openwrt/package/boot/uboot-envtools/files/mediatek_filogic

150 lines
3.7 KiB
Plaintext
Raw Normal View History

#
# Copyright (C) 2021 OpenWrt.org
#
[ -e /etc/config/ubootenv ] && exit 0
touch /etc/config/ubootenv
. /lib/uboot-envtools.sh
. /lib/functions.sh
board=$(board_name)
ubootenv_add_mmc_default() {
local envdev="$(find_mmc_part "ubootenv" "${1:-mmcblk0}")"
ubootenv_add_uci_config "$envdev" "0x0" "0x40000" "0x40000" "1"
ubootenv_add_uci_config "$envdev" "0x40000" "0x40000" "0x40000" "1"
}
ubootenv_add_nor_default() {
local envdev="/dev/mtd$(find_mtd_index "u-boot-env")"
ubootenv_add_uci_config "$envdev" "0x0" "0x20000" "0x20000" "1"
ubootenv_add_uci_config "$envdev" "0x20000" "0x20000" "0x20000" "1"
}
ubootenv_add_ubi_default() {
. /lib/upgrade/nand.sh
local envubi=$(nand_find_ubi ubi)
local envdev=/dev/$(nand_find_volume $envubi ubootenv)
local envdev2=/dev/$(nand_find_volume $envubi ubootenv2)
ubootenv_add_uci_config "$envdev" "0x0" "0x1f000" "0x1f000" "1"
ubootenv_add_uci_config "$envdev2" "0x0" "0x1f000" "0x1f000" "1"
}
case "$board" in
abt,asr3000|\
h3c,magic-nx30-pro|\
jcg,q30-pro|\
mediatek: MERCUSYS MR90X v1: add OpenWrt U-Boot (UBI) layout This commit adds OpenWrt U-Boot (UBI) layout support for MERCUSYS MR90X v1. Stock U-Boot UBI size: 50 MiB OpenWrt U-boot UBI size: 126 MiB Install ------- 1. Perform steps 1-14 of the OpenWrt installation guide (use OpenWrt initramfs-recovery.itb instead of initramfs-kernel.bin at the step 10, 12 and 14). Link: https://openwrt.org/toh/mercusys/mr90x_v1#installation 2. Make backups: ``` cat /dev/mtd0 > /tmp/boot.bin cat /dev/mtd5 > /tmp/tp_data.bin ``` Copy /tp_data dir content, /tmp/boot.bin and /tmp/tp_data.bin and to your PC using scp. You can also backup the remaining partititons. Copy backups to a safe place, they are required for the next steps and stock firmware recovery. 3. Reboot to OpenWrt initramfs: ``` reboot ``` 4. Copy OpenWrt ubi-bl31-uboot.fip, ubi-preloader.bin, ubi-squashfs-sysupgrade.itb and MT7986_EEPROM.bin, default-mac (from /tp_data backup) to the /tmp folder of the router using scp. 5. Prepare UBI: ``` ubidetach -p /dev/mtd3; ubiformat /dev/mtd3 -y; ubiattach -p /dev/mtd3 ubimkvol /dev/ubi0 -N fip -t static -s 1MiB ubiupdatevol /dev/ubi0_0 /tmp/ubi-bl31-uboot.fip ubimkvol /dev/ubi0 -N ubootenv -s 0x1f000 ubimkvol /dev/ubi0 -N ubootenv2 -s 0x1f000 ``` 6. Install kmod-mtd-rw and unlock partitions: ``` opkg update && opkg install kmod-mtd-rw insmod mtd-rw i_want_a_brick=1 mtd unlock boot mtd unlock bl2 mtd unlock factory ``` 7. Prepare "factory" partition: ``` dd if=/dev/zero bs=$((0x8000)) count=1 | tr '\000' '\377' > /tmp/factory.bin dd if=/tmp/MT7986_EEPROM.bin of=/tmp/factory.bin conv=notrunc dd if=/tmp/default-mac >> /tmp/factory.bin ``` 8. Write "factory" partition: ``` mtd erase factory mtd write /tmp/factory.bin factory ``` 9. Write preloader partition: ``` mtd erase bl2 mtd write /tmp/ubi-preloader.bin bl2 ``` 10. Write OpenWrt sysupgrade image: ``` sysupgrade -n /tmp/ubi-squashfs-sysupgrade.itb ``` Recovery -------- 1. Place OpenWrt initramfs-recovery.itb image (with original name) on the tftp server (IP: 192.168.1.254). 2. Press "reset" button and power on the router. After ~10 sec release the button. 3. Use OpenWrt initramfs system for recovery. BL2 and FIP recovery -------------------- Use mtk_uartboot and UART connetion if BL2 or FIP in UBI is destroyed: Link: https://github.com/981213/mtk_uartboot Link: https://openwrt.org/toh/mercusys/mr90x_v1#serial Return to stock: ---------------- 1. Copy "boot" partition backup (boot.bin) to the /tmp dir of the router using scp. 2. Install kmod-mtd-rw: ``` opkg update && opkg install kmod-mtd-rw ``` 3. Restore stock U-Boot: ``` insmod mtd-rw i_want_a_brick=1 mtd unlock boot mtd erase boot mtd write /tmp/boot.bin boot ``` 4. Erase UBI and reboot: ``` mtd erase ubi reboot ``` 5. Open U-Boot web recovery, upload stock firmware image and start upgrade. Link: http://192.168.1.1 6. Complete steps 1-9 of the OpenWrt installation guide to get root rights. Link: https://openwrt.org/toh/mercusys/mr90x_v1#installation 7. Upload "tp_data" partition backup (tp_data.bin) to the /tmp folder of the router using scp. 8. Restore stock calibrations: ``` mtd write /tmp/tp_data.bin tp_data reboot ``` 9. Perform "factory restore" via stock firmware web interface. Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com> Link: https://github.com/openwrt/openwrt/pull/16744 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2024-10-20 12:21:33 +00:00
mercusys,mr90x-v1-ubi|\
netcore,n60|\
nokia,ea0326gmp|\
qihoo,360t7|\
mediatek: Routerich AX3000: add OpenWrt U-Boot layout This commit adds OpenWrt U-Boot layout support for Routerich AX3000. The aims: 1. Get open-source U-Boot; 2. Get maximum available free space in OpenWrt. Install ------- 1. Copy OpenWrt ubootmod-bl31-uboot.fip, ubootmod-preloader.bin, to the /tmp folder of the router using scp. 2. Make mtd partitions backups: http://192.168.1.1/cgi-bin/luci/admin/system/flash -> Save mtdblock contents 3. Install kmod-mtd-rw: ``` opkg update && opkg install kmod-mtd-rw ``` 4. Write FIP and preloader: ``` insmod mtd-rw i_want_a_brick=1 mtd unlock BL2 mtd erase BL2 mtd write /tmp/ubootmod-preloader.bin BL2 mtd unlock FIP mtd erase FIP mtd write /tmp/ubootmod-bl31-uboot.fip FIP ``` 5. Copy OpenWrt ubootmod-initramfs-recovery.itb to the tftp server root with IP 192.168.1.254. 6. Reboot router: ``` reboot ``` U-Boot will automatically download from the tftp server and boot OpenWrt initramfs system. 7. Copy OpenWrt ubootmod-squashfs-sysupgrade.itb to the /tmp dir of the router using scp. 8. Run sysupgrade: ``` sysupgrade -n /tmp/squashfs-sysupgrade.itb ``` Recovery -------- 1. Place OpenWrt initramfs-recovery.itb image (with original name) on the tftp server (IP: 192.168.1.254). 2. Press "reset" button and power on the router. After ~10 sec release the button. 3. Use OpenWrt initramfs system for recovery. BL2 and FIP recovery -------------------- Use mtk_uartboot and UART connection if BL2 or FIP in UBI is destroyed: Link: https://github.com/981213/mtk_uartboot Return to stock: ---------------- 1. Copy partition backups (BL2.bin and FIP.bin) to the /tmp dir of the router using scp. 2. Install kmod-mtd-rw: ``` opkg update && opkg install kmod-mtd-rw ``` 3. Restore stock U-Boot and reboot: ``` insmod mtd-rw i_want_a_brick=1 mtd unlock BL2 mtd erase BL2 mtd write /tmp/BL2.bin BL2 mtd unlock FIP mtd erase FIP mtd write /tmp/FIP.bin FIP reboot ``` 4. Open U-Boot web recovery, upload stock firmware image and start upgrade. Link: http://192.168.1.1 Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com> Link: https://github.com/openwrt/openwrt/pull/16791 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2024-10-26 09:37:14 +00:00
routerich,ax3000-ubootmod|\
tplink,tl-xdr4288|\
tplink,tl-xdr6086|\
tplink,tl-xdr6088|\
tplink,tl-xtr8488|\
xiaomi,mi-router-ax3000t-ubootmod|\
xiaomi,mi-router-wr30u-ubootmod|\
xiaomi,redmi-router-ax6000-ubootmod|\
zyxel,ex5601-t0-ubootmod)
ubootenv_add_ubi_default
;;
acer,predator-w6|\
acer,predator-w6d|\
acer,vero-w6m|\
glinet,gl-mt2500|\
glinet,gl-mt6000|\
glinet,gl-x3000|\
mediatek: filogic: add support for NRadio C8-668GL NRadio C8-668GL is a Wi-Fi 6 5G cellular router based on MediaTek MT7981B SoC. - **SoC**: MediaTek MT7981B (2x Cortex-A53, 1.3GHz) - **RAM**: Nanya NT5AD512M16C4-JR 1GB DDR4 - **Flash**: ESMT FC51L08SFY3A 8GB eMMC - **Ethernet**: - 1x 2.5GbE (via GMAC0 and GPY211 PHY, shared with MT7531AE) - 3x 10/100/1000 Mbps (via MT7531AE, connected to GMAC0) - 5G Modem: GMAC1 (via GPY211 PHY - RTL8125BG - RM520N-GL) - **Wi-Fi**: MediaTek MT7976CN (2.4GHz/5GHz, 802.11ax, 2x2 MIMO, AX3000) - **Buttons**: Reset, WPS - **LEDs**: Power, 5G, 4G, WiFi - **SIM Slot**: 1x Nano SIM - **5G Modem**: Quectel RM520N-GL (Snapdragon™ X62) - **Power**: 12V/2A DC, 5.5×2.1 connector The MAC addresses are derived from the `fac_mac` field in the `bdinfo` partition, formatted as `fac_mac = HWMAC`. The allocation is as follows: | Vendor | OpenWrt Interface | Address | Notes | |---------|-------------------|---------------|------------------------------------------------| | LAN | br-lan | Label MAC | Default | | WAN | lan4 | Label MAC+1 | Only when lan4 is switched to WAN | | 2.4GHz | phy0-ap0 | Label MAC | | | 5GHz | phy1-ap0 | Label MAC | (Local Admin bit set) | | Modem | eth1 | Label MAC+2 | | 1. Log in to the router via `http://192.168.66.1`/. 2. Upgrade the official firmware to dual-system mode. 3. Select **Burn second system** and upload the `sysupgrade.bin` image. - Download the image from the OpenWrt build system or build it yourself using the OpenWrt buildroot. 4. Wait for 30 seconds and click **Switch system**. 5. The device will reboot and switch to OpenWrt. Set the U-Boot environment variable `boot_system=0` and reboot: ```bash fw_setenv boot_system 0 ``` Power off the router, hold the **WPS button**, and power it back on. 1. Rename the stock firmware file to **`recovery.bin`**. 2. Set your PC's Ethernet IP to **192.168.1.88** and connect it to the lan1 port on the router. 3. Run a TFTP server and place the `recovery.bin` file in its root directory. 4. Power off the router, press and hold the **Reset button**, and power it back on. 5. Release the Reset button when the TFTP server shows activity. 6. Wait for the router to flash the firmware and reboot automatically. - By default, `lan4` is part of `br-lan` and uses the label MAC address. - To query the RM520N-GL module, use the following command: ```bash cat /dev/ttyUSB2 & printf 'ATI\r\n' > /dev/ttyUSB2 ``` Signed-off-by: Yaoguang Bai <0xdeadc0de@badguys.club> Link: https://github.com/openwrt/openwrt/pull/17093 Signed-off-by: John Crispin <john@phrozen.org>
2024-11-26 09:18:28 +00:00
glinet,gl-xe3000|\
nradio,c8-668gl)
local envdev=$(find_mmc_part "u-boot-env")
ubootenv_add_uci_config "$envdev" "0x0" "0x80000"
;;
mediatek: filogic: add support ASUS RT-AX59U (based on support for ASUS RT-AX59U by liushiyou006) SOC: MediaTek MT7986 RAM: 512MB DDR4 FLASH: 128MB SPI-NAND (Winbond W25N01GV) WIFI: Mediatek MT7986 DBDC 802.11ax 2.4/5 GHz ETH: MediaTek MT7531 Switch UART: 3V3 115200 8N1 (Pinout silkscreened / Do not connect VCC) Upgrade from AsusWRT to OpenWRT using UART Download the OpenWrt initramfs image. Copy the image to a TFTP server reachable at 192.168.1.70/24. Rename the image to rtax59u.bin. Connect the PC with TFTP server to the RT-AX59U. Set a static ip on the ethernet interface of your PC. (ip address: 192.168.1.70, subnet mask:255.255.255.0) Conect to the serial console, interrupt the autoboot process by pressing '4' when prompted. Download & Boot the OpenWrt initramfs image. $ setenv ipaddr 192.168.1.1 $ setenv serverip 192.168.1.70 $ tftpboot 0x46000000 rtax59u.bin $ bootm 0x46000000 Wait for OpenWrt to boot. Transfer the sysupgrade image to the device using scp and install using sysupgrade. $ sysupgrade -n <path-to-sysupgrade.bin> Upgrade from AsusWRT to OpenWRT using WebUI Download transit TRX file from https://drive.google.com/drive/folders/1A20QdjK7Udagu31FSszpWAk8-cGlCwsq Upgrade firmware from WebUI (192.168.50.1) using downloaded TRX file Wait for OpenWRT to boot (192.168.1.1). Upgrade system with sysupgrade image using luci or uploading it through scp and executing sysupgrade command MAC Address for WLAN 5g is not following the same algorithm as in AsusWRT. We have increased by one the WLAN 5g to avoid collisions with other networks from WLAN 2g when bit 28 is already set. : Stock : OpenWrt WLAN 2g (1) : C8:xx:xx:0D:xx:D4 : C8:xx:xx:0D:xx:D4 WLAN 2g (2) : : CA:xx:xx:0D:xx:D4 WLAN 2g (3) : : CE:xx:xx:0D:xx:D4 WLAN 5g (1) : CA:xx:xx:1D:xx:D4 : CA:xx:xx:1D:xx:D5 WLAN 5g (2) : : CE:xx:xx:1D:xx:D5 WLAN 5g (3) : : C2:xx:xx:1D:xx:D5 WLAN 2g (1) : 08:xx:xx:76:xx:BE : 08:xx:xx:76:xx:BE WLAN 2g (2) : : 0A:xx:xx:76:xx:BE WLAN 2g (3) : : 0E:xx:xx:76:xx:BE WLAN 5g (1) : 0A:xx:xx:76:xx:BE : 0A:xx:xx:76:xx:BF WLAN 5g (2) : : 0E:xx:xx:76:xx:BF WLAN 5g (3) : : 02:xx:xx:76:xx:BF Signed-off-by: Xavier Franquet <xavier@franquet.es>
2023-11-20 07:18:00 +00:00
asus,rt-ax59u)
ubootenv_add_uci_config "/dev/mtd0" "0x100000" "0x20000" "0x20000"
;;
bananapi,bpi-r3|\
mediatek: filogic: add BananaPi BPi-R3 mini Hardware specification ---------------------- SoC: MediaTek MT7986A 4x A53 Flash: 128MB SPI-NAND, 8GB eMMC RAM: 2GB DDR4 Ethernet: 2x 2.5GbE (Airoha EN8811H) WiFi: MediaTek MT7976C 2x2 2.4G + 3x3 5G Interfaces: * M.2 Key-M: PCIe 2.0 x2 for NVMe SSD * M.2 Key-B: USB 3.0 with SIM slot * front USB 2.0 port LED: Power, Status, WLAN2G, WLAN5G, LTE, SSD Button: Reset, internal boot switch Fan: PWM-controlled 5V fan Power: 12V Type-C PD Installation instructions for eMMC ---------------------------------- 0. Set boot switch to boot from SPI-NAND (assuming stock rom or immortalwrt running there). 1. Write GPT partition table to eMMC Move openwrt-mediatek-filogic-bananapi_bpi-r3-mini-emmc-gpt.bin to the device /tmp using scp and write it to /dev/mmcblk0: dd if=/tmp/openwrt-*-r3-mini-emmc-gpt.bin of=/dev/mmcblk0 2. Reboot (to reload partition table) 3. Write bootloader and OpenWrt images Move files to the device /tmp using scp: - openwrt-*-bananapi_bpi-r3-mini-emmc-preloader.bin - openwrt-*-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip - openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb - openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb Write them to the appropriate partitions: echo 0 > /sys/block/mmcblk0boot0/force_ro dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-preloader.bin of=/dev/mmcblk0boot0 dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip of=/dev/mmcblk0p3 dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb of=/dev/mmcblk0p4 dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb of=/dev/mmcblk0p5 sync 4. Remove the device from power, set boot switch to eMMC and boot into OpenWrt. The device will come up with IP 192.168.1.1 and assume the Ethernet port closer to the USB-C power connector as LAN port. 5. If you like to have Ethernet support inside U-Boot (eg. to boot via TFTP) you also need to write the PHY firmware to /dev/mmcblk0boot1: echo 0 > /sys/block/mmcblk0boot1/force_ro dd if=/lib/firmware/airoha/EthMD32.dm.bin of=/dev/mmcblk0boot1 dd if=/lib/firmware/airoha/EthMD32.DSP.bin bs=16384 seek=1 of=/dev/mmcblk0boot1 Installation instructions for NAND ---------------------------------- 0. Set boot switch to boot from eMMC (assuming OpenWrt is installed there by instructions above. Using stock rom or immortalwrt does NOT work!) 1. Write things to NAND Move files to the device /tmp using scp: - openwrt-*-bananapi_bpi-r3-mini-snand-preloader.bin - openwrt-*-bananapi_bpi-r3-mini-snand-bl31-uboot.fip - openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb - openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb Write them to the appropriate locations: mtd write /tmp/openwrt-*-bananapi_bpi-r3-mini-snand-preloader.bin /dev/mtd0 ubidetach -m 1 ubiformat /dev/mtd1 ubiattach -m 1 volsize=$(wc -c < /tmp/openwrt-*-bananapi_bpi-r3-mini-snand-bl31-uboot.fip) ubimkvol /dev/ubi0 -N fip -n 0 -s $volsize -t static ubiupdatevol /dev/ubi0_0 /tmp/openwrt-*-bananapi_bpi-r3-mini-snand-bl31-uboot.fip cd /lib/firmware/airoha cat EthMD32.dm.bin EthMD32.DSP.bin > /tmp/en8811h-fw.bin ubimkvol /dev/ubi0 -N en8811h-firmware -n 1 -s 147456 -t static ubiupdatevol /dev/ubi0_1 /tmp/en8811h-fw.bin ubimkvol /dev/ubi0 -n 2 -N ubootenv -s 126976 ubimkvol /dev/ubi0 -n 3 -N ubootenv2 -s 126976 volsize=$(wc -c < /tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb) ubimkvol /dev/ubi0 -n 4 -N recovery -s $volsize ubiupdatevol /dev/ubi0_4 /tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb volsize=$(wc -c < /tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb) ubimkvol /dev/ubi0 -n 4 -N recovery -s $volsize ubiupdatevol /dev/ubi0_4 /tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb 3. Remove the device from power, set boot switch to NAND, power up and boot into OpenWrt. Partially based on immortalwrt support for the R3 mini, big thanks for doing the ground work! Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2024-01-26 17:28:01 +00:00
bananapi,bpi-r3-mini|\
bananapi,bpi-r4|\
bananapi,bpi-r4-poe|\
cmcc,rax3000m|\
jdcloud,re-cp-03)
. /lib/upgrade/fit.sh
export_fitblk_bootdev
case "$CI_METHOD" in
ubi)
ubootenv_add_ubi_default
;;
emmc)
bootdev=${EMMC_KERN_DEV%%p[0-9]*}
ubootenv_add_mmc_default "${bootdev#/dev/}"
;;
default)
ubootenv_add_nor_default
;;
esac
;;
mediatek: add Comfast CF-E393AX support Comfast CF-E393AX is a dual-band Wi-Fi 6 POE ceiling mount access point. Oem firmware is a custom openwrt 21.02 snapshot version. We can gain access via ssh once we remove the root password. Hardware specification: SoC: MediaTek MT7981A 2x A53 Flash: 128 MB SPI-NAND RAM: 256MB DDR3 Ethernet: 1x 10/100/1000 Mbps built-in PHY (WAN) 1x 10/100/1000/2500 Mbps MaxLinear GPY211C (LAN) Switch: MediaTek MT7531AE WiFi: MediaTek MT7976D LEDS: 1x (Red, Blue and Green) Button: Reset UART: 3.3v, 115200n8 -------------------------- | Layout | | ----------------- | | 4 | VCC GND TX RX | <= | | ----------------- | -------------------------- Gain SSH access: 1. Login into web interface (http://apipaddress/computer/login.html), and download the configuration(http://apipaddress/computer/config.html). 2. Rename downloaded backup config - 'backup.file to backup.tar.gz', Enter 'fakeroot' command then decompress the configuration: tar -zxf backup.tar.gz 3. Edit 'etc/shadow', update (remove) root password: With password = 'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::' 'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::' to Without password = 'root::0:99999:7:::' 'root::0:99999:7:::' 4. Repack 'etc' directory back to a new backup file: tar -zcf backup-ssh.tar.gz etc/ 5. Rename new config tar.gz file to 'backup-ssh.file' Exit fakeroot - 'exit' 6. Upload new configuration via web interface, now you can SSH with the following: 'ssh -vv -o HostKeyAlgorithms=+ssh-rsa \ -o PubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.10.1'. Backup the mtd partitions - https://openwrt.org/docs/guide-user/installation/generic.backup 7. Copy openwrt factory firmware to the tmp folder to install via ssh: 'scp -o HostKeyAlgorithms=+ssh-rsa \ -o PubkeyAcceptedAlgorithms=+ssh-rsa \ *-mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin \ root@192.168.10.1:/tmp/' 'sysupgrade -n -F \ /tmp/*--mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin' 8. Once led has stopped flashing - Connect via ssh with the default openwrt ip address - 'ssh root@192.168.1.1' 9. SSH copy the openwrt sysupgrade firmware and upgrade as per the default instructions. Signed-off-by: David Bentham <db260179@gmail.com>
2023-11-10 18:50:38 +00:00
comfast,cf-e393ax)
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x80000"
;;
cetron,ct3003|\
edgecore,eap111|\
netgear,wax220|\
zbtlink,zbt-z8102ax|\
zbtlink,zbt-z8103ax)
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000"
mediatek: filogic: add support for Ubiquiti UniFi 6 Plus (U6+) Ubiquiti U6+ is a dual-band WiFi 6 PoE access point. It is a drop-in upgrade of the U6 lite. Specifications --- - SoC: MediaTek MT7981A dual-core ARM Cortex-A53 1.3 GHz - RAM: 256 MB DDR3-2133 RAM - Flash: 16 MB SPI NOR and 4 GB eMMC - LAN: 1x Gigabit Ethernet with 802.3af/at support - WLAN: MediaTek MT7976C 2x2 MIMO dual-band WiFi 6 - LEDs: 1x blue and 1x white - Buttons: 1x reset button Installation --- 1. Power device using a PoE injector or switch 2. Connect via Ethernet to the device with static IP 192.168.1.2 3. SSH into the device with password: ubnt $ ssh ubnt@192.168.1.20 4. Unlock kernel partitions for writing $ echo 5edfacbf > /proc/ubnthal/.uf 5. Confirm correct partitions $ grep PARTNAME /sys/block/mmcblk0/mmcblk0p6/uevent PARTNAME=kernel0 $ grep PARTNAME /sys/block/mmcblk0/mmcblk0p7/uevent PARTNAME=kernel1 $ grep PARTNAME /sys/block/mmcblk0/mmcblk0p8/uevent PARTNAME=bs 6. Set and confirm bootloader environment $ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr); fdt rm /signature; bootubnt" $ fw_setenv bootcmd_real "run boot_openwrt" $ fw_printenv 7. Copy sysupgrade image to /tmp/openwrt.bin via scp 8. Copy kernel and rootfs to mmcblk0p6 and mmcblk0p7, respectively $ tar xf /tmp/openwrt.bin sysupgrade-ubnt_unifi-6-plus/kernel -O | dd of=/dev/mmcblk0p6 $ tar xf /tmp/openwrt.bin sysupgrade-ubnt_unifi-6-plus/root -O | dd of=/dev/mmcblk0p7 9. Ensure device boots from mmcblk0p6 $ echo -ne "\x00\x00\x00\x00\x2b\xe8\x4d\xa3" > /dev/mmcblk0p8 10. Reboot the device $ reboot Signed-off-by: Elbert Mai <code@elbertmai.com> Signed-off-by: Bjørn Mork <bjorn@mork.no>
2023-09-17 14:59:48 +00:00
;;
filogic: Add support for D-Link AQUILA PRO AI M30 Specification: - MT7981 CPU using 2.4GHz and 5GHz WiFi (both AX) - MT7531 switch - 512MB RAM - 128MB NAND flash with two UBI partitions with identical size - 1 multi color LED (red, green, blue, white) connected via GCA230718 - 3 buttons (WPS, reset, LED on/off) - 1 1Gbit WAN port - 4 1Gbit LAN ports Disassembly: - There are four screws at the bottom: 2 under the rubber feets, 2 under the label. - After removing the screws, the white plastic part can be shifted out of the blue part. - Be careful because the antennas are mounted on the side and the top of the white part. Serial Interface - The serial interface can be connected to the 4 pin holes on the side of the board. - Pins (from front to rear): - 3.3V - RX - TX - GND - Settings: 115200, 8N1 MAC addresses: - WAN MAC is stored in partition "Odm" at offset 0x81 - LAN (as printed on the device) is WAN MAC + 1 - WLAN MAC (2.4 GHz) is WAN MAC + 2 - WLAN MAC (5GHz) is WAN MAC + 3 Flashing via Recovery Web Interface: - The recovery web interface always flashes to the currently active partition. - If OpenWrt is flahsed to the second partition, it will not boot. - Ensure that you have an OEM image available (encrypted and decrypted version). Decryption is described in the end. - Set your IP address to 192.168.200.10, subnetmask 255.255.255.0 - Press the reset button while powering on the device - Keep the reset button pressed until the LED blinks red - Open a Chromium based and goto http://192.168.200.1 (recovery web interface) - Download openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-recovery.bin - The recovery web interface always reports successful flashing, even if it fails - After flashing, the recovery web interface will try to forward the browser to 192.168.0.1 (can be ignored) - If OpenWrt was flashed to the first partition, OpenWrt will boot (The status LED will start blinking white and stay white in the end). In this case you're done and can use OpenWrt. - If OpenWrt was flashed to the second partition, OpenWrt won't boot (The status LED will stay red forever). In this case, the following steps are reuqired: - Start the web recovery interface again and flash the **decrypted OEM image**. This will be flashed to the second partition as well. The OEM firmware web interface is afterwards accessible via http://192.168.200.1. - Now flash the **encrypted OEM image** via OEM firmware web interface. In this case, the new firmware is flashed to the first partition. After flashing and the following reboot, the OEM firmware web interface should still be accessible via http://192.168.200.1. - Start the web recovery interface again and flash the OpenWrt recovery image. Now it will be flashed to the first partition, OpenWrt will boot correctly afterwards and is accessible via 192.168.1.1. Flashing via U-Boot: - Open the case, connect to the UART console - Set your IP address to 192.168.200.2, subnet mask 255.255.255.0. Connect to one of the LAN interfaces of the router - Run a tftp server which provides openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-initramfs-kernel.bin. - Power on the device and select "7. Load image" in the U-Boot menu - Enter image file, tftp server IP and device IP (if they differ from the default). - TFTP download to RAM will start. After a few seconds OpenWrt initramfs should start - The initramfs is accessible via 192.168.1.1, change your IP address accordingly (or use multiple IP addresses on your interface) - Perform a sysupgrade using openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-sysupgrade.bin - Reboot the device. OpenWrt should start from flash now Revert back to stock using the Recovery Web Interface: - Set your IP address to 192.168.200.2, subnetmask 255.255.255.0 - Press the reset button while powering on the device - Keep the reset button pressed until the LED blinks red - Open a Chromium based and goto http://192.168.200.1 (recovery web interface) - Flash a decrypted firmware image from D-Link. Decrypting an firmware image is described below. Decrypting a D-Link firmware image: - Download https://github.com/RolandoMagico/firmware-utils/blob/M32/src/m32-firmware-util.c - Compile a binary from the downloaded file, e.g. gcc m32-firmware-util.c -lcrypto -o m32-firmware-util - Run ./m32-firmware-util M30 --DecryptFactoryImage <OriginalFirmware> <OutputFile> - Example for firmware M30A1_FW101B05: ./m32-firmware-util M30 --DecryptFactoryImage M30A1_FW101B05\(0725091522\).bin M30A1_FW101B05\(0725091522\)_decrypted.bin Flashing via OEM web interface is not possible, as it will change the active partition and OpenWrt is only running on the first UBI partition. Controlling the LEDs: - The LEDs are controlled by a chip called "GCA230718" which is connected to the main CPU via I2C (address 0x40) - I didn't find any documentation or driver for it, so the information below is purely based on my investigations - If there is already I driver for it, please tell me. Maybe I didn't search enough - I implemented a kernel module (leds-gca230718) to access the LEDs via DTS - The LED controller supports PWM for brightness control and ramp control for smooth blinking. This is not implemented in the driver - The LED controller supports toggling (on -> off -> on -> off) where the brightness of the LEDs can be set individually for each on cycle - Until now, only simple active/inactive control is implemented (like when the LEDs would have been connected via GPIO) - Controlling the LEDs requires three sequences sent to the chip. Each sequence consists of - A reset command (0x81 0xE4) written to register 0x00 - A control command (for example 0x0C 0x02 0x01 0x00 0x00 0x00 0xFF 0x01 0x00 0x00 0x00 0xFF 0x87 written to register 0x03) - The reset command is always the same - In the control command - byte 0 is always the same - byte 1 (0x02 in the example above) must be changed in every sequence: 0x02 -> 0x01 -> 0x03) - byte 2 is set to 0x01 which disables toggling. 0x02 would be LED toggling without ramp control, 0x03 would be toggling with ramp control - byte 3 to 6 define the brightness values for the LEDs (R,G,B,W) for the first on cycle when toggling - byte 7 defines the toggling frequency (if toggling enabled) - byte 8 to 11 define the brightness values for the LEDs (R,G,B,W) for the second on cycle when toggling - byte 12 is constant 0x87 Comparison to M32/R32: - The algorithms for decrypting the OEM firmware are the same for M30/M32/R32, only the keys differ - The keys are available in the GPL sources for the M32 - The M32/R32 contained raw data in the firmware images (kernel, rootfs), the R30 uses a sysupgrade tar instead - Creation of the recovery image is quite similar, only the header start string changes. So mostly takeover from M32/R32 for that. - Turned out that the bytes at offset 0x0E and 0x0F in the recovery image header are the checksum over the data area - This checksum was not checked in the recovery web interface of M32/R32 devices, but is now active in R30 - I adapted the recovery image creation to also calculate the checksum over the data area - The recovery image header for M30 contains addresses which don't match the memory layout in the DTS. The same addresses are also present in the OEM images - The recovery web interface either calculates the correct addresses from it or has it's own logic to determine where which information must be written Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
2023-12-24 13:42:23 +00:00
dlink,aquila-pro-ai-m30-a1)
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x40000" "0x40000"
;;
gatonetworks,gdsp)
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x10000"
;;
glinet,gl-mt3000)
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x80000" "0x20000"
;;
mediatek: add support for Routerich AX3000 This PR is continuation of work under "mediatek: add support for Routerich AX3000" #13703 by the agreement with PR #13703 original author (Maximilian Weinmann <x1@disroot.org>). All reviews from the previous PR were taken into into account. Routerich AX3000 is a wireless WiFi 6 router. Specification ------------- - SoC : MediaTek MT7981BA dual-core ARM Cortex-A53 1.3 GHz - RAM : DDR3 256 MiB (ESMT M15T2G16128A) - Flash : SPI-NAND 128 MiB (ESMT F50L1G41LB) - WLAN : MediaTek MT7976CN dual-band WiFi 6 - 2.4 GHz : b/g/n/ax, MIMO 2x2 - 5 GHz : a/n/ac/ax, MIMO 2x2 - Ethernet : 10/100/1000 Mbps x4 (MediaTek MT7531AE) - USB : 1x 2.0 - UART : through-hole on PCB - [J500] GND, TX, RX, 3.3V (115200n8) - Buttons : Mesh, Reset - LEDs : 1x Power (Blue) 1x WiFi 2.4 GHz (Blue) 1x WiFi 5 GHz (Red) 1x Mesh (Blue) 3x LAN activity (Blue) 1x WAN activity (Blue) 2x WAN no-internet (Red) - Power : 12 VDC, 1.5 A Installation ------------ Flash OpenWrt 'sysupgrade.bin' image using stock firmware web-interface (without keeping settings). Return to stock --------------- Install stock firmware image (without keeping settings) using OpenWrt sysupgrade method. Recovery -------- Connect uart, use u-boot menu to flash stock firmware image or boot OpenWrt initramfs image. MAC addresses ------------- +---------+-------------------+-----------+ | | MAC | Algorithm | +---------+-------------------+-----------+ | WAN | 24:0f:5e:xx:xx:b4 | label | | LAN | 24:0f:5e:xx:xx:b5 | label+1 | | WLAN 2g | 24:0f:5e:xx:xx:b6 | label+2 | | WLAN 5g | 24:0f:5e:xx:xx:b7 | label+3 | +---------+-------------------+-----------+ The WLAN 2g MAC was found in 'Factory', 0x4 Co-authored-by: Maximilian Weinmann <x1@disroot.org> Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2023-12-09 17:17:02 +00:00
mercusys,mr90x-v1|\
mediatek: filogic: add support for TP-LINK RE6000XD This commit adds support for TP-LINK RE6000XD. The device is quite similar to the Mercusys MR90X V1, except only 3 LAN ports and more LEDs. So thanks to csharper2005 for doing all the groundwork. Device specification -------------------- SoC Type: MediaTek MT7986BLA, Cortex-A53, 64-bit RAM: MediaTek MT7986BLA (512MB) Flash: SPI NAND GigaDevice (128 MB) Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8) Ethernet: 1x2.5Gbe (LAN3 2.5Gbps), 2xGbE (LAN 1Gbps, LAN1, LAN2) WLAN 2g: MediaTek MT7975N, b/g/n/ax, MIMO 4x4 WLAN 5g: MediaTek MT7975P(N), a/n/ac/ax, MIMO 4x4 LEDs: 8 LEDs, 1 status blue, 2x WIFI blue, 2x signal blue/red, 3 LAN blue gpio-controlled Button: 2 (Reset, WPS) USB ports: No Power: 12 VDC, 2 A Connector: Barrel Bootloader: Main U-Boot - U-Boot 2022.01-rc4. Additionally, ubi0 partition contain "seconduboot" (also U-Boot 2022.01-rc4) Serial console (UART), unpopulated --------------------- V +-------+-------+-------+-------+ | +3.3V | GND | TX | RX | +---+---+-------+-------+-------+ | +--- Don't connect Disassemble: rm the 2 screws at the bottom and the one at the backside. un-clip the case starting at the edge above the LEDs. Installation (UART) ------------------- 1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2 2. Attach UART, switch on the router and interrupt the boot process by pressing 'Ctrl-C' 3. Load and run OpenWrt initramfs image: tftpboot openwrt-mediatek-filogic-tplink_re6000xd-initramfs-kernel.bin bootm 4. Run 'sysupgrade -n' with the sysupgrade OpenWrt image Notice: while I was successfull at activating ssh (as described here: https://www.lisenet.com/2023/gaining-ssh-access-to-tp-link-re200-wi-fi-range-extender/) Unfortunately I haven't found the correct root password. Looks like they are using a static password (md5crypt, salt + 21 characters) that is not the web interface admin password. The TP-LINK RE900XD looks like the very same device, according to the pictures and the firmware. But I haven't checked if the OpenWrt firmware works as well on that device. The second ubi partition (ubi1) is empty and there is no known dual-partition mechanism, neither in u-boot nor in the stock firmware. Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
2024-05-17 15:33:00 +00:00
routerich,ax3000|\
mediatek: filogic: add support for Tenbay WR3000K Tenbay WR3000K is an 802.11ax (Wi-Fi 6) router, based on MediaTek MT7981B. - SoC: MetiaTek MT7981B - RAM: Hynex H5TQ2G863GFR 512MiB - Flash: Winbond W25N01GVZEIG 128MiB - Wi-Fi: MediaTek MT7976C (2.4GHz/5GHz, 802.11ax, 2x2 MIMO, AX3000) - MediaTek MT7915E: 2.4GHz and 5GHz - Ethernet: 1x 10/100/1000 Mbps WAN + 3x 10/100/1000 Mbps LAN - Switch: MediaTek MT7531AE - UART: J4 (115200 baud) - LEDs: Power - Buttons: Reset, WPS - PWR: 12V/1A DC, 5.5×2.1 connector | Vendor | OpenWrt Interface | Address | Notes | |---------|-------------------|---------------|------------------------------------------------| | WAN | wan | Label MAC | Stored MAC in factory + offset 4, label MAC is Stored MAC - 2 | | LAN | br-lan | Label MAC+1 | | | 2.4GHz | phy0-ap0 | Label MAC + 2 | | | 5GHz | phy1-ap0 | Label MAC + 3 | | - 0x000000000000-0x000000100000 : "BL2" - 0x000000100000-0x000000180000 : "u-boot-env" - 0x000000180000-0x000000380000 : "Factory" - 0x000000380000-0x000000580000 : "FIP" - 0x000000580000-0x000003580000 : "ubi" - 0x000003580000-0x000006580000 : "ubi1" - 0x000006580000-0x0000065a0000 : "Product" - 0x0000065a0000-0x000007580000 : "Custom" - The original partition-Ubi partition-Ubi1 is an AB dual system, and Openwrt only uses Ubi. So flash requires modifying the uboot variable `boot_from=ubi` to ensure that it only starts from Ubi. - The Product and Custom partitions are original and only exist to align with the original layout; they are not used by OpenWrt. - id: 0, kernel - id: 1, rootfs - id: 2, rootfs_data - **USB-to-TTL Serial Adapter** (e.g., CH340 or CP2102). - **Dupont Wires** (male-to-male, 3 wires). - **PC/Laptop** with a serial communication tool. - Screwdriver (to open the router case). 1. **OpenWrt Firmware**: - Download the appropriate `wr3000k-<build_time>-mediatek-filogic-tenbay_wr3000k-squashfs-sysupgrade.bin` firmware file for your router from the [OpenWrt website](https://openwrt.org/). 2. **Serial Communication Tool**: - Windows: PuTTY, Tera Term. - Linux/Mac: Minicom, screen. 3. (Optional) **TFTP Server**: - Install a TFTP server like Tftpd64 or tftp-hpa. --- 1. Open the router casing and locate the **TX, RX, and GND** pins. 2. Connect the router pins to the USB-to-TTL adapter as follows: - **TX (router)** → **RX (adapter)** - **RX (router)** → **TX (adapter)** - **GND (router)** → **GND (adapter)** 3. Do **not** connect the VCC pin to avoid damage. - **Baud rate**: 115200 - **Data bits**: 8 - **Stop bits**: 1 - **Parity**: None - **Flow control**: None --- 1. Power on the router and observe the serial terminal output. 2. When prompted (e.g., `Hit any key to stop autoboot: 3`), press the '/' key quickly to interrupt the boot process. 3. You will see the U-Boot Boot Menu: ```plaintext *** U-Boot Boot Menu *** 1. Factory mode 2. Startup system (Default) 3. Upgrade firmware 4. Upgrade ATF BL2 5. Upgrade ATF FIP 6. Upgrade single image 7. Load image 0. U-Boot console Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit ``` 4. Select Option 0 by typing 0 and pressing Enter. 5. Input into ```plaintext MT7981> setenv boot_from ubi MT7981> saveenv Saving Environment to MTD... Erasing on MTD device 'nmbm0'... OK Writing to MTD device 'nmbm0'... OK OK MT7981> printenv baudrate=115200 boot_from=ubi ... ``` the above indicates system will start from *ubi*. and then type ```plaintext MT7981> reset ``` will boot from *ubi* 1. Power on the router and observe the serial terminal output. 2. When prompted (e.g., `Hit any key to stop autoboot: 3`), press the '/' key quickly to interrupt the boot process. 3. You will see the U-Boot Boot Menu: ```plaintext *** U-Boot Boot Menu *** 1. Factory mode 2. Startup system (Default) 3. Upgrade firmware 4. Upgrade ATF BL2 5. Upgrade ATF FIP 6. Upgrade single image 7. Load image 0. U-Boot console Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit ``` 4. Choose Option 3: Upgrade Firmware Enter Upgrade Mode Select Option 3 by typing 3 and pressing Enter. Upgrade Methods You will be prompted to choose between: ```plaintext *** Upgrading Firmware *** Run image after upgrading? (Y/n): y Available load methods: 0 - TFTP client (Default) 1 - Xmodem 2 - Ymodem 3 - Kermit 4 - S-Record 5 - RAM Select (enter for default): 0 Input U-Boot's IP address: 192.168.1.1 Input TFTP server's IP address: 192.168.1.10 Input IP netmask: 255.255.255.0 Input file name: wr3000k-<build_time>-mediatek-filogic-tenbay_wr3000k-squashfs-sysupgrade.bin ``` Type Enter to proceed. The router will erase the old firmware and write the new one. Signed-off-by: Jianyu Zhuang <xzjianyu@gmail.com> Link: https://github.com/openwrt/openwrt/pull/17172 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2024-12-10 07:38:20 +00:00
tenbay,wr3000k|\
mediatek: filogic: add support for TP-LINK RE6000XD This commit adds support for TP-LINK RE6000XD. The device is quite similar to the Mercusys MR90X V1, except only 3 LAN ports and more LEDs. So thanks to csharper2005 for doing all the groundwork. Device specification -------------------- SoC Type: MediaTek MT7986BLA, Cortex-A53, 64-bit RAM: MediaTek MT7986BLA (512MB) Flash: SPI NAND GigaDevice (128 MB) Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8) Ethernet: 1x2.5Gbe (LAN3 2.5Gbps), 2xGbE (LAN 1Gbps, LAN1, LAN2) WLAN 2g: MediaTek MT7975N, b/g/n/ax, MIMO 4x4 WLAN 5g: MediaTek MT7975P(N), a/n/ac/ax, MIMO 4x4 LEDs: 8 LEDs, 1 status blue, 2x WIFI blue, 2x signal blue/red, 3 LAN blue gpio-controlled Button: 2 (Reset, WPS) USB ports: No Power: 12 VDC, 2 A Connector: Barrel Bootloader: Main U-Boot - U-Boot 2022.01-rc4. Additionally, ubi0 partition contain "seconduboot" (also U-Boot 2022.01-rc4) Serial console (UART), unpopulated --------------------- V +-------+-------+-------+-------+ | +3.3V | GND | TX | RX | +---+---+-------+-------+-------+ | +--- Don't connect Disassemble: rm the 2 screws at the bottom and the one at the backside. un-clip the case starting at the edge above the LEDs. Installation (UART) ------------------- 1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2 2. Attach UART, switch on the router and interrupt the boot process by pressing 'Ctrl-C' 3. Load and run OpenWrt initramfs image: tftpboot openwrt-mediatek-filogic-tplink_re6000xd-initramfs-kernel.bin bootm 4. Run 'sysupgrade -n' with the sysupgrade OpenWrt image Notice: while I was successfull at activating ssh (as described here: https://www.lisenet.com/2023/gaining-ssh-access-to-tp-link-re200-wi-fi-range-extender/) Unfortunately I haven't found the correct root password. Looks like they are using a static password (md5crypt, salt + 21 characters) that is not the web interface admin password. The TP-LINK RE900XD looks like the very same device, according to the pictures and the firmware. But I haven't checked if the OpenWrt firmware works as well on that device. The second ubi partition (ubi1) is empty and there is no known dual-partition mechanism, neither in u-boot nor in the stock firmware. Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
2024-05-17 15:33:00 +00:00
tplink,re6000xd)
local envdev=/dev/mtd$(find_mtd_index "u-boot-env")
ubootenv_add_uci_config "$envdev" "0x0" "0x20000" "0x20000" "1"
;;
openembed,som7981)
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x80000" "0x80000"
ubootenv_add_uci_sys_config "/dev/mtd3" "0x0" "0x100000" "0x100000"
;;
openwrt,one)
ubootenv_add_ubi_default
;;
smartrg,sdg-8733|\
smartrg,sdg-8733a|\
smartrg,sdg-8734)
local envdev=$(find_mmc_part "u-boot-env" "mmcblk0")
ubootenv_add_uci_config "$envdev" "0x0" "0x8000" "0x8000"
;;
ubnt,unifi-6-plus)
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x80000" "0x10000"
;;
mediatek: filogic: add support for Xiaomi AX3000T **SoC**: MediaTek MT7981B 2x A53 **Flash**: ESMT F50L1G41LB 128MB **RAM**: NT52B128M16JR-FL 256MB **Ethernet**: 4x 10/100/1000 Mbps **Switch**: MediaTek MT7531AE **WiFi**: MediaTek MT7976C **Buttons**: Reset, Mesh **Power**: DC 12V 1A 1. Get ssh access. Supported stock firmware **1.0.47** ``` curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=*******/api/misystem/arn_switch" -d "open=1&model=1&level=%0Anvram%20set%20ssh_en%3D1%0A" curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=*******/api/misystem/arn_switch" -d "open=1&model=1&level=%0Anvram%20commit%0A" curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=*******/api/misystem/arn_switch" -d "open=1&model=1&level=%0Ased%20-i%20's%2Fchannel%3D.*%2Fchannel%3D%22debug%22%2Fg'%20%2Fetc%2Finit.d%2Fdropbear%0A" curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=*******/api/misystem/arn_switch" -d "open=1&model=1&level=%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A" curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=********/api/misystem/arn_switch" -d "open=1&model=1&level=%0Apasswd%20-d%20root%0A ``` 2. Backup stock partitions ``` nanddump -f /tmp/BL2.bin /dev/mtd1 nanddump -f /tmp/Nvram.bin /dev/mtd2 nanddump -f /tmp/Bdata.bin /dev/mtd3 nanddump -f /tmp/Factory.bin /dev/mtd4 nanddump -f /tmp/FIP.bin /dev/mtd5 nanddump -f /tmp/ubi.bin /dev/mtd8 nanddump -f /tmp/KF.bin /dev/mtd12 ``` Then transfer them to your computer in a safe place. 3. Get firmware information `cat /proc/cmdline` 4. Copy openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi to **/tmp** and flash If **firmware=0** ``` ubiformat /dev/mtd9 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi nvram set boot_wait=on nvram set uart_en=1 nvram set flag_boot_rootfs=1 nvram set flag_last_success=1 nvram set flag_boot_success=1 nvram set flag_try_sys1_failed=0 nvram set flag_try_sys2_failed=0 nvram commit reboot ``` If **firmware=1** ``` ubiformat /dev/mtd8 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi nvram set boot_wait=on nvram set uart_en=1 nvram set flag_boot_rootfs=0 nvram set flag_last_success=0 nvram set flag_boot_success=1 nvram set flag_try_sys1_failed=0 nvram set flag_try_sys2_failed=0 nvram commit reboot ``` Then reboot your router, it should boot to the OpenWrt initramfs system now. 5. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin `sysupgrade -n /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin` 1. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb `ubiformat /dev/mtd8 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb` `reboot` 2. Install kmod-mtd-rw `opkg update && opkg install kmod-mtd-rw` `insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1` 3. Format ubi and create new ubootenv volume ``` ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8 ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB ``` 4. *(Optional **-10Mb** free space) Add recovery boot feature.* ``` ubimkvol /dev/ubi0 -n 2 -N recovery -s 10MiB ubiupdatevol /dev/ubi0_2 /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb ``` 5. Flash Openwrt U-Boot ``` mtd write /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-preloader.bin BL2 mtd write /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip FIP ``` 6. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-squashfs-sysupgrade.itb `sysupgrade -n /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-squashfs-sysupgrade.itb` 1. Force flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb `sysupgrade -F -n /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb` 2. Format ubi and Nvram ``` ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8 mtd erase Nvram ``` 3. Install kmod-mtd-rw `opkg update && opkg install kmod-mtd-rw` `insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1` 4. Flash stock images from backup ``` mtd write /tmp/BL2.bin BL2 mtd write /tmp/FIP.bin FIP mtd write /tmp/ubi.bin ubi ``` Then reboot your router, waiting it finished rollback in minutes. `ubiformat /dev/mtd7 -y -f /tmp/ubi.bin` Then reboot your router, waiting it finished rollback in minutes. Signed-off-by: Dim Fish <dimfish@gmail.com>
2023-11-27 09:01:34 +00:00
xiaomi,mi-router-ax3000t|\
xiaomi,mi-router-wr30u-stock|\
xiaomi,redmi-router-ax6000-stock)
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x20000"
ubootenv_add_uci_sys_config "/dev/mtd2" "0x0" "0x10000" "0x20000"
;;
mediatek: add support for Zyxel EX5601-T0 router Zyxel EX5601-T0 specifics -------------- The operator specific firmware running on the Zyxel branded EX5601-T0 includes U-Boot modifications affecting the OpenWrt installation. Partition Table | dev | size | erasesize | name | | ---- | -------- | --------- | ------------- | | mtd0 | 20000000 | 00040000 | "spi0.1" | | mtd1 | 00100000 | 00040000 | "BL2" | | mtd2 | 00080000 | 00040000 | "u-boot-env" | | mtd3 | 00200000 | 00040000 | "Factory" | | mtd4 | 001c0000 | 00040000 | "FIP" | | mtd5 | 00040000 | 00040000 | "zloader" | | mtd6 | 04000000 | 00040000 | "ubi" | | mtd7 | 04000000 | 00040000 | "ubi2" | | mtd8 | 15a80000 | 00040000 | "zyubi" | The router boots BL2 which than loads FIP (u-boot). U-boot has hardcoded a command to always launch Zloader "mtd read zloader 0x46000000" and than "bootm". Bootargs are deactivated. Zloader is the zyxel booloader which allow to dual-boot ubi or ubi2, by default access to zloader is blocked. Too zloader checks that the firmware contains a particolar file called zyfwinfo. Additional details regarding Zloader can be found here: https://hack-gpon.github.io/zyxel/ https://forum.openwrt.org/t/adding-openwrt-support-for-zyxel-ex5601-t0/155914 Hardware -------- SOC: MediaTek MT7986a CPU: 4 core cortex-a53 (2000MHz) RAM: 1GB DDR4 FLASH: 512MB SPI-NAND (Micron xxx) WIFI: Wifi6 Mediatek MT7976 802.11ax 5 GHz 4x4 + 2.4GHZ 4x4 ETH: MediaTek MT7531 Switch + SoC 3 x builtin 1G phy (lan1, lan2, lan3) 1 x MaxLinear GPY211B 2.5 N-Base-T phy5 (lan4) 1 x MaxLinear GPY211B 2.5Gbit xor SFP/N-Base-T phy6 (wan) USB: 1 x USB 3.2 Enhanced SuperSpeed port UART: 3V3 115200 8N1 (Pinout: GND KEY RX TX VCC) VOIP: 2 FXS ports for analog phones MAC Address Table ----------------- eth0/lan Factory 0x002a eth1/wan Factory 0x0024 wifi 2.4Ghz Factory 0x0004 wifi 5Ghz Factory 0x0004 + 1 Serial console (UART) --------------------- +-------+-------+-------+-------+-------+ | +3.3V | RX | TX | KEY | GND | +---+---+-------+-------+-------+-------+ | +--- Don't connect Installation ------------ Keep in mind that openwrt can only run on the UBI partition, the openwrt firmware is not able to understand the zloader bootargs. The procedure allows restoring the UBI partition with the Zyxel firmware and retains all the OEM functionalities. 1. Unlock Zloader (this will allow to swap manually between partitions UBI and UBI2): - Attach a usb-ttl adapter to your computer and boot the router. - While the router is booting at some point you will read the following: `Please press Enter to activate this console.` - As soon as you read that press enter, type root and than press enter again (just do it, don't care about the logs scrolling). - Most likely the router is still printing the boot log, leave it boot until it stops. - If everything went ok you should have full root access "root@EX5601-T0:/#". - Type the following command and press enter: "fw_setenv EngDebugFlag 0x1". - Reboot the router. - As soon as you read `Hit any key to stop autoboot:` press Enter. - If everything went ok you should have the following prompt: "ZHAL>". - You have successfully unlocked zloader access, this procedure must be done only once. 2. Check the current active partition: - Boot the router and repeat the steps above to gain root access. - Type the following command to check the current active image: "cat /proc/cmdline". - If `rootubi=ubi` it means that the active partition is `mtd6` - If `rootubi=ubi2` it means that the active partition is `mtd7` - As mentioned earlier we need to flash openwrt into ubi/mtd6 and never overwrite ubi2/mtd7 to be able to fully roll-back. - To activate and boot from mtd7 (ubi2) enter into ZHAL> command prompt and type the following commands: atbt 1 # unlock write atsw # swap boot partition atsr # reboot the router - After rebooting check again with "cat /proc/cmdline" that you are correctly booting from mtd7/ubi2 - If yes proceed with the installation guide. If not probably you don't have a firmware into ubi2 or you did something wrong. 3. Flashing: - Download the sysupgrade file for the router from openwrt, than we need to add the zyfwinfo file into the sysupgrade tar. Zloader only checks for the magic (which is a fixed value 'EXYZ') and the crc of the file itself (256bytes). I created a script to create a valid zyfwinfo file but you can use anything that does exactly the same: https://raw.githubusercontent.com/pameruoso/OpenWRT-Zyxel-EX5601-T0/main/gen_zyfwinfo.sh - Add the zyfwinfo file into the sysupgrade tar. - Enter via telnet or ssh into the router with admin credentials - Enter the following commands to disable the firmware and model checks "zycli fwidcheck off" and "zycli modelcheck off" - Open the router web interface and in the update firmware page select the "restore default settings option" - Select the sysupgrade file and click on upload. - The router will flash and reboot itself into openwrt from UBI 4. Restoring and going back to Zyxel firmware. - Use the ZHAL> command line to manually swap the boot parition to UBI2 with the following: atbt 1 # unlock write atsw # swap boot partition atsr # reboot the router - You will boot again the Zyxel firmware you have into UBI2 and you can flash the zyxel firmware to overwrite the UBI partition and openwrt. Working features ---------------- 3 gbit lan ports Wifi Zyxel partitioning for coexistance with Zloader and dual boot. WAN SFP port (only after exporting pins 57 and 10. gpiobase411) leds reset button serial interface usb port lan ethernet 2.5 gbit port (autosense) wan ethernet 2.5 gbit port (autosense) Not working ---------------- voip (missing drivers or proper zyxel platform software) Swapping the wan ethernet/sfp xor port ---------------- The way to swap the wan port between sfp and ethernet is the following: export the pins 57 and 10. Pin 57 is used to probe if an sfp is present. If pin 57 value is 0 it means that an sfp is present into the cage (cat /sys/class/gpio/gpio468/value). If pin 57 value is 1 it means that no sfp is inserted into the cage. In conclusion by default both 57 an 10 pins are by default 1, which means that the active port is the ethernet one. After inserting an SFP pin 57 will become 0 and you have to manually change the value of pin 10 to 0 too. This is totally scriptable of course. Leds description ------------ All the leds are working out of the box but the leds managed by the 2 maxlinear phy (phy 5 lan, phy6 wan). To activate the phy5 led (rj45 ethernet port led on the back of the router) you have to use mdio-tools. To activate the phy6 led (led on the front of the router for 2.5gbit link) you have to use mdio-tools. Example: Set lan5 led to fast blink on 2500/1000, slow blink on 10/100: mdio mdio-bus mmd 5:30 raw 0x0001 0x33FC Set wan 2.5gbit led to constant on when wan is 2.5gbit: mdio mdio-bus mmd 6:30 raw 0x0001 0x0080 Signed-off-by: Pietro Ameruoso <p.ameruoso@live.it>
2023-05-22 07:52:47 +00:00
zyxel,ex5601-t0)
local envdev=/dev/mtd$(find_mtd_index "u-boot-env")
ubootenv_add_uci_config "$envdev" "0x0" "0x20000" "0x40000" "2"
;;
filogic: support Telenor branded ZyXEL EX5700 Telenor quirks -------------- The operator specific firmware running on the Telenor branded ZyXEL EX5700 includes U-Boot modifications affecting the OpenWrt installation. Notable changes to U-Boot include - environment is stored in RAM and reset to defaults when power cycled - dual partition scheme with "nomimal" or "rescue" systems, falling back to "rescue" unless the OS signals success in 3 attempts - several runtime additions to the device-tree Some of these modifications have side effects requiring workarounds - U-Boot modifies /chosen/bootargs in an unsafe manner, and will crash unless this node exists - U-Boot verifies that the selected rootfs UBI volume exists, and refuses to boot if it doesn't. The chosen "rootfs" volume must contain a squashfs signature even for tftp or initramfs booting. - U-Boot parses the "factoryparams" UBI volume, setting the "ethaddr" variable to the label mac. But "factoryparams" does not always exist. Instead there is a "RIP" volume containing all the factory data. Copying the "RIP" volume to "factoryparams" will fix this Hardware -------- SOC: MediaTek MT7986 RAM: 1GB DDR4 FLASH: 512MB SPI-NAND (Mikron xxx) WIFI: Mediatek MT7986 802.11ax 5 GHz Mediatek MT7916 DBDC 802.11ax 2.4 + 6 GHz ETH: MediaTek MT7531 Switch + SoC 3 x builtin 1G phy (lan1, lan2, lan3) 2 x MaxLinear GPY211C 2.5 N-Base-T phy (lan4, wan) USB: 1 x USB 3.2 Enhanced SuperSpeed port UART: 3V3 115200 8N1 (Pinout: GND KEY RX TX VCC) Installation ------------ 1. Download the OpenWrt initramfs image. Copy the image to a TFTP server reachable at 192.168.1.2/24. Rename the image to C0A80101.img. 2. Connect the TFTP server to lan1, lan2 or lan3. Connect to the serial console, Interrupt the autoboot process by pressing ESC when prompted. 3. Download and boot the OpenWrt initramfs image. $ env set uboot_bootcount 0 $ env set firmware nominal $ tftpboot $ bootm 4. Wait for OpenWrt to boot. Transfer the sysupgrade image to the device using scp and install using sysupgrade. $ sysupgrade -n <path-to-sysupgrade.bin> Missing features ---------------- - The "lan1", "lan2" and "lan3" port LEDs are driven by the switch but OpenWrt does not correctly configure the output. - The "lan4" and "wan" port LEDs are driven by the GPH211C phys and not configured by OpenWrt. Signed-off-by: Bjørn Mork <bjorn@mork.no>
2023-03-28 13:04:21 +00:00
zyxel,ex5700-telenor)
ubootenv_add_uci_config "/dev/ubootenv" "0x0" "0x4000" "0x4000" "1"
;;
esac
config_load ubootenv
config_foreach ubootenv_add_app_config
exit 0