Use compat version to indicate that the new layout for larger kernels
is in place. This handled by the patch to ubnt.sh to always select
the kernel1 slot for flashing and as active kernel slot.
Signed-off-by: Tim Lunn <tim@feathertop.org>
Tested-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Link: https://github.com/openwrt/openwrt/pull/15194
(cherry picked from commit 1bdbd511b2)
Link: https://github.com/openwrt/openwrt/pull/17097
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Uboot selects which kernel slot to boot based on a flag in the factory
mtd partition. Patch ubnt.sh to ensure always flash to kernel1 slot and
update flag if required.
Signed-off-by: Tim Lunn <tim@feathertop.org>
Tested-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Link: https://github.com/openwrt/openwrt/pull/15194
(cherry picked from commit 5e355f1f90)
Link: https://github.com/openwrt/openwrt/pull/17097
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Edgerouter X currently has its eth1 port on the switch missing since there
is a naming conflict currently.
So, as the root cause is mixing kernel support for DSA interfaces having
predictable names set via "label" property vs others having it assigned
dynamically lets avoid the conflict by using our own custom property as
suggested upstream [1].
So, add support via "openwrt,netdev-name" property and use it on ERX.
Fixes: 2a25c6ace8 ("ramips: get rid of downstream network device label patch")
Fixes: #15643
Link: https://github.com/openwrt/openwrt/pull/17062
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 5695267847)
The Gemtek WVRTM-127ACN is an indoor dual band wifi router
with internal antennas and 3 Gigabit Ethernet ports.
The Gemtek WVRTM-130ACN is an indoor dual band wifi router
with external antennas and 5 Gigabit Ethernet ports.
Hardware of WVRTM-127ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB
- Storage: 128 MB NAND SLC flash
- Ethernet: 3x 10/100/1000 Mbps LAN1,LAN2 & WAN
- Wireless: 2.4GHz: Mediatek MT7603EN (802.11b/g/n)
- Wireless: 5GHz: Mediatek MT7612EN (802.11n/ac)
- LEDs: 11x
- Buttons: 2x WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ IN (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-127ACN_V02" "19K-513-8500R" "RoHS" "1717"
Hardware of WVRTM-130ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB (Kioxia TC58BVG0S3HTA00)
- Storage: 128 MB NAND SLC (Winbond W971GG6SB-25)
- Ethernet: 5x 10/100/1000 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
- Wireless: 2.4GHz and 5GHz Mediatek MT7615DN (802.11ac/b/g/n) (DBDC)
- LEDs: 10x
- Buttons: 3x Power, WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-130ACN_V01" "19K-515-4500R" "RoHS" "2112"
Enable access to uboot menu (needed in wvrtm-130acn):
- The access to uboot menu is blocked by `bootdelay = 0` set in ubootenv.
With stock firmware version 01.01.02.163 and previous, you can use CVE 2020-24365
command injection https://nvd.nist.gov/vuln/detail/CVE-2020-24365
python3 exploit.py -t 192.168.1.1 -c "fw_setenv bootdelay 3; fw_saveenv"
Backup the stock firmware:
- Connect via uart
- Connect via ethernet and assign your pc the address 192.168.15.x/24
- Power on the device; and start typing '4' to enter uboot menu
- Set factory mode and boot
MT7621 # setenv factory 2; saveenv
MT7621 # nand read 2800000 2000000 81000000; bootm
- Telnet and copy all mtd blocks
telnet 192.168.15.1
- Copy all mtd blocks and start webserver
for N in $(seq 0 6); do dd if=/dev/mtd$N of=/tmp/eeprom_mtd$N.bin; done
mount -o bind /tmp /www
lighttpd -f /etc/lighttpd.conf
- Backup stock rootfs_data (optional)
dd if=/dev/mtd7 of=/tmp/eeprom_mtd7.bin
dd if=/dev/mtd8 of=/tmp/eeprom_mtd8.bin
- Download to your pc from http://192.168.15.1/eeprom_mtd$N.bin
Installation:
- Connect via uart
- Connect via ethernet and assign your pc the address 10.10.10.3/24
- Start a tftp server and serve the image initramfs-kernel.bin
mkdir /tmp/ftpd;
cp initramfs-kernel.bin /tmp/ftpd/kernel.bin
dnsmasq --enable-tftp --tftp-root=/tmp/ftpd
- Power on the device; and start typing '4' to halt the bootloader
- Change the active mtd partition from mtd6 to mtd5 (needed by uboot)
MT7621 # setenv mtddevnum 5; saveenv
- Write the openwrt initramfs in ram via tftp and boot it
MT7621 # tftpboot 81000000 kernel.bin; bootm
- From the initramfs create the ubi device and install openwrt via sysupgrade
ubiformat /dev/mtd11 -y
sysupgrade -n -v /tmp/sysupgrade.bin
Recovery:
Restore the stock firmware from the backup of the mtd blocks
mtd write eeprom_mtd5.bin firmware
mtd write eeprom_mtd6.bin Kernel2
mtd write eeprom_mtd7.bin Storage1
mtd write eeprom_mtd8.bin Storage2
ubiformat /dev/mtd8 -y
reboot
Links to previous works on wvrtm-127acn:
https://github.com/digiampietro/hacking-gemtekhttps://forum.openwrt.org/t/add-support-for-gemtek-wvrtm-127acn-linkem-provider/168757
Signed-off-by: Samuele Longhi <agave@dracaena.it>
Link: https://github.com/openwrt/openwrt/pull/16685
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
73a9f9f857 added support. Let's use it.
Calibration data is not yet supported.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16256
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Currently eth1 (which is the first "lan" interface) doesn't work on this device.
During boot the following can be seen in logs:
```
[ 2.252804] mt7530-mdio mdio-bus:1f: MT7530 adapts as multi-chip module
[ 2.266060] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 19
[ 2.277889] mtk_soc_eth 1e100000.ethernet eth1: mediatek frame engine at 0xbe100000, irq 19
...
[ 2.355157] mt7530-mdio mdio-bus:1f: MT7530 adapts as multi-chip module
[ 2.390312] mt7530-mdio mdio-bus:1f: configuring for fixed/rgmii link mode
[ 2.398597] mt7530-mdio mdio-bus:1f: Link is Up - 1Gbps/Full - flow control rx/tx
[ 2.403872] mt7530-mdio mdio-bus:1f eth1 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7530 PHY] (irq=21)
[ 2.416988] mtk_soc_eth 1e100000.ethernet eth0: error -17 registering interface eth1
[ 2.426973] mt7530-mdio mdio-bus:1f eth2 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7530 PHY] (irq=22)
[ 2.440996] mt7530-mdio mdio-bus:1f eth3 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7530 PHY] (irq=23)
[ 2.454405] mt7530-mdio mdio-bus:1f eth4 (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7530 PHY] (irq=24)
[ 2.467198] mtk_soc_eth 1e100000.ethernet eth0: entered promiscuous mode
[ 2.474117] DSA: tree 0 setup
...
[ 6.820998] mtk_soc_eth 1e100000.ethernet dsa: renamed from eth0
[ 6.919904] mtk_soc_eth 1e100000.ethernet wan: renamed from eth1
```
So the problem seems to be the fact that built-in gmacs get default
names (eth0/eth1) and are renamed after switch ports are initialized. This means
that when switch port with name `eth1` is brought up this name is still used by
gmac1 causing switch port's init to fail.
This patch just renames the ports to avoid name collision.
Note: this will break existing configs for this device because it renames all
the ports. This should not be major problem because this device doesn't have a
proper OEM image and is only flashable with serial access, meaning there should
not be many users.
Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15865
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware Specification:
SoC: Mediatek MT7621DAT (MIPS1004Kc 880 MHz, dual core)
RAM: 128 MB
Storage: 128 MB NAND flash
Ethernet: 5x 10/100/1000 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
Wireless: 2.4GHz: Mediatek MT7603EN up to 300Mbps (802.11b/g/n MIMO 2x2)
Wireless: 5GHz: Mediatek MT7615N up to 1733Mbps (802.11n/ac MU-MIMO 4x4)
LEDs: Power (white & amber), Internet (white & amber)
LEDs: 2.4G (White), 5Ghz (White)
Buttons: WPS, Reset
USB: Front V3.0 & Rear V2.0
MAC Table
Label xx:xx:xx:xx:xx:38
LAN xx:xx:xx:xx:xx:39
2.4Ghz xx:xx:xx:xx:xx:3A
5Ghz xx:xx:xx:xx:xx:3C
WAN xx:xx:xx:xx:xx:38
Flash Instructions:
D-Link normal OEM firmware update page
1. upload OpenWRT factory.bin like any D-Link upgrade image
D-Link Fail Safe GUI:
1. Push and hold reset button (on the bottom of the device) until power led starts flashing (about 10 secs or so) while plugging in the power cable.
2. Give it ~30 seconds, to boot the fail safe GUI
3. Connect your client computer to LAN1 of the device
4. Set your client IP address manually to 192.168.0.2 / 255.255.255.0
5. Call the fail safe page for the device at http://192.168.0.1/
6. Use the provided fail safe web GUI to upload the factory.bin to the device
Signed-off-by: Alan Luck <luckyhome2008@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16269
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SoC: MediaTek MT7621
Flash: 16MB (Macronix MX25L12805D)
RAM: 128MB
Serial: As marked on PCB, baudrate is 57600, DO NOT CONNECT 3.3V!!!
Ethernet: 4x 10/100/1000 Mbps (3x LAN + WAN)
WIFI0: MT7615 2.4GHz 802.11b/g/n
WIFI1: MT7615 5GHz 802.11ac
Antennas: 6x external (3 per radio), non-detachable
LEDs: Programmable power-LED (blue-colored)
Buttons: Reset
INSTALLATION:
Get rootshell using insructions from https://gist.github.com/ZIKH26/18693c67ee7d2f8d2c60231b19194c37
Download and flash image
On computer:
python -m http.server
On router:
cd /tmp
wget http://:8000/factory.bin
mtd -r write factory.bin firmware
Device should reboot at this point.
Reverting to stock:
Download archive with firmware from Ruijie's site and
get .bin file from it. Then write that binary to firmware
partition. After reboot, factory-reset the router using
reset button.
Signed-off-by: Yahor Leonenka <staryjakau@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16202
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
ELECOM WSC-X1800GS is a 2.4/5 GHz band 11ax (Wi-Fi 6) mesh extender,
based on MT7621A
Specification:
- SoC : MediaTek MT7621A
- RAM : DDR3 512 MiB (Nanya NT5CC256M16ER-EK)
- Flash : RAW-NAND 128 MiB (Winbond W29N01HVSINF)
- WLAN : 2.4/5 GHz 2T2R (MediaTek MT7915D + MT7975D)
- Ethernet : 2x 10/100/1000 Mbps
- switch : MediaTek MT7530 (SoC)
- LEDs/Keys (GPIO): 9x/2x
- UART : through-hole on PCB ("J4")
- arrangement : 3.3V, GND, TX, RX from tri-angle marking
- settings : 115200n8
- Power : 12 VDC, 1 A (Max. 10.5 W)
Flash instruction using initramfs-factory image
1. Boot WMC-X1800GST normally
2. Access to "http://192.168.2.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt initramfs-factory image and click apply ("適用")
button
4. On initramfs image, download sysupgrade image to the device and
perform sysupgrade with that image
5. Wait ~120 seconds to complete flashing
Notes:
- The "firmware" partition on the stock image is only 0xF00000 (15 MiB)
and it's too small for the current OpenWrt firmware with UBI format.
So use the unused area at the end of NAND flash for rootfs (UBI).
MAC addresses:
LAN : 04:AB:18:xx:xx:6E (Factory, 0x3fff4 (hex))
2.4 GHz: 04:AB:18:xx:xx:6F (Factory, 0x3fffa (hex))
5 GHz : 04:AB:18:xx:xx:70 (Factory, 0x4 (hex))
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16384
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
ELECOM WMC-X1800GST is a 2.4/5 GHz band 11ax (Wi-Fi 6) mesh router,
based on MT7621A
Specification:
- SoC : MediaTek MT7621A
- RAM : DDR3 512 MiB (Nanya NT5CC256M16ER-EK)
- Flash : RAW-NAND 128 MiB (Winbond W29N01HVSINF)
- WLAN : 2.4/5 GHz 2T2R (MediaTek MT7915D + MT7975D)
- Ethernet : 3x 10/100/1000 Mbps
- switch : MediaTek MT7530 (SoC)
- LEDs/Keys (GPIO): 9x/5x
- UART : through-hole on PCB ("J4")
- arrangement : 3.3V, GND, TX, RX from tri-angle marking
- settings : 115200n8
- Power : 12 VDC, 1 A (Max. 11.5 W)
Flash instruction using initramfs-factory image
1. Boot WMC-X1800GST normally with "Router" mode
2. Access to "http://192.168.2.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt initramfs-factory image and click apply ("適用")
button
4. On initramfs image, download sysupgrade image to the device and
perform sysupgrade with that image
5. Wait ~120 seconds to complete flashing
Notes:
- The "firmware" partition on the stock image is only 0xF00000 (15 MiB)
and it's too small for the current OpenWrt firmware with UBI format.
So use the unused area at the end of NAND flash for rootfs (UBI).
MAC addresses:
LAN : 04:AB:18:xx:xx:BF (Factory, 0x3fff4 (hex))
WAN : 04:AB:18:xx:xx:C0 (Factory, 0x3fffa (hex))
2.4 GHz: 04:AB:18:xx:xx:C1 (Factory, 0x4 (hex))
5 GHz : 04:AB:18:xx:xx:C2
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16384
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for netis N6 WiFi 6 router.
Specification
-------------
- SoC : MediaTek MT7621AT, MIPS, 880 MHz
- RAM : 256 MiB
- Flash : NAND 128 MiB (ESMT PSU1GA30DT)
- WLAN : MT7905DAN + MT7975DN
- 2.4 GHz : b/g/n/ax, 574 Mbps, MIMO 2x2
- 5 GHz : a/n/ac/ax, 1201 Mbps, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x5 (1x WAN, 4x LAN)
- USB : 1x 3.0
- UART : 3.3V, 115200n8
- Buttons : 1x Reset
1x WPS
- LEDs : 1x Power (green)
1x System (green)
1x WAN (green)
1x WiFi 2.4 GHz (green), controlled by phy
1x WiFi 5 GHz (green), controlled by phy
1x WPS (green)
1x USB (green)
5x ethernet leds (green), controlled by switch
- Power : 12 VDC, 1.5 A
Installation
------------
1. Update the router using stock firmware web interface and OpenWrt
factory.bin image.
Recovery and return to stock
----------------------------
1. Assign your PC a static IP 192.168.1.2 and connect to the router using
the ethernet cable;
2. Power off the router;
3. Press Reset button, power on the router and wait until ethernet led
start blinking;
4. Release the button;
5. Open http://192.168.1.1/ (N6 System Recovery Mode) in your browser;
6. Upload OpenWrt factory.bin (or stock firmware *.bin) image and proceed
with upgrade.
MAC addresses
-------------
+---------+-------------------+
| | MAC example |
+---------+-------------------+
| LAN | dc:xx:xx:49:xx:04 |
| WAN | dc:xx:xx:49:xx:05 |
| WLAN 2g | dc:xx:xx:19:xx:06 |
| WLAN 5g | dc:xx:xx:79:xx:06 |
+---------+-------------------+
The WLAN MAC prototype was found in 'Factory', 0x4
The LAN MAC was found in 'Factory', 0x7ef20
The WAN MAC was found in 'Factory', 0x7ef26
Known issue
-----------
2.4 GHz WLAN doesn't start with mt76 driver.
Probable reason:
Original Netis N6 EEPROM contains wrong MT_EE_WIFI_CONF value (0xd2).
Other routers with the same WLAN hardware (e.g., Routerich AX1800)
have MT_EE_WIFI_CONF = 0x92.
Workaround (already included in this commit):
Extract EEPROM to a file at the first time boot and change
MT_EE_WIFI_CONF (offset 0x190) value from 0xd2 to 0x92. See
/etc/hotplug.d/firmware/11-mt76-caldata for details.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16322
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specifications:
- Device: DNA Valokuitu Plus EX400
- SoC: MT7621A
- Flash: 256MB NAND
- RAM: 256MB
- Ethernet: Built-in, 2 x 1GbE
- Wifi: MT7603 2.4 GHz, MT7615 5 GHz (4x internal antennas)
- USB: 1x 3.0
- LED: 1x green/red, 1x green
- Buttons: Reset
MAC addresses:
- LAN: u-boot 'ethaddr' (label)
- WAN: label + 1
- 2.4 GHz: label + 6
- 5 GHz: label + 7
Serial:
There is a black block connector next to the red ethernet connector. It
is accessible also through holes in the casing.
Pinout (TTL 3.3V)
+---+---+
|Tx |Rx |
+---+---+
|Vcc|Gnd|
+---+---+
Firmware:
The vendor firmware is a fork of OpenWrt (Reboot) with a kernel version
4.4.93. The flash is arranged as below and there is a dual boot
mechanism alternating between rootfs_0 and rootfs_1.
+-------+------+------+-----------+-----------+
| | env1 | env2 | rootfs_0 | rootfs_1 |
| +------+------+-----------+-----------+
| | UBI volumes |
+-------+-------------------------------------+
|U-Boot | UBI |
+-------+-------------------------------------+
|mtd0 | mtd1 |
+-------+-------------------------------------+
| NAND |
+---------------------------------------------+
In OpenWrt rootfs_0 will be used as a boot partition that will contain the
kernel and the dtb. The squashfs rootfs and overlay are standard OpenWrt
behaviour.
+-------+------+------+-----------+--------+------------+
| | env1 | env2 | rootfs_0 | rootfs | rootfs_data|
| +------+------+-----------+--------+------------+
| | UBI volumes |
+-------+-----------------------------------------------+
|U-Boot | UBI |
+-------+-----------------------------------------------+
|mtd0 | mtd1 |
+-------+-----------------------------------------------+
| NAND |
+-------------------------------------------------------+
U-boot:
With proper serial access booting can be halted to U-boot by pressing any
key. TFTP and flash writes are available, but only the first one has been
tested.
NOTE: Recovery mode can be accessed by holding down the reset button while
powering on the device. The led 'Update' will show a solid green light
once ready. A web server will be running at 192.168.1.1:80 and it will
allow flashing a firmware package. You can cycle between rootfs_0 and
rootfs_1 by pressing the reset button once.
Root password:
With the vendor web UI create a backup of your settings and download the
archive to your computer. Within the archive in the file
/etc/shadow replace the password hash for root with that of a password you
know. Restore the configuration with the vendor web UI and you will have
changed the root password.
SSH access:
You might need to enable the SSH service for LAN interface as by default
it's enabled for WAN only.
Installing OpenWrt:
With the vendor web UI install the OpenWrt factory image. Alternatively,
ssh to the device and use sysupgrade -n from cli.
Finalize by installing the OpenWrt sysupgrade image to get a fully
functioning system.
Reverting to the vendor firmware:
Boot with OpenWrt initramfs image
- Remove volumes rootfs_0, rootfs and rootfs_data and create vendor
volumes.
ubirmvol /dev/ubi0 -n 2
ubirmvol /dev/ubi0 -n 3
ubirmvol /dev/ubi0 -n 4
ubimkvol /dev/ubi0 -N rootfs_0 -S 990
ubimkvol /dev/ubi0 -N rootfs_1 -S 990
Power off and enter to the U-boot recovery to install the vendor
firmware.
Known issues:
- MACs for wifi are stored in currently unknown place but it seems
to persist over power-off. They might be stored on the chip.
Signed-off-by: Mauri Sandberg <maukka@ext.kapsi.fi>
[rmilecki: try NVMEM for MACs]
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
From the kernel log, we are using PCIe port 1 and 2.
dmesg:
```
[ 0.963526] mt7621-pci 1e140000.pcie: pcie0 no card, disable it (RST & CLK)
[ 0.970432] mt7621-pci 1e140000.pcie: PCIE1 enabled
[ 0.975312] mt7621-pci 1e140000.pcie: PCIE2 enabled
[ 1.071442] pci 0000:01:00.0: [14c3:7662] type 00 class 0x028000
[ 1.130382] pci 0000:02:00.0: [14c3:7603] type 00 class 0x028000
```
Fixes: https://github.com/openwrt/openwrt/issues/16000
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/16009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for a dual-band AX1800 wall plug manufactured
by Shenzhen Century Xinyang Tech Co., Ltd.
CPU: Mediatek MT7621A (2 cores, 4 threads)
RAM: 256i MiB DDR3 (Samsung K4B2G1646F-BCNB)
ROM: 16 MiB SPI NOR (Winbond W25Q128JVPQ)
Wired: one gigabit RJ45 port (with green/yellow non-GPIO LEDs)
WiFi: Mediatek MT7905DAN + MT7975DN (DBDC 2x 2T2R)
Ant.: four 2 dBi external antennas (two 2.4GHz, two 5 GHz)
GPIO: tri-color status LED (GPIO 13, 14, 16);
reset button (GPIO 18)
Power: 12V 2-pin JST-XH on main PCB
110/220V AC to 12V1A DC on auxiliary PCB
UART: 115200 8n1, SMD pads available on the PCB as J4
pinout is [3v3] (Rx) (Tx) (Gnd)
MAC: 1C:BF:CE:xx:xx:xx (2.4 GHz, label)
1C:BF:CE:xx:xx:xx + 1 (ethernet [1])
1C:BF:CE:xx:xx:xx + 2 (5 GHz)
Original firmware is LEDE Reboot 17.01-SNAPSHOT (kernel 4.4.198)
with a few custom packages and a non-LuCI web interface.
Telnet and SSH are enabled, requiring an unknown root password [2].
Root password is also needed to access the router via UART console,
but passwordless telnet can be enabled via a trivial web exploit [3]
and then the root password can be removed by editing `/etc/shadow`.
Installation: First upload `sysupgrade` binary via web interface at
`http://192.168.188.1/settings.shtml` and wait until getting back to
the home screen (select network to extend). The installation fails
since the original firmware uses `swconfig` and recent versions of
OpenWrt use DSA. However, the sysupgrade file is uploaded correctly
and stored at `/tmp/upgrade.bin`, so it can be written to flash via
the web exploit [4] (both `mtd -r write` and `sysupgrade -Fn` work
fine). Passwordless telnet/ssh is not needed for installation.
Alternatively, use u-boot menu to load image via TFTP.
Notes:
- Device model in LEDE is "MediaTek MT7621 RFB (802.11ax,SNOR)".
- It is sold under several names, among them are Wodesys WD-R1802U,
Fenvi F-AX1802U, and EDUP EP-2971; the Wodesys brand was selected
since it is referenced in `/etc/banner` and `/etc/hosts`, and the
PCB is marked "WD518A V1.0".
- Instead of a standard ethernet transformer, the PCB has a few tiny
SMD coils.
[1] Original firmware sets ethernet MAC to 1C:BF:CE:E7:62:1D based on
offset `0x3fff4` in the Factory partition; since this is the same
MAC for all units, whereas WiFi MACs stored at offsets 0x6 and 0xc
are unique, it was decided to use <label MAC + 1> for ethernet.
[2] root:$1$7rmMiPJj$91iv9LWhfkZE/t7aCBdo.0:18388:0:99999:7:::
[3] curl -X POST http://192.168.188.1/cgi-bin/adm.cgi \
-d page=Lang -d langType="en;killall telnetd;telnetd -l /bin/sh"
[4] curl -X POST http://192.168.188.1/cgi-bin/adm.cgi \
-d page=Lang -d langType="en;mtd -r write /tmp/upgrade.bin firmware"
Signed-off-by: Rani Hod <rani.hod@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15777
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Keenetic KN-3510 is a 2.4/5 Ghz band 11ax access point
Specification:
- System-On-Chip: MT7621AT
- CPU/Speed: 880 MHz
- Flash-Chip: Macronix MX30LF1G28AD-TI
- Flash size: 128 MiB
- RAM: 256 MiB
- 2x 10/100/1000 Mbps Ethernet
- PoE, 802.3af/at
- 4x internal antennas
- UART (J1) header on PCB (115200 8n1)
- WiFi: MT7915 2x2 2.4G 573.5Mbps + 2x2 5G 1201Mbps
- 2x LED, 2x button, 1x mode switch
Notes:
- The device supports dual boot mode
- The firmware partitions were concatinated into one
Flash instruction:
The only way to flash OpenWrt image is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24 and tftp server.
2. Rename "openwrt-ramips-mt7621-keenetic_kn-3510-squashfs-factory.bin"
to "KN-3510_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed until power led start blinking.
4. Router will download file from server, write it to flash and reboot
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15744
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The numberspace base has been changed since 6.6 kernel:
chip_num chip0 chip1 chip2 (32 gpios per bank)
old base 480 448 416
new base 512 544 576
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Buffalo WSR-2533DHPL2 is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based
on MediaTek MT7621A.
Specification:
- SoC : MediaTek MT7621AT
- RAM : DDR3 128 MiB (Winbond W631GG6MB12J)
- Flash : RAW-NAND 128 MiB (Winbond W29N01HVSINF)
- WLAN : 2.4/5 GHz (2x MediaTek MT7615N)
- Ethernet : 10/100/1000 Mbps x4
- Switch : MediaTek MT7530 (SoC)
- LED/keys : 8x/6x (2x buttons, 1x slide-switch)
- UART : through-hole on PCB (J4)
- arrangement : 3.3V, GND, TX, RX from triangle-mark
- settings : 57600n8
- Power : 12VDC 1.5A
Flash instruction using factory.bin image:
1. boot WSR-2533DHPL2 normally with "Router" mode
2. access to the WebI ("http://192.168.11.1/") on the device and open
firmware update page
("管理" -> "ファームウェア更新")
3. select the OpenWrt factory.bin image and click update ("更新実行")
button
Attention: do not use "factory-uboot.bin" image
4. Wait ~120 seconds to complete flashing
Flash instruction using initramfs image:
1. prepare the TFTP server with the initramfs image renamed to
"linux.trx-recovery" and IP address "192.168.11.2"
2. press the "AOSS" button while powering on the WSR-2533DHPL2
3. after 10 seconds, release the "AOSS" button, WSR-2533DHPL2 downloads
the initramfs image and boot with it automatically
4. on the initramfs image, download the factory-uboot.bin image to the
device and perform sysupgrade with it and "-F" option
5. wait ~120 seconds to complete flashing
Notes:
- There are 2x factory*.bin images for different purposes.
- factory.bin : for flashing on OEM WebUI
- factory-uboot.bin: for flashing on OEM bootloader or initramfs image
factory-uboot.bin is useful for recoverying the device, or refreshing
when the kernel partition is expanded in the future. sysupgrade on
this device accepts factory-uboot.bin with option "-F", but on that
situation, user configurations won't be kept, so it's not for normal
use.
MAC addresses:
LAN : 18:EC:E7:xx:xx:E0 (board_data, "mac" (text))
WAN : 18:EC:E7:xx:xx:E0 (board_data, "mac" (text))
2.4 GHz: 18:EC:E7:xx:xx:E1 (Factory, 0x4 (hex))
5 GHz : 18:EC:E7:xx:xx:E4 (Factory, 0x8004 (hex))
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Buffalo WSR-2533DHPLS is a 2.4/5 GHz band 11ac router, based on MediaTek
MT7621A.
Very similar to Buffalo WSR-2533DHPL, but with NAND, different GPIO
and TRX partitions.
Specification:
- SoC : MediaTek MT7621AT
- RAM : DDR3 256 MiB (Samsung K4B2G1646F-BYMA)
- Flash : RAW-NAND 128 MiB
(Winbond W29N01HV or KIOXIA TC58BVG0S3HTAI0)
- WLAN : 2.4/5 GHz (2x MediaTek MT7615N)
- Ethernet : 10/100/1000 Mbps
- Switch : MediaTek MT7530 (SoC) 4 ports
- LED/keys : 8x/6x (2x buttons, 1x slide-switch)
- UART : through-hole on PCB (J4)
- arrangement : 3.3V, GND, TX, RX from triangle-mark
- settings : 115200n8
- Power : 12VDC 1.5A
Flash instruction using factory.bin image:
1. boot WSR-2533DHPLS normally with "Router" mode
2. access to the WebI ("http://192.168.11.1/") on the device and open
firmware update page
("管理" -> "ファームウェア更新")
3. select the OpenWrt factory.bin image and click update ("更新実行")
button
Attention: do not use "factory-uboot.bin" image
4. Wait ~120 seconds to complete flashing
Flash instruction using initramfs image:
1. prepare the TFTP server with the initramfs image renamed to
"linux.trx-recovery" and IP address "192.168.11.2"
2. press the "AOSS" button while powering on the WSR-2533DHPLS
3. after 10 seconds, release the "AOSS" button, WSR-2533DHPLS downloads
the initramfs image and boot with it automatically
4. on the initramfs image, download the factory-uboot.bin image to the
device and perform sysupgrade with it and "-F" option
5. wait ~120 seconds to complete flashing
Notes:
- The embedded addresses in eeprom data in Factory partition have
Buffalo's OUI, but they don't match with the actual addresses
assigned to wlan devices. So fixup addresses by the user-space
script.
root@localhost:/# hexdump -C /dev/mtdblock3 | grep "^0000[08]000\s"
00000000 15 76 a0 00 88 57 ee bc 01 a8 15 76 c3 14 00 80 |.v...W.....v....|
00008000 15 76 a0 00 88 57 ee bc 01 f8 15 76 c3 14 00 80 |.v...W.....v....|
See "MAC addresses" below for actual addresses.
- There are 2x factory*.bin images for different purposes.
- factory.bin : for flashing on OEM WebUI
- factory-uboot.bin: for flashing on OEM bootloader or initramfs image
factory-uboot.bin is useful for recoverying the device, or refreshing
when the kernel partition is expanded in the future. sysupgrade on
this device accepts factory-uboot.bin with option "-F", but on that
situation, user configurations won't be kept, so it's not for normal
use.
MAC addresses:
LAN : 90:96:F3:xx:xx:30 (board_data, "mac" (text))
WAN : 90:96:F3:xx:xx:30 (board_data, "mac" (text))
2.4 GHz: 90:96:F3:xx:xx:31
5 GHz : 90:96:F3:xx:xx:38
[original work]
Signed-off-by: Audun-Marius Gangstø <audun@gangsto.org>
[convert to ubi, fix/improve DT, add sysupgrade support]
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Add support for D-Link DIR-2055 A1 based on similarities to DIR-1960 A1,
as well as various DIR-8xx A1 models. Existing DIR-1960 A1 openwrt
"factory" firmware installs without modifications via the D-Link Recovery
GUI and has no known incompatibilities with the DIR-2055 A1.
Changes to be committed:
new file: target/linux/ramips/dts/mt7621_dlink_dir-2055-a1.dts
modified: target/linux/ramips/image/mt7621.mk
modified: target/linux/ramips/mt7621/base-files/etc/board.d/01_leds
modified: target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh
Specifications:
Board: Not known
SoC: MediaTek MT7621 Family (MT7621AT)
RAM: 256 MB (Micron 9OK17 D9PTK, should be DDR3 MT41K128M16JT-125)
Flash: 128 MB (Winbond W29N01HVSINA)
WiFi: MediaTek MT7615 Family (MT7615N x2)
Switch: 1 WAN, 4 LAN (Gigabit)
Ports: 1 USB 3.0 (front)
Buttons: Reset, WiFi Toggle, WPS
LEDs: Power (white/orange), Internet (white/orange),
WiFi 2.4G (white), WiFi 5G (white)
Notes:
Only known difference vs. the DIR-1960 A1 is that the DIR-2055 A1
doesn't have a USB activity LED
Serial port:
Tested to be identical to various DIR-8xx A1 models with a similar
enclosure/pcb design:
Parameters: 57600, 8N1, 3.3V TTL no flow control
Location: J1 header (close to the Reset, WiFi and WPS buttons)
Pinout: 1 - VCC 2 - RXD 3 - TXD 4 - GND
Did not connect VCC when using
Installation:
D-Link Recovery GUI: power down the router, press and hold the reset
button, then re-plug it. Keep the reset button pressed until the power
LED starts flashing orange, manually assign a static IP address under
the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to
http://192.168.0.1
Some modern browsers may have problems flashing via the Recovery GUI,
if that occurs consider uploading the firmware through cURL:
curl -v -i -F "firmware=@file.bin" 192.168.0.1
Signed-off-by: Keith Harrison <keithh@protonmail.com>
Use a simple Shell script like on filogic target to get rid of downstream
patch for the Ethernet driver which was rejected upstream long ago.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
ELECOM WRC-X1800GS is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on
MT7621A.
Specification:
- SoC : MediaTek MT7621A
- RAM : DDR3 256 MiB
- Flash : RAW-NAND 128 MiB (Macronix MX30LF1G28AD-TI)
- WLAN : 2.4/5 GHz 2T2R (MediaTek MT7915D)
- Ethernet : 5x 10/100/1000 Mbps
- switch : MediaTek MT7530 (SoC)
- LEDs/Keys (GPIO) : 7x/4x
- UART : pin-header on PCB ("J5")
- arrangement : 3.3V, TX, RX, NC, GND from tri-angle marking
- settings : 115200n8
- Power : 12 VDC, 1 A
Flash instruction using initramfs-factory image:
1. Boot WRC-X1800GS normally with "Router" mode
2. Access to "http://192.168.2.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt initramfs-factory image and click apply ("適用")
button
4. After flashing initramfs-factory image and reboot, upload the
sysupgrade image and perform sysupgrade with it
5. Wait ~120 seconds to complete flashing
Notes:
- WRC-X1800GS has 2x os images. Those are switched on every firmware
updating on stock firmware, but dual-boot feature on this device
cannot be handled on OpenWrt. So the 1st image is always used on
OpenWrt.
This is controlled by "bootnum" variable embedded in "persist"
partition (addr: 0x4).
- WRC-X1800GS has 2x HW revisions. There are some small changes, but the
same DeviceTree in stock firmware is used for both revisions.
On this support of WRC-X1800GS, 2x green:wlan-2g-N LEDs are defined
for each revision and the same default triggers are set.
MAC addresses:
LAN : 38:97:A4:xx:xx:38 (Factory, 0x1fdfa (hex) / Ubootenv, ethaddr (text))
WAN : 38:97:A4:xx:xx:3B (Factory, 0x1fdf4 (hex))
2.4 GHz: 38:97:A4:xx:xx:39
5 GHz : 38:97:A4:xx:xx:3A
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
- Soc: MediaTek MT7621AT
- RAM: 512 MB (DDR3)
- Flash: 16 MB (SPI NOR)
- WiFi: MediaTek MT7905DAN, MediaTek MT7975DN
- Ethernet: 1 WAN, 3 LAN (Gigabit)
- Buttons: Reset, Joylink
- LEDs: (red, blue, green), routed to one indicator in the top of the
device
- Power: DC 12V 1A tip positive
- 1 TF Card Slot
The pins for the serial console are already labeled on the board
J4(V, R, T, G). Serial settings: 3.3V, 115200
MAC addresses:
| | MAC | Algorithm |
| ------- | ----------------- | --------- |
| label | dc:d8:xx:xx:xx:01 | label |
| LAN | dc:d8:xx:xx:xx:01 | label |
| WAN | dc:d8:xx:xx:xx:02 | label+1 |
| WLAN 2g | dc:d8:xx:xx:xx:03 | label+2 |
| WLAN 5g | de:d8:xx:xx:xx:04 | label+3 |
1. rename the
openwrt-ramips-mt7621-jdcloud_re-cp-02-squashfs-sysupgrade.bin
to JDCOS.bin
2. start a TFTP server from IP address 192.168.68.10 and serve the
image named JDCOS.bin
3. connect your device to the LAN port
4. power up the router and press any key on the console to interrupt
the boot process.
5. enter the following commands on the router console
1. setenv bootcount 6
2. saveenv
3. reset
> NOTE: wait for the restart, it will automatically fetch the
> image named JDCOS.bin from the TFTP server and write it into
> the flash. After the writing is completed, the router will be
> automatically restarted.
Unable to recognize large-capacity TF card, see #14042. But the patch
https://github.com/openwrt/openwrt/issues/14042#issuecomment-1910769942
works
Co-Authored-By: Jianti Chen <clbcjt@outlook.com>
Signed-off-by: Sheng Huang <shenghuang147@gmail.com>
Hardware Specification:
SoC: Mediatek MT7621DAT (MIPS1004Kc 880 MHz, dual core)
RAM: 128 MB
Storage: 128 MB NAND flash
Ethernet: 5x 10/100/1000 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
Wireless: 2.4GHz: Mediatek MT7603EN up to 300Mbps (802.11b/g/n MIMO 2x2)
Wireless: 5GHz: Mediatek MT7615N up to 1733Mbps (802.11n/ac MU-MIMO 4x4)
LEDs: Power (white & amber), Internet (white & amber)
LEDs: 2.4G (White), 5Ghz (White)
Buttons: WPS, Reset
MAC Table
Label xx:xx:xx:xx:xx:EB
LAN xx:xx:xx:xx:xx:EB
2.4Ghz xx:xx:xx:xx:xx:EC
5Ghz xx:xx:xx:xx:xx:ED
WAN xx:xx:xx:xx:xx:EE
Flash instructions:
D-Link normal OEM firmware update page
1. upload OpenWRT factory.bin like any D-Link upgrade image
D-Link Recovery GUI:
1. Push and hold reset button (on the bottom of the device) until power led starts flashing (about 10 secs or so) while plugging in the power cable.
2. Give it ~30 seconds, to boot the recovery mode GUI
3. Connect your client computer to LAN1 of the device
4. Set your client IP address manually to 192.168.0.2 / 255.255.255.0
5. Call the recovery page for the device at http://192.168.0.1/
6. Use the provided emergency web GUI to upload the recovery.bin to the device
Firefox on Windows in a Private Window (incognito) works me
Internet Explorer mode in Microsoft Edge works for others
seems to not work in Linux or virtual machine on Linux for most
some see success using 'curl -v -i -F "firmware=@file.bin" 192.168.0.1'
Thanks to @frkca and @rodneyrod for testing and pushing for its creation
Signed-off-by: Alan Luck <luckyhome2008@gmail.com>
Abandoning the label and using the function/color syntax for some dlink
dir series routers: dir-1960-a1, dir-2660-a1, dir-2640-a1, dir-3040-a1
and dir-3060-a1
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
This adds support for the A1 hardware revision of the DIR-3040.
It is an exact copy of the DIR-3060 save for some cosmetic changes to the housing.
Even going so far as having the same FCC ID.
Hardware specification:
SoC: MediaTek MT7621AT
Flash: Winbond W29N01HVSINA 128MB
RAM: Micron MT41K128M16JT-125 256MB
Ethernet: 5x 10/100/1000 Mbps
WiFi1: MT7615DN 2.4GHz N 2x2:2
WiFi2: MT7615DN 5GHz AC 2x2:2
WiFi3: MT7615N 5GHz AC 4x4:4
Button: WPS, Reset
Flash instructions:
OpenWrt can be installed via D-Link Recovery GUI:
NOTE: Seems to only work in Firefox on Windows.
Tried with Chrome on Windows, Firefox in Linux, and Chromium in Linux.
None of these other browsers worked.
1. Push and hold reset button (on the bottom of the device) until power led
starts flashing (about 10 secs or so) while plugging in the power cable.
2. Give it ~30 seconds, to boot the recovery mode GUI
3. Connect your client computer to LAN1 of the device
4. Set your client IP address manually to 192.168.0.2 / 255.255.255.0.
5. Call the recovery page for the device at http://192.168.0.1/
6. Use the provided emergency web GUI to upload and flash a new firmware to the device
Thanks to @Lucky1openwrt and @iivailo for creating the DIR-3060 DTS file and related changes,
so it was possible for me to adapt them to the DIR-3040, build images,
test and fix minor issues.
MAC Addresses:
| use | address | example |
| --- | --- | --- |
| LAN | label | f4:*:61 |
| WAN | label + 4 | f4:*:65 |
| WI1/2g | label + 2 | f4:*:63 |
| WI1/5g | label + 1 | f4:*:62 |
| WI2/5g | label + 3 | f4:*:64 |
The label MAC address was found in Factory, 0xe000
Checklist:
✓ nand
✓ ethernet
✓ button
✓ wifi2g
✓ wifi5g
✓ wifi5g
✓ mac
✓ led
Signed-off-by: Vince McKinsey <vincemckinsey@gmail.com>
This commit adds support for Z-ROUTER ZR-2660 (also known as Routerich
AX1800) wireless WiFi 6 router.
Specification
-------------
- SoC : MediaTek MT7621AT, MIPS, 880 MHz
- RAM : 256 MiB
- Flash : NAND 128 MiB (AMD/Spansion S34ML01G2)
- WLAN :
- 2.4 GHz : MediaTek MT7905D/MT7975 (14c3:7916), b/g/n/ax, MIMO 2x2
- 5 GHz : MediaTek MT7915E (14c3:7915), a/n/ac/ax, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x4 (1x WAN, 3x LAN)
- USB : 1x 2.0
- UART : 3.3V, 115200n8, pins are silkscreened on the pcb
- Buttons : 1x Reset
- LEDs : 1x WiFi 2.4 GHz (green)
1x WiFi 5 GHz (green)
1x LAN (green)
1x WAN (green)
1x WAN no-internet (red)
- Power : 12 VDC, 1 A
Installation
------------
1. Run tftp server on your PC (IP: 192.168.2.2) and put OpenWrt initramfs
image (initramfs.bin) to the tftp root dir
2. Open the following link in the browser to enable telnet:
http://192.168.2.1/cgi-bin/telnet_ssh
3. Connect to the router (default IP: 192.168.2.1) using telnet shell
(credentials - user:admin)
4. Run the following commands in the telnet shell (this will install
OpenWrt initramfs image on nand flash):
cd /tmp
tftp -g -r initramfs.bin 192.168.2.2
mtd write initramfs.bin firmware
mtd erase firmware_backup
reboot
5. Copy OpenWrt sysupgrade image (sysupgrade.bin) to the /tmp dir of the
router
6. Connect to the router (IP: 192.168.1.1) using ssh shell and run
sysupgrade command:
sysupgrade -n /tmp/sysupgrade.bin
Return to stock
---------------
1. Copy stock firmware (stock.bin) to the /tmp dir of the router using scp
2. Run following command in the router shell:
cd /tmp
mtd write stock.bin firmware
reboot
Recovery
--------
Connect uart (pins are silkscreened on the pcb), interrupt boot process by
pressing any key, use u-boot menu to flash stock firmware image or OpenWrt
initramfs image.
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 24:0f:5e:xx:xx:4c | label |
| WAN | 24:0f:5e:xx:xx:4d | label+1 |
| WLAN 2g | 24:0f:5e:xx:xx:4e | label+2 |
| WLAN 5g | 24:0f:5e:xx:xx:4f | label+3 |
+---------+-------------------+-----------+
The WLAN 2.4 MAC was found in 'factory', 0x4
The LAN MAC was found in 'factory', 0xfff4
The WAN MAC was found in 'factory', 0xfffa
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
The YunCore G720 is a dual band 802.11ax router with 5 GbE ports.
Specs:
- SoC: MediaTek MT7621
- Ethernet: 5x GbE ports (built-in MT7530)
- Wireless 2.4GHz / 5GHz: MediaTek MT7915E
- RAM: 256MiB
- ROM: 16MiB (W25Q128)
- 1 Button (reset)
- 8 LEDs (1x system, 2x wifi, 5x switch ports)
Flash instructions:
The vendor firmware is based on OpenWrt, the sysupgrade image can be
flashed using the '-F' (force) option on the CLI.
Make sure not to keep settings when doing so.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Unlike the recovery image, this initramfs-factory image can be flashed
using the stock firmware web interface (from any active boot partition),
as well as the bootloader recovery web page. Drop the recovery image in
favor of the factory image.
Installation via stock/recovery web interface:
1. Flash **initramfs-factory** image through the web page.
2. Boot into OpenWrt and perform sysupgrade with sysupgrade image.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Contrary to common ipTIME NOR devices, the "Config" partition of T5004
and AX2004M contain normal U-Boot environment variables. Renaming the
partition into "u-boot-env" serves for better description, and it also
conforms to common naming practice in OpenWrt.
This patch might also be extended to A3004T, but its u-boot-env
partition layout has not been confirmed yet.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
AX2004M uses NMBM on its NAND flash, but it was not enabled in DTS as the
device support [1] had been added before NMBM feature in mtk_bmt driver [2].
Let's enable it now.
With this change, there is a low possibility of boot failure after
sysupgrade from older versions. As AX2004M already has gone through
two stable releases in the meantime, it would be safe to warn users
by bumping DEVICE_COMPAT_VERSION.
[1] 37753f34ac ("ramips: add support for ipTIME AX2004M")
[2] 06382d1af7 ("kernel: add support for mediatek NMBM flash mapping support")
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
This commit:
1. Removes deprecated "label" property from the dts leds subnnodes;
2. Updates buttons and leds dts description according to kernel docs
examples.
Scope: devices well known to me.
Run-tested: TP-Link ec330-g5u, WiFire S1500.nbn
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Rostelecom RT-FE-1A is a wireless WiFi 5 router manufactured by Sercomm
company.
Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 256 MiB
Flash: 128 MiB
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7615E): a/n/ac, 4x4
Ethernet: 5x GbE (WAN, LAN1, LAN2, LAN3, LAN4)
USB ports: No
Button: 2 buttons (Reset & WPS)
LEDs:
- 1x Power (green, unmanaged)
- 1x Status (green, gpio)
- 1x 2.4G (green, hardware, mt76-phy0)
- 1x 2.4G (blue, gpio)
- 1x 5G (green, hardware, mt76-phy1)
- 1x 5G (blue, gpio)
- 5x Ethernet (green, hardware, 4x LAN & WAN)
Power: 12 VDC, 1.5 A
Connector type: barrel
Bootloader: U-Boot
Installation
-----------------
1. Login to the router web interface (default http://192.168.0.1/)
under "admin" account
2. Navigate to Settings -> Configuration -> Save to Computer
3. Decode the configuration. For example, using cfgtool.py tool (see
related section):
cfgtool.py -u configurationBackup.cfg
4. Open configurationBackup.xml and find the following block:
<OBJECT name="User." type="object" writable="1" encryption="0" >
<OBJECT name="1." type="object" writable="1" encryption="0" >
<PARAMETER name="Password" type="string" value="<some value>" writable="1" encryption="1" password="1" />
</OBJECT>
5. Replace <some value> by a new superadmin password and add a line
which enabling superadmin login after. For example, the block after
the changes:
<OBJECT name="User." type="object" writable="1" encryption="0" >
<OBJECT name="1." type="object" writable="1" encryption="0" >
<PARAMETER name="Password" type="string" value="s0meP@ss" writable="1" encryption="1" password="1" />
<PARAMETER name="Enable" type="boolean" value="1" writable="1" encryption="0"/>
</OBJECT>
6. Encode the configuration. For example, using cfgtool.py tool:
cfgtool.py -p configurationBackup.xml
7. Upload the changed configuration (configurationBackup_changed.cfg) to
the router
8. Login to the router web interface (superadmin:xxxxxxxxxx, where
xxxxxxxxxx is a new password from the p.5)
9. Enable SSH access to the router (Settings -> Access control -> SSH)
10. Connect to the router using SSH shell using superadmin account
11. Run in SSH shell:
sh
12. Make a mtd backup (optional, see related section)
13. Change bootflag to Sercomm1 and reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
reboot
14. Login to the router web interface under admin account
15. Remove dots from the OpenWrt factory image filename
16. Update firmware via web using OpenWrt factory image
Revert to stock
---------------
Change bootflag to Sercomm1 in OpenWrt CLI and then reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
mtd backup
----------
1. Set up a tftp server (e.g. tftpd64 for windows)
2. Connect to a router using SSH shell and run the following commands:
cd /tmp
for i in 0 1 2 3 4 5 6 7 8 9; do nanddump -f mtd$i /dev/mtd$i; \
tftp -l mtd$i -p 192.168.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done
tftp -l mtd.md5 -p 192.168.0.2
MAC Addresses
-------------
+-----+------------+---------+
| use | address | example |
+-----+------------+---------+
| LAN | label | f4:*:66 |
| WAN | label + 11 | f4:*:71 |
| 2g | label + 2 | f4:*:68 |
| 5g | label + 3 | f4:*:69 |
+-----+------------+---------+
The label MAC address was found in Factory, 0x21000
cfgtool.py
----------
A tool for decoding and encoding Sercomm configs.
Link: https://github.com/r3d5ky/sercomm_cfg_unpacker
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
This device is very similar, if not identical, to the TP-Link AX23 v1
but is targeted at service providers and features a completely different
flash layout.
Hardware
--------
CPU: MediaTek MT7621 DAT
RAM: 128MB DDR3 (integrated)
FLASH: 16MB SPI-NOR
WiFi: MediaTek MT7905 + MT7975 (2.4 / 5 DBDC) 802.11ax
SERIAL: 115200 8N1
LEDs - (3V3 - GND - RX - TX) - ETH ports
Installation
------------
Flashing is only possible via a serial connection using the sysupgrade
image; the factory image must be signed. You can flash the sysupgrade
image directly through the U-Boot console, or preferably, by booting the
initramfs image and flashing with the sysupgrade command. Follow these
steps for sysupgrade flashing:
1. Establish a UART serial connection.
2. Set up a TFTP server at 192.168.0.2 and copy the initramfs image
there.
3. Power on the device and press any key to interrupt normal boot.
4. Load the initramfs image using tftpboot.
5. Boot with bootm.
6. If you haven't done so already, back up all stock mtd partitions.
7. Copy the sysupgrade image to the router.
8. Flash OpenWrt through either LuCI or the sysupgrade command. Remember
not to attempt saving settings.
Revert to stock firmware
------------------------
Flash stock firmware via OEM web-recovery mode. If you don't have access
to the stock firmware image, you will need to restore the firmware
partition backed up earlier.
Web-Recovery
------------
The router supports an HTTP recovery mode:
1. Turn off the router.
2. Press the reset button and power on the device.
3. When all LEDs start flashing, release reset and quickly press it
again.
The interface is reachable at 192.168.0.1 and supports installation of
the OEM factory image. Note that flashing OpenWrt this way is not
possible, as mentioned above.
Signed-off-by: Darlan Pedro de Campos <darlanpedro@gmail.com>
The COVR-X1860 are MT7621-based AX1800 devices (similar to DAP-X1860, but
with two Ethernet ports and external power supply) that are sold in sets
of two (COVR-X1862) and three (COVR-X1863).
Specification:
- MT7621
- MT7915 + MT7975 2x2 802.11ax (DBDC)
- 256MB RAM
- 128 MB flash
- 3 LEDs (red, orange, white), routed to one indicator in the top of the device
- 2 buttons (WPS in the back and Reset at the bottom of the device)
MAC addresses:
- LAN MAC (printed on the device) is stored in config2 partition as ASCII (entry factory_mac=xx:xx:xx:xx:xx:xx)
- WAN MAC: LAN MAC + 3
- 2.4G MAC: LAN MAC + 1
- 5G MAC: LAN MAC + 2
The pins for the serial console are already labeled on the board (VCC, TX, RX, GND). Serial settings: 3.3V, 115200,8n1
Flashing via OEM Web Interface:
- Download openwrt-ramips-mt7621-dlink_covr-x1860-a1-squashfs-factory.bin via the OEM web interface firmware update
- The configuration wizard can be skipped by directly going to http://192.168.0.1/UpdateFirmware_Simple.html
Flashing via Recovery Web Interface:
- Set your IP address to 192.168.0.10, subnetmask 255.255.255.0
- Press the reset button while powering on the deivce
- Keep the reset button pressed until the status LED blinks red
- Open a Chromium based browser and goto http://192.168.0.1
- Download openwrt-ramips-mt7621-dlink_covr-x1860-a1-squashfs-recovery.bin
Revert back to stock using the Recovery Web Interface:
- Set your IP address to 192.168.0.10, subnetmask 255.255.255.25
- Press the reset button while powering on the deivce
- Keep the reset button pressed until the status LED blinks red
- Open a Chromium based browser and goto http://192.168.0.1
- Flash a decrypted firmware image from D-Link. Decrypting an firmware image is described below.
Decrypting a D-Link firmware image:
- Download https://github.com/openwrt/firmware-utils/blob/master/src/dlink-sge-image.c and https://raw.githubusercontent.com/openwrt/firmware-utils/master/src/dlink-sge-image.h
- Compile a binary from the downloaded file, e.g. gcc dlink-sge-image.c -lcrypto -o dlink-sge-image
- Run ./dlink-sge-image COVR-X1860 <OriginalFirmware> <OutputFile> -d
- Example for firmware 102b01: ./dlink-sge-image COVR-X1860 COVR-X1860_RevA_Firmware_102b01.bin COVR-X1860_RevA_Firmware_102b01_Decrypted.bin -d
The pull request is based on the discussion in https://forum.openwrt.org/t/add-support-for-d-link-covr-x1860
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Hardware:
- SoC: Mediatek MT7621 (MT7621AT)
- Flash: 32 MiB SPI-NOR (Macronix MX25L25635E)
- RAM: 128 MiB
- Ethernet: Built-in, 2 x 1GbE
- 3G/4G Modem: MEIG SLM828 (currently only supported with ModemManager)
- SLIC: Si32185 (unsupported)
- Power: 12V via barrel connector
- Wifi 2.4GHz: Mediatek MT7603BE 802.11b/g/b
- Wifi 5GHz: Mediatek MT7613BE 802.11ac/n/a
- LEDs: 8x (7 controllable)
- Buttons: 2x (RESET, WPS)
Installing OpenWrt:
- sysupgrade image is compatible with vendor firmware.
Recovery:
- Connect to any of the Ethernet ports, configure local IP:
10.10.10.3/24 (or 192.168.10.19/24, depending on OEM)
- Provide firmware file named 'mt7621.img' on TFTP server.
- Hold down both, RESET and WPS, then power on the board.
- Watch network traffic using tcpdump or wireshark in realtime to
observe progress of device requesting firmware. Once download has
completed, release both buttons and wait until firmware comes up.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Set correct GPIO (10) for the WPS button. This matches GPIO settings in
vendor GPL sources. Note that GPL sources also mention a USB indicator
LED (GPIO 13) but the device has neither an external USB port nor a USB LED.
In addition, prefixes (button-, led-) are added to relevant DT entries,
as well as color and function specifications for LEDs.
Closes: #13736
Reported-by: Waldemar Czabaj <kaball@wp.pl>
Signed-off-by: Rani Hod <rani.hod@gmail.com>
(added led mitigations for wifi leds)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
A typo snuck in with the addition of Cudy M1800, changing
"nr7101" to "nt7101". The result is a default network config
for NR7101 without the only ethernet interface on the NR7101,
thereby soft bricking it.
Fixes: f6d394e9f2 ("ramips: add support for Cudy M1800")
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Add support for COMFAST CF-EW72 V2
Hardware:
- SoC: Mediatek MT7621 (MT7621DAT or MT7621AT)
- Flash: 16 MiB NOR
- RAM: 128 MiB
- Ethernet: Built-in, 2 x 1GbE
- Power: only 802.3af PD on any port, injector supplied in the box
- PoE passthrough: No
- Wifi 2.4GHz: Mediatek MT7603BE 802.11b/g/b
- Wifi 5GHz: Mediatek MT7613BEN 802.11ac/n/a
- LEDs: 8x (only 1 is both visible and controllable, see below)
- Buttons: 1x (RESET)
Installing OpenWrt:
Flashing is done using Mediatek U-Boot System Recovery Mode
- make wired connection with 2 cables like this:
- - PC (LAN) <-> PoE Injector (LAN)
- - PoE Injector (POE) <-> CF-EW72 V2 (LAN). Leave unconnected to CF-EW72 V2 yet.
- configure 192.168.1.(2-254)/24 static ip address on your PC LAN
- press and keep pressed RESET button on device
- power the device by plugging PoE Injector (POE) <-> CF-EW72 V2 (LAN) cable
- wait for about 10 seconds until wifi led stops blinking and release RESET button
- navigate from your PC to http://192.168.1.1 and upload OpenWrt *-factory.bin firmware file
- proceed until router starts blinking with wifi led again (flashing) and stops (rebooting to OpenWrt)
MAC addresses as verified by OEM firmware:
vendor OpenWrt address
LAN lan\eth0 label
WAN wan label + 1
2g phy0 label + 2
5g phy1 label + 3
The label MAC address was found in 0xe000.
LEDs detailed:
The only both visible and controllable indicator is blue:wlan LED.
It is not bound by default to indicate activity of any wireless interfaces.
Place (WAN->ANT) | Num | GPIO | LED name (LuCI) | Note
-----------------|-----|-----------------------------------------------------------------------------------------
power | 1 | | | POWER LED. Not controlled with GPIO.
hidden_led_2 | 2 | 13 | blue:hidden_led_2 | This LED does not have proper hole in shell.
wan | 3 | | | WAN LED. Not controlled with GPIO.
hidden_led_4 | 4 | 16 | blue:hidden_led_4 | This LED does not have proper hole in shell.
lan | 5 | | | LAN LED. Not controlled with GPIO.
noconn_led_6 | 6 | | | Not controlled with GPIO, possibly not connected
wlan | 7 | 15 | blue:wlan | WLAN LED. Wireless indicator.
noconn_led_8 | 8 | | | Not controlled with GPIO, possibly not connected
mt76-phy0 and mt76-phy1 leds also exist in OpenWrt, but do not exist on board.
Signed-off-by: Alexey D. Filimonov <alexey@filimonic.net>
A bug report in the forum found that the MR70X lists four LAN ports in LuCI
while it has only three. This adds the device to the network setup file
to fix the issue.
Identified-by: Forum User "Lexeyko"
Signed-off-by: Andreas Böhler <dev@aboehler.at>
ALFA Network AX1800RM (FCC ID: 2AB877621) is a dual-band Wi-Fi 6
(AX1800) router, based on MediaTek MT7621A + MT79x5D platform.
Specifications:
- SOC: MT7621A (880 MHz)
- DRAM: DDR3 256 MiB (Nanya NT5CC128M16JR-EK)
- Flash: 16 MiB SPI NOR (EN25QH128A-104HIP)
- Ethernet: 4x 10/100/1000 Mbps (SOC's built-in switch)
- Wi-Fi: 2x2:2 2.4/5 GHz (MT7905DAN + MT7975DN)
(MT7905DAN doesn't support background DFS scan/BT)
- LED: 6x green, 1x green/red
- Buttons: 2x (reset, WPS)
- Antenna: 4x external, non-detachable omnidirectional
- UART: 1x 4-pin (2.54 mm pitch, J4, not populated)
- Power: 12 V DC/1 A (DC jack)
MAC addresses:
LAN: 00:c0:ca:xx:xx:4e (factory 0x4, +2)
WAN: 00:c0:ca:xx:xx:4f (factory 0x4, +3)
2.4 GHz: 00:c0:ca:xx:xx:4c (factory 0x4, device's label)
5 GHz: 00:c0:ca:xx:xx:4c (factory 0xa)
Flash instructions for web-based U-Boot recovery:
1. Power the device with WPS button pressed and wait around 10 seconds.
2. Setup static IP 192.168.1.2/24 on your PC.
3. Go to 192.168.1.1 in browser and upload 'recovery' image.
The device runs LEDE 17.01 (kernel 4.4.x) based firmware with 'failsafe'
mode available which allows alternative upgrade method:
1. Run device in 'failsafe' mode and change password for default user.
2. SSH to the device, transfer 'sysupgrade' image and perform upgrade
in forced mode, without preserving settings: 'sysupgrade -n -F ...'.
Other notes:
If you own early version of this device, the vendor firmware might
refuse OpenWrt image because of missing custom header. In that case,
ask vendor's customer support for stock firmware without custom header
support/requirement.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
The DRA-1360 rev A is a wall-plug AC1300 repeater.
Hardware is identical (same FCC ID, black case instead of white)
to D-Link DAP-1620 rev B, which is already supported, but a
different model name, revision, and hardware ID are needed.
Thus, the bulk of the DAP-1620 device tree is extracted to a
common dtsi included by the two models' device trees.
Repeating specs and installation instructions from e4c7703:
(note that the RAM size mentioned there was incorrect, oops)
Specs:
- SoC: MT7621AT (880MHz dual-core MIPS1004Kc)
- Memory: 128 MiB RAM, 16 MiB NOR SPI
- WiFi: MT7615DN 2x2 802.11n + 2x2 802.11ac (DBDC)
- Ethernet: 1 RJ45 port 10/100/1000
- Power/status LED: red+green
- LED RSSI bargraph: 2x green, 1x red+green
Installation:
- Keep reset button pressed during plug-in
- Web Recovery Updater is at 192.168.0.50
(pings are ignored, it listens only for http)
- Upload factory.bin, confirm flashing
(seems to work best with Chromium-based browsers)
Revert to OEM firmware:
- tail -c+117 DRA1360A1_FW112B03.bin | \
openssl aes-256-cbc -d -md md5 -out decrypted.bin \
-k c471706398cb147c6619f8a04a18d53e9c17ede8
- flash decrypted.bin via D-Link Web Recovery
Signed-off-by: Rani Hod <rani.hod@gmail.com>
I-O DATA WN-DEAX1800GR is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based
on MT7621A.
Specification:
- SoC : MediaTek MT7621A
- RAM : DDR3 256 MiB (Nanya NT5CC128M16JR-EK)
- Flash : RAW NAND 128 MiB (Winbond W29N01HVSINF)
- WLAN : 2.4/5 GHz (MediaTek MT7915)
- Ethernet : 5x 10/100/1000 Mbps
- Switch : MT7530 (SoC)
- LEDs/Keys : 6x/3x
- UART : through-hole on PCB (J2)
- assignment: 3.3V, GND, TX, RX from "1" marking
- settings : 115200n8
- Power : 12 VDC, 1 A
Flash instruction using initramfs-factory image:
1. Boot WN-DEAX1800GR normally
2. Access to "http://192.168.0.1/" and open firmware update page
("ファームウェア")
3. Select the OpenWrt initramfs-factory.bin image and click update
("更新") button to perform firmware update
4. On the initramfs image, perform sysupgrade with the
squashfs-sysupgrade.bin image
5. Wait ~120 seconds to complete flashing
Note:
- This device has 2x OS images on the flash storage. In this support,
the first one will be used.
Warning:
- Do not use "saveenv" command on U-Boot CLI.
This device has wrong u-boot-env data. The actual length of individual
env data installed to the device is 0x1000 (4 KiB), but installed
U-Boot requires 0x20000 (128 KiB). So U-Boot determines the data is
invalid. Then, if you perform saving environment data with saveenv on
U-Boot CLI, installed env data will be overwritten with too few
default values without individual values (SSID, password, MAC
addresses, etc...).
MAC addresses:
LAN : 50:41:B9:xx:xx:F4 (Config, ethaddr (text))
WAN : 50:41:B9:xx:xx:F6 (Config, wanaddr (text))
2.4 GHz: 50:41:B9:xx:xx:F4 (Config, rmac (text) / Factory, 0x4 (hex))
5 GHz : 50:41:B9:xx:xx:F5 (none)
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
I-O DATA devices manufactured by MSTC (MitraStar Technology Corp.)
have some important flags for booting, "bootnum" and "debugflag".
The almost devices have both flags but some devices have only
"bootnum" flag.
So optimize helper functions in iodata.sh to set each flags.
- both:
- WN-AX1167GR2
- WN-AX2033GR
- WN-DX1167R
- WN-DX1200GR
- WN-DX2033GR
- "bootnum" only
- WN-DEAX1800GR
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
The PHY of the wan2 port on MQmaker WiTi is wired to the second MAC of the
SoC. Rename the wan interface to wan1 and define it under the switch node,
effectively disabling the PHY muxing of the MT7530 switch's phy4.
Define the PHY of the wan2 port and adjust the gmac1 node accordingly. Now
that the PHY muxing feature is not being used anymore, the wan2 port can be
used to achieve 2 Gbps total bandwidth to the CPU.
Tested-by: Demetris Ierokipides <ierokipides.dem@gmail.com>
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
The TP-Link EAP613 v1 is a ceiling-mount 802.11ax access point. It can
be powered via PoE or a DC barrel connector (12V). Connecting to the
UART requires fine soldering and careful manipulation of any soldered
wires.
Device details:
* SoC: MT7621AT
* Flash: 16 MiB SPI NOR
* RAM: 256 MiB DDR3L
* Wi-Fi:
* MT7905DA + MT7975D: 2.4 GHz + 5 GHz (DBDC), 2x2:2
* Two stamped metal antennas (ANT1, ANT2)
* One PCB antenna (ANT3)
* One unpopulated antenna (ANT4)
* Ethernet:
* 1× 10/100/1000 Mbps port with PoE
* LEDs:
* Array of four blue LEDs with one control line
* Buttons:
* Reset
* Board test points:
* UART: next to CPU RF-shield and power circuits
* JTAG: under CPU RF-shield (untested)
* Watchdog: 3PEAK TPV706 (not implemented)
Althought three antennas are populated, the MT7905DA does not support
the additional Rx chain for background DFS detection (or Bluetooth)
according to commit 6cbcc34f50 ("ramips: disable unsupported
background radar detection").
MAC addresses:
* LAN: 48:22:54:xx:xx:a2 (device label)
* WLAN 2.4 GHz: 48:22:54:xx:xx:a2
* WLAN 5 GHz: 48:22:54:xx:xx:a3
The radio calibration blob stored in flash also contains valid MAC
addresses for both radio bands (OUI 00:0c:43).
Factory install:
1. Enable SSH on the device via web interface
2. Log in with SSH, and run `cliclientd stopcs`
3. Upload -factory.bin image via web interface. It may be necessary to
shorten the filename of the image to e.g. 'factory.bin'.
Recovery:
1. Open the device by unscrewing four screws from the backside
2. Carefully remove board from the housing
3. Connect to UART (3.3V):
* Find test points labelled "VCC", "GND", "UART_TX", "UART_RX"
* Solder wires to test points or connect otherwise. Be careful not
to damage the PCB e.g. by pulling on soldered wires.
* Open console with 115200n8 settings
4. Interrupt bootloader and use tftpboot to start an initramfs:
setenv ipaddr $DEVICE_IP
setenv serverip $SERVER_IP
tftpboot 84000000 openwrt-initramfs-kernel.bin
bootm
DO NOT use saveenv to store modified u-boot environment variables. The
environment is saved at flash offset 0x30000, which erases part of the
(secondary) bootloader.
The device uses two bootloader stages. The first stage will load the
second stage from a uImage stored at flash offset 0x10000. In case of
a damaged second stage, the first stage should allow uploading a new
image via y-modem (untested).
Signed-off-by: Sander Vanheule <sander@svanheule.net>
