mode is used to guarantee the connection of old devices that only support WiFi4 or WiFi5. TFTP + TTL Installation: Although a TTL connection is required for installation, we do not need to tear down it. We can find the TTL port from the cooling hole at the bottom. It is located below LAN3 and the pins are defined as follows: |LAN1|LAN2|LAN3|----|WAN| -------------------- |GND|TX|RX|VCC| 1. Set tftp server IP to 192.168.124.99 and put initramfs firmware in server's root directory, rename it to a simple name "initramfs.bin". 2. Plug in the power supply and wait for power on, connect the TTL cable and open a TTL session, enter "reboot", then enter "Y" to confirm. Finally push "0" to interruput boot while booting. 3. Execute command to install a initramfs system: # tftp 0x80010000 192.168.124.99:initramfs.bin # bootm 0x80010000 4. Backup nand flash by OpenWrt LuCI or dd instruction. We need those partitions if we want to back to stock firmwre due to official website does not provide download link. # dd if=/dev/mtd1 of=/tmp/u-boot-env.bin # dd if=/dev/mtd4 of=/tmp/firmware.bin 5. Edit u-boot env to ensure use default bootargs and first image slot: # fw_setenv bootargs # fw_setenv bootflag 0 6. Upgrade sysupgrade firmware. 7. About restore stock firmware: flash the "firmware" and "u-boot-env" partitions that we backed up in step 4. # mtd write /tmp/u-boot-env.bin u-boot-env # mtd write /tmp/firmware.bin firmware Additional Info: The H3C stock firmware has a 160-byte firmware header that appears to use a non-standard CRC32 verification algorithm. For this part of the data, the u-boot does not check it so we can just directly replace it with a placeholder. Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2022-03-20 15:42:37 +00:00
define Build/h3c-blank-header
dd if=/dev/zero of=$@.blank bs=160 count=1
cat $@ >> $@.blank
mv $@.blank $@
endef
ramips: add support for SIM SIMAX1800T and Haier HAR-20S2U1 SIM AX18T and Haier HAR-20S2U1 Wi-Fi6 AX1800 routers are designed based on Tenbay WR1800K. They have the same hardware circuits and u-boot. SIM AX18T has three carrier customized models: SIMAX1800M (China Mobile), SIMAX1800T (China Telecom) and SIMAX1800U (China Unicom). All of these models run the same firmware. Specifications: SOC: MT7621 + MT7905 + MT7975 ROM: 128 MiB RAM: 256 MiB LED: status *3 R/G/B Button: reset *1 + wps/mesh *1 Ethernet: lan *3 + wan *1 (10/100/1000Mbps) TTL Baudrate: 115200 TFTP Server: 192.168.1.254 TFTP IP: 192.168.1.28 or 192.168.1.160 (when envs is broken) MAC Address: use address source label 30:xx:xx:xx:xx:62 wan lan 30:xx:xx:xx:xx:65 factory.0x8004 wan 30:xx:xx:xx:xx:62 factory.0x8004 -3 wlan2g 30:xx:xx:xx:xx:64 factory.0x0004 wlan5g 32:xx:xx:xx:xx:64 factory.0x0004 set 7th bit TFTP Installation (initramfs image only & recommend): 1. Set local tftp server IP: 192.168.1.254 and NetMask: 255.255.255.0 2. Rename initramfs-kernel.bin to "factory.bin" and put it in the root directory of the tftp server. (tftpd64 is a good choice for Windows) 3. Start the TFTP server, plug in the power supply, and wait for the system to boot. 4. Backup "firmware" partition and rename it to "firmware.bin", we need it to back to stock firmware. 5. Use "fw_printenv" command to list envs. If "firmware_select=2" is observed then set u-boot enviroment: /# fw_setenv firmware_select 1 6. Apply sysupgrade.bin in OpenWrt LuCI. Web UI Installation: 1. Apply update by uploading initramfs-factory.bin to the web UI. 2. Use "fw_printenv" command to list envs. If "firmware_select=2" is observed then set u-boot enviroment: /# fw_setenv firmware_select 1 3. Apply squashfs-sysupgrade.bin in OpenWrt LuCI. Recovery to stock firmware: a. Upload "firmware.bin" to OpenWrt /tmp, then execute: /# mtd -r write /tmp/firmware.bin firmware b. We can also write factory image "UploadBrush-bin.img" to firmware partition to recovery. Upload image file to /tmp, then execute: /# mtd erase firmware /# mtd -r write /tmp/UploadBrush-bin.img firmware How to extract stock firmware image: Download stock firmware, then use openssl: openssl aes-256-cbc -d -salt -in [Downloaded_Firmware] \ -out "firmware.tar.tgz" -k QiLunSmartWL Signed-off-by: Chen Minqiang <ptpt52@gmail.com> Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2022-09-15 17:10:52 +00:00
define Build/haier-sim_wr1800k-factory
mkdir -p "$@.tmp"
mv "$@" "$@.tmp/UploadBrush-bin.img"
$(MKHASH) md5 "$@.tmp/UploadBrush-bin.img" | head -c32 > "$@.tmp/check_MD5.txt"
$(TAR) -czf "$@.tmp.tgz" -C "$@.tmp" UploadBrush-bin.img check_MD5.txt
$(STAGING_DIR_HOST)/bin/openssl aes-256-cbc -e -salt -in "$@.tmp.tgz" -out "$@" -k QiLunSmartWL
printf %32s $(DEVICE_MODEL) >> "$@"
rm -rf "$@.tmp" "$@.tmp.tgz"
ramips: add support for SIM SIMAX1800T and Haier HAR-20S2U1 SIM AX18T and Haier HAR-20S2U1 Wi-Fi6 AX1800 routers are designed based on Tenbay WR1800K. They have the same hardware circuits and u-boot. SIM AX18T has three carrier customized models: SIMAX1800M (China Mobile), SIMAX1800T (China Telecom) and SIMAX1800U (China Unicom). All of these models run the same firmware. Specifications: SOC: MT7621 + MT7905 + MT7975 ROM: 128 MiB RAM: 256 MiB LED: status *3 R/G/B Button: reset *1 + wps/mesh *1 Ethernet: lan *3 + wan *1 (10/100/1000Mbps) TTL Baudrate: 115200 TFTP Server: 192.168.1.254 TFTP IP: 192.168.1.28 or 192.168.1.160 (when envs is broken) MAC Address: use address source label 30:xx:xx:xx:xx:62 wan lan 30:xx:xx:xx:xx:65 factory.0x8004 wan 30:xx:xx:xx:xx:62 factory.0x8004 -3 wlan2g 30:xx:xx:xx:xx:64 factory.0x0004 wlan5g 32:xx:xx:xx:xx:64 factory.0x0004 set 7th bit TFTP Installation (initramfs image only & recommend): 1. Set local tftp server IP: 192.168.1.254 and NetMask: 255.255.255.0 2. Rename initramfs-kernel.bin to "factory.bin" and put it in the root directory of the tftp server. (tftpd64 is a good choice for Windows) 3. Start the TFTP server, plug in the power supply, and wait for the system to boot. 4. Backup "firmware" partition and rename it to "firmware.bin", we need it to back to stock firmware. 5. Use "fw_printenv" command to list envs. If "firmware_select=2" is observed then set u-boot enviroment: /# fw_setenv firmware_select 1 6. Apply sysupgrade.bin in OpenWrt LuCI. Web UI Installation: 1. Apply update by uploading initramfs-factory.bin to the web UI. 2. Use "fw_printenv" command to list envs. If "firmware_select=2" is observed then set u-boot enviroment: /# fw_setenv firmware_select 1 3. Apply squashfs-sysupgrade.bin in OpenWrt LuCI. Recovery to stock firmware: a. Upload "firmware.bin" to OpenWrt /tmp, then execute: /# mtd -r write /tmp/firmware.bin firmware b. We can also write factory image "UploadBrush-bin.img" to firmware partition to recovery. Upload image file to /tmp, then execute: /# mtd erase firmware /# mtd -r write /tmp/UploadBrush-bin.img firmware How to extract stock firmware image: Download stock firmware, then use openssl: openssl aes-256-cbc -d -salt -in [Downloaded_Firmware] \ -out "firmware.tar.tgz" -k QiLunSmartWL Signed-off-by: Chen Minqiang <ptpt52@gmail.com> Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2022-09-15 17:10:52 +00:00
endef
2019-04-09 05:48:31 +00:00
define Build/iodata-mstc-header
( \
data_size_crc="$$(dd if=$@ ibs=64 skip=1 2>/dev/null | gzip -c | \
tail -c 8 | od -An -tx8 --endian little | tr -d ' \n')"; \
echo -ne "$$(echo $$data_size_crc | sed 's/../\\x&/g')" | \
dd of=$@ bs=8 count=1 seek=7 conv=notrunc 2>/dev/null; \
)
dd if=/dev/zero of=$@ bs=4 count=1 seek=1 conv=notrunc 2>/dev/null
( \
header_crc="$$(dd if=$@ bs=64 count=1 2>/dev/null | gzip -c | \
tail -c 8 | od -An -N4 -tx4 --endian little | tr -d ' \n')"; \
echo -ne "$$(echo $$header_crc | sed 's/../\\x&/g')" | \
dd of=$@ bs=4 count=1 seek=1 conv=notrunc 2>/dev/null; \
)
2019-04-09 05:48:31 +00:00
endef
ramips: mt7621: add support for ZyXEL WSM20 The ZyXEL WSM20 aka Multy M1 is a cheap mesh router system by ZyXEL based on the MT7621 CPU. Specifications ============== SoC: MediaTek MT7621AT (880MHz) RAM: 256MiB Flash: 128MiB NAND Wireless: 802.11ax (2x2 MT7915E DBDC) Ethernet: 4x 10/100/1000 (MT7530) Button: 1x WPS, 1x Reset, 1x LED On/Off LED: 7 LEDs (3x white, 2x red, 2x green) MAC address assignment ====================== The MAC address assignment follows stock: The label MAC address is the LAN MAC address, the WAN address is read from flash. The WiFi MAC addresses are set in userspace to label MAC + 1 and label MAC + 2. Installation (web interface) ============================ The device is cloud-managed, but there is a hidden local firmware upgrade page in the OEM web interface. The device has to be registered in the cloud in order to be able to access this page. The system has a dual firmware design, there is no way to tell which firmware is currently booted. Therefore, an -initramfs version is flashed first. 1. Log into the OEM web GUI 2. Access the hidden upgrade page by navigating to https://192.168.212.1/gui/#/main/debug/firmwareupgrade 3. Upload the -initramfs-kernel.bin file and flash it 4. Wait for OpenWrt to boot and log in via SSH 5. Transfer the sysupgrade file via SCP 6. Run sysupgrade to install the image 7. Reboot and enjoy NB: If the initramfs version was installed in RAS2, the sysupgrade script sets the boot number to the first partition. A backup has to be performed manually in case the OEM firwmare should be kept. Installation (UART method) ========================== The UART method is more difficult, as the boot loader does not have a timeout set. A semi-working stock firmware is required to configure it: 1. Attach UART 2. Boot the stock firmware until the message about failsafe mode appears 3. Enter failsafe mode by pressing "f" and "Enter" 4. Type "mount_root" 5. Run "fw_setenv bootmenu_delay 3" 6. Reboot, U-Boot now presents a menu 7. The -initramfs-kernel.bin image can be flashed using the menu 8. Run the regular sysupgrade for a permanent installation Changing the partition to boot is a bit cumbersome in U-Boot, as there is no menu to select it. It can only be checked using mstc_bootnum. To change it, issue the following commands in U-Boot: nand read 1800000 53c0000 800 mw.b 1800004 1 1 nand erase 53c0000 800 nand write 1800000 53c0000 800 This selects FW1. Replace "mw.b 1800004 1 1" by "mw.b 1800004 2 1" to change to the second slot. Back to stock ============= It is possible to flash back to stock, but a OEM firmware upgrade is required. ZyXEL does not provide the link on its website, but the link can be acquired from the OEM web GUI by analyzing the transferred JSON objects. It is then a matter of writing the firmware to Kernel2 and setting the boot partition to FW2: mtd write zyxel.bin Kernel2 echo -ne "\x02" | dd of=/dev/mtdblock7 count=1 bs=1 seek=4 conv=notrunc Signed-off-by: Andreas Böhler <dev@aboehler.at> Credits to forum users Annick and SirLouen for their initial work on this device
2023-04-04 17:41:26 +00:00
define Build/znet-header
$(eval version=$(word 1,$(1)))
( \
data_size_crc="$$(dd if=$@ 2>/dev/null | gzip -c | \
tail -c 8 | od -An -N4 -tx4 --endian big | tr -d ' \n')"; \
payload_len="$$(dd if=$@ bs=4 count=1 skip=1 2>/dev/null | od -An -tdI --endian big | tr -d ' \n')"; \
payload_size_crc="$$(dd if=$@ ibs=1 count=$$payload_len 2>/dev/null | gzip -c | \
tail -c 8 | od -An -N4 -tx4 --endian big | tr -d ' \n')"; \
echo -ne "\x5A\x4E\x45\x54" | dd bs=4 count=1 conv=sync 2>/dev/null; \
echo -ne "$$(printf '%08x' $$(stat -c%s $@) | fold -s2 | xargs -I {} echo \\x{} | tac | tr -d '\n')" | \
dd bs=4 count=1 conv=sync 2>/dev/null; \
echo -ne "$$(echo $$data_size_crc | sed 's/../\\x&/g')" | \
dd bs=4 count=1 conv=sync 2>/dev/null; \
echo -ne "$$(echo $$payload_size_crc | sed 's/../\\x&/g')" | \
dd bs=4 count=1 conv=sync 2>/dev/null; \
echo -ne "\x12\x34\x56\x78" | dd bs=4 count=1 conv=sync 2>/dev/null; \
echo -ne "$(version)" | dd bs=28 count=1 conv=sync 2>/dev/null; \
dd if=/dev/zero bs=262096 count=1 conv=sync 2>/dev/null | tr "\000" "\377"; \
cat $@; \
) > $@.new
mv $@.new $@
endef
define Build/belkin-header
$(eval magic=$(word 1,$(1)))
$(eval hw_ver=$(word 2,$(1)))
$(eval fw_ver=$(word 3,$(1)))
( \
type_fw_date=$$(printf "01%02x%02x%02x" \
$$(date -d "@$(SOURCE_DATE_EPOCH)" "+%y %m %d")); \
hw_fw_ver=$$(printf "%02x%02x%02x%02x" \
$(hw_ver) $$(echo $(fw_ver) | cut -d. -f-3 | tr . ' ')); \
fw_len_crc=$$(gzip -c $@ | tail -c 8 | od -An -tx8 | tr -d ' \n'); \
fw_crc_len="$${fw_len_crc:8:8}$${fw_len_crc:0:8}"; \
\
printf "$(magic)" | dd bs=4 count=1 conv=sync 2>/dev/null; \
printf "$$(echo $${type_fw_date}$${hw_fw_ver} | \
sed 's/../\\x&/g')"; \
printf "$$(echo $${fw_crc_len}$${fw_crc_len} | \
sed 's/../\\x&/g')"; \
printf "\x5c\x78\x00\x00"; \
cat $@; \
) > $@.new
mv $@.new $@
endef
define Build/ubnt-erx-factory-image
if [ -e $(KDIR)/tmp/$(KERNEL_INITRAMFS_IMAGE) -a "$$(stat -c%s $@)" -lt "$(KERNEL_SIZE)" ]; then \
echo '21001:7' > $(1).compat; \
$(TAR) -cf $(1) --transform='s/^.*/compat/' $(1).compat; \
\
$(TAR) -rf $(1) --transform='s/^.*/vmlinux.tmp/' $(KDIR)/tmp/$(KERNEL_INITRAMFS_IMAGE); \
$(MKHASH) md5 $(KDIR)/tmp/$(KERNEL_INITRAMFS_IMAGE) > $(1).md5; \
$(TAR) -rf $(1) --transform='s/^.*/vmlinux.tmp.md5/' $(1).md5; \
\
echo "dummy" > $(1).rootfs; \
$(TAR) -rf $(1) --transform='s/^.*/squashfs.tmp/' $(1).rootfs; \
\
$(MKHASH) md5 $(1).rootfs > $(1).md5; \
$(TAR) -rf $(1) --transform='s/^.*/squashfs.tmp.md5/' $(1).md5; \
\
echo '$(BOARD) $(VERSION_CODE) $(VERSION_NUMBER)' > $(1).version; \
$(TAR) -rf $(1) --transform='s/^.*/version.tmp/' $(1).version; \
\
$(CP) $(1) $(BIN_DIR)/; \
else \
echo "WARNING: initramfs kernel image too big, cannot generate factory image (actual $$(stat -c%s $@); max $(KERNEL_SIZE))" >&2; \
fi
endef
ramips: mt7621: Add support for ZyXEL NR7101 The ZyXEL NR7101 is an 802.3at PoE powered 5G outdoor (IP68) CPE with integrated directional 5G/LTE antennas. Specifications: - SoC: MediaTek MT7621AT - RAM: 256 MB - Flash: 128 MB MB NAND (MX30LF1G18AC) - WiFi: MediaTek MT7603E - Switch: 1 LAN port (Gigabiti) - 5G/LTE: Quectel RG502Q-EA connected by USB3 to SoC - SIM: 2 micro-SIM slots under transparent cover - Buttons: Reset, WLAN under same cover - LEDs: Multicolour green/red/yellow under same cover (visible) - Power: 802.3at PoE via LAN port The device is built as an outdoor ethernet to 5G/LTE bridge or router. The Wifi interface is intended for installation and/or temporary management purposes only. UART Serial: 57600N1 Located on populated 5 pin header J5: [o] GND [ ] key - no pin [o] RX [o] TX [o] 3.3V Vcc Remove the SIM/button/LED cover, the WLAN button and 12 screws holding the back plate and antenna cover together. The GPS antenna is fixed to the cover, so be careful with the cable. Remove 4 screws fixing the antenna board to the main board, again being careful with the cables. A bluetooth TTL adapter is recommended for permanent console access, to keep the router water and dustproof. The 3.3V pin is able to power such an adapter. MAC addresses: OpenWrt OEM Address Found as lan eth2 08:26:97:*:*:BC Factory 0xe000 (hex), label wlan0 ra0 08:26:97:*:*:BD Factory 0x4 (hex) wwan0 usb0 random WARNING!! ISP managed firmware might at any time update itself to a version where all known workarounds have been disabled. Never boot an ISP managed firmware with a SIM in any of the slots if you intend to use the router with OpenWrt. The bootloader lock can only be disabled with root access to running firmware. The flash chip is physically inaccessible without soldering. Installation from OEM web GUI: - Log in as "supervisor" on https://172.17.1.1/ - Upload OpenWrt initramfs-recovery.bin image on the Maintenance -> Firmware page - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - (optional) Copy OpenWrt to the recovery partition. See below - Sysupgrade to the OpenWrt sysupgrade image and reboot Installation from OEM ssh: - Log in as "root" on 172.17.1.1 port 22022 - scp OpenWrt initramfs-recovery.bin image to 172.17.1.1:/tmp - Prepare bootloader config by running: nvram setro uboot DebugFlag 0x1 nvram setro uboot CheckBypass 0 nvram commit - Run "mtd_write -w write initramfs-recovery.bin Kernel" and reboot - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - (optional) Copy OpenWrt to the recovery partition. See below - Sysupgrade to the OpenWrt sysupgrade image and reboot Copying OpenWrt to the recovery partition: - Verify that you are running a working OpenWrt recovery image from flash - ssh to root@192.168.1.1 and run: fw_setenv CheckBypass 0 mtd -r erase Kernel2 - Wait while the bootloader mirrors Image1 to Image2 NOTE: This should only be done after successfully booting the OpenWrt recovery image from the primary partition during installation. Do not do this after having sysupgraded OpenWrt! Reinstalling the recovery image on normal upgrades is not required or recommended. Installation from Z-Loader: - Halt boot by pressing Escape on console - Set up a tftp server to serve the OpenWrt initramfs-recovery.bin image at 10.10.10.3 - Type "ATNR 1,initramfs-recovery.bin" at the "ZLB>" prompt - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - Sysupgrade to the OpenWrt sysupgrade image NOTE: ATNR will write the recovery image to both primary and recovery partitions in one go. Booting from RAM: - Halt boot by pressing Escape on console - Type "ATGU" at the "ZLB>" prompt to enter the U-Boot menu - Press "4" to select "4: Entr boot command line interface." - Set up a tftp server to serve the OpenWrt initramfs-recovery.bin image at 10.10.10.3 - Load it using "tftpboot 0x88000000 initramfs-recovery.bin" - Boot with "bootm 0x8800017C" to skip the 380 (0x17C) bytes ZyXEL header This method can also be used to RAM boot OEM firmware. The warning regarding OEM applies! Never boot an unknown OEM firmware, or any OEM firmware with a SIM in any slot. NOTE: U-Boot configuration is incomplete (on some devices?). You may have to configure a working mac address before running tftp using "setenv eth0addr <mac>" Unlocking the bootloader: If you are unebale to halt boot, then the bootloader is locked. The OEM firmware locks the bootloader on every boot by setting DebugFlag to 0. Setting it to 1 is therefore only temporary when OEM firmware is installed. - Run "nvram setro uboot DebugFlag 0x1; nvram commit" in OEM firmware - Run "fw_setenv DebugFlag 0x1" in OpenWrt NOTE: OpenWrt does this automatically on first boot if necessary NOTE2: Setting the flag to 0x1 avoids the reset to 0 in known OEM versions, but this might change. WARNING: Writing anything to flash while the bootloader is locked is considered extremely risky. Errors might cause a permanent brick! Enabling management access from LAN: Temporary workaround to allow installing OpenWrt if OEM firmware has disabled LAN management: - Connect to console - Log in as "root" - Run "iptables -I INPUT -i br0 -j ACCEPT" Notes on the OEM/bootloader dual partition scheme The dual partition scheme on this device uses Image2 as a recovery image only. The device will always boot from Image1, but the bootloader might copy Image2 to Image1 under specific conditions. This scheme prevents repurposing of the space occupied by Image2 in any useful way. Validation of primary and recovery images is controlled by the variables CheckBypass, Image1Stable, and Image1Try. The bootloader sets CheckBypass to 0 and reboots if Image1 fails validation. If CheckBypass is 0 and Image1 is invalid then Image2 is copied to Image1. If CheckBypass is 0 and Image2 is invalid, then Image1 is copied to Image2. If CheckBypass is 1 then all tests are skipped and Image1 is booted unconditionally. CheckBypass is set to 1 after each successful validation of Image1. Image1Try is incremented if Image1Stable is 0, and Image2 is copied to Image1 if Image1Try is 3 or larger. But the bootloader only tests Image1Try if CheckBypass is 0, which is impossible unless the booted image sets it to 0 before failing. The system is therefore not resilient against runtime errors like failure to mount the rootfs, unless the kernel image sets CheckBypass to 0 before failing. This is not yet implemented in OpenWrt. Setting Image1Stable to 1 prevents the bootloader from updating Image1Try on every boot, saving unnecessary writes to the environment partition. Keeping an OpenWrt initramfs recovery as Image2 is recommended primarily to avoid unwanted OEM firmware boots on failure. Ref the warning above. It enables console-less recovery in case of some failures to boot from Image1. Signed-off-by: Bjørn Mork <bjorn@mork.no>
2021-04-19 11:00:56 +00:00
define Build/zytrx-header
$(eval board=$(word 1,$(1)))
$(eval version=$(word 2,$(1)))
$(STAGING_DIR_HOST)/bin/zytrx -B '$(board)' -v '$(version)' -i $@ -o $@.new
mv $@.new $@
endef
ramips: add support for ZyXEL NWA50AX / NWA55AXE Hardware -------- CPU: Mediatek MT7621 RAM: 256M DDR3 FLASH: 128M NAND ETH: 1x Gigabit Ethernet WiFi: Mediatek MT7915 (2.4/5GHz 802.11ax 2x2 DBDC) BTN: 1x Reset (NWA50AX only) LED: 1x Multi-Color (NWA50AX only) UART Console ------------ NWA50AX: Available below the rubber cover next to the ethernet port. NWA55AXE: Available on the board when disassembling the device. Settings: 115200 8N1 Layout: <12V> <LAN> GND-RX-TX-VCC Logic-Level is 3V3. Don't connect VCC to your UART adapter! Installation Web-UI ------------------- Upload the Factory image using the devices Web-Interface. As the device uses a dual-image partition layout, OpenWrt can only installed on Slot A. This requires the current active image prior flashing the device to be on Slot B. If the currently installed image is started from Slot A, the device will flash OpenWrt to Slot B. OpenWrt will panic upon first boot in this case and the device will return to the ZyXEL firmware upon next boot. If this happens, first install a ZyXEL firmware upgrade of any version and install OpenWrt after that. Installation TFTP ----------------- This installation routine is especially useful in case * unknown device password (NWA55AXE lacks reset button) * bricked device Attach to the UART console header of the device. Interrupt the boot procedure by pressing Enter. The bootloader has a reduced command-set available from CLI, but more commands can be executed by abusing the atns command. Boot a OpenWrt initramfs image available on a TFTP server at 192.168.1.66. Rename the image to owrt.bin $ atnf owrt.bin $ atna 192.168.1.88 $ atns "192.168.1.66; tftpboot; bootm" Upon booting, set the booted image to the correct slot: $ zyxel-bootconfig /dev/mtd10 get-status $ zyxel-bootconfig /dev/mtd10 set-image-status 0 valid $ zyxel-bootconfig /dev/mtd10 set-active-image 0 Copy the OpenWrt ramboot-factory image to the device using scp. Write the factory image to NAND and reboot the device. $ mtd write ramboot-factory.bin firmware $ reboot Signed-off-by: David Bauer <mail@david-bauer.net>
2022-05-27 15:48:06 +00:00
define Build/zyxel-nwa-fit
$(TOPDIR)/scripts/mkits-zyxel-fit.sh \
$@.its $@ "6b e1 6f e1 ff ff ff ff ff ff"
PATH=$(LINUX_DIR)/scripts/dtc:$(PATH) mkimage -f $@.its $@.new
@mv $@.new $@
endef
define Device/dsa-migration
DEVICE_COMPAT_VERSION := 1.1
DEVICE_COMPAT_MESSAGE := Config cannot be migrated from swconfig to DSA
endef
define Device/nand
$(Device/dsa-migration)
BLOCKSIZE := 128k
KERNEL_SIZE := 4096k
PAGESIZE := 2048
UBINIZE_OPTS := -E 5
IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
endef
define Device/adslr_g7
$(Device/dsa-migration)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := ADSLR
DEVICE_MODEL := G7
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
endef
TARGET_DEVICES += adslr_g7
define Device/afoundry_ew1200
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := AFOUNDRY
DEVICE_MODEL := EW1200
DEVICE_PACKAGES := kmod-ata-ahci kmod-mt76x2 kmod-mt7603 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
SUPPORTED_DEVICES += ew1200
endef
TARGET_DEVICES += afoundry_ew1200
ramips: add support for ALFA Network Quad-E4G ALFA Network Quad-E4G is a universal Wi-Fi/4G platform, which offers three miniPCIe (PCIe, USB 2.0, SIM) and a single M.2 B-key (dual-SIM, USB 3.0) slots, RTC and five Gigabit Ethernet ports with PoE support. Specification: - MT7621A (880 MHz) - 256/512 MB of RAM (DDR3) - 16/32+ MB of FLASH (SPI NOR) - optional second SPI flash (8-pin WSON/SOIC) - 1x microSD (SDXC) flash card reader - 5x 10/100/100 Mbps Ethernet, with passive PoE support (24 V) in LAN1 - optional 802.3at/af PoE module for WAN - 3x miniPCIe slot (with PCIe and USB 2.0 buses, micro SIM and 5 V) - 1x M.2/NGFF B-key 3042 (USB 3.0/2.0, mini + micro SIM) - RTC (TI BQ32002, I2C bus) with backup battery (CR2032) - external hardware watchdog (EM Microelectronic EM6324) - 1x USB 2.0 Type-A - 1x micro USB Type-B for system serial console (Holtek HT42B534) - 11x LED (5 for Ethernet, 5 driven by GPIO, 1x power indicator) - 3x button (reset, user1, user2) - 1x I2C (4-pin, 2.54 mm pitch) header on PCB - 4x SIM (6-pin, 2.00 mm pitch) headers on PCB - 2x UART2/3 (4-pin, 2.54 mm pitch) headers on PCB - 1x mechanical power switch - 1x DC jack with lock (24 V) Other: - U-Boot selects default SIM slot, based on value of 'default_sim' env variable: '1' or unset -> SIM1 (mini), '2' -> SIM2 (micro). This board has additional logic circuit for M.2 SIM switching. The 'sim-select' will work only if both SIM slots are occupied. Otherwise, always slot with SIM inside is selected, no matter 'sim-select' value. - U-Boot enables power in all three miniPCIe and M.2 slots before loading the kernel - this board supports 'dual image' feature (controlled by 'dual_image' U-Boot environment variable) - all three miniPCIe slots have additional 5 V supply on pins 47 and 49 - the board allows to install up to two oversized miniPCIe cards (vendor has dedicated MediaTek MT7615N/D cards for this board) - this board has additional logic circuit controlling PERSTn pins inside miniPCIe slots. By default, PERSTn (GPIO19) is routed to all miniPCIe slots but setting GPIO22 to high allows PERSTn control per slot, using GPIO23-25 (value is inverted) You can use the 'sysupgrade' image directly in vendor firmware which is based on OpenWrt (make sure to not preserve settings - use 'sysupgrade -n -F ...' command). Alternatively, use web recovery mode in U-Boot: 1. Power the device with reset button pressed, the modem LED will start blinking slowly and after ~3 seconds, when it starts blinking faster, you can release the button. 2. Setup static IP 192.168.1.2/24 on your PC. 3. Go to 192.168.1.1 in browser and upload 'sysupgrade' image. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2019-11-03 11:12:44 +00:00
define Device/alfa-network_quad-e4g
$(Device/dsa-migration)
ramips: add support for ALFA Network Quad-E4G ALFA Network Quad-E4G is a universal Wi-Fi/4G platform, which offers three miniPCIe (PCIe, USB 2.0, SIM) and a single M.2 B-key (dual-SIM, USB 3.0) slots, RTC and five Gigabit Ethernet ports with PoE support. Specification: - MT7621A (880 MHz) - 256/512 MB of RAM (DDR3) - 16/32+ MB of FLASH (SPI NOR) - optional second SPI flash (8-pin WSON/SOIC) - 1x microSD (SDXC) flash card reader - 5x 10/100/100 Mbps Ethernet, with passive PoE support (24 V) in LAN1 - optional 802.3at/af PoE module for WAN - 3x miniPCIe slot (with PCIe and USB 2.0 buses, micro SIM and 5 V) - 1x M.2/NGFF B-key 3042 (USB 3.0/2.0, mini + micro SIM) - RTC (TI BQ32002, I2C bus) with backup battery (CR2032) - external hardware watchdog (EM Microelectronic EM6324) - 1x USB 2.0 Type-A - 1x micro USB Type-B for system serial console (Holtek HT42B534) - 11x LED (5 for Ethernet, 5 driven by GPIO, 1x power indicator) - 3x button (reset, user1, user2) - 1x I2C (4-pin, 2.54 mm pitch) header on PCB - 4x SIM (6-pin, 2.00 mm pitch) headers on PCB - 2x UART2/3 (4-pin, 2.54 mm pitch) headers on PCB - 1x mechanical power switch - 1x DC jack with lock (24 V) Other: - U-Boot selects default SIM slot, based on value of 'default_sim' env variable: '1' or unset -> SIM1 (mini), '2' -> SIM2 (micro). This board has additional logic circuit for M.2 SIM switching. The 'sim-select' will work only if both SIM slots are occupied. Otherwise, always slot with SIM inside is selected, no matter 'sim-select' value. - U-Boot enables power in all three miniPCIe and M.2 slots before loading the kernel - this board supports 'dual image' feature (controlled by 'dual_image' U-Boot environment variable) - all three miniPCIe slots have additional 5 V supply on pins 47 and 49 - the board allows to install up to two oversized miniPCIe cards (vendor has dedicated MediaTek MT7615N/D cards for this board) - this board has additional logic circuit controlling PERSTn pins inside miniPCIe slots. By default, PERSTn (GPIO19) is routed to all miniPCIe slots but setting GPIO22 to high allows PERSTn control per slot, using GPIO23-25 (value is inverted) You can use the 'sysupgrade' image directly in vendor firmware which is based on OpenWrt (make sure to not preserve settings - use 'sysupgrade -n -F ...' command). Alternatively, use web recovery mode in U-Boot: 1. Power the device with reset button pressed, the modem LED will start blinking slowly and after ~3 seconds, when it starts blinking faster, you can release the button. 2. Setup static IP 192.168.1.2/24 on your PC. 3. Go to 192.168.1.1 in browser and upload 'sysupgrade' image. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2019-11-03 11:12:44 +00:00
IMAGE_SIZE := 16064k
DEVICE_VENDOR := ALFA Network
DEVICE_MODEL := Quad-E4G
DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-usb3 \
-wpad-basic-mbedtls
SUPPORTED_DEVICES += quad-e4g
ramips: add support for ALFA Network Quad-E4G ALFA Network Quad-E4G is a universal Wi-Fi/4G platform, which offers three miniPCIe (PCIe, USB 2.0, SIM) and a single M.2 B-key (dual-SIM, USB 3.0) slots, RTC and five Gigabit Ethernet ports with PoE support. Specification: - MT7621A (880 MHz) - 256/512 MB of RAM (DDR3) - 16/32+ MB of FLASH (SPI NOR) - optional second SPI flash (8-pin WSON/SOIC) - 1x microSD (SDXC) flash card reader - 5x 10/100/100 Mbps Ethernet, with passive PoE support (24 V) in LAN1 - optional 802.3at/af PoE module for WAN - 3x miniPCIe slot (with PCIe and USB 2.0 buses, micro SIM and 5 V) - 1x M.2/NGFF B-key 3042 (USB 3.0/2.0, mini + micro SIM) - RTC (TI BQ32002, I2C bus) with backup battery (CR2032) - external hardware watchdog (EM Microelectronic EM6324) - 1x USB 2.0 Type-A - 1x micro USB Type-B for system serial console (Holtek HT42B534) - 11x LED (5 for Ethernet, 5 driven by GPIO, 1x power indicator) - 3x button (reset, user1, user2) - 1x I2C (4-pin, 2.54 mm pitch) header on PCB - 4x SIM (6-pin, 2.00 mm pitch) headers on PCB - 2x UART2/3 (4-pin, 2.54 mm pitch) headers on PCB - 1x mechanical power switch - 1x DC jack with lock (24 V) Other: - U-Boot selects default SIM slot, based on value of 'default_sim' env variable: '1' or unset -> SIM1 (mini), '2' -> SIM2 (micro). This board has additional logic circuit for M.2 SIM switching. The 'sim-select' will work only if both SIM slots are occupied. Otherwise, always slot with SIM inside is selected, no matter 'sim-select' value. - U-Boot enables power in all three miniPCIe and M.2 slots before loading the kernel - this board supports 'dual image' feature (controlled by 'dual_image' U-Boot environment variable) - all three miniPCIe slots have additional 5 V supply on pins 47 and 49 - the board allows to install up to two oversized miniPCIe cards (vendor has dedicated MediaTek MT7615N/D cards for this board) - this board has additional logic circuit controlling PERSTn pins inside miniPCIe slots. By default, PERSTn (GPIO19) is routed to all miniPCIe slots but setting GPIO22 to high allows PERSTn control per slot, using GPIO23-25 (value is inverted) You can use the 'sysupgrade' image directly in vendor firmware which is based on OpenWrt (make sure to not preserve settings - use 'sysupgrade -n -F ...' command). Alternatively, use web recovery mode in U-Boot: 1. Power the device with reset button pressed, the modem LED will start blinking slowly and after ~3 seconds, when it starts blinking faster, you can release the button. 2. Setup static IP 192.168.1.2/24 on your PC. 3. Go to 192.168.1.1 in browser and upload 'sysupgrade' image. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2019-11-03 11:12:44 +00:00
endef
TARGET_DEVICES += alfa-network_quad-e4g
ramips: add support for Amped Wireless ALLY router and extender Amped Wireless ALLY is a whole-home WiFi kit, with a router (model ALLY-R1900K) and an Extender (model ALLY-00X19K). Both are devices are 11ac and based on MediaTek MT7621AT and MT7615N chips. The units are nearly identical, except the Extender lacks a USB port and has a single Ethernet port. Specification: - SoC: MediaTek MT7621AT (2C/4T) @ 880MHz - RAM: 128MB DDR3 (Nanya NT5CC64M16GP-DI) - FLASH: 128MB NAND (Winbond W29N01GVSIAA) - WiFi: 2.4/5 GHz 4T4R - 2.4GHz MediaTek MT7615N bgn - 5GHz MediaTek MT7615N nac - Switch: SoC integrated Gigabit Switch - USB: 1x USB3 (Router only) - BTN: Reset, WPS - LED: single RGB - UART: through-hole on PCB. J1: pin1 (square pad, towards rear)=3.3V, pin2=RX, pin3=GND, pin4=TX. Settings: 57600/8N1. Note regarding dual system partitions ------------------------------------- The vendor firmware and boot loader use a dual partition scheme. The boot partition is decided by the bootImage U-boot environment variable: 0 for the 1st partition, 1 for the 2nd. OpenWrt does not support this scheme and will always use the first OS partition. It will set bootImage to 0 during installation, making sure the first partition is selected by the boot loader. Also, because we can't be sure which partition is active to begin with, a 2-step flash process is used. We first flash an initramfs image, then follow with a regular sysupgrade. Installation: Router (ALLY-R1900K) 1) Install the flashable initramfs image via the OEM web-interface. (Alternatively, you can use the TFTP recovery method below.) You can use WiFi or Ethernet. The direct URL is: http://192.168.3.1/07_06_00_firmware.html a. No login is needed, and you'll be in their setup wizard. b. You might get a warning about not being connected to the Internet. c. Towards the bottom of the page will be a section entitled "Or Manually Upgrade Firmware from a File:" where you can manually choose and upload a firmware file. d: Click "Choose File", select the OpenWRT "initramfs" image and click "Upload." 2) The Router will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 3) Log into LuCI as root; there is no password. 4) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 5) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Extender (ALLY-00X19K) 1) This device requires a TFTP recovery procedure to do an initial load of OpenWRT. Start by configuring a computer as a TFTP client: a. Install a TFTP client (server not necessary) b. Configure an Ethernet interface to 192.168.1.x/24; don't use .1 or .6 c. Connect the Ethernet to the sole Ethernet port on the X19K. 2) Put the ALLY Extender in TFTP recovery mode. a. Do this by pressing and holding the reset button on the bottom while connecting the power. b. As soon as the LED lights up green (roughly 2-3 seconds), release the button. 3) Start the TFTP transfer of the Initramfs image from your setup machine. For example, from Linux: tftp -v -m binary 192.168.1.6 69 -c put initramfs.bin 4) The Extender will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 5) Log into LuCI as root; there is no password. 6) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 7) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Backup the OEM Firmware: ----------------------- There isn't any downloadable firmware for the ALLY devices on the Amped Wireless web site. Reverting back to the OEM firmware is not possible unless we have a backup of the original OEM firmware. The OEM firmware may be stored on either /dev/mtd3 ("firmware") or /dev/mtd6 ("oem"). We can't be sure which was overwritten with the initramfs image, so backup both partitions to be safe. 1) Once logged into LuCI, navigate to System -> Backup/Flash Firmware. 2) Under "Save mtdblock contents," first select "firmware" and click "Save mtdblock" to download the image. 3) Repeat the process, but select "oem" from the pull-down menu. Revert to the OEM Firmware: -------------------------- * U-boot TFTP: Follow the TFTP recovery steps for the Extender, and use the backup image. * OpenWrt "Flash Firmware" interface: Upload the backup image and select "Force update" before continuing. Signed-off-by: Jonathan Sturges <jsturges@redhat.com>
2021-06-05 12:17:42 +00:00
define Device/ampedwireless_ally_common
$(Device/nand)
ramips: add support for Amped Wireless ALLY router and extender Amped Wireless ALLY is a whole-home WiFi kit, with a router (model ALLY-R1900K) and an Extender (model ALLY-00X19K). Both are devices are 11ac and based on MediaTek MT7621AT and MT7615N chips. The units are nearly identical, except the Extender lacks a USB port and has a single Ethernet port. Specification: - SoC: MediaTek MT7621AT (2C/4T) @ 880MHz - RAM: 128MB DDR3 (Nanya NT5CC64M16GP-DI) - FLASH: 128MB NAND (Winbond W29N01GVSIAA) - WiFi: 2.4/5 GHz 4T4R - 2.4GHz MediaTek MT7615N bgn - 5GHz MediaTek MT7615N nac - Switch: SoC integrated Gigabit Switch - USB: 1x USB3 (Router only) - BTN: Reset, WPS - LED: single RGB - UART: through-hole on PCB. J1: pin1 (square pad, towards rear)=3.3V, pin2=RX, pin3=GND, pin4=TX. Settings: 57600/8N1. Note regarding dual system partitions ------------------------------------- The vendor firmware and boot loader use a dual partition scheme. The boot partition is decided by the bootImage U-boot environment variable: 0 for the 1st partition, 1 for the 2nd. OpenWrt does not support this scheme and will always use the first OS partition. It will set bootImage to 0 during installation, making sure the first partition is selected by the boot loader. Also, because we can't be sure which partition is active to begin with, a 2-step flash process is used. We first flash an initramfs image, then follow with a regular sysupgrade. Installation: Router (ALLY-R1900K) 1) Install the flashable initramfs image via the OEM web-interface. (Alternatively, you can use the TFTP recovery method below.) You can use WiFi or Ethernet. The direct URL is: http://192.168.3.1/07_06_00_firmware.html a. No login is needed, and you'll be in their setup wizard. b. You might get a warning about not being connected to the Internet. c. Towards the bottom of the page will be a section entitled "Or Manually Upgrade Firmware from a File:" where you can manually choose and upload a firmware file. d: Click "Choose File", select the OpenWRT "initramfs" image and click "Upload." 2) The Router will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 3) Log into LuCI as root; there is no password. 4) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 5) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Extender (ALLY-00X19K) 1) This device requires a TFTP recovery procedure to do an initial load of OpenWRT. Start by configuring a computer as a TFTP client: a. Install a TFTP client (server not necessary) b. Configure an Ethernet interface to 192.168.1.x/24; don't use .1 or .6 c. Connect the Ethernet to the sole Ethernet port on the X19K. 2) Put the ALLY Extender in TFTP recovery mode. a. Do this by pressing and holding the reset button on the bottom while connecting the power. b. As soon as the LED lights up green (roughly 2-3 seconds), release the button. 3) Start the TFTP transfer of the Initramfs image from your setup machine. For example, from Linux: tftp -v -m binary 192.168.1.6 69 -c put initramfs.bin 4) The Extender will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 5) Log into LuCI as root; there is no password. 6) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 7) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Backup the OEM Firmware: ----------------------- There isn't any downloadable firmware for the ALLY devices on the Amped Wireless web site. Reverting back to the OEM firmware is not possible unless we have a backup of the original OEM firmware. The OEM firmware may be stored on either /dev/mtd3 ("firmware") or /dev/mtd6 ("oem"). We can't be sure which was overwritten with the initramfs image, so backup both partitions to be safe. 1) Once logged into LuCI, navigate to System -> Backup/Flash Firmware. 2) Under "Save mtdblock contents," first select "firmware" and click "Save mtdblock" to download the image. 3) Repeat the process, but select "oem" from the pull-down menu. Revert to the OEM Firmware: -------------------------- * U-boot TFTP: Follow the TFTP recovery steps for the Extender, and use the backup image. * OpenWrt "Flash Firmware" interface: Upload the backup image and select "Force update" before continuing. Signed-off-by: Jonathan Sturges <jsturges@redhat.com>
2021-06-05 12:17:42 +00:00
DEVICE_VENDOR := Amped Wireless
DEVICE_PACKAGES := kmod-mt7615-firmware
ramips: add support for Amped Wireless ALLY router and extender Amped Wireless ALLY is a whole-home WiFi kit, with a router (model ALLY-R1900K) and an Extender (model ALLY-00X19K). Both are devices are 11ac and based on MediaTek MT7621AT and MT7615N chips. The units are nearly identical, except the Extender lacks a USB port and has a single Ethernet port. Specification: - SoC: MediaTek MT7621AT (2C/4T) @ 880MHz - RAM: 128MB DDR3 (Nanya NT5CC64M16GP-DI) - FLASH: 128MB NAND (Winbond W29N01GVSIAA) - WiFi: 2.4/5 GHz 4T4R - 2.4GHz MediaTek MT7615N bgn - 5GHz MediaTek MT7615N nac - Switch: SoC integrated Gigabit Switch - USB: 1x USB3 (Router only) - BTN: Reset, WPS - LED: single RGB - UART: through-hole on PCB. J1: pin1 (square pad, towards rear)=3.3V, pin2=RX, pin3=GND, pin4=TX. Settings: 57600/8N1. Note regarding dual system partitions ------------------------------------- The vendor firmware and boot loader use a dual partition scheme. The boot partition is decided by the bootImage U-boot environment variable: 0 for the 1st partition, 1 for the 2nd. OpenWrt does not support this scheme and will always use the first OS partition. It will set bootImage to 0 during installation, making sure the first partition is selected by the boot loader. Also, because we can't be sure which partition is active to begin with, a 2-step flash process is used. We first flash an initramfs image, then follow with a regular sysupgrade. Installation: Router (ALLY-R1900K) 1) Install the flashable initramfs image via the OEM web-interface. (Alternatively, you can use the TFTP recovery method below.) You can use WiFi or Ethernet. The direct URL is: http://192.168.3.1/07_06_00_firmware.html a. No login is needed, and you'll be in their setup wizard. b. You might get a warning about not being connected to the Internet. c. Towards the bottom of the page will be a section entitled "Or Manually Upgrade Firmware from a File:" where you can manually choose and upload a firmware file. d: Click "Choose File", select the OpenWRT "initramfs" image and click "Upload." 2) The Router will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 3) Log into LuCI as root; there is no password. 4) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 5) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Extender (ALLY-00X19K) 1) This device requires a TFTP recovery procedure to do an initial load of OpenWRT. Start by configuring a computer as a TFTP client: a. Install a TFTP client (server not necessary) b. Configure an Ethernet interface to 192.168.1.x/24; don't use .1 or .6 c. Connect the Ethernet to the sole Ethernet port on the X19K. 2) Put the ALLY Extender in TFTP recovery mode. a. Do this by pressing and holding the reset button on the bottom while connecting the power. b. As soon as the LED lights up green (roughly 2-3 seconds), release the button. 3) Start the TFTP transfer of the Initramfs image from your setup machine. For example, from Linux: tftp -v -m binary 192.168.1.6 69 -c put initramfs.bin 4) The Extender will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 5) Log into LuCI as root; there is no password. 6) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 7) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Backup the OEM Firmware: ----------------------- There isn't any downloadable firmware for the ALLY devices on the Amped Wireless web site. Reverting back to the OEM firmware is not possible unless we have a backup of the original OEM firmware. The OEM firmware may be stored on either /dev/mtd3 ("firmware") or /dev/mtd6 ("oem"). We can't be sure which was overwritten with the initramfs image, so backup both partitions to be safe. 1) Once logged into LuCI, navigate to System -> Backup/Flash Firmware. 2) Under "Save mtdblock contents," first select "firmware" and click "Save mtdblock" to download the image. 3) Repeat the process, but select "oem" from the pull-down menu. Revert to the OEM Firmware: -------------------------- * U-boot TFTP: Follow the TFTP recovery steps for the Extender, and use the backup image. * OpenWrt "Flash Firmware" interface: Upload the backup image and select "Force update" before continuing. Signed-off-by: Jonathan Sturges <jsturges@redhat.com>
2021-06-05 12:17:42 +00:00
IMAGE_SIZE := 32768k
KERNEL_INITRAMFS := $(KERNEL_DTB) | uImage lzma -n 'flashable-initramfs' |\
edimax-header -s CSYS -m RN68 -f 0x001c0000 -S 0x01100000
endef
define Device/ampedwireless_ally-r1900k
$(Device/ampedwireless_ally_common)
DEVICE_MODEL := ALLY-R1900K
DEVICE_PACKAGES += kmod-usb3
endef
TARGET_DEVICES += ampedwireless_ally-r1900k
define Device/ampedwireless_ally-00x19k
$(Device/ampedwireless_ally_common)
DEVICE_MODEL := ALLY-00X19K
endef
TARGET_DEVICES += ampedwireless_ally-00x19k
ramips: mt7621: Add Arcadyan WE420223-99 support The Arcadyan WE420223-99 is a WiFi AC simultaneous dual-band access point distributed as Experia WiFi by KPN in the Netherlands. It features two ethernet ports and 2 internal antennas. Specifications -------------- SOC : Mediatek MT7621AT ETH : Two 1 gigabit ports, built into the SOC WIFI : MT7615DN BUTTON: Reset BUTTON: WPS LED : Power (green+red) LED : WiFi (green+blue) LED : WPS (green+red) LED : Followme (green+red) Power : 12 VDC, 1A barrel plug Winbond variant: RAM : Winbond W631GG6MB12J, 1GBIT DDR3 SDRAM Flash : Winbond W25Q256JVFQ, 256Mb SPI U-Boot: 1.1.3 (Nov 23 2017 - 16:40:17), Ralink 5.0.0.1 Macronix variant: RAM : Nanya NT5CC64M16GP-DI, 1GBIT DDR3 SDRAM Flash : MX25l25635FMI-10G, 256Mb SPI U-Boot: 1.1.3 (Dec 4 2017 - 11:37:57), Ralink 5.0.0.1 Serial ------ The serial port needs a TTL/RS-232 3V3 level converter! The Serial setting is 57600-8-N-1. The board has an unpopulated 2.54mm straight pin header. The pinout is: VCC (the square), RX, TX, GND. Installation ------------ See the Wiki page [1] for more details, it comes down to: 1. Open the device, take off the heat sink 2. Connect the SPI flash chip to a flasher, e.g. a Raspberry Pi. Also connect the RESET pin for stability (thanks @FPSUsername for reporting) 3. Make a backup in case you want to revert to stock later 4. Flash the squashfs-factory.trx file to offset 0x50000 of the flash 5. Ensure the bootpartition variable is set to 0 in the U-Boot environment located at 0x30000 Note that the U-Boot is password protected, this can optionally be removed. See the forum [2] for more details. MAC Addresses(stock) -------------------- +----------+------------------+-------------------+ | use | address | example | +----------+------------------+-------------------+ | Device | label | 00:00:00:11:00:00 | | Ethernet | + 3 | 00:00:00:11:00:03 | | 2g | + 0x020000f00001 | 02:00:00:01:00:01 | | 5g | + 1 | 00:00:00:11:00:01 | +----------+------------------+-------------------+ The label address is stored in ASCII in the board_data partition Notes ----- - This device has a dual-boot partition scheme, but OpenWRT will claim both partitions for more storage space. Known issues ------------ - 2g MAC address does not match stock due to missing support for that in macaddr_add - Only the power LED is configured by default References ---------- [1] https://openwrt.org/inbox/toh/arcadyan/astoria/we420223-99 [2] https://forum.openwrt.org/t/adding-openwrt-support-for-arcadyan-we420223-99-kpn-experia-wifi/132653 Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com> Signed-off-by: Harm Berntsen <git@harmberntsen.nl>
2023-01-08 16:03:25 +00:00
define Device/arcadyan_we420223-99
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := Arcadyan
DEVICE_MODEL := WE420223-99
DEVICE_ALT0_VENDOR := KPN
DEVICE_ALT0_MODEL := Experia WiFi
IMAGE_SIZE := 32128k
KERNEL_SIZE := 4352k
UBINIZE_OPTS := -E 5
PAGESIZE := 1
SUBPAGESIZE := 1
VID_HDR_OFFSET := 64
KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | \
uImage none | arcadyan-trx 0x746f435d
KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | \
uImage none
IMAGES += factory.trx
IMAGE/factory.trx := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | check-size
IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
ramips: mt7621: Add Arcadyan WE420223-99 support The Arcadyan WE420223-99 is a WiFi AC simultaneous dual-band access point distributed as Experia WiFi by KPN in the Netherlands. It features two ethernet ports and 2 internal antennas. Specifications -------------- SOC : Mediatek MT7621AT ETH : Two 1 gigabit ports, built into the SOC WIFI : MT7615DN BUTTON: Reset BUTTON: WPS LED : Power (green+red) LED : WiFi (green+blue) LED : WPS (green+red) LED : Followme (green+red) Power : 12 VDC, 1A barrel plug Winbond variant: RAM : Winbond W631GG6MB12J, 1GBIT DDR3 SDRAM Flash : Winbond W25Q256JVFQ, 256Mb SPI U-Boot: 1.1.3 (Nov 23 2017 - 16:40:17), Ralink 5.0.0.1 Macronix variant: RAM : Nanya NT5CC64M16GP-DI, 1GBIT DDR3 SDRAM Flash : MX25l25635FMI-10G, 256Mb SPI U-Boot: 1.1.3 (Dec 4 2017 - 11:37:57), Ralink 5.0.0.1 Serial ------ The serial port needs a TTL/RS-232 3V3 level converter! The Serial setting is 57600-8-N-1. The board has an unpopulated 2.54mm straight pin header. The pinout is: VCC (the square), RX, TX, GND. Installation ------------ See the Wiki page [1] for more details, it comes down to: 1. Open the device, take off the heat sink 2. Connect the SPI flash chip to a flasher, e.g. a Raspberry Pi. Also connect the RESET pin for stability (thanks @FPSUsername for reporting) 3. Make a backup in case you want to revert to stock later 4. Flash the squashfs-factory.trx file to offset 0x50000 of the flash 5. Ensure the bootpartition variable is set to 0 in the U-Boot environment located at 0x30000 Note that the U-Boot is password protected, this can optionally be removed. See the forum [2] for more details. MAC Addresses(stock) -------------------- +----------+------------------+-------------------+ | use | address | example | +----------+------------------+-------------------+ | Device | label | 00:00:00:11:00:00 | | Ethernet | + 3 | 00:00:00:11:00:03 | | 2g | + 0x020000f00001 | 02:00:00:01:00:01 | | 5g | + 1 | 00:00:00:11:00:01 | +----------+------------------+-------------------+ The label address is stored in ASCII in the board_data partition Notes ----- - This device has a dual-boot partition scheme, but OpenWRT will claim both partitions for more storage space. Known issues ------------ - 2g MAC address does not match stock due to missing support for that in macaddr_add - Only the power LED is configured by default References ---------- [1] https://openwrt.org/inbox/toh/arcadyan/astoria/we420223-99 [2] https://forum.openwrt.org/t/adding-openwrt-support-for-arcadyan-we420223-99-kpn-experia-wifi/132653 Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com> Signed-off-by: Harm Berntsen <git@harmberntsen.nl>
2023-01-08 16:03:25 +00:00
endef
TARGET_DEVICES += arcadyan_we420223-99
define Device/asiarf_ap7621-001
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
ramips/mt7621: fix IMAGE_SIZE for all devices This fixes IMAGE_SIZE for all devices based on the partition size given in DTS: DEVICE *.MK *.DTS VERDICT afoundry_ew1200 (16M) 0xfb0000 asiarf_ap7621-001 (16M) 0xfa0000 wrong buffalo_wsr-1166dhp (16M) 0xf90000 wrong buffalo_wsr-600dhp (16M) 0xfb0000 dlink_dir-860l-b1 (16M) 0xfb0000 d-team_newifi-d2 (32M) 0x1fb0000 d-team_pbr-m1 (16M) 0xfb0000 elecom_wrc-1167ghbk2-s 15488k 0xf20000 elecom_wrc-1900gst 11264k 0xb00000 elecom_wrc-2533gst 11264k 0xb00000 firefly_firewrt (16M) 0xfb0000 gehua_ghl-r-001 (32M) 0x1fb0000 gnubee_gb-pc1 (32M) 0x1fb0000 gnubee_gb-pc2 (32M) 0x1fb0000 hiwifi_hc5962 (32M) 0x2000000 wrong (kernel + ubi) iodata_wn-ax1167gr 15552k 0xf30000 iodata_wn-gx300gr 7798784 0x770000 lenovo_newifi-d1 (32M) 0x1fb0000 linksys_re6500 - 0x7b0000 default mediatek_ap-mt7621a-v60 (8M) 0x7b0000 mediatek_mt7621-eval-board (4M) 0xec0000 wrong (rootfs) mikrotik_rb750gr3 [16128k] 0xfc0000 mikrotik_rbm11g [16128k] 0xFC0000 mikrotik_rbm33g [16128k] 0xFC0000 mqmaker_witi-256m (16M) 0xfb0000 mqmaker_witi-512m (16M) 0xfb0000 mtc_wr1201 16000k 0xfa0000 netgear_ex6150 14848k 0xe80000 netgear_r6220 28672k 0x1c00000 netgear_r6350 40960k 0x2800000 netgear_wndr3700-v5 15232k 0xee0000 netis_wf-2881 129280k 0x7E40000 phicomm_k2p 15744k 0xf60000 planex_vr500 66453504 0x3fb0000 wrong samknows_whitebox-v8 (16M) 0xfb0000 storylink_sap-g3200u3 - 0x7b0000 default telco-electronics_x1 16064k 0xfb0000 thunder_timecloud - 0xfb0000 wrong totolink_a7000r 16064k 0xfb0000 tplink_re350-v1 6016k 0x5e0000 ubiquiti_edgerouterx - 0xfa00000 wrong (kernel1 + ubi) ubiquiti_edgerouterx-sfp - 0xfa00000 wrong (kernel1 + ubi) unielec_u7621-06-256m-16m 16064k 0xfb0000 unielec_u7621-06-512m-64m 65216k 0x3fb0000 wevo_11acnas (16M) 0xfb0000 wevo_w2914ns-v2 (16M) 0xfb0000 xiaomi_mir3g 32768k 0x7980000 wrong (kernel + ubi) xiaomi_mir3p (32M) 0xf980000 wrong (kernel + ubi) xzwifi_creativebox-v1 (32M) 0x1fb0000 youhua_wr1200js 16064k 0xfb0000 youku_yk-l2 (16M) 0xfb0000 zbtlink_zbt-we1326 (16M) 0xfb0000 zbtlink_zbt-we3526 (16M) 0xfb0000 zbtlink_zbt-wg2626 (16M) 0xfb0000 zbtlink_zbt-wg3526-16m (16M) 0xfb0000 zbtlink_zbt-wg3526-32m (32M) 0x1fb0000 No verdict means that the device is correctly set. Legend: ( ): Value is set via ralink_default_fw_size_xxM [ ]: Value is derived from parent definition - : Value is not set and derived from default definition Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-07-15 12:55:24 +00:00
IMAGE_SIZE := 16000k
DEVICE_VENDOR := AsiaRF
DEVICE_MODEL := AP7621-001
DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt76x2 kmod-usb3 \
-wpad-basic-mbedtls -uboot-envtools
endef
TARGET_DEVICES += asiarf_ap7621-001
define Device/asiarf_ap7621-nv1
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16000k
DEVICE_VENDOR := AsiaRF
DEVICE_MODEL := AP7621-NV1
DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt76x2 kmod-usb3 \
-wpad-basic-mbedtls -uboot-envtools
endef
TARGET_DEVICES += asiarf_ap7621-nv1
define Device/asus_rp-ac56
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := ASUS
DEVICE_MODEL := RP-AC56
IMAGE_SIZE := 16000k
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 \
kmod-i2c-ralink kmod-sound-mt7620 -uboot-envtools
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | append-rootfs | pad-rootfs | check-size
IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | \
check-size | append-metadata
endef
TARGET_DEVICES += asus_rp-ac56
define Device/asus_rp-ac87
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := ASUS
DEVICE_MODEL := RP-AC87
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | append-rootfs | pad-rootfs | check-size
IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | \
check-size | append-metadata
DEVICE_PACKAGES := kmod-mt7615-firmware rssileds -uboot-envtools
endef
TARGET_DEVICES += asus_rp-ac87
define Device/asus_rt-ac57u-v1
$(Device/dsa-migration)
DEVICE_VENDOR := ASUS
DEVICE_MODEL := RT-AC57U
DEVICE_VARIANT := v1
DEVICE_ALT0_VENDOR := ASUS
DEVICE_ALT0_MODEL := RT-AC1200GU
IMAGE_SIZE := 16064k
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport
SUPPORTED_DEVICES += asus,rt-ac57u
endef
TARGET_DEVICES += asus_rt-ac57u-v1
define Device/asus_rt-ac65p
$(Device/nand)
DEVICE_VENDOR := ASUS
DEVICE_MODEL := RT-AC65P
IMAGE_SIZE := 51200k
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
check-size
DEVICE_PACKAGES := kmod-usb3 kmod-mt7615-firmware
endef
TARGET_DEVICES += asus_rt-ac65p
define Device/asus_rt-ac85p
$(Device/nand)
DEVICE_VENDOR := ASUS
DEVICE_MODEL := RT-AC85P
IMAGE_SIZE := 51200k
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
check-size
DEVICE_PACKAGES := kmod-usb3 kmod-mt7615-firmware
endef
TARGET_DEVICES += asus_rt-ac85p
define Device/asus_rt-n56u-b1
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := ASUS
DEVICE_MODEL := RT-N56U
DEVICE_VARIANT := B1
IMAGE_SIZE := 16064k
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
endef
TARGET_DEVICES += asus_rt-n56u-b1
define Device/asus_rt-ax53u
$(Device/nand)
DEVICE_VENDOR := ASUS
DEVICE_MODEL := RT-AX53U
DEVICE_ALT0_VENDOR := ASUS
DEVICE_ALT0_MODEL := RT-AX1800U
IMAGE_SIZE := 51200k
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
check-size
DEVICE_PACKAGES := kmod-mt7915-firmware kmod-usb3 kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += asus_rt-ax53u
define Device/asus_rt-ax54
$(Device/nand)
DEVICE_VENDOR := ASUS
DEVICE_MODEL := RT-AX54
DEVICE_ALT0_VENDOR := ASUS
DEVICE_ALT0_MODEL := RT-AX54HP
DEVICE_ALT1_VENDOR := ASUS
DEVICE_ALT1_MODEL := RT-AX1800HP
DEVICE_ALT2_VENDOR := ASUS
DEVICE_ALT2_MODEL := RT-AX1800S
IMAGE_SIZE := 51200k
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
check-size
DEVICE_PACKAGES := kmod-mt7915-firmware
endef
TARGET_DEVICES += asus_rt-ax54
ramips: add support for Beeline SmartBox Flash Beeline SmartBox Flash is a wireless AC1300 (WiFi 5) router manufactured by Arcadyan company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB, Winbond W632GU6NB Flash: 128 MiB (NAND), Winbond W29N01HVSINF Wireless 2.4 GHz (MT7615DN): b/g/n, 2x2 Wireless 5 GHz (MT7615DN): a/n/ac, 2x2 Ethernet: 3xGbE (WAN, LAN1, LAN2) USB ports: 1xUSB3.0 Button: 1 (Reset/WPS) LEDs: 1 RGB LED Power: 12 VDC, 1.5 A Connector type: Barrel Bootloader: U-Boot (Ralink UBoot Version: 5.0.0.2) OEM: Arcadyan WE42022 Installation ------------ 1. Place *factory.trx on any web server (192.168.1.2 in this example) 2. Connect to the router using telnet shell (no password required) 3. Save MAC adresses to U-Boot environment: uboot_env --set --name eth2macaddr --value $(ifconfig | grep eth2 | \ awk '{print $5}') uboot_env --set --name eth3macaddr --value $(ifconfig | grep eth3 | \ awk '{print $5}') uboot_env --set --name ra0macaddr --value $(ifconfig | grep ra0 | \ awk '{print $5}') uboot_env --set --name rax0macaddr --value $(ifconfig | grep rax0 | \ awk '{print $5}') 4. Ensure that MACs were saved correctly: uboot_env --get --name eth2macaddr uboot_env --get --name eth3macaddr uboot_env --get --name ra0macaddr uboot_env --get --name rax0macaddr 5. Download and write the OpenWrt images: cd /tmp wget http://192.168.1.2/factory.trx mtd_write erase /dev/mtd4 mtd_write write factory.trx /dev/mtd4 6. Set 1st boot partition and reboot: uboot_env --set --name bootpartition --value 0 reboot Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv bootpartition 1 reboot 2. Optional step. Upgrade the stock firmware with any version to overwrite the OpenWrt in Slot 1. MAC addresses ------------- +-----------+-------------------+----------------+ | Interface | MAC | Source | +-----------+-------------------+----------------+ | label | 30:xx:xx:51:xx:09 | No MACs was | | LAN | 30:xx:xx:51:xx:09 | found on Flash | | WAN | 30:xx:xx:51:xx:06 | [1] | | WLAN_2g | 30:xx:xx:51:xx:07 | | | WLAN_5g | 32:xx:xx:41:xx:07 | | +-----------+-------------------+----------------+ [1]: a. Label wasb't found neither in factory nor in other places. b. MAC addresses are stored in encrypted partition "glbcfg". Encryption key hasn't known yet. To ensure the correct MACs in OpenWrt, a hack with saving of the MACs to u-boot-env during the installation was applied. c. Default Ralink ethernet MAC address (00:0C:43:28:80:36) was found in "Factory" 0xfff0. It's the same for all Smartbox Flash devices. OEM firmware also uses this MAC when initialazes ethernet driver. In OpenWrt we use it only as internal GMAC (eth0), all other MACs are unique. Therefore, there is no any barriers to the operation of several Smartbox Flash devices even within the same broadcast domain. Stock firmware image format --------------------------- +--------------+---------------+----------------------------------------+ | Offset | 1.0.15 | Description | +==============+===============+========================================+ | 0x0 | 5d 43 6f 74 | TRX magic "]Cot" | +--------------+---------------+----------------------------------------+ | 0x4 | 00 70 ff 00 | Length (reverse) | +--------------+---------------+----------------------------------------+ | | | htonl(~crc) from 0xc ("flag_version") | | 0x8 | 72 b3 93 16 | to "Length" | +--------------+---------------+----------------------------------------+ | 0xc | 00 00 01 00 | Flags | +--------------+---------------+----------------------------------------+ | | | Offset (reverse) of Kernel partition | | 0x10 | 1c 00 00 00 | from the start of the header | +--------------+---------------+----------------------------------------+ | | | Offset (reverse) of RootFS partition | | 0x14 | 00 00 42 00 | from the start of the header | +--------------+---------------+----------------------------------------+ | 0x18 | 00 00 00 00 | Zeroes | +--------------+---------------+----------------------------------------+ | 0x1c | 27 05 19 56 … | Kernel data + zero padding | +--------------+---------------+----------------------------------------+ | | | RootFS data (starting with "hsqs") + | | 0x420000 | 68 73 71 73 … | zero padding to "Length" | +--------------+---------------+----------------------------------------+ | | | Some signature data (format is | | | | unknown). Necessary for the fw | | "Lenght" | 00 00 00 00 … | update via oem fw web interface. | +--------------+---------------+----------------------------------------+ | "Lenght" + | | TRX magic "HDR0". U-Boot is | | 0x10c | 48 44 52 30 | checking it at every boot. | +--------------+---------------+----------------------------------------+ | | | 1.00: | | | | Zero padding to ("Lenght" + 0x23000) | | | | 1.0.12: | | | | Zero padding to ("Lenght" + 0x2a000) | | "Lenght" + | | 1.0.13, 1.0.15, 1.0.16: | | 0x110 | 00 00 00 00 | Zero padding to ("Lenght" + 0x10000) | +--------------+---------------+----------------------------------------+ Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-01-05 13:11:56 +00:00
define Device/beeline_smartbox-flash
$(Device/nand)
ramips: add support for Beeline SmartBox Flash Beeline SmartBox Flash is a wireless AC1300 (WiFi 5) router manufactured by Arcadyan company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB, Winbond W632GU6NB Flash: 128 MiB (NAND), Winbond W29N01HVSINF Wireless 2.4 GHz (MT7615DN): b/g/n, 2x2 Wireless 5 GHz (MT7615DN): a/n/ac, 2x2 Ethernet: 3xGbE (WAN, LAN1, LAN2) USB ports: 1xUSB3.0 Button: 1 (Reset/WPS) LEDs: 1 RGB LED Power: 12 VDC, 1.5 A Connector type: Barrel Bootloader: U-Boot (Ralink UBoot Version: 5.0.0.2) OEM: Arcadyan WE42022 Installation ------------ 1. Place *factory.trx on any web server (192.168.1.2 in this example) 2. Connect to the router using telnet shell (no password required) 3. Save MAC adresses to U-Boot environment: uboot_env --set --name eth2macaddr --value $(ifconfig | grep eth2 | \ awk '{print $5}') uboot_env --set --name eth3macaddr --value $(ifconfig | grep eth3 | \ awk '{print $5}') uboot_env --set --name ra0macaddr --value $(ifconfig | grep ra0 | \ awk '{print $5}') uboot_env --set --name rax0macaddr --value $(ifconfig | grep rax0 | \ awk '{print $5}') 4. Ensure that MACs were saved correctly: uboot_env --get --name eth2macaddr uboot_env --get --name eth3macaddr uboot_env --get --name ra0macaddr uboot_env --get --name rax0macaddr 5. Download and write the OpenWrt images: cd /tmp wget http://192.168.1.2/factory.trx mtd_write erase /dev/mtd4 mtd_write write factory.trx /dev/mtd4 6. Set 1st boot partition and reboot: uboot_env --set --name bootpartition --value 0 reboot Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv bootpartition 1 reboot 2. Optional step. Upgrade the stock firmware with any version to overwrite the OpenWrt in Slot 1. MAC addresses ------------- +-----------+-------------------+----------------+ | Interface | MAC | Source | +-----------+-------------------+----------------+ | label | 30:xx:xx:51:xx:09 | No MACs was | | LAN | 30:xx:xx:51:xx:09 | found on Flash | | WAN | 30:xx:xx:51:xx:06 | [1] | | WLAN_2g | 30:xx:xx:51:xx:07 | | | WLAN_5g | 32:xx:xx:41:xx:07 | | +-----------+-------------------+----------------+ [1]: a. Label wasb't found neither in factory nor in other places. b. MAC addresses are stored in encrypted partition "glbcfg". Encryption key hasn't known yet. To ensure the correct MACs in OpenWrt, a hack with saving of the MACs to u-boot-env during the installation was applied. c. Default Ralink ethernet MAC address (00:0C:43:28:80:36) was found in "Factory" 0xfff0. It's the same for all Smartbox Flash devices. OEM firmware also uses this MAC when initialazes ethernet driver. In OpenWrt we use it only as internal GMAC (eth0), all other MACs are unique. Therefore, there is no any barriers to the operation of several Smartbox Flash devices even within the same broadcast domain. Stock firmware image format --------------------------- +--------------+---------------+----------------------------------------+ | Offset | 1.0.15 | Description | +==============+===============+========================================+ | 0x0 | 5d 43 6f 74 | TRX magic "]Cot" | +--------------+---------------+----------------------------------------+ | 0x4 | 00 70 ff 00 | Length (reverse) | +--------------+---------------+----------------------------------------+ | | | htonl(~crc) from 0xc ("flag_version") | | 0x8 | 72 b3 93 16 | to "Length" | +--------------+---------------+----------------------------------------+ | 0xc | 00 00 01 00 | Flags | +--------------+---------------+----------------------------------------+ | | | Offset (reverse) of Kernel partition | | 0x10 | 1c 00 00 00 | from the start of the header | +--------------+---------------+----------------------------------------+ | | | Offset (reverse) of RootFS partition | | 0x14 | 00 00 42 00 | from the start of the header | +--------------+---------------+----------------------------------------+ | 0x18 | 00 00 00 00 | Zeroes | +--------------+---------------+----------------------------------------+ | 0x1c | 27 05 19 56 … | Kernel data + zero padding | +--------------+---------------+----------------------------------------+ | | | RootFS data (starting with "hsqs") + | | 0x420000 | 68 73 71 73 … | zero padding to "Length" | +--------------+---------------+----------------------------------------+ | | | Some signature data (format is | | | | unknown). Necessary for the fw | | "Lenght" | 00 00 00 00 … | update via oem fw web interface. | +--------------+---------------+----------------------------------------+ | "Lenght" + | | TRX magic "HDR0". U-Boot is | | 0x10c | 48 44 52 30 | checking it at every boot. | +--------------+---------------+----------------------------------------+ | | | 1.00: | | | | Zero padding to ("Lenght" + 0x23000) | | | | 1.0.12: | | | | Zero padding to ("Lenght" + 0x2a000) | | "Lenght" + | | 1.0.13, 1.0.15, 1.0.16: | | 0x110 | 00 00 00 00 | Zero padding to ("Lenght" + 0x10000) | +--------------+---------------+----------------------------------------+ Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-01-05 13:11:56 +00:00
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := Beeline
DEVICE_MODEL := SmartBox Flash
IMAGE_SIZE := 32768k
KERNEL_SIZE := 4352k
KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | \
uImage none | arcadyan-trx 0x746f435d | pad-to $$(KERNEL_SIZE)
ramips: add support for Beeline SmartBox Flash Beeline SmartBox Flash is a wireless AC1300 (WiFi 5) router manufactured by Arcadyan company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB, Winbond W632GU6NB Flash: 128 MiB (NAND), Winbond W29N01HVSINF Wireless 2.4 GHz (MT7615DN): b/g/n, 2x2 Wireless 5 GHz (MT7615DN): a/n/ac, 2x2 Ethernet: 3xGbE (WAN, LAN1, LAN2) USB ports: 1xUSB3.0 Button: 1 (Reset/WPS) LEDs: 1 RGB LED Power: 12 VDC, 1.5 A Connector type: Barrel Bootloader: U-Boot (Ralink UBoot Version: 5.0.0.2) OEM: Arcadyan WE42022 Installation ------------ 1. Place *factory.trx on any web server (192.168.1.2 in this example) 2. Connect to the router using telnet shell (no password required) 3. Save MAC adresses to U-Boot environment: uboot_env --set --name eth2macaddr --value $(ifconfig | grep eth2 | \ awk '{print $5}') uboot_env --set --name eth3macaddr --value $(ifconfig | grep eth3 | \ awk '{print $5}') uboot_env --set --name ra0macaddr --value $(ifconfig | grep ra0 | \ awk '{print $5}') uboot_env --set --name rax0macaddr --value $(ifconfig | grep rax0 | \ awk '{print $5}') 4. Ensure that MACs were saved correctly: uboot_env --get --name eth2macaddr uboot_env --get --name eth3macaddr uboot_env --get --name ra0macaddr uboot_env --get --name rax0macaddr 5. Download and write the OpenWrt images: cd /tmp wget http://192.168.1.2/factory.trx mtd_write erase /dev/mtd4 mtd_write write factory.trx /dev/mtd4 6. Set 1st boot partition and reboot: uboot_env --set --name bootpartition --value 0 reboot Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv bootpartition 1 reboot 2. Optional step. Upgrade the stock firmware with any version to overwrite the OpenWrt in Slot 1. MAC addresses ------------- +-----------+-------------------+----------------+ | Interface | MAC | Source | +-----------+-------------------+----------------+ | label | 30:xx:xx:51:xx:09 | No MACs was | | LAN | 30:xx:xx:51:xx:09 | found on Flash | | WAN | 30:xx:xx:51:xx:06 | [1] | | WLAN_2g | 30:xx:xx:51:xx:07 | | | WLAN_5g | 32:xx:xx:41:xx:07 | | +-----------+-------------------+----------------+ [1]: a. Label wasb't found neither in factory nor in other places. b. MAC addresses are stored in encrypted partition "glbcfg". Encryption key hasn't known yet. To ensure the correct MACs in OpenWrt, a hack with saving of the MACs to u-boot-env during the installation was applied. c. Default Ralink ethernet MAC address (00:0C:43:28:80:36) was found in "Factory" 0xfff0. It's the same for all Smartbox Flash devices. OEM firmware also uses this MAC when initialazes ethernet driver. In OpenWrt we use it only as internal GMAC (eth0), all other MACs are unique. Therefore, there is no any barriers to the operation of several Smartbox Flash devices even within the same broadcast domain. Stock firmware image format --------------------------- +--------------+---------------+----------------------------------------+ | Offset | 1.0.15 | Description | +==============+===============+========================================+ | 0x0 | 5d 43 6f 74 | TRX magic "]Cot" | +--------------+---------------+----------------------------------------+ | 0x4 | 00 70 ff 00 | Length (reverse) | +--------------+---------------+----------------------------------------+ | | | htonl(~crc) from 0xc ("flag_version") | | 0x8 | 72 b3 93 16 | to "Length" | +--------------+---------------+----------------------------------------+ | 0xc | 00 00 01 00 | Flags | +--------------+---------------+----------------------------------------+ | | | Offset (reverse) of Kernel partition | | 0x10 | 1c 00 00 00 | from the start of the header | +--------------+---------------+----------------------------------------+ | | | Offset (reverse) of RootFS partition | | 0x14 | 00 00 42 00 | from the start of the header | +--------------+---------------+----------------------------------------+ | 0x18 | 00 00 00 00 | Zeroes | +--------------+---------------+----------------------------------------+ | 0x1c | 27 05 19 56 … | Kernel data + zero padding | +--------------+---------------+----------------------------------------+ | | | RootFS data (starting with "hsqs") + | | 0x420000 | 68 73 71 73 … | zero padding to "Length" | +--------------+---------------+----------------------------------------+ | | | Some signature data (format is | | | | unknown). Necessary for the fw | | "Lenght" | 00 00 00 00 … | update via oem fw web interface. | +--------------+---------------+----------------------------------------+ | "Lenght" + | | TRX magic "HDR0". U-Boot is | | 0x10c | 48 44 52 30 | checking it at every boot. | +--------------+---------------+----------------------------------------+ | | | 1.00: | | | | Zero padding to ("Lenght" + 0x23000) | | | | 1.0.12: | | | | Zero padding to ("Lenght" + 0x2a000) | | "Lenght" + | | 1.0.13, 1.0.15, 1.0.16: | | 0x110 | 00 00 00 00 | Zero padding to ("Lenght" + 0x10000) | +--------------+---------------+----------------------------------------+ Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-01-05 13:11:56 +00:00
KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | \
uImage none
IMAGES += factory.trx
IMAGE/factory.trx := append-kernel | append-ubi | check-size
DEVICE_PACKAGES := kmod-usb3 kmod-mt7615-firmware uencrypt-mbedtls
ramips: add support for Beeline SmartBox Flash Beeline SmartBox Flash is a wireless AC1300 (WiFi 5) router manufactured by Arcadyan company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB, Winbond W632GU6NB Flash: 128 MiB (NAND), Winbond W29N01HVSINF Wireless 2.4 GHz (MT7615DN): b/g/n, 2x2 Wireless 5 GHz (MT7615DN): a/n/ac, 2x2 Ethernet: 3xGbE (WAN, LAN1, LAN2) USB ports: 1xUSB3.0 Button: 1 (Reset/WPS) LEDs: 1 RGB LED Power: 12 VDC, 1.5 A Connector type: Barrel Bootloader: U-Boot (Ralink UBoot Version: 5.0.0.2) OEM: Arcadyan WE42022 Installation ------------ 1. Place *factory.trx on any web server (192.168.1.2 in this example) 2. Connect to the router using telnet shell (no password required) 3. Save MAC adresses to U-Boot environment: uboot_env --set --name eth2macaddr --value $(ifconfig | grep eth2 | \ awk '{print $5}') uboot_env --set --name eth3macaddr --value $(ifconfig | grep eth3 | \ awk '{print $5}') uboot_env --set --name ra0macaddr --value $(ifconfig | grep ra0 | \ awk '{print $5}') uboot_env --set --name rax0macaddr --value $(ifconfig | grep rax0 | \ awk '{print $5}') 4. Ensure that MACs were saved correctly: uboot_env --get --name eth2macaddr uboot_env --get --name eth3macaddr uboot_env --get --name ra0macaddr uboot_env --get --name rax0macaddr 5. Download and write the OpenWrt images: cd /tmp wget http://192.168.1.2/factory.trx mtd_write erase /dev/mtd4 mtd_write write factory.trx /dev/mtd4 6. Set 1st boot partition and reboot: uboot_env --set --name bootpartition --value 0 reboot Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv bootpartition 1 reboot 2. Optional step. Upgrade the stock firmware with any version to overwrite the OpenWrt in Slot 1. MAC addresses ------------- +-----------+-------------------+----------------+ | Interface | MAC | Source | +-----------+-------------------+----------------+ | label | 30:xx:xx:51:xx:09 | No MACs was | | LAN | 30:xx:xx:51:xx:09 | found on Flash | | WAN | 30:xx:xx:51:xx:06 | [1] | | WLAN_2g | 30:xx:xx:51:xx:07 | | | WLAN_5g | 32:xx:xx:41:xx:07 | | +-----------+-------------------+----------------+ [1]: a. Label wasb't found neither in factory nor in other places. b. MAC addresses are stored in encrypted partition "glbcfg". Encryption key hasn't known yet. To ensure the correct MACs in OpenWrt, a hack with saving of the MACs to u-boot-env during the installation was applied. c. Default Ralink ethernet MAC address (00:0C:43:28:80:36) was found in "Factory" 0xfff0. It's the same for all Smartbox Flash devices. OEM firmware also uses this MAC when initialazes ethernet driver. In OpenWrt we use it only as internal GMAC (eth0), all other MACs are unique. Therefore, there is no any barriers to the operation of several Smartbox Flash devices even within the same broadcast domain. Stock firmware image format --------------------------- +--------------+---------------+----------------------------------------+ | Offset | 1.0.15 | Description | +==============+===============+========================================+ | 0x0 | 5d 43 6f 74 | TRX magic "]Cot" | +--------------+---------------+----------------------------------------+ | 0x4 | 00 70 ff 00 | Length (reverse) | +--------------+---------------+----------------------------------------+ | | | htonl(~crc) from 0xc ("flag_version") | | 0x8 | 72 b3 93 16 | to "Length" | +--------------+---------------+----------------------------------------+ | 0xc | 00 00 01 00 | Flags | +--------------+---------------+----------------------------------------+ | | | Offset (reverse) of Kernel partition | | 0x10 | 1c 00 00 00 | from the start of the header | +--------------+---------------+----------------------------------------+ | | | Offset (reverse) of RootFS partition | | 0x14 | 00 00 42 00 | from the start of the header | +--------------+---------------+----------------------------------------+ | 0x18 | 00 00 00 00 | Zeroes | +--------------+---------------+----------------------------------------+ | 0x1c | 27 05 19 56 … | Kernel data + zero padding | +--------------+---------------+----------------------------------------+ | | | RootFS data (starting with "hsqs") + | | 0x420000 | 68 73 71 73 … | zero padding to "Length" | +--------------+---------------+----------------------------------------+ | | | Some signature data (format is | | | | unknown). Necessary for the fw | | "Lenght" | 00 00 00 00 … | update via oem fw web interface. | +--------------+---------------+----------------------------------------+ | "Lenght" + | | TRX magic "HDR0". U-Boot is | | 0x10c | 48 44 52 30 | checking it at every boot. | +--------------+---------------+----------------------------------------+ | | | 1.00: | | | | Zero padding to ("Lenght" + 0x23000) | | | | 1.0.12: | | | | Zero padding to ("Lenght" + 0x2a000) | | "Lenght" + | | 1.0.13, 1.0.15, 1.0.16: | | 0x110 | 00 00 00 00 | Zero padding to ("Lenght" + 0x10000) | +--------------+---------------+----------------------------------------+ Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-01-05 13:11:56 +00:00
endef
TARGET_DEVICES += beeline_smartbox-flash
ramips: add support for Beeline SmartBox GIGA Beeline SmartBox GIGA is a wireless WiFi 5 router manufactured by Sercomm company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB, Nanya NT5CC128M16JR-EK Flash: 128 MiB, Macronix MX30LF1G18AC Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2 Wireless 5 GHz (MT7613BE): a/n/ac, 2x2 Ethernet: 3 ports - 2xGbE (WAN, LAN1), 1xFE (LAN2) USB ports: 1xUSB3.0 Button: 1 button (Reset/WPS) PCB ID: DBE00B-1.6MM LEDs: 1 RGB LED Power: 12 VDC, 1.5 A Connector type: barrel Bootloader: U-Boot Installation ----------------- 1. Downgrade stock (Beeline) firmware to v.1.0.02; 2. Give factory OpenWrt image a shorter name, e.g. 1001.img; 3. Upload and update the firmware via the original web interface. Remark: You might need make the 3rd step twice if your running firmware is booted from the Slot 1 (Sercomm0 bootflag). The stock firmware reverses the bootflag (Sercomm0 / Sercomm1) on each firmware update. Revert to stock --------------- 1. Change the bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 2. Optional: Update with any stock (Beeline) firmware if you want to overwrite OpenWrt in Slot 0 completely. MAC Addresses ------------- +-----+-----------+---------+ | use | address | example | +-----+-----------+---------+ | LAN | label | *:16 | | WAN | label + 1 | *:17 | | 2g | label + 4 | *:1a | | 5g | label + 5 | *:1b | +-----+-----------+---------+ The label MAC address was found in Factory 0x21000 Notes ----- 1. The following scripts are required for the build: sercomm-crypto.py - already exists in OpenWrt sercomm-partition-tag.py - already exists in OpenWrt sercomm-payload.py - already exists in OpenWrt sercomm-pid.py - new, the part of this pull request sercomm-kernel-header.py - new, the part of this pull request 2. This device (same as other Sercomm S2,S3-based devices) requires special LZMA and LOADADDR settings for successful boot: LZMA_TEXT_START=0x82800000 KERNEL_LOADADDR=0x81001000 LOADADDR=0x80001000 3. This device (same as several other Sercomm-based devices - Beeline, Netgear, Etisalat, Rostelecom) has partition map (mtd1) containing real partition offsets, which may differ from device to device depending on the number and location of bad blocks on NAND. "fixed-partitions" is used if the partition map is not found or corrupted. This behavour (it's the same as on stock firmware) is provided by MTD_SERCOMM_PARTS module. Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-03-18 18:09:45 +00:00
define Device/beeline_smartbox-giga
$(Device/sercomm_dxx)
IMAGE_SIZE := 24576k
SERCOMM_HWID := DBE
SERCOMM_HWVER := 10100
SERCOMM_SWVER := 1001
DEVICE_VENDOR := Beeline
DEVICE_MODEL := SmartBox GIGA
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
kmod-usb3
ramips: add support for Beeline SmartBox GIGA Beeline SmartBox GIGA is a wireless WiFi 5 router manufactured by Sercomm company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB, Nanya NT5CC128M16JR-EK Flash: 128 MiB, Macronix MX30LF1G18AC Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2 Wireless 5 GHz (MT7613BE): a/n/ac, 2x2 Ethernet: 3 ports - 2xGbE (WAN, LAN1), 1xFE (LAN2) USB ports: 1xUSB3.0 Button: 1 button (Reset/WPS) PCB ID: DBE00B-1.6MM LEDs: 1 RGB LED Power: 12 VDC, 1.5 A Connector type: barrel Bootloader: U-Boot Installation ----------------- 1. Downgrade stock (Beeline) firmware to v.1.0.02; 2. Give factory OpenWrt image a shorter name, e.g. 1001.img; 3. Upload and update the firmware via the original web interface. Remark: You might need make the 3rd step twice if your running firmware is booted from the Slot 1 (Sercomm0 bootflag). The stock firmware reverses the bootflag (Sercomm0 / Sercomm1) on each firmware update. Revert to stock --------------- 1. Change the bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 2. Optional: Update with any stock (Beeline) firmware if you want to overwrite OpenWrt in Slot 0 completely. MAC Addresses ------------- +-----+-----------+---------+ | use | address | example | +-----+-----------+---------+ | LAN | label | *:16 | | WAN | label + 1 | *:17 | | 2g | label + 4 | *:1a | | 5g | label + 5 | *:1b | +-----+-----------+---------+ The label MAC address was found in Factory 0x21000 Notes ----- 1. The following scripts are required for the build: sercomm-crypto.py - already exists in OpenWrt sercomm-partition-tag.py - already exists in OpenWrt sercomm-payload.py - already exists in OpenWrt sercomm-pid.py - new, the part of this pull request sercomm-kernel-header.py - new, the part of this pull request 2. This device (same as other Sercomm S2,S3-based devices) requires special LZMA and LOADADDR settings for successful boot: LZMA_TEXT_START=0x82800000 KERNEL_LOADADDR=0x81001000 LOADADDR=0x80001000 3. This device (same as several other Sercomm-based devices - Beeline, Netgear, Etisalat, Rostelecom) has partition map (mtd1) containing real partition offsets, which may differ from device to device depending on the number and location of bad blocks on NAND. "fixed-partitions" is used if the partition map is not found or corrupted. This behavour (it's the same as on stock firmware) is provided by MTD_SERCOMM_PARTS module. Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-03-18 18:09:45 +00:00
endef
TARGET_DEVICES += beeline_smartbox-giga
ramips: add support for Sercomm S1500 devices This commit adds support for following wireless routers: - Beeline SmartBox PRO (Serсomm S1500 AWI) - WiFire S1500.NBN (Serсomm S1500 BUC) This commit is based on this PR: - Link: https://github.com/openwrt/openwrt/pull/4770 - Author: Maximilian Weinmann <x1@disroot.org> The opening of this PR was agreed with author. My changes: - Sorting, minor changes and some movings between dts and dtsi - Move leds to dts when possible - Recipes for the factory image - Update of the installation/recovery/return to stock guides - Add reset GPIO for the pcie1 Common specification -------------------- SoC: MediaTek MT7621AT (880 MHz, 2 cores) Switch: MediaTek MT7530 (via SoC MT7621AT) Wireless: 2.4 GHz, MT7602EN, b/g/n, 2x2 Wireless: 5 GHz, MT7612EN, a/n/ac, 2x2 Ethernet: 5 ports - 5×GbE (WAN, LAN1-4) Mini PCIe: via J2 on PCB, not soldered on the board UART: J4 -> GND[], TX, VCC(3.3V), RX BootLoader: U-Boot SerComm/Mediatek Beeline SmartBox PRO specification ---------------------------------- RAM (Nanya NT5CB128M16FP): 256 MiB NAND-Flash (ESMT F59L2G81A): 256 MiB USB ports: 2xUSB2.0 LEDs: Status (white), WPS (blue), 2g (white), 5g (white) + 10 LED Ethernet Buttons: 2 button (reset, wps), 1 switch button (ROUT<->REP) Power: 12 VDC, 1.5 A PCB Sticker: 970AWI0QW00N256SMT Ver. 1.0 CSN: SG15******** MAC LAN: 94:4A:0C:**:**:** Manufacturer's code: 0AWI0500QW1 WiFire S1500.NBN specification ------------------------------ RAM (Nanya NT5CC64M16GP): 128 MiB NAND-Flash (ESMT F59L1G81MA): 128 MiB USB ports: 1xUSB2.0 LEDs: Status (white), WPS (white), 2g (white), 5g (white) + 10 LED Ethernet Buttons: 2 button (RESET, WPS) Power: 12 VDC, 1.0 A PCB Sticker: 970BUC0RW00N128SMT Ver. 1.0 CSN: MH16******** MAC WAN: E0:60:66:**:**:** Manufacturer's code: 0BUC0500RW1 MAC address table (PRO) ----------------------- use address source LAN *:23 factory 0x1000 (label) WAN *:24 factory $label +1 2g *:23 factory $label 5g *:25 factory $label +2 MAC addresses (NBN) ------------------- use address source LAN *:0e factory 0x1000 WAN *:0f LAN +1 (label) 2g *:0f LAN +1 5g *:10 LAN +2 OEM easy installation --------------------- 1. Remove all dots from the factory image filename (except the dot before file extension) 2. Upload and update the firmware via the original web interface 3. Two options are possible after the reboot: a. OpenWrt - that's OK, the mission accomplished b. Stock firmware - install Stock firmware (to switch booflag from Sercomm0 to Sercomm1) and then OpenWrt factory image. Return to Stock --------------- 1. Change the bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock2 reboot 2. Install stock firmware via the web OEM firmware interface Recovery -------- Use sercomm-recovery tool. Link: https://github.com/danitool/sercomm-recovery Tested-by: Pavel Ivanov <pi635v@gmail.com> Tested-by: Denis Myshaev <denis.myshaev@gmail.com> Tested-by: Oleg Galeev <olegingaleev@gmail.com> Tested-By: Ivan Pavlov <AuthorReflex@gmail.com> Co-authored-by: Maximilian Weinmann <x1@disroot.org> Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com> (cherry picked from commit 2d6784a033a994043759fa3b94c48afd5df81f88)
2023-06-11 20:50:23 +00:00
define Device/beeline_smartbox-pro
$(Device/sercomm_s1500)
DEVICE_VENDOR := Beeline
DEVICE_MODEL := SmartBox PRO
DEVICE_ALT0_VENDOR := Sercomm
DEVICE_ALT0_MODEL := S1500 AWI
IMAGE_SIZE := 34816k
IMAGE/factory.img := append-kernel | sercomm-kernel-factory | \
sercomm-reset-slot1-chksum | append-ubi | check-size | \
sercomm-factory-cqr | sercomm-append-tail | sercomm-mkhash
SERCOMM_HWID := AWI
SERCOMM_HWVER := 10000
SERCOMM_ROOTFS2_OFFSET := 0x3d00000
SERCOMM_SWVER := 2020
endef
TARGET_DEVICES += beeline_smartbox-pro
ramips: add support for Beeline SmartBox TURBO Beeline SmartBox TURBO is a wireless WiFi 5 router manufactured by Sercomm company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB Flash: 256 MiB, Micron MT29F2G08ABAGA3W Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2 Wireless 5 GHz (MT7615E): a/n/ac, 4x4 Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1xUSB3.0 Button: 2 buttons (Reset & WPS) LEDs: 1 RGB LED Power: 12 VDC, 1.5 A Connector type: barrel Bootloader: U-Boot Installation ----------------- 1. Login to the router web interface (admin:admin) 2. Navigate to Settings -> WAN -> Add static IP interface (e.g. 10.0.0.1/255.255.255.0) 3. Navigate to Settings -> Remote cotrol -> Add SSH, port 22, 10.0.0.0/255.255.255.0 and interface created before 4. Change IP of your client to 10.0.0.2/255.255.255.0 and connect the ethernet cable to the WAN port of the router 5. Connect to the router using SSH shell (SuperUser:SNxxxxxxxxxx, where SNxxxxxxxxxx is the serial number from the backplate label) 6. Run in SSH shell: sh 7. Make a mtd backup (optional, see related section) 8. Change bootflag to Sercomm1 and reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 reboot 9. Login to the router web interface (admin:admin) 10. Remove dots from the OpenWrt factory image filename 11. Update firmware via web using OpenWrt factory image Revert to stock --------------- 1. Change bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 2. Optional: Update with any stock (Beeline) firmware if you want to overwrite OpenWrt in Slot 0 completely. mtd backup ---------- 1. Set up a tftp server (e.g. tftpd64 for windows) 2. Connect to a router using SSH shell and run the following commands: cd /tmp for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \ tftp -l mtd$i -p 10.0.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done tftp -l mtd.md5 -p 10.0.0.2 MAC Addresses ------------- +-----+-----------+---------+ | use | address | example | +-----+-----------+---------+ | LAN | label | *:54 | | WAN | label + 1 | *:55 | | 2g | label + 4 | *:58 | | 5g | label + 5 | *:59 | +-----+-----------+---------+ The label MAC address was found in Factory 0x21000 Co-developed-by: Maximilian Weinmann <x1@disroot.org> Signed-off-by: Maximilian Weinmann <x1@disroot.org> Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-03-18 18:09:45 +00:00
define Device/beeline_smartbox-turbo
$(Device/sercomm_dxx)
IMAGE_SIZE := 32768k
SERCOMM_HWID := DF3
SERCOMM_HWVER := 10200
SERCOMM_SWVER := 1004
DEVICE_VENDOR := Beeline
DEVICE_MODEL := SmartBox TURBO
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware kmod-usb3
ramips: add support for Beeline SmartBox TURBO Beeline SmartBox TURBO is a wireless WiFi 5 router manufactured by Sercomm company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB Flash: 256 MiB, Micron MT29F2G08ABAGA3W Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2 Wireless 5 GHz (MT7615E): a/n/ac, 4x4 Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1xUSB3.0 Button: 2 buttons (Reset & WPS) LEDs: 1 RGB LED Power: 12 VDC, 1.5 A Connector type: barrel Bootloader: U-Boot Installation ----------------- 1. Login to the router web interface (admin:admin) 2. Navigate to Settings -> WAN -> Add static IP interface (e.g. 10.0.0.1/255.255.255.0) 3. Navigate to Settings -> Remote cotrol -> Add SSH, port 22, 10.0.0.0/255.255.255.0 and interface created before 4. Change IP of your client to 10.0.0.2/255.255.255.0 and connect the ethernet cable to the WAN port of the router 5. Connect to the router using SSH shell (SuperUser:SNxxxxxxxxxx, where SNxxxxxxxxxx is the serial number from the backplate label) 6. Run in SSH shell: sh 7. Make a mtd backup (optional, see related section) 8. Change bootflag to Sercomm1 and reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 reboot 9. Login to the router web interface (admin:admin) 10. Remove dots from the OpenWrt factory image filename 11. Update firmware via web using OpenWrt factory image Revert to stock --------------- 1. Change bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 2. Optional: Update with any stock (Beeline) firmware if you want to overwrite OpenWrt in Slot 0 completely. mtd backup ---------- 1. Set up a tftp server (e.g. tftpd64 for windows) 2. Connect to a router using SSH shell and run the following commands: cd /tmp for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \ tftp -l mtd$i -p 10.0.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done tftp -l mtd.md5 -p 10.0.0.2 MAC Addresses ------------- +-----+-----------+---------+ | use | address | example | +-----+-----------+---------+ | LAN | label | *:54 | | WAN | label + 1 | *:55 | | 2g | label + 4 | *:58 | | 5g | label + 5 | *:59 | +-----+-----------+---------+ The label MAC address was found in Factory 0x21000 Co-developed-by: Maximilian Weinmann <x1@disroot.org> Signed-off-by: Maximilian Weinmann <x1@disroot.org> Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-03-18 18:09:45 +00:00
endef
TARGET_DEVICES += beeline_smartbox-turbo
ramips: Add support for Beeline SmartBox TURBO+ This adds support for Beeline Smart Box TURBO+ (Serсomm S3 CQR) router. Device specification -------------------- SoC Type: MediaTek MT7621AT (880 MHz, 2 cores) RAM (Nanya NT5CC64M16GP): 128 MiB Flash (Macronix MX30LF1G18AC): 128 MiB Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2 Wireless 5 GHz (MT7615N): a/n/ac, 4x4 Ethernet: 5 ports - 5×GbE (WAN, LAN1-4) USB ports: 1xUSB3.0 Buttons: 2 button (reset, wps) LEDs: Red, Green, Blue Zigbee (EFR32MG1B232GG): 3.0 Stock bootloader: U-Boot 1.1.3 Power: 12 VDC, 1.5 A Installation (fw 2.0.9) ----------------------- 1. Login to the web interface under SuperUser (root) credentials. Password: SDXXXXXXXXXX, where SDXXXXXXXXXX is serial number of the device written on the backplate stick. 2. Navigate to Setting -> WAN. Add: Name - WAN1 Connection Type - Static IP Address - 172.16.0.1 Netmask - 255.255.255.0 Save -> Apply. Set default: WAN1 3. Enable SSH and HTTP on WAN. Setting -> Remote control. Add: Protocol - SSH Port - 22 IP Address - 172.16.0.1 Netmask - 255.255.255.0 WAN Interface - WAN1 Save ->Apply Add: Protocol - HTTP Port - 80 IP Address - 172.16.0.1 Netmask - 255.255.255.0 WAN interface - WAN1 Save -> Apply 4. Set up your PC ethernet: Connection Type - Static IP Address - 172.16.0.2 Netmask - 255.255.255.0 Gateway - 172.16.0.1 5. Connect PC using ethernet cable to the WAN port of the router 6. Connect to the router using SSH shell under SuperUser account 7. Make a mtd backup (optional, see related section) 8. Change bootflag to Sercomm1 and reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 reboot 9. Login to the router web interface under admin account 10. Remove dots from the OpenWrt factory image filename 11. Update firmware via web using OpenWrt factory image Revert to stock --------------- Change bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 mtd backup ---------- 1. Set up a tftp server (e.g. tftpd64 for windows) 2. Connect to a router using SSH shell and run the following commands: cd /tmp for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \ tftp -l mtd$i -p 172.16.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done tftp -l mtd.md5 -p 171.16.0.2 Recovery -------- Use sercomm-recovery tool. Link: https://github.com/danitool/sercomm-recovery MAC Addresses (fw 2.0.9) ------------------------ +-----+------------+---------+ | use | address | example | +-----+------------+---------+ | LAN | label | *:e8 | | WAN | label + 1 | *:e9 | | 2g | label + 4 | *:ec | | 5g | label + 5 | *:ed | +-----+------------+---------+ The label MAC address was found in Factory 0x21000 Factory image format -------------------- +---+-------------------+-------------+--------------------+ | # | Offset | Size | Description | +---+-------------------+-------------+--------------------+ | 1 | 0x0 | 0x200 | Tag Header Factory | | 2 | 0x200 | 0x100 | Tag Header Kernel1 | | 3 | 0x300 | 0x100 | Tag Header Kernel2 | | 4 | 0x400 | SIZE_KERNEL | Kernel | | 5 | 0x400+SIZE_KERNEL | SIZE_ROOTFS | RootFS(UBI) | +---+-------------------+-------------+--------------------+ Co-authored-by: Mikhail Zhilkin <csharper2005@gmail.com> Signed-off-by: Maximilian Weinmann <x1@disroot.org> (cherry picked from commit 8fcfb21b16e7537b9a871a1f67cb218c6be93149)
2022-12-07 16:44:09 +00:00
define Device/beeline_smartbox-turbo-plus
$(Device/sercomm_cxx)
IMAGE_SIZE := 32768k
SERCOMM_HWID := CQR
SERCOMM_HWVER := 10000
SERCOMM_SWVER := 2010
DEVICE_VENDOR := Beeline
DEVICE_MODEL := SmartBox TURBO+
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware kmod-usb3
endef
TARGET_DEVICES += beeline_smartbox-turbo-plus
define Device/belkin_rt1800
$(Device/nand)
IMAGE_SIZE := 49152k
DEVICE_VENDOR := Belkin
DEVICE_MODEL := RT1800
DEVICE_PACKAGES := kmod-mt7915-firmware kmod-usb3
KERNEL_LOADADDR := 0x82000000
KERNEL := kernel-bin | relocate-kernel 0x80001000 | lzma | \
fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb | \
append-squashfs4-fakeroot
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
append-ubi | check-size | belkin-header RT18 1 9.9.9
endef
TARGET_DEVICES += belkin_rt1800
define Device/buffalo_wsr-1166dhp
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE/sysupgrade.bin := trx | pad-rootfs | append-metadata
ramips/mt7621: fix IMAGE_SIZE for all devices This fixes IMAGE_SIZE for all devices based on the partition size given in DTS: DEVICE *.MK *.DTS VERDICT afoundry_ew1200 (16M) 0xfb0000 asiarf_ap7621-001 (16M) 0xfa0000 wrong buffalo_wsr-1166dhp (16M) 0xf90000 wrong buffalo_wsr-600dhp (16M) 0xfb0000 dlink_dir-860l-b1 (16M) 0xfb0000 d-team_newifi-d2 (32M) 0x1fb0000 d-team_pbr-m1 (16M) 0xfb0000 elecom_wrc-1167ghbk2-s 15488k 0xf20000 elecom_wrc-1900gst 11264k 0xb00000 elecom_wrc-2533gst 11264k 0xb00000 firefly_firewrt (16M) 0xfb0000 gehua_ghl-r-001 (32M) 0x1fb0000 gnubee_gb-pc1 (32M) 0x1fb0000 gnubee_gb-pc2 (32M) 0x1fb0000 hiwifi_hc5962 (32M) 0x2000000 wrong (kernel + ubi) iodata_wn-ax1167gr 15552k 0xf30000 iodata_wn-gx300gr 7798784 0x770000 lenovo_newifi-d1 (32M) 0x1fb0000 linksys_re6500 - 0x7b0000 default mediatek_ap-mt7621a-v60 (8M) 0x7b0000 mediatek_mt7621-eval-board (4M) 0xec0000 wrong (rootfs) mikrotik_rb750gr3 [16128k] 0xfc0000 mikrotik_rbm11g [16128k] 0xFC0000 mikrotik_rbm33g [16128k] 0xFC0000 mqmaker_witi-256m (16M) 0xfb0000 mqmaker_witi-512m (16M) 0xfb0000 mtc_wr1201 16000k 0xfa0000 netgear_ex6150 14848k 0xe80000 netgear_r6220 28672k 0x1c00000 netgear_r6350 40960k 0x2800000 netgear_wndr3700-v5 15232k 0xee0000 netis_wf-2881 129280k 0x7E40000 phicomm_k2p 15744k 0xf60000 planex_vr500 66453504 0x3fb0000 wrong samknows_whitebox-v8 (16M) 0xfb0000 storylink_sap-g3200u3 - 0x7b0000 default telco-electronics_x1 16064k 0xfb0000 thunder_timecloud - 0xfb0000 wrong totolink_a7000r 16064k 0xfb0000 tplink_re350-v1 6016k 0x5e0000 ubiquiti_edgerouterx - 0xfa00000 wrong (kernel1 + ubi) ubiquiti_edgerouterx-sfp - 0xfa00000 wrong (kernel1 + ubi) unielec_u7621-06-256m-16m 16064k 0xfb0000 unielec_u7621-06-512m-64m 65216k 0x3fb0000 wevo_11acnas (16M) 0xfb0000 wevo_w2914ns-v2 (16M) 0xfb0000 xiaomi_mir3g 32768k 0x7980000 wrong (kernel + ubi) xiaomi_mir3p (32M) 0xf980000 wrong (kernel + ubi) xzwifi_creativebox-v1 (32M) 0x1fb0000 youhua_wr1200js 16064k 0xfb0000 youku_yk-l2 (16M) 0xfb0000 zbtlink_zbt-we1326 (16M) 0xfb0000 zbtlink_zbt-we3526 (16M) 0xfb0000 zbtlink_zbt-wg2626 (16M) 0xfb0000 zbtlink_zbt-wg3526-16m (16M) 0xfb0000 zbtlink_zbt-wg3526-32m (32M) 0x1fb0000 No verdict means that the device is correctly set. Legend: ( ): Value is set via ralink_default_fw_size_xxM [ ]: Value is derived from parent definition - : Value is not set and derived from default definition Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-07-15 12:55:24 +00:00
IMAGE_SIZE := 15936k
DEVICE_VENDOR := Buffalo
DEVICE_MODEL := WSR-1166DHP
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 -uboot-envtools
SUPPORTED_DEVICES += wsr-1166
endef
TARGET_DEVICES += buffalo_wsr-1166dhp
define Device/buffalo_wsr-2533dhpl
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 7936k
DEVICE_VENDOR := Buffalo
DEVICE_MODEL := WSR-2533DHPL
DEVICE_ALT0_VENDOR := Buffalo
DEVICE_ALT0_MODEL := WSR-2533DHP
IMAGE/sysupgrade.bin := trx | pad-rootfs | append-metadata
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
endef
TARGET_DEVICES += buffalo_wsr-2533dhpl
define Device/buffalo_wsr-600dhp
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Buffalo
DEVICE_MODEL := WSR-600DHP
DEVICE_PACKAGES := kmod-mt7603 kmod-rt2800-pci -uboot-envtools
SUPPORTED_DEVICES += wsr-600
endef
TARGET_DEVICES += buffalo_wsr-600dhp
define Device/bolt_arion
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 32448k
DEVICE_VENDOR := BOLT
DEVICE_MODEL := Arion
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2
endef
TARGET_DEVICES += bolt_arion
define Device/cudy_m1800
$(Device/dsa-migration)
DEVICE_VENDOR := Cudy
DEVICE_MODEL := M1800
IMAGE_SIZE := 16064k
UIMAGE_NAME := R17
DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
endef
TARGET_DEVICES += cudy_m1800
define Device/cudy_wr1300-v1
$(Device/dsa-migration)
IMAGE_SIZE := 15872k
DEVICE_VENDOR := Cudy
DEVICE_MODEL := WR1300
DEVICE_VARIANT := v1
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
SUPPORTED_DEVICES += cudy,wr1300 R10
endef
TARGET_DEVICES += cudy_wr1300-v1
define Device/cudy_wr1300-v2
$(Device/dsa-migration)
IMAGE_SIZE := 15872k
DEVICE_VENDOR := Cudy
DEVICE_MODEL := WR1300
DEVICE_VARIANT := v2
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
-uboot-envtools
SUPPORTED_DEVICES += cudy,wr1300 R23
endef
TARGET_DEVICES += cudy_wr1300-v2
define Device/cudy_wr2100
$(Device/dsa-migration)
DEVICE_VENDOR := Cudy
DEVICE_MODEL := WR2100
IMAGE_SIZE := 15872k
UIMAGE_NAME := R11
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware -uboot-envtools
endef
TARGET_DEVICES += cudy_wr2100
define Device/cudy_x6-v1
$(Device/dsa-migration)
IMAGE_SIZE := 32256k
DEVICE_VENDOR := Cudy
DEVICE_MODEL := X6
DEVICE_VARIANT := v1
UIMAGE_NAME := R13
DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
SUPPORTED_DEVICES += cudy,x6 R13
endef
TARGET_DEVICES += cudy_x6-v1
define Device/cudy_x6-v2
$(Device/dsa-migration)
IMAGE_SIZE := 15872k
DEVICE_VENDOR := Cudy
DEVICE_MODEL := X6
DEVICE_VARIANT := v2
UIMAGE_NAME := R30
DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
SUPPORTED_DEVICES += cudy,x6 R30
endef
TARGET_DEVICES += cudy_x6-v2
define Device/dlink_dap-1620-b1
DEVICE_VENDOR := D-Link
DEVICE_MODEL := DAP-1620
DEVICE_VARIANT := B1
DEVICE_PACKAGES := kmod-mt7615-firmware rssileds
DLINK_HWID := MT76XMT7621-RP-PR2475-NA
IMAGE_SIZE := 16064k
IMAGES += factory.bin
IMAGE/factory.bin := $$(sysupgrade_bin) | \
check-size 11009992 | pad-to 11009992 | \
append-md5sum-ascii-salted ffff | \
append-string $$(DLINK_HWID) | \
check-size
endef
TARGET_DEVICES += dlink_dap-1620-b1
define Device/dlink_dap-x1860-a1
$(Device/nand)
IMAGE_SIZE := 53248k
DEVICE_VENDOR := D-Link
DEVICE_MODEL := DAP-X1860
DEVICE_VARIANT := A1
KERNEL_SIZE := 8192k
KERNEL_LOADADDR := 0x82000000
KERNEL := kernel-bin | relocate-kernel 0x80001000 | lzma | \
fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
check-size | elx-header 011b0060 8844A2D168B45A2D
DEVICE_PACKAGES := kmod-mt7915-firmware rssileds -uboot-envtools
endef
TARGET_DEVICES += dlink_dap-x1860-a1
ramips: add support for D-Link DIR-867/DIR-882 A1 This patch adds support for D-Link DIR-867 A1 and D-Link DIR-882 A1. Given the similarity of these devices, this patch also introduces a common DTS shared between DIR-867 A1, DIR-878 A1 and DIR-882 A1. Specifications: * Board: AP-MTKH7-0002 * SoC: MediaTek MT7621AT * RAM: 128 MB (DDR3) * Flash: 16 MB (SPI NOR) * WiFi: MediaTek MT7615N (x2) * Switch: 1 WAN, 4 LAN (Gigabit) * Ports: 1 USB 2.0, 1 USB 3.0 * Buttons: Reset, WiFi Toggle, WPS * LEDs: Power (green/orange), Internet (green/orange), WiFi 2.4G (green), WiFi 5G (green), USB 2.0 (green), USB 3.0 (green) Notes: * WiFi 2.4G and WiFi 5G LEDs are wired directly to the wireless chips * DIR-867 wireless chips are limited to 3x3 streams at hardware level * USB ports and related LEDs available only on DIR-882 Serial port: * Parameters: 57600, 8N1 * Location: J1 header (close to the Reset, WiFi and WPS buttons) * Pinout: 1 - VCC 2 - RXD 3 - TXD 4 - GND Installation: * D-Link Recovery GUI: power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the power LED starts flashing orange, manually assign a static IP address under the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1 * Some modern browsers may have problems flashing via the Recovery GUI, if that occurs consider uploading the firmware through cURL: curl -v -i -F "firmware=@file.bin" 192.168.0.1 Signed-off-by: Mateus B. Cassiano <mbc07@live.com> [move DEVICE_VARIANT to individual definitions] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-15 21:45:39 +00:00
define Device/dlink_dir-8xx-a1
$(Device/dsa-migration)
ramips: add support for D-Link DIR-867/DIR-882 A1 This patch adds support for D-Link DIR-867 A1 and D-Link DIR-882 A1. Given the similarity of these devices, this patch also introduces a common DTS shared between DIR-867 A1, DIR-878 A1 and DIR-882 A1. Specifications: * Board: AP-MTKH7-0002 * SoC: MediaTek MT7621AT * RAM: 128 MB (DDR3) * Flash: 16 MB (SPI NOR) * WiFi: MediaTek MT7615N (x2) * Switch: 1 WAN, 4 LAN (Gigabit) * Ports: 1 USB 2.0, 1 USB 3.0 * Buttons: Reset, WiFi Toggle, WPS * LEDs: Power (green/orange), Internet (green/orange), WiFi 2.4G (green), WiFi 5G (green), USB 2.0 (green), USB 3.0 (green) Notes: * WiFi 2.4G and WiFi 5G LEDs are wired directly to the wireless chips * DIR-867 wireless chips are limited to 3x3 streams at hardware level * USB ports and related LEDs available only on DIR-882 Serial port: * Parameters: 57600, 8N1 * Location: J1 header (close to the Reset, WiFi and WPS buttons) * Pinout: 1 - VCC 2 - RXD 3 - TXD 4 - GND Installation: * D-Link Recovery GUI: power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the power LED starts flashing orange, manually assign a static IP address under the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1 * Some modern browsers may have problems flashing via the Recovery GUI, if that occurs consider uploading the firmware through cURL: curl -v -i -F "firmware=@file.bin" 192.168.0.1 Signed-off-by: Mateus B. Cassiano <mbc07@live.com> [move DEVICE_VARIANT to individual definitions] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-15 21:45:39 +00:00
IMAGE_SIZE := 16000k
DEVICE_VENDOR := D-Link
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
KERNEL := $$(KERNEL) | uimage-sgehdr
ramips: add support for D-Link DIR-867/DIR-882 A1 This patch adds support for D-Link DIR-867 A1 and D-Link DIR-882 A1. Given the similarity of these devices, this patch also introduces a common DTS shared between DIR-867 A1, DIR-878 A1 and DIR-882 A1. Specifications: * Board: AP-MTKH7-0002 * SoC: MediaTek MT7621AT * RAM: 128 MB (DDR3) * Flash: 16 MB (SPI NOR) * WiFi: MediaTek MT7615N (x2) * Switch: 1 WAN, 4 LAN (Gigabit) * Ports: 1 USB 2.0, 1 USB 3.0 * Buttons: Reset, WiFi Toggle, WPS * LEDs: Power (green/orange), Internet (green/orange), WiFi 2.4G (green), WiFi 5G (green), USB 2.0 (green), USB 3.0 (green) Notes: * WiFi 2.4G and WiFi 5G LEDs are wired directly to the wireless chips * DIR-867 wireless chips are limited to 3x3 streams at hardware level * USB ports and related LEDs available only on DIR-882 Serial port: * Parameters: 57600, 8N1 * Location: J1 header (close to the Reset, WiFi and WPS buttons) * Pinout: 1 - VCC 2 - RXD 3 - TXD 4 - GND Installation: * D-Link Recovery GUI: power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the power LED starts flashing orange, manually assign a static IP address under the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1 * Some modern browsers may have problems flashing via the Recovery GUI, if that occurs consider uploading the firmware through cURL: curl -v -i -F "firmware=@file.bin" 192.168.0.1 Signed-off-by: Mateus B. Cassiano <mbc07@live.com> [move DEVICE_VARIANT to individual definitions] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-15 21:45:39 +00:00
IMAGES += factory.bin
IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | \
check-size | append-metadata
IMAGE/factory.bin := append-kernel | append-rootfs | check-size
ramips: add support for D-Link DIR-867/DIR-882 A1 This patch adds support for D-Link DIR-867 A1 and D-Link DIR-882 A1. Given the similarity of these devices, this patch also introduces a common DTS shared between DIR-867 A1, DIR-878 A1 and DIR-882 A1. Specifications: * Board: AP-MTKH7-0002 * SoC: MediaTek MT7621AT * RAM: 128 MB (DDR3) * Flash: 16 MB (SPI NOR) * WiFi: MediaTek MT7615N (x2) * Switch: 1 WAN, 4 LAN (Gigabit) * Ports: 1 USB 2.0, 1 USB 3.0 * Buttons: Reset, WiFi Toggle, WPS * LEDs: Power (green/orange), Internet (green/orange), WiFi 2.4G (green), WiFi 5G (green), USB 2.0 (green), USB 3.0 (green) Notes: * WiFi 2.4G and WiFi 5G LEDs are wired directly to the wireless chips * DIR-867 wireless chips are limited to 3x3 streams at hardware level * USB ports and related LEDs available only on DIR-882 Serial port: * Parameters: 57600, 8N1 * Location: J1 header (close to the Reset, WiFi and WPS buttons) * Pinout: 1 - VCC 2 - RXD 3 - TXD 4 - GND Installation: * D-Link Recovery GUI: power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the power LED starts flashing orange, manually assign a static IP address under the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1 * Some modern browsers may have problems flashing via the Recovery GUI, if that occurs consider uploading the firmware through cURL: curl -v -i -F "firmware=@file.bin" 192.168.0.1 Signed-off-by: Mateus B. Cassiano <mbc07@live.com> [move DEVICE_VARIANT to individual definitions] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-15 21:45:39 +00:00
endef
define Device/dlink_dir-8xx-r1
$(Device/dsa-migration)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := D-Link
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
KERNEL_INITRAMFS := $$(KERNEL)
IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | \
check-size | append-metadata
endef
ramips: add support for D-Link DIR-1960 A1 This patch adds support for D-Link DIR-1960 A1. Given the similarity with the DIR-1760/2660 A1, this patch also introduces a common DTSI which can be shared with these devices, with support to be added in future commits. Specifications: * Board: AP-MTKH7-0002 * SoC: MediaTek MT7621AT * RAM: 256 MB (DDR3) * Flash: 128 MB (NAND) * WiFi: MediaTek MT7615N (x2) * Switch: 1 WAN, 4 LAN (Gigabit) * Ports: 1 USB 3.0 * Buttons: Reset, WPS * LEDs: Power (white/orange), Internet (white/orange), WiFi 2.4G (white), WiFi 5G (white), USB 3.0 (white) Notes: * WiFi 2.4G and WiFi 5G LEDs are wired directly to the wireless chips Installation: * D-Link Recovery GUI: power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the power LED starts flashing orange, manually assign a static IP address under the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1 * Some modern browsers may have problems flashing via the Recovery GUI, if that occurs consider uploading the firmware through cURL: curl -v -i -F "firmware=@file.bin" 192.168.0.1 MAC addresses: lan factory 0xe000 *:EB (label) wan factory 0xe006 *:EE 2.4 factory 0xe000 +1 *:EC 5.0 factory 0xe000 +2 *:ED Seems like vendor didn't replace the dummy entrys in the calibration data. Signed-off-by: Josh Bendavid <joshbendavid@gmail.com> [fix whitespace issues, create patch to merge DIR-1960 first, move special WiFi MAC settings to DTS, extend commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-14 15:39:21 +00:00
define Device/dlink_dir-xx60-a1
$(Device/nand)
ramips: add support for D-Link DIR-1960 A1 This patch adds support for D-Link DIR-1960 A1. Given the similarity with the DIR-1760/2660 A1, this patch also introduces a common DTSI which can be shared with these devices, with support to be added in future commits. Specifications: * Board: AP-MTKH7-0002 * SoC: MediaTek MT7621AT * RAM: 256 MB (DDR3) * Flash: 128 MB (NAND) * WiFi: MediaTek MT7615N (x2) * Switch: 1 WAN, 4 LAN (Gigabit) * Ports: 1 USB 3.0 * Buttons: Reset, WPS * LEDs: Power (white/orange), Internet (white/orange), WiFi 2.4G (white), WiFi 5G (white), USB 3.0 (white) Notes: * WiFi 2.4G and WiFi 5G LEDs are wired directly to the wireless chips Installation: * D-Link Recovery GUI: power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the power LED starts flashing orange, manually assign a static IP address under the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1 * Some modern browsers may have problems flashing via the Recovery GUI, if that occurs consider uploading the firmware through cURL: curl -v -i -F "firmware=@file.bin" 192.168.0.1 MAC addresses: lan factory 0xe000 *:EB (label) wan factory 0xe006 *:EE 2.4 factory 0xe000 +1 *:EC 5.0 factory 0xe000 +2 *:ED Seems like vendor didn't replace the dummy entrys in the calibration data. Signed-off-by: Josh Bendavid <joshbendavid@gmail.com> [fix whitespace issues, create patch to merge DIR-1960 first, move special WiFi MAC settings to DTS, extend commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-14 15:39:21 +00:00
IMAGE_SIZE := 40960k
DEVICE_VENDOR := D-Link
DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
KERNEL := $$(KERNEL) | uimage-sgehdr
ramips: add support for D-Link DIR-1960 A1 This patch adds support for D-Link DIR-1960 A1. Given the similarity with the DIR-1760/2660 A1, this patch also introduces a common DTSI which can be shared with these devices, with support to be added in future commits. Specifications: * Board: AP-MTKH7-0002 * SoC: MediaTek MT7621AT * RAM: 256 MB (DDR3) * Flash: 128 MB (NAND) * WiFi: MediaTek MT7615N (x2) * Switch: 1 WAN, 4 LAN (Gigabit) * Ports: 1 USB 3.0 * Buttons: Reset, WPS * LEDs: Power (white/orange), Internet (white/orange), WiFi 2.4G (white), WiFi 5G (white), USB 3.0 (white) Notes: * WiFi 2.4G and WiFi 5G LEDs are wired directly to the wireless chips Installation: * D-Link Recovery GUI: power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the power LED starts flashing orange, manually assign a static IP address under the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1 * Some modern browsers may have problems flashing via the Recovery GUI, if that occurs consider uploading the firmware through cURL: curl -v -i -F "firmware=@file.bin" 192.168.0.1 MAC addresses: lan factory 0xe000 *:EB (label) wan factory 0xe006 *:EE 2.4 factory 0xe000 +1 *:EC 5.0 factory 0xe000 +2 *:ED Seems like vendor didn't replace the dummy entrys in the calibration data. Signed-off-by: Josh Bendavid <joshbendavid@gmail.com> [fix whitespace issues, create patch to merge DIR-1960 first, move special WiFi MAC settings to DTS, extend commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-14 15:39:21 +00:00
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
check-size
endef
ramips: add support for D-Link DIR-1935 A1 Add support for D-Link DIR-1935 A1 based on similarities to DIR-882 A1, DIR-867 A1 and other DIR-8xx A1 models. Existing DIR-882 A1 openwrt "factory" firmware installs without modificaitons via the D-Link Recovery GUI and has no known incompatibilities with the DIR-1935 A1. Changes to be committed: new file: target/linux/ramips/dts/mt7621_dlink_dir-1935-a1.dts modified: target/linux/ramips/image/mt7621.mk modified: target/linux/ramips/mt7621/base-files/etc/board.d/01_leds Specifications: * Board: Not known * SoC: MediaTek MT7621 Family * RAM: 128 MB (DDR3) * Flash: 16 MB (SPI NOR) * WiFi: MediaTek MT7615 Family (x2) * Switch: 1 WAN, 4 LAN (Gigabit) * Ports: 1 USB 3.0 * Buttons: Reset, WiFi Toggle, WPS * LEDs: Power (green/orange), Internet (green/orange), WiFi 2.4G (green), WiFi 5G (green) Notes: * 160MHz 5GHz is available in LuCi but does not appear to work (i.e. no SSID is visible in wifi scanning apps on other devices) with either official DIR-882 A1 firmware or a test build for the DIR-1935 A1 based on the 22.03.2 branch. 80 MHz 5GHz works. Serial port: * Untested (potential user damage/error) * Expected to be identical to other DIR-8xx A1 models: * Parameters: 57600, 8N1 * Location: J1 header (close to the Reset, WiFi and WPS buttons) * Pinout: 1 - VCC 2 - RXD 3 - TXD 4 - GND Installation: * D-Link Recovery GUI: power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the power LED starts flashing orange, manually assign a static IP address under the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1 * Some modern browsers may have problems flashing via the Recovery GUI, if that occurs consider uploading the firmware through cURL: curl -v -i -F "firmware=@file.bin" 192.168.0.1 Signed-off-by: Keith Harrison <keithh@protonmail.com>
2023-01-07 15:23:03 +00:00
define Device/dlink_dir-1935-a1
$(Device/dlink_dir-8xx-a1)
DEVICE_MODEL := DIR-1935
DEVICE_VARIANT := A1
DEVICE_PACKAGES += kmod-usb3
endef
TARGET_DEVICES += dlink_dir-1935-a1
ramips: add support for D-Link DIR-1960 A1 This patch adds support for D-Link DIR-1960 A1. Given the similarity with the DIR-1760/2660 A1, this patch also introduces a common DTSI which can be shared with these devices, with support to be added in future commits. Specifications: * Board: AP-MTKH7-0002 * SoC: MediaTek MT7621AT * RAM: 256 MB (DDR3) * Flash: 128 MB (NAND) * WiFi: MediaTek MT7615N (x2) * Switch: 1 WAN, 4 LAN (Gigabit) * Ports: 1 USB 3.0 * Buttons: Reset, WPS * LEDs: Power (white/orange), Internet (white/orange), WiFi 2.4G (white), WiFi 5G (white), USB 3.0 (white) Notes: * WiFi 2.4G and WiFi 5G LEDs are wired directly to the wireless chips Installation: * D-Link Recovery GUI: power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the power LED starts flashing orange, manually assign a static IP address under the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1 * Some modern browsers may have problems flashing via the Recovery GUI, if that occurs consider uploading the firmware through cURL: curl -v -i -F "firmware=@file.bin" 192.168.0.1 MAC addresses: lan factory 0xe000 *:EB (label) wan factory 0xe006 *:EE 2.4 factory 0xe000 +1 *:EC 5.0 factory 0xe000 +2 *:ED Seems like vendor didn't replace the dummy entrys in the calibration data. Signed-off-by: Josh Bendavid <joshbendavid@gmail.com> [fix whitespace issues, create patch to merge DIR-1960 first, move special WiFi MAC settings to DTS, extend commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-14 15:39:21 +00:00
define Device/dlink_dir-1960-a1
$(Device/dlink_dir-xx60-a1)
DEVICE_MODEL := DIR-1960
DEVICE_VARIANT := A1
endef
TARGET_DEVICES += dlink_dir-1960-a1
define Device/dlink_dir-2640-a1
$(Device/dlink_dir-xx60-a1)
DEVICE_MODEL := DIR-2640
DEVICE_VARIANT := A1
endef
TARGET_DEVICES += dlink_dir-2640-a1
define Device/dlink_dir-2660-a1
$(Device/dlink_dir-xx60-a1)
DEVICE_MODEL := DIR-2660
DEVICE_VARIANT := A1
endef
TARGET_DEVICES += dlink_dir-2660-a1
define Device/dlink_dir-3060-a1
$(Device/dlink_dir-xx60-a1)
DEVICE_MODEL := DIR-3060
DEVICE_VARIANT := A1
endef
TARGET_DEVICES += dlink_dir-3060-a1
ramips: add support for D-Link Dir-853 A1 Specifications: * SoC: MT7621AT * RAM: 256MB (NT5CC64M16GP-DI) * Flash: 16MB NOR SPI flash (GD25Q127CSIG, using GD25Q128C driver) * WiFi: MT7615DN (2.4GHz+5Ghz) with DBDC * Ethernet: 4x1000M LAN, 1x 1000M WAN * LEDs: Power Blue+Orange,Wan Blue+Orange,WPS Blue,"2.4G"Blue, "5G" Blue, USB Blue * Buttons: Reset,WPS, Wifi * Serial interface: on board but not populated, pinout (from the DC jack side to the WAN port side) is "3.3V Input Output Gnd". Baud rate is 57600, settings are 8 data bits, no parity bit, one stop bit, and no flow control. Stock flash layout: ``` GD25Q128C(c8 40180000) (16384 Kbytes) mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0 Creating 7 MTD partitions on "raspi": 0x000000000000-0x000001000000 : "ALL" 0x000000000000-0x000000030000 : "Bootloader" 0x000000030000-0x000000040000 : "Config" 0x000000040000-0x000000050000 : "Factory" 0x000000050000-0x000000060000 : "Config2" 0x000000060000-0x000000fb0000 : "Kernel" 0x000000fb0000-0x000001000000 : "Private" ``` The kernel partition will be replaced with the OpenWrt image, the other partitions are left untouched. "Config2" seems to be the config storage used by the stock firmware. "Private" is a 320kB empty JFFS2 partition that comes with the stock firmware. One can get a larger space for OpenWrt by merging it with "Kernel". OpenWrt flash layout: ``` 0x000000000000-0x000000030000 : "u-boot" 0x000000030000-0x000000040000 : "u-boot-env" 0x000000040000-0x000000050000 : "factory" 0x000000050000-0x000000060000 : "config2_stock" 0x000000060000-0x000000fb0000 : "firmware" 0x000000fb0000-0x000001000000 : "private_stock" ``` The OpenWrt image must have 96 bytes of padding in the header. MAC addresses on OEM firmware: | | location on the flash | notes | |------ |----------------------- |---------- | | lan (eth2) | factory + 0xe000 | on label | | wan (eth3) | factory + 0xe006 | | | 2.4g (rax0) | not on flash | lan + 1 | | 5g (ra0) | not on flash | lan + 2 | Mac addresses of the 2.4g and 5g interface are stored as ASCII strings in the u-boot-env partition, but they are not used. OpenWrt calculates Wifi Mac addresses based on the LAN Mac. Flash and test instructions: Flash the encrypted image (available in the OpenWrt forum) through the stock D-Dink web interface. 1. Open the case, and solder the 4-pin header near the WAN port. 2. Connect it to a USB-UART TTL (3.3V) adapter, no need to connect VCC. 3. Open a terminal emulator (e.g. `screen /dev/ttyUSB0` on linux) with the settings mentioned above. 4. Setup a TFTP server on your PC that can serve `xxx-ramips-mt7621-dlink_dir-853-a1-initramfs-kernel.bin`. 5. Connect any LAN port to your PC and set a static IPv4 address to 192.168.0.101 (netmask 255.255.255.0). 6. Power on the device and keeps pressing 1 until you see the prompt. 7. Use default IP addresses and enter the file name accordingly, then hit enter. 8. Wait until it boots to OpenWrt, the default IP address is 192.168.1.1, you need to change your PC network adapter to use DHCP in order to access LUCI. 9. So far, the OpenWrt runs in RAM and the flash contents are not touched. You can try OpenWrt without having to overwrite the stock firmware, a reboot clears all changes. 10. Optionally, backup the stock firmware (the "firmware" partition) in Luci. 11. To permantly install OpenWrt to the device , click on "System -> Backup/Flash Firmware" in Luci and flash `xxx-ramips-mt7621-dlink_dir-853-a1-squashfs-sysupgrade.bin` Known problems: * WLAN0 defaults to 5G after a fresh installation, to enable 2.4G network, you need to config it manually in LUCI. * If you see jffs2 related warnings/errors after updating from the stock web interface, you need to do a reset in LUCI. The error will be gone after a cold reboot. Signed-off-by: Hang Zhou <929513338qq@gmail.com>
2023-02-26 09:13:33 +00:00
define Device/dlink_dir-853-a1
$(Device/dlink_dir-8xx-a1)
DEVICE_MODEL := DIR-853
DEVICE_VARIANT := A1
DEVICE_PACKAGES += kmod-usb3 kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += dlink_dir-853-a1
ramips: add support for D-Link DIR-853 A3 Specifications: * SoC: MT7621AT * RAM: 256MB * Flash: 128MB NAND flash * WiFi: MT7615DN (2.4GHz+5Ghz) with DBDC * LAN: 5x1000M * Firmware layout is Uboot with extra 96 bytes in header * Base PCB is DIR-1360 REV1.0 * LEDs Power Blue+Orange,Wan Blue+Orange,WPS Blue,"2.4G"Blue, "5G" Blue, USB Blue * Buttons Reset,WPS, Wifi MAC addresses on OEM firmware: lan factory 0xe000 f4:*:*:a8:*:65 (label) wan factory 0xe006 f4:*:*:a8:*:68 2.4 GHz [not on flash] f6:*:*:c8:*:66 5.0 GHz factory 0x4 f4:*:*:a8:*:66 The increment of the 4th byte for the 2.4g address appears to vary. Reported cases: 5g 2.4g increment f4:XX:XX:a8:XX:66 f6:XX:XX:c8:XX:66 +0x20 x0:xx:xx:68:xx:xx x2:xx:xx:48:xx:xx -0x20 x4:xx:xx:6a:xx:xx x6:xx:xx:4a:xx:xx -0x20 Since increment is inconsistent and there is no obvious pattern in swapping bytes, and the 2.4g address has local bit set anyway, it seems safer to use the LAN address with flipped byte here in order to prevent collisions between OpenWrt devices and OEM devices for this interface. This way we at least use an address as base that is definitely owned by the device at hand. Flashing instruction: The Dlink "Emergency Room" cannot be accessed through the reset button on this device. You can either use console or use the encrypted factory image availble in the openwrt forum. Once the encrypted image is flashed throuh the stock Dlink web interface, the sysupgrade images can be used. Header pins needs to be soldered near the WPS and Wifi buttons. The layout for the pins is (VCC,RX,TX,GND). No need to connect the VCC. the settings are: Bps/Par/Bits : 57600 8N1 Hardware Flow Control : No Software Flow Control : No Connect your client computer to LAN1 of the device Set your client IP address manually to 192.168.0.101 / 255.255.255.0. Call the recovery page or tftp for the device at http://192.168.0.1 Use the provided emergency web GUI to upload and flash a new firmware to the device At the time of adding support the wireless config needs to be set up by editing the wireless config file: * Setting the country code is mandatory, otherwise the router loses connectivity at the next reboot. This is mandatory and can be done from luci. After setting the country code the router boots correctly. A reset with the reset button will fix the issue and the user has to reconfigure. * This is minor since the 5g interface does not come up online although it is not set as disabled. 2 options here: 1- Either run the "wifi" command. Can be added from LUCI in system - startup - local startup and just add wifi above "exit 0". 2- Or add the serialize option in the wireless config file as shown below. This one would work and bring both interfaces automatically at every boot: config wifi-device 'radio0' option serialize '1' config wifi-device 'radio1' option serialize '1' Signed-off-by: Karim Dehouche <karimdplay@gmail.com> [rebase, improve MAC table, update wireless config comment, fix 2.4g macaddr setup] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-08-18 07:19:16 +00:00
define Device/dlink_dir-853-a3
$(Device/dlink_dir-xx60-a1)
DEVICE_MODEL := DIR-853
DEVICE_VARIANT := A3
endef
TARGET_DEVICES += dlink_dir-853-a3
ramips: add support for D-Link DIR-853-R1 This PR adds support for router D-Link DIR-853-R1 Specifications: SoC: MT7621AT RAM: 128MB Flash: 16MB SPI WiFi: MT7615DN (2.4GHz+5Ghz) with DBDC (This mode allows this single chip act as an 2x2 11n radio and an 2x2 11ac radio at the same time) LAN: 5x1000M LEDs Power Blue+Orange,Wan Blue+Orange,WPS Blue,"2.4G"Blue, "5G" Blue USB Blue Buttons Reset,WPS, Wifi MAC addresses: |Interface | MAC | Factory |Comment |------------|-----------------|-------------|---------------- |WAN sticker |C4:XX:XX:6E:XX:2A| |Sticker |LAN |C4:XX:XX:6E:XX:2B| | |Wifi (5g) |C4:XX:XX:6E:XX:2C|0x4 | |Wifi (2.4g) |C6:XX:XX:7E:XX:2C| | | | | | | |C4:XX:XX:6E:XX:2E|0x8004 0xe000| | |C4:XX:XX:6E:XX:2F|0xe006 | The increment of the 4th byte for the 2.4g address appears to vary. Reported cases: 5g 2.4g increment C4:XX:XX:6E:XX:2C C6:XX:XX:7E:XX:2C 0x10 f4:XX:XX:16:XX:32 f6:XX:XX:36:XX:32 0x20 F4:XX:XX:A6:XX:E3 F6:XX:XX:B6:XX:E3 0x10 Since increment is inconsistent and there is no obvious pattern in swapping bytes, and the 2.4g address has local bit set anyway, it seems safer to use the LAN address with flipped byte here in order to prevent collisions between OpenWrt devices and OEM devices for this interface. This way we at least use an address as base that is definitely owned by the device at hand. Flashing instruction: The Dlink "Emergency Room" Connect your client computer to LAN1 of the device Set your client IP address manually to 192.168.0.101 / 255.255.255.0. Then, power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the internet LED stops flashing Call the recovery page or tftp for the device at http://192.168.0.1 Use the provided emergency web GUI to upload and flash a new firmware to the device. Signed-off-by: Stas Fiduchi <fiduchi@protonmail.com> [commit title/message improvements, use correct label MAC address, calculate MAC addresses based on 0x4, minor DTS style fixes, add uart2 to state_default, remove factory image, add 2.4g MAC address, use partition DTSI, add macaddr comment in DTS] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-06-12 08:35:27 +00:00
define Device/dlink_dir-853-r1
$(Device/dlink_dir-8xx-r1)
DEVICE_MODEL := DIR-853
DEVICE_VARIANT := R1
DEVICE_PACKAGES += kmod-usb3 kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += dlink_dir-853-r1
define Device/dlink_dir-860l-b1
$(Device/dsa-migration)
$(Device/seama-lzma-loader)
SEAMA_SIGNATURE := wrgac13_dlink.2013gui_dir860lb
IMAGE_SIZE := 16064k
DEVICE_VENDOR := D-Link
DEVICE_MODEL := DIR-860L
DEVICE_VARIANT := B1
DEVICE_PACKAGES := kmod-mt76x2 kmod-usb3 kmod-usb-ledtrig-usbport \
-uboot-envtools
SUPPORTED_DEVICES += dir-860l-b1
endef
TARGET_DEVICES += dlink_dir-860l-b1
ramips: add support for D-Link DIR-867/DIR-882 A1 This patch adds support for D-Link DIR-867 A1 and D-Link DIR-882 A1. Given the similarity of these devices, this patch also introduces a common DTS shared between DIR-867 A1, DIR-878 A1 and DIR-882 A1. Specifications: * Board: AP-MTKH7-0002 * SoC: MediaTek MT7621AT * RAM: 128 MB (DDR3) * Flash: 16 MB (SPI NOR) * WiFi: MediaTek MT7615N (x2) * Switch: 1 WAN, 4 LAN (Gigabit) * Ports: 1 USB 2.0, 1 USB 3.0 * Buttons: Reset, WiFi Toggle, WPS * LEDs: Power (green/orange), Internet (green/orange), WiFi 2.4G (green), WiFi 5G (green), USB 2.0 (green), USB 3.0 (green) Notes: * WiFi 2.4G and WiFi 5G LEDs are wired directly to the wireless chips * DIR-867 wireless chips are limited to 3x3 streams at hardware level * USB ports and related LEDs available only on DIR-882 Serial port: * Parameters: 57600, 8N1 * Location: J1 header (close to the Reset, WiFi and WPS buttons) * Pinout: 1 - VCC 2 - RXD 3 - TXD 4 - GND Installation: * D-Link Recovery GUI: power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the power LED starts flashing orange, manually assign a static IP address under the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1 * Some modern browsers may have problems flashing via the Recovery GUI, if that occurs consider uploading the firmware through cURL: curl -v -i -F "firmware=@file.bin" 192.168.0.1 Signed-off-by: Mateus B. Cassiano <mbc07@live.com> [move DEVICE_VARIANT to individual definitions] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-15 21:45:39 +00:00
define Device/dlink_dir-867-a1
$(Device/dlink_dir-8xx-a1)
DEVICE_MODEL := DIR-867
DEVICE_VARIANT := A1
endef
TARGET_DEVICES += dlink_dir-867-a1
define Device/dlink_dir-878-a1
ramips: add support for D-Link DIR-867/DIR-882 A1 This patch adds support for D-Link DIR-867 A1 and D-Link DIR-882 A1. Given the similarity of these devices, this patch also introduces a common DTS shared between DIR-867 A1, DIR-878 A1 and DIR-882 A1. Specifications: * Board: AP-MTKH7-0002 * SoC: MediaTek MT7621AT * RAM: 128 MB (DDR3) * Flash: 16 MB (SPI NOR) * WiFi: MediaTek MT7615N (x2) * Switch: 1 WAN, 4 LAN (Gigabit) * Ports: 1 USB 2.0, 1 USB 3.0 * Buttons: Reset, WiFi Toggle, WPS * LEDs: Power (green/orange), Internet (green/orange), WiFi 2.4G (green), WiFi 5G (green), USB 2.0 (green), USB 3.0 (green) Notes: * WiFi 2.4G and WiFi 5G LEDs are wired directly to the wireless chips * DIR-867 wireless chips are limited to 3x3 streams at hardware level * USB ports and related LEDs available only on DIR-882 Serial port: * Parameters: 57600, 8N1 * Location: J1 header (close to the Reset, WiFi and WPS buttons) * Pinout: 1 - VCC 2 - RXD 3 - TXD 4 - GND Installation: * D-Link Recovery GUI: power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the power LED starts flashing orange, manually assign a static IP address under the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1 * Some modern browsers may have problems flashing via the Recovery GUI, if that occurs consider uploading the firmware through cURL: curl -v -i -F "firmware=@file.bin" 192.168.0.1 Signed-off-by: Mateus B. Cassiano <mbc07@live.com> [move DEVICE_VARIANT to individual definitions] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-15 21:45:39 +00:00
$(Device/dlink_dir-8xx-a1)
DEVICE_MODEL := DIR-878
DEVICE_VARIANT := A1
endef
TARGET_DEVICES += dlink_dir-878-a1
define Device/dlink_dir-878-r1
$(Device/dlink_dir-8xx-r1)
DEVICE_MODEL := DIR-878
DEVICE_VARIANT := R1
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | append-rootfs | check-size | \
sign-dlink-ru 57c5375741c30ca9ebcb36713db4ba51 \
ab0dff19af8842cdb70a86b4b68d23f7
endef
TARGET_DEVICES += dlink_dir-878-r1
ramips: add support for D-Link DIR-867/DIR-882 A1 This patch adds support for D-Link DIR-867 A1 and D-Link DIR-882 A1. Given the similarity of these devices, this patch also introduces a common DTS shared between DIR-867 A1, DIR-878 A1 and DIR-882 A1. Specifications: * Board: AP-MTKH7-0002 * SoC: MediaTek MT7621AT * RAM: 128 MB (DDR3) * Flash: 16 MB (SPI NOR) * WiFi: MediaTek MT7615N (x2) * Switch: 1 WAN, 4 LAN (Gigabit) * Ports: 1 USB 2.0, 1 USB 3.0 * Buttons: Reset, WiFi Toggle, WPS * LEDs: Power (green/orange), Internet (green/orange), WiFi 2.4G (green), WiFi 5G (green), USB 2.0 (green), USB 3.0 (green) Notes: * WiFi 2.4G and WiFi 5G LEDs are wired directly to the wireless chips * DIR-867 wireless chips are limited to 3x3 streams at hardware level * USB ports and related LEDs available only on DIR-882 Serial port: * Parameters: 57600, 8N1 * Location: J1 header (close to the Reset, WiFi and WPS buttons) * Pinout: 1 - VCC 2 - RXD 3 - TXD 4 - GND Installation: * D-Link Recovery GUI: power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the power LED starts flashing orange, manually assign a static IP address under the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1 * Some modern browsers may have problems flashing via the Recovery GUI, if that occurs consider uploading the firmware through cURL: curl -v -i -F "firmware=@file.bin" 192.168.0.1 Signed-off-by: Mateus B. Cassiano <mbc07@live.com> [move DEVICE_VARIANT to individual definitions] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-15 21:45:39 +00:00
define Device/dlink_dir-882-a1
$(Device/dlink_dir-8xx-a1)
DEVICE_MODEL := DIR-882
DEVICE_VARIANT := A1
DEVICE_PACKAGES += kmod-usb3 kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += dlink_dir-882-a1
define Device/dlink_dir-882-r1
$(Device/dlink_dir-8xx-r1)
DEVICE_MODEL := DIR-882
DEVICE_VARIANT := R1
DEVICE_PACKAGES += kmod-usb3 kmod-usb-ledtrig-usbport
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | append-rootfs | check-size | \
sign-dlink-ru 57c5375741c30ca9ebcb36713db4ba51 \
ab0dff19af8842cdb70a86b4b68d23f7
endef
TARGET_DEVICES += dlink_dir-882-r1
ramips: Add support for Dual-Q H721 Dual-Q H721 is a router platform board, it is the smaller model of the U7621-06. The device has the following specifications: MT7621AT (880 MHz) 256 of RAM (DDR3) 16 MB of FLASH (MX25l12805d SPI) 5x 1 Gbps Ethernet (MT7621 built-in switch) 1x M.2 (NGFF) 3.7V 3A max for 5G M.2 Modem work at USB3.0 mode 1x Minipcie 3.7V 3A max for LTE Modem work at USB2.0 Mode 2x Minipcie for WIFI card 4x Lan+1x Wan 10/100M/1000M RJ45 port 14x LEDs (1x GPIO-controlled) 1x reset button 1x UART header (4-pins) 1x mico SD-card reader 1x DC jack for main power (5~27 V) The following has been tested and is working: Ethernet switch miniPCIe slots (tested with Wi-Fi cards and LTE modem cards) miniSIM slot (works with normal size simcard) sysupgrade reset button micro SD-card reader Installation: This board has no locked down bootloader. The seller can be asked to install openwrt, so upgrades are standard sysupgrade method. Recovery: This board contains a Chinese, closed-source bootloader called Breed (Boot and Recovery Environment for Embedded Devices). Breed supports web recovery and to enter it, you keep the reset button pressed for around 5 seconds during boot. Your machine will be assigned an IP through DHCP and the router will use IP address 192.168.1.1. The recovery website is in Chinese, but is easy to use. Click on the second item in the list to access the recovery page, then the second item on the next page is where you select the firmware. In order to start the recovery, you click the button at the bottom. Signed-off-by: Dawsen Gao <dawsen_gao@163.com> [change author name (used SoB one), add ethernet pinctrl, apply sorting to device recipe] Signed-off-by: Sungbo Eo <mans0n@gorani.run>
2022-02-12 02:21:21 +00:00
define Device/dual-q_h721
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Dual-Q
DEVICE_MODEL := H721
DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-usb3 \
-wpad-basic-mbedtls -uboot-envtools
ramips: Add support for Dual-Q H721 Dual-Q H721 is a router platform board, it is the smaller model of the U7621-06. The device has the following specifications: MT7621AT (880 MHz) 256 of RAM (DDR3) 16 MB of FLASH (MX25l12805d SPI) 5x 1 Gbps Ethernet (MT7621 built-in switch) 1x M.2 (NGFF) 3.7V 3A max for 5G M.2 Modem work at USB3.0 mode 1x Minipcie 3.7V 3A max for LTE Modem work at USB2.0 Mode 2x Minipcie for WIFI card 4x Lan+1x Wan 10/100M/1000M RJ45 port 14x LEDs (1x GPIO-controlled) 1x reset button 1x UART header (4-pins) 1x mico SD-card reader 1x DC jack for main power (5~27 V) The following has been tested and is working: Ethernet switch miniPCIe slots (tested with Wi-Fi cards and LTE modem cards) miniSIM slot (works with normal size simcard) sysupgrade reset button micro SD-card reader Installation: This board has no locked down bootloader. The seller can be asked to install openwrt, so upgrades are standard sysupgrade method. Recovery: This board contains a Chinese, closed-source bootloader called Breed (Boot and Recovery Environment for Embedded Devices). Breed supports web recovery and to enter it, you keep the reset button pressed for around 5 seconds during boot. Your machine will be assigned an IP through DHCP and the router will use IP address 192.168.1.1. The recovery website is in Chinese, but is easy to use. Click on the second item in the list to access the recovery page, then the second item on the next page is where you select the firmware. In order to start the recovery, you click the button at the bottom. Signed-off-by: Dawsen Gao <dawsen_gao@163.com> [change author name (used SoB one), add ethernet pinctrl, apply sorting to device recipe] Signed-off-by: Sungbo Eo <mans0n@gorani.run>
2022-02-12 02:21:21 +00:00
endef
TARGET_DEVICES += dual-q_h721
define Device/d-team_newifi-d2
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 32448k
DEVICE_VENDOR := D-Team
DEVICE_MODEL := Newifi D2
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
endef
TARGET_DEVICES += d-team_newifi-d2
define Device/d-team_pbr-m1
$(Device/dsa-migration)
IMAGE_SIZE := 32448k
DEVICE_VENDOR := PandoraBox
DEVICE_MODEL := PBR-M1
DEVICE_PACKAGES := kmod-ata-ahci kmod-mt7603 kmod-mt76x2 kmod-sdhci-mt7620 \
kmod-usb3 kmod-usb-ledtrig-usbport -uboot-envtools
SUPPORTED_DEVICES += pbr-m1
endef
TARGET_DEVICES += d-team_pbr-m1
define Device/edimax_ra21s
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Edimax
DEVICE_MODEL := RA21S
DEVICE_ALT0_VENDOR := Edimax
DEVICE_ALT0_MODEL := Gemini RA21S
IMAGES += factory.bin
IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
elx-header 02020040 8844A2D168B45A2D
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
endef
TARGET_DEVICES += edimax_ra21s
ramips: add support for Edimax Gemini RE23S Hardware -------- SoC: Mediatek MT7621AT (880 MHz, 2 cores 4 threads) RAM: 128MB FLASH: 16MB NOR (Macronix MX25L12805D) ETH: 1x 10/100/1000 Mbps Ethernet (MT7530) WIFI: - 2.4GHz: 1x MT7615 (4x4:4) - 5GHz: 1x MT7615 (4x4:4) - 4 antennas: 2 external detachable and 2 internal BTN: - 1x Reset button - 1x WPS button LEDS: - 1x Green led (Power) - 1x Green-Amber-Red led (Wifi) UART: - 57600-8-N-1 Everything works correctly. Installation ------------ Flash the factory image directly from OEM web interface. (You can login using these credentials: admin/1234) Restore OEM Firmware -------------------- Flash the OEM "bin" firmware directly from LUCI. The firmware is downloadable from the OEM web page. Warning: Remember to not keep settings! Warning2: Remember to force the flash. Restoring procedure tested with RE23_1.08.bin MAC addresses ------------- factory 0x4 *:24 factory 0x8004 *:25 Cimage 0x07 *:24 Cimage 0x0D *:24 Cimage 0x13 *:24 Cimage 0x19 *:25 No other addresses were found in factory partition. Since the label contains both the 2.4GHz and 5GHz mac address I decided to set the 5GHz one as label-mac-device. Moreover it also corresponds to the lan mac address. Notes ----- The wifi led in the OEM firmware changes colour depending on the signal strength. This can be done in OpenWrt but just for one interface. So for now will not be any default action for this led. If you want to open the case, pay attention to the antenna placed on the bottom part of the front cover. The wire is a bit short and it breaks easily. (I broke it) Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> [fix two typos and add extended MAC address section to commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-05-19 23:27:56 +00:00
define Device/edimax_re23s
$(Device/dsa-migration)
ramips: add support for Edimax Gemini RE23S Hardware -------- SoC: Mediatek MT7621AT (880 MHz, 2 cores 4 threads) RAM: 128MB FLASH: 16MB NOR (Macronix MX25L12805D) ETH: 1x 10/100/1000 Mbps Ethernet (MT7530) WIFI: - 2.4GHz: 1x MT7615 (4x4:4) - 5GHz: 1x MT7615 (4x4:4) - 4 antennas: 2 external detachable and 2 internal BTN: - 1x Reset button - 1x WPS button LEDS: - 1x Green led (Power) - 1x Green-Amber-Red led (Wifi) UART: - 57600-8-N-1 Everything works correctly. Installation ------------ Flash the factory image directly from OEM web interface. (You can login using these credentials: admin/1234) Restore OEM Firmware -------------------- Flash the OEM "bin" firmware directly from LUCI. The firmware is downloadable from the OEM web page. Warning: Remember to not keep settings! Warning2: Remember to force the flash. Restoring procedure tested with RE23_1.08.bin MAC addresses ------------- factory 0x4 *:24 factory 0x8004 *:25 Cimage 0x07 *:24 Cimage 0x0D *:24 Cimage 0x13 *:24 Cimage 0x19 *:25 No other addresses were found in factory partition. Since the label contains both the 2.4GHz and 5GHz mac address I decided to set the 5GHz one as label-mac-device. Moreover it also corresponds to the lan mac address. Notes ----- The wifi led in the OEM firmware changes colour depending on the signal strength. This can be done in OpenWrt but just for one interface. So for now will not be any default action for this led. If you want to open the case, pay attention to the antenna placed on the bottom part of the front cover. The wire is a bit short and it breaks easily. (I broke it) Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> [fix two typos and add extended MAC address section to commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-05-19 23:27:56 +00:00
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 15680k
DEVICE_VENDOR := Edimax
DEVICE_MODEL := RE23S
DEVICE_ALT0_VENDOR := Edimax
DEVICE_ALT0_MODEL := Gemini RE23S
IMAGE/sysupgrade.bin := append-kernel | append-rootfs | \
edimax-header -s CSYS -m RN76 -f 0x70000 -S 0x01100000 | pad-rootfs | \
check-size | append-metadata
ramips: add support for Edimax Gemini RE23S Hardware -------- SoC: Mediatek MT7621AT (880 MHz, 2 cores 4 threads) RAM: 128MB FLASH: 16MB NOR (Macronix MX25L12805D) ETH: 1x 10/100/1000 Mbps Ethernet (MT7530) WIFI: - 2.4GHz: 1x MT7615 (4x4:4) - 5GHz: 1x MT7615 (4x4:4) - 4 antennas: 2 external detachable and 2 internal BTN: - 1x Reset button - 1x WPS button LEDS: - 1x Green led (Power) - 1x Green-Amber-Red led (Wifi) UART: - 57600-8-N-1 Everything works correctly. Installation ------------ Flash the factory image directly from OEM web interface. (You can login using these credentials: admin/1234) Restore OEM Firmware -------------------- Flash the OEM "bin" firmware directly from LUCI. The firmware is downloadable from the OEM web page. Warning: Remember to not keep settings! Warning2: Remember to force the flash. Restoring procedure tested with RE23_1.08.bin MAC addresses ------------- factory 0x4 *:24 factory 0x8004 *:25 Cimage 0x07 *:24 Cimage 0x0D *:24 Cimage 0x13 *:24 Cimage 0x19 *:25 No other addresses were found in factory partition. Since the label contains both the 2.4GHz and 5GHz mac address I decided to set the 5GHz one as label-mac-device. Moreover it also corresponds to the lan mac address. Notes ----- The wifi led in the OEM firmware changes colour depending on the signal strength. This can be done in OpenWrt but just for one interface. So for now will not be any default action for this led. If you want to open the case, pay attention to the antenna placed on the bottom part of the front cover. The wire is a bit short and it breaks easily. (I broke it) Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> [fix two typos and add extended MAC address section to commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-05-19 23:27:56 +00:00
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | append-rootfs | \
edimax-header -s CSYS -m RN76 -f 0x70000 -S 0x01100000 | pad-rootfs | \
check-size
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
ramips: add support for Edimax Gemini RE23S Hardware -------- SoC: Mediatek MT7621AT (880 MHz, 2 cores 4 threads) RAM: 128MB FLASH: 16MB NOR (Macronix MX25L12805D) ETH: 1x 10/100/1000 Mbps Ethernet (MT7530) WIFI: - 2.4GHz: 1x MT7615 (4x4:4) - 5GHz: 1x MT7615 (4x4:4) - 4 antennas: 2 external detachable and 2 internal BTN: - 1x Reset button - 1x WPS button LEDS: - 1x Green led (Power) - 1x Green-Amber-Red led (Wifi) UART: - 57600-8-N-1 Everything works correctly. Installation ------------ Flash the factory image directly from OEM web interface. (You can login using these credentials: admin/1234) Restore OEM Firmware -------------------- Flash the OEM "bin" firmware directly from LUCI. The firmware is downloadable from the OEM web page. Warning: Remember to not keep settings! Warning2: Remember to force the flash. Restoring procedure tested with RE23_1.08.bin MAC addresses ------------- factory 0x4 *:24 factory 0x8004 *:25 Cimage 0x07 *:24 Cimage 0x0D *:24 Cimage 0x13 *:24 Cimage 0x19 *:25 No other addresses were found in factory partition. Since the label contains both the 2.4GHz and 5GHz mac address I decided to set the 5GHz one as label-mac-device. Moreover it also corresponds to the lan mac address. Notes ----- The wifi led in the OEM firmware changes colour depending on the signal strength. This can be done in OpenWrt but just for one interface. So for now will not be any default action for this led. If you want to open the case, pay attention to the antenna placed on the bottom part of the front cover. The wire is a bit short and it breaks easily. (I broke it) Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> [fix two typos and add extended MAC address section to commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-05-19 23:27:56 +00:00
endef
TARGET_DEVICES += edimax_re23s
define Device/edimax_rg21s
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Edimax
DEVICE_MODEL := Gemini AC2600 RG21S
IMAGES += factory.bin
IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
elx-header 02020038 8844A2D168B45A2D
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
endef
TARGET_DEVICES += edimax_rg21s
define Device/elecom_wrc-1167ghbk2-s
$(Device/dsa-migration)
IMAGE_SIZE := 15488k
DEVICE_VENDOR := ELECOM
DEVICE_MODEL := WRC-1167GHBK2-S
IMAGES += factory.bin
IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
elecom-wrc-gs-factory WRC-1167GHBK2-S 0.00
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
endef
TARGET_DEVICES += elecom_wrc-1167ghbk2-s
define Device/elecom_wrc-gs
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := ELECOM
IMAGES += factory.bin
IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
elecom-wrc-gs-factory $$$$(ELECOM_HWNAME) 0.00 -N | \
append-string MT7621_ELECOM_$$$$(ELECOM_HWNAME)
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
endef
define Device/elecom_wrc-1167gs2-b
$(Device/elecom_wrc-gs)
IMAGE_SIZE := 11264k
DEVICE_MODEL := WRC-1167GS2-B
ELECOM_HWNAME := WRC-1167GS2
endef
TARGET_DEVICES += elecom_wrc-1167gs2-b
define Device/elecom_wrc-1167gst2
$(Device/elecom_wrc-gs)
IMAGE_SIZE := 24576k
DEVICE_MODEL := WRC-1167GST2
ELECOM_HWNAME := WRC-1167GST2
endef
TARGET_DEVICES += elecom_wrc-1167gst2
define Device/elecom_wrc-1750gs
$(Device/elecom_wrc-gs)
IMAGE_SIZE := 11264k
DEVICE_MODEL := WRC-1750GS
ELECOM_HWNAME := WRC-1750GS
endef
TARGET_DEVICES += elecom_wrc-1750gs
define Device/elecom_wrc-1750gst2
$(Device/elecom_wrc-gs)
IMAGE_SIZE := 24576k
DEVICE_MODEL := WRC-1750GST2
ELECOM_HWNAME := WRC-1750GST2
endef
TARGET_DEVICES += elecom_wrc-1750gst2
define Device/elecom_wrc-1750gsv
$(Device/elecom_wrc-gs)
IMAGE_SIZE := 11264k
DEVICE_MODEL := WRC-1750GSV
ELECOM_HWNAME := WRC-1750GSV
endef
TARGET_DEVICES += elecom_wrc-1750gsv
define Device/elecom_wrc-1900gst
$(Device/elecom_wrc-gs)
IMAGE_SIZE := 11264k
DEVICE_MODEL := WRC-1900GST
ELECOM_HWNAME := WRC-1900GST
endef
TARGET_DEVICES += elecom_wrc-1900gst
define Device/elecom_wrc-2533ghbk2-t
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := ELECOM
DEVICE_MODEL := WRC-2533GHBK2-T
IMAGE_SIZE := 7808k
IMAGES += factory.bin
IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
elx-header 0107003b 8844A2D168B45A2D | \
elecom-product-header WRC-2533GHBK2-T
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
endef
TARGET_DEVICES += elecom_wrc-2533ghbk2-t
define Device/elecom_wrc-2533ghbk-i
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := ELECOM
DEVICE_MODEL := WRC-2533GHBK-I
IMAGE_SIZE := 9856k
IMAGES += factory.bin
IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
elx-header 0107002d 8844A2D168B45A2D | \
elecom-product-header WRC-2533GHBK-I
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
endef
TARGET_DEVICES += elecom_wrc-2533ghbk-i
define Device/elecom_wrc-2533gs2
$(Device/elecom_wrc-gs)
IMAGE_SIZE := 11264k
DEVICE_MODEL := WRC-2533GS2
ELECOM_HWNAME := WRC-2533GS2
endef
TARGET_DEVICES += elecom_wrc-2533gs2
define Device/elecom_wrc-2533gst
$(Device/elecom_wrc-gs)
IMAGE_SIZE := 11264k
DEVICE_MODEL := WRC-2533GST
ELECOM_HWNAME := WRC-2533GST
endef
TARGET_DEVICES += elecom_wrc-2533gst
define Device/elecom_wrc-2533gst2
$(Device/elecom_wrc-gs)
IMAGE_SIZE := 24576k
DEVICE_MODEL := WRC-2533GST2
ELECOM_HWNAME := WRC-2533GST2
endef
TARGET_DEVICES += elecom_wrc-2533gst2
ramips: add support for Etisalat S3 Etisalat S3 is a wireless WiFi 5 router manufactured by Sercomm company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB Flash: 128 MiB Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2 Wireless 5 GHz (MT7615E): a/n/ac, 4x4 Ethernet: 5x GbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1x USB3.0 Button: 2 buttons (Reset & WPS) LEDs: - 1x Status (RGB) - 1x 2.4G (blue, hardware, mt76-phy0) - 1x 5G (blue, hardware, mt76-phy1) Power: 12 VDC, 1.5 A Connector type: barrel Bootloader: U-Boot Installation ----------------- 1. Login to the router web interface under admin account 2. Navigate to Settings -> Configuration -> Save to Computer 3. Decode the configuration. For example, using cfgtool.py tool (see related section): cfgtool.py -u configurationBackup.cfg 4. Open configurationBackup.xml and find the following line: <PARAMETER name="Password" type="string" value="<your router serial \ is here>" writable="1" encryption="1" password="1"/> 5. Insert the following line after and save: <PARAMETER name="Enable" type="boolean" value="1" writable="1" encryption="0"/> 6. Encode the configuration. For example, using cfgtool.py tool: cfgtool.py -p configurationBackup.xml 7. Upload the changed configuration (configurationBackup_changed.cfg) to the router 8. Login to the router web interface (SuperUser:ETxxxxxxxxxx, where ETxxxxxxxxxx is the serial number from the backplate label) 9. Navigate to Settings -> WAN -> Add static IP interface (e.g. 10.0.0.1/255.255.255.0) 10. Navigate to Settings -> Remote cotrol -> Add SSH, port 22, 10.0.0.0/255.255.255.0 and interface created before 11. Change IP of your client to 10.0.0.2/255.255.255.0 and connect the ethernet cable to the WAN port of the router 12. Connect to the router using SSH shell under SuperUser account 13. Run in SSH shell: sh 14. Make a mtd backup (optional, see related section) 15. Change bootflag to Sercomm1 and reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 reboot 16. Login to the router web interface under admin account 17. Remove dots from the OpenWrt factory image filename 18. Update firmware via web using OpenWrt factory image Revert to stock --------------- Change bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 mtd backup ---------- 1. Set up a tftp server (e.g. tftpd64 for windows) 2. Connect to a router using SSH shell and run the following commands: cd /tmp for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \ tftp -l mtd$i -p 10.0.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done tftp -l mtd.md5 -p 10.0.0.2 Recovery -------- Use sercomm-recovery tool. Link: https://github.com/danitool/sercomm-recovery MAC Addresses ------------- +-----+------------+---------+ | use | address | example | +-----+------------+---------+ | LAN | label | *:50 | | WAN | label + 11 | *:5b | | 2g | label + 2 | *:52 | | 5g | label + 3 | *:53 | +-----+------------+---------+ The label MAC address was found in Factory 0x21000 cfgtool.py ---------- A tool for decoding and encoding Sercomm configs. Link: https://github.com/r3d5ky/sercomm_cfg_unpacker Co-authored-by: Karim Dehouche <karimdplay@gmail.com> Co-authored-by: Maximilian Weinmann <x1@disroot.org> Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-11-27 14:01:58 +00:00
define Device/etisalat_s3
$(Device/sercomm_dxx)
IMAGE_SIZE := 32768k
SERCOMM_HWID := DDK
SERCOMM_HWVER := 10000
SERCOMM_SWVER := 4009
DEVICE_VENDOR := Etisalat
DEVICE_MODEL := S3
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware kmod-usb3
ramips: add support for Etisalat S3 Etisalat S3 is a wireless WiFi 5 router manufactured by Sercomm company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB Flash: 128 MiB Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2 Wireless 5 GHz (MT7615E): a/n/ac, 4x4 Ethernet: 5x GbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1x USB3.0 Button: 2 buttons (Reset & WPS) LEDs: - 1x Status (RGB) - 1x 2.4G (blue, hardware, mt76-phy0) - 1x 5G (blue, hardware, mt76-phy1) Power: 12 VDC, 1.5 A Connector type: barrel Bootloader: U-Boot Installation ----------------- 1. Login to the router web interface under admin account 2. Navigate to Settings -> Configuration -> Save to Computer 3. Decode the configuration. For example, using cfgtool.py tool (see related section): cfgtool.py -u configurationBackup.cfg 4. Open configurationBackup.xml and find the following line: <PARAMETER name="Password" type="string" value="<your router serial \ is here>" writable="1" encryption="1" password="1"/> 5. Insert the following line after and save: <PARAMETER name="Enable" type="boolean" value="1" writable="1" encryption="0"/> 6. Encode the configuration. For example, using cfgtool.py tool: cfgtool.py -p configurationBackup.xml 7. Upload the changed configuration (configurationBackup_changed.cfg) to the router 8. Login to the router web interface (SuperUser:ETxxxxxxxxxx, where ETxxxxxxxxxx is the serial number from the backplate label) 9. Navigate to Settings -> WAN -> Add static IP interface (e.g. 10.0.0.1/255.255.255.0) 10. Navigate to Settings -> Remote cotrol -> Add SSH, port 22, 10.0.0.0/255.255.255.0 and interface created before 11. Change IP of your client to 10.0.0.2/255.255.255.0 and connect the ethernet cable to the WAN port of the router 12. Connect to the router using SSH shell under SuperUser account 13. Run in SSH shell: sh 14. Make a mtd backup (optional, see related section) 15. Change bootflag to Sercomm1 and reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 reboot 16. Login to the router web interface under admin account 17. Remove dots from the OpenWrt factory image filename 18. Update firmware via web using OpenWrt factory image Revert to stock --------------- Change bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 mtd backup ---------- 1. Set up a tftp server (e.g. tftpd64 for windows) 2. Connect to a router using SSH shell and run the following commands: cd /tmp for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \ tftp -l mtd$i -p 10.0.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done tftp -l mtd.md5 -p 10.0.0.2 Recovery -------- Use sercomm-recovery tool. Link: https://github.com/danitool/sercomm-recovery MAC Addresses ------------- +-----+------------+---------+ | use | address | example | +-----+------------+---------+ | LAN | label | *:50 | | WAN | label + 11 | *:5b | | 2g | label + 2 | *:52 | | 5g | label + 3 | *:53 | +-----+------------+---------+ The label MAC address was found in Factory 0x21000 cfgtool.py ---------- A tool for decoding and encoding Sercomm configs. Link: https://github.com/r3d5ky/sercomm_cfg_unpacker Co-authored-by: Karim Dehouche <karimdplay@gmail.com> Co-authored-by: Maximilian Weinmann <x1@disroot.org> Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-11-27 14:01:58 +00:00
endef
TARGET_DEVICES += etisalat_s3
define Device/firefly_firewrt
$(Device/dsa-migration)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Firefly
DEVICE_MODEL := FireWRT
DEVICE_PACKAGES := kmod-mt76x2 kmod-usb3 kmod-usb-ledtrig-usbport \
-uboot-envtools
SUPPORTED_DEVICES += firewrt
endef
TARGET_DEVICES += firefly_firewrt
define Device/gehua_ghl-r-001
$(Device/dsa-migration)
IMAGE_SIZE := 32448k
DEVICE_VENDOR := GeHua
DEVICE_MODEL := GHL-R-001
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
endef
TARGET_DEVICES += gehua_ghl-r-001
ramips: add support for GL.iNet GL-MT1300 The GL-MT1300 is a high-performance new generation pocket-sized router that offers a powerful hardware and first-class cybersecurity protocol with unique and modern design. Specifications: - SoC: MT7621A, Dual-Core @880MHz - RAM: 256 MB DDR3 - Flash: 32 MB - Ethernet: 3 x 10/100/1000: 2 x LAN + 1 x WAN - Wireless: 1 x MT7615D Dual-Band 2.4GHz(400Mbps) + 5GHz(867Mbps) - USB: 1 x USB 3.0 port - Slot: 1 x MicroSD card slot - Button: 1 x Reset button - Switch: 1 x Mode switch - LED: 1 x Blue LED + 1 x White LED MAC addresses based on vendor firmware: WAN : factory 0x4000 LAN : Mac from factory 0x4000 + 1 2.4GHz : factory 0x4 5GHz : Mac form factory 0x4 + 1 Flashing instructions: 1.Connect to one of LAN ports. 2.Set the static IP on the PC to 192.168.1.2. 3.Press the Reset button and power the device (do not release the button). After waiting for the blue led to flash 5 times, the white led will come on and release the button. 4.Browse the 192.168.1.1 web page and update firmware according to web tips. 5.The blue led will flash when the firmware is being upgraded. 6.The blue led stops blinking to indicate that the firmware upgrade is complete and U-Boot automatically starts the firmware. For more information on GL-MT1300, see the OFFICIAL GL.iNet website: https://www.gl-inet.com/products/gl-mt1300/ Signed-off-by: Xinfa Deng <xinfa.deng@gl-inet.com> [add input-type for switch, wrap long line in 10_fix_wifi_mac] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-16 07:58:28 +00:00
define Device/glinet_gl-mt1300
$(Device/dsa-migration)
IMAGE_SIZE := 32448k
DEVICE_VENDOR := GL.iNet
DEVICE_MODEL := GL-MT1300
DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 -uboot-envtools
ramips: add support for GL.iNet GL-MT1300 The GL-MT1300 is a high-performance new generation pocket-sized router that offers a powerful hardware and first-class cybersecurity protocol with unique and modern design. Specifications: - SoC: MT7621A, Dual-Core @880MHz - RAM: 256 MB DDR3 - Flash: 32 MB - Ethernet: 3 x 10/100/1000: 2 x LAN + 1 x WAN - Wireless: 1 x MT7615D Dual-Band 2.4GHz(400Mbps) + 5GHz(867Mbps) - USB: 1 x USB 3.0 port - Slot: 1 x MicroSD card slot - Button: 1 x Reset button - Switch: 1 x Mode switch - LED: 1 x Blue LED + 1 x White LED MAC addresses based on vendor firmware: WAN : factory 0x4000 LAN : Mac from factory 0x4000 + 1 2.4GHz : factory 0x4 5GHz : Mac form factory 0x4 + 1 Flashing instructions: 1.Connect to one of LAN ports. 2.Set the static IP on the PC to 192.168.1.2. 3.Press the Reset button and power the device (do not release the button). After waiting for the blue led to flash 5 times, the white led will come on and release the button. 4.Browse the 192.168.1.1 web page and update firmware according to web tips. 5.The blue led will flash when the firmware is being upgraded. 6.The blue led stops blinking to indicate that the firmware upgrade is complete and U-Boot automatically starts the firmware. For more information on GL-MT1300, see the OFFICIAL GL.iNet website: https://www.gl-inet.com/products/gl-mt1300/ Signed-off-by: Xinfa Deng <xinfa.deng@gl-inet.com> [add input-type for switch, wrap long line in 10_fix_wifi_mac] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-16 07:58:28 +00:00
endef
TARGET_DEVICES += glinet_gl-mt1300
define Device/gnubee_gb-pc1
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := GnuBee
DEVICE_MODEL := Personal Cloud One
DEVICE_PACKAGES := kmod-ata-ahci kmod-usb3 kmod-sdhci-mt7620 \
-wpad-basic-mbedtls -uboot-envtools
IMAGE_SIZE := 32448k
endef
TARGET_DEVICES += gnubee_gb-pc1
define Device/gnubee_gb-pc2
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := GnuBee
DEVICE_MODEL := Personal Cloud Two
DEVICE_PACKAGES := kmod-ata-ahci kmod-usb3 kmod-sdhci-mt7620 \
-wpad-basic-mbedtls -uboot-envtools
IMAGE_SIZE := 32448k
endef
TARGET_DEVICES += gnubee_gb-pc2
ramips: Add support for CJ-Hello HYC-G920 Hanyang Digitech Co., Ltd. MSIP-CMM-HYD-HYC-G920 CJ-Hello HYC-G920 SoC : MediaTek MT7621AT RAM : 256M (SK hynix H5TQ2G63FFR) FLASH : 16MB (Winbond W25Q128BV) WiFi : MediaTek MT7602EN bgn 2SS WiFi : MediaTek MT7612EN nac 2SS BTN : Reset LED : - Power RED - WAN Green - LAN {1-4} - WiFi 2.4 GHz Blue - WiFi 5 GHz Blue - USB Green **For MT7621 stage1 DDR Test** UART : J4 GND - 3V3 - TX - RX - GND / 57600-8N1 ``` MT7621 stage1 code 10:33:55 (ASIC) CPU=500000000 HZ BUS=166666666 HZ ``` **For u boot environment** UART : J4 GND - 3V3 - TX - RX - GND / 115200-8N1 **UART Menu** ``` Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP. ``` **Steps** Press 4: Entr boot command line interface. On the pormpt enter. `setenv firmware_size 0xf60000` Then enter. `saveenv` Then enter. `reset` **Device will reboot** Set your IP 192.168.100.100/24 Connect your lan cable to wan port. **On the UART Menu** Press 2: Load system code then write to Flash via TFTP. Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N) **enter** `Y` Please Input new ones /or Ctrl-C to discard Input device IP (192.168.100.55) ==:`192.168.100.55` Input server IP (192.168.100.100) ==:`192.168.100.100` Input Linux Kernel filename () ==:`openwrt-22.03.0-ramips-mt7621-hanyang_hyc-g920-squashfs-sysupgrade.bin` After uploading firmware image, device will boot Openwrt. Signed-off-by: Muhammad AL-Qadhy <m.ismael@gmail.com>
2023-03-21 06:49:22 +00:00
define Device/hanyang_hyc-g920
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := Hanyang
DEVICE_MODEL := CJ-Hello HYC-G920
IMAGE_SIZE := 15744k
DEVICE_PACKAGES := kmod-usb3 kmod-mt76x2 kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += hanyang_hyc-g920
ramips: add support for H3C TX1800 Plus / TX1801 Plus / TX1806 H3C TX180x series WiFi6 routers are customized by different carrier. While these three devices look different, they use the same motherboard inside. Another minor difference comes from the model name definition in the u-boot environment variable. Specifications: SOC: MT7621 + MT7915 ROM: 128 MiB RAM: 256 MiB LED: status *2 Button: reset *1 + wps/mesh *1 Ethernet: lan *3 + wan *1 (10/100/1000Mbps) TTL Baudrate: 115200 TFTP server IP: 192.168.124.99 MAC Address: use address(sample 1) address(sample 2) source label 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 u-boot-env@ethaddr lan 88:xx:xx:98:xx:13 88:xx:xx:a2:xx:a6 $label +1 wan 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 $label WiFi4_2G 8a:xx:xx:58:xx:14 8a:xx:xx:52:xx:a7 (Compatibility mode) WiFi5_5G 8a:xx:xx:b8:xx:14 8a:xx:xx:b2:xx:a7 (Compatibility mode) WiFi6_2G 8a:xx:xx:18:xx:14 8a:xx:xx:12:xx:a7 WiFi6_5G 8a:xx:xx:78:xx:14 8a:xx:xx:72:xx:a7 Compatibility mode is used to guarantee the connection of old devices that only support WiFi4 or WiFi5. TFTP + TTL Installation: Although a TTL connection is required for installation, we do not need to tear down it. We can find the TTL port from the cooling hole at the bottom. It is located below LAN3 and the pins are defined as follows: |LAN1|LAN2|LAN3|----|WAN| -------------------- |GND|TX|RX|VCC| 1. Set tftp server IP to 192.168.124.99 and put initramfs firmware in server's root directory, rename it to a simple name "initramfs.bin". 2. Plug in the power supply and wait for power on, connect the TTL cable and open a TTL session, enter "reboot", then enter "Y" to confirm. Finally push "0" to interruput boot while booting. 3. Execute command to install a initramfs system: # tftp 0x80010000 192.168.124.99:initramfs.bin # bootm 0x80010000 4. Backup nand flash by OpenWrt LuCI or dd instruction. We need those partitions if we want to back to stock firmwre due to official website does not provide download link. # dd if=/dev/mtd1 of=/tmp/u-boot-env.bin # dd if=/dev/mtd4 of=/tmp/firmware.bin 5. Edit u-boot env to ensure use default bootargs and first image slot: # fw_setenv bootargs # fw_setenv bootflag 0 6. Upgrade sysupgrade firmware. 7. About restore stock firmware: flash the "firmware" and "u-boot-env" partitions that we backed up in step 4. # mtd write /tmp/u-boot-env.bin u-boot-env # mtd write /tmp/firmware.bin firmware Additional Info: The H3C stock firmware has a 160-byte firmware header that appears to use a non-standard CRC32 verification algorithm. For this part of the data, the u-boot does not check it so we can just directly replace it with a placeholder. Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2022-03-20 15:42:37 +00:00
define Device/h3c_tx180x
$(Device/nand)
ramips: add support for H3C TX1800 Plus / TX1801 Plus / TX1806 H3C TX180x series WiFi6 routers are customized by different carrier. While these three devices look different, they use the same motherboard inside. Another minor difference comes from the model name definition in the u-boot environment variable. Specifications: SOC: MT7621 + MT7915 ROM: 128 MiB RAM: 256 MiB LED: status *2 Button: reset *1 + wps/mesh *1 Ethernet: lan *3 + wan *1 (10/100/1000Mbps) TTL Baudrate: 115200 TFTP server IP: 192.168.124.99 MAC Address: use address(sample 1) address(sample 2) source label 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 u-boot-env@ethaddr lan 88:xx:xx:98:xx:13 88:xx:xx:a2:xx:a6 $label +1 wan 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 $label WiFi4_2G 8a:xx:xx:58:xx:14 8a:xx:xx:52:xx:a7 (Compatibility mode) WiFi5_5G 8a:xx:xx:b8:xx:14 8a:xx:xx:b2:xx:a7 (Compatibility mode) WiFi6_2G 8a:xx:xx:18:xx:14 8a:xx:xx:12:xx:a7 WiFi6_5G 8a:xx:xx:78:xx:14 8a:xx:xx:72:xx:a7 Compatibility mode is used to guarantee the connection of old devices that only support WiFi4 or WiFi5. TFTP + TTL Installation: Although a TTL connection is required for installation, we do not need to tear down it. We can find the TTL port from the cooling hole at the bottom. It is located below LAN3 and the pins are defined as follows: |LAN1|LAN2|LAN3|----|WAN| -------------------- |GND|TX|RX|VCC| 1. Set tftp server IP to 192.168.124.99 and put initramfs firmware in server's root directory, rename it to a simple name "initramfs.bin". 2. Plug in the power supply and wait for power on, connect the TTL cable and open a TTL session, enter "reboot", then enter "Y" to confirm. Finally push "0" to interruput boot while booting. 3. Execute command to install a initramfs system: # tftp 0x80010000 192.168.124.99:initramfs.bin # bootm 0x80010000 4. Backup nand flash by OpenWrt LuCI or dd instruction. We need those partitions if we want to back to stock firmwre due to official website does not provide download link. # dd if=/dev/mtd1 of=/tmp/u-boot-env.bin # dd if=/dev/mtd4 of=/tmp/firmware.bin 5. Edit u-boot env to ensure use default bootargs and first image slot: # fw_setenv bootargs # fw_setenv bootflag 0 6. Upgrade sysupgrade firmware. 7. About restore stock firmware: flash the "firmware" and "u-boot-env" partitions that we backed up in step 4. # mtd write /tmp/u-boot-env.bin u-boot-env # mtd write /tmp/firmware.bin firmware Additional Info: The H3C stock firmware has a 160-byte firmware header that appears to use a non-standard CRC32 verification algorithm. For this part of the data, the u-boot does not check it so we can just directly replace it with a placeholder. Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2022-03-20 15:42:37 +00:00
KERNEL_SIZE := 8192k
IMAGE_SIZE := 120832k
KERNEL_LOADADDR := 0x82000000
KERNEL_INITRAMFS := kernel-bin | relocate-kernel 0x80001000 | lzma | \
fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
KERNEL := $$(KERNEL_INITRAMFS) | h3c-blank-header
DEVICE_VENDOR := H3C
DEVICE_PACKAGES := kmod-mt7915-firmware
ramips: add support for H3C TX1800 Plus / TX1801 Plus / TX1806 H3C TX180x series WiFi6 routers are customized by different carrier. While these three devices look different, they use the same motherboard inside. Another minor difference comes from the model name definition in the u-boot environment variable. Specifications: SOC: MT7621 + MT7915 ROM: 128 MiB RAM: 256 MiB LED: status *2 Button: reset *1 + wps/mesh *1 Ethernet: lan *3 + wan *1 (10/100/1000Mbps) TTL Baudrate: 115200 TFTP server IP: 192.168.124.99 MAC Address: use address(sample 1) address(sample 2) source label 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 u-boot-env@ethaddr lan 88:xx:xx:98:xx:13 88:xx:xx:a2:xx:a6 $label +1 wan 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 $label WiFi4_2G 8a:xx:xx:58:xx:14 8a:xx:xx:52:xx:a7 (Compatibility mode) WiFi5_5G 8a:xx:xx:b8:xx:14 8a:xx:xx:b2:xx:a7 (Compatibility mode) WiFi6_2G 8a:xx:xx:18:xx:14 8a:xx:xx:12:xx:a7 WiFi6_5G 8a:xx:xx:78:xx:14 8a:xx:xx:72:xx:a7 Compatibility mode is used to guarantee the connection of old devices that only support WiFi4 or WiFi5. TFTP + TTL Installation: Although a TTL connection is required for installation, we do not need to tear down it. We can find the TTL port from the cooling hole at the bottom. It is located below LAN3 and the pins are defined as follows: |LAN1|LAN2|LAN3|----|WAN| -------------------- |GND|TX|RX|VCC| 1. Set tftp server IP to 192.168.124.99 and put initramfs firmware in server's root directory, rename it to a simple name "initramfs.bin". 2. Plug in the power supply and wait for power on, connect the TTL cable and open a TTL session, enter "reboot", then enter "Y" to confirm. Finally push "0" to interruput boot while booting. 3. Execute command to install a initramfs system: # tftp 0x80010000 192.168.124.99:initramfs.bin # bootm 0x80010000 4. Backup nand flash by OpenWrt LuCI or dd instruction. We need those partitions if we want to back to stock firmwre due to official website does not provide download link. # dd if=/dev/mtd1 of=/tmp/u-boot-env.bin # dd if=/dev/mtd4 of=/tmp/firmware.bin 5. Edit u-boot env to ensure use default bootargs and first image slot: # fw_setenv bootargs # fw_setenv bootflag 0 6. Upgrade sysupgrade firmware. 7. About restore stock firmware: flash the "firmware" and "u-boot-env" partitions that we backed up in step 4. # mtd write /tmp/u-boot-env.bin u-boot-env # mtd write /tmp/firmware.bin firmware Additional Info: The H3C stock firmware has a 160-byte firmware header that appears to use a non-standard CRC32 verification algorithm. For this part of the data, the u-boot does not check it so we can just directly replace it with a placeholder. Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2022-03-20 15:42:37 +00:00
endef
define Device/h3c_tx1800-plus
$(Device/h3c_tx180x)
DEVICE_MODEL := TX1800 Plus
endef
TARGET_DEVICES += h3c_tx1800-plus
define Device/h3c_tx1801-plus
$(Device/h3c_tx180x)
DEVICE_MODEL := TX1801 Plus
endef
TARGET_DEVICES += h3c_tx1801-plus
define Device/h3c_tx1806
$(Device/h3c_tx180x)
DEVICE_MODEL := TX1806
endef
TARGET_DEVICES += h3c_tx1806
ramips: add support for SIM SIMAX1800T and Haier HAR-20S2U1 SIM AX18T and Haier HAR-20S2U1 Wi-Fi6 AX1800 routers are designed based on Tenbay WR1800K. They have the same hardware circuits and u-boot. SIM AX18T has three carrier customized models: SIMAX1800M (China Mobile), SIMAX1800T (China Telecom) and SIMAX1800U (China Unicom). All of these models run the same firmware. Specifications: SOC: MT7621 + MT7905 + MT7975 ROM: 128 MiB RAM: 256 MiB LED: status *3 R/G/B Button: reset *1 + wps/mesh *1 Ethernet: lan *3 + wan *1 (10/100/1000Mbps) TTL Baudrate: 115200 TFTP Server: 192.168.1.254 TFTP IP: 192.168.1.28 or 192.168.1.160 (when envs is broken) MAC Address: use address source label 30:xx:xx:xx:xx:62 wan lan 30:xx:xx:xx:xx:65 factory.0x8004 wan 30:xx:xx:xx:xx:62 factory.0x8004 -3 wlan2g 30:xx:xx:xx:xx:64 factory.0x0004 wlan5g 32:xx:xx:xx:xx:64 factory.0x0004 set 7th bit TFTP Installation (initramfs image only & recommend): 1. Set local tftp server IP: 192.168.1.254 and NetMask: 255.255.255.0 2. Rename initramfs-kernel.bin to "factory.bin" and put it in the root directory of the tftp server. (tftpd64 is a good choice for Windows) 3. Start the TFTP server, plug in the power supply, and wait for the system to boot. 4. Backup "firmware" partition and rename it to "firmware.bin", we need it to back to stock firmware. 5. Use "fw_printenv" command to list envs. If "firmware_select=2" is observed then set u-boot enviroment: /# fw_setenv firmware_select 1 6. Apply sysupgrade.bin in OpenWrt LuCI. Web UI Installation: 1. Apply update by uploading initramfs-factory.bin to the web UI. 2. Use "fw_printenv" command to list envs. If "firmware_select=2" is observed then set u-boot enviroment: /# fw_setenv firmware_select 1 3. Apply squashfs-sysupgrade.bin in OpenWrt LuCI. Recovery to stock firmware: a. Upload "firmware.bin" to OpenWrt /tmp, then execute: /# mtd -r write /tmp/firmware.bin firmware b. We can also write factory image "UploadBrush-bin.img" to firmware partition to recovery. Upload image file to /tmp, then execute: /# mtd erase firmware /# mtd -r write /tmp/UploadBrush-bin.img firmware How to extract stock firmware image: Download stock firmware, then use openssl: openssl aes-256-cbc -d -salt -in [Downloaded_Firmware] \ -out "firmware.tar.tgz" -k QiLunSmartWL Signed-off-by: Chen Minqiang <ptpt52@gmail.com> Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2022-09-15 17:10:52 +00:00
define Device/haier-sim_wr1800k
$(Device/nand)
ramips: add support for SIM SIMAX1800T and Haier HAR-20S2U1 SIM AX18T and Haier HAR-20S2U1 Wi-Fi6 AX1800 routers are designed based on Tenbay WR1800K. They have the same hardware circuits and u-boot. SIM AX18T has three carrier customized models: SIMAX1800M (China Mobile), SIMAX1800T (China Telecom) and SIMAX1800U (China Unicom). All of these models run the same firmware. Specifications: SOC: MT7621 + MT7905 + MT7975 ROM: 128 MiB RAM: 256 MiB LED: status *3 R/G/B Button: reset *1 + wps/mesh *1 Ethernet: lan *3 + wan *1 (10/100/1000Mbps) TTL Baudrate: 115200 TFTP Server: 192.168.1.254 TFTP IP: 192.168.1.28 or 192.168.1.160 (when envs is broken) MAC Address: use address source label 30:xx:xx:xx:xx:62 wan lan 30:xx:xx:xx:xx:65 factory.0x8004 wan 30:xx:xx:xx:xx:62 factory.0x8004 -3 wlan2g 30:xx:xx:xx:xx:64 factory.0x0004 wlan5g 32:xx:xx:xx:xx:64 factory.0x0004 set 7th bit TFTP Installation (initramfs image only & recommend): 1. Set local tftp server IP: 192.168.1.254 and NetMask: 255.255.255.0 2. Rename initramfs-kernel.bin to "factory.bin" and put it in the root directory of the tftp server. (tftpd64 is a good choice for Windows) 3. Start the TFTP server, plug in the power supply, and wait for the system to boot. 4. Backup "firmware" partition and rename it to "firmware.bin", we need it to back to stock firmware. 5. Use "fw_printenv" command to list envs. If "firmware_select=2" is observed then set u-boot enviroment: /# fw_setenv firmware_select 1 6. Apply sysupgrade.bin in OpenWrt LuCI. Web UI Installation: 1. Apply update by uploading initramfs-factory.bin to the web UI. 2. Use "fw_printenv" command to list envs. If "firmware_select=2" is observed then set u-boot enviroment: /# fw_setenv firmware_select 1 3. Apply squashfs-sysupgrade.bin in OpenWrt LuCI. Recovery to stock firmware: a. Upload "firmware.bin" to OpenWrt /tmp, then execute: /# mtd -r write /tmp/firmware.bin firmware b. We can also write factory image "UploadBrush-bin.img" to firmware partition to recovery. Upload image file to /tmp, then execute: /# mtd erase firmware /# mtd -r write /tmp/UploadBrush-bin.img firmware How to extract stock firmware image: Download stock firmware, then use openssl: openssl aes-256-cbc -d -salt -in [Downloaded_Firmware] \ -out "firmware.tar.tgz" -k QiLunSmartWL Signed-off-by: Chen Minqiang <ptpt52@gmail.com> Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2022-09-15 17:10:52 +00:00
IMAGE_SIZE := 125440k
KERNEL_LOADADDR := 0x82000000
KERNEL := kernel-bin | relocate-kernel 0x80001000 | lzma | \
fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
ARTIFACTS := initramfs-factory.bin
ARTIFACT/initramfs-factory.bin := append-image-stage initramfs-kernel.bin | \
haier-sim_wr1800k-factory
endif
DEVICE_PACKAGES := kmod-mt7915-firmware
ramips: add support for SIM SIMAX1800T and Haier HAR-20S2U1 SIM AX18T and Haier HAR-20S2U1 Wi-Fi6 AX1800 routers are designed based on Tenbay WR1800K. They have the same hardware circuits and u-boot. SIM AX18T has three carrier customized models: SIMAX1800M (China Mobile), SIMAX1800T (China Telecom) and SIMAX1800U (China Unicom). All of these models run the same firmware. Specifications: SOC: MT7621 + MT7905 + MT7975 ROM: 128 MiB RAM: 256 MiB LED: status *3 R/G/B Button: reset *1 + wps/mesh *1 Ethernet: lan *3 + wan *1 (10/100/1000Mbps) TTL Baudrate: 115200 TFTP Server: 192.168.1.254 TFTP IP: 192.168.1.28 or 192.168.1.160 (when envs is broken) MAC Address: use address source label 30:xx:xx:xx:xx:62 wan lan 30:xx:xx:xx:xx:65 factory.0x8004 wan 30:xx:xx:xx:xx:62 factory.0x8004 -3 wlan2g 30:xx:xx:xx:xx:64 factory.0x0004 wlan5g 32:xx:xx:xx:xx:64 factory.0x0004 set 7th bit TFTP Installation (initramfs image only & recommend): 1. Set local tftp server IP: 192.168.1.254 and NetMask: 255.255.255.0 2. Rename initramfs-kernel.bin to "factory.bin" and put it in the root directory of the tftp server. (tftpd64 is a good choice for Windows) 3. Start the TFTP server, plug in the power supply, and wait for the system to boot. 4. Backup "firmware" partition and rename it to "firmware.bin", we need it to back to stock firmware. 5. Use "fw_printenv" command to list envs. If "firmware_select=2" is observed then set u-boot enviroment: /# fw_setenv firmware_select 1 6. Apply sysupgrade.bin in OpenWrt LuCI. Web UI Installation: 1. Apply update by uploading initramfs-factory.bin to the web UI. 2. Use "fw_printenv" command to list envs. If "firmware_select=2" is observed then set u-boot enviroment: /# fw_setenv firmware_select 1 3. Apply squashfs-sysupgrade.bin in OpenWrt LuCI. Recovery to stock firmware: a. Upload "firmware.bin" to OpenWrt /tmp, then execute: /# mtd -r write /tmp/firmware.bin firmware b. We can also write factory image "UploadBrush-bin.img" to firmware partition to recovery. Upload image file to /tmp, then execute: /# mtd erase firmware /# mtd -r write /tmp/UploadBrush-bin.img firmware How to extract stock firmware image: Download stock firmware, then use openssl: openssl aes-256-cbc -d -salt -in [Downloaded_Firmware] \ -out "firmware.tar.tgz" -k QiLunSmartWL Signed-off-by: Chen Minqiang <ptpt52@gmail.com> Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2022-09-15 17:10:52 +00:00
endef
define Device/haier_har-20s2u1
$(Device/haier-sim_wr1800k)
DEVICE_VENDOR := Haier
DEVICE_MODEL := HAR-20S2U1
endef
TARGET_DEVICES += haier_har-20s2u1
ramips: add support for HiLink HLK-7621A evaluation board Specifications: - SoC: MediaTek MT7621AT - RAM: 256 MB (DDR3) - Flash: 32 MB SPI NOR 44MHz - Switch: 1 WAN, 4 LAN (Gigabit) - LEDs: 1 WAN, 4 LAN (controlled by PHY) - USB Ports: 1 x USB2, 1 x USB3 - WLAN: 1 x 2.4, 5 GHz 866Mbps (MT7612E) - Button: 1 button (reset) - UART Serial: UART1 as console : 57600 baud - Power: 12VDC, 1A Installation: Update openWRT firmware using internal GNUBEE uboot: https://github.com/gnubee-git/GnuBee-MT7621-uboot By HTTP: Initial uboot address is http://10.10.10.123, your address needs to be 10.10.10.x, and mask 255.255.255.0. By TFTP: Uboot is in client mode, the address of the firmware must be tftp://10.10.10.3/uboot.bin Recovery: Manufacturer provides MTK OpenWrt 14.07 source code, compile then flash it by uboot. HLK-7621A is a stamp hole package module for embedded development, users have to design IO boards to use it. MAC addresses: - u-boot-env contains a placeholder address: > mtd_get_mac_ascii u-boot-env ethaddr 03:17:73:ab:cd:ef - phy0 gets a valid-looking address: > cat /sys/class/ieee80211/phy0/macaddress f8:62:aa:**:**:a8 - Calibration data for &pcie2 contains a valid address, however the zeros in the right half look like it's not real: 8c:88:2b:00:00:1b - Since it's an evaluation board and there is no solid information about the MAC address assignment, the ethernet MAC address is left random. Signed-off-by: Chen Yijun <cyjason@bupt.edu.cn> [add keys and pcie nodes to properly support evaluation board] Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com> [remove ethernet address, wrap lines properly] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-04-04 06:50:26 +00:00
define Device/hilink_hlk-7621a-evb
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := HiLink
DEVICE_MODEL := HLK-7621A evaluation board
DEVICE_PACKAGES += kmod-mt76x2 kmod-usb3 -uboot-envtools
ramips: add support for HiLink HLK-7621A evaluation board Specifications: - SoC: MediaTek MT7621AT - RAM: 256 MB (DDR3) - Flash: 32 MB SPI NOR 44MHz - Switch: 1 WAN, 4 LAN (Gigabit) - LEDs: 1 WAN, 4 LAN (controlled by PHY) - USB Ports: 1 x USB2, 1 x USB3 - WLAN: 1 x 2.4, 5 GHz 866Mbps (MT7612E) - Button: 1 button (reset) - UART Serial: UART1 as console : 57600 baud - Power: 12VDC, 1A Installation: Update openWRT firmware using internal GNUBEE uboot: https://github.com/gnubee-git/GnuBee-MT7621-uboot By HTTP: Initial uboot address is http://10.10.10.123, your address needs to be 10.10.10.x, and mask 255.255.255.0. By TFTP: Uboot is in client mode, the address of the firmware must be tftp://10.10.10.3/uboot.bin Recovery: Manufacturer provides MTK OpenWrt 14.07 source code, compile then flash it by uboot. HLK-7621A is a stamp hole package module for embedded development, users have to design IO boards to use it. MAC addresses: - u-boot-env contains a placeholder address: > mtd_get_mac_ascii u-boot-env ethaddr 03:17:73:ab:cd:ef - phy0 gets a valid-looking address: > cat /sys/class/ieee80211/phy0/macaddress f8:62:aa:**:**:a8 - Calibration data for &pcie2 contains a valid address, however the zeros in the right half look like it's not real: 8c:88:2b:00:00:1b - Since it's an evaluation board and there is no solid information about the MAC address assignment, the ethernet MAC address is left random. Signed-off-by: Chen Yijun <cyjason@bupt.edu.cn> [add keys and pcie nodes to properly support evaluation board] Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com> [remove ethernet address, wrap lines properly] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-04-04 06:50:26 +00:00
IMAGE_SIZE := 32448k
endef
TARGET_DEVICES += hilink_hlk-7621a-evb
define Device/hiwifi_hc5962
$(Device/nand)
$(Device/uimage-lzma-loader)
ramips/mt7621: fix IMAGE_SIZE for all devices This fixes IMAGE_SIZE for all devices based on the partition size given in DTS: DEVICE *.MK *.DTS VERDICT afoundry_ew1200 (16M) 0xfb0000 asiarf_ap7621-001 (16M) 0xfa0000 wrong buffalo_wsr-1166dhp (16M) 0xf90000 wrong buffalo_wsr-600dhp (16M) 0xfb0000 dlink_dir-860l-b1 (16M) 0xfb0000 d-team_newifi-d2 (32M) 0x1fb0000 d-team_pbr-m1 (16M) 0xfb0000 elecom_wrc-1167ghbk2-s 15488k 0xf20000 elecom_wrc-1900gst 11264k 0xb00000 elecom_wrc-2533gst 11264k 0xb00000 firefly_firewrt (16M) 0xfb0000 gehua_ghl-r-001 (32M) 0x1fb0000 gnubee_gb-pc1 (32M) 0x1fb0000 gnubee_gb-pc2 (32M) 0x1fb0000 hiwifi_hc5962 (32M) 0x2000000 wrong (kernel + ubi) iodata_wn-ax1167gr 15552k 0xf30000 iodata_wn-gx300gr 7798784 0x770000 lenovo_newifi-d1 (32M) 0x1fb0000 linksys_re6500 - 0x7b0000 default mediatek_ap-mt7621a-v60 (8M) 0x7b0000 mediatek_mt7621-eval-board (4M) 0xec0000 wrong (rootfs) mikrotik_rb750gr3 [16128k] 0xfc0000 mikrotik_rbm11g [16128k] 0xFC0000 mikrotik_rbm33g [16128k] 0xFC0000 mqmaker_witi-256m (16M) 0xfb0000 mqmaker_witi-512m (16M) 0xfb0000 mtc_wr1201 16000k 0xfa0000 netgear_ex6150 14848k 0xe80000 netgear_r6220 28672k 0x1c00000 netgear_r6350 40960k 0x2800000 netgear_wndr3700-v5 15232k 0xee0000 netis_wf-2881 129280k 0x7E40000 phicomm_k2p 15744k 0xf60000 planex_vr500 66453504 0x3fb0000 wrong samknows_whitebox-v8 (16M) 0xfb0000 storylink_sap-g3200u3 - 0x7b0000 default telco-electronics_x1 16064k 0xfb0000 thunder_timecloud - 0xfb0000 wrong totolink_a7000r 16064k 0xfb0000 tplink_re350-v1 6016k 0x5e0000 ubiquiti_edgerouterx - 0xfa00000 wrong (kernel1 + ubi) ubiquiti_edgerouterx-sfp - 0xfa00000 wrong (kernel1 + ubi) unielec_u7621-06-256m-16m 16064k 0xfb0000 unielec_u7621-06-512m-64m 65216k 0x3fb0000 wevo_11acnas (16M) 0xfb0000 wevo_w2914ns-v2 (16M) 0xfb0000 xiaomi_mir3g 32768k 0x7980000 wrong (kernel + ubi) xiaomi_mir3p (32M) 0xf980000 wrong (kernel + ubi) xzwifi_creativebox-v1 (32M) 0x1fb0000 youhua_wr1200js 16064k 0xfb0000 youku_yk-l2 (16M) 0xfb0000 zbtlink_zbt-we1326 (16M) 0xfb0000 zbtlink_zbt-we3526 (16M) 0xfb0000 zbtlink_zbt-wg2626 (16M) 0xfb0000 zbtlink_zbt-wg3526-16m (16M) 0xfb0000 zbtlink_zbt-wg3526-32m (32M) 0x1fb0000 No verdict means that the device is correctly set. Legend: ( ): Value is set via ralink_default_fw_size_xxM [ ]: Value is derived from parent definition - : Value is not set and derived from default definition Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-07-15 12:55:24 +00:00
IMAGE_SIZE := 32768k
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
check-size
DEVICE_VENDOR := HiWiFi
DEVICE_MODEL := HC5962
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 -uboot-envtools
endef
TARGET_DEVICES += hiwifi_hc5962
define Device/humax_e10
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 15936k
DEVICE_VENDOR := HUMAX
DEVICE_MODEL := E10
DEVICE_ALT0_VENDOR := HUMAX
DEVICE_ALT0_MODEL := QUANTUM E10
IMAGE/sysupgrade.bin := append-kernel | append-rootfs | \
edimax-header -s CSYS -m EA03 -f 0x70000 -S 0x01100000 | pad-rootfs | \
check-size | append-metadata
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | append-rootfs | pad-rootfs | \
edimax-header -s CSYS -m EA03 -f 0x70000 -S 0x01100000 | \
check-size | zip upg -P f013c26cf0a320fb71d03356dcb6bb63
DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 -uboot-envtools
endef
TARGET_DEVICES += humax_e10
define Device/huasifei_ws1208v2
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Huasifei
DEVICE_MODEL := WS1208V2
DEVICE_PACKAGES := kmod-ata-ahci kmod-mt7603 kmod-mt76x2 kmod-sdhci-mt7620 \
kmod-usb3 kmod-usb-net-cdc-mbim kmod-usb-net-qmi-wwan \
kmod-usb-serial-option -uboot-envtools
endef
TARGET_DEVICES += huasifei_ws1208v2
ramips: add support for I-O DATA WN-AX1167GR I-O DATA WN-AX1167GR is a 2.4/5 GHz band 11ac router, based on MediaTek MT7621A. Specification: - MT7621A (2-Cores, 4-Threads) - 64 MB of RAM (DDR2) - 16 MB of Flash (SPI) - 2T2R 2.4/5 GHz - 5x 10/100/1000 Mbps Ethernet - 2x LEDs, 4x keys (2x buttons, 1x slide switch) - UART header on PCB - Vcc, GND, TX, RX from ethernet port side - baudrate: 115200 bps (U-Boot, OpenWrt) Stock firmware: In the stock firmware, WN-AX1167GR has two os images each composed of Linux kernel and rootfs. These images are stored in "Kernel" and "app" partition of the following partitions, respectively. (excerpt from dmesg): MX25L12805D(c2 2018c220) (16384 Kbytes) mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0 Creating 10 MTD partitions on "raspi": 0x000000000000-0x000001000000 : "ALL" 0x000000000000-0x000000030000 : "Bootloader" 0x000000030000-0x000000040000 : "Config " 0x000000040000-0x000000050000 : "Factory" 0x000000050000-0x000000060000 : "iNIC_rf" 0x000000060000-0x0000007e0000 : "Kernel" 0x000000800000-0x000000f80000 : "app" 0x000000f90000-0x000000fa0000 : "Key" 0x000000fa0000-0x000000fb0000 : "backup" 0x000000fb0000-0x000001000000 : "storage" The flag for boot partition is stored in "Key" partition, and U-Boot reads this and determines the partition to boot. If the image that U-Boot first reads according to the flag is "Bad Magic Number", U-Boot then tries to boot from the other image. If the second image is correct, change the flag to the number corresponding to that image and boot from that image. (example): ## Booting image at bc800000 ... Bad Magic Number,FFFFFFFF Boot from KERNEL 1 !! ## Booting image at bc060000 ... Image Name: MIPS OpenWrt Linux-4.14.50 Image Type: MIPS Linux kernel Image (lzma compressed) Data Size: 1865917 Bytes = 1.8 MB Load Address: 80001000 Entry Point: 80001000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK raspi_erase_write: offs:f90000, count:34 . . Done! Starting kernel ... Flash instruction using factory image: 1. Connect the computer to the LAN port of WN-AX1167GR 2. Connect power cable to WN-AX1167GR and turn on it 3. Access to "192.168.0.1" on the web browser and open firmware update page ("ファームウェア") 4. Select the OpenWrt factory image and perform firmware update 5. On the initramfs image, execute "mtd erase firmware" to erase stock firmware and execute sysupgrade with sysupgrade image for WN-AX1167GR 6. Wait ~180 seconds to complete flasing Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2018-06-27 13:47:13 +00:00
define Device/iodata_wn-ax1167gr
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
ramips: add support for I-O DATA WN-AX1167GR I-O DATA WN-AX1167GR is a 2.4/5 GHz band 11ac router, based on MediaTek MT7621A. Specification: - MT7621A (2-Cores, 4-Threads) - 64 MB of RAM (DDR2) - 16 MB of Flash (SPI) - 2T2R 2.4/5 GHz - 5x 10/100/1000 Mbps Ethernet - 2x LEDs, 4x keys (2x buttons, 1x slide switch) - UART header on PCB - Vcc, GND, TX, RX from ethernet port side - baudrate: 115200 bps (U-Boot, OpenWrt) Stock firmware: In the stock firmware, WN-AX1167GR has two os images each composed of Linux kernel and rootfs. These images are stored in "Kernel" and "app" partition of the following partitions, respectively. (excerpt from dmesg): MX25L12805D(c2 2018c220) (16384 Kbytes) mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0 Creating 10 MTD partitions on "raspi": 0x000000000000-0x000001000000 : "ALL" 0x000000000000-0x000000030000 : "Bootloader" 0x000000030000-0x000000040000 : "Config " 0x000000040000-0x000000050000 : "Factory" 0x000000050000-0x000000060000 : "iNIC_rf" 0x000000060000-0x0000007e0000 : "Kernel" 0x000000800000-0x000000f80000 : "app" 0x000000f90000-0x000000fa0000 : "Key" 0x000000fa0000-0x000000fb0000 : "backup" 0x000000fb0000-0x000001000000 : "storage" The flag for boot partition is stored in "Key" partition, and U-Boot reads this and determines the partition to boot. If the image that U-Boot first reads according to the flag is "Bad Magic Number", U-Boot then tries to boot from the other image. If the second image is correct, change the flag to the number corresponding to that image and boot from that image. (example): ## Booting image at bc800000 ... Bad Magic Number,FFFFFFFF Boot from KERNEL 1 !! ## Booting image at bc060000 ... Image Name: MIPS OpenWrt Linux-4.14.50 Image Type: MIPS Linux kernel Image (lzma compressed) Data Size: 1865917 Bytes = 1.8 MB Load Address: 80001000 Entry Point: 80001000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK raspi_erase_write: offs:f90000, count:34 . . Done! Starting kernel ... Flash instruction using factory image: 1. Connect the computer to the LAN port of WN-AX1167GR 2. Connect power cable to WN-AX1167GR and turn on it 3. Access to "192.168.0.1" on the web browser and open firmware update page ("ファームウェア") 4. Select the OpenWrt factory image and perform firmware update 5. On the initramfs image, execute "mtd erase firmware" to erase stock firmware and execute sysupgrade with sysupgrade image for WN-AX1167GR 6. Wait ~180 seconds to complete flasing Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2018-06-27 13:47:13 +00:00
IMAGE_SIZE := 15552k
DEVICE_VENDOR := I-O DATA
DEVICE_MODEL := WN-AX1167GR
ARTIFACTS := initramfs-factory.bin
ARTIFACT/initramfs-factory.bin := append-image-stage initramfs-kernel.bin | \
check-size 7680k | senao-header -r 0x30a -p 0x1055 -t 4
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 -uboot-envtools
ramips: add support for I-O DATA WN-AX1167GR I-O DATA WN-AX1167GR is a 2.4/5 GHz band 11ac router, based on MediaTek MT7621A. Specification: - MT7621A (2-Cores, 4-Threads) - 64 MB of RAM (DDR2) - 16 MB of Flash (SPI) - 2T2R 2.4/5 GHz - 5x 10/100/1000 Mbps Ethernet - 2x LEDs, 4x keys (2x buttons, 1x slide switch) - UART header on PCB - Vcc, GND, TX, RX from ethernet port side - baudrate: 115200 bps (U-Boot, OpenWrt) Stock firmware: In the stock firmware, WN-AX1167GR has two os images each composed of Linux kernel and rootfs. These images are stored in "Kernel" and "app" partition of the following partitions, respectively. (excerpt from dmesg): MX25L12805D(c2 2018c220) (16384 Kbytes) mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0 Creating 10 MTD partitions on "raspi": 0x000000000000-0x000001000000 : "ALL" 0x000000000000-0x000000030000 : "Bootloader" 0x000000030000-0x000000040000 : "Config " 0x000000040000-0x000000050000 : "Factory" 0x000000050000-0x000000060000 : "iNIC_rf" 0x000000060000-0x0000007e0000 : "Kernel" 0x000000800000-0x000000f80000 : "app" 0x000000f90000-0x000000fa0000 : "Key" 0x000000fa0000-0x000000fb0000 : "backup" 0x000000fb0000-0x000001000000 : "storage" The flag for boot partition is stored in "Key" partition, and U-Boot reads this and determines the partition to boot. If the image that U-Boot first reads according to the flag is "Bad Magic Number", U-Boot then tries to boot from the other image. If the second image is correct, change the flag to the number corresponding to that image and boot from that image. (example): ## Booting image at bc800000 ... Bad Magic Number,FFFFFFFF Boot from KERNEL 1 !! ## Booting image at bc060000 ... Image Name: MIPS OpenWrt Linux-4.14.50 Image Type: MIPS Linux kernel Image (lzma compressed) Data Size: 1865917 Bytes = 1.8 MB Load Address: 80001000 Entry Point: 80001000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK raspi_erase_write: offs:f90000, count:34 . . Done! Starting kernel ... Flash instruction using factory image: 1. Connect the computer to the LAN port of WN-AX1167GR 2. Connect power cable to WN-AX1167GR and turn on it 3. Access to "192.168.0.1" on the web browser and open firmware update page ("ファームウェア") 4. Select the OpenWrt factory image and perform firmware update 5. On the initramfs image, execute "mtd erase firmware" to erase stock firmware and execute sysupgrade with sysupgrade image for WN-AX1167GR 6. Wait ~180 seconds to complete flasing Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2018-06-27 13:47:13 +00:00
endef
TARGET_DEVICES += iodata_wn-ax1167gr
define Device/iodata_nand
$(Device/nand)
DEVICE_VENDOR := I-O DATA
2019-08-26 11:27:22 +00:00
IMAGE_SIZE := 51200k
LOADER_TYPE := bin
KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | lzma | uImage lzma
endef
# The OEM webinterface expects an kernel with initramfs which has the uImage
# header field ih_name.
# We don't want to set the header name field for the kernel include in the
# sysupgrade image as well, as this image shouldn't be accepted by the OEM
# webinterface. It will soft-brick the board.
define Device/iodata_wn-ax1167gr2
$(Device/iodata_nand)
DEVICE_MODEL := WN-AX1167GR2
KERNEL_INITRAMFS := $(KERNEL_DTB) | loader-kernel | lzma | \
uImage lzma -M 0x434f4d42 -n '3.10(XBC.1)b10' | iodata-mstc-header
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
2019-08-26 11:27:22 +00:00
endef
TARGET_DEVICES += iodata_wn-ax1167gr2
ramips: add support for I-O DATA WN-AX2033GR I-O DATA WN-AX2033GR is roughly the same as I-O DATA WN-AX1167GR2. The difference is Wi-Fi feature. Specification ============= - SoC: MediaTek MT7621A - RAM: DDR3 128 MiB - Flash Memory: NAND 128 MiB (Spansion S34ML01G200TF100) - Wi-Fi: MediaTek MT7603E - Wi-Fi: MediaTek MT7615 - Ethernet: 5x 10 Mbps / 100 Mbps / 1000 Mbps (1x WAN, 4x LAN) - LED: 2x green LED - Input: 2x tactile switch, 1x slide switch - Serial console: 57600bps, PCB through hole J5 (Vcc, TX, RX, NC, GND) - Power: DC 12V This device only supports channel 1-13 and 36-140. Thus, narrower frequency limits compared to other devices are required for limiting wi-fi frequency correctly. Without this, non-supported frequencies are activated. Flash instructions ================== 1. Open the router management page (192.168.0.1). 2. Update router firmware using "initramfs-kernel.bin". 3. After updating, run sysupgrade with "sysupgrade.bin". Recovery instructions ===================== WN-AX2033GR contains Zyxel Z-LOADER 1. Setup TFTP server (IP address: 10.10.10.3). 2. Put official firmware into TFTP server directory (distribution site: https://www.iodata.jp/lib/software/w/2068.htm) 3. Connect WX-AX2033GR Ethernet port and computer that runs TFTP server. 4. Connect to serial console. 5. Interrupt booting by Esc key. 6. Flash firmware using "ATNR 1,[firmware filename]" command. Signed-off-by: Yanase Yuki <dev@zpc.sakura.ne.jp> [adjust for kernel 5.4, add recovery instructions/frequency comment] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-02-06 03:00:47 +00:00
define Device/iodata_wn-ax2033gr
$(Device/iodata_nand)
ramips: add support for I-O DATA WN-AX2033GR I-O DATA WN-AX2033GR is roughly the same as I-O DATA WN-AX1167GR2. The difference is Wi-Fi feature. Specification ============= - SoC: MediaTek MT7621A - RAM: DDR3 128 MiB - Flash Memory: NAND 128 MiB (Spansion S34ML01G200TF100) - Wi-Fi: MediaTek MT7603E - Wi-Fi: MediaTek MT7615 - Ethernet: 5x 10 Mbps / 100 Mbps / 1000 Mbps (1x WAN, 4x LAN) - LED: 2x green LED - Input: 2x tactile switch, 1x slide switch - Serial console: 57600bps, PCB through hole J5 (Vcc, TX, RX, NC, GND) - Power: DC 12V This device only supports channel 1-13 and 36-140. Thus, narrower frequency limits compared to other devices are required for limiting wi-fi frequency correctly. Without this, non-supported frequencies are activated. Flash instructions ================== 1. Open the router management page (192.168.0.1). 2. Update router firmware using "initramfs-kernel.bin". 3. After updating, run sysupgrade with "sysupgrade.bin". Recovery instructions ===================== WN-AX2033GR contains Zyxel Z-LOADER 1. Setup TFTP server (IP address: 10.10.10.3). 2. Put official firmware into TFTP server directory (distribution site: https://www.iodata.jp/lib/software/w/2068.htm) 3. Connect WX-AX2033GR Ethernet port and computer that runs TFTP server. 4. Connect to serial console. 5. Interrupt booting by Esc key. 6. Flash firmware using "ATNR 1,[firmware filename]" command. Signed-off-by: Yanase Yuki <dev@zpc.sakura.ne.jp> [adjust for kernel 5.4, add recovery instructions/frequency comment] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-02-06 03:00:47 +00:00
DEVICE_MODEL := WN-AX2033GR
KERNEL_INITRAMFS := $(KERNEL_DTB) | loader-kernel | lzma | \
uImage lzma -M 0x434f4d42 -n '3.10(VST.1)C10' | iodata-mstc-header
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware -uboot-envtools
ramips: add support for I-O DATA WN-AX2033GR I-O DATA WN-AX2033GR is roughly the same as I-O DATA WN-AX1167GR2. The difference is Wi-Fi feature. Specification ============= - SoC: MediaTek MT7621A - RAM: DDR3 128 MiB - Flash Memory: NAND 128 MiB (Spansion S34ML01G200TF100) - Wi-Fi: MediaTek MT7603E - Wi-Fi: MediaTek MT7615 - Ethernet: 5x 10 Mbps / 100 Mbps / 1000 Mbps (1x WAN, 4x LAN) - LED: 2x green LED - Input: 2x tactile switch, 1x slide switch - Serial console: 57600bps, PCB through hole J5 (Vcc, TX, RX, NC, GND) - Power: DC 12V This device only supports channel 1-13 and 36-140. Thus, narrower frequency limits compared to other devices are required for limiting wi-fi frequency correctly. Without this, non-supported frequencies are activated. Flash instructions ================== 1. Open the router management page (192.168.0.1). 2. Update router firmware using "initramfs-kernel.bin". 3. After updating, run sysupgrade with "sysupgrade.bin". Recovery instructions ===================== WN-AX2033GR contains Zyxel Z-LOADER 1. Setup TFTP server (IP address: 10.10.10.3). 2. Put official firmware into TFTP server directory (distribution site: https://www.iodata.jp/lib/software/w/2068.htm) 3. Connect WX-AX2033GR Ethernet port and computer that runs TFTP server. 4. Connect to serial console. 5. Interrupt booting by Esc key. 6. Flash firmware using "ATNR 1,[firmware filename]" command. Signed-off-by: Yanase Yuki <dev@zpc.sakura.ne.jp> [adjust for kernel 5.4, add recovery instructions/frequency comment] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-02-06 03:00:47 +00:00
endef
TARGET_DEVICES += iodata_wn-ax2033gr
2019-04-09 05:48:31 +00:00
define Device/iodata_wn-dx1167r
$(Device/iodata_nand)
2019-04-09 05:48:31 +00:00
DEVICE_MODEL := WN-DX1167R
KERNEL_INITRAMFS := $(KERNEL_DTB) | loader-kernel | lzma | \
uImage lzma -M 0x434f4d43 -n '3.10(XIK.1)b10' | iodata-mstc-header
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
2019-04-09 05:48:31 +00:00
endef
TARGET_DEVICES += iodata_wn-dx1167r
ramips: add support for I-O DATA WN-DX1200GR I-O DATA WN-DX1200GR is a 2.4/5 GHz band 11ac (WiFi-5) router, based on MT7621A. Specification: - SoC : MediaTek MT7621A - RAM : DDR3 128 MiB - Flash : raw NAND 128 MiB - WLAN : 2.4/5 GHz 2T2R - 2.4 GHz : MediaTek MT7603E - 5 GHz : MediaTek MT7613BE - Ethernet : 10/100/1000 Mbps x5 - Switch : MediaTek MT7530 (SoC) - LEDs/keys : 2x/3x (2x buttons, 1x slide-switch) - UART : through-hole on PCB - J5: 3.3V, TX, RX, NC, GND from triangle-mark - 57600n8 - Power : 12 VDC, 1 A Flash instruction using initramfs image: 1. Boot WN-DX1200GR normally 2. Access to "http://192.168.0.1/" and open firmware update page ("ファームウェア") 3. Select the OpenWrt initramfs image and click update ("更新") button to perform firmware update 4. On the initramfs image, perform sysupgrade with the squashfs-sysupgrade image 5. Wait ~120 seconds to complete flashing Notes: - currently, mt7615e driver in mt76 doesn't fully support MT7613 (MT7663) wifi chip - the eeprom data in flash is not used by mt7615e driver and the driver reports the tx-power up to 3dBm - the correct MAC address for MT7613BE in eeprom data cannot be assigned to the phy - last 0x80000 (512 KiB) in NAND flash is not used on stock firmware - stock firmware requires "customized uImage header" (called as "combo image") by MSTC (MitraStar Technology Corp.), but U-Boot doesn't - uImage magic ( 0x0 - 0x3 ) : 0x434F4D43 ("COMC") - header crc32 ( 0x4 - 0x7 ) : with "data length" and "data crc32" - image name (0x20 - 0x37) : model ID and firmware versions - data length (0x38 - 0x3b) : kernel + rootfs - data crc32 (0x3c - 0x3f) : kernel + rootfs MAC addresses: LAN: 50:41:B9:xx:xx:08 (Ubootenv, ethaddr (text) / Factory, 0x1E000 (hex)) WAN: 50:41:B9:xx:xx:0A (Factory, 0x1E006 (hex)) 2.4GHz: 50:41:B9:xx:xx:08 (Factory, 0x4 (hex)) 5GHz: 50:41:B9:xx:xx:09 (Factory, 0x8004 (hex)) Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com> [add check whether dflag_offset is set] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-26 14:50:51 +00:00
define Device/iodata_wn-dx1200gr
$(Device/iodata_nand)
DEVICE_MODEL := WN-DX1200GR
KERNEL_INITRAMFS := $(KERNEL_DTB) | loader-kernel | lzma | \
uImage lzma -M 0x434f4d43 -n '3.10(XIQ.0)b20' | iodata-mstc-header
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
-uboot-envtools
ramips: add support for I-O DATA WN-DX1200GR I-O DATA WN-DX1200GR is a 2.4/5 GHz band 11ac (WiFi-5) router, based on MT7621A. Specification: - SoC : MediaTek MT7621A - RAM : DDR3 128 MiB - Flash : raw NAND 128 MiB - WLAN : 2.4/5 GHz 2T2R - 2.4 GHz : MediaTek MT7603E - 5 GHz : MediaTek MT7613BE - Ethernet : 10/100/1000 Mbps x5 - Switch : MediaTek MT7530 (SoC) - LEDs/keys : 2x/3x (2x buttons, 1x slide-switch) - UART : through-hole on PCB - J5: 3.3V, TX, RX, NC, GND from triangle-mark - 57600n8 - Power : 12 VDC, 1 A Flash instruction using initramfs image: 1. Boot WN-DX1200GR normally 2. Access to "http://192.168.0.1/" and open firmware update page ("ファームウェア") 3. Select the OpenWrt initramfs image and click update ("更新") button to perform firmware update 4. On the initramfs image, perform sysupgrade with the squashfs-sysupgrade image 5. Wait ~120 seconds to complete flashing Notes: - currently, mt7615e driver in mt76 doesn't fully support MT7613 (MT7663) wifi chip - the eeprom data in flash is not used by mt7615e driver and the driver reports the tx-power up to 3dBm - the correct MAC address for MT7613BE in eeprom data cannot be assigned to the phy - last 0x80000 (512 KiB) in NAND flash is not used on stock firmware - stock firmware requires "customized uImage header" (called as "combo image") by MSTC (MitraStar Technology Corp.), but U-Boot doesn't - uImage magic ( 0x0 - 0x3 ) : 0x434F4D43 ("COMC") - header crc32 ( 0x4 - 0x7 ) : with "data length" and "data crc32" - image name (0x20 - 0x37) : model ID and firmware versions - data length (0x38 - 0x3b) : kernel + rootfs - data crc32 (0x3c - 0x3f) : kernel + rootfs MAC addresses: LAN: 50:41:B9:xx:xx:08 (Ubootenv, ethaddr (text) / Factory, 0x1E000 (hex)) WAN: 50:41:B9:xx:xx:0A (Factory, 0x1E006 (hex)) 2.4GHz: 50:41:B9:xx:xx:08 (Factory, 0x4 (hex)) 5GHz: 50:41:B9:xx:xx:09 (Factory, 0x8004 (hex)) Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com> [add check whether dflag_offset is set] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-26 14:50:51 +00:00
endef
TARGET_DEVICES += iodata_wn-dx1200gr
ramips: add support for I-O DATA WN-DX2033GR I-O DATA WN-DX2033GR is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on MT7621A. Specification: - SoC : MediaTek MT7621A - RAM : DDR3 128 MiB - Flash : Raw NAND 128 MiB (Macronix MX30LF1G18AC-TI) - WLAN : 2.4/5 GHz - 2.4 GHz : 2T2R, MediaTek MT7603E - 5 GHz : 4T4R, MediaTek MT7615 - Ethernet : 5x 10/100/1000 Mbps - Switch : MediaTek MT7530 (SoC) - LEDs/Keys : 2x/3x (2x buttons, 1x slide-switch) - UART : through-hole on PCB - J5: 3.3V, TX, RX, NC, GND from triangle mark - 57600n8 - Power : 12 VDC, 1 A Flash instruction using initramfs image: 1. Boot WN-DX2033GR normally 2. Access to "http://192.168.0.1/" and open firmware update page ("ファームウェア") 3. Select the OpenWrt initramfs image and click update ("更新") button to perform firmware update 4. On the initramfs image, download the sysupgrade.bin image to the device and perform sysupgrade with it 5. Wait ~120 seconds to complete flashing Notes: - The hardware of WN-DX2033GR and WN-AX2033GR are almost the same, and it is certified under the same radio-wave related regulations in Japan - The last 0x80000 (512 KiB) in NAND flash is not used on stock firmware - stock firmware requires "customized uImage header" (called as "combo image") by MSTC (MitraStar Technology Corp.), but U-Boot doesn't - uImage magic ( 0x0 - 0x3 ) : 0x434F4D42 ("COMB") - header crc32 ( 0x4 - 0x7 ) : with "data length" and "data crc32" - image name (0x20 - 0x37) : model ID and firmware versions - data length (0x38 - 0x3b) : kernel + rootfs - data crc32 (0x3c - 0x3f) : kernel + rootfs - There are 2x important flags in the flash: - bootnum : select os partition for booting (persist, 0x4) - 0x01: firmware - 0x02: firmware_2 - debugflag : allow interrupt kernel loader, it's named as "Z-LOADER" (Factory, 0xFE75) - 0x00: disable debug - 0x01: enable debug MAC addresses: LAN : 50:41:B9:xx:xx:90 (Factory, 0xE000 (hex) / Ubootenv, ethaddr (text)) WAN : 50:41:B9:xx:xx:92 (Factory, 0xE006 (hex)) 2.4 GHz : 50:41:B9:xx:xx:90 (Factory, 0x4 (hex)) 5 GHz : 50:41:B9:xx:xx:91 (Factory, 0x8004 (hex)) Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2021-09-18 12:39:04 +00:00
define Device/iodata_wn-dx2033gr
$(Device/iodata_nand)
DEVICE_MODEL := WN-DX2033GR
KERNEL_INITRAMFS := $(KERNEL_DTB) | loader-kernel | lzma | \
uImage lzma -M 0x434f4d42 -n '3.10(XID.0)b30' | iodata-mstc-header
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware -uboot-envtools
ramips: add support for I-O DATA WN-DX2033GR I-O DATA WN-DX2033GR is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on MT7621A. Specification: - SoC : MediaTek MT7621A - RAM : DDR3 128 MiB - Flash : Raw NAND 128 MiB (Macronix MX30LF1G18AC-TI) - WLAN : 2.4/5 GHz - 2.4 GHz : 2T2R, MediaTek MT7603E - 5 GHz : 4T4R, MediaTek MT7615 - Ethernet : 5x 10/100/1000 Mbps - Switch : MediaTek MT7530 (SoC) - LEDs/Keys : 2x/3x (2x buttons, 1x slide-switch) - UART : through-hole on PCB - J5: 3.3V, TX, RX, NC, GND from triangle mark - 57600n8 - Power : 12 VDC, 1 A Flash instruction using initramfs image: 1. Boot WN-DX2033GR normally 2. Access to "http://192.168.0.1/" and open firmware update page ("ファームウェア") 3. Select the OpenWrt initramfs image and click update ("更新") button to perform firmware update 4. On the initramfs image, download the sysupgrade.bin image to the device and perform sysupgrade with it 5. Wait ~120 seconds to complete flashing Notes: - The hardware of WN-DX2033GR and WN-AX2033GR are almost the same, and it is certified under the same radio-wave related regulations in Japan - The last 0x80000 (512 KiB) in NAND flash is not used on stock firmware - stock firmware requires "customized uImage header" (called as "combo image") by MSTC (MitraStar Technology Corp.), but U-Boot doesn't - uImage magic ( 0x0 - 0x3 ) : 0x434F4D42 ("COMB") - header crc32 ( 0x4 - 0x7 ) : with "data length" and "data crc32" - image name (0x20 - 0x37) : model ID and firmware versions - data length (0x38 - 0x3b) : kernel + rootfs - data crc32 (0x3c - 0x3f) : kernel + rootfs - There are 2x important flags in the flash: - bootnum : select os partition for booting (persist, 0x4) - 0x01: firmware - 0x02: firmware_2 - debugflag : allow interrupt kernel loader, it's named as "Z-LOADER" (Factory, 0xFE75) - 0x00: disable debug - 0x01: enable debug MAC addresses: LAN : 50:41:B9:xx:xx:90 (Factory, 0xE000 (hex) / Ubootenv, ethaddr (text)) WAN : 50:41:B9:xx:xx:92 (Factory, 0xE006 (hex)) 2.4 GHz : 50:41:B9:xx:xx:90 (Factory, 0x4 (hex)) 5 GHz : 50:41:B9:xx:xx:91 (Factory, 0x8004 (hex)) Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2021-09-18 12:39:04 +00:00
endef
TARGET_DEVICES += iodata_wn-dx2033gr
define Device/iodata_wn-gx300gr
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 7616k
DEVICE_VENDOR := I-O DATA
DEVICE_MODEL := WN-GX300GR
DEVICE_PACKAGES := kmod-mt7603 -uboot-envtools
endef
TARGET_DEVICES += iodata_wn-gx300gr
define Device/iodata_wnpr2600g
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := I-O DATA
DEVICE_MODEL := WNPR2600G
IMAGE_SIZE := 13952k
IMAGES += factory.bin
IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
elx-header 0104003a 8844A2D168B45A2D
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
endef
TARGET_DEVICES += iodata_wnpr2600g
2022-02-11 14:18:39 +00:00
define Device/iptime_a3002mesh
$(Device/dsa-migration)
IMAGE_SIZE := 16128k
UIMAGE_NAME := a3002me
DEVICE_VENDOR := ipTIME
DEVICE_MODEL := A3002MESH
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
2022-02-11 14:18:39 +00:00
endef
TARGET_DEVICES += iptime_a3002mesh
define Device/iptime_a3004ns-dual
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16128k
UIMAGE_NAME := a3004nd
DEVICE_VENDOR := ipTIME
DEVICE_MODEL := A3004NS-dual
DEVICE_PACKAGES := kmod-usb3 kmod-mt76x2 kmod-usb-ledtrig-usbport \
-uboot-envtools
endef
TARGET_DEVICES += iptime_a3004ns-dual
define Device/iptime_a3004t
$(Device/nand)
$(Device/uimage-lzma-loader)
FILESYSTEMS := squashfs
IMAGE_SIZE := 129280k
UIMAGE_NAME := a3004t
DEVICE_VENDOR := ipTIME
DEVICE_MODEL := A3004T
DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 -uboot-envtools
endef
TARGET_DEVICES += iptime_a3004t
define Device/iptime_a6004ns-m
$(Device/dsa-migration)
IMAGE_SIZE := 16128k
UIMAGE_NAME := a6004nm
DEVICE_VENDOR := ipTIME
DEVICE_MODEL := A6004NS-M
DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
endef
TARGET_DEVICES += iptime_a6004ns-m
define Device/iptime_a6ns-m
$(Device/dsa-migration)
IMAGE_SIZE := 16128k
UIMAGE_NAME := a6nm
DEVICE_VENDOR := ipTIME
DEVICE_MODEL := A6ns-M
DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
endef
TARGET_DEVICES += iptime_a6ns-m
define Device/iptime_a8004t
$(Device/dsa-migration)
IMAGE_SIZE := 16128k
UIMAGE_NAME := a8004t
DEVICE_VENDOR := ipTIME
DEVICE_MODEL := A8004T
DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 -uboot-envtools
endef
TARGET_DEVICES += iptime_a8004t
define Device/iptime_ax2004m
$(Device/nand)
IMAGE_SIZE := 121344k
KERNEL_LOADADDR := 0x82000000
KERNEL := kernel-bin | relocate-kernel 0x80001000 | lzma | \
fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
IMAGES += recovery.bin
IMAGE/recovery.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
check-size | iptime-crc32 ax2004m
DEVICE_VENDOR := ipTIME
DEVICE_MODEL := AX2004M
DEVICE_PACKAGES := kmod-mt7915-firmware kmod-usb3 -uboot-envtools
endef
TARGET_DEVICES += iptime_ax2004m
define Device/iptime_t5004
$(Device/nand)
IMAGE_SIZE := 129280k
UIMAGE_NAME := t5004
DEVICE_VENDOR := ipTIME
DEVICE_MODEL := T5004
DEVICE_PACKAGES := -wpad-basic-mbedtls -uboot-envtools
endef
TARGET_DEVICES += iptime_t5004
define Device/jcg_jhr-ac876m
$(Device/dsa-migration)
IMAGE_SIZE := 16064k
IMAGES += factory.bin
IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | jcg-header 89.1
JCG_MAXSIZE := 16064k
DEVICE_VENDOR := JCG
DEVICE_MODEL := JHR-AC876M
DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
endef
TARGET_DEVICES += jcg_jhr-ac876m
define Device/jcg_q20
$(Device/nand)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 91136k
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
check-size
DEVICE_VENDOR := JCG
DEVICE_MODEL := Q20
DEVICE_PACKAGES := kmod-mt7915-firmware
endef
TARGET_DEVICES += jcg_q20
define Device/jcg_y2
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
IMAGES += factory.bin
IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | jcg-header 95.1
JCG_MAXSIZE := 16064k
DEVICE_VENDOR := JCG
DEVICE_MODEL := Y2
DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 -uboot-envtools
endef
TARGET_DEVICES += jcg_y2
define Device/keenetic_kn-3010
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 31488k
DEVICE_VENDOR := Keenetic
DEVICE_MODEL := KN-3010
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
-uboot-envtools
IMAGES += factory.bin
IMAGE/factory.bin := $$(sysupgrade_bin) | pad-to $$$$(BLOCKSIZE) | \
check-size | zyimage -d 0x803010 -v "KN-3010"
endef
TARGET_DEVICES += keenetic_kn-3010
define Device/lenovo_newifi-d1
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 32448k
DEVICE_VENDOR := Lenovo
DEVICE_MODEL := Newifi D1
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 kmod-sdhci-mt7620 \
kmod-usb-ledtrig-usbport -uboot-envtools
SUPPORTED_DEVICES += newifi-d1
endef
TARGET_DEVICES += lenovo_newifi-d1
ramips: add support for Linksys E5600 This submission relied heavily on the work of Linksys EA7300 v1/ v2. Specifications: * SoC: MediaTek MT7621A (880 MHz 2c/4t) * RAM: 128M DDR3-1600 * Flash: 128M NAND * Eth: MediaTek MT7621A (10/100/1000 Mbps x5) * Radio: MT7603E/MT7613BE (2.4 GHz & 5 GHz) * Antennae: 2 internal fixed in the casing and 2 on the PCB * LEDs: Blue (x4 Ethernet) Blue+Orange (x2 Power + WPS and Internet) * Buttons: Reset (x1) WPS (x1) Installation: Flash factory image through GUI. This device has 2 partitions for the firmware called firmware and alt_firmware. To successfully flash and boot the device, the device should have been running from alt_firmware partition. To get the device booted through alt_firmware partition, download the OEM firmware from Linksys website and upgrade the firmware from web GUI. Once this is done, flash the OpenWrt Factory firmware from web GUI. Reverting to factory firmware: 1. Boot to 'alt_firmware'(where stock firmware resides) by doing one of the following: Press the "wps" button as soon as power LED turns on when booting. (OR) Hard-reset the router consecutively three times to force it to boot from 'alt_firmware'. 2. To remove any traces of OpenWRT from your router simply flash the OEM image at this point. Signed-off-by: Aashish Kulkarni <aashishkul@gmail.com> [fix hanging indents and wrap to 74 characters per line, add kmod-mt7663-firmware-sta package for 5GHz STA mode to work, remove sysupgrade.bin and concatenate IMAGES instead in mt7621.mk, set default-state "on" for power LED] Signed-off-by: Sannihith Kinnera <digislayer@protonmail.com> [move check-size before append-metadata, remove trailing whitespace] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-03-02 05:10:14 +00:00
define Device/linksys_e5600
$(Device/nand)
ramips: add support for Linksys E5600 This submission relied heavily on the work of Linksys EA7300 v1/ v2. Specifications: * SoC: MediaTek MT7621A (880 MHz 2c/4t) * RAM: 128M DDR3-1600 * Flash: 128M NAND * Eth: MediaTek MT7621A (10/100/1000 Mbps x5) * Radio: MT7603E/MT7613BE (2.4 GHz & 5 GHz) * Antennae: 2 internal fixed in the casing and 2 on the PCB * LEDs: Blue (x4 Ethernet) Blue+Orange (x2 Power + WPS and Internet) * Buttons: Reset (x1) WPS (x1) Installation: Flash factory image through GUI. This device has 2 partitions for the firmware called firmware and alt_firmware. To successfully flash and boot the device, the device should have been running from alt_firmware partition. To get the device booted through alt_firmware partition, download the OEM firmware from Linksys website and upgrade the firmware from web GUI. Once this is done, flash the OpenWrt Factory firmware from web GUI. Reverting to factory firmware: 1. Boot to 'alt_firmware'(where stock firmware resides) by doing one of the following: Press the "wps" button as soon as power LED turns on when booting. (OR) Hard-reset the router consecutively three times to force it to boot from 'alt_firmware'. 2. To remove any traces of OpenWRT from your router simply flash the OEM image at this point. Signed-off-by: Aashish Kulkarni <aashishkul@gmail.com> [fix hanging indents and wrap to 74 characters per line, add kmod-mt7663-firmware-sta package for 5GHz STA mode to work, remove sysupgrade.bin and concatenate IMAGES instead in mt7621.mk, set default-state "on" for power LED] Signed-off-by: Sannihith Kinnera <digislayer@protonmail.com> [move check-size before append-metadata, remove trailing whitespace] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-03-02 05:10:14 +00:00
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 26624k
DEVICE_VENDOR := Linksys
DEVICE_MODEL := E5600
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap
ramips: add support for Linksys E5600 This submission relied heavily on the work of Linksys EA7300 v1/ v2. Specifications: * SoC: MediaTek MT7621A (880 MHz 2c/4t) * RAM: 128M DDR3-1600 * Flash: 128M NAND * Eth: MediaTek MT7621A (10/100/1000 Mbps x5) * Radio: MT7603E/MT7613BE (2.4 GHz & 5 GHz) * Antennae: 2 internal fixed in the casing and 2 on the PCB * LEDs: Blue (x4 Ethernet) Blue+Orange (x2 Power + WPS and Internet) * Buttons: Reset (x1) WPS (x1) Installation: Flash factory image through GUI. This device has 2 partitions for the firmware called firmware and alt_firmware. To successfully flash and boot the device, the device should have been running from alt_firmware partition. To get the device booted through alt_firmware partition, download the OEM firmware from Linksys website and upgrade the firmware from web GUI. Once this is done, flash the OpenWrt Factory firmware from web GUI. Reverting to factory firmware: 1. Boot to 'alt_firmware'(where stock firmware resides) by doing one of the following: Press the "wps" button as soon as power LED turns on when booting. (OR) Hard-reset the router consecutively three times to force it to boot from 'alt_firmware'. 2. To remove any traces of OpenWRT from your router simply flash the OEM image at this point. Signed-off-by: Aashish Kulkarni <aashishkul@gmail.com> [fix hanging indents and wrap to 74 characters per line, add kmod-mt7663-firmware-sta package for 5GHz STA mode to work, remove sysupgrade.bin and concatenate IMAGES instead in mt7621.mk, set default-state "on" for power LED] Signed-off-by: Sannihith Kinnera <digislayer@protonmail.com> [move check-size before append-metadata, remove trailing whitespace] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-03-02 05:10:14 +00:00
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
append-ubi | check-size | gemtek-trailer
endef
TARGET_DEVICES += linksys_e5600
define Device/linksys_e7350
$(Device/belkin_rt1800)
DEVICE_VENDOR := Linksys
DEVICE_MODEL := E7350
IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
append-ubi | check-size | belkin-header GOLF 1 9.9.9
endef
TARGET_DEVICES += linksys_e7350
define Device/linksys_ea7xxx
$(Device/nand)
ramips: add support for Linksys EA7500 v2 The Linksys EA7500 v2 is advertised as AC1900, but its internal hardware is AC2600 capable. Hardware -------- SoC: Mediatek MT7621AT (880 MHz, 2 cores 4 threads) RAM: 256M (Nanya NT5CC128M16IP-DI) FLASH: 128MB NAND (Macronix MX30LF1G18AC-TI) ETH: 5x 10/100/1000 Mbps Ethernet (MT7530) WIFI: - 2.4GHz: 1x MT7615N (4x4:4) - 5GHz: 1x MT7615N (4x4:4) - 4 antennas: 3 external detachable antennas and 1 internal USB: - 1x USB 3.0 - 1x USB 2.0 BTN: - 1x Reset button - 1x WPS button LEDS: - 1x White led (Power) - 6x Green leds (link lan1-lan4, link wan, wps) - 5x Orange leds (act lan1-lan4, act wan) (working but unmodifiable) Everything works correctly. Installation ------------ The “factory” openwrt image can be flashed directly from OEM stock firmware. After the flash the router will reboot automatically. However, due to the dual boot system, the first installation could fail (if you want to know why, read the footnotes). If the flash succeed and you can reach OpenWrt through the web interface or ssh, you are done. Otherwise the router will try to boot 3 times and then will automatically boot the OEM firmware (don’t turn off the router. Simply wait and try to reach the router through the web interface every now and then, it will take few minutes). After this, you should be back in the OEM firmware. Now you have to flash the OEM Firmware over itself using the OEM web interface (I tested it using the FW_EA7500v2_2.0.8.194281_prod.img downloaded from the Linksys website). When the router reboots flash the “factory” OpenWrt image and this time it should work. After the OpenWrt installation you have to use the sysupgrade image for future updates. Restore OEM Firmware -------------------- After the OpenWrt flash, the OEM firmware is still stored in the second partition thanks to the dual boot system. You can switch from OpenWrt to OEM firmware and vice-versa failing the boot 3 times in a row: 1) power on the router 2) wait 15 seconds 3) power off the router 4) repeat steps 1-2-3 twice more. 5) power on the router and you should be in the “other” firmware If you want to completely remove OpenWrt from your router, switch to the OEM firmware and then flash OEM firmware from the web interface as a normal update. This procedure will overwrite the OpenWrt partition. Footnotes --------- The Linksys EA7500-v2 has a dual boot system to avoid bricks. This system works using 2 pair of partitions: 1) "kernel" and "rootfs" 2) "alt_kernel" and "alt_rootfs". After 3 failed boot attempts, the bootloader tries to boot the other pair of partitions and so on. This system is managed by the bootloader, which writes a bootcount in the s_env partition, and if successfully booted, the system add a "zero-bootcount" after the previous value. A system update performed from OEM firmware, writes the firmware on the other pair of partitions and sets the bootloader to boot the new pair of partitions editing the “boot_part” variable in the bootloader vars. Effectively it's a quick and safe system to switch the selected boot partition. Another way to switch the boot partition is: 1) power on the router 2) wait 15 seconds 3) power off the router 4) repeat steps 1-2-3 twice more. 5) power on the router and you should be in the “other” firmware In this OpenWrt port, this dual boot system is partially working because the bootloader sets the right rootfs partition in the cmdline but unfortunately OpenWrt for ramips platform overwrites the cmdline so is not possible to detect the right rootfs partition. Because all of this, I preferred to simply use the first pair of partitions and set read-only the other pair. However this solution is not optimal because is not possible to know without opening the case which is the current booted partition. Let’s take for example a router booting the OEM firmware from the first pair of partitions. If we flash the OpenWrt image, it will be written on the second pair. In this situation the router will bootloop 3 times and then will automatically come back to the first pair of partitions containg the OEM firmware. In this situation, to flash OpenWrt correctly is necessary to switch the booting partition, flashing again the OEM firmware over itself. At this point the OEM firmware is on both pair of partitions but the current booted pair is the second one. Now, flashing the OpenWrt factory image will write the firmware on the first pair and then will boot correctly. If this limitation in the ramips platform about the cmdline will be fixed, the dual boot system can also be implemented in OpenWrt with almost no effort. Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> Co-Developed-by: Jackson Lim <jackcolentern@gmail.com> Signed-off-by: Jackson Lim <jackcolentern@gmail.com>
2020-05-11 23:27:50 +00:00
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 36864k
DEVICE_VENDOR := Linksys
DEVICE_PACKAGES := kmod-usb3 kmod-mt7615-firmware
ramips: add support for Linksys EA7500 v2 The Linksys EA7500 v2 is advertised as AC1900, but its internal hardware is AC2600 capable. Hardware -------- SoC: Mediatek MT7621AT (880 MHz, 2 cores 4 threads) RAM: 256M (Nanya NT5CC128M16IP-DI) FLASH: 128MB NAND (Macronix MX30LF1G18AC-TI) ETH: 5x 10/100/1000 Mbps Ethernet (MT7530) WIFI: - 2.4GHz: 1x MT7615N (4x4:4) - 5GHz: 1x MT7615N (4x4:4) - 4 antennas: 3 external detachable antennas and 1 internal USB: - 1x USB 3.0 - 1x USB 2.0 BTN: - 1x Reset button - 1x WPS button LEDS: - 1x White led (Power) - 6x Green leds (link lan1-lan4, link wan, wps) - 5x Orange leds (act lan1-lan4, act wan) (working but unmodifiable) Everything works correctly. Installation ------------ The “factory” openwrt image can be flashed directly from OEM stock firmware. After the flash the router will reboot automatically. However, due to the dual boot system, the first installation could fail (if you want to know why, read the footnotes). If the flash succeed and you can reach OpenWrt through the web interface or ssh, you are done. Otherwise the router will try to boot 3 times and then will automatically boot the OEM firmware (don’t turn off the router. Simply wait and try to reach the router through the web interface every now and then, it will take few minutes). After this, you should be back in the OEM firmware. Now you have to flash the OEM Firmware over itself using the OEM web interface (I tested it using the FW_EA7500v2_2.0.8.194281_prod.img downloaded from the Linksys website). When the router reboots flash the “factory” OpenWrt image and this time it should work. After the OpenWrt installation you have to use the sysupgrade image for future updates. Restore OEM Firmware -------------------- After the OpenWrt flash, the OEM firmware is still stored in the second partition thanks to the dual boot system. You can switch from OpenWrt to OEM firmware and vice-versa failing the boot 3 times in a row: 1) power on the router 2) wait 15 seconds 3) power off the router 4) repeat steps 1-2-3 twice more. 5) power on the router and you should be in the “other” firmware If you want to completely remove OpenWrt from your router, switch to the OEM firmware and then flash OEM firmware from the web interface as a normal update. This procedure will overwrite the OpenWrt partition. Footnotes --------- The Linksys EA7500-v2 has a dual boot system to avoid bricks. This system works using 2 pair of partitions: 1) "kernel" and "rootfs" 2) "alt_kernel" and "alt_rootfs". After 3 failed boot attempts, the bootloader tries to boot the other pair of partitions and so on. This system is managed by the bootloader, which writes a bootcount in the s_env partition, and if successfully booted, the system add a "zero-bootcount" after the previous value. A system update performed from OEM firmware, writes the firmware on the other pair of partitions and sets the bootloader to boot the new pair of partitions editing the “boot_part” variable in the bootloader vars. Effectively it's a quick and safe system to switch the selected boot partition. Another way to switch the boot partition is: 1) power on the router 2) wait 15 seconds 3) power off the router 4) repeat steps 1-2-3 twice more. 5) power on the router and you should be in the “other” firmware In this OpenWrt port, this dual boot system is partially working because the bootloader sets the right rootfs partition in the cmdline but unfortunately OpenWrt for ramips platform overwrites the cmdline so is not possible to detect the right rootfs partition. Because all of this, I preferred to simply use the first pair of partitions and set read-only the other pair. However this solution is not optimal because is not possible to know without opening the case which is the current booted partition. Let’s take for example a router booting the OEM firmware from the first pair of partitions. If we flash the OpenWrt image, it will be written on the second pair. In this situation the router will bootloop 3 times and then will automatically come back to the first pair of partitions containg the OEM firmware. In this situation, to flash OpenWrt correctly is necessary to switch the booting partition, flashing again the OEM firmware over itself. At this point the OEM firmware is on both pair of partitions but the current booted pair is the second one. Now, flashing the OpenWrt factory image will write the firmware on the first pair and then will boot correctly. If this limitation in the ramips platform about the cmdline will be fixed, the dual boot system can also be implemented in OpenWrt with almost no effort. Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> Co-Developed-by: Jackson Lim <jackcolentern@gmail.com> Signed-off-by: Jackson Lim <jackcolentern@gmail.com>
2020-05-11 23:27:50 +00:00
IMAGES := sysupgrade.bin factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
append-ubi | check-size | linksys-image type=$$$$(LINKSYS_HWNAME)
endef
define Device/linksys_ea6350-v4
$(Device/linksys_ea7xxx)
DEVICE_MODEL := EA6350
DEVICE_VARIANT := v4
LINKSYS_HWNAME := EA6350
DEVICE_PACKAGES += kmod-mt7603 kmod-mt7663-firmware-ap
endef
TARGET_DEVICES += linksys_ea6350-v4
define Device/linksys_ea7300-v1
$(Device/linksys_ea7xxx)
DEVICE_MODEL := EA7300
DEVICE_VARIANT := v1
LINKSYS_HWNAME := EA7300
endef
TARGET_DEVICES += linksys_ea7300-v1
define Device/linksys_ea7300-v2
$(Device/linksys_ea7xxx)
DEVICE_MODEL := EA7300
DEVICE_VARIANT := v2
LINKSYS_HWNAME := EA7300v2
DEVICE_PACKAGES += kmod-mt7603
endef
TARGET_DEVICES += linksys_ea7300-v2
define Device/linksys_ea7500-v2
$(Device/linksys_ea7xxx)
DEVICE_MODEL := EA7500
DEVICE_VARIANT := v2
LINKSYS_HWNAME := EA7500v2
ramips: add support for Linksys EA7500 v2 The Linksys EA7500 v2 is advertised as AC1900, but its internal hardware is AC2600 capable. Hardware -------- SoC: Mediatek MT7621AT (880 MHz, 2 cores 4 threads) RAM: 256M (Nanya NT5CC128M16IP-DI) FLASH: 128MB NAND (Macronix MX30LF1G18AC-TI) ETH: 5x 10/100/1000 Mbps Ethernet (MT7530) WIFI: - 2.4GHz: 1x MT7615N (4x4:4) - 5GHz: 1x MT7615N (4x4:4) - 4 antennas: 3 external detachable antennas and 1 internal USB: - 1x USB 3.0 - 1x USB 2.0 BTN: - 1x Reset button - 1x WPS button LEDS: - 1x White led (Power) - 6x Green leds (link lan1-lan4, link wan, wps) - 5x Orange leds (act lan1-lan4, act wan) (working but unmodifiable) Everything works correctly. Installation ------------ The “factory” openwrt image can be flashed directly from OEM stock firmware. After the flash the router will reboot automatically. However, due to the dual boot system, the first installation could fail (if you want to know why, read the footnotes). If the flash succeed and you can reach OpenWrt through the web interface or ssh, you are done. Otherwise the router will try to boot 3 times and then will automatically boot the OEM firmware (don’t turn off the router. Simply wait and try to reach the router through the web interface every now and then, it will take few minutes). After this, you should be back in the OEM firmware. Now you have to flash the OEM Firmware over itself using the OEM web interface (I tested it using the FW_EA7500v2_2.0.8.194281_prod.img downloaded from the Linksys website). When the router reboots flash the “factory” OpenWrt image and this time it should work. After the OpenWrt installation you have to use the sysupgrade image for future updates. Restore OEM Firmware -------------------- After the OpenWrt flash, the OEM firmware is still stored in the second partition thanks to the dual boot system. You can switch from OpenWrt to OEM firmware and vice-versa failing the boot 3 times in a row: 1) power on the router 2) wait 15 seconds 3) power off the router 4) repeat steps 1-2-3 twice more. 5) power on the router and you should be in the “other” firmware If you want to completely remove OpenWrt from your router, switch to the OEM firmware and then flash OEM firmware from the web interface as a normal update. This procedure will overwrite the OpenWrt partition. Footnotes --------- The Linksys EA7500-v2 has a dual boot system to avoid bricks. This system works using 2 pair of partitions: 1) "kernel" and "rootfs" 2) "alt_kernel" and "alt_rootfs". After 3 failed boot attempts, the bootloader tries to boot the other pair of partitions and so on. This system is managed by the bootloader, which writes a bootcount in the s_env partition, and if successfully booted, the system add a "zero-bootcount" after the previous value. A system update performed from OEM firmware, writes the firmware on the other pair of partitions and sets the bootloader to boot the new pair of partitions editing the “boot_part” variable in the bootloader vars. Effectively it's a quick and safe system to switch the selected boot partition. Another way to switch the boot partition is: 1) power on the router 2) wait 15 seconds 3) power off the router 4) repeat steps 1-2-3 twice more. 5) power on the router and you should be in the “other” firmware In this OpenWrt port, this dual boot system is partially working because the bootloader sets the right rootfs partition in the cmdline but unfortunately OpenWrt for ramips platform overwrites the cmdline so is not possible to detect the right rootfs partition. Because all of this, I preferred to simply use the first pair of partitions and set read-only the other pair. However this solution is not optimal because is not possible to know without opening the case which is the current booted partition. Let’s take for example a router booting the OEM firmware from the first pair of partitions. If we flash the OpenWrt image, it will be written on the second pair. In this situation the router will bootloop 3 times and then will automatically come back to the first pair of partitions containg the OEM firmware. In this situation, to flash OpenWrt correctly is necessary to switch the booting partition, flashing again the OEM firmware over itself. At this point the OEM firmware is on both pair of partitions but the current booted pair is the second one. Now, flashing the OpenWrt factory image will write the firmware on the first pair and then will boot correctly. If this limitation in the ramips platform about the cmdline will be fixed, the dual boot system can also be implemented in OpenWrt with almost no effort. Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> Co-Developed-by: Jackson Lim <jackcolentern@gmail.com> Signed-off-by: Jackson Lim <jackcolentern@gmail.com>
2020-05-11 23:27:50 +00:00
endef
TARGET_DEVICES += linksys_ea7500-v2
define Device/linksys_ea8100-v1
$(Device/linksys_ea7xxx)
DEVICE_MODEL := EA8100
DEVICE_VARIANT := v1
LINKSYS_HWNAME := EA8100
endef
TARGET_DEVICES += linksys_ea8100-v1
define Device/linksys_ea8100-v2
$(Device/linksys_ea7xxx)
DEVICE_MODEL := EA8100
DEVICE_VARIANT := v2
LINKSYS_HWNAME := EA8100v2
endef
TARGET_DEVICES += linksys_ea8100-v2
define Device/linksys_re6500
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 7872k
DEVICE_VENDOR := Linksys
DEVICE_MODEL := RE6500
DEVICE_PACKAGES := kmod-mt76x2 -uboot-envtools
SUPPORTED_DEVICES += re6500
ramips: add support for Xiaomi Mi Router 3 Pro Hardware: CPU: MediaTek MT7621AT (2x880MHz) RAM: 512MB DDR3 FLASH: 256MB NAND WiFi: 2.4GHz 4x4 MT7615 b/g/n (Needs driver, See Issues!) WiFI: 5GHz 4x4 MT7615 a/n/ac (Needs driver, See Issues!) USB: 1x 3.0 ETH: 1x WAN 10/100/1000 3x LAN 10/100/1000 LED: Power/Status BTN: RESET UART: 115200 8n1 Partition layout and boot: Stock Xiaomi firmware has the MTD split into (among others) - kernel0 (@0x200000) - kernel1 (@0x600000) - rootfs0 - rootfs1 - overlay (ubi) Xiaomi uboot expects to find kernels at 0x200000 & 0x600000 referred to as system 1 & system 2 respectively. a kernel is considered suitable for handing control over if its linux magic number exists & uImage CRC are correct. If either of those conditions fail, a matching sys'n'_fail flag is set in uboot env & a restart performed in the hope that the alternate kernel is okay. If neither kernel checksums ok and both are marked failed, system 2 is booted anyway. Note uboot's tftp flash install writes the transferred image to both kernel partitions. Installation: Similar to the Xiaomi MIR3G, we keep stock Xiaomi firmware in kernel0 for ease of recovery, and install OpenWRT into kernel1 and after. The installation file for OpenWRT is a *squashfs-factory.bin file that contains the kernel and a ubi partition. This is flashed as follows: nvram set flag_try_sys1_failed=1 nvram set flag_try_sys2_failed=0 nvram commit dd if=factory.bin bs=1M count=4 | mtd write - kernel1 dd if=factory.bin bs=1M skip=4 | mtd write - rootfs0 reboot Reverting to stock: The part of stock firmware we've kept in kernel0 allows us to run stock recovery, which will re-flash stock firmware from a *.bin file on a USB. For this we do the following: fw_setenv flag_try_sys1_failed 0 fw_setenv flag_try_sys2_failed 1 reboot After reboot the LED status light will blink red, at which point pressing the 'reset' button will cause stock firmware to be installed from USB. Issues: OpenWRT currently does not have support for the MT7615 wifi chips. There is ongoing work to add mt7615 support to the open source mt76 driver. Until that support is in place, there are closed-source kernel modules that can be used. See: https://forum.openwrt.org/t/support-for-xiaomi-wifi-r3p-pro/20290/170 Signed-off-by: Ozgur Can Leonard <ozgurcan@gmail.com> Signed-off-by: Christian Lamparter <chunkeey@gmail.com> [02_network remaps, Added link to notes]
2019-03-05 08:41:37 +00:00
endef
TARGET_DEVICES += linksys_re6500
ramips: add support for Xiaomi Mi Router 3 Pro Hardware: CPU: MediaTek MT7621AT (2x880MHz) RAM: 512MB DDR3 FLASH: 256MB NAND WiFi: 2.4GHz 4x4 MT7615 b/g/n (Needs driver, See Issues!) WiFI: 5GHz 4x4 MT7615 a/n/ac (Needs driver, See Issues!) USB: 1x 3.0 ETH: 1x WAN 10/100/1000 3x LAN 10/100/1000 LED: Power/Status BTN: RESET UART: 115200 8n1 Partition layout and boot: Stock Xiaomi firmware has the MTD split into (among others) - kernel0 (@0x200000) - kernel1 (@0x600000) - rootfs0 - rootfs1 - overlay (ubi) Xiaomi uboot expects to find kernels at 0x200000 & 0x600000 referred to as system 1 & system 2 respectively. a kernel is considered suitable for handing control over if its linux magic number exists & uImage CRC are correct. If either of those conditions fail, a matching sys'n'_fail flag is set in uboot env & a restart performed in the hope that the alternate kernel is okay. If neither kernel checksums ok and both are marked failed, system 2 is booted anyway. Note uboot's tftp flash install writes the transferred image to both kernel partitions. Installation: Similar to the Xiaomi MIR3G, we keep stock Xiaomi firmware in kernel0 for ease of recovery, and install OpenWRT into kernel1 and after. The installation file for OpenWRT is a *squashfs-factory.bin file that contains the kernel and a ubi partition. This is flashed as follows: nvram set flag_try_sys1_failed=1 nvram set flag_try_sys2_failed=0 nvram commit dd if=factory.bin bs=1M count=4 | mtd write - kernel1 dd if=factory.bin bs=1M skip=4 | mtd write - rootfs0 reboot Reverting to stock: The part of stock firmware we've kept in kernel0 allows us to run stock recovery, which will re-flash stock firmware from a *.bin file on a USB. For this we do the following: fw_setenv flag_try_sys1_failed 0 fw_setenv flag_try_sys2_failed 1 reboot After reboot the LED status light will blink red, at which point pressing the 'reset' button will cause stock firmware to be installed from USB. Issues: OpenWRT currently does not have support for the MT7615 wifi chips. There is ongoing work to add mt7615 support to the open source mt76 driver. Until that support is in place, there are closed-source kernel modules that can be used. See: https://forum.openwrt.org/t/support-for-xiaomi-wifi-r3p-pro/20290/170 Signed-off-by: Ozgur Can Leonard <ozgurcan@gmail.com> Signed-off-by: Christian Lamparter <chunkeey@gmail.com> [02_network remaps, Added link to notes]
2019-03-05 08:41:37 +00:00
define Device/linksys_re7000
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Linksys
DEVICE_MODEL := RE7000
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware
endef
TARGET_DEVICES += linksys_re7000
define Device/mediatek_ap-mt7621a-v60
$(Device/dsa-migration)
IMAGE_SIZE := 7872k
DEVICE_VENDOR := Mediatek
DEVICE_MODEL := AP-MT7621A-V60 EVB
DEVICE_PACKAGES := kmod-usb3 kmod-sdhci-mt7620 kmod-sound-mt7620 \
-wpad-basic-mbedtls -uboot-envtools
endef
TARGET_DEVICES += mediatek_ap-mt7621a-v60
define Device/mediatek_mt7621-eval-board
$(Device/dsa-migration)
ramips/mt7621: fix IMAGE_SIZE for all devices This fixes IMAGE_SIZE for all devices based on the partition size given in DTS: DEVICE *.MK *.DTS VERDICT afoundry_ew1200 (16M) 0xfb0000 asiarf_ap7621-001 (16M) 0xfa0000 wrong buffalo_wsr-1166dhp (16M) 0xf90000 wrong buffalo_wsr-600dhp (16M) 0xfb0000 dlink_dir-860l-b1 (16M) 0xfb0000 d-team_newifi-d2 (32M) 0x1fb0000 d-team_pbr-m1 (16M) 0xfb0000 elecom_wrc-1167ghbk2-s 15488k 0xf20000 elecom_wrc-1900gst 11264k 0xb00000 elecom_wrc-2533gst 11264k 0xb00000 firefly_firewrt (16M) 0xfb0000 gehua_ghl-r-001 (32M) 0x1fb0000 gnubee_gb-pc1 (32M) 0x1fb0000 gnubee_gb-pc2 (32M) 0x1fb0000 hiwifi_hc5962 (32M) 0x2000000 wrong (kernel + ubi) iodata_wn-ax1167gr 15552k 0xf30000 iodata_wn-gx300gr 7798784 0x770000 lenovo_newifi-d1 (32M) 0x1fb0000 linksys_re6500 - 0x7b0000 default mediatek_ap-mt7621a-v60 (8M) 0x7b0000 mediatek_mt7621-eval-board (4M) 0xec0000 wrong (rootfs) mikrotik_rb750gr3 [16128k] 0xfc0000 mikrotik_rbm11g [16128k] 0xFC0000 mikrotik_rbm33g [16128k] 0xFC0000 mqmaker_witi-256m (16M) 0xfb0000 mqmaker_witi-512m (16M) 0xfb0000 mtc_wr1201 16000k 0xfa0000 netgear_ex6150 14848k 0xe80000 netgear_r6220 28672k 0x1c00000 netgear_r6350 40960k 0x2800000 netgear_wndr3700-v5 15232k 0xee0000 netis_wf-2881 129280k 0x7E40000 phicomm_k2p 15744k 0xf60000 planex_vr500 66453504 0x3fb0000 wrong samknows_whitebox-v8 (16M) 0xfb0000 storylink_sap-g3200u3 - 0x7b0000 default telco-electronics_x1 16064k 0xfb0000 thunder_timecloud - 0xfb0000 wrong totolink_a7000r 16064k 0xfb0000 tplink_re350-v1 6016k 0x5e0000 ubiquiti_edgerouterx - 0xfa00000 wrong (kernel1 + ubi) ubiquiti_edgerouterx-sfp - 0xfa00000 wrong (kernel1 + ubi) unielec_u7621-06-256m-16m 16064k 0xfb0000 unielec_u7621-06-512m-64m 65216k 0x3fb0000 wevo_11acnas (16M) 0xfb0000 wevo_w2914ns-v2 (16M) 0xfb0000 xiaomi_mir3g 32768k 0x7980000 wrong (kernel + ubi) xiaomi_mir3p (32M) 0xf980000 wrong (kernel + ubi) xzwifi_creativebox-v1 (32M) 0x1fb0000 youhua_wr1200js 16064k 0xfb0000 youku_yk-l2 (16M) 0xfb0000 zbtlink_zbt-we1326 (16M) 0xfb0000 zbtlink_zbt-we3526 (16M) 0xfb0000 zbtlink_zbt-wg2626 (16M) 0xfb0000 zbtlink_zbt-wg3526-16m (16M) 0xfb0000 zbtlink_zbt-wg3526-32m (32M) 0x1fb0000 No verdict means that the device is correctly set. Legend: ( ): Value is set via ralink_default_fw_size_xxM [ ]: Value is derived from parent definition - : Value is not set and derived from default definition Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-07-15 12:55:24 +00:00
IMAGE_SIZE := 15104k
DEVICE_VENDOR := MediaTek
DEVICE_MODEL := MT7621 EVB
DEVICE_PACKAGES := -wpad-basic-mbedtls -uboot-envtools
SUPPORTED_DEVICES += mt7621
endef
TARGET_DEVICES += mediatek_mt7621-eval-board
define Device/mercusys_mr70x-v1
$(Device/dsa-migration)
$(Device/tplink-safeloader)
DEVICE_VENDOR := Mercusys
DEVICE_MODEL := MR70X
DEVICE_VARIANT := v1
DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
TPLINK_BOARD_ID := MR70X
KERNEL := $(KERNEL_DTB) | uImage lzma
IMAGE_SIZE := 15744k
endef
TARGET_DEVICES += mercusys_mr70x-v1
define Device/MikroTik
$(Device/dsa-migration)
DEVICE_VENDOR := MikroTik
IMAGE_SIZE := 16128k
DEVICE_PACKAGES := kmod-usb3 -uboot-envtools
KERNEL_NAME := vmlinuz
KERNEL := kernel-bin | append-dtb-elf
IMAGE/sysupgrade.bin := append-kernel | kernel2minor -s 1024 | \
pad-to $$$$(BLOCKSIZE) | append-rootfs | pad-rootfs | check-size | \
append-metadata
endef
define Device/mikrotik_ltap-2hnd
$(Device/MikroTik)
DEVICE_MODEL := LtAP-2HnD
DEVICE_PACKAGES += kmod-ath9k kmod-pps-gpio rssileds
endef
TARGET_DEVICES += mikrotik_ltap-2hnd
define Device/mikrotik_routerboard-750gr3
$(Device/MikroTik)
DEVICE_MODEL := RouterBOARD 750Gr3
DEVICE_PACKAGES += -wpad-basic-mbedtls
SUPPORTED_DEVICES += mikrotik,rb750gr3
endef
TARGET_DEVICES += mikrotik_routerboard-750gr3
ramips: add support for MikroTik RouterBOARD 760iGS (hEX S) This patch adds support for the MikroTik RouterBOARD 760iGS router. It is similar to the already supported RouterBOARD 750Gr3. The 760iGS device features an added SFP cage, and passive PoE out on port 5 compared to the RB750Gr3. https://mikrotik.com/product/hex_s Specifications: - SoC: MediaTek MT7621A - CPU: 880MHz - Flash: 16 MB - RAM: 256 MB - Ethernet: 5x 10/100/1000 Mbps - SFP cage - USB port - microSD slot Unsupported: - Beeper (requires PWM driver) - ZT2046Q (ADS7846 compatible) on SPI as slave 1 (CS1) The linux driver requires an interrupt, and pendown GPIO These are unknown, and not needed with the touchscreen only used for temperature and voltage monitoring. ads7846 hwmon: temp0 is degrees Celsius temp1 is voltage * 32 GPIOs: - 07: input passive PoE out (lan5) compatible (Mikrotik) device connected - 17: output passive PoE out (lan5) switch Installation through RouterBoot follows the usual MikroTik method https://openwrt.org/toh/mikrotik/common To boot to intramfs image in RAM: 1. Setup TFTP server to serve intramfs image. 2. Plug Ethernet cable into WAN port. 3. Unplug power, hold reset button and plug power in. Wait (~25 seconds) for beep and then release reset button. The SFP LED will be lit in RouterBoot, but will not be lit in OpenWRT. 4. Wait for a minute. Router should be running OpenWrt, check by plugging in to port 2-5 and going to 192.168.1.1. To install OpenWrt to flash: 1. Follow steps above to boot intramfs image in RAM. 2. Flash the sysupgrade.bin image with web interface or sysupgrade. 3. Once the router reboots you will be running OpenWrt from flash. OEM firmware differences: - RouterOS assigns a different MAC address for each port - The first address (E01 on the sticker) is used for wan (ether1 in OEM). - The next address is used for lan2. - The last address (E06 on the sticker) is used for sfp. [Initial port work, shared dtsi] Signed-off-by: Vince Grassia <vincenzo.grassia@zionark.com> [SFP support and GPIO identification] Signed-off-by: Luka Logar <luka.logar@iname.com> [Misc. fixes and submission] Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au> [rebase, drop uart3 from state_default on 750gr3, minor commit title/message facelift] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-06-10 22:15:40 +00:00
define Device/mikrotik_routerboard-760igs
$(Device/MikroTik)
DEVICE_MODEL := RouterBOARD 760iGS
DEVICE_PACKAGES += kmod-sfp -wpad-basic-mbedtls
ramips: add support for MikroTik RouterBOARD 760iGS (hEX S) This patch adds support for the MikroTik RouterBOARD 760iGS router. It is similar to the already supported RouterBOARD 750Gr3. The 760iGS device features an added SFP cage, and passive PoE out on port 5 compared to the RB750Gr3. https://mikrotik.com/product/hex_s Specifications: - SoC: MediaTek MT7621A - CPU: 880MHz - Flash: 16 MB - RAM: 256 MB - Ethernet: 5x 10/100/1000 Mbps - SFP cage - USB port - microSD slot Unsupported: - Beeper (requires PWM driver) - ZT2046Q (ADS7846 compatible) on SPI as slave 1 (CS1) The linux driver requires an interrupt, and pendown GPIO These are unknown, and not needed with the touchscreen only used for temperature and voltage monitoring. ads7846 hwmon: temp0 is degrees Celsius temp1 is voltage * 32 GPIOs: - 07: input passive PoE out (lan5) compatible (Mikrotik) device connected - 17: output passive PoE out (lan5) switch Installation through RouterBoot follows the usual MikroTik method https://openwrt.org/toh/mikrotik/common To boot to intramfs image in RAM: 1. Setup TFTP server to serve intramfs image. 2. Plug Ethernet cable into WAN port. 3. Unplug power, hold reset button and plug power in. Wait (~25 seconds) for beep and then release reset button. The SFP LED will be lit in RouterBoot, but will not be lit in OpenWRT. 4. Wait for a minute. Router should be running OpenWrt, check by plugging in to port 2-5 and going to 192.168.1.1. To install OpenWrt to flash: 1. Follow steps above to boot intramfs image in RAM. 2. Flash the sysupgrade.bin image with web interface or sysupgrade. 3. Once the router reboots you will be running OpenWrt from flash. OEM firmware differences: - RouterOS assigns a different MAC address for each port - The first address (E01 on the sticker) is used for wan (ether1 in OEM). - The next address is used for lan2. - The last address (E06 on the sticker) is used for sfp. [Initial port work, shared dtsi] Signed-off-by: Vince Grassia <vincenzo.grassia@zionark.com> [SFP support and GPIO identification] Signed-off-by: Luka Logar <luka.logar@iname.com> [Misc. fixes and submission] Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au> [rebase, drop uart3 from state_default on 750gr3, minor commit title/message facelift] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-06-10 22:15:40 +00:00
endef
TARGET_DEVICES += mikrotik_routerboard-760igs
define Device/mikrotik_routerboard-m11g
$(Device/MikroTik)
DEVICE_MODEL := RouterBOARD M11G
DEVICE_PACKAGES := -wpad-basic-mbedtls
SUPPORTED_DEVICES += mikrotik,rbm11g
endef
TARGET_DEVICES += mikrotik_routerboard-m11g
define Device/mikrotik_routerboard-m33g
$(Device/MikroTik)
DEVICE_MODEL := RouterBOARD M33G
DEVICE_PACKAGES := -wpad-basic-mbedtls
SUPPORTED_DEVICES += mikrotik,rbm33g
endef
TARGET_DEVICES += mikrotik_routerboard-m33g
define Device/mqmaker_witi
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := MQmaker
DEVICE_MODEL := WiTi
DEVICE_PACKAGES := kmod-ata-ahci kmod-mt76x2 kmod-sdhci-mt7620 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
SUPPORTED_DEVICES += witi mqmaker,witi-256m mqmaker,witi-512m
endef
TARGET_DEVICES += mqmaker_witi
define Device/mtc_wr1201
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16000k
DEVICE_VENDOR := MTC
DEVICE_MODEL := Wireless Router WR1201
KERNEL_INITRAMFS := $(KERNEL_DTB) | uImage lzma -n 'WR1201_8_128'
DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
endef
TARGET_DEVICES += mtc_wr1201
ramips: add support for MTS WG430223 MTS WG430223 is a wireless AC1300 (WiFi 5) router manufactured by Arcadyan company. It's very similar to Beeline Smartbox Flash (Arcadyan WG443223). Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 128 MiB Flash: 128 MiB (Winbond W29N01HV) Wireless 2.4 GHz (MT7615DN): b/g/n, 2x2 Wireless 5 GHz (MT7615DN): a/n/ac, 2x2 Ethernet: 3xGbE (WAN, LAN1, LAN2) USB ports: No Button: 1 (Reset/WPS) LEDs: 2 (Red, Green) Power: 12 VDC, 1 A Connector type: Barrel Bootloader: U-Boot (Ralink UBoot Version: 5.0.0.2) OEM: Arcadyan WG430223 Installation ------------ 1. Login to the router web interface (superadmin:serial number) 2. Navigate to Administration -> Miscellaneous -> Access control lists & enable telnet & enable "Remote control from any IP address" 3. Connect to the router using telnet (default admin:admin) 4. Place *factory.trx on any web server (192.168.1.2 in this example) 5. Connect to the router using telnet shell (no password required) 6. Save MAC adresses to U-Boot environment: uboot_env --set --name eth2macaddr --value $(ifconfig | grep eth2 | \ awk '{print $5}') uboot_env --set --name eth3macaddr --value $(ifconfig | grep eth3 | \ awk '{print $5}') uboot_env --set --name ra0macaddr --value $(ifconfig | grep ra0 | \ awk '{print $5}') uboot_env --set --name rax0macaddr --value $(ifconfig | grep rax0 | \ awk '{print $5}') 7. Ensure that MACs were saved correctly: uboot_env --get --name eth2macaddr uboot_env --get --name eth3macaddr uboot_env --get --name ra0macaddr uboot_env --get --name rax0macaddr 8. Download and write the OpenWrt images: cd /tmp wget http://192.168.1.2/factory.trx mtd_write erase /dev/mtd4 mtd_write write factory.trx /dev/mtd4 9. Set 1st boot partition and reboot: uboot_env --set --name bootpartition --value 0 Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv bootpartition 1 reboot 2. Optional step. Upgrade the stock firmware with any version to overwrite the OpenWrt in Slot 1. MAC addresses ------------- +-----------+-------------------+----------------+ | Interface | MAC | Source | +-----------+-------------------+----------------+ | label | A4:xx:xx:51:xx:F4 | No MACs was | | LAN | A4:xx:xx:51:xx:F6 | found on Flash | | WAN | A4:xx:xx:51:xx:F4 | [1] | | WLAN_2g | A4:xx:xx:51:xx:F5 | | | WLAN_5g | A6:xx:xx:21:xx:F5 | | +-----------+-------------------+----------------+ [1]: a. Label wasb't found neither in factory nor in other places. b. MAC addresses are stored in encrypted partition "glbcfg". Encryption key hasn't known yet. To ensure the correct MACs in OpenWrt, a hack with saving of the MACs to u-boot-env during the installation was applied. c. Default Ralink ethernet MAC address (00:0C:43:28:80:A0) was found in "Factory" 0xfff0. It's the same for all MTS WG430223 devices. OEM firmware also uses this MAC when initialazes ethernet driver. In OpenWrt we use it only as internal GMAC (eth0), all other MACs are unique. Therefore, there is no any barriers to the operation of several MTS WG430223 devices even within the same broadcast domain. Stock firmware image format --------------------------- The same as Beeline Smartbox Flash but with another trx magic +--------------+---------------+----------------------------------------+ | Offset | | Description | +==============+===============+========================================+ | 0x0 | 31 52 48 53 | TRX magic "1RHS" | +--------------+---------------+----------------------------------------+ Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-05-04 15:16:38 +00:00
define Device/mts_wg430223
$(Device/nand)
ramips: add support for MTS WG430223 MTS WG430223 is a wireless AC1300 (WiFi 5) router manufactured by Arcadyan company. It's very similar to Beeline Smartbox Flash (Arcadyan WG443223). Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 128 MiB Flash: 128 MiB (Winbond W29N01HV) Wireless 2.4 GHz (MT7615DN): b/g/n, 2x2 Wireless 5 GHz (MT7615DN): a/n/ac, 2x2 Ethernet: 3xGbE (WAN, LAN1, LAN2) USB ports: No Button: 1 (Reset/WPS) LEDs: 2 (Red, Green) Power: 12 VDC, 1 A Connector type: Barrel Bootloader: U-Boot (Ralink UBoot Version: 5.0.0.2) OEM: Arcadyan WG430223 Installation ------------ 1. Login to the router web interface (superadmin:serial number) 2. Navigate to Administration -> Miscellaneous -> Access control lists & enable telnet & enable "Remote control from any IP address" 3. Connect to the router using telnet (default admin:admin) 4. Place *factory.trx on any web server (192.168.1.2 in this example) 5. Connect to the router using telnet shell (no password required) 6. Save MAC adresses to U-Boot environment: uboot_env --set --name eth2macaddr --value $(ifconfig | grep eth2 | \ awk '{print $5}') uboot_env --set --name eth3macaddr --value $(ifconfig | grep eth3 | \ awk '{print $5}') uboot_env --set --name ra0macaddr --value $(ifconfig | grep ra0 | \ awk '{print $5}') uboot_env --set --name rax0macaddr --value $(ifconfig | grep rax0 | \ awk '{print $5}') 7. Ensure that MACs were saved correctly: uboot_env --get --name eth2macaddr uboot_env --get --name eth3macaddr uboot_env --get --name ra0macaddr uboot_env --get --name rax0macaddr 8. Download and write the OpenWrt images: cd /tmp wget http://192.168.1.2/factory.trx mtd_write erase /dev/mtd4 mtd_write write factory.trx /dev/mtd4 9. Set 1st boot partition and reboot: uboot_env --set --name bootpartition --value 0 Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv bootpartition 1 reboot 2. Optional step. Upgrade the stock firmware with any version to overwrite the OpenWrt in Slot 1. MAC addresses ------------- +-----------+-------------------+----------------+ | Interface | MAC | Source | +-----------+-------------------+----------------+ | label | A4:xx:xx:51:xx:F4 | No MACs was | | LAN | A4:xx:xx:51:xx:F6 | found on Flash | | WAN | A4:xx:xx:51:xx:F4 | [1] | | WLAN_2g | A4:xx:xx:51:xx:F5 | | | WLAN_5g | A6:xx:xx:21:xx:F5 | | +-----------+-------------------+----------------+ [1]: a. Label wasb't found neither in factory nor in other places. b. MAC addresses are stored in encrypted partition "glbcfg". Encryption key hasn't known yet. To ensure the correct MACs in OpenWrt, a hack with saving of the MACs to u-boot-env during the installation was applied. c. Default Ralink ethernet MAC address (00:0C:43:28:80:A0) was found in "Factory" 0xfff0. It's the same for all MTS WG430223 devices. OEM firmware also uses this MAC when initialazes ethernet driver. In OpenWrt we use it only as internal GMAC (eth0), all other MACs are unique. Therefore, there is no any barriers to the operation of several MTS WG430223 devices even within the same broadcast domain. Stock firmware image format --------------------------- The same as Beeline Smartbox Flash but with another trx magic +--------------+---------------+----------------------------------------+ | Offset | | Description | +==============+===============+========================================+ | 0x0 | 31 52 48 53 | TRX magic "1RHS" | +--------------+---------------+----------------------------------------+ Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-05-04 15:16:38 +00:00
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := MTS
DEVICE_MODEL := WG430223
IMAGE_SIZE := 32768k
KERNEL_SIZE := 4352k
KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | \
uImage none | arcadyan-trx 0x53485231 | pad-to $$(KERNEL_SIZE)
KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | \
uImage none
IMAGES += factory.trx
IMAGE/factory.trx := append-kernel | append-ubi | check-size
DEVICE_PACKAGES := kmod-mt7615-firmware uencrypt-mbedtls
ramips: add support for MTS WG430223 MTS WG430223 is a wireless AC1300 (WiFi 5) router manufactured by Arcadyan company. It's very similar to Beeline Smartbox Flash (Arcadyan WG443223). Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 128 MiB Flash: 128 MiB (Winbond W29N01HV) Wireless 2.4 GHz (MT7615DN): b/g/n, 2x2 Wireless 5 GHz (MT7615DN): a/n/ac, 2x2 Ethernet: 3xGbE (WAN, LAN1, LAN2) USB ports: No Button: 1 (Reset/WPS) LEDs: 2 (Red, Green) Power: 12 VDC, 1 A Connector type: Barrel Bootloader: U-Boot (Ralink UBoot Version: 5.0.0.2) OEM: Arcadyan WG430223 Installation ------------ 1. Login to the router web interface (superadmin:serial number) 2. Navigate to Administration -> Miscellaneous -> Access control lists & enable telnet & enable "Remote control from any IP address" 3. Connect to the router using telnet (default admin:admin) 4. Place *factory.trx on any web server (192.168.1.2 in this example) 5. Connect to the router using telnet shell (no password required) 6. Save MAC adresses to U-Boot environment: uboot_env --set --name eth2macaddr --value $(ifconfig | grep eth2 | \ awk '{print $5}') uboot_env --set --name eth3macaddr --value $(ifconfig | grep eth3 | \ awk '{print $5}') uboot_env --set --name ra0macaddr --value $(ifconfig | grep ra0 | \ awk '{print $5}') uboot_env --set --name rax0macaddr --value $(ifconfig | grep rax0 | \ awk '{print $5}') 7. Ensure that MACs were saved correctly: uboot_env --get --name eth2macaddr uboot_env --get --name eth3macaddr uboot_env --get --name ra0macaddr uboot_env --get --name rax0macaddr 8. Download and write the OpenWrt images: cd /tmp wget http://192.168.1.2/factory.trx mtd_write erase /dev/mtd4 mtd_write write factory.trx /dev/mtd4 9. Set 1st boot partition and reboot: uboot_env --set --name bootpartition --value 0 Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv bootpartition 1 reboot 2. Optional step. Upgrade the stock firmware with any version to overwrite the OpenWrt in Slot 1. MAC addresses ------------- +-----------+-------------------+----------------+ | Interface | MAC | Source | +-----------+-------------------+----------------+ | label | A4:xx:xx:51:xx:F4 | No MACs was | | LAN | A4:xx:xx:51:xx:F6 | found on Flash | | WAN | A4:xx:xx:51:xx:F4 | [1] | | WLAN_2g | A4:xx:xx:51:xx:F5 | | | WLAN_5g | A6:xx:xx:21:xx:F5 | | +-----------+-------------------+----------------+ [1]: a. Label wasb't found neither in factory nor in other places. b. MAC addresses are stored in encrypted partition "glbcfg". Encryption key hasn't known yet. To ensure the correct MACs in OpenWrt, a hack with saving of the MACs to u-boot-env during the installation was applied. c. Default Ralink ethernet MAC address (00:0C:43:28:80:A0) was found in "Factory" 0xfff0. It's the same for all MTS WG430223 devices. OEM firmware also uses this MAC when initialazes ethernet driver. In OpenWrt we use it only as internal GMAC (eth0), all other MACs are unique. Therefore, there is no any barriers to the operation of several MTS WG430223 devices even within the same broadcast domain. Stock firmware image format --------------------------- The same as Beeline Smartbox Flash but with another trx magic +--------------+---------------+----------------------------------------+ | Offset | | Description | +==============+===============+========================================+ | 0x0 | 31 52 48 53 | TRX magic "1RHS" | +--------------+---------------+----------------------------------------+ Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-05-04 15:16:38 +00:00
endef
TARGET_DEVICES += mts_wg430223
define Device/netgear_ex6150
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := NETGEAR
DEVICE_MODEL := EX6150
DEVICE_PACKAGES := kmod-mt76x2 -uboot-envtools
NETGEAR_BOARD_ID := U12H318T00_NETGEAR
IMAGE_SIZE := 14848k
IMAGES += factory.chk
IMAGE/factory.chk := $$(sysupgrade_bin) | check-size | netgear-chk
endef
TARGET_DEVICES += netgear_ex6150
define Device/netgear_sercomm_nand
$(Device/nand)
$(Device/uimage-lzma-loader)
IMAGES += factory.img kernel.bin rootfs.bin
IMAGE/factory.img := pad-extra 2048k | append-kernel | pad-to 6144k | \
append-ubi | pad-to $$$$(BLOCKSIZE) | sercom-footer | pad-to 128 | \
zip $$$$(SERCOMM_HWNAME).bin | sercom-seal
ramips: add support for Netgear R6350 Netgear R6350 is a wireless router, aka Netgear AC1750. Specification: - SoC: Mediatek MT7621AT (2 CPU cores, 4 threads) - RAM: 128MiB (Nanya NT5CC64M16GP-DI) - ROM: 128MiB NAND Flash (Macronix MX30LF1G18AC-TI) - Wireless: for 11b/g/n (upto 300Mbps): MT7603 for 11a/ac (upto 1450Mbps) : MT7615, is not avaliable now - Ethernet LAN speed: up to 1000Mbps - Ethernet LAN ports: 4 - Ethernet WAN speed: up to 1000Mbps - Ethernet WAN ports: 1 - USB ports: 1 (USB 2.0) - LEDs: 4 (all can be controlled by SoC's GPIO) - buttons: 2 - serial ports: unknown Installation through telnet: - Copy kernel.bin and rootfs.bin to a USB flash disk, plug to usb port on the router. - Enable telnet with link: http://192.168.1.1/setup.cgi?todo=debug (login if required, default: admin password) - You will see "Debug Enabled!" - Telnet 192.168.1.1 and login with "root" - ls /mnt/shares/ to find out path of your USB disk. 'myUdisk' for example. - cd /mnt/shares/myUdisk - mtd_write write rootfs.bin Rootfs - mtd_write write kernel.bin Kernel - reboot recovery when bricked: nmrpflash can be used to recover to the netgear firmware if a broken image was flashed. The SC_PART_MAP partition suggests that an on flash partition table exists. After implementing a partition parser/builder for the sercom partition format, the definitions don't match the flash layout used by the stock firmware. It either means the partition format has not yet been completely understood or it isn't used by the stock firmware. For now, use fixed partitions instead. Signed-off-by: NOGUCHI Hiroshi <drvlabo@gmail.com> [apply latest ramips changes and document the on flash partition map issues] Signed-off-by: Mathias Kresin <dev@kresin.me>
2018-08-24 01:36:13 +00:00
IMAGE/kernel.bin := append-kernel
IMAGE/rootfs.bin := append-ubi | check-size
DEVICE_VENDOR := NETGEAR
DEVICE_PACKAGES := kmod-mt7603 kmod-usb3 kmod-usb-ledtrig-usbport \
-uboot-envtools
endef
define Device/netgear_r6220
$(Device/netgear_sercomm_nand)
DEVICE_MODEL := R6220
SERCOMM_HWNAME := R6220
SERCOMM_HWID := AYA
SERCOMM_HWVER := A001
SERCOMM_SWVER := 0x0086
IMAGE_SIZE := 28672k
DEVICE_PACKAGES += kmod-mt76x2
SUPPORTED_DEVICES += r6220
ramips: add support for Netgear R6350 Netgear R6350 is a wireless router, aka Netgear AC1750. Specification: - SoC: Mediatek MT7621AT (2 CPU cores, 4 threads) - RAM: 128MiB (Nanya NT5CC64M16GP-DI) - ROM: 128MiB NAND Flash (Macronix MX30LF1G18AC-TI) - Wireless: for 11b/g/n (upto 300Mbps): MT7603 for 11a/ac (upto 1450Mbps) : MT7615, is not avaliable now - Ethernet LAN speed: up to 1000Mbps - Ethernet LAN ports: 4 - Ethernet WAN speed: up to 1000Mbps - Ethernet WAN ports: 1 - USB ports: 1 (USB 2.0) - LEDs: 4 (all can be controlled by SoC's GPIO) - buttons: 2 - serial ports: unknown Installation through telnet: - Copy kernel.bin and rootfs.bin to a USB flash disk, plug to usb port on the router. - Enable telnet with link: http://192.168.1.1/setup.cgi?todo=debug (login if required, default: admin password) - You will see "Debug Enabled!" - Telnet 192.168.1.1 and login with "root" - ls /mnt/shares/ to find out path of your USB disk. 'myUdisk' for example. - cd /mnt/shares/myUdisk - mtd_write write rootfs.bin Rootfs - mtd_write write kernel.bin Kernel - reboot recovery when bricked: nmrpflash can be used to recover to the netgear firmware if a broken image was flashed. The SC_PART_MAP partition suggests that an on flash partition table exists. After implementing a partition parser/builder for the sercom partition format, the definitions don't match the flash layout used by the stock firmware. It either means the partition format has not yet been completely understood or it isn't used by the stock firmware. For now, use fixed partitions instead. Signed-off-by: NOGUCHI Hiroshi <drvlabo@gmail.com> [apply latest ramips changes and document the on flash partition map issues] Signed-off-by: Mathias Kresin <dev@kresin.me>
2018-08-24 01:36:13 +00:00
endef
TARGET_DEVICES += netgear_r6220
ramips: add support for Netgear R6350 Netgear R6350 is a wireless router, aka Netgear AC1750. Specification: - SoC: Mediatek MT7621AT (2 CPU cores, 4 threads) - RAM: 128MiB (Nanya NT5CC64M16GP-DI) - ROM: 128MiB NAND Flash (Macronix MX30LF1G18AC-TI) - Wireless: for 11b/g/n (upto 300Mbps): MT7603 for 11a/ac (upto 1450Mbps) : MT7615, is not avaliable now - Ethernet LAN speed: up to 1000Mbps - Ethernet LAN ports: 4 - Ethernet WAN speed: up to 1000Mbps - Ethernet WAN ports: 1 - USB ports: 1 (USB 2.0) - LEDs: 4 (all can be controlled by SoC's GPIO) - buttons: 2 - serial ports: unknown Installation through telnet: - Copy kernel.bin and rootfs.bin to a USB flash disk, plug to usb port on the router. - Enable telnet with link: http://192.168.1.1/setup.cgi?todo=debug (login if required, default: admin password) - You will see "Debug Enabled!" - Telnet 192.168.1.1 and login with "root" - ls /mnt/shares/ to find out path of your USB disk. 'myUdisk' for example. - cd /mnt/shares/myUdisk - mtd_write write rootfs.bin Rootfs - mtd_write write kernel.bin Kernel - reboot recovery when bricked: nmrpflash can be used to recover to the netgear firmware if a broken image was flashed. The SC_PART_MAP partition suggests that an on flash partition table exists. After implementing a partition parser/builder for the sercom partition format, the definitions don't match the flash layout used by the stock firmware. It either means the partition format has not yet been completely understood or it isn't used by the stock firmware. For now, use fixed partitions instead. Signed-off-by: NOGUCHI Hiroshi <drvlabo@gmail.com> [apply latest ramips changes and document the on flash partition map issues] Signed-off-by: Mathias Kresin <dev@kresin.me>
2018-08-24 01:36:13 +00:00
define Device/netgear_r6260
$(Device/netgear_sercomm_nand)
DEVICE_MODEL := R6260
SERCOMM_HWNAME := R6260
SERCOMM_HWID := CHJ
SERCOMM_HWVER := A001
SERCOMM_SWVER := 0x0052
IMAGE_SIZE := 40960k
DEVICE_PACKAGES += kmod-mt7615-firmware
endef
TARGET_DEVICES += netgear_r6260
define Device/netgear_r6350
$(Device/netgear_sercomm_nand)
DEVICE_MODEL := R6350
SERCOMM_HWNAME := R6350
SERCOMM_HWID := CHJ
SERCOMM_HWVER := A001
SERCOMM_SWVER := 0x0052
IMAGE_SIZE := 40960k
DEVICE_PACKAGES += kmod-mt7615-firmware
endef
TARGET_DEVICES += netgear_r6350
ramips: add support for MikroTik RouterBOARD RBM11g This commit adds support for the MikroTik RouterBOARD RBM11g. =Hardware= The RBM11g is a mt7621 based device featuring one GbE port and one miniPCIe slot with a sim card socket and USB 2.0. ==Switch== The single onboard Ethernet port is connected the CPU directly. The internal switch of the mt7621 SoC is disabled. ==Flash== The device has one spi nor flash chip. It is a 128 Mbit winbond 25Q128FVS connected to CS0. ==PCIe== The board features a single miniPCIe slot. It has a dedicated mini SIM socket and a USB 2.0 port. Power to the miniPCIe slot is controlled via GPIO9. ==USB== There are no external USB ports. ==Power== The board can accept both, passive PoE and external power via a 2.1 mm barrel jack (center-positive). The input voltage range is 11-32 V. ==Serial port== The device does have an onboard UART on an unpopulated header next to the flash chip: GND: pin 2 TX: pin 7 RX: pin 6 Settings: 115200, 8N1 See below illustration for positioning of the header. 0 = screw hole * = some pin T = TX pin R = RX pin G = GND pin Pinout: +--------------- |O | __ | / \ | \__/ | | | | +---+ | |RAM| | +--+ | | | |**| <- unpopulated header with UART | |*T| +---+ | |R*| +--------+ | |**| | | | |G*| | CPU | | +--+ | | | +--+ | | | | | +--------+ | +--+ <- flash chip |O | +-----+ | | | |+--+ | | || | | | +--------------------- =Installation= To install an OpenWRT image to the device two components must be built: 1. A openwrt initramfs image 2. A openwrt sysupgrade image ===initramfs & sysupgrade image=== Select target devices "Mikrotik RBM11G" in openwrt menuconfig and build the images. This will create the images "openwrt-ramips-mt7621-mikrotik_rbm11g-initramfs-kernel.bin" and "openwrt-ramips-mt7621-mikrotik_rbm11g-squashfs-sysupgrade.bin" in the output directory. ==Installing== **Make sure to back up your RouterOS license in case you do ever want to go back to RouterOS using "/system license output" and back up the created license file.** When rebooted the board will try booting via ethernet first. If your board does not boot via ethernet automatically you will have to attach to the serial port and set ethernet as boot device within RouterBOOT. 1. Set up a dhcp server that points the bootfile to tftp server serving the "openwrt-ramips-mt7621-mikrotik_rbm11g-initramfs-kernel.bin" initramfs image 2. Connect to ethernet port on board 3. Power on the board 4. Wait for OpenWrt to boot Right now OpenWrt will be running with a SSH server listening. Now OpenWrt must be flashed to the devices flash: 1. Copy "openwrt-ramips-mt7621-mikrotik_rbm11g-squashfs-sysupgrade.bin" to the device using scp. 2. Write openwrt to flash using "sysupgrade openwrt-ramips-mt7621-mikrotik_rbm11g-squashfs-sysupgrade.bin" Once the flashing completes the board will reboot. Disconnect from the devices ethernet port or stop the DHCP/TFTP server to prevent the device from booting via ethernet again. The device should now boot straight to OpenWrt. Signed-off-by: Tobias Schramm <tobleminer@gmail.com>
2018-06-25 20:51:43 +00:00
define Device/netgear_r6700-v2
$(Device/netgear_sercomm_nand)
DEVICE_MODEL := R6700
DEVICE_VARIANT := v2
DEVICE_ALT0_VENDOR := NETGEAR
DEVICE_ALT0_MODEL := Nighthawk AC2400
DEVICE_ALT0_VARIANT := v1
DEVICE_ALT1_VENDOR := NETGEAR
DEVICE_ALT1_MODEL := Nighthawk AC2100
DEVICE_ALT1_VARIANT := v1
SERCOMM_HWNAME := R6950
SERCOMM_HWID := BZV
SERCOMM_HWVER := A001
SERCOMM_SWVER := 0x1032
IMAGE_SIZE := 40960k
DEVICE_PACKAGES += kmod-mt7615-firmware
endef
TARGET_DEVICES += netgear_r6700-v2
define Device/netgear_r6800
$(Device/netgear_sercomm_nand)
DEVICE_MODEL := R6800
SERCOMM_HWNAME := R6950
SERCOMM_HWID := BZV
SERCOMM_HWVER := A001
SERCOMM_SWVER := 0x0062
IMAGE_SIZE := 40960k
DEVICE_PACKAGES += kmod-mt7615-firmware
endef
TARGET_DEVICES += netgear_r6800
define Device/netgear_r6850
$(Device/netgear_sercomm_nand)
DEVICE_MODEL := R6850
SERCOMM_HWNAME := R6850
SERCOMM_HWID := CHJ
SERCOMM_HWVER := A001
SERCOMM_SWVER := 0x0052
IMAGE_SIZE := 40960k
DEVICE_PACKAGES += kmod-mt7615-firmware
endef
TARGET_DEVICES += netgear_r6850
define Device/netgear_r6900-v2
$(Device/netgear_sercomm_nand)
DEVICE_MODEL := R6900
DEVICE_VARIANT := v2
SERCOMM_HWNAME := R6950
SERCOMM_HWID := BZV
SERCOMM_HWVER := A001
SERCOMM_SWVER := 0x1032
IMAGE_SIZE := 40960k
DEVICE_PACKAGES += kmod-mt7615-firmware
endef
TARGET_DEVICES += netgear_r6900-v2
define Device/netgear_r7200
$(Device/netgear_sercomm_nand)
DEVICE_MODEL := R7200
SERCOMM_HWNAME := R6950
SERCOMM_HWID := BZV
SERCOMM_HWVER := A001
SERCOMM_SWVER := 0x1032
IMAGE_SIZE := 40960k
DEVICE_PACKAGES += kmod-mt7615-firmware
endef
TARGET_DEVICES += netgear_r7200
define Device/netgear_r7450
$(Device/netgear_sercomm_nand)
DEVICE_MODEL := R7450
SERCOMM_HWNAME := R6950
SERCOMM_HWID := BZV
SERCOMM_HWVER := A001
SERCOMM_SWVER := 0x1032
IMAGE_SIZE := 40960k
DEVICE_PACKAGES += kmod-mt7615-firmware
endef
TARGET_DEVICES += netgear_r7450
define Device/netgear_wac104
$(Device/netgear_sercomm_nand)
DEVICE_MODEL := WAC104
SERCOMM_HWNAME := WAC104
SERCOMM_HWID := CAY
SERCOMM_HWVER := A001
SERCOMM_SWVER := 0x0006
IMAGE_SIZE := 28672k
DEVICE_PACKAGES += kmod-mt76x2
endef
TARGET_DEVICES += netgear_wac104
define Device/netgear_wac124
$(Device/netgear_sercomm_nand)
DEVICE_MODEL := WAC124
SERCOMM_HWNAME := WAC124
SERCOMM_HWID := CTL
SERCOMM_HWVER := A003
SERCOMM_SWVER := 0x0402
IMAGE_SIZE := 40960k
DEVICE_PACKAGES += kmod-mt7615-firmware
endef
TARGET_DEVICES += netgear_wac124
define Device/netgear_wax202
$(Device/nand)
DEVICE_VENDOR := NETGEAR
DEVICE_MODEL := WAX202
DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
NETGEAR_ENC_MODEL := WAX202
NETGEAR_ENC_REGION := US
IMAGE_SIZE := 38912k
KERNEL_LOADADDR := 0x82000000
KERNEL := kernel-bin | relocate-kernel 0x80001000 | lzma | \
fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb | \
append-squashfs4-fakeroot
IMAGES += factory.img
IMAGE/factory.img := append-kernel | pad-to $$(KERNEL_SIZE) | \
append-ubi | check-size | netgear-encrypted-factory
endef
TARGET_DEVICES += netgear_wax202
define Device/netgear_wndr3700-v5
$(Device/dsa-migration)
$(Device/netgear_sercomm_nor)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 15232k
DEVICE_MODEL := WNDR3700
DEVICE_VARIANT := v5
SERCOMM_HWNAME := WNDR3700v5
SERCOMM_HWID := AYB
SERCOMM_HWVER := A001
SERCOMM_SWVER := 0x1054
SERCOMM_PAD := 320k
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
SUPPORTED_DEVICES += wndr3700v5
ramips: add support for MTC Wireless Router WR1201 MTC Wireless Router WR1201 is the OEM name of the board. It is also sold rebranded as STRONG Dual Band Gigabit Router 1200. Specification: - SoC: MediaTek MT7621A (880 MHz) - Flash: 16 MiB - RAM: 128 MiB - Wireless: 2.4Ghz(MT7602EN) and 5Ghz (MT7612EN) - Ethernet speed: 10/100/1000 - Ethernet ports: 4+1 - 1x USB 3.0 - 1x microSD reader - Serial baud rate of Bootloader and factory firmware: 57600 The OEM webinterface writes only as much bytes as listed in the uImage header field to the flash. Also, the OEM webinterface evaluates the name field of uImage header before flashing (the string "WR1201_8_128") To flash via webinterface, is mandatory to use first initramfs.bin and after (from the OpenWrt) the sysupgrade.bin Some notes: - Some microSD will not work: mtk-sd 1e130000.sdhci: no support for card's volts mmc0: error -22 whilst initialising SDIO card mtk-sd 1e130000.sdhci: no support for card's volts mmc0: error -22 whilst initialising MMC card mtk-sd 1e130000.sdhci: no support for card's volts mmc0: error -22 whilst initialising SDIO card mtk-sd 1e130000.sdhci: card claims to support voltages below defined range mtk-sd 1e130000.sdhci: no support for card's volts mmc0: error -22 whilst initialising MMC card mtk-sd 1e130000.sdhci: no support for card's volts mmc0: error -22 whilst initialising SDIO card mtk-sd 1e130000.sdhci: no support for card's volts mmc0: error -22 whilst initialising MMC card Signed-off-by: Valentín Kivachuk <vk18496@gmail.com>
2018-11-29 23:13:53 +00:00
endef
TARGET_DEVICES += netgear_wndr3700-v5
ramips: add support for MTC Wireless Router WR1201 MTC Wireless Router WR1201 is the OEM name of the board. It is also sold rebranded as STRONG Dual Band Gigabit Router 1200. Specification: - SoC: MediaTek MT7621A (880 MHz) - Flash: 16 MiB - RAM: 128 MiB - Wireless: 2.4Ghz(MT7602EN) and 5Ghz (MT7612EN) - Ethernet speed: 10/100/1000 - Ethernet ports: 4+1 - 1x USB 3.0 - 1x microSD reader - Serial baud rate of Bootloader and factory firmware: 57600 The OEM webinterface writes only as much bytes as listed in the uImage header field to the flash. Also, the OEM webinterface evaluates the name field of uImage header before flashing (the string "WR1201_8_128") To flash via webinterface, is mandatory to use first initramfs.bin and after (from the OpenWrt) the sysupgrade.bin Some notes: - Some microSD will not work: mtk-sd 1e130000.sdhci: no support for card's volts mmc0: error -22 whilst initialising SDIO card mtk-sd 1e130000.sdhci: no support for card's volts mmc0: error -22 whilst initialising MMC card mtk-sd 1e130000.sdhci: no support for card's volts mmc0: error -22 whilst initialising SDIO card mtk-sd 1e130000.sdhci: card claims to support voltages below defined range mtk-sd 1e130000.sdhci: no support for card's volts mmc0: error -22 whilst initialising MMC card mtk-sd 1e130000.sdhci: no support for card's volts mmc0: error -22 whilst initialising SDIO card mtk-sd 1e130000.sdhci: no support for card's volts mmc0: error -22 whilst initialising MMC card Signed-off-by: Valentín Kivachuk <vk18496@gmail.com>
2018-11-29 23:13:53 +00:00
define Device/netis_wf2881
$(Device/nand)
$(Device/uimage-lzma-loader)
FILESYSTEMS := squashfs
IMAGE_SIZE := 129280k
UIMAGE_NAME := WF2881_0.0.00
KERNEL_INITRAMFS := $$(KERNEL) | netis-tail WF2881
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi | \
check-size
DEVICE_VENDOR := NETIS
DEVICE_MODEL := WF2881
DEVICE_PACKAGES := kmod-mt76x2 kmod-usb3 kmod-usb-ledtrig-usbport \
-uboot-envtools
endef
TARGET_DEVICES += netis_wf2881
ramips: add support for OrayBox X3A OrayBox X3A is a 2.4/5GHz dual band AC router, based on MediaTek MT7621. Specification: * SoC: MT7621 * RAM: DDR3 128 MiB * Flash: 16 MiB NOR (XM25Q128) * Wi-Fi: (single chip hosting both 2.4G and 5G) * 2.4GHz: MT7615 * 5GHz: MT7615 * Ethernet: 3x 1000Mbps * Switch: MT7530 * LED: * Ethernet LEDs: On the back of the router, hardware-controlled. * Status LEDs: One "pixel-like" RGB LED in the front of the router, which is actually made up of 3 individual LEDs (with dedicated GPIO pins) with the color of Red, Green, and Blue. The OEM firmware only lights up one color at a time to indicate status, but that's very boring, and the colors actually look great when combined, so I've improvised a little and made them indicate netdev activities. My test results: GPIO 13/14/15 000 white (actually more like bright green or cyan because the brightness of the green LED is higher than red and blue) 001 bright purple 010 bright green 011 red 100 bright cyan 101 blue 110 green 111 off Flash Layout: 0x0000000-0x0030000 : "u-boot" 0x0030000-0x0040000 : "u-boot-env" 0x0040000-0x0050000 : "factory" 0x0050000-0x0f50000 : "firmware" /*0x0f50000 to 0x0fe0000 is undefined, same as OEM firmware*/ 0x0fe0000-0x0ff0000 : "bdinfo" 0x0ff0000-0x1000000 : "reserve" MAC address: MAC Source Description Fix A0:CX:XX:BX:XX:0D BDINFO_9 LAN(LABEL) DTS A0:CX:XX:BX:XX:0E BDINFO_9 + 1 WAN DTS A2:CX:XX:BX:XX:0F FACTORY_4 WIFI2G DTS A2:CX:XX:CX:XX:0F SETBIT 7 (FACTORY_4 + 0x100000) WIFI5G HOTPLUG A6:CX:XX:BX:XX:0F N/A WIFI2G_CLIENT N/A A6:DX:XX:BX:XX:0F N/A WIFI5G_CLIENT N/A Stock dmesg: https://pastebin.com/2t2jwLdf Stock Dumps: https://pastebin.com/LDLxSWX3 Installation via SSH (does not void your warranty): 1. -----UNLOCK SSH----- 1.1 Set computer IP to DHCP mode, load 'http://10.168.1.1/cgi-bin/luci' in your browser. Password is 'admin'. 1.2 Click the "备份且导出" (backup and export) button, and download the config file. 1.3 Open the downloaded file with 7zip, navigate to '/etc/config/'. 1.4 Edit the file './system'. Change the '0' into '1' under "config sys 'ssh'". 1.5 Save the file. 1.6 Upload the file by clicking the "导入且恢复" (import and recover) button. The router will automatically reboot. 2. -----FLASH THE OPENWRT FIRMWARE----- 2.1 Use any scp tool to upload the 'sysupgrade' firmware to the '/tmp/' folder to your router. It should be root@10.168.1.1 and the password is 'admin'. 2.2 SSH into the router, also root@10.168.1.1 and the password is 'admin'. 2.3 **IMPORTANT** Type command 'dd if=/dev/mtd3 of=/tmp/firmware.bin', to backup the stock firmware. Since the OEM does not provide firmware download on their website, this is the only way to get it. 2.3 **ALSO IMPORTANT** Use any scp tool to download your backed-up stock firmware from '/tmp/' to your local drive. Then you'd better use a hex reading tool to have a rough look at it to make sure nothing is corrupt. Or u can just back up again and cross check the MD5. 2.4 Type command 'mtd write /tmp/XXX.bin firmware', and it should flash the firmware. 2.5 Verify that nothing went wrong. If you're confident, type 'reboot' and reboot the router. Revert to stock firmware: 1. load stock firmware using mtd (make sure u have a backup). Signed-off-by: Ray Wang <raywang777@foxmail.com>
2022-03-12 14:57:12 +00:00
define Device/oraybox_x3a
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 15360k
DEVICE_VENDOR := OrayBox
DEVICE_MODEL := X3A
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
ramips: add support for OrayBox X3A OrayBox X3A is a 2.4/5GHz dual band AC router, based on MediaTek MT7621. Specification: * SoC: MT7621 * RAM: DDR3 128 MiB * Flash: 16 MiB NOR (XM25Q128) * Wi-Fi: (single chip hosting both 2.4G and 5G) * 2.4GHz: MT7615 * 5GHz: MT7615 * Ethernet: 3x 1000Mbps * Switch: MT7530 * LED: * Ethernet LEDs: On the back of the router, hardware-controlled. * Status LEDs: One "pixel-like" RGB LED in the front of the router, which is actually made up of 3 individual LEDs (with dedicated GPIO pins) with the color of Red, Green, and Blue. The OEM firmware only lights up one color at a time to indicate status, but that's very boring, and the colors actually look great when combined, so I've improvised a little and made them indicate netdev activities. My test results: GPIO 13/14/15 000 white (actually more like bright green or cyan because the brightness of the green LED is higher than red and blue) 001 bright purple 010 bright green 011 red 100 bright cyan 101 blue 110 green 111 off Flash Layout: 0x0000000-0x0030000 : "u-boot" 0x0030000-0x0040000 : "u-boot-env" 0x0040000-0x0050000 : "factory" 0x0050000-0x0f50000 : "firmware" /*0x0f50000 to 0x0fe0000 is undefined, same as OEM firmware*/ 0x0fe0000-0x0ff0000 : "bdinfo" 0x0ff0000-0x1000000 : "reserve" MAC address: MAC Source Description Fix A0:CX:XX:BX:XX:0D BDINFO_9 LAN(LABEL) DTS A0:CX:XX:BX:XX:0E BDINFO_9 + 1 WAN DTS A2:CX:XX:BX:XX:0F FACTORY_4 WIFI2G DTS A2:CX:XX:CX:XX:0F SETBIT 7 (FACTORY_4 + 0x100000) WIFI5G HOTPLUG A6:CX:XX:BX:XX:0F N/A WIFI2G_CLIENT N/A A6:DX:XX:BX:XX:0F N/A WIFI5G_CLIENT N/A Stock dmesg: https://pastebin.com/2t2jwLdf Stock Dumps: https://pastebin.com/LDLxSWX3 Installation via SSH (does not void your warranty): 1. -----UNLOCK SSH----- 1.1 Set computer IP to DHCP mode, load 'http://10.168.1.1/cgi-bin/luci' in your browser. Password is 'admin'. 1.2 Click the "备份且导出" (backup and export) button, and download the config file. 1.3 Open the downloaded file with 7zip, navigate to '/etc/config/'. 1.4 Edit the file './system'. Change the '0' into '1' under "config sys 'ssh'". 1.5 Save the file. 1.6 Upload the file by clicking the "导入且恢复" (import and recover) button. The router will automatically reboot. 2. -----FLASH THE OPENWRT FIRMWARE----- 2.1 Use any scp tool to upload the 'sysupgrade' firmware to the '/tmp/' folder to your router. It should be root@10.168.1.1 and the password is 'admin'. 2.2 SSH into the router, also root@10.168.1.1 and the password is 'admin'. 2.3 **IMPORTANT** Type command 'dd if=/dev/mtd3 of=/tmp/firmware.bin', to backup the stock firmware. Since the OEM does not provide firmware download on their website, this is the only way to get it. 2.3 **ALSO IMPORTANT** Use any scp tool to download your backed-up stock firmware from '/tmp/' to your local drive. Then you'd better use a hex reading tool to have a rough look at it to make sure nothing is corrupt. Or u can just back up again and cross check the MD5. 2.4 Type command 'mtd write /tmp/XXX.bin firmware', and it should flash the firmware. 2.5 Verify that nothing went wrong. If you're confident, type 'reboot' and reboot the router. Revert to stock firmware: 1. load stock firmware using mtd (make sure u have a backup). Signed-off-by: Ray Wang <raywang777@foxmail.com>
2022-03-12 14:57:12 +00:00
endef
TARGET_DEVICES += oraybox_x3a
define Device/phicomm_k2p
$(Device/dsa-migration)
IMAGE_SIZE := 15744k
DEVICE_VENDOR := Phicomm
DEVICE_MODEL := K2P
DEVICE_ALT0_VENDOR := Phicomm
DEVICE_ALT0_MODEL := KE 2P
SUPPORTED_DEVICES += k2p
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
endef
TARGET_DEVICES += phicomm_k2p
define Device/planex_vr500
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
ramips/mt7621: fix IMAGE_SIZE for all devices This fixes IMAGE_SIZE for all devices based on the partition size given in DTS: DEVICE *.MK *.DTS VERDICT afoundry_ew1200 (16M) 0xfb0000 asiarf_ap7621-001 (16M) 0xfa0000 wrong buffalo_wsr-1166dhp (16M) 0xf90000 wrong buffalo_wsr-600dhp (16M) 0xfb0000 dlink_dir-860l-b1 (16M) 0xfb0000 d-team_newifi-d2 (32M) 0x1fb0000 d-team_pbr-m1 (16M) 0xfb0000 elecom_wrc-1167ghbk2-s 15488k 0xf20000 elecom_wrc-1900gst 11264k 0xb00000 elecom_wrc-2533gst 11264k 0xb00000 firefly_firewrt (16M) 0xfb0000 gehua_ghl-r-001 (32M) 0x1fb0000 gnubee_gb-pc1 (32M) 0x1fb0000 gnubee_gb-pc2 (32M) 0x1fb0000 hiwifi_hc5962 (32M) 0x2000000 wrong (kernel + ubi) iodata_wn-ax1167gr 15552k 0xf30000 iodata_wn-gx300gr 7798784 0x770000 lenovo_newifi-d1 (32M) 0x1fb0000 linksys_re6500 - 0x7b0000 default mediatek_ap-mt7621a-v60 (8M) 0x7b0000 mediatek_mt7621-eval-board (4M) 0xec0000 wrong (rootfs) mikrotik_rb750gr3 [16128k] 0xfc0000 mikrotik_rbm11g [16128k] 0xFC0000 mikrotik_rbm33g [16128k] 0xFC0000 mqmaker_witi-256m (16M) 0xfb0000 mqmaker_witi-512m (16M) 0xfb0000 mtc_wr1201 16000k 0xfa0000 netgear_ex6150 14848k 0xe80000 netgear_r6220 28672k 0x1c00000 netgear_r6350 40960k 0x2800000 netgear_wndr3700-v5 15232k 0xee0000 netis_wf-2881 129280k 0x7E40000 phicomm_k2p 15744k 0xf60000 planex_vr500 66453504 0x3fb0000 wrong samknows_whitebox-v8 (16M) 0xfb0000 storylink_sap-g3200u3 - 0x7b0000 default telco-electronics_x1 16064k 0xfb0000 thunder_timecloud - 0xfb0000 wrong totolink_a7000r 16064k 0xfb0000 tplink_re350-v1 6016k 0x5e0000 ubiquiti_edgerouterx - 0xfa00000 wrong (kernel1 + ubi) ubiquiti_edgerouterx-sfp - 0xfa00000 wrong (kernel1 + ubi) unielec_u7621-06-256m-16m 16064k 0xfb0000 unielec_u7621-06-512m-64m 65216k 0x3fb0000 wevo_11acnas (16M) 0xfb0000 wevo_w2914ns-v2 (16M) 0xfb0000 xiaomi_mir3g 32768k 0x7980000 wrong (kernel + ubi) xiaomi_mir3p (32M) 0xf980000 wrong (kernel + ubi) xzwifi_creativebox-v1 (32M) 0x1fb0000 youhua_wr1200js 16064k 0xfb0000 youku_yk-l2 (16M) 0xfb0000 zbtlink_zbt-we1326 (16M) 0xfb0000 zbtlink_zbt-we3526 (16M) 0xfb0000 zbtlink_zbt-wg2626 (16M) 0xfb0000 zbtlink_zbt-wg3526-16m (16M) 0xfb0000 zbtlink_zbt-wg3526-32m (32M) 0x1fb0000 No verdict means that the device is correctly set. Legend: ( ): Value is set via ralink_default_fw_size_xxM [ ]: Value is derived from parent definition - : Value is not set and derived from default definition Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-07-15 12:55:24 +00:00
IMAGE_SIZE := 65216k
DEVICE_VENDOR := Planex
DEVICE_MODEL := VR500
DEVICE_PACKAGES := kmod-usb3 -wpad-basic-mbedtls -uboot-envtools
SUPPORTED_DEVICES += vr500
endef
TARGET_DEVICES += planex_vr500
ramips: add support for RAISECOM MSG1500 X.00 RAISECOM MSG1500 X.00 is a 2.4/5 GHz band 11ac (Wi-Fi 5) router. Apart from the general model, there are two ISP customized models: China Mobile and China Telecom. Specifications: - SoC: Mediatek MT7621AT - RAM: 256MiB DDR3 - Flash: 128MiB NAND - Ethernet: 5 * 10/100/1000Mbps: 4 * LAN + 1 * WAN - Switch: MediaTek MT7530 (SoC) - WLAN: 1 * MT7615DN Dual-Band 2.4GHz 2T2R (400Mbps) 5GHz 2T2R (867Mbps) - USB: 1 * USB 2.0 port - Button: 1 * RESET button, 1 * WPS button, 1 * WIFI button - LED: blue color: POWER, WAN, WPS, 2.4G, 5G, LAN1, LAN2, LAN3, LAN4, USB - UART: 1 * serial port header (4-pin) - Power: DC 12V, 1A - Switch: 1 * POWER switch MAC addresses as verified by vendor firmware: use address source LAN C8:XX:XX:3A:XX:E7 Config "protest_lan_mac" ascii (label) WAN C8:XX:XX:3A:XX:EA Config "protest_wan_mac" ascii 5G C8:XX:XX:3A:XX:E8 Factory "0x4" hex 2.4G CA:XX:XX:4A:XX:E8 [not on flash] The increment of the 4th byte for the 2.4g address appears to vary. Reported cases: 5g 2.4g increment C8:XX:XX:90:XX:C3 CA:XX:XX:C0:XX:C3 0x30 C8:XX:XX:3A:XX:08 CA:XX:XX:4A:XX:08 0x10 C8:XX:XX:3A:XX:E8 CA:XX:XX:4A:XX:E8 0x10 Since increment is inconsistent and there is no obvious pattern in swapping bytes, and the 2.4g address has local bit set anyway, it seems safer to use the LAN address with flipped byte here in order to prevent collisions between OpenWrt devices and OEM devices for this interface. This way we at least use an address as base that is definitely owned by the device at hand. Notes: 1. The vendor firmware allows you to connect to the router by telnet. (known version 1.0.0 can open telnet.) There is no official binary firmware available. Backup the important partitions data: "Bootloader", "Config", "Factory", and "firmware". Note that with the vendor firmware the memory is detected only 128MiB and the last 512KiB in NAND flash is not used. 2. The POWER LED is default on after press POWER switch. The WAN and LAN1 - 4 LEDs are wired to ethernet switch. The WPS LED is controlled by MT7615DN's GPIO. Currently there is no proper way to configure it. 3. At the time of adding support the wireless config needs to be set up by editing the wireless config file: * Setting the country code is mandatory, otherwise the router loses connectivity at the next reboot. This is mandatory and can be done from luci. After setting the country code the router boots correctly. A reset with the reset button will fix the issue and the user has to reconfigure. * This is minor since the 5g interface does not come up online although it is not set as disabled. 2 options here: 1- Either run the "wifi" command. Can be added from LuCI in system - startup - local startup and just add wifi above "exit 0". 2- Or add the serialize option in the wireless config file as shown below. This one would work and bring both interfaces automatically at every boot: config wifi-device 'radio0' option serialize '1' config wifi-device 'radio1' option serialize '1' Flash instructions using initramfs image: 1. Press POWER switch to power down if the router is running. 2. Connect PC to one of LAN ports, and set static IP address to "10.10.10.2", netmask to "255.255.255.0", and gateway to "10.10.10.1" manually on the PC. 3. Push and hold the WIFI button, and then power up the router. After about 10s (or you can call the recovery page, see "4" below) you can release the WIFI button. There is no clear indication when the router is entering or has entered into "RAISECOM Router Recovery Mode". 4. Call the recovery page for the router at "http://10.10.10.1". Keep an eye on the "WARNING!! tip" of the recovery page. Click "Choose File" to select initramfs image, then click "Upload". 5. If image is uploaded successfully, you will see the page display "Device is upgrading the firmware... %". Keep an eye on the "WARNING!! tip" of the recovery page. When the page display "Upgrade Successfully", you can set IP address as "automatically obtain". 6. After the rebooting (PC should automatically obtain an IP address), open the SSH connection, then download the sysupgrade image to the router and perform sysupgrade with it. Flash back to vendor firmware: See "Flash instructions 1 - 5" above. The only difference is that in step 4 you should select the vendor firmware which you backup. Signed-off-by: Liangkuan Yang <ylk951207@gmail.com>
2021-08-11 07:47:22 +00:00
define Device/raisecom_msg1500-x-00
$(Device/nand)
ramips: add support for RAISECOM MSG1500 X.00 RAISECOM MSG1500 X.00 is a 2.4/5 GHz band 11ac (Wi-Fi 5) router. Apart from the general model, there are two ISP customized models: China Mobile and China Telecom. Specifications: - SoC: Mediatek MT7621AT - RAM: 256MiB DDR3 - Flash: 128MiB NAND - Ethernet: 5 * 10/100/1000Mbps: 4 * LAN + 1 * WAN - Switch: MediaTek MT7530 (SoC) - WLAN: 1 * MT7615DN Dual-Band 2.4GHz 2T2R (400Mbps) 5GHz 2T2R (867Mbps) - USB: 1 * USB 2.0 port - Button: 1 * RESET button, 1 * WPS button, 1 * WIFI button - LED: blue color: POWER, WAN, WPS, 2.4G, 5G, LAN1, LAN2, LAN3, LAN4, USB - UART: 1 * serial port header (4-pin) - Power: DC 12V, 1A - Switch: 1 * POWER switch MAC addresses as verified by vendor firmware: use address source LAN C8:XX:XX:3A:XX:E7 Config "protest_lan_mac" ascii (label) WAN C8:XX:XX:3A:XX:EA Config "protest_wan_mac" ascii 5G C8:XX:XX:3A:XX:E8 Factory "0x4" hex 2.4G CA:XX:XX:4A:XX:E8 [not on flash] The increment of the 4th byte for the 2.4g address appears to vary. Reported cases: 5g 2.4g increment C8:XX:XX:90:XX:C3 CA:XX:XX:C0:XX:C3 0x30 C8:XX:XX:3A:XX:08 CA:XX:XX:4A:XX:08 0x10 C8:XX:XX:3A:XX:E8 CA:XX:XX:4A:XX:E8 0x10 Since increment is inconsistent and there is no obvious pattern in swapping bytes, and the 2.4g address has local bit set anyway, it seems safer to use the LAN address with flipped byte here in order to prevent collisions between OpenWrt devices and OEM devices for this interface. This way we at least use an address as base that is definitely owned by the device at hand. Notes: 1. The vendor firmware allows you to connect to the router by telnet. (known version 1.0.0 can open telnet.) There is no official binary firmware available. Backup the important partitions data: "Bootloader", "Config", "Factory", and "firmware". Note that with the vendor firmware the memory is detected only 128MiB and the last 512KiB in NAND flash is not used. 2. The POWER LED is default on after press POWER switch. The WAN and LAN1 - 4 LEDs are wired to ethernet switch. The WPS LED is controlled by MT7615DN's GPIO. Currently there is no proper way to configure it. 3. At the time of adding support the wireless config needs to be set up by editing the wireless config file: * Setting the country code is mandatory, otherwise the router loses connectivity at the next reboot. This is mandatory and can be done from luci. After setting the country code the router boots correctly. A reset with the reset button will fix the issue and the user has to reconfigure. * This is minor since the 5g interface does not come up online although it is not set as disabled. 2 options here: 1- Either run the "wifi" command. Can be added from LuCI in system - startup - local startup and just add wifi above "exit 0". 2- Or add the serialize option in the wireless config file as shown below. This one would work and bring both interfaces automatically at every boot: config wifi-device 'radio0' option serialize '1' config wifi-device 'radio1' option serialize '1' Flash instructions using initramfs image: 1. Press POWER switch to power down if the router is running. 2. Connect PC to one of LAN ports, and set static IP address to "10.10.10.2", netmask to "255.255.255.0", and gateway to "10.10.10.1" manually on the PC. 3. Push and hold the WIFI button, and then power up the router. After about 10s (or you can call the recovery page, see "4" below) you can release the WIFI button. There is no clear indication when the router is entering or has entered into "RAISECOM Router Recovery Mode". 4. Call the recovery page for the router at "http://10.10.10.1". Keep an eye on the "WARNING!! tip" of the recovery page. Click "Choose File" to select initramfs image, then click "Upload". 5. If image is uploaded successfully, you will see the page display "Device is upgrading the firmware... %". Keep an eye on the "WARNING!! tip" of the recovery page. When the page display "Upgrade Successfully", you can set IP address as "automatically obtain". 6. After the rebooting (PC should automatically obtain an IP address), open the SSH connection, then download the sysupgrade image to the router and perform sysupgrade with it. Flash back to vendor firmware: See "Flash instructions 1 - 5" above. The only difference is that in step 4 you should select the vendor firmware which you backup. Signed-off-by: Liangkuan Yang <ylk951207@gmail.com>
2021-08-11 07:47:22 +00:00
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 129280k
DEVICE_VENDOR := RAISECOM
DEVICE_MODEL := MSG1500
DEVICE_VARIANT := X.00
DEVICE_ALT0_VENDOR := Nokia
DEVICE_ALT0_MODEL := A-040W-Q
DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 kmod-usb-ledtrig-usbport
ramips: add support for RAISECOM MSG1500 X.00 RAISECOM MSG1500 X.00 is a 2.4/5 GHz band 11ac (Wi-Fi 5) router. Apart from the general model, there are two ISP customized models: China Mobile and China Telecom. Specifications: - SoC: Mediatek MT7621AT - RAM: 256MiB DDR3 - Flash: 128MiB NAND - Ethernet: 5 * 10/100/1000Mbps: 4 * LAN + 1 * WAN - Switch: MediaTek MT7530 (SoC) - WLAN: 1 * MT7615DN Dual-Band 2.4GHz 2T2R (400Mbps) 5GHz 2T2R (867Mbps) - USB: 1 * USB 2.0 port - Button: 1 * RESET button, 1 * WPS button, 1 * WIFI button - LED: blue color: POWER, WAN, WPS, 2.4G, 5G, LAN1, LAN2, LAN3, LAN4, USB - UART: 1 * serial port header (4-pin) - Power: DC 12V, 1A - Switch: 1 * POWER switch MAC addresses as verified by vendor firmware: use address source LAN C8:XX:XX:3A:XX:E7 Config "protest_lan_mac" ascii (label) WAN C8:XX:XX:3A:XX:EA Config "protest_wan_mac" ascii 5G C8:XX:XX:3A:XX:E8 Factory "0x4" hex 2.4G CA:XX:XX:4A:XX:E8 [not on flash] The increment of the 4th byte for the 2.4g address appears to vary. Reported cases: 5g 2.4g increment C8:XX:XX:90:XX:C3 CA:XX:XX:C0:XX:C3 0x30 C8:XX:XX:3A:XX:08 CA:XX:XX:4A:XX:08 0x10 C8:XX:XX:3A:XX:E8 CA:XX:XX:4A:XX:E8 0x10 Since increment is inconsistent and there is no obvious pattern in swapping bytes, and the 2.4g address has local bit set anyway, it seems safer to use the LAN address with flipped byte here in order to prevent collisions between OpenWrt devices and OEM devices for this interface. This way we at least use an address as base that is definitely owned by the device at hand. Notes: 1. The vendor firmware allows you to connect to the router by telnet. (known version 1.0.0 can open telnet.) There is no official binary firmware available. Backup the important partitions data: "Bootloader", "Config", "Factory", and "firmware". Note that with the vendor firmware the memory is detected only 128MiB and the last 512KiB in NAND flash is not used. 2. The POWER LED is default on after press POWER switch. The WAN and LAN1 - 4 LEDs are wired to ethernet switch. The WPS LED is controlled by MT7615DN's GPIO. Currently there is no proper way to configure it. 3. At the time of adding support the wireless config needs to be set up by editing the wireless config file: * Setting the country code is mandatory, otherwise the router loses connectivity at the next reboot. This is mandatory and can be done from luci. After setting the country code the router boots correctly. A reset with the reset button will fix the issue and the user has to reconfigure. * This is minor since the 5g interface does not come up online although it is not set as disabled. 2 options here: 1- Either run the "wifi" command. Can be added from LuCI in system - startup - local startup and just add wifi above "exit 0". 2- Or add the serialize option in the wireless config file as shown below. This one would work and bring both interfaces automatically at every boot: config wifi-device 'radio0' option serialize '1' config wifi-device 'radio1' option serialize '1' Flash instructions using initramfs image: 1. Press POWER switch to power down if the router is running. 2. Connect PC to one of LAN ports, and set static IP address to "10.10.10.2", netmask to "255.255.255.0", and gateway to "10.10.10.1" manually on the PC. 3. Push and hold the WIFI button, and then power up the router. After about 10s (or you can call the recovery page, see "4" below) you can release the WIFI button. There is no clear indication when the router is entering or has entered into "RAISECOM Router Recovery Mode". 4. Call the recovery page for the router at "http://10.10.10.1". Keep an eye on the "WARNING!! tip" of the recovery page. Click "Choose File" to select initramfs image, then click "Upload". 5. If image is uploaded successfully, you will see the page display "Device is upgrading the firmware... %". Keep an eye on the "WARNING!! tip" of the recovery page. When the page display "Upgrade Successfully", you can set IP address as "automatically obtain". 6. After the rebooting (PC should automatically obtain an IP address), open the SSH connection, then download the sysupgrade image to the router and perform sysupgrade with it. Flash back to vendor firmware: See "Flash instructions 1 - 5" above. The only difference is that in step 4 you should select the vendor firmware which you backup. Signed-off-by: Liangkuan Yang <ylk951207@gmail.com>
2021-08-11 07:47:22 +00:00
endef
TARGET_DEVICES += raisecom_msg1500-x-00
define Device/renkforce_ws-wn530hp3-a
$(Device/dsa-migration)
DEVICE_VENDOR := Renkforce
DEVICE_MODEL := WS-WN530HP3-A
DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
-uboot-envtools
IMAGE/sysupgrade.bin := append-kernel | pad-to 65536 | append-rootfs | \
check-size | append-metadata
IMAGE_SIZE := 15040k
endef
TARGET_DEVICES += renkforce_ws-wn530hp3-a
ramips: add support for Rostelecom RT-SF-1 Rostelecom RT-SF-1 is a wireless WiFi 5 router manufactured by Sercomm company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB Flash: 256 MiB, Micron MT29F2G08ABAGA3W Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2 Wireless 5 GHz (MT7615E): a/n/ac, 4x4 Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1xUSB3.0 ZigBee: 3.0, EFR32 MG1B232GG Button: 2 buttons (Reset & WPS) LEDs: - 1x Status (RGB) - 1x 2.4G (blue, hardware, mt76-phy0) - 1x 5G (blue, hardware, mt76-phy1) Power: 12 VDC, 1.5 A Connector type: barrel Bootloader: U-Boot Installation ----------------- 1. Remove dots from the OpenWrt factory image filename 2. Login to the router web interface 3. Update firmware using web interface with the OpenWrt factory image 4. If OpenWrt is booted, then no further steps are required. Enjoy! Otherwise (Stock firmware has booted again) proceed to the next step. 5. Update firmware using web interface with any version of the Stock firmware 6. Update firmware using web interface with the OpenWrt factory image Revert to stock --------------- Change bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 Recovery -------- Use sercomm-recovery tool. Link: https://github.com/danitool/sercomm-recovery MAC Addresses ------------- +-----+------------+------------+ | use | address | example | +-----+------------+------------+ | LAN | label | *:72, *:d2 | | WAN | label + 11 | *:7d, *:dd | | 2g | label + 2 | *:74, *:d4 | | 5g | label + 3 | *:75, *:d5 | +-----+------------+------------+ The label MAC address was found in Factory 0x21000 Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-11-02 08:44:46 +00:00
define Device/rostelecom_rt-sf-1
$(Device/sercomm_dxx)
IMAGE_SIZE := 32768k
SERCOMM_HWID := DKG
SERCOMM_HWVER := 10110
SERCOMM_SWVER := 1026
DEVICE_VENDOR := Rostelecom
DEVICE_MODEL := RT-SF-1
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware kmod-usb3
ramips: add support for Rostelecom RT-SF-1 Rostelecom RT-SF-1 is a wireless WiFi 5 router manufactured by Sercomm company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB Flash: 256 MiB, Micron MT29F2G08ABAGA3W Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2 Wireless 5 GHz (MT7615E): a/n/ac, 4x4 Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1xUSB3.0 ZigBee: 3.0, EFR32 MG1B232GG Button: 2 buttons (Reset & WPS) LEDs: - 1x Status (RGB) - 1x 2.4G (blue, hardware, mt76-phy0) - 1x 5G (blue, hardware, mt76-phy1) Power: 12 VDC, 1.5 A Connector type: barrel Bootloader: U-Boot Installation ----------------- 1. Remove dots from the OpenWrt factory image filename 2. Login to the router web interface 3. Update firmware using web interface with the OpenWrt factory image 4. If OpenWrt is booted, then no further steps are required. Enjoy! Otherwise (Stock firmware has booted again) proceed to the next step. 5. Update firmware using web interface with any version of the Stock firmware 6. Update firmware using web interface with the OpenWrt factory image Revert to stock --------------- Change bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 Recovery -------- Use sercomm-recovery tool. Link: https://github.com/danitool/sercomm-recovery MAC Addresses ------------- +-----+------------+------------+ | use | address | example | +-----+------------+------------+ | LAN | label | *:72, *:d2 | | WAN | label + 11 | *:7d, *:dd | | 2g | label + 2 | *:74, *:d4 | | 5g | label + 3 | *:75, *:d5 | +-----+------------+------------+ The label MAC address was found in Factory 0x21000 Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-11-02 08:44:46 +00:00
endef
TARGET_DEVICES += rostelecom_rt-sf-1
define Device/samknows_whitebox-v8
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := SamKnows
DEVICE_MODEL := Whitebox 8
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport
SUPPORTED_DEVICES += sk-wb8
endef
TARGET_DEVICES += samknows_whitebox-v8
define Device/sercomm_na502
$(Device/nand)
IMAGE_SIZE := 20480k
DEVICE_VENDOR := SERCOMM
DEVICE_MODEL := NA502
DEVICE_PACKAGES := kmod-mt76x2 kmod-mt7603 kmod-usb3 -uboot-envtools
endef
TARGET_DEVICES += sercomm_na502
define Device/sercomm_na502s
$(Device/nand)
IMAGE_SIZE := 20971520
DEVICE_VENDOR := SERCOMM
DEVICE_MODEL := NA502S
DEVICE_PACKAGES := kmod-mt76x2 kmod-mt7603 kmod-usb3 kmod-usb-serial \
kmod-usb-serial-xr_usb_serial_common -uboot-envtools
endef
TARGET_DEVICES += sercomm_na502s
ramips: add support for SIM SIMAX1800T and Haier HAR-20S2U1 SIM AX18T and Haier HAR-20S2U1 Wi-Fi6 AX1800 routers are designed based on Tenbay WR1800K. They have the same hardware circuits and u-boot. SIM AX18T has three carrier customized models: SIMAX1800M (China Mobile), SIMAX1800T (China Telecom) and SIMAX1800U (China Unicom). All of these models run the same firmware. Specifications: SOC: MT7621 + MT7905 + MT7975 ROM: 128 MiB RAM: 256 MiB LED: status *3 R/G/B Button: reset *1 + wps/mesh *1 Ethernet: lan *3 + wan *1 (10/100/1000Mbps) TTL Baudrate: 115200 TFTP Server: 192.168.1.254 TFTP IP: 192.168.1.28 or 192.168.1.160 (when envs is broken) MAC Address: use address source label 30:xx:xx:xx:xx:62 wan lan 30:xx:xx:xx:xx:65 factory.0x8004 wan 30:xx:xx:xx:xx:62 factory.0x8004 -3 wlan2g 30:xx:xx:xx:xx:64 factory.0x0004 wlan5g 32:xx:xx:xx:xx:64 factory.0x0004 set 7th bit TFTP Installation (initramfs image only & recommend): 1. Set local tftp server IP: 192.168.1.254 and NetMask: 255.255.255.0 2. Rename initramfs-kernel.bin to "factory.bin" and put it in the root directory of the tftp server. (tftpd64 is a good choice for Windows) 3. Start the TFTP server, plug in the power supply, and wait for the system to boot. 4. Backup "firmware" partition and rename it to "firmware.bin", we need it to back to stock firmware. 5. Use "fw_printenv" command to list envs. If "firmware_select=2" is observed then set u-boot enviroment: /# fw_setenv firmware_select 1 6. Apply sysupgrade.bin in OpenWrt LuCI. Web UI Installation: 1. Apply update by uploading initramfs-factory.bin to the web UI. 2. Use "fw_printenv" command to list envs. If "firmware_select=2" is observed then set u-boot enviroment: /# fw_setenv firmware_select 1 3. Apply squashfs-sysupgrade.bin in OpenWrt LuCI. Recovery to stock firmware: a. Upload "firmware.bin" to OpenWrt /tmp, then execute: /# mtd -r write /tmp/firmware.bin firmware b. We can also write factory image "UploadBrush-bin.img" to firmware partition to recovery. Upload image file to /tmp, then execute: /# mtd erase firmware /# mtd -r write /tmp/UploadBrush-bin.img firmware How to extract stock firmware image: Download stock firmware, then use openssl: openssl aes-256-cbc -d -salt -in [Downloaded_Firmware] \ -out "firmware.tar.tgz" -k QiLunSmartWL Signed-off-by: Chen Minqiang <ptpt52@gmail.com> Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2022-09-15 17:10:52 +00:00
define Device/sim_simax1800t
$(Device/haier-sim_wr1800k)
DEVICE_VENDOR := SIM
DEVICE_MODEL := SIMAX1800T
endef
TARGET_DEVICES += sim_simax1800t
define Device/snr_snr-cpe-me1
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 15040k
DEVICE_VENDOR := SNR
DEVICE_MODEL := SNR-CPE-ME1
UIMAGE_NAME := SNR-CPE-ME1-5GHZ-MT
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x0e kmod-usb3 \
kmod-usb-ledtrig-usbport uboot-envtools
endef
TARGET_DEVICES += snr_snr-cpe-me1
define Device/snr_snr-cpe-me2-lite
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := SNR
DEVICE_MODEL := SNR-CPE-ME2-Lite
UIMAGE_NAME := $$(DEVICE_MODEL)
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
-uboot-envtools
endef
TARGET_DEVICES += snr_snr-cpe-me2-lite
define Device/snr_snr-cpe-me2-sfp
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := SNR
DEVICE_MODEL := SNR-CPE-ME2-SFP
UIMAGE_NAME := $$(DEVICE_MODEL)
DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 \
kmod-sfp kmod-usb-ledtrig-usbport uboot-envtools
endef
TARGET_DEVICES += snr_snr-cpe-me2-sfp
define Device/storylink_sap-g3200u3
$(Device/dsa-migration)
IMAGE_SIZE := 7872k
DEVICE_VENDOR := STORYLiNK
DEVICE_MODEL := SAP-G3200U3
DEVICE_PACKAGES := kmod-mt76x2 kmod-usb3 kmod-usb-ledtrig-usbport \
-uboot-envtools
SUPPORTED_DEVICES += sap-g3200u3
endef
TARGET_DEVICES += storylink_sap-g3200u3
define Device/telco-electronics_x1
$(Device/dsa-migration)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Telco Electronics
DEVICE_MODEL := X1
DEVICE_PACKAGES := kmod-usb3 kmod-mt76 -uboot-envtools
endef
TARGET_DEVICES += telco-electronics_x1
ramips: add support for Tenbay T-MB5EU-V01 Hardware -------- MediaTek MT7621 SoC 256M DDR3 16MB BoHong SPI-NOR MediaTek MT7905+7975 2x2T2R DBDC bgnax / acax RGB LED WPS + RESET Button UART on compute module (silkscreened / 115200n8) The router itself is just a board with Power / USB / RJ-45 connectors and DC/DC converters. The SoC and WiFi components are on a daughterboard which connect using two M.2 connectors. The compute module has the model number "T-CB1800K-DM2 V02" printed on it. The main baord has "T-MB5EU V01" printed on it. This information might be useful, as it's highly likely either of these two will be reused in similar designs. The router itself is sold as Tenbay T-MB5EU directly from the OEM as well as "KuWFI AX1800 Smart WiFi 6 Eouter" on Amazon.de for ~50€ in a slightly different case. Installation ------------ A Tool for creating a factory image for the Vendor Web Interface can be found here: https://github.com/blocktrron/t-mb5eu-v01-factory-creator/ As the OEM Firmware is just a modified LEDE 17.01, you can also access failsafe mode via UART while the OS boots, by connecting to UART and pressing "f" when prompted. The Router is reachable at 192.168.1.1 via root without password. Transfer the OpenWrt sysupgrade image via scp and apply with sysupgrade using the -n and -F flags. Alternatively, the board can be flashed by attaching to the UART console, interrupting the boot process by keeping "0" pressed while attaching power. Serve the OpenWrt initramfs using a TFTP server with address 192.168.1.66. Rename the initramfs to ax1800.bin. Attach your TFTP server to one of the LAN ports. Execute the following commands. $ setenv ipaddr 192.168.1.67 $ setenv serverip 192.168.1.66 $ tftpboot 0x84000000 ax1800.bin $ bootm Wait for the device to boot. Then transfer the OpenWrt sysupgrade image to the device using SCP and apply sysupgrade. Signed-off-by: David Bauer <mail@david-bauer.net>
2021-05-06 16:07:18 +00:00
define Device/tenbay_t-mb5eu-v01
$(Device/dsa-migration)
DEVICE_VENDOR := Tenbay
DEVICE_MODEL := T-MB5EU-V01
DEVICE_DTS_CONFIG := config@1
DEVICE_PACKAGES += kmod-mt7915-firmware kmod-usb3 -uboot-envtools
ramips: add support for Tenbay T-MB5EU-V01 Hardware -------- MediaTek MT7621 SoC 256M DDR3 16MB BoHong SPI-NOR MediaTek MT7905+7975 2x2T2R DBDC bgnax / acax RGB LED WPS + RESET Button UART on compute module (silkscreened / 115200n8) The router itself is just a board with Power / USB / RJ-45 connectors and DC/DC converters. The SoC and WiFi components are on a daughterboard which connect using two M.2 connectors. The compute module has the model number "T-CB1800K-DM2 V02" printed on it. The main baord has "T-MB5EU V01" printed on it. This information might be useful, as it's highly likely either of these two will be reused in similar designs. The router itself is sold as Tenbay T-MB5EU directly from the OEM as well as "KuWFI AX1800 Smart WiFi 6 Eouter" on Amazon.de for ~50€ in a slightly different case. Installation ------------ A Tool for creating a factory image for the Vendor Web Interface can be found here: https://github.com/blocktrron/t-mb5eu-v01-factory-creator/ As the OEM Firmware is just a modified LEDE 17.01, you can also access failsafe mode via UART while the OS boots, by connecting to UART and pressing "f" when prompted. The Router is reachable at 192.168.1.1 via root without password. Transfer the OpenWrt sysupgrade image via scp and apply with sysupgrade using the -n and -F flags. Alternatively, the board can be flashed by attaching to the UART console, interrupting the boot process by keeping "0" pressed while attaching power. Serve the OpenWrt initramfs using a TFTP server with address 192.168.1.66. Rename the initramfs to ax1800.bin. Attach your TFTP server to one of the LAN ports. Execute the following commands. $ setenv ipaddr 192.168.1.67 $ setenv serverip 192.168.1.66 $ tftpboot 0x84000000 ax1800.bin $ bootm Wait for the device to boot. Then transfer the OpenWrt sysupgrade image to the device using SCP and apply sysupgrade. Signed-off-by: David Bauer <mail@david-bauer.net>
2021-05-06 16:07:18 +00:00
KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
IMAGE_SIZE := 15808k
SUPPORTED_DEVICES += mt7621-dm2-t-mb5eu-v01-nor
endef
TARGET_DEVICES += tenbay_t-mb5eu-v01
define Device/thunder_timecloud
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Thunder
DEVICE_MODEL := Timecloud
DEVICE_PACKAGES := kmod-usb3 -wpad-basic-mbedtls -uboot-envtools
SUPPORTED_DEVICES += timecloud
endef
TARGET_DEVICES += thunder_timecloud
define Device/totolink_a7000r
$(Device/dsa-migration)
IMAGE_SIZE := 16064k
UIMAGE_NAME := C8340R1C-9999
DEVICE_VENDOR := TOTOLINK
DEVICE_MODEL := A7000R
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
endef
TARGET_DEVICES += totolink_a7000r
define Device/totolink_x5000r
$(Device/dsa-migration)
IMAGE_SIZE := 16064k
UIMAGE_NAME := C8343R-9999
DEVICE_VENDOR := TOTOLINK
DEVICE_MODEL := X5000R
DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
endef
TARGET_DEVICES += totolink_x5000r
define Device/tozed_zlt-s12-pro
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := TOZED
DEVICE_MODEL := ZLT S12 PRO
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 comgt-ncm -uboot-envtools
endef
TARGET_DEVICES += tozed_zlt-s12-pro
define Device/tplink_archer-ax23-v1
$(Device/dsa-migration)
$(Device/tplink-safeloader)
DEVICE_MODEL := Archer AX23
DEVICE_VARIANT := v1
DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
TPLINK_BOARD_ID := ARCHER-AX23-V1
KERNEL := $(KERNEL_DTB) | uImage lzma
IMAGE_SIZE := 15744k
endef
TARGET_DEVICES += tplink_archer-ax23-v1
ramips: add support for TP-Link Archer A6 v3 The patch adds support for the TP-Link Archer A6 v3 The router is sold in US and India with FCC ID TE7A6V3 Specification ------------- MediaTek MT7621 SOC RAM: 128MB DDR3 SPI Flash: W25Q128 (16MB) Ethernet: MT7530 5x 1000Base-T WiFi 5GHz: Mediatek MT7613BE WiFi 2.4GHz: Mediatek MT7603E UART/Serial: 115200 8n1 Device Configuration & Serial Port Pins --------------------------------------- ETH Ports: LAN4 LAN3 LAN2 LAN1 WAN _______________________ | | Serial Pins: | VCC GND TXD RXD | |_____________________| LEDs: Power Wifi2G Wifi5G LAN WAN Build Output ------------ The build will generate following set of files [1] openwrt-ramips-mt7621-tplink_archer-a6-v3-initramfs-kernel.bin [2] openwrt-ramips-mt7621-tplink_archer-a6-v3-squashfs-factory.bin [3] openwrt-ramips-mt7621-tplink_archer-a6-v3-squashfs-sysupgrade.bin How to Use - Flashing from TP-Link Web Interface ------------------------------------------------ * Go to "Advanced/System Tools/Firmware Update". * Click "Browse" and upload the OpenWrt factory image: factory.bin[2] * Click the "Upgrade" button, and select "Yes" when prompted. TFTP Booting ------------ Setup a TFTP boot server with address 192.168.0.5. While starting U-boot press '4' key to stop autoboot. Copy the initramfs-kernel.bin[1] to TFTP server folder, rename as test.bin From u-boot command prompt run tftpboot followed by bootm. Recovery -------- Archer A6 V3 has recovery page activated if SPI booting from flash fails. Recovery page can be activated from serial console only. Press 'x' while u-boot is starting Note: TFTP boot can be activated only from u-boot serial console. Device recovery address: 192.168.0.1 Thanks to: Frankis for Randmon MAC address fix. Signed-off-by: Vinay Patil <post2vinay@gmail.com> [remove superfluous factory image definition, whitespacing] Signed-off-by: David Bauer <mail@david-bauer.net>
2021-04-19 01:22:51 +00:00
define Device/tplink_archer-a6-v3
$(Device/dsa-migration)
$(Device/tplink-safeloader)
DEVICE_MODEL := Archer A6
DEVICE_VARIANT := V3
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e \
kmod-mt7663-firmware-ap -uboot-envtools
ramips: add support for TP-Link Archer A6 v3 The patch adds support for the TP-Link Archer A6 v3 The router is sold in US and India with FCC ID TE7A6V3 Specification ------------- MediaTek MT7621 SOC RAM: 128MB DDR3 SPI Flash: W25Q128 (16MB) Ethernet: MT7530 5x 1000Base-T WiFi 5GHz: Mediatek MT7613BE WiFi 2.4GHz: Mediatek MT7603E UART/Serial: 115200 8n1 Device Configuration & Serial Port Pins --------------------------------------- ETH Ports: LAN4 LAN3 LAN2 LAN1 WAN _______________________ | | Serial Pins: | VCC GND TXD RXD | |_____________________| LEDs: Power Wifi2G Wifi5G LAN WAN Build Output ------------ The build will generate following set of files [1] openwrt-ramips-mt7621-tplink_archer-a6-v3-initramfs-kernel.bin [2] openwrt-ramips-mt7621-tplink_archer-a6-v3-squashfs-factory.bin [3] openwrt-ramips-mt7621-tplink_archer-a6-v3-squashfs-sysupgrade.bin How to Use - Flashing from TP-Link Web Interface ------------------------------------------------ * Go to "Advanced/System Tools/Firmware Update". * Click "Browse" and upload the OpenWrt factory image: factory.bin[2] * Click the "Upgrade" button, and select "Yes" when prompted. TFTP Booting ------------ Setup a TFTP boot server with address 192.168.0.5. While starting U-boot press '4' key to stop autoboot. Copy the initramfs-kernel.bin[1] to TFTP server folder, rename as test.bin From u-boot command prompt run tftpboot followed by bootm. Recovery -------- Archer A6 V3 has recovery page activated if SPI booting from flash fails. Recovery page can be activated from serial console only. Press 'x' while u-boot is starting Note: TFTP boot can be activated only from u-boot serial console. Device recovery address: 192.168.0.1 Thanks to: Frankis for Randmon MAC address fix. Signed-off-by: Vinay Patil <post2vinay@gmail.com> [remove superfluous factory image definition, whitespacing] Signed-off-by: David Bauer <mail@david-bauer.net>
2021-04-19 01:22:51 +00:00
TPLINK_BOARD_ID := ARCHER-A6-V3
KERNEL := $(KERNEL_DTB) | uImage lzma
IMAGE_SIZE := 15744k
endef
TARGET_DEVICES += tplink_archer-a6-v3
ramips: add support for TP-Link Archer C6 v3 The patch adds support for the TP-Link Archer C6 v3 (FCC ID TE7A6V3) The patch adds identification changes to the existing TP-Link Archer A6, by Vinay Patil <post2vinay@gmail.com>, which has identical hardware. Specification ------------- MediaTek MT7621 SOC RAM: 128MB DDR3 SPI Flash: W25Q128 (16MB) Ethernet: MT7530 5x 1000Base-T WiFi 5GHz: Mediatek MT7613BE WiFi 2.4GHz: Mediatek MT7603E UART/Serial: 115200 8n1 Device Configuration & Serial Port Pins --------------------------------------- ETH Ports: LAN4 LAN3 LAN2 LAN1 WAN _______________________ | | Serial Pins: | VCC GND TXD RXD | |_____________________| LEDs: Power Wifi2G Wifi5G LAN WAN Build Output ------------ The build will generate following set of files [1] openwrt-ramips-mt7621-tplink_archer-c6-v3-initramfs-kernel.bin [2] openwrt-ramips-mt7621-tplink_archer-c6-v3-squashfs-factory.bin [3] openwrt-ramips-mt7621-tplink_archer-c6-v3-squashfs-sysupgrade.bin How to Use - Flashing from TP-Link Web Interface ------------------------------------------------ * Go to "Advanced/System Tools/Firmware Update". * Click "Browse" and upload the OpenWrt factory image: factory.bin[2] * Click the "Upgrade" button, and select "Yes" when prompted. TFTP Booting ------------ Setup a TFTP boot server with address 192.168.0.5. While starting U-boot press '4' key to stop autoboot. Copy the initramfs-kernel.bin[1] to TFTP server folder, rename as test.bin From u-boot command prompt run tftpboot followed by bootm. Recovery -------- Archer A6 V3 has recovery page activated if SPI booting from flash fails. Recovery page can be activated by powercycling the router four times before the boot process is complete. Note: TFTP boot can be activated only from u-boot serial console. Device recovery address: 192.168.0.1 Signed-off-by: Amish Vishwakarma <vishwakarma.amish@gmail.com> [fix indent] Signed-off-by: David Bauer <mail@david-bauer.net>
2021-06-05 07:01:00 +00:00
define Device/tplink_archer-c6-v3
$(Device/dsa-migration)
$(Device/tplink-safeloader)
DEVICE_MODEL := Archer C6
DEVICE_VARIANT := V3
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
-uboot-envtools
ramips: add support for TP-Link Archer C6 v3 The patch adds support for the TP-Link Archer C6 v3 (FCC ID TE7A6V3) The patch adds identification changes to the existing TP-Link Archer A6, by Vinay Patil <post2vinay@gmail.com>, which has identical hardware. Specification ------------- MediaTek MT7621 SOC RAM: 128MB DDR3 SPI Flash: W25Q128 (16MB) Ethernet: MT7530 5x 1000Base-T WiFi 5GHz: Mediatek MT7613BE WiFi 2.4GHz: Mediatek MT7603E UART/Serial: 115200 8n1 Device Configuration & Serial Port Pins --------------------------------------- ETH Ports: LAN4 LAN3 LAN2 LAN1 WAN _______________________ | | Serial Pins: | VCC GND TXD RXD | |_____________________| LEDs: Power Wifi2G Wifi5G LAN WAN Build Output ------------ The build will generate following set of files [1] openwrt-ramips-mt7621-tplink_archer-c6-v3-initramfs-kernel.bin [2] openwrt-ramips-mt7621-tplink_archer-c6-v3-squashfs-factory.bin [3] openwrt-ramips-mt7621-tplink_archer-c6-v3-squashfs-sysupgrade.bin How to Use - Flashing from TP-Link Web Interface ------------------------------------------------ * Go to "Advanced/System Tools/Firmware Update". * Click "Browse" and upload the OpenWrt factory image: factory.bin[2] * Click the "Upgrade" button, and select "Yes" when prompted. TFTP Booting ------------ Setup a TFTP boot server with address 192.168.0.5. While starting U-boot press '4' key to stop autoboot. Copy the initramfs-kernel.bin[1] to TFTP server folder, rename as test.bin From u-boot command prompt run tftpboot followed by bootm. Recovery -------- Archer A6 V3 has recovery page activated if SPI booting from flash fails. Recovery page can be activated by powercycling the router four times before the boot process is complete. Note: TFTP boot can be activated only from u-boot serial console. Device recovery address: 192.168.0.1 Signed-off-by: Amish Vishwakarma <vishwakarma.amish@gmail.com> [fix indent] Signed-off-by: David Bauer <mail@david-bauer.net>
2021-06-05 07:01:00 +00:00
TPLINK_BOARD_ID := ARCHER-C6-V3
KERNEL := $(KERNEL_DTB) | uImage lzma
IMAGE_SIZE := 15744k
endef
TARGET_DEVICES += tplink_archer-c6-v3
ramips: add support for TP-Link Archer C6U v1 (EU) This patch adds support for TP-Link Archer C6U v1 (EU). The device is also known in some market as Archer C6 v3. This patch supports only Archer C6U v1 (EU). Specifications: -------------- * SoC: Mediatek MT7621AT 2C2T, 880MHz * RAM: 128MB DDR3 * Flash: 16MB SPI NOR flash (Winbond 25Q128) * WiFi 5GHz: Mediatek MT7613BEN (2x2:2) * WiFi 2.4GHz: Mediatek MT7603EN (2x2:2) * Ethernet: MT7630, 5x 1000Base-T. * LED: Power, WAN, LAN, WiFi 2GHz and 5GHz, USB * Buttons: Reset, WPS. * UART: Serial console (115200 8n1), J1(GND:3) * USB: One USB2 port. Installation: ------------ Install the OpenWrt factory image for C6U is from the TP-Link web interface. 1) Go to "Advanced/System Tools/Firmware Update". 2) Click "Browse" and upload the OpenWrt factory image: openwrt-ramips-mt7621-tplink_archer-c6u-v1-squashfs-factory.bin. 3) Click the "Upgrade" button, and select "Yes" when prompted. Recovery to stock firmware: -------------------------- The C6U bootloader has a failsafe mode that provides a web interface (running at 192.168.0.1) for reverting back to the stock TP-Link firmware. The failsafe interface is triggered from the serial console or on failed kernel boot. Unfortunately, there's no key combination that enables the failsafe mode. This gives us two options for recovery: 1) Recover using the serial console (J1 header). The recovery interface can be selected by hitting 'x' when prompted on boot. 2) Trigger the bootloader failsafe mode. A more dangerous option is force the bootloader into recovery mode by erasing the OpenWrt partition from the OpenWrt's shell - e.g "mtd erase firmware". Please be careful, since erasing the wrong partition can brick your device. MAC addresses: ------------- OEM firmware configuration: D8:07:B6:xx:xx:83 : 5G D8:07:B6:xx:xx:84 : LAN (label) D8:07:B6:xx:xx:84 : 2.4G D8:07:B6:xx:xx:85 : WAN Signed-off-by: Georgi Vlaev <georgi.vlaev@konsulko.com>
2020-07-31 11:02:21 +00:00
define Device/tplink_archer-c6u-v1
$(Device/dsa-migration)
$(Device/tplink-safeloader)
DEVICE_MODEL := Archer C6U
DEVICE_VARIANT := v1
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
kmod-usb3 kmod-usb-ledtrig-usbport -uboot-envtools
ramips: add support for TP-Link Archer C6U v1 (EU) This patch adds support for TP-Link Archer C6U v1 (EU). The device is also known in some market as Archer C6 v3. This patch supports only Archer C6U v1 (EU). Specifications: -------------- * SoC: Mediatek MT7621AT 2C2T, 880MHz * RAM: 128MB DDR3 * Flash: 16MB SPI NOR flash (Winbond 25Q128) * WiFi 5GHz: Mediatek MT7613BEN (2x2:2) * WiFi 2.4GHz: Mediatek MT7603EN (2x2:2) * Ethernet: MT7630, 5x 1000Base-T. * LED: Power, WAN, LAN, WiFi 2GHz and 5GHz, USB * Buttons: Reset, WPS. * UART: Serial console (115200 8n1), J1(GND:3) * USB: One USB2 port. Installation: ------------ Install the OpenWrt factory image for C6U is from the TP-Link web interface. 1) Go to "Advanced/System Tools/Firmware Update". 2) Click "Browse" and upload the OpenWrt factory image: openwrt-ramips-mt7621-tplink_archer-c6u-v1-squashfs-factory.bin. 3) Click the "Upgrade" button, and select "Yes" when prompted. Recovery to stock firmware: -------------------------- The C6U bootloader has a failsafe mode that provides a web interface (running at 192.168.0.1) for reverting back to the stock TP-Link firmware. The failsafe interface is triggered from the serial console or on failed kernel boot. Unfortunately, there's no key combination that enables the failsafe mode. This gives us two options for recovery: 1) Recover using the serial console (J1 header). The recovery interface can be selected by hitting 'x' when prompted on boot. 2) Trigger the bootloader failsafe mode. A more dangerous option is force the bootloader into recovery mode by erasing the OpenWrt partition from the OpenWrt's shell - e.g "mtd erase firmware". Please be careful, since erasing the wrong partition can brick your device. MAC addresses: ------------- OEM firmware configuration: D8:07:B6:xx:xx:83 : 5G D8:07:B6:xx:xx:84 : LAN (label) D8:07:B6:xx:xx:84 : 2.4G D8:07:B6:xx:xx:85 : WAN Signed-off-by: Georgi Vlaev <georgi.vlaev@konsulko.com>
2020-07-31 11:02:21 +00:00
KERNEL := $(KERNEL_DTB) | uImage lzma
TPLINK_BOARD_ID := ARCHER-C6U-V1
IMAGE_SIZE := 15744k
endef
TARGET_DEVICES += tplink_archer-c6u-v1
define Device/tplink_deco-m4r-v4
$(Device/dsa-migration)
$(Device/tplink-safeloader)
DEVICE_MODEL := Deco M4R
DEVICE_VARIANT := v4
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
-uboot-envtools
KERNEL := $(KERNEL_DTB) | uImage lzma
TPLINK_BOARD_ID := DECO-M4R-V4
IMAGE_SIZE := 15744k
endef
TARGET_DEVICES += tplink_deco-m4r-v4
ramips: mt7621: add TP-Link EAP235-Wall support The TP-Link EAP235-Wall is a wall-mounted, PoE-powered AC1200 access point with four gigabit ethernet ports. When connecting to the device's serial port, it is strongly advised to use an isolated UART adapter. This prevents linking different power domains created by the PoE power supply, which may damage your devices. The device's U-Boot supports saving modified environments with `saveenv`. However, there is no u-boot-env partition, and saving modifications will cause the partition table to be overwritten. This is not an issue for running OpenWrt, but will prevent the vendor FW from functioning properly. Device specifications: * SoC: MT7621DAT * RAM: 128MiB * Flash: 16MiB SPI-NOR * Wireless 2.4GHz (MT7603EN): b/g/n, 2x2 * Wireless 5GHz (MT7613BEN): a/n/ac, 2x2 * Ethernet: 4× GbE * Back side: ETH0, PoE PD port * Bottom side: ETH1, ETH2, ETH3 * Single white device LED * LED button, reset button (available for failsafe) * PoE pass-through on port ETH3 (enabled with GPIO) Datasheet of the flash chip specifies a maximum frequency of 33MHz, but that didn't work. 20MHz gives no errors with reading (flash dump) or writing (sysupgrade). Device mac addresses: Stock firmware uses the same MAC address for ethernet (on device label) and 2.4GHz wireless. The 5GHz wireless address is incremented by one. This address is stored in the 'info' ('default-mac') partition at an offset of 8 bytes. From OEM ifconfig: eth a4:2b:b0:...:88 ra0 a4:2b:b0:...:88 rai0 a4:2b:b0:...:89 Flashing instructions: * Enable SSH in the web interface, and SSH into the target device * run `cliclientd stopcs`, this should return "success" * upload the factory image via the web interface Debricking: U-boot can be interrupted during boot, serial console is 57600 baud, 8n1 This allows installing a sysupgrade image, or fixing the device in another way. * Access serial header from the side of the board, close to ETH3, pin-out is (1:TX, 2:RX, 3:GND, 4:3.3V), with pin 1 closest to ETH3. * Interrupt bootloader by holding '4' during boot, which drops the bootloader into its shell * Change default 'serverip' and 'ipaddr' variables (optional) * Download initramfs with `tftpboot`, and boot image with `bootm` # tftpboot 84000000 openwrt-initramfs.bin # bootm Revert to stock: Using the tplink-safeloader utility from the firmware-utils package, TP-Link's firmware image can be converted to an OpenWrt-compatible sysupgrade image: $ ./staging_dir/host/bin/tplink-safeloader -B EAP235-WALL-V1 \ -z EAP235-WALLv1_XXX_up_signed.bin -o eap235-sysupgrade.bin This can then be flashed using the OpenWrt sysupgrade interface. The image will appear to be incompatible and must be force flashed, without keeping the current configuration. Known issues: - DFS support is incomplete (known issue with MT7613) - MT7613 radio may stop responding when idling, reboot required. This was an issue with the ddc75ff704 version of mt76, but appears to have improved/disappeared with bc3963764d. Error notice example: [ 7099.554067] mt7615e 0000:02:00.0: Message 73 (seq 1) timeout Hardware was kindly provided for porting by Stijn Segers. Tested-by: Stijn Segers <foss@volatilesystems.org> Signed-off-by: Sander Vanheule <sander@svanheule.net>
2021-02-18 19:52:53 +00:00
define Device/tplink_eap235-wall-v1
$(Device/dsa-migration)
$(Device/tplink-safeloader)
DEVICE_MODEL := EAP235-Wall
DEVICE_VARIANT := v1
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
-uboot-envtools
ramips: mt7621: add TP-Link EAP235-Wall support The TP-Link EAP235-Wall is a wall-mounted, PoE-powered AC1200 access point with four gigabit ethernet ports. When connecting to the device's serial port, it is strongly advised to use an isolated UART adapter. This prevents linking different power domains created by the PoE power supply, which may damage your devices. The device's U-Boot supports saving modified environments with `saveenv`. However, there is no u-boot-env partition, and saving modifications will cause the partition table to be overwritten. This is not an issue for running OpenWrt, but will prevent the vendor FW from functioning properly. Device specifications: * SoC: MT7621DAT * RAM: 128MiB * Flash: 16MiB SPI-NOR * Wireless 2.4GHz (MT7603EN): b/g/n, 2x2 * Wireless 5GHz (MT7613BEN): a/n/ac, 2x2 * Ethernet: 4× GbE * Back side: ETH0, PoE PD port * Bottom side: ETH1, ETH2, ETH3 * Single white device LED * LED button, reset button (available for failsafe) * PoE pass-through on port ETH3 (enabled with GPIO) Datasheet of the flash chip specifies a maximum frequency of 33MHz, but that didn't work. 20MHz gives no errors with reading (flash dump) or writing (sysupgrade). Device mac addresses: Stock firmware uses the same MAC address for ethernet (on device label) and 2.4GHz wireless. The 5GHz wireless address is incremented by one. This address is stored in the 'info' ('default-mac') partition at an offset of 8 bytes. From OEM ifconfig: eth a4:2b:b0:...:88 ra0 a4:2b:b0:...:88 rai0 a4:2b:b0:...:89 Flashing instructions: * Enable SSH in the web interface, and SSH into the target device * run `cliclientd stopcs`, this should return "success" * upload the factory image via the web interface Debricking: U-boot can be interrupted during boot, serial console is 57600 baud, 8n1 This allows installing a sysupgrade image, or fixing the device in another way. * Access serial header from the side of the board, close to ETH3, pin-out is (1:TX, 2:RX, 3:GND, 4:3.3V), with pin 1 closest to ETH3. * Interrupt bootloader by holding '4' during boot, which drops the bootloader into its shell * Change default 'serverip' and 'ipaddr' variables (optional) * Download initramfs with `tftpboot`, and boot image with `bootm` # tftpboot 84000000 openwrt-initramfs.bin # bootm Revert to stock: Using the tplink-safeloader utility from the firmware-utils package, TP-Link's firmware image can be converted to an OpenWrt-compatible sysupgrade image: $ ./staging_dir/host/bin/tplink-safeloader -B EAP235-WALL-V1 \ -z EAP235-WALLv1_XXX_up_signed.bin -o eap235-sysupgrade.bin This can then be flashed using the OpenWrt sysupgrade interface. The image will appear to be incompatible and must be force flashed, without keeping the current configuration. Known issues: - DFS support is incomplete (known issue with MT7613) - MT7613 radio may stop responding when idling, reboot required. This was an issue with the ddc75ff704 version of mt76, but appears to have improved/disappeared with bc3963764d. Error notice example: [ 7099.554067] mt7615e 0000:02:00.0: Message 73 (seq 1) timeout Hardware was kindly provided for porting by Stijn Segers. Tested-by: Stijn Segers <foss@volatilesystems.org> Signed-off-by: Sander Vanheule <sander@svanheule.net>
2021-02-18 19:52:53 +00:00
TPLINK_BOARD_ID := EAP235-WALL-V1
IMAGE_SIZE := 13440k
IMAGE/factory.bin := append-rootfs | tplink-safeloader factory | \
pad-extra 128
endef
TARGET_DEVICES += tplink_eap235-wall-v1
ramips: mt7621: add TP-Link EAP613 v1 The TP-Link EAP613 v1 is a ceiling-mount 802.11ax access point. It can be powered via PoE or a DC barrel connector (12V). Connecting to the UART requires fine soldering and careful manipulation of any soldered wires. Device details: * SoC: MT7621AT * Flash: 16 MiB SPI NOR * RAM: 256 MiB DDR3L * Wi-Fi: * MT7905DA + MT7975D: 2.4 GHz + 5 GHz (DBDC), 2x2:2 * Two stamped metal antennas (ANT1, ANT2) * One PCB antenna (ANT3) * One unpopulated antenna (ANT4) * Ethernet: * 1× 10/100/1000 Mbps port with PoE * LEDs: * Array of four blue LEDs with one control line * Buttons: * Reset * Board test points: * UART: next to CPU RF-shield and power circuits * JTAG: under CPU RF-shield (untested) * Watchdog: 3PEAK TPV706 (not implemented) Althought three antennas are populated, the MT7905DA does not support the additional Rx chain for background DFS detection (or Bluetooth) according to commit 6cbcc34f50a3 ("ramips: disable unsupported background radar detection"). MAC addresses: * LAN: 48:22:54:xx:xx:a2 (device label) * WLAN 2.4 GHz: 48:22:54:xx:xx:a2 * WLAN 5 GHz: 48:22:54:xx:xx:a3 The radio calibration blob stored in flash also contains valid MAC addresses for both radio bands (OUI 00:0c:43). Factory install: 1. Enable SSH on the device via web interface 2. Log in with SSH, and run `cliclientd stopcs` 3. Upload -factory.bin image via web interface. It may be necessary to shorten the filename of the image to e.g. 'factory.bin'. Recovery: 1. Open the device by unscrewing four screws from the backside 2. Carefully remove board from the housing 3. Connect to UART (3.3V): * Find test points labelled "VCC", "GND", "UART_TX", "UART_RX" * Solder wires to test points or connect otherwise. Be careful not to damage the PCB e.g. by pulling on soldered wires. * Open console with 115200n8 settings 4. Interrupt bootloader and use tftpboot to start an initramfs: setenv ipaddr $DEVICE_IP setenv serverip $SERVER_IP tftpboot 84000000 openwrt-initramfs-kernel.bin bootm DO NOT use saveenv to store modified u-boot environment variables. The environment is saved at flash offset 0x30000, which erases part of the (secondary) bootloader. The device uses two bootloader stages. The first stage will load the second stage from a uImage stored at flash offset 0x10000. In case of a damaged second stage, the first stage should allow uploading a new image via y-modem (untested). Signed-off-by: Sander Vanheule <sander@svanheule.net> (cherry picked from commit 11588c52b47c2c3b2cdc7849ce9e4804bfdb8bb5)
2023-06-24 20:18:35 +00:00
define Device/tplink_eap613-v1
$(Device/dsa-migration)
$(Device/tplink-safeloader)
DEVICE_MODEL := EAP613
DEVICE_VARIANT := v1
DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
TPLINK_BOARD_ID := EAP610-V3
KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb | pad-to 64k
KERNEL_INITRAMFS := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd
IMAGE_SIZE := 13248k
endef
TARGET_DEVICES += tplink_eap613-v1
ramips: support TP-Link EAP615-Wall Add support for the TP-Link EAP615-Wall, an AX1800 Wall Plate WiFi 6 AP. The device is very similar to the TP-Link EAP235-Wall. Hardware: * SoC: MediaTek MT7621AT * RAM: 128MiB * Flash: 16MiB SPI-NOR * Ethernet: 4x GbE * Back: ETH0 (PoE-PD) * Bottom: ETH1, ETH2, ETH3 (PoE passthrough) * WiFi: MT7905DAN/MT7975DN 2.4/5 GHz 2T2R * LEDS: 1x white * Buttons: 1x LED, 1x reset Stock firmware uses a random MAC address for ethernet. OpenWrt uses the MAC address that is on the device label for ethernet and the wireless interfaces. MAC address must not be incremented, as this will cause MAC address conflicts in case you have two devices with consecutive MAC addresses. Instead, different locally administered addresses will be generated automatically, based on the MAC on the label. Installation via stock firmware: * Enable SSH in the TP-Link web interface * SSH to the device * Run `cliclientd stopcs` * Upload the OpenWrt factory image via the TP-Link web interface Installation via bootloader: * Solder TTL header. Pinout: 1: TX, 2: RX, 3: GND, 4: VCC, with pin 1 closest to ETH1. Baud rate 115200 * Interrupt boot process by holding a key during boot * Boot the OpenWrt initramfs: # tftpboot 0x84000000 openwrt-ramips-mt7621-tplink_eap615-wall-v1-initramfs-kernel.bin # bootm * Copy openwrt-ramips-mt7621-tplink_eap615-wall-v1-squashfs-sysupgrade.bin to /tmp and use sysupgrade to install it Thanks to Sander Vanheule for his work on the EAP235-Wall, which made adding support for the EAP615-Wall very easy. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Reviewed-by: Sander Vanheule <sander@svanheule.net> Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com>
2022-01-27 21:42:33 +00:00
define Device/tplink_eap615-wall-v1
$(Device/dsa-migration)
$(Device/tplink-safeloader)
DEVICE_MODEL := EAP615-Wall
DEVICE_VARIANT := v1
DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
ramips: support TP-Link EAP615-Wall Add support for the TP-Link EAP615-Wall, an AX1800 Wall Plate WiFi 6 AP. The device is very similar to the TP-Link EAP235-Wall. Hardware: * SoC: MediaTek MT7621AT * RAM: 128MiB * Flash: 16MiB SPI-NOR * Ethernet: 4x GbE * Back: ETH0 (PoE-PD) * Bottom: ETH1, ETH2, ETH3 (PoE passthrough) * WiFi: MT7905DAN/MT7975DN 2.4/5 GHz 2T2R * LEDS: 1x white * Buttons: 1x LED, 1x reset Stock firmware uses a random MAC address for ethernet. OpenWrt uses the MAC address that is on the device label for ethernet and the wireless interfaces. MAC address must not be incremented, as this will cause MAC address conflicts in case you have two devices with consecutive MAC addresses. Instead, different locally administered addresses will be generated automatically, based on the MAC on the label. Installation via stock firmware: * Enable SSH in the TP-Link web interface * SSH to the device * Run `cliclientd stopcs` * Upload the OpenWrt factory image via the TP-Link web interface Installation via bootloader: * Solder TTL header. Pinout: 1: TX, 2: RX, 3: GND, 4: VCC, with pin 1 closest to ETH1. Baud rate 115200 * Interrupt boot process by holding a key during boot * Boot the OpenWrt initramfs: # tftpboot 0x84000000 openwrt-ramips-mt7621-tplink_eap615-wall-v1-initramfs-kernel.bin # bootm * Copy openwrt-ramips-mt7621-tplink_eap615-wall-v1-squashfs-sysupgrade.bin to /tmp and use sysupgrade to install it Thanks to Sander Vanheule for his work on the EAP235-Wall, which made adding support for the EAP615-Wall very easy. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Reviewed-by: Sander Vanheule <sander@svanheule.net> Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com>
2022-01-27 21:42:33 +00:00
TPLINK_BOARD_ID := EAP615-WALL-V1
KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb | pad-to 64k
KERNEL_INITRAMFS := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd
IMAGE_SIZE := 13248k
endef
TARGET_DEVICES += tplink_eap615-wall-v1
ramips: add basic support for TP-Link EC330-G5u v1 This adds basic support for TP-Link EC330-G5u Ver:1.0 router (also known as TP-Link Archer C9ERT). Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 128 MiB, Nanya NT5CC64M16GP-DI Flash: 128 MiB NAND, ESMT F59L1G81MA-25T Wireless 2.4 GHz (MediaTek MT7615N): b/g/n, 4x4 Wireless 5 GHz (MediaTek MT7615N): a/n/ac, 4x4 Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1xUSB3.0 Button: 4 (Led, WiFi On/Off, Reset, WPS) LEDs: 7 blue LEDs, 1 orange(amber) LED, 1 white(non-gpio) LED Power: 12 VDC, 2 A Connector type: Barrel Bootloader: First U-Boot (1.1.3), Main U-Boot (1.1.3). Additionally, original TP-Link firmware contains Image U-Boot (1.1.3). Serial console (UART) --------------------- V +-------+-------+-------+-------+ | +3.3V | GND | TX | RX | +---+---+-------+-------+-------+ | J2 | +--- Don't connect Installation ------------ 1. Rename OpenWrt initramfs image to test.bin and place it on tftp server with IP 192.168.0.5 2. Attach UART, switch on the router and interrupt the boot process by pressing 't' 3. Load and run OpenWrt initramfs image: tftpboot bootm 4. Once inside OpenWrt, switch to the first boot image: fw_setenv BootImage 0 5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv BootImage 1 reboot Recovery -------- 1. Press Reset button and power on the router 2. Navigate to U-Boot recovery web server (http://192.168.0.1/) and upload the OEM firmware MAC addresses ------------- +---------+-------------------+-------------------+-------------+ | | MAC example 1 | MAC example 2 | Algorithm | +---------+-------------------+-------------------+-------------+ | label | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | LAN | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WAN | 72:ff:7b:xx:xx:f5 | 54:d4:f7:xx:xx:db | label+1 [1] | | WLAN 2g | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WLAN 5g | 68:ff:7b:xx:xx:f6 | 50:d4:f7:xx:xx:dc | label+2 | +---------+-------------------+-------------------+-------------+ label MAC address was found in factory at 0x165 (text format xx:xx:xx:xx:xx:xx). Notes ----- [1] WAN MAC address: a. First octet of WAN MAC is differ than others and OUI is not related to TP-Link company. This probably should be fixed. b. Flipping bits in first octet and hex delta are different for the different MAC examples: +-----------------+----------------+----------------+ | | Example 1 | Example 2 | +-----------------+----------------+----------------+ | LAN | 68 = 0110 1000 | 50 = 0101 0000 | | MAC (1st octet) | ^ ^ ^ | | +-----------------+----------------+----------------+ | WAN | 72 = 0111 0010 | 54 = 0101 0100 | | MAC (1st octet) | ^ ^ ^ | ^ | +-----------------+----------------+----------------+ | HEX delta | 0xa | 0x4 | +-----------------+----------------+----------------+ | DEC delta | 4 | 4 | +-----------------+----------------+----------------+ c. DEC delta is a constant (4). This looks like a mistake in OEM firmware and probably should be fixed. Based on the above, I decided to keep correct OUI and make WAN MAC = label + 1. [2] Bootloaders The device contains 3 bootloaders: - First U-Boot: U-Boot 1.1.3 (Mar 18 2019 - 12:50:24). The First U-Boot located on NAND Flash to load next full-feature Uboot. - Main U-Boot + its backup: U-Boot 1.1.3 (Mar 18 2019 - 12:50:29). This bootloader includes recovery webserver. Requires special uImages to continue the boot process: 0x00 (os0, os1) - firmware uImage 0x40 (os0, os1) - standalone uImage (OpenWrt kernel is here) - Additionally, both slots of the original TP-Link firmware contains Image U-Boot: U-Boot 1.1.3 (Oct 16 2019 - 08:14:45). It checks image magics and CRCs. We don't use this U-Boot with OpenWrt. Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2023-01-06 15:47:58 +00:00
define Device/tplink_ec330-g5u-v1
$(Device/nand)
ramips: add basic support for TP-Link EC330-G5u v1 This adds basic support for TP-Link EC330-G5u Ver:1.0 router (also known as TP-Link Archer C9ERT). Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 128 MiB, Nanya NT5CC64M16GP-DI Flash: 128 MiB NAND, ESMT F59L1G81MA-25T Wireless 2.4 GHz (MediaTek MT7615N): b/g/n, 4x4 Wireless 5 GHz (MediaTek MT7615N): a/n/ac, 4x4 Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1xUSB3.0 Button: 4 (Led, WiFi On/Off, Reset, WPS) LEDs: 7 blue LEDs, 1 orange(amber) LED, 1 white(non-gpio) LED Power: 12 VDC, 2 A Connector type: Barrel Bootloader: First U-Boot (1.1.3), Main U-Boot (1.1.3). Additionally, original TP-Link firmware contains Image U-Boot (1.1.3). Serial console (UART) --------------------- V +-------+-------+-------+-------+ | +3.3V | GND | TX | RX | +---+---+-------+-------+-------+ | J2 | +--- Don't connect Installation ------------ 1. Rename OpenWrt initramfs image to test.bin and place it on tftp server with IP 192.168.0.5 2. Attach UART, switch on the router and interrupt the boot process by pressing 't' 3. Load and run OpenWrt initramfs image: tftpboot bootm 4. Once inside OpenWrt, switch to the first boot image: fw_setenv BootImage 0 5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv BootImage 1 reboot Recovery -------- 1. Press Reset button and power on the router 2. Navigate to U-Boot recovery web server (http://192.168.0.1/) and upload the OEM firmware MAC addresses ------------- +---------+-------------------+-------------------+-------------+ | | MAC example 1 | MAC example 2 | Algorithm | +---------+-------------------+-------------------+-------------+ | label | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | LAN | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WAN | 72:ff:7b:xx:xx:f5 | 54:d4:f7:xx:xx:db | label+1 [1] | | WLAN 2g | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WLAN 5g | 68:ff:7b:xx:xx:f6 | 50:d4:f7:xx:xx:dc | label+2 | +---------+-------------------+-------------------+-------------+ label MAC address was found in factory at 0x165 (text format xx:xx:xx:xx:xx:xx). Notes ----- [1] WAN MAC address: a. First octet of WAN MAC is differ than others and OUI is not related to TP-Link company. This probably should be fixed. b. Flipping bits in first octet and hex delta are different for the different MAC examples: +-----------------+----------------+----------------+ | | Example 1 | Example 2 | +-----------------+----------------+----------------+ | LAN | 68 = 0110 1000 | 50 = 0101 0000 | | MAC (1st octet) | ^ ^ ^ | | +-----------------+----------------+----------------+ | WAN | 72 = 0111 0010 | 54 = 0101 0100 | | MAC (1st octet) | ^ ^ ^ | ^ | +-----------------+----------------+----------------+ | HEX delta | 0xa | 0x4 | +-----------------+----------------+----------------+ | DEC delta | 4 | 4 | +-----------------+----------------+----------------+ c. DEC delta is a constant (4). This looks like a mistake in OEM firmware and probably should be fixed. Based on the above, I decided to keep correct OUI and make WAN MAC = label + 1. [2] Bootloaders The device contains 3 bootloaders: - First U-Boot: U-Boot 1.1.3 (Mar 18 2019 - 12:50:24). The First U-Boot located on NAND Flash to load next full-feature Uboot. - Main U-Boot + its backup: U-Boot 1.1.3 (Mar 18 2019 - 12:50:29). This bootloader includes recovery webserver. Requires special uImages to continue the boot process: 0x00 (os0, os1) - firmware uImage 0x40 (os0, os1) - standalone uImage (OpenWrt kernel is here) - Additionally, both slots of the original TP-Link firmware contains Image U-Boot: U-Boot 1.1.3 (Oct 16 2019 - 08:14:45). It checks image magics and CRCs. We don't use this U-Boot with OpenWrt. Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2023-01-06 15:47:58 +00:00
LOADER := bin
IMAGE_SIZE := 49152k
DEVICE_VENDOR := TP-Link
DEVICE_MODEL := EC330-G5u
DEVICE_ALT0_VENDOR := TP-Link
DEVICE_ALT0_MODEL := Archer C9ERT
DEVICE_VARIANT := v1
DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb-ledtrig-usbport kmod-usb3
ramips: add basic support for TP-Link EC330-G5u v1 This adds basic support for TP-Link EC330-G5u Ver:1.0 router (also known as TP-Link Archer C9ERT). Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 128 MiB, Nanya NT5CC64M16GP-DI Flash: 128 MiB NAND, ESMT F59L1G81MA-25T Wireless 2.4 GHz (MediaTek MT7615N): b/g/n, 4x4 Wireless 5 GHz (MediaTek MT7615N): a/n/ac, 4x4 Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1xUSB3.0 Button: 4 (Led, WiFi On/Off, Reset, WPS) LEDs: 7 blue LEDs, 1 orange(amber) LED, 1 white(non-gpio) LED Power: 12 VDC, 2 A Connector type: Barrel Bootloader: First U-Boot (1.1.3), Main U-Boot (1.1.3). Additionally, original TP-Link firmware contains Image U-Boot (1.1.3). Serial console (UART) --------------------- V +-------+-------+-------+-------+ | +3.3V | GND | TX | RX | +---+---+-------+-------+-------+ | J2 | +--- Don't connect Installation ------------ 1. Rename OpenWrt initramfs image to test.bin and place it on tftp server with IP 192.168.0.5 2. Attach UART, switch on the router and interrupt the boot process by pressing 't' 3. Load and run OpenWrt initramfs image: tftpboot bootm 4. Once inside OpenWrt, switch to the first boot image: fw_setenv BootImage 0 5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv BootImage 1 reboot Recovery -------- 1. Press Reset button and power on the router 2. Navigate to U-Boot recovery web server (http://192.168.0.1/) and upload the OEM firmware MAC addresses ------------- +---------+-------------------+-------------------+-------------+ | | MAC example 1 | MAC example 2 | Algorithm | +---------+-------------------+-------------------+-------------+ | label | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | LAN | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WAN | 72:ff:7b:xx:xx:f5 | 54:d4:f7:xx:xx:db | label+1 [1] | | WLAN 2g | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WLAN 5g | 68:ff:7b:xx:xx:f6 | 50:d4:f7:xx:xx:dc | label+2 | +---------+-------------------+-------------------+-------------+ label MAC address was found in factory at 0x165 (text format xx:xx:xx:xx:xx:xx). Notes ----- [1] WAN MAC address: a. First octet of WAN MAC is differ than others and OUI is not related to TP-Link company. This probably should be fixed. b. Flipping bits in first octet and hex delta are different for the different MAC examples: +-----------------+----------------+----------------+ | | Example 1 | Example 2 | +-----------------+----------------+----------------+ | LAN | 68 = 0110 1000 | 50 = 0101 0000 | | MAC (1st octet) | ^ ^ ^ | | +-----------------+----------------+----------------+ | WAN | 72 = 0111 0010 | 54 = 0101 0100 | | MAC (1st octet) | ^ ^ ^ | ^ | +-----------------+----------------+----------------+ | HEX delta | 0xa | 0x4 | +-----------------+----------------+----------------+ | DEC delta | 4 | 4 | +-----------------+----------------+----------------+ c. DEC delta is a constant (4). This looks like a mistake in OEM firmware and probably should be fixed. Based on the above, I decided to keep correct OUI and make WAN MAC = label + 1. [2] Bootloaders The device contains 3 bootloaders: - First U-Boot: U-Boot 1.1.3 (Mar 18 2019 - 12:50:24). The First U-Boot located on NAND Flash to load next full-feature Uboot. - Main U-Boot + its backup: U-Boot 1.1.3 (Mar 18 2019 - 12:50:29). This bootloader includes recovery webserver. Requires special uImages to continue the boot process: 0x00 (os0, os1) - firmware uImage 0x40 (os0, os1) - standalone uImage (OpenWrt kernel is here) - Additionally, both slots of the original TP-Link firmware contains Image U-Boot: U-Boot 1.1.3 (Oct 16 2019 - 08:14:45). It checks image magics and CRCs. We don't use this U-Boot with OpenWrt. Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2023-01-06 15:47:58 +00:00
KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | \
uImage-tplink-c9 standalone '$(call toupper,$(LINUX_KARCH)) \
$(VERSION_DIST) Linux-$(LINUX_VERSION)' | \
uImage-tplink-c9 firmware 'OS IMAGE ($(VERSION_DIST))'
KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | \
uImage none
ramips: add factory image for TP-Link EC330-G5u v1 This commit adds factory.bin image for TP-Link EC330-G5u v1. This allows to install OpenWrt without connecting a serial cable (UART). Installation using factory image -------------------------------- Tested with "3.16.0 0.9.1 v6037.0 Build 191016 Rel.30619nb" TP-Link firmware. 1. Login to the router web interface (http://192.168.0.1/ by default) and save running config to "conf.bin" file 2. Open configuration file in any TP-Link config editor (e.g. https://jahed.github.io/tp-link-config-editor/) 3. Find "DeviceInfo" section and insert a new string "<Description val="Modem Router`telnetd -p 1023 -l login`" />" according to the following example: <DeviceInfo> ... <Description val="Modem Router`telnetd -p 1023 -l login`" /> ... </DeviceInfo> 4. Save configuration file and upload changed configuration using stock firmware interface 5. Login using telnet to IP:192.168.0.1 (Username:admin, password:1234) 6. Run "cat /proc/mtd | grep mtd7" a. If the result is 'mtd7: 03000000 00020000 "rootfs" 03400000', then install stock firmware using web interface to toggle booted firmware image from "os1" to "os0" b. If the result is 'mtd7: 03000000 00020000 "rootfs" 00400000', then all is ok, go to the next step 7. Set up a tftp server with OpenWrt factory.bin image (IP:192.168.0.100 in this example) 8. Login using telnet to 192.168.0.1 9. Download OpenWrt factory.bin image from the tftp server: cd /tmp tftp -g -r factory.bin 192.168.0.100 10. Write OpenWrt factory.bin image: dd if=/tmp/factory.bin of=/dev/mtdblock1 11. Power cycle the router Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2023-04-22 09:35:44 +00:00
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | \
append-ubi | check-size
ramips: add basic support for TP-Link EC330-G5u v1 This adds basic support for TP-Link EC330-G5u Ver:1.0 router (also known as TP-Link Archer C9ERT). Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 128 MiB, Nanya NT5CC64M16GP-DI Flash: 128 MiB NAND, ESMT F59L1G81MA-25T Wireless 2.4 GHz (MediaTek MT7615N): b/g/n, 4x4 Wireless 5 GHz (MediaTek MT7615N): a/n/ac, 4x4 Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1xUSB3.0 Button: 4 (Led, WiFi On/Off, Reset, WPS) LEDs: 7 blue LEDs, 1 orange(amber) LED, 1 white(non-gpio) LED Power: 12 VDC, 2 A Connector type: Barrel Bootloader: First U-Boot (1.1.3), Main U-Boot (1.1.3). Additionally, original TP-Link firmware contains Image U-Boot (1.1.3). Serial console (UART) --------------------- V +-------+-------+-------+-------+ | +3.3V | GND | TX | RX | +---+---+-------+-------+-------+ | J2 | +--- Don't connect Installation ------------ 1. Rename OpenWrt initramfs image to test.bin and place it on tftp server with IP 192.168.0.5 2. Attach UART, switch on the router and interrupt the boot process by pressing 't' 3. Load and run OpenWrt initramfs image: tftpboot bootm 4. Once inside OpenWrt, switch to the first boot image: fw_setenv BootImage 0 5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv BootImage 1 reboot Recovery -------- 1. Press Reset button and power on the router 2. Navigate to U-Boot recovery web server (http://192.168.0.1/) and upload the OEM firmware MAC addresses ------------- +---------+-------------------+-------------------+-------------+ | | MAC example 1 | MAC example 2 | Algorithm | +---------+-------------------+-------------------+-------------+ | label | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | LAN | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WAN | 72:ff:7b:xx:xx:f5 | 54:d4:f7:xx:xx:db | label+1 [1] | | WLAN 2g | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WLAN 5g | 68:ff:7b:xx:xx:f6 | 50:d4:f7:xx:xx:dc | label+2 | +---------+-------------------+-------------------+-------------+ label MAC address was found in factory at 0x165 (text format xx:xx:xx:xx:xx:xx). Notes ----- [1] WAN MAC address: a. First octet of WAN MAC is differ than others and OUI is not related to TP-Link company. This probably should be fixed. b. Flipping bits in first octet and hex delta are different for the different MAC examples: +-----------------+----------------+----------------+ | | Example 1 | Example 2 | +-----------------+----------------+----------------+ | LAN | 68 = 0110 1000 | 50 = 0101 0000 | | MAC (1st octet) | ^ ^ ^ | | +-----------------+----------------+----------------+ | WAN | 72 = 0111 0010 | 54 = 0101 0100 | | MAC (1st octet) | ^ ^ ^ | ^ | +-----------------+----------------+----------------+ | HEX delta | 0xa | 0x4 | +-----------------+----------------+----------------+ | DEC delta | 4 | 4 | +-----------------+----------------+----------------+ c. DEC delta is a constant (4). This looks like a mistake in OEM firmware and probably should be fixed. Based on the above, I decided to keep correct OUI and make WAN MAC = label + 1. [2] Bootloaders The device contains 3 bootloaders: - First U-Boot: U-Boot 1.1.3 (Mar 18 2019 - 12:50:24). The First U-Boot located on NAND Flash to load next full-feature Uboot. - Main U-Boot + its backup: U-Boot 1.1.3 (Mar 18 2019 - 12:50:29). This bootloader includes recovery webserver. Requires special uImages to continue the boot process: 0x00 (os0, os1) - firmware uImage 0x40 (os0, os1) - standalone uImage (OpenWrt kernel is here) - Additionally, both slots of the original TP-Link firmware contains Image U-Boot: U-Boot 1.1.3 (Oct 16 2019 - 08:14:45). It checks image magics and CRCs. We don't use this U-Boot with OpenWrt. Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2023-01-06 15:47:58 +00:00
endef
TARGET_DEVICES += tplink_ec330-g5u-v1
ramips: add basic support for tp-link er605-v2 This is a MT7621-based device with 128MB NAND flash, 256MB RAM, and a USB port. The board has headers to attach console. In order for them to work two solder bridges near those pads need to be made. The defice has the following partition table: ``` 0x000000000000-0x000000080000 : "u-boot" 0x000000080000-0x000000100000 : "u-boot-env" 0x000000100000-0x000000140000 : "factory" 0x000000140000-0x000007e00000 : "firmware" 0x000007e00000-0x000008000000 : "panic-ops" ``` `firmware` partition contains UBI volumes. Unfortunately I accidentally wiped partition and I no longer have access to it. `firmware` partition contains 'secondary' U-Boot which is run by 'first' u-boot. It also contains various configuration partitions that include device info and MAC address. There also seems to be 'primary' and 'backup' set of 'main' volumes. U-boot has `mtkupgrade` command that just overrides data on firmware partitions. Firmware file provided by TP-Link cannot be used with that command. U-boot also has 'recovery' http server. Unfortunately I was not able to make it work with manufacturer's firmware. Manufacturer's firmware essentially contains multiple UBI volumes along with 'partition table'. Unfortunately I no longer can properly run manufacturer's firmware so I cannot at the moment try to a support for building 'factory' images. This patch adds support for initramfs image as well as sysupgrade image. This seems to be pretty standard MT7621 board otherwise. Things that work: * network * leds * usb * factory MAC detection Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
2022-12-15 01:26:38 +00:00
define Device/tplink_er605-v2
$(Device/nand)
ramips: add basic support for tp-link er605-v2 This is a MT7621-based device with 128MB NAND flash, 256MB RAM, and a USB port. The board has headers to attach console. In order for them to work two solder bridges near those pads need to be made. The defice has the following partition table: ``` 0x000000000000-0x000000080000 : "u-boot" 0x000000080000-0x000000100000 : "u-boot-env" 0x000000100000-0x000000140000 : "factory" 0x000000140000-0x000007e00000 : "firmware" 0x000007e00000-0x000008000000 : "panic-ops" ``` `firmware` partition contains UBI volumes. Unfortunately I accidentally wiped partition and I no longer have access to it. `firmware` partition contains 'secondary' U-Boot which is run by 'first' u-boot. It also contains various configuration partitions that include device info and MAC address. There also seems to be 'primary' and 'backup' set of 'main' volumes. U-boot has `mtkupgrade` command that just overrides data on firmware partitions. Firmware file provided by TP-Link cannot be used with that command. U-boot also has 'recovery' http server. Unfortunately I was not able to make it work with manufacturer's firmware. Manufacturer's firmware essentially contains multiple UBI volumes along with 'partition table'. Unfortunately I no longer can properly run manufacturer's firmware so I cannot at the moment try to a support for building 'factory' images. This patch adds support for initramfs image as well as sysupgrade image. This seems to be pretty standard MT7621 board otherwise. Things that work: * network * leds * usb * factory MAC detection Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
2022-12-15 01:26:38 +00:00
DEVICE_VENDOR := TP-Link
DEVICE_MODEL := ER605
DEVICE_VARIANT := v2
DEVICE_PACKAGES := -wpad-basic-mbedtls kmod-usb3 -uboot-envtools
ramips: add basic support for tp-link er605-v2 This is a MT7621-based device with 128MB NAND flash, 256MB RAM, and a USB port. The board has headers to attach console. In order for them to work two solder bridges near those pads need to be made. The defice has the following partition table: ``` 0x000000000000-0x000000080000 : "u-boot" 0x000000080000-0x000000100000 : "u-boot-env" 0x000000100000-0x000000140000 : "factory" 0x000000140000-0x000007e00000 : "firmware" 0x000007e00000-0x000008000000 : "panic-ops" ``` `firmware` partition contains UBI volumes. Unfortunately I accidentally wiped partition and I no longer have access to it. `firmware` partition contains 'secondary' U-Boot which is run by 'first' u-boot. It also contains various configuration partitions that include device info and MAC address. There also seems to be 'primary' and 'backup' set of 'main' volumes. U-boot has `mtkupgrade` command that just overrides data on firmware partitions. Firmware file provided by TP-Link cannot be used with that command. U-boot also has 'recovery' http server. Unfortunately I was not able to make it work with manufacturer's firmware. Manufacturer's firmware essentially contains multiple UBI volumes along with 'partition table'. Unfortunately I no longer can properly run manufacturer's firmware so I cannot at the moment try to a support for building 'factory' images. This patch adds support for initramfs image as well as sysupgrade image. This seems to be pretty standard MT7621 board otherwise. Things that work: * network * leds * usb * factory MAC detection Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
2022-12-15 01:26:38 +00:00
KERNEL_IN_UBI := 1
KERNEL_LOADADDR := 0x82000000
KERNEL := kernel-bin | relocate-kernel 0x80001000 | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
IMAGES += sysupgrade.tar
IMAGE_SIZE := 127744k
endef
TARGET_DEVICES += tplink_er605-v2
ramips: add support for TP-Link MR600 V2(EU) MR600 V2(EU) is an LTE router that also supports 4G+ band aggregation etc. and can reportedly achieve higher bandwidth with it. - Specifications: * SoC: Mediatek MT7621DAT 880MHz * RAM: 128MB DDR3 * Flash: 16MB SPI NOR flash (GD25Q128C) * LTE Modem: Qualcomm MDM9240 * WiFi 5GHz: Mediatek MT7613BEN * WiFi 2.4GHz: Mediatek MT7603EN * Ethernet: MT7530, 4x 1000Base-T. * UART: Serial console (115200 8n1), J1(GND:3) * Buttons: Reset, WPS. * LED: Power, WAN, LTE, WiFi 2GHz and 5GHz, LAN, Signal1, Signal2, Signal3 - MAC Addresses: OEM firmware configuration: 54:af:97:xx:xx:7b : 2.4G 54:af:97:xx:xx:7a : 5G 54:af:97:xx:xx:7c : LTE 54:af:97:xx:xx:7b : LAN (label) 54:af:97:xx:xx:7c : WAN - Installation: 1. Download the OpenWrt initramfs-image. Place it into a TFTP server root directory and rename it to openwrt.img Configure the TFTP server to listen at 192.168.0.5/24. 3. Connect to the serial console. Attach power and interrupt the boot procedure when prompted (type `tpl`). Credentials are admin / 1234 4. Configure U-Boot for booting OpenWrt from ram $ tftpboot $ bootm 5. Transfer the OpenWrt sysupgrade image to the device. - LTE: In order to setup the wwan0 interface: 1. Add a `qmi` proto interface under `/etc/config/network`, e.g.: ``` config interface 'wwan0' option device '/dev/cdc-wdm0' option proto 'qmi' option pincode 'XXXX' option apn 'your_isp_apn' ``` 2. Add `wwan0` interface to the `wan` firewall zone 3. `/etc/init.d/network restart` Signed-off-by: Linos Giannopoulos <linosgian00@gmail.com>
2022-10-02 22:30:28 +00:00
define Device/tplink_mr600-v2-eu
$(Device/dsa-migration)
$(Device/tplink-v2)
DEVICE_MODEL := MR600
DEVICE_VARIANT := v2 (EU)
TPLINK_FLASHLAYOUT := 16Mltq
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
kmod-usb-net-qmi-wwan uqmi kmod-usb3 -uboot-envtools
IMAGE/factory.bin := tplink-v2-image -e -a 0x10000
IMAGE/sysupgrade.bin := tplink-v2-image -s -e -a 0x10000 | check-size | \
append-metadata
ramips: add support for TP-Link MR600 V2(EU) MR600 V2(EU) is an LTE router that also supports 4G+ band aggregation etc. and can reportedly achieve higher bandwidth with it. - Specifications: * SoC: Mediatek MT7621DAT 880MHz * RAM: 128MB DDR3 * Flash: 16MB SPI NOR flash (GD25Q128C) * LTE Modem: Qualcomm MDM9240 * WiFi 5GHz: Mediatek MT7613BEN * WiFi 2.4GHz: Mediatek MT7603EN * Ethernet: MT7530, 4x 1000Base-T. * UART: Serial console (115200 8n1), J1(GND:3) * Buttons: Reset, WPS. * LED: Power, WAN, LTE, WiFi 2GHz and 5GHz, LAN, Signal1, Signal2, Signal3 - MAC Addresses: OEM firmware configuration: 54:af:97:xx:xx:7b : 2.4G 54:af:97:xx:xx:7a : 5G 54:af:97:xx:xx:7c : LTE 54:af:97:xx:xx:7b : LAN (label) 54:af:97:xx:xx:7c : WAN - Installation: 1. Download the OpenWrt initramfs-image. Place it into a TFTP server root directory and rename it to openwrt.img Configure the TFTP server to listen at 192.168.0.5/24. 3. Connect to the serial console. Attach power and interrupt the boot procedure when prompted (type `tpl`). Credentials are admin / 1234 4. Configure U-Boot for booting OpenWrt from ram $ tftpboot $ bootm 5. Transfer the OpenWrt sysupgrade image to the device. - LTE: In order to setup the wwan0 interface: 1. Add a `qmi` proto interface under `/etc/config/network`, e.g.: ``` config interface 'wwan0' option device '/dev/cdc-wdm0' option proto 'qmi' option pincode 'XXXX' option apn 'your_isp_apn' ``` 2. Add `wwan0` interface to the `wan` firewall zone 3. `/etc/init.d/network restart` Signed-off-by: Linos Giannopoulos <linosgian00@gmail.com>
2022-10-02 22:30:28 +00:00
KERNEL := $(KERNEL_DTB) | uImage lzma
KERNEL_INITRAMFS := $$(KERNEL) | tplink-v2-header
TPLINK_BOARD_ID := MR600-V2-EU
IMAGE_SIZE := 16384k
endef
TARGET_DEVICES += tplink_mr600-v2-eu
2019-04-17 18:17:45 +00:00
define Device/tplink_re350-v1
$(Device/dsa-migration)
2019-04-17 18:17:45 +00:00
$(Device/tplink-safeloader)
DEVICE_MODEL := RE350
DEVICE_VARIANT := v1
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 -uboot-envtools
2019-04-17 18:17:45 +00:00
TPLINK_BOARD_ID := RE350-V1
IMAGE_SIZE := 6016k
SUPPORTED_DEVICES += re350-v1
endef
TARGET_DEVICES += tplink_re350-v1
define Device/tplink_re500-v1
$(Device/dsa-migration)
$(Device/tplink-safeloader)
DEVICE_MODEL := RE500
DEVICE_VARIANT := v1
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
TPLINK_BOARD_ID := RE500-V1
IMAGE_SIZE := 14208k
endef
TARGET_DEVICES += tplink_re500-v1
2019-04-17 18:17:45 +00:00
define Device/tplink_re650-v1
$(Device/dsa-migration)
2019-04-17 18:17:45 +00:00
$(Device/tplink-safeloader)
DEVICE_MODEL := RE650
DEVICE_VARIANT := v1
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
2019-04-17 18:17:45 +00:00
TPLINK_BOARD_ID := RE650-V1
IMAGE_SIZE := 14208k
endef
TARGET_DEVICES += tplink_re650-v1
define Device/tplink_re650-v2
$(Device/dsa-migration)
$(Device/tplink-safeloader)
DEVICE_MODEL := RE650
DEVICE_VARIANT := v2
DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
TPLINK_BOARD_ID := RE650-V2
IMAGE_SIZE := 7994k
endef
TARGET_DEVICES += tplink_re650-v2
define Device/tplink_tl-wpa8631p-v3
$(Device/dsa-migration)
$(Device/tplink-safeloader)
DEVICE_MODEL := TL-WPA8631P
DEVICE_VARIANT := v3
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
-uboot-envtools
TPLINK_BOARD_ID := TL-WPA8631P-V3
IMAGE_SIZE := 7232k
endef
TARGET_DEVICES += tplink_tl-wpa8631p-v3
define Device/ubnt_edgerouter_common
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := Ubiquiti
ramips/mt7621: fix IMAGE_SIZE for all devices This fixes IMAGE_SIZE for all devices based on the partition size given in DTS: DEVICE *.MK *.DTS VERDICT afoundry_ew1200 (16M) 0xfb0000 asiarf_ap7621-001 (16M) 0xfa0000 wrong buffalo_wsr-1166dhp (16M) 0xf90000 wrong buffalo_wsr-600dhp (16M) 0xfb0000 dlink_dir-860l-b1 (16M) 0xfb0000 d-team_newifi-d2 (32M) 0x1fb0000 d-team_pbr-m1 (16M) 0xfb0000 elecom_wrc-1167ghbk2-s 15488k 0xf20000 elecom_wrc-1900gst 11264k 0xb00000 elecom_wrc-2533gst 11264k 0xb00000 firefly_firewrt (16M) 0xfb0000 gehua_ghl-r-001 (32M) 0x1fb0000 gnubee_gb-pc1 (32M) 0x1fb0000 gnubee_gb-pc2 (32M) 0x1fb0000 hiwifi_hc5962 (32M) 0x2000000 wrong (kernel + ubi) iodata_wn-ax1167gr 15552k 0xf30000 iodata_wn-gx300gr 7798784 0x770000 lenovo_newifi-d1 (32M) 0x1fb0000 linksys_re6500 - 0x7b0000 default mediatek_ap-mt7621a-v60 (8M) 0x7b0000 mediatek_mt7621-eval-board (4M) 0xec0000 wrong (rootfs) mikrotik_rb750gr3 [16128k] 0xfc0000 mikrotik_rbm11g [16128k] 0xFC0000 mikrotik_rbm33g [16128k] 0xFC0000 mqmaker_witi-256m (16M) 0xfb0000 mqmaker_witi-512m (16M) 0xfb0000 mtc_wr1201 16000k 0xfa0000 netgear_ex6150 14848k 0xe80000 netgear_r6220 28672k 0x1c00000 netgear_r6350 40960k 0x2800000 netgear_wndr3700-v5 15232k 0xee0000 netis_wf-2881 129280k 0x7E40000 phicomm_k2p 15744k 0xf60000 planex_vr500 66453504 0x3fb0000 wrong samknows_whitebox-v8 (16M) 0xfb0000 storylink_sap-g3200u3 - 0x7b0000 default telco-electronics_x1 16064k 0xfb0000 thunder_timecloud - 0xfb0000 wrong totolink_a7000r 16064k 0xfb0000 tplink_re350-v1 6016k 0x5e0000 ubiquiti_edgerouterx - 0xfa00000 wrong (kernel1 + ubi) ubiquiti_edgerouterx-sfp - 0xfa00000 wrong (kernel1 + ubi) unielec_u7621-06-256m-16m 16064k 0xfb0000 unielec_u7621-06-512m-64m 65216k 0x3fb0000 wevo_11acnas (16M) 0xfb0000 wevo_w2914ns-v2 (16M) 0xfb0000 xiaomi_mir3g 32768k 0x7980000 wrong (kernel + ubi) xiaomi_mir3p (32M) 0xf980000 wrong (kernel + ubi) xzwifi_creativebox-v1 (32M) 0x1fb0000 youhua_wr1200js 16064k 0xfb0000 youku_yk-l2 (16M) 0xfb0000 zbtlink_zbt-we1326 (16M) 0xfb0000 zbtlink_zbt-we3526 (16M) 0xfb0000 zbtlink_zbt-wg2626 (16M) 0xfb0000 zbtlink_zbt-wg3526-16m (16M) 0xfb0000 zbtlink_zbt-wg3526-32m (32M) 0x1fb0000 No verdict means that the device is correctly set. Legend: ( ): Value is set via ralink_default_fw_size_xxM [ ]: Value is derived from parent definition - : Value is not set and derived from default definition Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-07-15 12:55:24 +00:00
IMAGE_SIZE := 256768k
FILESYSTEMS := squashfs
KERNEL_SIZE := 3145728
KERNEL_INITRAMFS := $$(KERNEL) | \
ubnt-erx-factory-image $(KDIR)/tmp/$$(KERNEL_INITRAMFS_PREFIX)-factory.tar
IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
DEVICE_PACKAGES += -wpad-basic-mbedtls -uboot-envtools
endef
define Device/ubnt_edgerouter-x
$(Device/ubnt_edgerouter_common)
DEVICE_MODEL := EdgeRouter X
SUPPORTED_DEVICES += ubnt-erx ubiquiti,edgerouterx
endef
TARGET_DEVICES += ubnt_edgerouter-x
define Device/ubnt_edgerouter-x-sfp
$(Device/ubnt_edgerouter_common)
DEVICE_MODEL := EdgeRouter X SFP
DEVICE_ALT0_VENDOR := Ubiquiti
DEVICE_ALT0_MODEL := EdgePoint R6
DEVICE_PACKAGES += kmod-i2c-algo-pca kmod-gpio-pca953x kmod-sfp
SUPPORTED_DEVICES += ubnt-erx-sfp ubiquiti,edgerouterx-sfp
endef
TARGET_DEVICES += ubnt_edgerouter-x-sfp
ramips: add support for Ubiquiti UniFi 6 Lite Hardware -------- MediaTek MT7621AT 256M DDR3 32M SPI-NOR MediaTek MT7603 2T2R 802.11n 2.4GHz MediaTek MT7915 2T2R 802.11ax 5GHz Not Working ----------- - Bluetooth (connected to UART3) UART ---- UART is located in the lower left corner of the board. Pinout is 0 - 3V3 (don't connect) 1 - RX 2 - TX 3 - GND Console is 115200 8N1. Boot ---- 1. Connect to the serial console and connect power. 2. Double-press ESC when prompted 3. Set the fdt address $ fdt addr $(fdtcontroladdr) 4. Remove the signature node from the control FDT $ fdt rm /signature 5. Transfer and boot the OpenWrt initramfs image to the device. Make sure to name the file C0A80114.img and have it reachable at 192.168.1.1/24 $ tftpboot; bootm Installation ------------ 1. Connect to the booted device at 192.168.1.20 using username/password "ubnt". 2. Update the bootloader environment. $ fw_setenv devmode TRUE $ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr); fdt rm /signature; bootubnt" $ fw_setenv bootcmd "run boot_openwrt" 3. Transfer the OpenWrt sysupgrade image to the device using SCP. 4. Check the mtd partition number for bs / kernel0 / kernel1 $ cat /proc/mtd 5. Set the bootselect flag to boot from kernel0 $ dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock4 6. Write the OpenWrt sysupgrade image to both kernel0 as well as kernel1 $ dd if=openwrt.bin of=/dev/mtdblock6 $ dd if=openwrt.bin of=/dev/mtdblock7 7. Reboot the device. It should boot into OpenWrt. Below are the original installation instructions prior to the discovery of "devmode=TRUE". They are not required for installation and are documentation only. The bootloader employs signature verification on the FIT image configurations. This way, booting unauthorized image without patching the bootloader is not possible. Manually configuring the bootcmd in the U-Boot envronment won't work, as this is restored to the default value if modified. The bootloader is made up of three different parts. 1. The SPL performing early board initialization and providing a XModem recovery in case the PBL is missing 2. The PBL being the primary U-Boot application and containing the control FDT. It is LZMA packed with a uImage header. 3. A Ubiquiti standalone U-Boot application providing the main boot routine as well as their recovery mechanism. In a perfect world, we would only replace the PBL, as the SPL does not perform checks on the PBLs integrity. However, as the PBL is in the same eraseblock as the SPL, we need to at least rewrite both. The bootloader will only verify integrity in case it has a "signature" node in it's control device-tree. Renaming the signature node to something else will prevent this from happening. Warning: These instructions are based on the firmware intially shipped with the device and potentially brick your device in a way it can only be recovered using a SPI flasher. Only (!) proceed if you understand this! 1. Extract the bootloader from the U-Boot partition using the OpenWrt initramfs image. 2. Split the bootloader into it's 3 components: $ dd if=bootloader.bin of=spl.bin bs=1 skip=0 count=45056 $ dd if=bootloader.bin of=pbl.uimage bs=1 skip=45056 count=143360 $ dd if=bootloader.bin of=ubnt.uimage bs=1 skip=188416 3. Strip the uImage header from the PBL $ dd if=pbl.uimage of=pbl.lzma bs=64 skip=1 4. Decompress the PBL $ lzma -d pbl.lzma --single-stream The decompressed PBL sha256sum should be d8b406c65240d260cf15be5f97f40c1d6d1b6e61ec3abed37bb841c90fcc1235 5. Open the decompressed PBL using your favorite hexeditor. Locate the control FDT at offset 0x4CED0 (0xD00DFEED). At offset 0x4D5BC, the label for the signature node is located. Rename the "signature" string at this offset to "signaturr". The patched PBL sha256sum should be d028e374cdb40ba44b6e3cef2e4e8a8c16a3b85eb15d9544d24fdd10eed64c97 6. Compress the patched PBL $ lzma -z pbl --lzma1=dict=67108864 The resulting pbl.lzma file should have the sha256sum 7ae6118928fa0d0b3fe4ff81abd80ecfd9ba2944cb0f0a462b6ae65913088b42 7. Create the PBL uimage $ SOURCE_DATE_EPOCH=1607909492 mkimage -A mips -O u-boot -C lzma -n "U-Boot 2018.03 [UniFi,v1.1.40.71]" -a 84000000 -e 84000000 -T firmware -d pbl.lzma patched_pbl.uimage The resulting patched_pbl.uimage should have the sha256sum b90d7fa2dcc6814180d3943530d8d6b0d6a03636113c94e99af34f196d3cf2ce 8. Reassemble the complete bootloader $ dd if=patched_pbl.uimage of=aligned_pbl.uimage bs=143360 count=1 conv=sync $ cat spl.bin > patched_uboot.bin $ cat aligned_pbl.uimage >> patched_uboot.bin $ cat ubnt.uimage >> patched_uboot.bin The resulting patched_uboot.bin should have the sha256sum 3e1186f33b88a525687285c2a8b22e8786787b31d4648b8eee66c672222aa76b 9. Transfer your patched bootloader to the device. Also install the kmod-mtd-rw package using opkg and load it. $ insmod mtd-rw.ko i_want_a_brick=1 Write the patched bootloader to mtd0 $ mtd write patched_uboot.bin u-boot 10. Erase the kernel1 partition, as the bootloader might otherwise decide to boot from there. $ mtd erase kernel1 11. Transfer the OpenWrt sysupgrade image to the device and install using sysupgrade. FIT configurations ------------------ In the future, the MT7621 UniFi6 family can be supported by a single OpenWrt image. config@1: U6 Lite config@2: U6 IW config@3: U6 Mesh config@4: U6 Extender config@5: U6 LR-EA (Early Access - GA is MT7622) Signed-off-by: David Bauer <mail@david-bauer.net>
2020-12-12 13:34:00 +00:00
define Device/ubnt_unifi-6-lite
$(Device/dsa-migration)
DEVICE_VENDOR := Ubiquiti
DEVICE_MODEL := UniFi 6 Lite
DEVICE_DTS_CONFIG := config@1
DEVICE_DTS_LOADADDR := 0x87000000
DEVICE_PACKAGES += kmod-mt7603 kmod-mt7915-firmware -uboot-envtools
ramips: add support for Ubiquiti UniFi 6 Lite Hardware -------- MediaTek MT7621AT 256M DDR3 32M SPI-NOR MediaTek MT7603 2T2R 802.11n 2.4GHz MediaTek MT7915 2T2R 802.11ax 5GHz Not Working ----------- - Bluetooth (connected to UART3) UART ---- UART is located in the lower left corner of the board. Pinout is 0 - 3V3 (don't connect) 1 - RX 2 - TX 3 - GND Console is 115200 8N1. Boot ---- 1. Connect to the serial console and connect power. 2. Double-press ESC when prompted 3. Set the fdt address $ fdt addr $(fdtcontroladdr) 4. Remove the signature node from the control FDT $ fdt rm /signature 5. Transfer and boot the OpenWrt initramfs image to the device. Make sure to name the file C0A80114.img and have it reachable at 192.168.1.1/24 $ tftpboot; bootm Installation ------------ 1. Connect to the booted device at 192.168.1.20 using username/password "ubnt". 2. Update the bootloader environment. $ fw_setenv devmode TRUE $ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr); fdt rm /signature; bootubnt" $ fw_setenv bootcmd "run boot_openwrt" 3. Transfer the OpenWrt sysupgrade image to the device using SCP. 4. Check the mtd partition number for bs / kernel0 / kernel1 $ cat /proc/mtd 5. Set the bootselect flag to boot from kernel0 $ dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock4 6. Write the OpenWrt sysupgrade image to both kernel0 as well as kernel1 $ dd if=openwrt.bin of=/dev/mtdblock6 $ dd if=openwrt.bin of=/dev/mtdblock7 7. Reboot the device. It should boot into OpenWrt. Below are the original installation instructions prior to the discovery of "devmode=TRUE". They are not required for installation and are documentation only. The bootloader employs signature verification on the FIT image configurations. This way, booting unauthorized image without patching the bootloader is not possible. Manually configuring the bootcmd in the U-Boot envronment won't work, as this is restored to the default value if modified. The bootloader is made up of three different parts. 1. The SPL performing early board initialization and providing a XModem recovery in case the PBL is missing 2. The PBL being the primary U-Boot application and containing the control FDT. It is LZMA packed with a uImage header. 3. A Ubiquiti standalone U-Boot application providing the main boot routine as well as their recovery mechanism. In a perfect world, we would only replace the PBL, as the SPL does not perform checks on the PBLs integrity. However, as the PBL is in the same eraseblock as the SPL, we need to at least rewrite both. The bootloader will only verify integrity in case it has a "signature" node in it's control device-tree. Renaming the signature node to something else will prevent this from happening. Warning: These instructions are based on the firmware intially shipped with the device and potentially brick your device in a way it can only be recovered using a SPI flasher. Only (!) proceed if you understand this! 1. Extract the bootloader from the U-Boot partition using the OpenWrt initramfs image. 2. Split the bootloader into it's 3 components: $ dd if=bootloader.bin of=spl.bin bs=1 skip=0 count=45056 $ dd if=bootloader.bin of=pbl.uimage bs=1 skip=45056 count=143360 $ dd if=bootloader.bin of=ubnt.uimage bs=1 skip=188416 3. Strip the uImage header from the PBL $ dd if=pbl.uimage of=pbl.lzma bs=64 skip=1 4. Decompress the PBL $ lzma -d pbl.lzma --single-stream The decompressed PBL sha256sum should be d8b406c65240d260cf15be5f97f40c1d6d1b6e61ec3abed37bb841c90fcc1235 5. Open the decompressed PBL using your favorite hexeditor. Locate the control FDT at offset 0x4CED0 (0xD00DFEED). At offset 0x4D5BC, the label for the signature node is located. Rename the "signature" string at this offset to "signaturr". The patched PBL sha256sum should be d028e374cdb40ba44b6e3cef2e4e8a8c16a3b85eb15d9544d24fdd10eed64c97 6. Compress the patched PBL $ lzma -z pbl --lzma1=dict=67108864 The resulting pbl.lzma file should have the sha256sum 7ae6118928fa0d0b3fe4ff81abd80ecfd9ba2944cb0f0a462b6ae65913088b42 7. Create the PBL uimage $ SOURCE_DATE_EPOCH=1607909492 mkimage -A mips -O u-boot -C lzma -n "U-Boot 2018.03 [UniFi,v1.1.40.71]" -a 84000000 -e 84000000 -T firmware -d pbl.lzma patched_pbl.uimage The resulting patched_pbl.uimage should have the sha256sum b90d7fa2dcc6814180d3943530d8d6b0d6a03636113c94e99af34f196d3cf2ce 8. Reassemble the complete bootloader $ dd if=patched_pbl.uimage of=aligned_pbl.uimage bs=143360 count=1 conv=sync $ cat spl.bin > patched_uboot.bin $ cat aligned_pbl.uimage >> patched_uboot.bin $ cat ubnt.uimage >> patched_uboot.bin The resulting patched_uboot.bin should have the sha256sum 3e1186f33b88a525687285c2a8b22e8786787b31d4648b8eee66c672222aa76b 9. Transfer your patched bootloader to the device. Also install the kmod-mtd-rw package using opkg and load it. $ insmod mtd-rw.ko i_want_a_brick=1 Write the patched bootloader to mtd0 $ mtd write patched_uboot.bin u-boot 10. Erase the kernel1 partition, as the bootloader might otherwise decide to boot from there. $ mtd erase kernel1 11. Transfer the OpenWrt sysupgrade image to the device and install using sysupgrade. FIT configurations ------------------ In the future, the MT7621 UniFi6 family can be supported by a single OpenWrt image. config@1: U6 Lite config@2: U6 IW config@3: U6 Mesh config@4: U6 Extender config@5: U6 LR-EA (Early Access - GA is MT7622) Signed-off-by: David Bauer <mail@david-bauer.net>
2020-12-12 13:34:00 +00:00
KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
IMAGE_SIZE := 15424k
endef
TARGET_DEVICES += ubnt_unifi-6-lite
define Device/ubnt_unifi-flexhd
$(Device/dsa-migration)
DEVICE_VENDOR := Ubiquiti
DEVICE_MODEL := UniFi FlexHD
DEVICE_DTS_CONFIG := config@2
DEVICE_DTS_LOADADDR := 0x87000000
KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615-firmware kmod-leds-ubnt-ledbar \
-uboot-envtools
IMAGE_SIZE := 15552k
endef
TARGET_DEVICES += ubnt_unifi-flexhd
define Device/ubnt_unifi-nanohd
$(Device/dsa-migration)
DEVICE_VENDOR := Ubiquiti
DEVICE_MODEL := UniFi nanoHD
DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615-firmware -uboot-envtools
IMAGE_SIZE := 15552k
endef
TARGET_DEVICES += ubnt_unifi-nanohd
ramips: add support for Ubiquiti USW-Flex Hardware -------- MediaTek MT7621AT 16M SPI-NOR Macronix MX25L12835FMI Microchip PD69104B1 4-Channel PoE-PSE controller TI TPS2373 PoE-PD controller PoE-Controller -------------- By default, the PoE outputs do not work with OpenWrt. To make them output power, install the "poemgr" package from the packages feed. This package can control the PD69104B1 PSE controller. Installation ------------ 1. Connect to the booted device at 192.168.1.20 using username/password "ubnt" via SSH. 2. Add the uboot-envtools configuration file /etc/fw_env.config with the following content $ echo "/dev/mtd1 0x0 0x1000 0x10000 1" > /etc/fw_env.config 3. Update the bootloader environment. $ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr); fdt rm /signature; bootubnt" $ fw_setenv bootcmd "run boot_openwrt" 4. Transfer the OpenWrt sysupgrade image to the device using SCP. 5. Check the mtd partition number for bs / kernel0 / kernel1 $ cat /proc/mtd 6. Set the bootselect flag to boot from kernel0 $ dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock4 7. Write the OpenWrt sysupgrade image to both kernel0 as well as kernel1 $ dd if=openwrt.bin of=/dev/mtdblock6 $ dd if=openwrt.bin of=/dev/mtdblock7 8. Reboot the device. It should boot into OpenWrt. Restore to UniFi ---------------- To restore the vendor firmware, follow the Ubiquiti UniFi TFTP recovery guide for access points. The process is the same for the Flex switch. Signed-off-by: David Bauer <mail@david-bauer.net>
2021-08-20 11:23:42 +00:00
define Device/ubnt_usw-flex
$(Device/dsa-migration)
DEVICE_VENDOR := Ubiquiti
DEVICE_MODEL := UniFi Switch Flex
DEVICE_DTS_CONFIG := config@1
DEVICE_DTS_LOADADDR := 0x87000000
DEVICE_PACKAGES += -uboot-envtools
ramips: add support for Ubiquiti USW-Flex Hardware -------- MediaTek MT7621AT 16M SPI-NOR Macronix MX25L12835FMI Microchip PD69104B1 4-Channel PoE-PSE controller TI TPS2373 PoE-PD controller PoE-Controller -------------- By default, the PoE outputs do not work with OpenWrt. To make them output power, install the "poemgr" package from the packages feed. This package can control the PD69104B1 PSE controller. Installation ------------ 1. Connect to the booted device at 192.168.1.20 using username/password "ubnt" via SSH. 2. Add the uboot-envtools configuration file /etc/fw_env.config with the following content $ echo "/dev/mtd1 0x0 0x1000 0x10000 1" > /etc/fw_env.config 3. Update the bootloader environment. $ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr); fdt rm /signature; bootubnt" $ fw_setenv bootcmd "run boot_openwrt" 4. Transfer the OpenWrt sysupgrade image to the device using SCP. 5. Check the mtd partition number for bs / kernel0 / kernel1 $ cat /proc/mtd 6. Set the bootselect flag to boot from kernel0 $ dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock4 7. Write the OpenWrt sysupgrade image to both kernel0 as well as kernel1 $ dd if=openwrt.bin of=/dev/mtdblock6 $ dd if=openwrt.bin of=/dev/mtdblock7 8. Reboot the device. It should boot into OpenWrt. Restore to UniFi ---------------- To restore the vendor firmware, follow the Ubiquiti UniFi TFTP recovery guide for access points. The process is the same for the Flex switch. Signed-off-by: David Bauer <mail@david-bauer.net>
2021-08-20 11:23:42 +00:00
KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
IMAGE_SIZE := 14720k
ramips: add support for Ubiquiti USW-Flex Hardware -------- MediaTek MT7621AT 16M SPI-NOR Macronix MX25L12835FMI Microchip PD69104B1 4-Channel PoE-PSE controller TI TPS2373 PoE-PD controller PoE-Controller -------------- By default, the PoE outputs do not work with OpenWrt. To make them output power, install the "poemgr" package from the packages feed. This package can control the PD69104B1 PSE controller. Installation ------------ 1. Connect to the booted device at 192.168.1.20 using username/password "ubnt" via SSH. 2. Add the uboot-envtools configuration file /etc/fw_env.config with the following content $ echo "/dev/mtd1 0x0 0x1000 0x10000 1" > /etc/fw_env.config 3. Update the bootloader environment. $ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr); fdt rm /signature; bootubnt" $ fw_setenv bootcmd "run boot_openwrt" 4. Transfer the OpenWrt sysupgrade image to the device using SCP. 5. Check the mtd partition number for bs / kernel0 / kernel1 $ cat /proc/mtd 6. Set the bootselect flag to boot from kernel0 $ dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock4 7. Write the OpenWrt sysupgrade image to both kernel0 as well as kernel1 $ dd if=openwrt.bin of=/dev/mtdblock6 $ dd if=openwrt.bin of=/dev/mtdblock7 8. Reboot the device. It should boot into OpenWrt. Restore to UniFi ---------------- To restore the vendor firmware, follow the Ubiquiti UniFi TFTP recovery guide for access points. The process is the same for the Flex switch. Signed-off-by: David Bauer <mail@david-bauer.net>
2021-08-20 11:23:42 +00:00
endef
TARGET_DEVICES += ubnt_usw-flex
ramips: add support for UniElec U7621-01 UniElec U7621-01 is a router platform board, the smaller model of the U7621-06. The device has the following specifications: - MT7621AT (880 MHz) - 256 of RAM (DDR3) - 16 MB of FLASH (SPI NOR) - 5x 1 Gbps Ethernet (MT7621 built-in switch) - 1x 2.4Ghz MT7603E - 1x 5Ghz MT7612 - 1x miniPCIe slots (PCIe bus only) - 1x miniSIM slot - 1x USB 2.0 (uses the usb 3.0 driver) - 8x LEDs (1x GPIO-controlled) - 1x reset button - 1x UART header (4-pins) - 1x GPIO header (30-pins) - 1x DC jack for main power (12 V) The following has been tested and is working: - Ethernet switch - 1x 2.4Ghz MT7603E (wifi) - 1x 5Ghz MT7612 (wifi) - miniPCIe slots (tested with Wi-Fi cards and LTE modem cards) - miniSIM slot (works with normal size simcard) - sysupgrade - reset button Installation: This board has no locked down bootloader. The seller can be asked to install openwrt v18.06, so upgrades are standard sysupgrade method. Recovery: This board contains a Chinese, closed-source bootloader called Breed (Boot and Recovery Environment for Embedded Devices). Breed supports web recovery and to enter it, you keep the reset button pressed for around 5 seconds during boot. Your machine will be assigned an IP through DHCP and the router will use IP address 192.168.1.1. The recovery website is in Chinese, but is easy to use. Click on the second item in the list to access the recovery page, then the second item on the next page is where you select the firmware. In order to start the recovery, you click the button at the bottom. LEDs list (left to right): - ESW_P0_LED_0 - ESW_P1_LED_0 - ESW_P2_LED_0 - ESW_P3_LED_0 - ESW_P4_LED_0 - CTS2_N (GPIO10, configured as "status" LED) - LED_WLAN# (connected with pin 44 in wifi1 slot) Signed-off-by: David Bentham <db260179@gmail.com> [add DEVICE_VARIANT, fix DEVICE_PACKAGES, remove &gpio] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-11-21 14:04:49 +00:00
define Device/unielec_u7621-01-16m
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := UniElec
DEVICE_MODEL := U7621-01
DEVICE_VARIANT := 16M
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 -uboot-envtools
ramips: add support for UniElec U7621-01 UniElec U7621-01 is a router platform board, the smaller model of the U7621-06. The device has the following specifications: - MT7621AT (880 MHz) - 256 of RAM (DDR3) - 16 MB of FLASH (SPI NOR) - 5x 1 Gbps Ethernet (MT7621 built-in switch) - 1x 2.4Ghz MT7603E - 1x 5Ghz MT7612 - 1x miniPCIe slots (PCIe bus only) - 1x miniSIM slot - 1x USB 2.0 (uses the usb 3.0 driver) - 8x LEDs (1x GPIO-controlled) - 1x reset button - 1x UART header (4-pins) - 1x GPIO header (30-pins) - 1x DC jack for main power (12 V) The following has been tested and is working: - Ethernet switch - 1x 2.4Ghz MT7603E (wifi) - 1x 5Ghz MT7612 (wifi) - miniPCIe slots (tested with Wi-Fi cards and LTE modem cards) - miniSIM slot (works with normal size simcard) - sysupgrade - reset button Installation: This board has no locked down bootloader. The seller can be asked to install openwrt v18.06, so upgrades are standard sysupgrade method. Recovery: This board contains a Chinese, closed-source bootloader called Breed (Boot and Recovery Environment for Embedded Devices). Breed supports web recovery and to enter it, you keep the reset button pressed for around 5 seconds during boot. Your machine will be assigned an IP through DHCP and the router will use IP address 192.168.1.1. The recovery website is in Chinese, but is easy to use. Click on the second item in the list to access the recovery page, then the second item on the next page is where you select the firmware. In order to start the recovery, you click the button at the bottom. LEDs list (left to right): - ESW_P0_LED_0 - ESW_P1_LED_0 - ESW_P2_LED_0 - ESW_P3_LED_0 - ESW_P4_LED_0 - CTS2_N (GPIO10, configured as "status" LED) - LED_WLAN# (connected with pin 44 in wifi1 slot) Signed-off-by: David Bentham <db260179@gmail.com> [add DEVICE_VARIANT, fix DEVICE_PACKAGES, remove &gpio] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-11-21 14:04:49 +00:00
endef
TARGET_DEVICES += unielec_u7621-01-16m
define Device/unielec_u7621-06-16m
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := UniElec
DEVICE_MODEL := U7621-06
DEVICE_VARIANT := 16M
DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-usb3 \
-wpad-basic-mbedtls -uboot-envtools
SUPPORTED_DEVICES += u7621-06-256M-16M unielec,u7621-06-256m-16m
endef
TARGET_DEVICES += unielec_u7621-06-16m
define Device/unielec_u7621-06-32m
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 32448k
DEVICE_VENDOR := UniElec
DEVICE_MODEL := U7621-06
DEVICE_VARIANT := 32M
DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-usb3 \
-wpad-basic-mbedtls -uboot-envtools
SUPPORTED_DEVICES += unielec,u7621-06-32m
endef
TARGET_DEVICES += unielec_u7621-06-32m
define Device/unielec_u7621-06-64m
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 65216k
DEVICE_VENDOR := UniElec
DEVICE_MODEL := U7621-06
DEVICE_VARIANT := 64M
DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-usb3 \
-wpad-basic-mbedtls -uboot-envtools
SUPPORTED_DEVICES += unielec,u7621-06-512m-64m
endef
TARGET_DEVICES += unielec_u7621-06-64m
ramips: add support for Wavlink WL-WN531A6 This patch adds support for Wavlink WL-WN531A6 (Quantum D6). Specifications: -------------- * SoC: Mediatek MT7621AT 2C2T, 880MHz * RAM: 128MB DDR3, Nanya NT5CB64M16GP-EK * Flash: 16MB SPI NOR flash, GigaDevice GD25Q127CSIG * WiFi 5GHz: Mediatek MT7615N (4x4:4) on mini PCIE slot. * WiFi 2.4GHz: Mediatek MT7603EN (2x2:2) on mini PCIE slot. * Ethernet: MT7630, 5x 1000Base-T * LED: Power, WAN, LAN(x4), WiFi, WPS, dual color "WAVLINK" LED logo on the top cover. * Buttons: Reset, WPS, "Turbo", touch button on the top cover via RH6015C touch sensor. * UART: UART1: serial console (57600 8n1) on the J4 header located below the top heatsink. UART2: J12 header, located on the right side of the board. * USB: One USB3 port. * I2C: J9 header, located below the top heatsink. Backup the OEM Firmware: ----------------------- There isn't any firmware released for the WL-WN531A6 on the Wavlink web site. Reverting back to the OEM firmware is not possible unless we have a backup of the original OEM firmware. The OEM firmware is stored on /dev/mtd4 ("Kernel"). 1) Plug a FAT32 formatted USB flash drive into the USB port. 2) Navigate to "Setup->USB Storage". Under the "Available Network folder" you can see part of the mount point of the newly mounted flash drive filesystem - e.g "sda1". The full mount point is prefixed with "/media", so in this case the mount point becomes "/media/sda1". 3) Go to http://192.168.10.1/webcmd.shtml . 4) Type the following line in the "Command" input box: dd if=/dev/mtd4ro of=/media/sda1/firmware.bin 5) Click "Apply" 6) After few seconds, in the text area should appear this output: 30080+0 records in 30080+0 records out 7) Type "sync" in the "Command" input box and click "Apply". 8) At this point the OEM firmware is stored on the flash drive as "firmware.bin". The size of the file is 15040 KB. Installation: ------------ * Flashing instructions (OEM web interface): The OEM web interface accepts only files with names containing "WN531A6". It's also impossible to flash the *-sysupgrade.bin image, so we have to flash the *-initramfs-kernel.bin first and use the OpenWrt's upgrade interface to write the sysupgrade image. 1) Rename openwrt-ramips-mt7621-wavlink_wl-wn531a6-initramfs-kernel.bin to WN531A6.bin. 2) Connect your computer to the one of the LAN ports of the router with an Ethernet cable and open http://192.168.10.1 3) Browse to Setup -> Firmware Upgrade interface. 4) Upload the (renamed) OpenWrt image - WN531A6.bin. 5) Proceed with the firmware installation and give the device a few minutes to finish and reboot. 6) After reboot wait for the "WAVLINK" logo on the top cover to turn solid blue, and open http://192.168.1.1 7) Use the OpenWrt's "Flash Firmware" interface to write the OpenWrt sysupgrade image: openwrt-ramips-mt7621-wavlink_wl-wn531a6-squashfs-sysupgrade.bin * Flashing instructions (u-boot TFTP): 1) Configure a TFTP server on your computer and set its IP to 192.168.10.100 2) Rename the OpenWrt sysupgrade image to firmware.bin and place it in the root folder of the TFTP server. 3) Power off the device and connect an Ethernet cable from one of its LAN ports your computer. 4) Press the "Reset" button (and keep it pressed) 5) Power on the device. 6) After a few seconds, when the connected port LAN LED stops blinking fast, release the "Reset" button. 7) Flashing OpenWrt takes less than a minute, system will reboot automatically. 8) After reboot the WAVLINK logo on the top cover will indicate the current OpenWrt running status (wait until the logo tunrs solid blue). Revert to the OEM Firmware: -------------------------- * U-boot TFTP: Follow "Flashing instructions (u-boot TFTP)" and use the "firmware.bin" backup image. * OpenWrt "Flash Firmware" interface: Upload the "firmware.bin" backup image and select "Force update" before continuing. Notes: ----- * The MAC address shown on the label at the back of the device is assigned to the 2.4G WiFi adapter. MAC addresses assigned by the OEM firmware: 2.4G: *:XX (label): factory@0x0004 5G: *:XX + 1 : factory@0x8004 WAN: *:XX - 1 : factory@0xe006 LAN: *:XX - 2 : factory@0xe000 * The I2C bus and UART2 are fully functional. The headers are not populated. Signed-off-by: Georgi Vlaev <georgi.vlaev@konsulko.com>
2020-08-25 08:26:21 +00:00
define Device/wavlink_wl-wn531a6
$(Device/dsa-migration)
DEVICE_VENDOR := Wavlink
DEVICE_MODEL := WL-WN531A6
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware kmod-usb3 -uboot-envtools
ramips: add support for Wavlink WL-WN531A6 This patch adds support for Wavlink WL-WN531A6 (Quantum D6). Specifications: -------------- * SoC: Mediatek MT7621AT 2C2T, 880MHz * RAM: 128MB DDR3, Nanya NT5CB64M16GP-EK * Flash: 16MB SPI NOR flash, GigaDevice GD25Q127CSIG * WiFi 5GHz: Mediatek MT7615N (4x4:4) on mini PCIE slot. * WiFi 2.4GHz: Mediatek MT7603EN (2x2:2) on mini PCIE slot. * Ethernet: MT7630, 5x 1000Base-T * LED: Power, WAN, LAN(x4), WiFi, WPS, dual color "WAVLINK" LED logo on the top cover. * Buttons: Reset, WPS, "Turbo", touch button on the top cover via RH6015C touch sensor. * UART: UART1: serial console (57600 8n1) on the J4 header located below the top heatsink. UART2: J12 header, located on the right side of the board. * USB: One USB3 port. * I2C: J9 header, located below the top heatsink. Backup the OEM Firmware: ----------------------- There isn't any firmware released for the WL-WN531A6 on the Wavlink web site. Reverting back to the OEM firmware is not possible unless we have a backup of the original OEM firmware. The OEM firmware is stored on /dev/mtd4 ("Kernel"). 1) Plug a FAT32 formatted USB flash drive into the USB port. 2) Navigate to "Setup->USB Storage". Under the "Available Network folder" you can see part of the mount point of the newly mounted flash drive filesystem - e.g "sda1". The full mount point is prefixed with "/media", so in this case the mount point becomes "/media/sda1". 3) Go to http://192.168.10.1/webcmd.shtml . 4) Type the following line in the "Command" input box: dd if=/dev/mtd4ro of=/media/sda1/firmware.bin 5) Click "Apply" 6) After few seconds, in the text area should appear this output: 30080+0 records in 30080+0 records out 7) Type "sync" in the "Command" input box and click "Apply". 8) At this point the OEM firmware is stored on the flash drive as "firmware.bin". The size of the file is 15040 KB. Installation: ------------ * Flashing instructions (OEM web interface): The OEM web interface accepts only files with names containing "WN531A6". It's also impossible to flash the *-sysupgrade.bin image, so we have to flash the *-initramfs-kernel.bin first and use the OpenWrt's upgrade interface to write the sysupgrade image. 1) Rename openwrt-ramips-mt7621-wavlink_wl-wn531a6-initramfs-kernel.bin to WN531A6.bin. 2) Connect your computer to the one of the LAN ports of the router with an Ethernet cable and open http://192.168.10.1 3) Browse to Setup -> Firmware Upgrade interface. 4) Upload the (renamed) OpenWrt image - WN531A6.bin. 5) Proceed with the firmware installation and give the device a few minutes to finish and reboot. 6) After reboot wait for the "WAVLINK" logo on the top cover to turn solid blue, and open http://192.168.1.1 7) Use the OpenWrt's "Flash Firmware" interface to write the OpenWrt sysupgrade image: openwrt-ramips-mt7621-wavlink_wl-wn531a6-squashfs-sysupgrade.bin * Flashing instructions (u-boot TFTP): 1) Configure a TFTP server on your computer and set its IP to 192.168.10.100 2) Rename the OpenWrt sysupgrade image to firmware.bin and place it in the root folder of the TFTP server. 3) Power off the device and connect an Ethernet cable from one of its LAN ports your computer. 4) Press the "Reset" button (and keep it pressed) 5) Power on the device. 6) After a few seconds, when the connected port LAN LED stops blinking fast, release the "Reset" button. 7) Flashing OpenWrt takes less than a minute, system will reboot automatically. 8) After reboot the WAVLINK logo on the top cover will indicate the current OpenWrt running status (wait until the logo tunrs solid blue). Revert to the OEM Firmware: -------------------------- * U-boot TFTP: Follow "Flashing instructions (u-boot TFTP)" and use the "firmware.bin" backup image. * OpenWrt "Flash Firmware" interface: Upload the "firmware.bin" backup image and select "Force update" before continuing. Notes: ----- * The MAC address shown on the label at the back of the device is assigned to the 2.4G WiFi adapter. MAC addresses assigned by the OEM firmware: 2.4G: *:XX (label): factory@0x0004 5G: *:XX + 1 : factory@0x8004 WAN: *:XX - 1 : factory@0xe006 LAN: *:XX - 2 : factory@0xe000 * The I2C bus and UART2 are fully functional. The headers are not populated. Signed-off-by: Georgi Vlaev <georgi.vlaev@konsulko.com>
2020-08-25 08:26:21 +00:00
IMAGE_SIZE := 15040k
endef
TARGET_DEVICES += wavlink_wl-wn531a6
ramips: add support for Wavlink WL-WN533A8 The Wavlink WL-WN533A8 is an AC3000 router with 5 gigabit ethernet ports and one USB 3.0 port. It's also known as Wavlink QUANTUM T8. Hardware -------- SoC: Mediatek MT7621A RAM: 128MB (Nanya NT5CB64M16GP-EK) FLASH: 16MB NOR (GigaDevice GD25Q127CSIG3) ETH: - 5x 10/100/1000 Mbps Ethernet (4x LAN + 1x WAN) WIFI: - 1x MT7615DN (2x 2x2:2) 2.4GHz and 5GHz DBDC - 1x MT7615NE (4x4:4) 5GHz - 8 external antennas BTN: - 1x Reset button - 1x WPS button - 1x Turbo button - 1x Touchlink button - 1x ON/OFF switch LEDS: - 1x Red led (system status) - 1x Blue led (system status) - 7x Blue leds (wifi led + 5 ethernet ports + power) USB: - 1x USB 3.0 port UART: - 57600-8-N-1 J4 Everything works correctly. Installation ------------ Flash the initramfs image in the OEM firmware interface (http://192.168.10.1/update.shtml). When Openwrt boots, flash the sysupgrade image otherwise you won't be able to keep configuration between reboots. (Procedure tested on fw M33A8.V5030.190716 and M33A8.V5030.201204) Restore OEM Firmware -------------------- Flash the firmware update available online directly from LUCI. You can download it from: https://www.wavlink.com/en_us/firmware/details/f2d247ecba.html Warning: Remember to not keep settings! Warning2: Remember to force the flash. Notes ----- 1) Router mac addresses: LAN XX:XX:XX:XX:XX:63 (factory @ 0xe006) WAN XX:XX:XX:XX:XX:64 (factory @ 0xe000) WIFI 2G/5G XX:XX:XX:XX:XX:65 (factory @ 0x04) WIFI 5G XX:XX:XX:XX:XX:66 (factory @ 0x8004) LABEL XX:XX:XX:XX:XX:65 In OEM firmware the DBDC wifi interfaces have these mac addresses: 2G) 82:XX:XX:XX:XX:65 5G) 80:XX:XX:XX:XX:65 While in OpenWrt the addresses are: 2G) 80:XX:XX:XX:XX:65 5G) 02:XX:XX:XX:XX:65 2) radio0 will show as 2G/5G interface but only 2G is really usable. 3) There is just one wifi led for all wifi interfaces. It currently shows only the radio0 GHz wifi activity. 4) My unit was shipped with M33A8.V5030.190716 firmware which contains the http://192.168.10.1/webcmd.shtml page. Entering "telnetd" in the input box it will start the telnet daemon. Now you can access the telnet console on port 2323 with these credentials: username: admin2860 password: admin 5) The M33A8.V5030.201204 firmware version, doesn't contain anymore the webcmd.shtml page. If your router is shipped with a previous firmware version and you want to back it up, you can follow the back up procedure of the WS-WN583A6. Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
2022-04-18 15:35:33 +00:00
define Device/wavlink_wl-wn533a8
$(Device/dsa-migration)
DEVICE_VENDOR := Wavlink
DEVICE_MODEL := WL-WN533A8
KERNEL_INITRAMFS_SUFFIX := -WN533A8$$(KERNEL_SUFFIX)
DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 -uboot-envtools
ramips: add support for Wavlink WL-WN533A8 The Wavlink WL-WN533A8 is an AC3000 router with 5 gigabit ethernet ports and one USB 3.0 port. It's also known as Wavlink QUANTUM T8. Hardware -------- SoC: Mediatek MT7621A RAM: 128MB (Nanya NT5CB64M16GP-EK) FLASH: 16MB NOR (GigaDevice GD25Q127CSIG3) ETH: - 5x 10/100/1000 Mbps Ethernet (4x LAN + 1x WAN) WIFI: - 1x MT7615DN (2x 2x2:2) 2.4GHz and 5GHz DBDC - 1x MT7615NE (4x4:4) 5GHz - 8 external antennas BTN: - 1x Reset button - 1x WPS button - 1x Turbo button - 1x Touchlink button - 1x ON/OFF switch LEDS: - 1x Red led (system status) - 1x Blue led (system status) - 7x Blue leds (wifi led + 5 ethernet ports + power) USB: - 1x USB 3.0 port UART: - 57600-8-N-1 J4 Everything works correctly. Installation ------------ Flash the initramfs image in the OEM firmware interface (http://192.168.10.1/update.shtml). When Openwrt boots, flash the sysupgrade image otherwise you won't be able to keep configuration between reboots. (Procedure tested on fw M33A8.V5030.190716 and M33A8.V5030.201204) Restore OEM Firmware -------------------- Flash the firmware update available online directly from LUCI. You can download it from: https://www.wavlink.com/en_us/firmware/details/f2d247ecba.html Warning: Remember to not keep settings! Warning2: Remember to force the flash. Notes ----- 1) Router mac addresses: LAN XX:XX:XX:XX:XX:63 (factory @ 0xe006) WAN XX:XX:XX:XX:XX:64 (factory @ 0xe000) WIFI 2G/5G XX:XX:XX:XX:XX:65 (factory @ 0x04) WIFI 5G XX:XX:XX:XX:XX:66 (factory @ 0x8004) LABEL XX:XX:XX:XX:XX:65 In OEM firmware the DBDC wifi interfaces have these mac addresses: 2G) 82:XX:XX:XX:XX:65 5G) 80:XX:XX:XX:XX:65 While in OpenWrt the addresses are: 2G) 80:XX:XX:XX:XX:65 5G) 02:XX:XX:XX:XX:65 2) radio0 will show as 2G/5G interface but only 2G is really usable. 3) There is just one wifi led for all wifi interfaces. It currently shows only the radio0 GHz wifi activity. 4) My unit was shipped with M33A8.V5030.190716 firmware which contains the http://192.168.10.1/webcmd.shtml page. Entering "telnetd" in the input box it will start the telnet daemon. Now you can access the telnet console on port 2323 with these credentials: username: admin2860 password: admin 5) The M33A8.V5030.201204 firmware version, doesn't contain anymore the webcmd.shtml page. If your router is shipped with a previous firmware version and you want to back it up, you can follow the back up procedure of the WS-WN583A6. Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
2022-04-18 15:35:33 +00:00
IMAGE_SIZE := 15040k
endef
TARGET_DEVICES += wavlink_wl-wn533a8
define Device/wavlink_ws-wn572hp3-4g
$(Device/dsa-migration)
DEVICE_VENDOR := Wavlink
DEVICE_MODEL := WS-WN572HP3
DEVICE_VARIANT := 4G
IMAGE_SIZE := 15040k
KERNEL_LOADADDR := 0x82000000
KERNEL := kernel-bin | relocate-kernel 0x80001000 | lzma | \
fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
IMAGE/sysupgrade.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
append-rootfs | pad-rootfs | check-size | append-metadata
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
kmod-usb3 kmod-usb-net-rndis comgt-ncm -uboot-envtools
endef
TARGET_DEVICES += wavlink_ws-wn572hp3-4g
define Device/wevo_11acnas
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
UIMAGE_NAME := 11AC-NAS-Router(0.0.0)
DEVICE_VENDOR := WeVO
DEVICE_MODEL := 11AC NAS Router
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
SUPPORTED_DEVICES += 11acnas
endef
TARGET_DEVICES += wevo_11acnas
define Device/wevo_w2914ns-v2
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
UIMAGE_NAME := W2914NS-V2(0.0.0)
DEVICE_VENDOR := WeVO
DEVICE_MODEL := W2914NS
DEVICE_VARIANT := v2
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
SUPPORTED_DEVICES += w2914nsv2
endef
TARGET_DEVICES += wevo_w2914ns-v2
ramips: add support for Sercomm S1500 devices This commit adds support for following wireless routers: - Beeline SmartBox PRO (Serсomm S1500 AWI) - WiFire S1500.NBN (Serсomm S1500 BUC) This commit is based on this PR: - Link: https://github.com/openwrt/openwrt/pull/4770 - Author: Maximilian Weinmann <x1@disroot.org> The opening of this PR was agreed with author. My changes: - Sorting, minor changes and some movings between dts and dtsi - Move leds to dts when possible - Recipes for the factory image - Update of the installation/recovery/return to stock guides - Add reset GPIO for the pcie1 Common specification -------------------- SoC: MediaTek MT7621AT (880 MHz, 2 cores) Switch: MediaTek MT7530 (via SoC MT7621AT) Wireless: 2.4 GHz, MT7602EN, b/g/n, 2x2 Wireless: 5 GHz, MT7612EN, a/n/ac, 2x2 Ethernet: 5 ports - 5×GbE (WAN, LAN1-4) Mini PCIe: via J2 on PCB, not soldered on the board UART: J4 -> GND[], TX, VCC(3.3V), RX BootLoader: U-Boot SerComm/Mediatek Beeline SmartBox PRO specification ---------------------------------- RAM (Nanya NT5CB128M16FP): 256 MiB NAND-Flash (ESMT F59L2G81A): 256 MiB USB ports: 2xUSB2.0 LEDs: Status (white), WPS (blue), 2g (white), 5g (white) + 10 LED Ethernet Buttons: 2 button (reset, wps), 1 switch button (ROUT<->REP) Power: 12 VDC, 1.5 A PCB Sticker: 970AWI0QW00N256SMT Ver. 1.0 CSN: SG15******** MAC LAN: 94:4A:0C:**:**:** Manufacturer's code: 0AWI0500QW1 WiFire S1500.NBN specification ------------------------------ RAM (Nanya NT5CC64M16GP): 128 MiB NAND-Flash (ESMT F59L1G81MA): 128 MiB USB ports: 1xUSB2.0 LEDs: Status (white), WPS (white), 2g (white), 5g (white) + 10 LED Ethernet Buttons: 2 button (RESET, WPS) Power: 12 VDC, 1.0 A PCB Sticker: 970BUC0RW00N128SMT Ver. 1.0 CSN: MH16******** MAC WAN: E0:60:66:**:**:** Manufacturer's code: 0BUC0500RW1 MAC address table (PRO) ----------------------- use address source LAN *:23 factory 0x1000 (label) WAN *:24 factory $label +1 2g *:23 factory $label 5g *:25 factory $label +2 MAC addresses (NBN) ------------------- use address source LAN *:0e factory 0x1000 WAN *:0f LAN +1 (label) 2g *:0f LAN +1 5g *:10 LAN +2 OEM easy installation --------------------- 1. Remove all dots from the factory image filename (except the dot before file extension) 2. Upload and update the firmware via the original web interface 3. Two options are possible after the reboot: a. OpenWrt - that's OK, the mission accomplished b. Stock firmware - install Stock firmware (to switch booflag from Sercomm0 to Sercomm1) and then OpenWrt factory image. Return to Stock --------------- 1. Change the bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock2 reboot 2. Install stock firmware via the web OEM firmware interface Recovery -------- Use sercomm-recovery tool. Link: https://github.com/danitool/sercomm-recovery Tested-by: Pavel Ivanov <pi635v@gmail.com> Tested-by: Denis Myshaev <denis.myshaev@gmail.com> Tested-by: Oleg Galeev <olegingaleev@gmail.com> Tested-By: Ivan Pavlov <AuthorReflex@gmail.com> Co-authored-by: Maximilian Weinmann <x1@disroot.org> Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com> (cherry picked from commit 2d6784a033a994043759fa3b94c48afd5df81f88)
2023-06-11 20:50:23 +00:00
define Device/wifire_s1500-nbn
$(Device/sercomm_s1500)
DEVICE_VENDOR := WiFire
DEVICE_MODEL := S1500.NBN
DEVICE_ALT0_VENDOR := Sercomm
DEVICE_ALT0_MODEL := S1500 BUC
IMAGE_SIZE := 51200k
IMAGE/factory.img := append-kernel | sercomm-kernel-factory | \
sercomm-reset-slot1-chksum | append-ubi | check-size | \
sercomm-factory-cqr | sercomm-fix-buc-pid | sercomm-mkhash | \
sercomm-crypto
SERCOMM_HWID := BUC
SERCOMM_HWVER := 10000
SERCOMM_ROOTFS2_OFFSET := 0x4d00000
SERCOMM_SWVER := 2015
endef
TARGET_DEVICES += wifire_s1500-nbn
ramips: add support for Winstars WS-WN583A6 The Winstars WS-WN583A6 is a wireless repeater with 2 gigabit ethernet ports. Even if mine is branded as "Gemeita AC2100", the sticker on the back says WS-WN583A6. So I will refer to it as Winstars WS-WN583A6. Probably the real product name is the Wavlink WL-WN583A6 because of the many references to Wavlink in the OEM firmware and bootlog. Hardware -------- SoC: Mediatek MT7621AT (880 MHz, 2 cores 4 threads) RAM: 128MB FLASH: 8MB NOR (GigaDevice GD25Q64B) ETH: 2x 10/100/1000 Mbps Ethernet (MT7530) WIFI: - 2.4GHz: 1x MT7603E (2x2:2) - 5GHz: 1x MT7615E (4x4:4) - 6 internal antennas BTN: - 1x Reset button - 1x WPS button - 1x ON/OFF switch (working but unmodifiable) - 1x Auto/Schedule switch (working but unmodifiable. Read Note #3) LEDS: - 1x White led - 1x Red led - 1x Amber led - 1x Blue led - 2x Blue leds (lan and wan port status: working but unmodifiable) UART: - 57600-8-N-1 Everything works correctly. Currently there is no firmware update available. Because of this, in order to restore the OEM firmware, you must firstly dump the OEM firmware from your router before you flash the OpenWrt image. Backup the OEM Firmware ----------------------- The following steps are to be intended for users having little to none experience in linux. Obviously there are many ways to backup the OEM firmware, but probably this is the easiest way for this router. Procedure tested on M83A6.V5030.191210 firmware version. 1) Go to http://192.168.10.1/webcmd.shtml 2) Type the following line in the "Command" input box: mkdir /etc_ro/lighttpd/www/dev; for i in /dev/mtd*ro; do dd if=${i} of=/etc_ro/lighttpd/www${i}; done 3) Click "Apply" 4) After few seconds, in the textarea should appear this output: 16384+0 records in 16384+0 records out 8388608 bytes (8.0MB) copied, 4.038820 seconds, 2.0MB/s 384+0 records in 384+0 records out 196608 bytes (192.0KB) copied, 0.095180 seconds, 2.0MB/s 128+0 records in 128+0 records out 65536 bytes (64.0KB) copied, 0.032020 seconds, 2.0MB/s 128+0 records in 128+0 records out 65536 bytes (64.0KB) copied, 0.031760 seconds, 2.0MB/s 15744+0 records in 15744+0 records out 8060928 bytes (7.7MB) copied, 3.885280 seconds, 2.0MB/s dd: can't open '/dev/mtd5ro': No such device dd: can't open '/dev/mtd6ro': No such device dd: can't open '/dev/mtd7ro': No such device Excluding the "X.XXXXXX seconds" part, you should get the same exact output. If your output doesn't match mine, stop reading and ask for help in the forum. 5) Open the following links to download the partitions of the OEM FW: http://192.168.10.1/dev/mtd0ro http://192.168.10.1/dev/mtd1ro http://192.168.10.1/dev/mtd2ro http://192.168.10.1/dev/mtd3ro http://192.168.10.1/dev/mtd4ro If one (or more) of these files weight 0 byte, stop reading and ask for help in the forum. 6) Store these downloaded files in a safe place. 7) Reboot your router to remove any temporary file from your router. Installation ------------ Flash the initramfs image in the OEM firmware interface. When openwrt boots, flash the sysupgrade image otherwise you won't be able to keep configuration between reboots. Restore OEM Firmware -------------------- Flash the "mtd4ro" file you previously backed-up directly from LUCI. Warning: Remember to not keep settings! Warning2: Remember to force the flash. Notes ----- 1) The "System Command" page allows to run every command as root. For example you can use "dd" and "nc" to backup the OEM firmware. PC (SERVER): nc -l 5555 > ./mtdXro ROUTER (CLIENT): dd if=/dev/mtdXro | nc PC_IP_ADDRESS 5555 2) The OEM web interface accepts only images containing the string "WN583A6" in the filename. Currently the OEM interface accepts only the initramfs image probably because it checks if the ih_size in the image header is equal to the whole image size (instead of the kernel size) Read more here: https://forum.openwrt.org/t/support-for-strong-1200/22768/19 3) The white led (namely "Smart Night Light") can be controller by the user only if the side switch is set to "Schedule" otherwise it will be activated by the light condition (there is a photodiode on the top side of the router) 4) Router mac addresses: LAN XX:XX:XX:XX:XX:8F WAN XX:XX:XX:XX:XX:90 WIFI 2G XX:XX:XX:XX:XX:91 WIFI 5G XX:XX:XX:XX:XX:92 LABEL XX:XX:XX:XX:XX:91 Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> [remove chosen node, fix whitespace] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-16 21:29:27 +00:00
define Device/winstars_ws-wn583a6
$(Device/dsa-migration)
ramips: add support for Winstars WS-WN583A6 The Winstars WS-WN583A6 is a wireless repeater with 2 gigabit ethernet ports. Even if mine is branded as "Gemeita AC2100", the sticker on the back says WS-WN583A6. So I will refer to it as Winstars WS-WN583A6. Probably the real product name is the Wavlink WL-WN583A6 because of the many references to Wavlink in the OEM firmware and bootlog. Hardware -------- SoC: Mediatek MT7621AT (880 MHz, 2 cores 4 threads) RAM: 128MB FLASH: 8MB NOR (GigaDevice GD25Q64B) ETH: 2x 10/100/1000 Mbps Ethernet (MT7530) WIFI: - 2.4GHz: 1x MT7603E (2x2:2) - 5GHz: 1x MT7615E (4x4:4) - 6 internal antennas BTN: - 1x Reset button - 1x WPS button - 1x ON/OFF switch (working but unmodifiable) - 1x Auto/Schedule switch (working but unmodifiable. Read Note #3) LEDS: - 1x White led - 1x Red led - 1x Amber led - 1x Blue led - 2x Blue leds (lan and wan port status: working but unmodifiable) UART: - 57600-8-N-1 Everything works correctly. Currently there is no firmware update available. Because of this, in order to restore the OEM firmware, you must firstly dump the OEM firmware from your router before you flash the OpenWrt image. Backup the OEM Firmware ----------------------- The following steps are to be intended for users having little to none experience in linux. Obviously there are many ways to backup the OEM firmware, but probably this is the easiest way for this router. Procedure tested on M83A6.V5030.191210 firmware version. 1) Go to http://192.168.10.1/webcmd.shtml 2) Type the following line in the "Command" input box: mkdir /etc_ro/lighttpd/www/dev; for i in /dev/mtd*ro; do dd if=${i} of=/etc_ro/lighttpd/www${i}; done 3) Click "Apply" 4) After few seconds, in the textarea should appear this output: 16384+0 records in 16384+0 records out 8388608 bytes (8.0MB) copied, 4.038820 seconds, 2.0MB/s 384+0 records in 384+0 records out 196608 bytes (192.0KB) copied, 0.095180 seconds, 2.0MB/s 128+0 records in 128+0 records out 65536 bytes (64.0KB) copied, 0.032020 seconds, 2.0MB/s 128+0 records in 128+0 records out 65536 bytes (64.0KB) copied, 0.031760 seconds, 2.0MB/s 15744+0 records in 15744+0 records out 8060928 bytes (7.7MB) copied, 3.885280 seconds, 2.0MB/s dd: can't open '/dev/mtd5ro': No such device dd: can't open '/dev/mtd6ro': No such device dd: can't open '/dev/mtd7ro': No such device Excluding the "X.XXXXXX seconds" part, you should get the same exact output. If your output doesn't match mine, stop reading and ask for help in the forum. 5) Open the following links to download the partitions of the OEM FW: http://192.168.10.1/dev/mtd0ro http://192.168.10.1/dev/mtd1ro http://192.168.10.1/dev/mtd2ro http://192.168.10.1/dev/mtd3ro http://192.168.10.1/dev/mtd4ro If one (or more) of these files weight 0 byte, stop reading and ask for help in the forum. 6) Store these downloaded files in a safe place. 7) Reboot your router to remove any temporary file from your router. Installation ------------ Flash the initramfs image in the OEM firmware interface. When openwrt boots, flash the sysupgrade image otherwise you won't be able to keep configuration between reboots. Restore OEM Firmware -------------------- Flash the "mtd4ro" file you previously backed-up directly from LUCI. Warning: Remember to not keep settings! Warning2: Remember to force the flash. Notes ----- 1) The "System Command" page allows to run every command as root. For example you can use "dd" and "nc" to backup the OEM firmware. PC (SERVER): nc -l 5555 > ./mtdXro ROUTER (CLIENT): dd if=/dev/mtdXro | nc PC_IP_ADDRESS 5555 2) The OEM web interface accepts only images containing the string "WN583A6" in the filename. Currently the OEM interface accepts only the initramfs image probably because it checks if the ih_size in the image header is equal to the whole image size (instead of the kernel size) Read more here: https://forum.openwrt.org/t/support-for-strong-1200/22768/19 3) The white led (namely "Smart Night Light") can be controller by the user only if the side switch is set to "Schedule" otherwise it will be activated by the light condition (there is a photodiode on the top side of the router) 4) Router mac addresses: LAN XX:XX:XX:XX:XX:8F WAN XX:XX:XX:XX:XX:90 WIFI 2G XX:XX:XX:XX:XX:91 WIFI 5G XX:XX:XX:XX:XX:92 LABEL XX:XX:XX:XX:XX:91 Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> [remove chosen node, fix whitespace] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-16 21:29:27 +00:00
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 7872k
DEVICE_VENDOR := Winstars
DEVICE_MODEL := WS-WN583A6
DEVICE_ALT0_VENDOR := Gemeita
DEVICE_ALT0_MODEL := AC2100
KERNEL_INITRAMFS_SUFFIX := -WN583A6$$(KERNEL_SUFFIX)
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware -uboot-envtools
ramips: add support for Winstars WS-WN583A6 The Winstars WS-WN583A6 is a wireless repeater with 2 gigabit ethernet ports. Even if mine is branded as "Gemeita AC2100", the sticker on the back says WS-WN583A6. So I will refer to it as Winstars WS-WN583A6. Probably the real product name is the Wavlink WL-WN583A6 because of the many references to Wavlink in the OEM firmware and bootlog. Hardware -------- SoC: Mediatek MT7621AT (880 MHz, 2 cores 4 threads) RAM: 128MB FLASH: 8MB NOR (GigaDevice GD25Q64B) ETH: 2x 10/100/1000 Mbps Ethernet (MT7530) WIFI: - 2.4GHz: 1x MT7603E (2x2:2) - 5GHz: 1x MT7615E (4x4:4) - 6 internal antennas BTN: - 1x Reset button - 1x WPS button - 1x ON/OFF switch (working but unmodifiable) - 1x Auto/Schedule switch (working but unmodifiable. Read Note #3) LEDS: - 1x White led - 1x Red led - 1x Amber led - 1x Blue led - 2x Blue leds (lan and wan port status: working but unmodifiable) UART: - 57600-8-N-1 Everything works correctly. Currently there is no firmware update available. Because of this, in order to restore the OEM firmware, you must firstly dump the OEM firmware from your router before you flash the OpenWrt image. Backup the OEM Firmware ----------------------- The following steps are to be intended for users having little to none experience in linux. Obviously there are many ways to backup the OEM firmware, but probably this is the easiest way for this router. Procedure tested on M83A6.V5030.191210 firmware version. 1) Go to http://192.168.10.1/webcmd.shtml 2) Type the following line in the "Command" input box: mkdir /etc_ro/lighttpd/www/dev; for i in /dev/mtd*ro; do dd if=${i} of=/etc_ro/lighttpd/www${i}; done 3) Click "Apply" 4) After few seconds, in the textarea should appear this output: 16384+0 records in 16384+0 records out 8388608 bytes (8.0MB) copied, 4.038820 seconds, 2.0MB/s 384+0 records in 384+0 records out 196608 bytes (192.0KB) copied, 0.095180 seconds, 2.0MB/s 128+0 records in 128+0 records out 65536 bytes (64.0KB) copied, 0.032020 seconds, 2.0MB/s 128+0 records in 128+0 records out 65536 bytes (64.0KB) copied, 0.031760 seconds, 2.0MB/s 15744+0 records in 15744+0 records out 8060928 bytes (7.7MB) copied, 3.885280 seconds, 2.0MB/s dd: can't open '/dev/mtd5ro': No such device dd: can't open '/dev/mtd6ro': No such device dd: can't open '/dev/mtd7ro': No such device Excluding the "X.XXXXXX seconds" part, you should get the same exact output. If your output doesn't match mine, stop reading and ask for help in the forum. 5) Open the following links to download the partitions of the OEM FW: http://192.168.10.1/dev/mtd0ro http://192.168.10.1/dev/mtd1ro http://192.168.10.1/dev/mtd2ro http://192.168.10.1/dev/mtd3ro http://192.168.10.1/dev/mtd4ro If one (or more) of these files weight 0 byte, stop reading and ask for help in the forum. 6) Store these downloaded files in a safe place. 7) Reboot your router to remove any temporary file from your router. Installation ------------ Flash the initramfs image in the OEM firmware interface. When openwrt boots, flash the sysupgrade image otherwise you won't be able to keep configuration between reboots. Restore OEM Firmware -------------------- Flash the "mtd4ro" file you previously backed-up directly from LUCI. Warning: Remember to not keep settings! Warning2: Remember to force the flash. Notes ----- 1) The "System Command" page allows to run every command as root. For example you can use "dd" and "nc" to backup the OEM firmware. PC (SERVER): nc -l 5555 > ./mtdXro ROUTER (CLIENT): dd if=/dev/mtdXro | nc PC_IP_ADDRESS 5555 2) The OEM web interface accepts only images containing the string "WN583A6" in the filename. Currently the OEM interface accepts only the initramfs image probably because it checks if the ih_size in the image header is equal to the whole image size (instead of the kernel size) Read more here: https://forum.openwrt.org/t/support-for-strong-1200/22768/19 3) The white led (namely "Smart Night Light") can be controller by the user only if the side switch is set to "Schedule" otherwise it will be activated by the light condition (there is a photodiode on the top side of the router) 4) Router mac addresses: LAN XX:XX:XX:XX:XX:8F WAN XX:XX:XX:XX:XX:90 WIFI 2G XX:XX:XX:XX:XX:91 WIFI 5G XX:XX:XX:XX:XX:92 LABEL XX:XX:XX:XX:XX:91 Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> [remove chosen node, fix whitespace] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-16 21:29:27 +00:00
endef
TARGET_DEVICES += winstars_ws-wn583a6
define Device/xiaomi_nand_separate
$(Device/nand)
ramips: Add support for Xiaomi Mi Router(Black,R2100) The Xiaomi Mi Router AC2100 is a *black* cylindrical router that shares many characteristics (apart from its looks and the GPIO ports) with the 6-antenna *white* "Xiaomi Redmi Router AC2100" See the visual comparison of the two routers here: https://github.com/emirefek/openwrt-R2100/raw/imgcdn/rm2100-r2100.jpg Specification of R2100: - CPU: MediaTek MT7621A - RAM: 128 MB DDR3 - FLASH: 128 MB ESMT NAND - WIFI: 2x2 802.11bgn (MT7603) - WIFI: 4x4 802.11ac (MT7615) - ETH: 3xLAN+1xWAN 1000base-T - LED: Power, WAN in Yellow and Blue - UART: On board (Don't know where is should be confirmed by anybody else) - Modified u-boot Hacking of official firmware process is same at both RM2100 and R2100. Thanks to @namidairo Here is the detailed guide Hack: https://github.com/impulse/ac2100-openwrt-guide Guide is written for MacOS but it will work at linux. needed packages: python3(with scapy), netcat, http server, telnet client 1. Run PPPoE&exploit to get nc and wget busybox, get telnet and wget firmware 2. mtd write openwrt-ramips-mt7621-xiaomi_mi-router-ac2100-kernel1.bin kernel1 3. nvram set uart_en=1 4. nvram set bootdelay=5 5. nvram set flag_try_sys1_failed=1 6. nvram commit 7. mtd -r write openwrt-ramips-mt7621-xiaomi_mi-router-ac2100-rootfs0.bin rootfs0 other than these I specified in here. Everything is same with: https://github.com/openwrt/openwrt/commit/f3792690c4f0567a8965d82898295b9d50c3bb7e Thanks for all community and especially for this device: @Ilyas @scp07 @namidairo @Percy @thorsten97 @impulse (names@forum.openwrt.com) MAC Locations: WAN *:b5 = factory 0xe006 LAN *:b6 = factory 0xe000 WIFI 5ghz *:b8 = factory 0x8004 WIFI 2.4ghz *:b7 = factory 0x0004 Signed-off-by: Emir Efe Kucuk <emirefek@gmail.com> [refactored common image bits into Device/xiaomi-ac2100, fixed From:] Signed-off-by: Petr Štetiar <ynezz@true.cz>
2020-05-30 09:18:50 +00:00
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := Xiaomi
ramips: Add support for Xiaomi Mi Router(Black,R2100) The Xiaomi Mi Router AC2100 is a *black* cylindrical router that shares many characteristics (apart from its looks and the GPIO ports) with the 6-antenna *white* "Xiaomi Redmi Router AC2100" See the visual comparison of the two routers here: https://github.com/emirefek/openwrt-R2100/raw/imgcdn/rm2100-r2100.jpg Specification of R2100: - CPU: MediaTek MT7621A - RAM: 128 MB DDR3 - FLASH: 128 MB ESMT NAND - WIFI: 2x2 802.11bgn (MT7603) - WIFI: 4x4 802.11ac (MT7615) - ETH: 3xLAN+1xWAN 1000base-T - LED: Power, WAN in Yellow and Blue - UART: On board (Don't know where is should be confirmed by anybody else) - Modified u-boot Hacking of official firmware process is same at both RM2100 and R2100. Thanks to @namidairo Here is the detailed guide Hack: https://github.com/impulse/ac2100-openwrt-guide Guide is written for MacOS but it will work at linux. needed packages: python3(with scapy), netcat, http server, telnet client 1. Run PPPoE&exploit to get nc and wget busybox, get telnet and wget firmware 2. mtd write openwrt-ramips-mt7621-xiaomi_mi-router-ac2100-kernel1.bin kernel1 3. nvram set uart_en=1 4. nvram set bootdelay=5 5. nvram set flag_try_sys1_failed=1 6. nvram commit 7. mtd -r write openwrt-ramips-mt7621-xiaomi_mi-router-ac2100-rootfs0.bin rootfs0 other than these I specified in here. Everything is same with: https://github.com/openwrt/openwrt/commit/f3792690c4f0567a8965d82898295b9d50c3bb7e Thanks for all community and especially for this device: @Ilyas @scp07 @namidairo @Percy @thorsten97 @impulse (names@forum.openwrt.com) MAC Locations: WAN *:b5 = factory 0xe006 LAN *:b6 = factory 0xe000 WIFI 5ghz *:b8 = factory 0x8004 WIFI 2.4ghz *:b7 = factory 0x0004 Signed-off-by: Emir Efe Kucuk <emirefek@gmail.com> [refactored common image bits into Device/xiaomi-ac2100, fixed From:] Signed-off-by: Petr Štetiar <ynezz@true.cz>
2020-05-30 09:18:50 +00:00
IMAGES += kernel1.bin rootfs0.bin
IMAGE/kernel1.bin := append-kernel
IMAGE/rootfs0.bin := append-ubi | check-size
endef
define Device/xiaomi_mi-router-3g
$(Device/xiaomi_nand_separate)
DEVICE_MODEL := Mi Router 3G
IMAGE_SIZE := 124416k
DEVICE_PACKAGES += kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
SUPPORTED_DEVICES += R3G mir3g xiaomi,mir3g
endef
TARGET_DEVICES += xiaomi_mi-router-3g
define Device/xiaomi_mi-router-3g-v2
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 14848k
DEVICE_VENDOR := Xiaomi
DEVICE_MODEL := Mi Router 3G
DEVICE_VARIANT := v2
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 -uboot-envtools
SUPPORTED_DEVICES += xiaomi,mir3g-v2
endef
TARGET_DEVICES += xiaomi_mi-router-3g-v2
define Device/xiaomi_mi-router-3-pro
$(Device/nand)
$(Device/uimage-lzma-loader)
ramips/mt7621: fix IMAGE_SIZE for all devices This fixes IMAGE_SIZE for all devices based on the partition size given in DTS: DEVICE *.MK *.DTS VERDICT afoundry_ew1200 (16M) 0xfb0000 asiarf_ap7621-001 (16M) 0xfa0000 wrong buffalo_wsr-1166dhp (16M) 0xf90000 wrong buffalo_wsr-600dhp (16M) 0xfb0000 dlink_dir-860l-b1 (16M) 0xfb0000 d-team_newifi-d2 (32M) 0x1fb0000 d-team_pbr-m1 (16M) 0xfb0000 elecom_wrc-1167ghbk2-s 15488k 0xf20000 elecom_wrc-1900gst 11264k 0xb00000 elecom_wrc-2533gst 11264k 0xb00000 firefly_firewrt (16M) 0xfb0000 gehua_ghl-r-001 (32M) 0x1fb0000 gnubee_gb-pc1 (32M) 0x1fb0000 gnubee_gb-pc2 (32M) 0x1fb0000 hiwifi_hc5962 (32M) 0x2000000 wrong (kernel + ubi) iodata_wn-ax1167gr 15552k 0xf30000 iodata_wn-gx300gr 7798784 0x770000 lenovo_newifi-d1 (32M) 0x1fb0000 linksys_re6500 - 0x7b0000 default mediatek_ap-mt7621a-v60 (8M) 0x7b0000 mediatek_mt7621-eval-board (4M) 0xec0000 wrong (rootfs) mikrotik_rb750gr3 [16128k] 0xfc0000 mikrotik_rbm11g [16128k] 0xFC0000 mikrotik_rbm33g [16128k] 0xFC0000 mqmaker_witi-256m (16M) 0xfb0000 mqmaker_witi-512m (16M) 0xfb0000 mtc_wr1201 16000k 0xfa0000 netgear_ex6150 14848k 0xe80000 netgear_r6220 28672k 0x1c00000 netgear_r6350 40960k 0x2800000 netgear_wndr3700-v5 15232k 0xee0000 netis_wf-2881 129280k 0x7E40000 phicomm_k2p 15744k 0xf60000 planex_vr500 66453504 0x3fb0000 wrong samknows_whitebox-v8 (16M) 0xfb0000 storylink_sap-g3200u3 - 0x7b0000 default telco-electronics_x1 16064k 0xfb0000 thunder_timecloud - 0xfb0000 wrong totolink_a7000r 16064k 0xfb0000 tplink_re350-v1 6016k 0x5e0000 ubiquiti_edgerouterx - 0xfa00000 wrong (kernel1 + ubi) ubiquiti_edgerouterx-sfp - 0xfa00000 wrong (kernel1 + ubi) unielec_u7621-06-256m-16m 16064k 0xfb0000 unielec_u7621-06-512m-64m 65216k 0x3fb0000 wevo_11acnas (16M) 0xfb0000 wevo_w2914ns-v2 (16M) 0xfb0000 xiaomi_mir3g 32768k 0x7980000 wrong (kernel + ubi) xiaomi_mir3p (32M) 0xf980000 wrong (kernel + ubi) xzwifi_creativebox-v1 (32M) 0x1fb0000 youhua_wr1200js 16064k 0xfb0000 youku_yk-l2 (16M) 0xfb0000 zbtlink_zbt-we1326 (16M) 0xfb0000 zbtlink_zbt-we3526 (16M) 0xfb0000 zbtlink_zbt-wg2626 (16M) 0xfb0000 zbtlink_zbt-wg3526-16m (16M) 0xfb0000 zbtlink_zbt-wg3526-32m (32M) 0x1fb0000 No verdict means that the device is correctly set. Legend: ( ): Value is set via ralink_default_fw_size_xxM [ ]: Value is derived from parent definition - : Value is not set and derived from default definition Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-07-15 12:55:24 +00:00
IMAGE_SIZE := 255488k
DEVICE_VENDOR := Xiaomi
DEVICE_MODEL := Mi Router 3 Pro
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
check-size
DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 kmod-usb-ledtrig-usbport
SUPPORTED_DEVICES += xiaomi,mir3p
endef
TARGET_DEVICES += xiaomi_mi-router-3-pro
ramips: mt7621: add support for Xiaomi Mi Router 4 Xiaomi Mi Router 4 is the same as Xiaomi Mi Router 3G, except for the RAM (256Mib→128Mib), LEDs and gpio (MiNet button). Specifications: Power: 12 VDC, 1 A Connector type: barrel CPU1: MediaTek MT7621A (880 MHz, 4 cores) FLA1: 128 MiB (ESMT F59L1G81MA) RAM1: 128 MiB (ESMT M15T1G1664A) WI1 chip1: MediaTek MT7603EN WI1 802dot11 protocols: bgn WI1 MIMO config: 2x2:2 WI1 antenna connector: U.FL WI2 chip1: MediaTek MT7612EN WI2 802dot11 protocols: an+ac WI2 MIMO config: 2x2:2 WI2 antenna connector: U.FL ETH chip1: MediaTek MT7621A Switch: MediaTek MT7621A UART Serial [o] TX [o] GND [o] RX [ ] VCC - Do not connect it MAC addresses as verified by OEM firmware: use address source LAN *:c2 factory 0xe000 (label) WAN *:c3 factory 0xe006 2g *:c4 factory 0x0000 5g *:c5 factory 0x8000 Flashing instructions: 1.Create a simple http server (nginx etc) 2.set uart enable To enable writing to the console, you must reset to factory settings Then you see uboot boot, press the keyboard 4 button (enter uboot command line) If it is not successful, repeat the above operation of restoring the factory settings. After entering the uboot command line, type: setenv uart_en 1 saveenv boot 3.use shell in uart cd /tmp wget http://"your_computer_ip:80"/openwrt-ramips-mt7621-xiaomi_mir4-squashfs-kernel1.bin wget http://"your_computer_ip:80"/openwrt-ramips-mt7621-xiaomi_mir4-squashfs-rootfs0.bin mtd write openwrt-ramips-mt7621-xiaomi_mir4-squashfs-kernel1.bin kernel1 mtd write openwrt-ramips-mt7621-xiaomi_mir4-squashfs-rootfs0.bin rootfs0 nvram set flag_try_sys1_failed=1 nvram commit reboot 4.login to the router http://192.168.1.1/ Installation via Software exploit Find the instructions in the https://github.com/acecilia/OpenWRTInvasion Signed-off-by: Dmytro Oz <sequentiality@gmail.com> [commit message facelift, rebase onto shared DTSI/common device definition, bump uboot-envtools] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-14 19:07:32 +00:00
define Device/xiaomi_mi-router-4
$(Device/xiaomi_nand_separate)
DEVICE_MODEL := Mi Router 4
IMAGE_SIZE := 124416k
DEVICE_PACKAGES += kmod-mt7603 kmod-mt76x2
endef
TARGET_DEVICES += xiaomi_mi-router-4
ramips: add Xiaomi Mi Router 4A Gigabit explicitly This device has previously been supported by the image for Xiaomi Mi Router 3G v2. Since this is not obvious, the 4A is marketed as a new major revision and it also seems to have a different bootloader, this will be both more tidy and more helpful for the users. Apart from that, note that there also is a 100M version of the device that uses mt7628 platform, so a specifically named image will also prevent confusion in this area. Specifications: - SoC: MediaTek MT7621 - Flash: 16 MiB NOR SPI - RAM: 128 MiB DDR3 - Ethernet: 3x 10/100/1000 Mbps (switched, 2xLAN + WAN) - WIFI0: MT7603E 2.4GHz 802.11b/g/n - WIFI1: MT7612E 5GHz 802.11ac - Antennas: 4x external (2 per radio), non-detachable - LEDs: Programmable "power" LED (two-coloured, yellow/blue) Non-programmable "internet" LED (shows WAN activity) - Buttons: Reset Installation: Bootloader won't accept any serial input unless "boot_wait" u-boot environment variable is changed to "on". Vendor firmware won't accept any serial input until "uart_en" is set to "1". Using the https://github.com/acecilia/OpenWRTInvasion exploit you can gain access to shell to enable these options: To enable uart keyboard actions - 'nvram set uart_en=1' To make uboot delay boot work - 'nvram set boot_wait=on' Set boot delay to 5 - 'nvram set bootdelay=5' Then run 'nvram commit' to make the changes permanent. Once in the shell (following the OpenWRTInvasion instructions) you can then run the following to flash OpenWrt and then reboot: 'cd /tmp; curl https://downloads.openwrt.org/...-sysupgrade.bin --output firmware.bin; mtd -e OS1 -r write firmware.bin OS1' Suggested-by: David Bentham <db260179@gmail.com> Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-11-12 15:00:10 +00:00
define Device/xiaomi_mi-router-4a-gigabit
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 14848k
DEVICE_VENDOR := Xiaomi
DEVICE_MODEL := Mi Router 4A
DEVICE_VARIANT := Gigabit Edition
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 -uboot-envtools
ramips: add Xiaomi Mi Router 4A Gigabit explicitly This device has previously been supported by the image for Xiaomi Mi Router 3G v2. Since this is not obvious, the 4A is marketed as a new major revision and it also seems to have a different bootloader, this will be both more tidy and more helpful for the users. Apart from that, note that there also is a 100M version of the device that uses mt7628 platform, so a specifically named image will also prevent confusion in this area. Specifications: - SoC: MediaTek MT7621 - Flash: 16 MiB NOR SPI - RAM: 128 MiB DDR3 - Ethernet: 3x 10/100/1000 Mbps (switched, 2xLAN + WAN) - WIFI0: MT7603E 2.4GHz 802.11b/g/n - WIFI1: MT7612E 5GHz 802.11ac - Antennas: 4x external (2 per radio), non-detachable - LEDs: Programmable "power" LED (two-coloured, yellow/blue) Non-programmable "internet" LED (shows WAN activity) - Buttons: Reset Installation: Bootloader won't accept any serial input unless "boot_wait" u-boot environment variable is changed to "on". Vendor firmware won't accept any serial input until "uart_en" is set to "1". Using the https://github.com/acecilia/OpenWRTInvasion exploit you can gain access to shell to enable these options: To enable uart keyboard actions - 'nvram set uart_en=1' To make uboot delay boot work - 'nvram set boot_wait=on' Set boot delay to 5 - 'nvram set bootdelay=5' Then run 'nvram commit' to make the changes permanent. Once in the shell (following the OpenWRTInvasion instructions) you can then run the following to flash OpenWrt and then reboot: 'cd /tmp; curl https://downloads.openwrt.org/...-sysupgrade.bin --output firmware.bin; mtd -e OS1 -r write firmware.bin OS1' Suggested-by: David Bentham <db260179@gmail.com> Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-11-12 15:00:10 +00:00
endef
TARGET_DEVICES += xiaomi_mi-router-4a-gigabit
ramips: mt7621: add support for Xiaomi Mi Router 4A Gigabit v2 Device is the same as Xiaomi Mi Router 4A Gigabit, except of: - 5G WiFi is MT7663 - addresses of leds, wifi and eth ports are slightly changed Specs: SoC: MT7621 CPU: 2 x 880 MHz ROM: 16 MB RAM: 128 MB WLAN: MT7603, MT7663 MAC addresses: WAN **** factory 0xe006 (label) LAN *:f7 factory 0xe000 2.4 GHz *:f8 factory 0x0000+0x4 (mtd-eeprom+0x4) 5 GHz *:f9 factory 0x8000+0x4 (mtd-eeprom+0x4) Installation: Factory firmware is based on a custom OpenWrt 17.x. Installation is the same as for Xiaomi Mi Router 4A Gigabit. Probably the easiest way to install is to use the script from this repository: https://github.com/acecilia/OpenWRTInvasion/pull/155 In a more advanced case, you can do everything yourself: - gain access to the device through one of the exploits described in the link above - upload sysupgrade image to /tmp - overwrite stock firmware: # mtd -e OS1 -r write /tmp/sysupgrade.bin OS1 Recovery: Recovery procedure is the same as for Xiaomi Mi Router 4A Gigabit. Possible options can be found here: https://openwrt.org/inbox/toh/xiaomi/xiaomi_mi_router_4a_gigabit_edition One of the ways is to use another router with OpenWrt: - connect both routers by their LAN ports - download stock firmware from [1] - place it inside /tmp/test.bin on the main router - configure PXE/TFTP on the main router - power off 4Av2, hold Reset button, power on - as soon as image download via TFTP starts, Reset can be released - blinking blue wan LED will indicate the end of the flashing process, now router can be rebooted [1] http://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/r4av2/miwifi_r4av2_firmware_release_2.30.28.bin Signed-off-by: Dmitry Sokolov <e323w@proton.me>
2023-01-15 21:52:27 +00:00
define Device/xiaomi_mi-router-4a-gigabit-v2
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 14784k
DEVICE_VENDOR := Xiaomi
DEVICE_MODEL := Mi Router 4A
DEVICE_VARIANT := Gigabit Edition v2
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
-uboot-envtools
ramips: mt7621: add support for Xiaomi Mi Router 4A Gigabit v2 Device is the same as Xiaomi Mi Router 4A Gigabit, except of: - 5G WiFi is MT7663 - addresses of leds, wifi and eth ports are slightly changed Specs: SoC: MT7621 CPU: 2 x 880 MHz ROM: 16 MB RAM: 128 MB WLAN: MT7603, MT7663 MAC addresses: WAN **** factory 0xe006 (label) LAN *:f7 factory 0xe000 2.4 GHz *:f8 factory 0x0000+0x4 (mtd-eeprom+0x4) 5 GHz *:f9 factory 0x8000+0x4 (mtd-eeprom+0x4) Installation: Factory firmware is based on a custom OpenWrt 17.x. Installation is the same as for Xiaomi Mi Router 4A Gigabit. Probably the easiest way to install is to use the script from this repository: https://github.com/acecilia/OpenWRTInvasion/pull/155 In a more advanced case, you can do everything yourself: - gain access to the device through one of the exploits described in the link above - upload sysupgrade image to /tmp - overwrite stock firmware: # mtd -e OS1 -r write /tmp/sysupgrade.bin OS1 Recovery: Recovery procedure is the same as for Xiaomi Mi Router 4A Gigabit. Possible options can be found here: https://openwrt.org/inbox/toh/xiaomi/xiaomi_mi_router_4a_gigabit_edition One of the ways is to use another router with OpenWrt: - connect both routers by their LAN ports - download stock firmware from [1] - place it inside /tmp/test.bin on the main router - configure PXE/TFTP on the main router - power off 4Av2, hold Reset button, power on - as soon as image download via TFTP starts, Reset can be released - blinking blue wan LED will indicate the end of the flashing process, now router can be rebooted [1] http://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/r4av2/miwifi_r4av2_firmware_release_2.30.28.bin Signed-off-by: Dmitry Sokolov <e323w@proton.me>
2023-01-15 21:52:27 +00:00
endef
TARGET_DEVICES += xiaomi_mi-router-4a-gigabit-v2
define Device/xiaomi_mi-router-ac2100
$(Device/xiaomi_nand_separate)
DEVICE_MODEL := Mi Router AC2100
IMAGE_SIZE := 120320k
DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615-firmware -uboot-envtools
endef
TARGET_DEVICES += xiaomi_mi-router-ac2100
ramips: add support for Xiaomi Mi Router CR660x series Xiaomi Mi Router CR6606 is a Wi-Fi6 AX1800 Router with 4 GbE Ports. Alongside the general model, it has three carrier customized models: CR6606 (China Unicom), CR6608 (China Mobile), CR6609 (China Telecom) Specifications: - SoC: MediaTek MT7621AT - RAM: 256MB DDR3 (ESMT M15T2G16128A) - Flash: 128MB NAND (ESMT F59L1G81MB) - Ethernet: 1000Base-T x4 (MT7530 SoC) - WLAN: 2x2 2.4GHz 574Mbps + 2x2 5GHz 1201Mbps (MT7905DAN + MT7975DN) - LEDs: System (Blue, Yellow), Internet (Blue, Yellow) - Buttons: Reset, WPS - UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1) - Power: 12VDC, 1A Jailbreak Notes: 1. Get shell access. 1.1. Get yourself a wireless router that runs OpenWrt already. 1.2. On the OpenWrt router: 1.2.1. Access its console. 1.2.2. Create and edit /usr/lib/lua/luci/controller/admin/xqsystem.lua with the following code (exclude backquotes and line no.): ``` 1 module("luci.controller.admin.xqsystem", package.seeall) 2 3 function index() 4 local page = node("api") 5 page.target = firstchild() 6 page.title = ("") 7 page.order = 100 8 page.index = true 9 page = node("api","xqsystem") 10 page.target = firstchild() 11 page.title = ("") 12 page.order = 100 13 page.index = true 14 entry({"api", "xqsystem", "token"}, call("getToken"), (""), 103, 0x08) 15 end 16 17 local LuciHttp = require("luci.http") 18 19 function getToken() 20 local result = {} 21 result["code"] = 0 22 result["token"] = "; nvram set ssh_en=1; nvram commit; sed -i 's/channel=.*/channel=\"debug\"/g' /etc/init.d/dropbear; /etc/init.d/drop bear start;" 23 LuciHttp.write_json(result) 24 end ``` 1.2.3. Browse http://{OWRT_ADDR}/cgi-bin/luci/api/xqsystem/token It should give you a respond like this: {"code":0,"token":"; nvram set ssh_en=1; nvram commit; ..."} If so, continue; Otherwise, check the file, reboot the rout- er, try again. 1.2.4. Set wireless network interface's IP to 169.254.31.1, turn off DHCP of wireless interface's zone. 1.2.5. Connect to the router wirelessly, manually set your access device's IP to 169.254.31.3, make sure http://169.254.31.1/cgi-bin/luci/api/xqsystem/token still have a similar result as 1.2.3 shows. 1.3. On the Xiaomi CR660x: 1.3.1. Login to the web interface. Your would be directed to a page with URL like this: http://{ROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/web/home#r- outer 1.3.2. Browse this URL with {STOK} from 1.3.1, {WIFI_NAME} {PASSWORD} be your OpenWrt router's SSID and password: http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/misy- stem/extendwifi_connect?ssid={WIFI_NAME}&password={PASSWO- RD} It should return 0. 1.3.3. Browse this URL with {STOK} from 1.3.1: http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/xqsy- stem/oneclick_get_remote_token?username=xxx&password=xxx&- nonce=xxx 1.4. Before rebooting, you can now access your CR660x via SSH. For CR6606, you can calculate your root password by this project: https://github.com/wfjsw/xiaoqiang-root-password, or at https://www.oxygen7.cn/miwifi. The root password for carrier-specific models should be the admi- nistration password or the default login password on the label. It is also feasible to change the root password at the same time by modifying the script from step 1.2.2. You can treat OpenWrt Router however you like from this point as long as you don't mind go through this again if you have to expl- oit it again. If you do have to and left your OpenWrt router unt- ouched, start from 1.3. 2. There's no official binary firmware available, and if you lose the content of your flash, no one except Xiaomi can help you. Dump these partitions in case you need them: "Bootloader" "Nvram" "Bdata" "crash" "crash_log" "firmware" "firmware1" "overlay" "obr" Find the corespond block device from /proc/mtd Read from read-only block device to avoid misoperation. It's recommended to use /tmp/syslogbackup/ as destination, since files would be available at http://{ROUTER_ADDR}/backup/log/YOUR_DUMP Keep an eye on memory usage though. 3. Since UART access is locked ootb, you should get UART access by modify uboot env. Otherwise, your router may become bricked. Excute these in stock firmware shell: a. nvram set boot_wait=on b. nvram set bootdelay=3 c. nvram commit Or in OpenWrt: a. opkg update && opkg install kmod-mtd-rw b. insmod mtd-rw i_want_a_brick=1 c. fw_setenv boot_wait on d. fw_setenv bootdelay 3 e. rmmod mtd-rw Migrate to OpenWrt: 1. Transfer squashfs-firmware.bin to the router. 2. nvram set flag_try_sys1_failed=0 3. nvram set flag_try_sys2_failed=1 4. nvram commit 5. mtd -r write /path/to/image/squashfs-firmware.bin firmware Additional Info: 1. CR660x series routers has a different nand layout compared to other Xiaomi nand devices. 2. This router has a relatively fresh uboot (2018.09) compared to other Xiaomi devices, and it is capable of booting fit image firmware. Unfortunately, no successful attempt of booting OpenWrt fit image were made so far. The cause is still yet to be known. For now, we use legacy image instead. Signed-off-by: Raymond Wang <infiwang@pm.me>
2021-09-11 15:54:30 +00:00
define Device/xiaomi_mi-router-cr660x
$(Device/nand)
ramips: add support for Xiaomi Mi Router CR660x series Xiaomi Mi Router CR6606 is a Wi-Fi6 AX1800 Router with 4 GbE Ports. Alongside the general model, it has three carrier customized models: CR6606 (China Unicom), CR6608 (China Mobile), CR6609 (China Telecom) Specifications: - SoC: MediaTek MT7621AT - RAM: 256MB DDR3 (ESMT M15T2G16128A) - Flash: 128MB NAND (ESMT F59L1G81MB) - Ethernet: 1000Base-T x4 (MT7530 SoC) - WLAN: 2x2 2.4GHz 574Mbps + 2x2 5GHz 1201Mbps (MT7905DAN + MT7975DN) - LEDs: System (Blue, Yellow), Internet (Blue, Yellow) - Buttons: Reset, WPS - UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1) - Power: 12VDC, 1A Jailbreak Notes: 1. Get shell access. 1.1. Get yourself a wireless router that runs OpenWrt already. 1.2. On the OpenWrt router: 1.2.1. Access its console. 1.2.2. Create and edit /usr/lib/lua/luci/controller/admin/xqsystem.lua with the following code (exclude backquotes and line no.): ``` 1 module("luci.controller.admin.xqsystem", package.seeall) 2 3 function index() 4 local page = node("api") 5 page.target = firstchild() 6 page.title = ("") 7 page.order = 100 8 page.index = true 9 page = node("api","xqsystem") 10 page.target = firstchild() 11 page.title = ("") 12 page.order = 100 13 page.index = true 14 entry({"api", "xqsystem", "token"}, call("getToken"), (""), 103, 0x08) 15 end 16 17 local LuciHttp = require("luci.http") 18 19 function getToken() 20 local result = {} 21 result["code"] = 0 22 result["token"] = "; nvram set ssh_en=1; nvram commit; sed -i 's/channel=.*/channel=\"debug\"/g' /etc/init.d/dropbear; /etc/init.d/drop bear start;" 23 LuciHttp.write_json(result) 24 end ``` 1.2.3. Browse http://{OWRT_ADDR}/cgi-bin/luci/api/xqsystem/token It should give you a respond like this: {"code":0,"token":"; nvram set ssh_en=1; nvram commit; ..."} If so, continue; Otherwise, check the file, reboot the rout- er, try again. 1.2.4. Set wireless network interface's IP to 169.254.31.1, turn off DHCP of wireless interface's zone. 1.2.5. Connect to the router wirelessly, manually set your access device's IP to 169.254.31.3, make sure http://169.254.31.1/cgi-bin/luci/api/xqsystem/token still have a similar result as 1.2.3 shows. 1.3. On the Xiaomi CR660x: 1.3.1. Login to the web interface. Your would be directed to a page with URL like this: http://{ROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/web/home#r- outer 1.3.2. Browse this URL with {STOK} from 1.3.1, {WIFI_NAME} {PASSWORD} be your OpenWrt router's SSID and password: http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/misy- stem/extendwifi_connect?ssid={WIFI_NAME}&password={PASSWO- RD} It should return 0. 1.3.3. Browse this URL with {STOK} from 1.3.1: http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/xqsy- stem/oneclick_get_remote_token?username=xxx&password=xxx&- nonce=xxx 1.4. Before rebooting, you can now access your CR660x via SSH. For CR6606, you can calculate your root password by this project: https://github.com/wfjsw/xiaoqiang-root-password, or at https://www.oxygen7.cn/miwifi. The root password for carrier-specific models should be the admi- nistration password or the default login password on the label. It is also feasible to change the root password at the same time by modifying the script from step 1.2.2. You can treat OpenWrt Router however you like from this point as long as you don't mind go through this again if you have to expl- oit it again. If you do have to and left your OpenWrt router unt- ouched, start from 1.3. 2. There's no official binary firmware available, and if you lose the content of your flash, no one except Xiaomi can help you. Dump these partitions in case you need them: "Bootloader" "Nvram" "Bdata" "crash" "crash_log" "firmware" "firmware1" "overlay" "obr" Find the corespond block device from /proc/mtd Read from read-only block device to avoid misoperation. It's recommended to use /tmp/syslogbackup/ as destination, since files would be available at http://{ROUTER_ADDR}/backup/log/YOUR_DUMP Keep an eye on memory usage though. 3. Since UART access is locked ootb, you should get UART access by modify uboot env. Otherwise, your router may become bricked. Excute these in stock firmware shell: a. nvram set boot_wait=on b. nvram set bootdelay=3 c. nvram commit Or in OpenWrt: a. opkg update && opkg install kmod-mtd-rw b. insmod mtd-rw i_want_a_brick=1 c. fw_setenv boot_wait on d. fw_setenv bootdelay 3 e. rmmod mtd-rw Migrate to OpenWrt: 1. Transfer squashfs-firmware.bin to the router. 2. nvram set flag_try_sys1_failed=0 3. nvram set flag_try_sys2_failed=1 4. nvram commit 5. mtd -r write /path/to/image/squashfs-firmware.bin firmware Additional Info: 1. CR660x series routers has a different nand layout compared to other Xiaomi nand devices. 2. This router has a relatively fresh uboot (2018.09) compared to other Xiaomi devices, and it is capable of booting fit image firmware. Unfortunately, no successful attempt of booting OpenWrt fit image were made so far. The cause is still yet to be known. For now, we use legacy image instead. Signed-off-by: Raymond Wang <infiwang@pm.me>
2021-09-11 15:54:30 +00:00
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := Xiaomi
IMAGE_SIZE := 128512k
IMAGES += firmware.bin
IMAGE/firmware.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
check-size
DEVICE_PACKAGES += kmod-mt7915-firmware
ramips: add support for Xiaomi Mi Router CR660x series Xiaomi Mi Router CR6606 is a Wi-Fi6 AX1800 Router with 4 GbE Ports. Alongside the general model, it has three carrier customized models: CR6606 (China Unicom), CR6608 (China Mobile), CR6609 (China Telecom) Specifications: - SoC: MediaTek MT7621AT - RAM: 256MB DDR3 (ESMT M15T2G16128A) - Flash: 128MB NAND (ESMT F59L1G81MB) - Ethernet: 1000Base-T x4 (MT7530 SoC) - WLAN: 2x2 2.4GHz 574Mbps + 2x2 5GHz 1201Mbps (MT7905DAN + MT7975DN) - LEDs: System (Blue, Yellow), Internet (Blue, Yellow) - Buttons: Reset, WPS - UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1) - Power: 12VDC, 1A Jailbreak Notes: 1. Get shell access. 1.1. Get yourself a wireless router that runs OpenWrt already. 1.2. On the OpenWrt router: 1.2.1. Access its console. 1.2.2. Create and edit /usr/lib/lua/luci/controller/admin/xqsystem.lua with the following code (exclude backquotes and line no.): ``` 1 module("luci.controller.admin.xqsystem", package.seeall) 2 3 function index() 4 local page = node("api") 5 page.target = firstchild() 6 page.title = ("") 7 page.order = 100 8 page.index = true 9 page = node("api","xqsystem") 10 page.target = firstchild() 11 page.title = ("") 12 page.order = 100 13 page.index = true 14 entry({"api", "xqsystem", "token"}, call("getToken"), (""), 103, 0x08) 15 end 16 17 local LuciHttp = require("luci.http") 18 19 function getToken() 20 local result = {} 21 result["code"] = 0 22 result["token"] = "; nvram set ssh_en=1; nvram commit; sed -i 's/channel=.*/channel=\"debug\"/g' /etc/init.d/dropbear; /etc/init.d/drop bear start;" 23 LuciHttp.write_json(result) 24 end ``` 1.2.3. Browse http://{OWRT_ADDR}/cgi-bin/luci/api/xqsystem/token It should give you a respond like this: {"code":0,"token":"; nvram set ssh_en=1; nvram commit; ..."} If so, continue; Otherwise, check the file, reboot the rout- er, try again. 1.2.4. Set wireless network interface's IP to 169.254.31.1, turn off DHCP of wireless interface's zone. 1.2.5. Connect to the router wirelessly, manually set your access device's IP to 169.254.31.3, make sure http://169.254.31.1/cgi-bin/luci/api/xqsystem/token still have a similar result as 1.2.3 shows. 1.3. On the Xiaomi CR660x: 1.3.1. Login to the web interface. Your would be directed to a page with URL like this: http://{ROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/web/home#r- outer 1.3.2. Browse this URL with {STOK} from 1.3.1, {WIFI_NAME} {PASSWORD} be your OpenWrt router's SSID and password: http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/misy- stem/extendwifi_connect?ssid={WIFI_NAME}&password={PASSWO- RD} It should return 0. 1.3.3. Browse this URL with {STOK} from 1.3.1: http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/xqsy- stem/oneclick_get_remote_token?username=xxx&password=xxx&- nonce=xxx 1.4. Before rebooting, you can now access your CR660x via SSH. For CR6606, you can calculate your root password by this project: https://github.com/wfjsw/xiaoqiang-root-password, or at https://www.oxygen7.cn/miwifi. The root password for carrier-specific models should be the admi- nistration password or the default login password on the label. It is also feasible to change the root password at the same time by modifying the script from step 1.2.2. You can treat OpenWrt Router however you like from this point as long as you don't mind go through this again if you have to expl- oit it again. If you do have to and left your OpenWrt router unt- ouched, start from 1.3. 2. There's no official binary firmware available, and if you lose the content of your flash, no one except Xiaomi can help you. Dump these partitions in case you need them: "Bootloader" "Nvram" "Bdata" "crash" "crash_log" "firmware" "firmware1" "overlay" "obr" Find the corespond block device from /proc/mtd Read from read-only block device to avoid misoperation. It's recommended to use /tmp/syslogbackup/ as destination, since files would be available at http://{ROUTER_ADDR}/backup/log/YOUR_DUMP Keep an eye on memory usage though. 3. Since UART access is locked ootb, you should get UART access by modify uboot env. Otherwise, your router may become bricked. Excute these in stock firmware shell: a. nvram set boot_wait=on b. nvram set bootdelay=3 c. nvram commit Or in OpenWrt: a. opkg update && opkg install kmod-mtd-rw b. insmod mtd-rw i_want_a_brick=1 c. fw_setenv boot_wait on d. fw_setenv bootdelay 3 e. rmmod mtd-rw Migrate to OpenWrt: 1. Transfer squashfs-firmware.bin to the router. 2. nvram set flag_try_sys1_failed=0 3. nvram set flag_try_sys2_failed=1 4. nvram commit 5. mtd -r write /path/to/image/squashfs-firmware.bin firmware Additional Info: 1. CR660x series routers has a different nand layout compared to other Xiaomi nand devices. 2. This router has a relatively fresh uboot (2018.09) compared to other Xiaomi devices, and it is capable of booting fit image firmware. Unfortunately, no successful attempt of booting OpenWrt fit image were made so far. The cause is still yet to be known. For now, we use legacy image instead. Signed-off-by: Raymond Wang <infiwang@pm.me>
2021-09-11 15:54:30 +00:00
endef
define Device/xiaomi_mi-router-cr6606
$(Device/xiaomi_mi-router-cr660x)
DEVICE_MODEL := Mi Router CR6606
endef
TARGET_DEVICES += xiaomi_mi-router-cr6606
define Device/xiaomi_mi-router-cr6608
$(Device/xiaomi_mi-router-cr660x)
DEVICE_MODEL := Mi Router CR6608
endef
TARGET_DEVICES += xiaomi_mi-router-cr6608
define Device/xiaomi_mi-router-cr6609
$(Device/xiaomi_mi-router-cr660x)
DEVICE_MODEL := Mi Router CR6609
endef
TARGET_DEVICES += xiaomi_mi-router-cr6609
ramips: Add support for Xiaomi Redmi Router AC2100 (RM2100) Specification: - CPU: MediaTek MT7621A - RAM: 128 MB DDR3 - FLASH: 128 MB ESMT NAND - WIFI: 2x2 802.11bgn (MT7603) - WIFI: 4x4 802.11ac (MT7615) - ETH: 3xLAN+1xWAN 1000base-T - LED: Power, WAN, in Amber and White - UART: On board near ethernet, opposite side from power - Modified u-boot Installation: 1. Run linked exploit to get shell, startup telnet and wget the files over 2. mtd write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-kernel1.bin kernel1 3. nvram set uart_en=1 4. nvram set bootdelay=5 5. nvram set flag_try_sys1_failed=1 6. nvram commit 7. mtd -r write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-rootfs0.bin rootfs0 Restore to stock: 1. Setup PXE and TFTP server serving stock firmware image (See dhcp-boot option of dnsmasq) 2. Hold reset button down before powering on and wait for flashing amber led 3. Release reset button 4. Wait until status led changes from flashing amber to white Notes: This device has dual kernel and rootfs slots like other Xiaomi devices currently supported (mir3g, etc.) thus, we use the second slot and overwrite the first rootfs onwards in order to get more space. Exploit and detailed instructions: https://openwrt.org/toh/xiaomi/xiaomi_redmi_router_ac2100 An implementation of CVE-2020-8597 against stock firmware version 1.0.14 This requires a computer with ethernet plugged into the wan port and an active PPPoE session, and if successful will open a reverse shell to 192.168.31.177 on port 31337. As this shell is somewhat unreliable and likely to be killed in a random amount of time, it is recommended to wget a static compiled busybox binary onto the device and start telnetd with it. The stock telnetd and dropbear unfortunately appear inoperable. (Disabled on release versions of stock firmware likely) Ie. wget https://yourip/busybox-mipsel -O /tmp/busybox chmod a+x /tmp/busybox /tmp/busybox telnetd -l /bin/sh Tested-by: David Martinez <bonkilla@gmail.com> Signed-off-by: Richard Huynh <voxlympha@gmail.com>
2020-04-23 02:50:21 +00:00
define Device/xiaomi_redmi-router-ac2100
$(Device/xiaomi_nand_separate)
ramips: Add support for Xiaomi Redmi Router AC2100 (RM2100) Specification: - CPU: MediaTek MT7621A - RAM: 128 MB DDR3 - FLASH: 128 MB ESMT NAND - WIFI: 2x2 802.11bgn (MT7603) - WIFI: 4x4 802.11ac (MT7615) - ETH: 3xLAN+1xWAN 1000base-T - LED: Power, WAN, in Amber and White - UART: On board near ethernet, opposite side from power - Modified u-boot Installation: 1. Run linked exploit to get shell, startup telnet and wget the files over 2. mtd write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-kernel1.bin kernel1 3. nvram set uart_en=1 4. nvram set bootdelay=5 5. nvram set flag_try_sys1_failed=1 6. nvram commit 7. mtd -r write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-rootfs0.bin rootfs0 Restore to stock: 1. Setup PXE and TFTP server serving stock firmware image (See dhcp-boot option of dnsmasq) 2. Hold reset button down before powering on and wait for flashing amber led 3. Release reset button 4. Wait until status led changes from flashing amber to white Notes: This device has dual kernel and rootfs slots like other Xiaomi devices currently supported (mir3g, etc.) thus, we use the second slot and overwrite the first rootfs onwards in order to get more space. Exploit and detailed instructions: https://openwrt.org/toh/xiaomi/xiaomi_redmi_router_ac2100 An implementation of CVE-2020-8597 against stock firmware version 1.0.14 This requires a computer with ethernet plugged into the wan port and an active PPPoE session, and if successful will open a reverse shell to 192.168.31.177 on port 31337. As this shell is somewhat unreliable and likely to be killed in a random amount of time, it is recommended to wget a static compiled busybox binary onto the device and start telnetd with it. The stock telnetd and dropbear unfortunately appear inoperable. (Disabled on release versions of stock firmware likely) Ie. wget https://yourip/busybox-mipsel -O /tmp/busybox chmod a+x /tmp/busybox /tmp/busybox telnetd -l /bin/sh Tested-by: David Martinez <bonkilla@gmail.com> Signed-off-by: Richard Huynh <voxlympha@gmail.com>
2020-04-23 02:50:21 +00:00
DEVICE_MODEL := Redmi Router AC2100
IMAGE_SIZE := 120320k
DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615-firmware
ramips: Add support for Xiaomi Redmi Router AC2100 (RM2100) Specification: - CPU: MediaTek MT7621A - RAM: 128 MB DDR3 - FLASH: 128 MB ESMT NAND - WIFI: 2x2 802.11bgn (MT7603) - WIFI: 4x4 802.11ac (MT7615) - ETH: 3xLAN+1xWAN 1000base-T - LED: Power, WAN, in Amber and White - UART: On board near ethernet, opposite side from power - Modified u-boot Installation: 1. Run linked exploit to get shell, startup telnet and wget the files over 2. mtd write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-kernel1.bin kernel1 3. nvram set uart_en=1 4. nvram set bootdelay=5 5. nvram set flag_try_sys1_failed=1 6. nvram commit 7. mtd -r write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-rootfs0.bin rootfs0 Restore to stock: 1. Setup PXE and TFTP server serving stock firmware image (See dhcp-boot option of dnsmasq) 2. Hold reset button down before powering on and wait for flashing amber led 3. Release reset button 4. Wait until status led changes from flashing amber to white Notes: This device has dual kernel and rootfs slots like other Xiaomi devices currently supported (mir3g, etc.) thus, we use the second slot and overwrite the first rootfs onwards in order to get more space. Exploit and detailed instructions: https://openwrt.org/toh/xiaomi/xiaomi_redmi_router_ac2100 An implementation of CVE-2020-8597 against stock firmware version 1.0.14 This requires a computer with ethernet plugged into the wan port and an active PPPoE session, and if successful will open a reverse shell to 192.168.31.177 on port 31337. As this shell is somewhat unreliable and likely to be killed in a random amount of time, it is recommended to wget a static compiled busybox binary onto the device and start telnetd with it. The stock telnetd and dropbear unfortunately appear inoperable. (Disabled on release versions of stock firmware likely) Ie. wget https://yourip/busybox-mipsel -O /tmp/busybox chmod a+x /tmp/busybox /tmp/busybox telnetd -l /bin/sh Tested-by: David Martinez <bonkilla@gmail.com> Signed-off-by: Richard Huynh <voxlympha@gmail.com>
2020-04-23 02:50:21 +00:00
endef
TARGET_DEVICES += xiaomi_redmi-router-ac2100
define Device/xiaoyu_xy-c5
$(Device/dsa-migration)
IMAGE_SIZE := 32448k
DEVICE_VENDOR := XiaoYu
DEVICE_MODEL := XY-C5
DEVICE_PACKAGES := kmod-ata-ahci kmod-usb3 -wpad-basic-mbedtls \
-uboot-envtools
endef
TARGET_DEVICES += xiaoyu_xy-c5
define Device/xzwifi_creativebox-v1
$(Device/dsa-migration)
IMAGE_SIZE := 32448k
DEVICE_VENDOR := CreativeBox
DEVICE_MODEL := v1
DEVICE_PACKAGES := kmod-ata-ahci kmod-mt7603 kmod-mt76x2 kmod-sdhci-mt7620 \
kmod-usb3 -wpad-basic-mbedtls -uboot-envtools
endef
TARGET_DEVICES += xzwifi_creativebox-v1
define Device/youhua_wr1200js
$(Device/dsa-migration)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := YouHua
DEVICE_MODEL := WR1200JS
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
endef
TARGET_DEVICES += youhua_wr1200js
define Device/youku_yk-l2
$(Device/dsa-migration)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Youku
DEVICE_MODEL := YK-L2
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
UIMAGE_MAGIC := 0x12291000
UIMAGE_NAME := 400000000000000000003000
endef
TARGET_DEVICES += youku_yk-l2
define Device/yuncore_ax820
$(Device/dsa-migration)
IMAGE_SIZE := 15808k
DEVICE_VENDOR := YunCore
DEVICE_MODEL := AX820
DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
endef
TARGET_DEVICES += yuncore_ax820
define Device/yuncore_fap640
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 15808k
DEVICE_VENDOR := YunCore
DEVICE_MODEL := FAP640
DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
endef
TARGET_DEVICES += yuncore_fap640
define Device/yuncore_fap690
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 15808k
DEVICE_VENDOR := YunCore
DEVICE_MODEL := FAP690
DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
endef
TARGET_DEVICES += yuncore_fap690
define Device/zbtlink_zbt-we1326
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Zbtlink
DEVICE_MODEL := ZBT-WE1326
DEVICE_ALT0_VENDOR := Wiflyer
DEVICE_ALT0_MODEL := WF3526-P
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 kmod-sdhci-mt7620 \
-uboot-envtools
SUPPORTED_DEVICES += zbt-we1326
endef
TARGET_DEVICES += zbtlink_zbt-we1326
define Device/zbtlink_zbt-we3526
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Zbtlink
DEVICE_MODEL := ZBT-WE3526
DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
endef
TARGET_DEVICES += zbtlink_zbt-we3526
ramips: add support for Zbtlink ZBT-WG1602 Zbtlink ZBT-WG1602 is a Wi-Fi router intendent to use with WWAN (UMTS/LTE/3G/4G) modems. The router board offsers a couple of miniPCIe slots with USB and SIM only and another one pure miniPCIe slot as well as five Gigabit Ethernet ports (4xLAN + WAN). Specification: * SoC: MT7621A * RAM: 256/512 MiB * Flash: 16/32 MiB (SPI NOR) * external watchdog (looks like Torexsemi XC6131B) * Eth: 10/100/1000 Mbps Ethernet x5 ports (4xLAN + WAN) * WLAN 2GHz: MT7603EN (.11n, MIMO 2x2) * WLAN 5GHz: MT7612EN (.11ac, MIMO 2x2) * WLAN Ants: detachable x2, shared by 2GHz & 5GHz radios * miniPCIe: 2x slots with USB&SIM + 1x slot with regular PCIe bus * WWAN Ants: detachable x4 * External storage: microSD (SDXC) slot * USB: 2.0 Type-A port * LED: 11 (5 per Eth phy, 3 SoC controlled, 2 WLAN 2/5 controlled, 1 power indicator) * Button: 1 (reset) * UART: console (115200 baud) * Power: DC jack (12 V / 2.5 A) Additional HW information: * SoC USB port #1 is shared by internal miniPCIe slot and external Type-A USB port, USB D+/D- lines are toggled between ports using a GPIO controlled DPDT switch. * Power of the USB enabled miniPCIe slots can be individually controlled using dedicated GPIO lines. * Vendor firmware feeds the external watchdog with 1s pulses. GPIO watchdog driver is able to either generate a 1us pulses or toggle the output line. 1us is not enough for the external watchod timer, so the line toggling driver mode is utilized. Installation: Vendor's firmware is OpenWrt (LEDE) based, so the sysupgrade image can be directly used to install OpenWrt. Firmware must be upgraded using the 'force' and 'do not save configuration' command line options (or correspondig web interface checkboxes) since the vendor firmware is from the pre-DSA era. Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
2021-11-16 10:10:25 +00:00
define Device/zbtlink_zbt-wg1602-16m
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Zbtlink
DEVICE_MODEL := ZBT-WG1602
DEVICE_VARIANT := 16M
DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
ramips: add support for Zbtlink ZBT-WG1602 Zbtlink ZBT-WG1602 is a Wi-Fi router intendent to use with WWAN (UMTS/LTE/3G/4G) modems. The router board offsers a couple of miniPCIe slots with USB and SIM only and another one pure miniPCIe slot as well as five Gigabit Ethernet ports (4xLAN + WAN). Specification: * SoC: MT7621A * RAM: 256/512 MiB * Flash: 16/32 MiB (SPI NOR) * external watchdog (looks like Torexsemi XC6131B) * Eth: 10/100/1000 Mbps Ethernet x5 ports (4xLAN + WAN) * WLAN 2GHz: MT7603EN (.11n, MIMO 2x2) * WLAN 5GHz: MT7612EN (.11ac, MIMO 2x2) * WLAN Ants: detachable x2, shared by 2GHz & 5GHz radios * miniPCIe: 2x slots with USB&SIM + 1x slot with regular PCIe bus * WWAN Ants: detachable x4 * External storage: microSD (SDXC) slot * USB: 2.0 Type-A port * LED: 11 (5 per Eth phy, 3 SoC controlled, 2 WLAN 2/5 controlled, 1 power indicator) * Button: 1 (reset) * UART: console (115200 baud) * Power: DC jack (12 V / 2.5 A) Additional HW information: * SoC USB port #1 is shared by internal miniPCIe slot and external Type-A USB port, USB D+/D- lines are toggled between ports using a GPIO controlled DPDT switch. * Power of the USB enabled miniPCIe slots can be individually controlled using dedicated GPIO lines. * Vendor firmware feeds the external watchdog with 1s pulses. GPIO watchdog driver is able to either generate a 1us pulses or toggle the output line. 1us is not enough for the external watchod timer, so the line toggling driver mode is utilized. Installation: Vendor's firmware is OpenWrt (LEDE) based, so the sysupgrade image can be directly used to install OpenWrt. Firmware must be upgraded using the 'force' and 'do not save configuration' command line options (or correspondig web interface checkboxes) since the vendor firmware is from the pre-DSA era. Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
2021-11-16 10:10:25 +00:00
endef
TARGET_DEVICES += zbtlink_zbt-wg1602-16m
ramips: add support for Zbtlink ZBT-WG1602-V04 Description heavily based on commit 7e89421a7c3855d66a20350a5bf9ca4cc7a2caf9 by Sergey Ryazanov <ryazanov.s.a@gmail.com> Details I cannot confirm have been removed Completed with great help from \x on IRC. Thanks, \x! Zbtlink ZBT-WG1602-V04 is a Wi-Fi router intendend for use with WWAN (UMTS/LTE/3G/4G) modems. The router board offers a couple of miniPCIe slots with USB and SIM only and another one which is a pure miniPCIe slot as well as five Gigabit Ethernet ports (4xLAN + WAN). Specification: * SoC: MT7621A * RAM: 256/512 MiB * Flash: 16/32 MiB * Eth: 10/100/1000 Mbps Ethernet x5 ports (4xLAN + WAN) * WLAN 2GHz: MT7603E (.11bgn, MIMO 2x2) * WLAN 5GHz: MT7662E (.11nac, MIMO 2x2) * WLAN Ants: detachable x2, shared by 2GHz & 5GHz radios * miniPCIe: 2x slots with USB&SIM + 1x slot with regular PCIe bus * WWAN Ants: detachable x4 * External storage: microSD (SDXC) slot * USB: 3.0 Type-A port * LED: 11 (5 per Eth phy, 3 SoC controlled, 2 WLAN 2/5 controlled, 1 power indicator) * Button: 1 (reset) * UART: console (115200 baud) * Power: DC jack (12 V / 2.5 A) Additional HW information: * SoC USB port 1 is shared by internal miniPCIe slot and external Type-A USB port, USB D+/D- lines are toggled between ports using a GPIO controlled DPDT switch. Installation: The kernel image can be installed directly onto the device via a browser to 192.168.1.1 using the built in firmware recovery Web UI available. It can be accessed by pushing the reset button in, applying power and holding the reset button for approximately 10 seconds. When the kernel image has been flashed, you can access LuCI and upload the sysupgrade as normal. Signed-off-by: Alexander Horner <ahorner@programmer.net>
2022-09-26 19:17:40 +00:00
define Device/zbtlink_zbt-wg1602-v04-16m
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Zbtlink
DEVICE_MODEL := ZBT-WG1602-V04
DEVICE_VARIANT := 16M
DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
ramips: add support for Zbtlink ZBT-WG1602-V04 Description heavily based on commit 7e89421a7c3855d66a20350a5bf9ca4cc7a2caf9 by Sergey Ryazanov <ryazanov.s.a@gmail.com> Details I cannot confirm have been removed Completed with great help from \x on IRC. Thanks, \x! Zbtlink ZBT-WG1602-V04 is a Wi-Fi router intendend for use with WWAN (UMTS/LTE/3G/4G) modems. The router board offers a couple of miniPCIe slots with USB and SIM only and another one which is a pure miniPCIe slot as well as five Gigabit Ethernet ports (4xLAN + WAN). Specification: * SoC: MT7621A * RAM: 256/512 MiB * Flash: 16/32 MiB * Eth: 10/100/1000 Mbps Ethernet x5 ports (4xLAN + WAN) * WLAN 2GHz: MT7603E (.11bgn, MIMO 2x2) * WLAN 5GHz: MT7662E (.11nac, MIMO 2x2) * WLAN Ants: detachable x2, shared by 2GHz & 5GHz radios * miniPCIe: 2x slots with USB&SIM + 1x slot with regular PCIe bus * WWAN Ants: detachable x4 * External storage: microSD (SDXC) slot * USB: 3.0 Type-A port * LED: 11 (5 per Eth phy, 3 SoC controlled, 2 WLAN 2/5 controlled, 1 power indicator) * Button: 1 (reset) * UART: console (115200 baud) * Power: DC jack (12 V / 2.5 A) Additional HW information: * SoC USB port 1 is shared by internal miniPCIe slot and external Type-A USB port, USB D+/D- lines are toggled between ports using a GPIO controlled DPDT switch. Installation: The kernel image can be installed directly onto the device via a browser to 192.168.1.1 using the built in firmware recovery Web UI available. It can be accessed by pushing the reset button in, applying power and holding the reset button for approximately 10 seconds. When the kernel image has been flashed, you can access LuCI and upload the sysupgrade as normal. Signed-off-by: Alexander Horner <ahorner@programmer.net>
2022-09-26 19:17:40 +00:00
endef
TARGET_DEVICES += zbtlink_zbt-wg1602-v04-16m
define Device/zbtlink_zbt-wg1602-v04-32m
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 32128k
DEVICE_VENDOR := Zbtlink
DEVICE_MODEL := ZBT-WG1602-V04
DEVICE_VARIANT := 32M
DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
ramips: add support for Zbtlink ZBT-WG1602-V04 Description heavily based on commit 7e89421a7c3855d66a20350a5bf9ca4cc7a2caf9 by Sergey Ryazanov <ryazanov.s.a@gmail.com> Details I cannot confirm have been removed Completed with great help from \x on IRC. Thanks, \x! Zbtlink ZBT-WG1602-V04 is a Wi-Fi router intendend for use with WWAN (UMTS/LTE/3G/4G) modems. The router board offers a couple of miniPCIe slots with USB and SIM only and another one which is a pure miniPCIe slot as well as five Gigabit Ethernet ports (4xLAN + WAN). Specification: * SoC: MT7621A * RAM: 256/512 MiB * Flash: 16/32 MiB * Eth: 10/100/1000 Mbps Ethernet x5 ports (4xLAN + WAN) * WLAN 2GHz: MT7603E (.11bgn, MIMO 2x2) * WLAN 5GHz: MT7662E (.11nac, MIMO 2x2) * WLAN Ants: detachable x2, shared by 2GHz & 5GHz radios * miniPCIe: 2x slots with USB&SIM + 1x slot with regular PCIe bus * WWAN Ants: detachable x4 * External storage: microSD (SDXC) slot * USB: 3.0 Type-A port * LED: 11 (5 per Eth phy, 3 SoC controlled, 2 WLAN 2/5 controlled, 1 power indicator) * Button: 1 (reset) * UART: console (115200 baud) * Power: DC jack (12 V / 2.5 A) Additional HW information: * SoC USB port 1 is shared by internal miniPCIe slot and external Type-A USB port, USB D+/D- lines are toggled between ports using a GPIO controlled DPDT switch. Installation: The kernel image can be installed directly onto the device via a browser to 192.168.1.1 using the built in firmware recovery Web UI available. It can be accessed by pushing the reset button in, applying power and holding the reset button for approximately 10 seconds. When the kernel image has been flashed, you can access LuCI and upload the sysupgrade as normal. Signed-off-by: Alexander Horner <ahorner@programmer.net>
2022-09-26 19:17:40 +00:00
endef
TARGET_DEVICES += zbtlink_zbt-wg1602-v04-32m
define Device/zbtlink_zbt-wg1608-16m
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Zbtlink
DEVICE_MODEL := ZBT-WG1608
DEVICE_VARIANT := 16M
DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt7603 kmod-mt7615e \
kmod-mt7663-firmware-ap kmod-usb3 kmod-usb-ledtrig-usbport \
-uboot-envtools
endef
TARGET_DEVICES += zbtlink_zbt-wg1608-16m
define Device/zbtlink_zbt-wg1608-32m
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 32448k
DEVICE_VENDOR := Zbtlink
DEVICE_MODEL := ZBT-WG1608
DEVICE_VARIANT := 32M
DEVICE_PACKAGES := kmod-sdhci-mt7620 kmod-mt7603 kmod-mt7615e \
kmod-mt7663-firmware-ap kmod-usb3 kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += zbtlink_zbt-wg1608-32m
define Device/zbtlink_zbt-wg2626
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Zbtlink
DEVICE_MODEL := ZBT-WG2626
DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
SUPPORTED_DEVICES += zbt-wg2626
endef
TARGET_DEVICES += zbtlink_zbt-wg2626
define Device/zbtlink_zbt-wg3526-16m
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := Zbtlink
DEVICE_MODEL := ZBT-WG3526
DEVICE_VARIANT := 16M
DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-mt7603 kmod-mt76x2 \
kmod-usb3 kmod-usb-ledtrig-usbport -uboot-envtools
SUPPORTED_DEVICES += zbt-wg3526 zbt-wg3526-16M
endef
TARGET_DEVICES += zbtlink_zbt-wg3526-16m
define Device/zbtlink_zbt-wg3526-32m
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
IMAGE_SIZE := 32448k
DEVICE_VENDOR := Zbtlink
DEVICE_MODEL := ZBT-WG3526
DEVICE_VARIANT := 32M
DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-mt7603 kmod-mt76x2 \
kmod-usb3 kmod-usb-ledtrig-usbport -uboot-envtools
SUPPORTED_DEVICES += ac1200pro zbt-wg3526-32M
endef
TARGET_DEVICES += zbtlink_zbt-wg3526-32m
define Device/zio_freezio
$(Device/dsa-migration)
IMAGE_SIZE := 16064k
DEVICE_VENDOR := ZIO
DEVICE_MODEL := FREEZIO
DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x2 kmod-usb3 \
kmod-usb-ledtrig-usbport -uboot-envtools
endef
TARGET_DEVICES += zio_freezio
ramips: add support for ZyXEL WAP6805 (Altibox WiFi+) Hardware -------- SoC: MediaTek MT7621ST WiFi: MediaTek MT7603 Quantenna QT3840BC Flash: 128M NAND RAM: 64M LED: Dual colour red and green BTN: Reset WPS Eth: 4 x 10/100/1000 connected to MT7621 internal switch MT7621 RGMII port connected to Quantenna module GPIO: Power/reset of Quantenna module Quantenna module ---------------- The Quantenna QT3840BC (or QV840) is a separate SoC running another Linux installation. It is mounted on a wide mini-PCIe form factor module, but is connected to the RGMII port of the MT7621. It loads both a second uboot stage and an os image from the MT7621 using tftp. The module is configured using Quantenna specific RPC calls over IP, using 802.1q over the RGMII link to support multiple SSIDs. There is no support for using this module as a WiFi device in OpenWrt. A package with basic firmware and management tools is being prepared. Serial ports ------------ Two serial ports with headers: RRJ1 - 115200 8N1 - Connected to the Quantenna console J1 - 57600 8N1 - Connected to the MT7621 console Both share pinout with many other Zyxel/Mitrastar devices: 1 - NC (VDD) 2 - TX 3 - RX 4 - NC (no pin) 5 - GND Dual system partitions ---------------------- The vendor firmware and boot loader use a dual partition scheme storing a counter in the header of each partition. The partition with the highest number will be selected for boot. OpenWrt does not support this scheme and will always use the first OS partition. It will reset both counters to zero the first time sysupgrade is run, making sure the first partition is selected by the boot loader. Installation from vendor firmware --------------------------------- 1. Run a DHCP server. The WAP6805 is configured as a client device and does not have a default static IP address. Make a note of which address it is assigned 2. tftp the OpenWrt initramfs-kernel.bin image to this address. Wait for the WAP6805 to reboot. 3. ssh to the OpenWrt initramfs system on 192.168.1.1. Make a backup of all mtd partitions now. The last used OEM image is still present in either "Kernel" or "Kernel2" at this point, and can be restored later if you save a copy. 4. sysupgrade to the OpenWrt sysupgrade.bin image. Installation from U-Boot ------------------------ This requires serial console access 1. Copy the OpenWrt initramfs-kernel.bin image as "ras.bin" to your tftp server directory. Configure the server address as 192.168.0.33/24 2. Hit ESC when the message "Hit ESC key to stop autoboot" appears 3. Type "ATGU" + Enter, and then "2" immediately after pressing enter. 4. Answer Y to the question "Erase Linux in Flash then burn new one. Are you sure?", and answer the address/filename questions. Defaults: Input device IP (192.168.0.2) Input server IP (192.168.0.33) Input Linux Kernel filename ("ras.bin") 5. Wait until after you see the message "Done!" and power cycle the device. It will hang after flashing. 6. Continue with step 3 and 4 from the vendor firmware procedure. Notes on the WAP6805 U-Boot --------------------------- The bootloader has been modified with both ZyXELs zyloader and the device specific dual partition scheme. These changes appear to have broken a few things. The zyloader shell claims to support a number of ZyXEL AT commands, but not all of them work. The image selection scheme is unreliable and inconsistent. A limited U-Boot menu is available - and used by the above U-Boot install procedure. But direct booting into an uploaded image does not work, neither with ram nor with flash. Flashing works, but requires a hard reset after it is finished. Reverting to OEM firmware ------------------------- The OEM firmware can be restored by using mtd write from OpenWrt, flashing it to the "Kernel" partition. E.g. ssh root@192.168.1.1 "mtd -r -e Kernel write - Kernel" < oem.bin OEM firmwares for the WAP6805 are not avaible for public download, so a backup of the original installation is required. See above. Alternatively, firmware for the WAP6806 (Armor X1) may be used. This is exactly the same hardware. But the branding features do obviously differ. LED controller -------------- Hardware implementation is unknown. The dual-color LED is controlled by 3 GPIOs: 4: red 7: blinking green 13: green Enabling both red and green makes the LED appear yellow. The boot loader enables hardware blinking, causing the green LED to blink slowly on power-on, until the OpenWrt boot mode starts a faster software blink. Signed-off-by: Bjørn Mork <bjorn@mork.no> [fix alphabetic sorting for image build statement] Signed-off-by: Petr Štetiar <ynezz@true.cz>
2018-04-18 19:57:52 +00:00
define Device/zyxel_lte3301-plus
$(Device/nand)
DEVICE_VENDOR := ZyXEL
DEVICE_MODEL := LTE3301-PLUS
KERNEL_SIZE := 31488k
DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 kmod-usb-ledtrig-usbport \
kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi
KERNEL := $(KERNEL_DTB) | uImage lzma | \
zytrx-header $$(DEVICE_MODEL) $$(VERSION_DIST)-$$(REVISION)
KERNEL_INITRAMFS := $(KERNEL_DTB) | uImage lzma | \
zytrx-header $$(DEVICE_MODEL) 9.99(ABQU.1)$$(VERSION_DIST)-recovery
KERNEL_INITRAMFS_SUFFIX := -recovery.bin
endef
TARGET_DEVICES += zyxel_lte3301-plus
ramips: mt7621: Add support for ZyXEL NR7101 The ZyXEL NR7101 is an 802.3at PoE powered 5G outdoor (IP68) CPE with integrated directional 5G/LTE antennas. Specifications: - SoC: MediaTek MT7621AT - RAM: 256 MB - Flash: 128 MB MB NAND (MX30LF1G18AC) - WiFi: MediaTek MT7603E - Switch: 1 LAN port (Gigabiti) - 5G/LTE: Quectel RG502Q-EA connected by USB3 to SoC - SIM: 2 micro-SIM slots under transparent cover - Buttons: Reset, WLAN under same cover - LEDs: Multicolour green/red/yellow under same cover (visible) - Power: 802.3at PoE via LAN port The device is built as an outdoor ethernet to 5G/LTE bridge or router. The Wifi interface is intended for installation and/or temporary management purposes only. UART Serial: 57600N1 Located on populated 5 pin header J5: [o] GND [ ] key - no pin [o] RX [o] TX [o] 3.3V Vcc Remove the SIM/button/LED cover, the WLAN button and 12 screws holding the back plate and antenna cover together. The GPS antenna is fixed to the cover, so be careful with the cable. Remove 4 screws fixing the antenna board to the main board, again being careful with the cables. A bluetooth TTL adapter is recommended for permanent console access, to keep the router water and dustproof. The 3.3V pin is able to power such an adapter. MAC addresses: OpenWrt OEM Address Found as lan eth2 08:26:97:*:*:BC Factory 0xe000 (hex), label wlan0 ra0 08:26:97:*:*:BD Factory 0x4 (hex) wwan0 usb0 random WARNING!! ISP managed firmware might at any time update itself to a version where all known workarounds have been disabled. Never boot an ISP managed firmware with a SIM in any of the slots if you intend to use the router with OpenWrt. The bootloader lock can only be disabled with root access to running firmware. The flash chip is physically inaccessible without soldering. Installation from OEM web GUI: - Log in as "supervisor" on https://172.17.1.1/ - Upload OpenWrt initramfs-recovery.bin image on the Maintenance -> Firmware page - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - (optional) Copy OpenWrt to the recovery partition. See below - Sysupgrade to the OpenWrt sysupgrade image and reboot Installation from OEM ssh: - Log in as "root" on 172.17.1.1 port 22022 - scp OpenWrt initramfs-recovery.bin image to 172.17.1.1:/tmp - Prepare bootloader config by running: nvram setro uboot DebugFlag 0x1 nvram setro uboot CheckBypass 0 nvram commit - Run "mtd_write -w write initramfs-recovery.bin Kernel" and reboot - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - (optional) Copy OpenWrt to the recovery partition. See below - Sysupgrade to the OpenWrt sysupgrade image and reboot Copying OpenWrt to the recovery partition: - Verify that you are running a working OpenWrt recovery image from flash - ssh to root@192.168.1.1 and run: fw_setenv CheckBypass 0 mtd -r erase Kernel2 - Wait while the bootloader mirrors Image1 to Image2 NOTE: This should only be done after successfully booting the OpenWrt recovery image from the primary partition during installation. Do not do this after having sysupgraded OpenWrt! Reinstalling the recovery image on normal upgrades is not required or recommended. Installation from Z-Loader: - Halt boot by pressing Escape on console - Set up a tftp server to serve the OpenWrt initramfs-recovery.bin image at 10.10.10.3 - Type "ATNR 1,initramfs-recovery.bin" at the "ZLB>" prompt - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - Sysupgrade to the OpenWrt sysupgrade image NOTE: ATNR will write the recovery image to both primary and recovery partitions in one go. Booting from RAM: - Halt boot by pressing Escape on console - Type "ATGU" at the "ZLB>" prompt to enter the U-Boot menu - Press "4" to select "4: Entr boot command line interface." - Set up a tftp server to serve the OpenWrt initramfs-recovery.bin image at 10.10.10.3 - Load it using "tftpboot 0x88000000 initramfs-recovery.bin" - Boot with "bootm 0x8800017C" to skip the 380 (0x17C) bytes ZyXEL header This method can also be used to RAM boot OEM firmware. The warning regarding OEM applies! Never boot an unknown OEM firmware, or any OEM firmware with a SIM in any slot. NOTE: U-Boot configuration is incomplete (on some devices?). You may have to configure a working mac address before running tftp using "setenv eth0addr <mac>" Unlocking the bootloader: If you are unebale to halt boot, then the bootloader is locked. The OEM firmware locks the bootloader on every boot by setting DebugFlag to 0. Setting it to 1 is therefore only temporary when OEM firmware is installed. - Run "nvram setro uboot DebugFlag 0x1; nvram commit" in OEM firmware - Run "fw_setenv DebugFlag 0x1" in OpenWrt NOTE: OpenWrt does this automatically on first boot if necessary NOTE2: Setting the flag to 0x1 avoids the reset to 0 in known OEM versions, but this might change. WARNING: Writing anything to flash while the bootloader is locked is considered extremely risky. Errors might cause a permanent brick! Enabling management access from LAN: Temporary workaround to allow installing OpenWrt if OEM firmware has disabled LAN management: - Connect to console - Log in as "root" - Run "iptables -I INPUT -i br0 -j ACCEPT" Notes on the OEM/bootloader dual partition scheme The dual partition scheme on this device uses Image2 as a recovery image only. The device will always boot from Image1, but the bootloader might copy Image2 to Image1 under specific conditions. This scheme prevents repurposing of the space occupied by Image2 in any useful way. Validation of primary and recovery images is controlled by the variables CheckBypass, Image1Stable, and Image1Try. The bootloader sets CheckBypass to 0 and reboots if Image1 fails validation. If CheckBypass is 0 and Image1 is invalid then Image2 is copied to Image1. If CheckBypass is 0 and Image2 is invalid, then Image1 is copied to Image2. If CheckBypass is 1 then all tests are skipped and Image1 is booted unconditionally. CheckBypass is set to 1 after each successful validation of Image1. Image1Try is incremented if Image1Stable is 0, and Image2 is copied to Image1 if Image1Try is 3 or larger. But the bootloader only tests Image1Try if CheckBypass is 0, which is impossible unless the booted image sets it to 0 before failing. The system is therefore not resilient against runtime errors like failure to mount the rootfs, unless the kernel image sets CheckBypass to 0 before failing. This is not yet implemented in OpenWrt. Setting Image1Stable to 1 prevents the bootloader from updating Image1Try on every boot, saving unnecessary writes to the environment partition. Keeping an OpenWrt initramfs recovery as Image2 is recommended primarily to avoid unwanted OEM firmware boots on failure. Ref the warning above. It enables console-less recovery in case of some failures to boot from Image1. Signed-off-by: Bjørn Mork <bjorn@mork.no>
2021-04-19 11:00:56 +00:00
define Device/zyxel_nr7101
$(Device/nand)
ramips: mt7621: Add support for ZyXEL NR7101 The ZyXEL NR7101 is an 802.3at PoE powered 5G outdoor (IP68) CPE with integrated directional 5G/LTE antennas. Specifications: - SoC: MediaTek MT7621AT - RAM: 256 MB - Flash: 128 MB MB NAND (MX30LF1G18AC) - WiFi: MediaTek MT7603E - Switch: 1 LAN port (Gigabiti) - 5G/LTE: Quectel RG502Q-EA connected by USB3 to SoC - SIM: 2 micro-SIM slots under transparent cover - Buttons: Reset, WLAN under same cover - LEDs: Multicolour green/red/yellow under same cover (visible) - Power: 802.3at PoE via LAN port The device is built as an outdoor ethernet to 5G/LTE bridge or router. The Wifi interface is intended for installation and/or temporary management purposes only. UART Serial: 57600N1 Located on populated 5 pin header J5: [o] GND [ ] key - no pin [o] RX [o] TX [o] 3.3V Vcc Remove the SIM/button/LED cover, the WLAN button and 12 screws holding the back plate and antenna cover together. The GPS antenna is fixed to the cover, so be careful with the cable. Remove 4 screws fixing the antenna board to the main board, again being careful with the cables. A bluetooth TTL adapter is recommended for permanent console access, to keep the router water and dustproof. The 3.3V pin is able to power such an adapter. MAC addresses: OpenWrt OEM Address Found as lan eth2 08:26:97:*:*:BC Factory 0xe000 (hex), label wlan0 ra0 08:26:97:*:*:BD Factory 0x4 (hex) wwan0 usb0 random WARNING!! ISP managed firmware might at any time update itself to a version where all known workarounds have been disabled. Never boot an ISP managed firmware with a SIM in any of the slots if you intend to use the router with OpenWrt. The bootloader lock can only be disabled with root access to running firmware. The flash chip is physically inaccessible without soldering. Installation from OEM web GUI: - Log in as "supervisor" on https://172.17.1.1/ - Upload OpenWrt initramfs-recovery.bin image on the Maintenance -> Firmware page - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - (optional) Copy OpenWrt to the recovery partition. See below - Sysupgrade to the OpenWrt sysupgrade image and reboot Installation from OEM ssh: - Log in as "root" on 172.17.1.1 port 22022 - scp OpenWrt initramfs-recovery.bin image to 172.17.1.1:/tmp - Prepare bootloader config by running: nvram setro uboot DebugFlag 0x1 nvram setro uboot CheckBypass 0 nvram commit - Run "mtd_write -w write initramfs-recovery.bin Kernel" and reboot - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - (optional) Copy OpenWrt to the recovery partition. See below - Sysupgrade to the OpenWrt sysupgrade image and reboot Copying OpenWrt to the recovery partition: - Verify that you are running a working OpenWrt recovery image from flash - ssh to root@192.168.1.1 and run: fw_setenv CheckBypass 0 mtd -r erase Kernel2 - Wait while the bootloader mirrors Image1 to Image2 NOTE: This should only be done after successfully booting the OpenWrt recovery image from the primary partition during installation. Do not do this after having sysupgraded OpenWrt! Reinstalling the recovery image on normal upgrades is not required or recommended. Installation from Z-Loader: - Halt boot by pressing Escape on console - Set up a tftp server to serve the OpenWrt initramfs-recovery.bin image at 10.10.10.3 - Type "ATNR 1,initramfs-recovery.bin" at the "ZLB>" prompt - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - Sysupgrade to the OpenWrt sysupgrade image NOTE: ATNR will write the recovery image to both primary and recovery partitions in one go. Booting from RAM: - Halt boot by pressing Escape on console - Type "ATGU" at the "ZLB>" prompt to enter the U-Boot menu - Press "4" to select "4: Entr boot command line interface." - Set up a tftp server to serve the OpenWrt initramfs-recovery.bin image at 10.10.10.3 - Load it using "tftpboot 0x88000000 initramfs-recovery.bin" - Boot with "bootm 0x8800017C" to skip the 380 (0x17C) bytes ZyXEL header This method can also be used to RAM boot OEM firmware. The warning regarding OEM applies! Never boot an unknown OEM firmware, or any OEM firmware with a SIM in any slot. NOTE: U-Boot configuration is incomplete (on some devices?). You may have to configure a working mac address before running tftp using "setenv eth0addr <mac>" Unlocking the bootloader: If you are unebale to halt boot, then the bootloader is locked. The OEM firmware locks the bootloader on every boot by setting DebugFlag to 0. Setting it to 1 is therefore only temporary when OEM firmware is installed. - Run "nvram setro uboot DebugFlag 0x1; nvram commit" in OEM firmware - Run "fw_setenv DebugFlag 0x1" in OpenWrt NOTE: OpenWrt does this automatically on first boot if necessary NOTE2: Setting the flag to 0x1 avoids the reset to 0 in known OEM versions, but this might change. WARNING: Writing anything to flash while the bootloader is locked is considered extremely risky. Errors might cause a permanent brick! Enabling management access from LAN: Temporary workaround to allow installing OpenWrt if OEM firmware has disabled LAN management: - Connect to console - Log in as "root" - Run "iptables -I INPUT -i br0 -j ACCEPT" Notes on the OEM/bootloader dual partition scheme The dual partition scheme on this device uses Image2 as a recovery image only. The device will always boot from Image1, but the bootloader might copy Image2 to Image1 under specific conditions. This scheme prevents repurposing of the space occupied by Image2 in any useful way. Validation of primary and recovery images is controlled by the variables CheckBypass, Image1Stable, and Image1Try. The bootloader sets CheckBypass to 0 and reboots if Image1 fails validation. If CheckBypass is 0 and Image1 is invalid then Image2 is copied to Image1. If CheckBypass is 0 and Image2 is invalid, then Image1 is copied to Image2. If CheckBypass is 1 then all tests are skipped and Image1 is booted unconditionally. CheckBypass is set to 1 after each successful validation of Image1. Image1Try is incremented if Image1Stable is 0, and Image2 is copied to Image1 if Image1Try is 3 or larger. But the bootloader only tests Image1Try if CheckBypass is 0, which is impossible unless the booted image sets it to 0 before failing. The system is therefore not resilient against runtime errors like failure to mount the rootfs, unless the kernel image sets CheckBypass to 0 before failing. This is not yet implemented in OpenWrt. Setting Image1Stable to 1 prevents the bootloader from updating Image1Try on every boot, saving unnecessary writes to the environment partition. Keeping an OpenWrt initramfs recovery as Image2 is recommended primarily to avoid unwanted OEM firmware boots on failure. Ref the warning above. It enables console-less recovery in case of some failures to boot from Image1. Signed-off-by: Bjørn Mork <bjorn@mork.no>
2021-04-19 11:00:56 +00:00
DEVICE_VENDOR := ZyXEL
DEVICE_MODEL := NR7101
KERNEL_SIZE := 31488k
DEVICE_PACKAGES := kmod-mt7603 kmod-usb3 kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi
ramips: mt7621: Add support for ZyXEL NR7101 The ZyXEL NR7101 is an 802.3at PoE powered 5G outdoor (IP68) CPE with integrated directional 5G/LTE antennas. Specifications: - SoC: MediaTek MT7621AT - RAM: 256 MB - Flash: 128 MB MB NAND (MX30LF1G18AC) - WiFi: MediaTek MT7603E - Switch: 1 LAN port (Gigabiti) - 5G/LTE: Quectel RG502Q-EA connected by USB3 to SoC - SIM: 2 micro-SIM slots under transparent cover - Buttons: Reset, WLAN under same cover - LEDs: Multicolour green/red/yellow under same cover (visible) - Power: 802.3at PoE via LAN port The device is built as an outdoor ethernet to 5G/LTE bridge or router. The Wifi interface is intended for installation and/or temporary management purposes only. UART Serial: 57600N1 Located on populated 5 pin header J5: [o] GND [ ] key - no pin [o] RX [o] TX [o] 3.3V Vcc Remove the SIM/button/LED cover, the WLAN button and 12 screws holding the back plate and antenna cover together. The GPS antenna is fixed to the cover, so be careful with the cable. Remove 4 screws fixing the antenna board to the main board, again being careful with the cables. A bluetooth TTL adapter is recommended for permanent console access, to keep the router water and dustproof. The 3.3V pin is able to power such an adapter. MAC addresses: OpenWrt OEM Address Found as lan eth2 08:26:97:*:*:BC Factory 0xe000 (hex), label wlan0 ra0 08:26:97:*:*:BD Factory 0x4 (hex) wwan0 usb0 random WARNING!! ISP managed firmware might at any time update itself to a version where all known workarounds have been disabled. Never boot an ISP managed firmware with a SIM in any of the slots if you intend to use the router with OpenWrt. The bootloader lock can only be disabled with root access to running firmware. The flash chip is physically inaccessible without soldering. Installation from OEM web GUI: - Log in as "supervisor" on https://172.17.1.1/ - Upload OpenWrt initramfs-recovery.bin image on the Maintenance -> Firmware page - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - (optional) Copy OpenWrt to the recovery partition. See below - Sysupgrade to the OpenWrt sysupgrade image and reboot Installation from OEM ssh: - Log in as "root" on 172.17.1.1 port 22022 - scp OpenWrt initramfs-recovery.bin image to 172.17.1.1:/tmp - Prepare bootloader config by running: nvram setro uboot DebugFlag 0x1 nvram setro uboot CheckBypass 0 nvram commit - Run "mtd_write -w write initramfs-recovery.bin Kernel" and reboot - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - (optional) Copy OpenWrt to the recovery partition. See below - Sysupgrade to the OpenWrt sysupgrade image and reboot Copying OpenWrt to the recovery partition: - Verify that you are running a working OpenWrt recovery image from flash - ssh to root@192.168.1.1 and run: fw_setenv CheckBypass 0 mtd -r erase Kernel2 - Wait while the bootloader mirrors Image1 to Image2 NOTE: This should only be done after successfully booting the OpenWrt recovery image from the primary partition during installation. Do not do this after having sysupgraded OpenWrt! Reinstalling the recovery image on normal upgrades is not required or recommended. Installation from Z-Loader: - Halt boot by pressing Escape on console - Set up a tftp server to serve the OpenWrt initramfs-recovery.bin image at 10.10.10.3 - Type "ATNR 1,initramfs-recovery.bin" at the "ZLB>" prompt - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - Sysupgrade to the OpenWrt sysupgrade image NOTE: ATNR will write the recovery image to both primary and recovery partitions in one go. Booting from RAM: - Halt boot by pressing Escape on console - Type "ATGU" at the "ZLB>" prompt to enter the U-Boot menu - Press "4" to select "4: Entr boot command line interface." - Set up a tftp server to serve the OpenWrt initramfs-recovery.bin image at 10.10.10.3 - Load it using "tftpboot 0x88000000 initramfs-recovery.bin" - Boot with "bootm 0x8800017C" to skip the 380 (0x17C) bytes ZyXEL header This method can also be used to RAM boot OEM firmware. The warning regarding OEM applies! Never boot an unknown OEM firmware, or any OEM firmware with a SIM in any slot. NOTE: U-Boot configuration is incomplete (on some devices?). You may have to configure a working mac address before running tftp using "setenv eth0addr <mac>" Unlocking the bootloader: If you are unebale to halt boot, then the bootloader is locked. The OEM firmware locks the bootloader on every boot by setting DebugFlag to 0. Setting it to 1 is therefore only temporary when OEM firmware is installed. - Run "nvram setro uboot DebugFlag 0x1; nvram commit" in OEM firmware - Run "fw_setenv DebugFlag 0x1" in OpenWrt NOTE: OpenWrt does this automatically on first boot if necessary NOTE2: Setting the flag to 0x1 avoids the reset to 0 in known OEM versions, but this might change. WARNING: Writing anything to flash while the bootloader is locked is considered extremely risky. Errors might cause a permanent brick! Enabling management access from LAN: Temporary workaround to allow installing OpenWrt if OEM firmware has disabled LAN management: - Connect to console - Log in as "root" - Run "iptables -I INPUT -i br0 -j ACCEPT" Notes on the OEM/bootloader dual partition scheme The dual partition scheme on this device uses Image2 as a recovery image only. The device will always boot from Image1, but the bootloader might copy Image2 to Image1 under specific conditions. This scheme prevents repurposing of the space occupied by Image2 in any useful way. Validation of primary and recovery images is controlled by the variables CheckBypass, Image1Stable, and Image1Try. The bootloader sets CheckBypass to 0 and reboots if Image1 fails validation. If CheckBypass is 0 and Image1 is invalid then Image2 is copied to Image1. If CheckBypass is 0 and Image2 is invalid, then Image1 is copied to Image2. If CheckBypass is 1 then all tests are skipped and Image1 is booted unconditionally. CheckBypass is set to 1 after each successful validation of Image1. Image1Try is incremented if Image1Stable is 0, and Image2 is copied to Image1 if Image1Try is 3 or larger. But the bootloader only tests Image1Try if CheckBypass is 0, which is impossible unless the booted image sets it to 0 before failing. The system is therefore not resilient against runtime errors like failure to mount the rootfs, unless the kernel image sets CheckBypass to 0 before failing. This is not yet implemented in OpenWrt. Setting Image1Stable to 1 prevents the bootloader from updating Image1Try on every boot, saving unnecessary writes to the environment partition. Keeping an OpenWrt initramfs recovery as Image2 is recommended primarily to avoid unwanted OEM firmware boots on failure. Ref the warning above. It enables console-less recovery in case of some failures to boot from Image1. Signed-off-by: Bjørn Mork <bjorn@mork.no>
2021-04-19 11:00:56 +00:00
KERNEL := $(KERNEL_DTB) | uImage lzma | zytrx-header $$(DEVICE_MODEL) $$(VERSION_DIST)-$$(REVISION)
KERNEL_INITRAMFS := $(KERNEL_DTB) | uImage lzma | zytrx-header $$(DEVICE_MODEL) 9.99(ABUV.9)$$(VERSION_DIST)-recovery
KERNEL_INITRAMFS_SUFFIX := -recovery.bin
endef
TARGET_DEVICES += zyxel_nr7101
ramips: add support for ZyXEL NWA50AX / NWA55AXE Hardware -------- CPU: Mediatek MT7621 RAM: 256M DDR3 FLASH: 128M NAND ETH: 1x Gigabit Ethernet WiFi: Mediatek MT7915 (2.4/5GHz 802.11ax 2x2 DBDC) BTN: 1x Reset (NWA50AX only) LED: 1x Multi-Color (NWA50AX only) UART Console ------------ NWA50AX: Available below the rubber cover next to the ethernet port. NWA55AXE: Available on the board when disassembling the device. Settings: 115200 8N1 Layout: <12V> <LAN> GND-RX-TX-VCC Logic-Level is 3V3. Don't connect VCC to your UART adapter! Installation Web-UI ------------------- Upload the Factory image using the devices Web-Interface. As the device uses a dual-image partition layout, OpenWrt can only installed on Slot A. This requires the current active image prior flashing the device to be on Slot B. If the currently installed image is started from Slot A, the device will flash OpenWrt to Slot B. OpenWrt will panic upon first boot in this case and the device will return to the ZyXEL firmware upon next boot. If this happens, first install a ZyXEL firmware upgrade of any version and install OpenWrt after that. Installation TFTP ----------------- This installation routine is especially useful in case * unknown device password (NWA55AXE lacks reset button) * bricked device Attach to the UART console header of the device. Interrupt the boot procedure by pressing Enter. The bootloader has a reduced command-set available from CLI, but more commands can be executed by abusing the atns command. Boot a OpenWrt initramfs image available on a TFTP server at 192.168.1.66. Rename the image to owrt.bin $ atnf owrt.bin $ atna 192.168.1.88 $ atns "192.168.1.66; tftpboot; bootm" Upon booting, set the booted image to the correct slot: $ zyxel-bootconfig /dev/mtd10 get-status $ zyxel-bootconfig /dev/mtd10 set-image-status 0 valid $ zyxel-bootconfig /dev/mtd10 set-active-image 0 Copy the OpenWrt ramboot-factory image to the device using scp. Write the factory image to NAND and reboot the device. $ mtd write ramboot-factory.bin firmware $ reboot Signed-off-by: David Bauer <mail@david-bauer.net>
2022-05-27 15:48:06 +00:00
define Device/zyxel_nwa-ax
$(Device/nand)
ramips: add support for ZyXEL NWA50AX / NWA55AXE Hardware -------- CPU: Mediatek MT7621 RAM: 256M DDR3 FLASH: 128M NAND ETH: 1x Gigabit Ethernet WiFi: Mediatek MT7915 (2.4/5GHz 802.11ax 2x2 DBDC) BTN: 1x Reset (NWA50AX only) LED: 1x Multi-Color (NWA50AX only) UART Console ------------ NWA50AX: Available below the rubber cover next to the ethernet port. NWA55AXE: Available on the board when disassembling the device. Settings: 115200 8N1 Layout: <12V> <LAN> GND-RX-TX-VCC Logic-Level is 3V3. Don't connect VCC to your UART adapter! Installation Web-UI ------------------- Upload the Factory image using the devices Web-Interface. As the device uses a dual-image partition layout, OpenWrt can only installed on Slot A. This requires the current active image prior flashing the device to be on Slot B. If the currently installed image is started from Slot A, the device will flash OpenWrt to Slot B. OpenWrt will panic upon first boot in this case and the device will return to the ZyXEL firmware upon next boot. If this happens, first install a ZyXEL firmware upgrade of any version and install OpenWrt after that. Installation TFTP ----------------- This installation routine is especially useful in case * unknown device password (NWA55AXE lacks reset button) * bricked device Attach to the UART console header of the device. Interrupt the boot procedure by pressing Enter. The bootloader has a reduced command-set available from CLI, but more commands can be executed by abusing the atns command. Boot a OpenWrt initramfs image available on a TFTP server at 192.168.1.66. Rename the image to owrt.bin $ atnf owrt.bin $ atna 192.168.1.88 $ atns "192.168.1.66; tftpboot; bootm" Upon booting, set the booted image to the correct slot: $ zyxel-bootconfig /dev/mtd10 get-status $ zyxel-bootconfig /dev/mtd10 set-image-status 0 valid $ zyxel-bootconfig /dev/mtd10 set-active-image 0 Copy the OpenWrt ramboot-factory image to the device using scp. Write the factory image to NAND and reboot the device. $ mtd write ramboot-factory.bin firmware $ reboot Signed-off-by: David Bauer <mail@david-bauer.net>
2022-05-27 15:48:06 +00:00
DEVICE_VENDOR := ZyXEL
KERNEL_SIZE := 8192k
DEVICE_PACKAGES := kmod-mt7915-firmware zyxel-bootconfig
ramips: add support for ZyXEL NWA50AX / NWA55AXE Hardware -------- CPU: Mediatek MT7621 RAM: 256M DDR3 FLASH: 128M NAND ETH: 1x Gigabit Ethernet WiFi: Mediatek MT7915 (2.4/5GHz 802.11ax 2x2 DBDC) BTN: 1x Reset (NWA50AX only) LED: 1x Multi-Color (NWA50AX only) UART Console ------------ NWA50AX: Available below the rubber cover next to the ethernet port. NWA55AXE: Available on the board when disassembling the device. Settings: 115200 8N1 Layout: <12V> <LAN> GND-RX-TX-VCC Logic-Level is 3V3. Don't connect VCC to your UART adapter! Installation Web-UI ------------------- Upload the Factory image using the devices Web-Interface. As the device uses a dual-image partition layout, OpenWrt can only installed on Slot A. This requires the current active image prior flashing the device to be on Slot B. If the currently installed image is started from Slot A, the device will flash OpenWrt to Slot B. OpenWrt will panic upon first boot in this case and the device will return to the ZyXEL firmware upon next boot. If this happens, first install a ZyXEL firmware upgrade of any version and install OpenWrt after that. Installation TFTP ----------------- This installation routine is especially useful in case * unknown device password (NWA55AXE lacks reset button) * bricked device Attach to the UART console header of the device. Interrupt the boot procedure by pressing Enter. The bootloader has a reduced command-set available from CLI, but more commands can be executed by abusing the atns command. Boot a OpenWrt initramfs image available on a TFTP server at 192.168.1.66. Rename the image to owrt.bin $ atnf owrt.bin $ atna 192.168.1.88 $ atns "192.168.1.66; tftpboot; bootm" Upon booting, set the booted image to the correct slot: $ zyxel-bootconfig /dev/mtd10 get-status $ zyxel-bootconfig /dev/mtd10 set-image-status 0 valid $ zyxel-bootconfig /dev/mtd10 set-active-image 0 Copy the OpenWrt ramboot-factory image to the device using scp. Write the factory image to NAND and reboot the device. $ mtd write ramboot-factory.bin firmware $ reboot Signed-off-by: David Bauer <mail@david-bauer.net>
2022-05-27 15:48:06 +00:00
KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
IMAGES += factory.bin ramboot-factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | zyxel-nwa-fit
IMAGE/ramboot-factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi
endef
define Device/zyxel_nwa50ax
$(Device/zyxel_nwa-ax)
DEVICE_MODEL := NWA50AX
endef
TARGET_DEVICES += zyxel_nwa50ax
define Device/zyxel_nwa55axe
$(Device/zyxel_nwa-ax)
DEVICE_MODEL := NWA55AXE
endef
TARGET_DEVICES += zyxel_nwa55axe
ramips: add support for ZyXEL WAP6805 (Altibox WiFi+) Hardware -------- SoC: MediaTek MT7621ST WiFi: MediaTek MT7603 Quantenna QT3840BC Flash: 128M NAND RAM: 64M LED: Dual colour red and green BTN: Reset WPS Eth: 4 x 10/100/1000 connected to MT7621 internal switch MT7621 RGMII port connected to Quantenna module GPIO: Power/reset of Quantenna module Quantenna module ---------------- The Quantenna QT3840BC (or QV840) is a separate SoC running another Linux installation. It is mounted on a wide mini-PCIe form factor module, but is connected to the RGMII port of the MT7621. It loads both a second uboot stage and an os image from the MT7621 using tftp. The module is configured using Quantenna specific RPC calls over IP, using 802.1q over the RGMII link to support multiple SSIDs. There is no support for using this module as a WiFi device in OpenWrt. A package with basic firmware and management tools is being prepared. Serial ports ------------ Two serial ports with headers: RRJ1 - 115200 8N1 - Connected to the Quantenna console J1 - 57600 8N1 - Connected to the MT7621 console Both share pinout with many other Zyxel/Mitrastar devices: 1 - NC (VDD) 2 - TX 3 - RX 4 - NC (no pin) 5 - GND Dual system partitions ---------------------- The vendor firmware and boot loader use a dual partition scheme storing a counter in the header of each partition. The partition with the highest number will be selected for boot. OpenWrt does not support this scheme and will always use the first OS partition. It will reset both counters to zero the first time sysupgrade is run, making sure the first partition is selected by the boot loader. Installation from vendor firmware --------------------------------- 1. Run a DHCP server. The WAP6805 is configured as a client device and does not have a default static IP address. Make a note of which address it is assigned 2. tftp the OpenWrt initramfs-kernel.bin image to this address. Wait for the WAP6805 to reboot. 3. ssh to the OpenWrt initramfs system on 192.168.1.1. Make a backup of all mtd partitions now. The last used OEM image is still present in either "Kernel" or "Kernel2" at this point, and can be restored later if you save a copy. 4. sysupgrade to the OpenWrt sysupgrade.bin image. Installation from U-Boot ------------------------ This requires serial console access 1. Copy the OpenWrt initramfs-kernel.bin image as "ras.bin" to your tftp server directory. Configure the server address as 192.168.0.33/24 2. Hit ESC when the message "Hit ESC key to stop autoboot" appears 3. Type "ATGU" + Enter, and then "2" immediately after pressing enter. 4. Answer Y to the question "Erase Linux in Flash then burn new one. Are you sure?", and answer the address/filename questions. Defaults: Input device IP (192.168.0.2) Input server IP (192.168.0.33) Input Linux Kernel filename ("ras.bin") 5. Wait until after you see the message "Done!" and power cycle the device. It will hang after flashing. 6. Continue with step 3 and 4 from the vendor firmware procedure. Notes on the WAP6805 U-Boot --------------------------- The bootloader has been modified with both ZyXELs zyloader and the device specific dual partition scheme. These changes appear to have broken a few things. The zyloader shell claims to support a number of ZyXEL AT commands, but not all of them work. The image selection scheme is unreliable and inconsistent. A limited U-Boot menu is available - and used by the above U-Boot install procedure. But direct booting into an uploaded image does not work, neither with ram nor with flash. Flashing works, but requires a hard reset after it is finished. Reverting to OEM firmware ------------------------- The OEM firmware can be restored by using mtd write from OpenWrt, flashing it to the "Kernel" partition. E.g. ssh root@192.168.1.1 "mtd -r -e Kernel write - Kernel" < oem.bin OEM firmwares for the WAP6805 are not avaible for public download, so a backup of the original installation is required. See above. Alternatively, firmware for the WAP6806 (Armor X1) may be used. This is exactly the same hardware. But the branding features do obviously differ. LED controller -------------- Hardware implementation is unknown. The dual-color LED is controlled by 3 GPIOs: 4: red 7: blinking green 13: green Enabling both red and green makes the LED appear yellow. The boot loader enables hardware blinking, causing the green LED to blink slowly on power-on, until the OpenWrt boot mode starts a faster software blink. Signed-off-by: Bjørn Mork <bjorn@mork.no> [fix alphabetic sorting for image build statement] Signed-off-by: Petr Štetiar <ynezz@true.cz>
2018-04-18 19:57:52 +00:00
define Device/zyxel_wap6805
$(Device/nand)
$(Device/uimage-lzma-loader)
ramips: add support for ZyXEL WAP6805 (Altibox WiFi+) Hardware -------- SoC: MediaTek MT7621ST WiFi: MediaTek MT7603 Quantenna QT3840BC Flash: 128M NAND RAM: 64M LED: Dual colour red and green BTN: Reset WPS Eth: 4 x 10/100/1000 connected to MT7621 internal switch MT7621 RGMII port connected to Quantenna module GPIO: Power/reset of Quantenna module Quantenna module ---------------- The Quantenna QT3840BC (or QV840) is a separate SoC running another Linux installation. It is mounted on a wide mini-PCIe form factor module, but is connected to the RGMII port of the MT7621. It loads both a second uboot stage and an os image from the MT7621 using tftp. The module is configured using Quantenna specific RPC calls over IP, using 802.1q over the RGMII link to support multiple SSIDs. There is no support for using this module as a WiFi device in OpenWrt. A package with basic firmware and management tools is being prepared. Serial ports ------------ Two serial ports with headers: RRJ1 - 115200 8N1 - Connected to the Quantenna console J1 - 57600 8N1 - Connected to the MT7621 console Both share pinout with many other Zyxel/Mitrastar devices: 1 - NC (VDD) 2 - TX 3 - RX 4 - NC (no pin) 5 - GND Dual system partitions ---------------------- The vendor firmware and boot loader use a dual partition scheme storing a counter in the header of each partition. The partition with the highest number will be selected for boot. OpenWrt does not support this scheme and will always use the first OS partition. It will reset both counters to zero the first time sysupgrade is run, making sure the first partition is selected by the boot loader. Installation from vendor firmware --------------------------------- 1. Run a DHCP server. The WAP6805 is configured as a client device and does not have a default static IP address. Make a note of which address it is assigned 2. tftp the OpenWrt initramfs-kernel.bin image to this address. Wait for the WAP6805 to reboot. 3. ssh to the OpenWrt initramfs system on 192.168.1.1. Make a backup of all mtd partitions now. The last used OEM image is still present in either "Kernel" or "Kernel2" at this point, and can be restored later if you save a copy. 4. sysupgrade to the OpenWrt sysupgrade.bin image. Installation from U-Boot ------------------------ This requires serial console access 1. Copy the OpenWrt initramfs-kernel.bin image as "ras.bin" to your tftp server directory. Configure the server address as 192.168.0.33/24 2. Hit ESC when the message "Hit ESC key to stop autoboot" appears 3. Type "ATGU" + Enter, and then "2" immediately after pressing enter. 4. Answer Y to the question "Erase Linux in Flash then burn new one. Are you sure?", and answer the address/filename questions. Defaults: Input device IP (192.168.0.2) Input server IP (192.168.0.33) Input Linux Kernel filename ("ras.bin") 5. Wait until after you see the message "Done!" and power cycle the device. It will hang after flashing. 6. Continue with step 3 and 4 from the vendor firmware procedure. Notes on the WAP6805 U-Boot --------------------------- The bootloader has been modified with both ZyXELs zyloader and the device specific dual partition scheme. These changes appear to have broken a few things. The zyloader shell claims to support a number of ZyXEL AT commands, but not all of them work. The image selection scheme is unreliable and inconsistent. A limited U-Boot menu is available - and used by the above U-Boot install procedure. But direct booting into an uploaded image does not work, neither with ram nor with flash. Flashing works, but requires a hard reset after it is finished. Reverting to OEM firmware ------------------------- The OEM firmware can be restored by using mtd write from OpenWrt, flashing it to the "Kernel" partition. E.g. ssh root@192.168.1.1 "mtd -r -e Kernel write - Kernel" < oem.bin OEM firmwares for the WAP6805 are not avaible for public download, so a backup of the original installation is required. See above. Alternatively, firmware for the WAP6806 (Armor X1) may be used. This is exactly the same hardware. But the branding features do obviously differ. LED controller -------------- Hardware implementation is unknown. The dual-color LED is controlled by 3 GPIOs: 4: red 7: blinking green 13: green Enabling both red and green makes the LED appear yellow. The boot loader enables hardware blinking, causing the green LED to blink slowly on power-on, until the OpenWrt boot mode starts a faster software blink. Signed-off-by: Bjørn Mork <bjorn@mork.no> [fix alphabetic sorting for image build statement] Signed-off-by: Petr Štetiar <ynezz@true.cz>
2018-04-18 19:57:52 +00:00
IMAGE_SIZE := 32448k
DEVICE_VENDOR := ZyXEL
DEVICE_MODEL := WAP6805
DEVICE_PACKAGES := kmod-mt7603 kmod-mt7621-qtn-rgmii -uboot-envtools
KERNEL := $$(KERNEL/lzma-loader) | uImage none | uimage-padhdr 160
ramips: add support for ZyXEL WAP6805 (Altibox WiFi+) Hardware -------- SoC: MediaTek MT7621ST WiFi: MediaTek MT7603 Quantenna QT3840BC Flash: 128M NAND RAM: 64M LED: Dual colour red and green BTN: Reset WPS Eth: 4 x 10/100/1000 connected to MT7621 internal switch MT7621 RGMII port connected to Quantenna module GPIO: Power/reset of Quantenna module Quantenna module ---------------- The Quantenna QT3840BC (or QV840) is a separate SoC running another Linux installation. It is mounted on a wide mini-PCIe form factor module, but is connected to the RGMII port of the MT7621. It loads both a second uboot stage and an os image from the MT7621 using tftp. The module is configured using Quantenna specific RPC calls over IP, using 802.1q over the RGMII link to support multiple SSIDs. There is no support for using this module as a WiFi device in OpenWrt. A package with basic firmware and management tools is being prepared. Serial ports ------------ Two serial ports with headers: RRJ1 - 115200 8N1 - Connected to the Quantenna console J1 - 57600 8N1 - Connected to the MT7621 console Both share pinout with many other Zyxel/Mitrastar devices: 1 - NC (VDD) 2 - TX 3 - RX 4 - NC (no pin) 5 - GND Dual system partitions ---------------------- The vendor firmware and boot loader use a dual partition scheme storing a counter in the header of each partition. The partition with the highest number will be selected for boot. OpenWrt does not support this scheme and will always use the first OS partition. It will reset both counters to zero the first time sysupgrade is run, making sure the first partition is selected by the boot loader. Installation from vendor firmware --------------------------------- 1. Run a DHCP server. The WAP6805 is configured as a client device and does not have a default static IP address. Make a note of which address it is assigned 2. tftp the OpenWrt initramfs-kernel.bin image to this address. Wait for the WAP6805 to reboot. 3. ssh to the OpenWrt initramfs system on 192.168.1.1. Make a backup of all mtd partitions now. The last used OEM image is still present in either "Kernel" or "Kernel2" at this point, and can be restored later if you save a copy. 4. sysupgrade to the OpenWrt sysupgrade.bin image. Installation from U-Boot ------------------------ This requires serial console access 1. Copy the OpenWrt initramfs-kernel.bin image as "ras.bin" to your tftp server directory. Configure the server address as 192.168.0.33/24 2. Hit ESC when the message "Hit ESC key to stop autoboot" appears 3. Type "ATGU" + Enter, and then "2" immediately after pressing enter. 4. Answer Y to the question "Erase Linux in Flash then burn new one. Are you sure?", and answer the address/filename questions. Defaults: Input device IP (192.168.0.2) Input server IP (192.168.0.33) Input Linux Kernel filename ("ras.bin") 5. Wait until after you see the message "Done!" and power cycle the device. It will hang after flashing. 6. Continue with step 3 and 4 from the vendor firmware procedure. Notes on the WAP6805 U-Boot --------------------------- The bootloader has been modified with both ZyXELs zyloader and the device specific dual partition scheme. These changes appear to have broken a few things. The zyloader shell claims to support a number of ZyXEL AT commands, but not all of them work. The image selection scheme is unreliable and inconsistent. A limited U-Boot menu is available - and used by the above U-Boot install procedure. But direct booting into an uploaded image does not work, neither with ram nor with flash. Flashing works, but requires a hard reset after it is finished. Reverting to OEM firmware ------------------------- The OEM firmware can be restored by using mtd write from OpenWrt, flashing it to the "Kernel" partition. E.g. ssh root@192.168.1.1 "mtd -r -e Kernel write - Kernel" < oem.bin OEM firmwares for the WAP6805 are not avaible for public download, so a backup of the original installation is required. See above. Alternatively, firmware for the WAP6806 (Armor X1) may be used. This is exactly the same hardware. But the branding features do obviously differ. LED controller -------------- Hardware implementation is unknown. The dual-color LED is controlled by 3 GPIOs: 4: red 7: blinking green 13: green Enabling both red and green makes the LED appear yellow. The boot loader enables hardware blinking, causing the green LED to blink slowly on power-on, until the OpenWrt boot mode starts a faster software blink. Signed-off-by: Bjørn Mork <bjorn@mork.no> [fix alphabetic sorting for image build statement] Signed-off-by: Petr Štetiar <ynezz@true.cz>
2018-04-18 19:57:52 +00:00
endef
TARGET_DEVICES += zyxel_wap6805
ramips: mt7621: add support for ZyXEL WSM20 The ZyXEL WSM20 aka Multy M1 is a cheap mesh router system by ZyXEL based on the MT7621 CPU. Specifications ============== SoC: MediaTek MT7621AT (880MHz) RAM: 256MiB Flash: 128MiB NAND Wireless: 802.11ax (2x2 MT7915E DBDC) Ethernet: 4x 10/100/1000 (MT7530) Button: 1x WPS, 1x Reset, 1x LED On/Off LED: 7 LEDs (3x white, 2x red, 2x green) MAC address assignment ====================== The MAC address assignment follows stock: The label MAC address is the LAN MAC address, the WAN address is read from flash. The WiFi MAC addresses are set in userspace to label MAC + 1 and label MAC + 2. Installation (web interface) ============================ The device is cloud-managed, but there is a hidden local firmware upgrade page in the OEM web interface. The device has to be registered in the cloud in order to be able to access this page. The system has a dual firmware design, there is no way to tell which firmware is currently booted. Therefore, an -initramfs version is flashed first. 1. Log into the OEM web GUI 2. Access the hidden upgrade page by navigating to https://192.168.212.1/gui/#/main/debug/firmwareupgrade 3. Upload the -initramfs-kernel.bin file and flash it 4. Wait for OpenWrt to boot and log in via SSH 5. Transfer the sysupgrade file via SCP 6. Run sysupgrade to install the image 7. Reboot and enjoy NB: If the initramfs version was installed in RAS2, the sysupgrade script sets the boot number to the first partition. A backup has to be performed manually in case the OEM firwmare should be kept. Installation (UART method) ========================== The UART method is more difficult, as the boot loader does not have a timeout set. A semi-working stock firmware is required to configure it: 1. Attach UART 2. Boot the stock firmware until the message about failsafe mode appears 3. Enter failsafe mode by pressing "f" and "Enter" 4. Type "mount_root" 5. Run "fw_setenv bootmenu_delay 3" 6. Reboot, U-Boot now presents a menu 7. The -initramfs-kernel.bin image can be flashed using the menu 8. Run the regular sysupgrade for a permanent installation Changing the partition to boot is a bit cumbersome in U-Boot, as there is no menu to select it. It can only be checked using mstc_bootnum. To change it, issue the following commands in U-Boot: nand read 1800000 53c0000 800 mw.b 1800004 1 1 nand erase 53c0000 800 nand write 1800000 53c0000 800 This selects FW1. Replace "mw.b 1800004 1 1" by "mw.b 1800004 2 1" to change to the second slot. Back to stock ============= It is possible to flash back to stock, but a OEM firmware upgrade is required. ZyXEL does not provide the link on its website, but the link can be acquired from the OEM web GUI by analyzing the transferred JSON objects. It is then a matter of writing the firmware to Kernel2 and setting the boot partition to FW2: mtd write zyxel.bin Kernel2 echo -ne "\x02" | dd of=/dev/mtdblock7 count=1 bs=1 seek=4 conv=notrunc Signed-off-by: Andreas Böhler <dev@aboehler.at> Credits to forum users Annick and SirLouen for their initial work on this device
2023-04-04 17:41:26 +00:00
define Device/zyxel_wsm20
$(Device/nand)
ramips: mt7621: add support for ZyXEL WSM20 The ZyXEL WSM20 aka Multy M1 is a cheap mesh router system by ZyXEL based on the MT7621 CPU. Specifications ============== SoC: MediaTek MT7621AT (880MHz) RAM: 256MiB Flash: 128MiB NAND Wireless: 802.11ax (2x2 MT7915E DBDC) Ethernet: 4x 10/100/1000 (MT7530) Button: 1x WPS, 1x Reset, 1x LED On/Off LED: 7 LEDs (3x white, 2x red, 2x green) MAC address assignment ====================== The MAC address assignment follows stock: The label MAC address is the LAN MAC address, the WAN address is read from flash. The WiFi MAC addresses are set in userspace to label MAC + 1 and label MAC + 2. Installation (web interface) ============================ The device is cloud-managed, but there is a hidden local firmware upgrade page in the OEM web interface. The device has to be registered in the cloud in order to be able to access this page. The system has a dual firmware design, there is no way to tell which firmware is currently booted. Therefore, an -initramfs version is flashed first. 1. Log into the OEM web GUI 2. Access the hidden upgrade page by navigating to https://192.168.212.1/gui/#/main/debug/firmwareupgrade 3. Upload the -initramfs-kernel.bin file and flash it 4. Wait for OpenWrt to boot and log in via SSH 5. Transfer the sysupgrade file via SCP 6. Run sysupgrade to install the image 7. Reboot and enjoy NB: If the initramfs version was installed in RAS2, the sysupgrade script sets the boot number to the first partition. A backup has to be performed manually in case the OEM firwmare should be kept. Installation (UART method) ========================== The UART method is more difficult, as the boot loader does not have a timeout set. A semi-working stock firmware is required to configure it: 1. Attach UART 2. Boot the stock firmware until the message about failsafe mode appears 3. Enter failsafe mode by pressing "f" and "Enter" 4. Type "mount_root" 5. Run "fw_setenv bootmenu_delay 3" 6. Reboot, U-Boot now presents a menu 7. The -initramfs-kernel.bin image can be flashed using the menu 8. Run the regular sysupgrade for a permanent installation Changing the partition to boot is a bit cumbersome in U-Boot, as there is no menu to select it. It can only be checked using mstc_bootnum. To change it, issue the following commands in U-Boot: nand read 1800000 53c0000 800 mw.b 1800004 1 1 nand erase 53c0000 800 nand write 1800000 53c0000 800 This selects FW1. Replace "mw.b 1800004 1 1" by "mw.b 1800004 2 1" to change to the second slot. Back to stock ============= It is possible to flash back to stock, but a OEM firmware upgrade is required. ZyXEL does not provide the link on its website, but the link can be acquired from the OEM web GUI by analyzing the transferred JSON objects. It is then a matter of writing the firmware to Kernel2 and setting the boot partition to FW2: mtd write zyxel.bin Kernel2 echo -ne "\x02" | dd of=/dev/mtdblock7 count=1 bs=1 seek=4 conv=notrunc Signed-off-by: Andreas Böhler <dev@aboehler.at> Credits to forum users Annick and SirLouen for their initial work on this device
2023-04-04 17:41:26 +00:00
KERNEL_SIZE := 8192k
IMAGE_SIZE := 41943040
DEVICE_VENDOR := ZyXEL
DEVICE_MODEL := WSM20
DEVICE_PACKAGES := kmod-mt7915-firmware
KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb | znet-header V1.00(ABZF.0)C0
KERNEL_INITRAMFS := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb | znet-header V1.00(ABZF.0)C0
endef
TARGET_DEVICES += zyxel_wsm20