The vendor U-Boot on the Cudy M3000 and the Yuncore AX835 assign random
mac addresses on boot and set the 'local-mac-address' property which
prevents Openwrt from assigning the correct address from evmem.
This patch removes the alias for ethernet0 so that U-Boot doesn't add the
property, removes the workaround from 02_network, and adds back the nvmem
definition for the M3000.
Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
(cherry picked from commit a55ab9e134)
Hardware:
SoC: MT7981b
RAM: 256 MB
Flash: 128 MB SPI NAND
Ethernet:
1x 2.5Gbps (rtl8221b)
1x 1Gbps (integrated phy)
WiFi: 2x2 MT7981
Buttons: Reset, WPS
LED: 1x multicolor
Solder on UART:
- remove rubber ring on the bottom
- remove screws
- pull up the cylinder, maybe help by push on an ethernet socket with a screwdriver
- remove the (3) screws holding the board in the frame
- remove the board from the frame to get to the screws for the silver, flat heat shield
- remove the (3) screws holding the heat shield
- solder UART pins to the back of the board
- make sure to have the pins point out on side with the black, finned heat spread
- the markings for the pins are going to be below the silver heat shield
- Vcc is not needed
If you don't intend on using the UART outside of the installation process, you might not
want to solder:
- carefully scrape off the thin layer of epoxy on the holes (not the copper)
- place your pin header with the UART attached in the holes
- the pins, starting with the one closest to the socket:
- Vcc (not required)
- GND
- RX
- TX
- either wedge the header or hold it with your fingers so that the pins stay in contact with the board
Installation (UART):
- attach an Ethernet cable to the 1Gbps port (black) on the router
- hold the reset button while powering the router
- press CTRL-C or wait for the timeout to get to the U-Boot prompt
- prepare a TFTP server on the network to supply ..-initramfs-kernel.bin
- use 'tftpboot' in the U-Boot shell to pull the image
- boot the image using 'bootm'
- push the ..-sysupgrade to the router using your preferred method
- perform the upgrade with 'sysupgrade -n'
There is a recovery mechanism that involves fetching a file called 'recovery.bin' but that is not understood yet.
Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
(cherry picked from commit 20e4a18feb)
The MAC address assigned to lan/wan was reversed.
Fixes: 6e51ff88b0 ("mediatek: add support for JDCloud RE-CP-03")
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Specification:
- MT7981 CPU using 2.4GHz and 5GHz WiFi (both AX)
- MT7531 switch
- 512MB RAM
- 128MB NAND flash with two UBI partitions with identical size
- 1 multi color LED (red, green, blue, white) connected via GCA230718
- 3 buttons (WPS, reset, LED on/off)
- 1 1Gbit WAN port
- 4 1Gbit LAN ports
Disassembly:
- There are four screws at the bottom: 2 under the rubber feets, 2 under the label.
- After removing the screws, the white plastic part can be shifted out of the blue part.
- Be careful because the antennas are mounted on the side and the top of the white part.
Serial Interface
- The serial interface can be connected to the 4 pin holes on the side of the board.
- Pins (from front to rear):
- 3.3V
- RX
- TX
- GND
- Settings: 115200, 8N1
MAC addresses:
- WAN MAC is stored in partition "Odm" at offset 0x81
- LAN (as printed on the device) is WAN MAC + 1
- WLAN MAC (2.4 GHz) is WAN MAC + 2
- WLAN MAC (5GHz) is WAN MAC + 3
Flashing via Recovery Web Interface:
- The recovery web interface always flashes to the currently active partition.
- If OpenWrt is flahsed to the second partition, it will not boot.
- Ensure that you have an OEM image available (encrypted and decrypted version). Decryption is described in the end.
- Set your IP address to 192.168.200.10, subnetmask 255.255.255.0
- Press the reset button while powering on the device
- Keep the reset button pressed until the LED blinks red
- Open a Chromium based and goto http://192.168.200.1 (recovery web interface)
- Download openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-recovery.bin
- The recovery web interface always reports successful flashing, even if it fails
- After flashing, the recovery web interface will try to forward the browser to 192.168.0.1 (can be ignored)
- If OpenWrt was flashed to the first partition, OpenWrt will boot (The status LED will start blinking white and stay white in the end). In this case you're done and can use OpenWrt.
- If OpenWrt was flashed to the second partition, OpenWrt won't boot (The status LED will stay red forever). In this case, the following steps are reuqired:
- Start the web recovery interface again and flash the **decrypted OEM image**. This will be flashed to the second partition as well. The OEM firmware web interface is afterwards accessible via http://192.168.200.1.
- Now flash the **encrypted OEM image** via OEM firmware web interface. In this case, the new firmware is flashed to the first partition. After flashing and the following reboot, the OEM firmware web interface should still be accessible via http://192.168.200.1.
- Start the web recovery interface again and flash the OpenWrt recovery image. Now it will be flashed to the first partition, OpenWrt will boot correctly afterwards and is accessible via 192.168.1.1.
Flashing via U-Boot:
- Open the case, connect to the UART console
- Set your IP address to 192.168.200.2, subnet mask 255.255.255.0. Connect to one of the LAN interfaces of the router
- Run a tftp server which provides openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-initramfs-kernel.bin.
- Power on the device and select "7. Load image" in the U-Boot menu
- Enter image file, tftp server IP and device IP (if they differ from the default).
- TFTP download to RAM will start. After a few seconds OpenWrt initramfs should start
- The initramfs is accessible via 192.168.1.1, change your IP address accordingly (or use multiple IP addresses on your interface)
- Perform a sysupgrade using openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-sysupgrade.bin
- Reboot the device. OpenWrt should start from flash now
Revert back to stock using the Recovery Web Interface:
- Set your IP address to 192.168.200.2, subnetmask 255.255.255.0
- Press the reset button while powering on the device
- Keep the reset button pressed until the LED blinks red
- Open a Chromium based and goto http://192.168.200.1 (recovery web interface)
- Flash a decrypted firmware image from D-Link. Decrypting an firmware image is described below.
Decrypting a D-Link firmware image:
- Download https://github.com/RolandoMagico/firmware-utils/blob/M32/src/m32-firmware-util.c
- Compile a binary from the downloaded file, e.g. gcc m32-firmware-util.c -lcrypto -o m32-firmware-util
- Run ./m32-firmware-util M30 --DecryptFactoryImage <OriginalFirmware> <OutputFile>
- Example for firmware M30A1_FW101B05: ./m32-firmware-util M30 --DecryptFactoryImage M30A1_FW101B05\(0725091522\).bin M30A1_FW101B05\(0725091522\)_decrypted.bin
Flashing via OEM web interface is not possible, as it will change the active partition and OpenWrt is only running on the first UBI partition.
Controlling the LEDs:
- The LEDs are controlled by a chip called "GCA230718" which is connected to the main CPU via I2C (address 0x40)
- I didn't find any documentation or driver for it, so the information below is purely based on my investigations
- If there is already I driver for it, please tell me. Maybe I didn't search enough
- I implemented a kernel module (leds-gca230718) to access the LEDs via DTS
- The LED controller supports PWM for brightness control and ramp control for smooth blinking. This is not implemented in the driver
- The LED controller supports toggling (on -> off -> on -> off) where the brightness of the LEDs can be set individually for each on cycle
- Until now, only simple active/inactive control is implemented (like when the LEDs would have been connected via GPIO)
- Controlling the LEDs requires three sequences sent to the chip. Each sequence consists of
- A reset command (0x81 0xE4) written to register 0x00
- A control command (for example 0x0C 0x02 0x01 0x00 0x00 0x00 0xFF 0x01 0x00 0x00 0x00 0xFF 0x87 written to register 0x03)
- The reset command is always the same
- In the control command
- byte 0 is always the same
- byte 1 (0x02 in the example above) must be changed in every sequence: 0x02 -> 0x01 -> 0x03)
- byte 2 is set to 0x01 which disables toggling. 0x02 would be LED toggling without ramp control, 0x03 would be toggling with ramp control
- byte 3 to 6 define the brightness values for the LEDs (R,G,B,W) for the first on cycle when toggling
- byte 7 defines the toggling frequency (if toggling enabled)
- byte 8 to 11 define the brightness values for the LEDs (R,G,B,W) for the second on cycle when toggling
- byte 12 is constant 0x87
Comparison to M32/R32:
- The algorithms for decrypting the OEM firmware are the same for M30/M32/R32, only the keys differ
- The keys are available in the GPL sources for the M32
- The M32/R32 contained raw data in the firmware images (kernel, rootfs), the R30 uses a sysupgrade tar instead
- Creation of the recovery image is quite similar, only the header start string changes. So mostly takeover from M32/R32 for that.
- Turned out that the bytes at offset 0x0E and 0x0F in the recovery image header are the checksum over the data area
- This checksum was not checked in the recovery web interface of M32/R32 devices, but is now active in R30
- I adapted the recovery image creation to also calculate the checksum over the data area
- The recovery image header for M30 contains addresses which don't match the memory layout in the DTS. The same addresses are also present in the OEM images
- The recovery web interface either calculates the correct addresses from it or has it's own logic to determine where which information must be written
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
(cherry picked from commit 29cca6cfee)
Rename network devices to their label set in DT without invocation of
a sub-shell.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 983222605c)
Implement the functionality of
target/linux/ramips/patches-5.15/700-net-ethernet-mediatek-support-net-labels.patch
in userspace, since the driver patch has been rejected as a generic solution:
https://github.com/openwrt/openwrt/pull/11435
Signed-off-by: Bjørn Mork <bjorn@mork.no>
(cherry picked from commit 1dd1ac2c35)
Hardware specification:
SoC: MediaTek MT7986A 4x A53
Flash: ESMT F50L1G41LB 128MB
RAM: W632GU6NB DDR3 256MB
Ethernet: 1x 2.5G + 4x 1G
WiFi1: MT7975N 2.4GHz 4T4R
WiFi2: MT7975PN 5GHz 4T4R
Button: Reset, WPS
Power: DC 12V 2A
Flash instructions:
1. Connect to the router using ssh or telnet,
username: useradmin, password is the web
login password of the router.
2. Use scp to upload bl31-uboot.fip and flash:
"mtd write xxx-preloader.bin spi0.0"
"mtd write xxx-bl31-uboot.fip FIP"
"mtd erase ubi"
3. Connect to the router via the Lan port,
set a static ip of your PC.
(ip 192.168.1.254, gateway 192.168.1.1)
4. Download initramfs image, reboot router,
waiting for tftp recovery to complete.
5. After openwrt boots up, perform sysupgrade.
Note:
1. Back up all mtd partitions before flashing.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
(cherry picked from commit 4ae474afbd)
Comfast CF-E393AX is a dual-band Wi-Fi 6 POE ceiling mount access point.
Oem firmware is a custom openwrt 21.02 snapshot version.
We can gain access via ssh once we remove the root password.
Hardware specification:
SoC: MediaTek MT7981A 2x A53
Flash: 128 MB SPI-NAND
RAM: 256MB DDR3
Ethernet: 1x 10/100/1000 Mbps built-in PHY (WAN)
1x 10/100/1000/2500 Mbps MaxLinear GPY211C (LAN)
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976D
LEDS: 1x (Red, Blue and Green)
Button: Reset
UART: 3.3v, 115200n8
--------------------------
| Layout |
| ----------------- |
| 4 | VCC GND TX RX | <= |
| ----------------- |
--------------------------
Gain SSH access:
1. Login into web interface (http://apipaddress/computer/login.html),
and download the
configuration(http://apipaddress/computer/config.html).
2. Rename downloaded backup config - 'backup.file to backup.tar.gz',
Enter 'fakeroot' command then decompress the configuration:
tar -zxf backup.tar.gz
3. Edit 'etc/shadow', update (remove) root password:
With password =
'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
to
Without password =
'root::0:99999:7:::'
'root::0:99999:7:::'
4. Repack 'etc' directory back to a new backup file:
tar -zcf backup-ssh.tar.gz etc/
5. Rename new config tar.gz file to 'backup-ssh.file'
Exit fakeroot - 'exit'
6. Upload new configuration via web interface, now you
can SSH with the following:
'ssh -vv -o HostKeyAlgorithms=+ssh-rsa \
-o PubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.10.1'.
Backup the mtd partitions
- https://openwrt.org/docs/guide-user/installation/generic.backup
7. Copy openwrt factory firmware to the tmp folder to install via ssh:
'scp -o HostKeyAlgorithms=+ssh-rsa \
-o PubkeyAcceptedAlgorithms=+ssh-rsa \
*-mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin \
root@192.168.10.1:/tmp/'
'sysupgrade -n -F \
/tmp/*--mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin'
8. Once led has stopped flashing - Connect via ssh with the
default openwrt ip address - 'ssh root@192.168.1.1'
9. SSH copy the openwrt sysupgrade firmware and upgrade
as per the default instructions.
Signed-off-by: David Bentham <db260179@gmail.com>
(cherry picked from commit d8f4453bf2)
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 16MB NOR
RAM: 256MB
Ethernet: 2x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset
Power: DC 12V 1A, PoE 802.3af 48V
Flash instructions:
Option #1 - SSH
I was able to SSH into the stock firmware of my device.
1. Attach the router to the network
2. Use scp (-O) to copy the sysupgrade image
3. Connect using SSH and run `sysupgrade -n`
Option #2 - U-Boot
One way to use the bootloader for flashing is using TFTP:
1. Connect to the router using an ethernet cable
2 Spin up a TFTP server serving the sysupgrade file
3. Open the case and attach a UART
4. Attach power to the router and interrupt the countdown by pressing
any key
5. Select option #2 (Upgrade firmware)
6. Enter IP address information and image name
7. Wait patiently
Co-Authored-By: Enrique Rodríguez Valencia <enrique.rodriguez@galgus.net>
Co-Authored-By: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
(cherry picked from commit b4086f44cd)
The Bonanza Peak series are a couple of MT7986-powered 2.5 GBit/s
Wi-Fi 6 residential gateway, access point and mesh router products.
All of them come with an eMMC to boot from, are powered via USB-C and
got a USB 3.0 type-A port. All of them got a Dialog (Renesas) DA14531
Bluetooth module connected via UART. If the device was previously
running stock firmware, the BT chip's internal flash has been loaded
with firmware and it can be attached using hciattach when using
OpenWrt.
SOC: MediaTek MT7986A
RAM: 2 GiB DDR4
eMMC: 8 GiB
Bluetooth: BLE5 (DA14531)
Serial: 3.3V level, 115200 8n1 on 4-pin connector
* SDG-8612 - Dual-band RJ-45 gateway
2x 2.5G MaxLinear PHY for WAN port
3x 1GE LAN ports via MT7531 switch
* SDG-8614 - Dual-band SFP gateway
1x SFP cage with up to 2.5G speed
1x 2.5G MaxLinear PHY for LAN port
3x 1GE LAN ports via MT7531 switch
* SDG-8622 - Tri-band mesh router
2x 2.5G MaxLinear PHY
The MT7986 2G and 5G are used as 2G and 5G high band.
There’s a MT7915 PCIe card for 5G low band.
* SDG-8632 - Tri-band mesh router with 6 GHz
2x 2.5G MaxLinear PHY
The MT7986 serves the 2G and 6G bands.
There’s a MT7915 PCIe card for 5G.
Installation via U-Boot serial console:
0. setup TFTP server with IP 192.168.1.10/24, place initramfs image
renamed to openwrt.XXX where XXX is the internal product number:
SDG-8612: XXX = 412
SDG-8614: XXX = 414
SDG-8622: XXX = 422
SDG-8632: XXX = 432
1. connect to the serial console and power on the device.
Interrupt the bootloader by pressing 'st'
2. setenv boot_mode openwrt ; saveenv
3. run boot1
Load firmware via TFTP and write to flash
4. run boot2
Now OpenWrt initramfs should boot
5. upload sysupgrade.bin via scp to /tmp
6. sysupgrade
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 3aa686f8d4)
Specifications:
SoC: MediaTek MT7981B
RAM: 256MiB
Flash: SPI-NAND 128 MiB
Switch: 1 WAN, 3 LAN (Gigabit)
Buttons: Reset, Mesh
Power: DC 12V 1A
WiFi: MT7976CN
UART: 115200n8
UART Layout:
VCC-RX-TX-GND
No. of Antennas: 6
Note: Upon opening the router, only 5 antennas were connected
to the mainboard.
Led Layout:
Power-Mesh-5gwifi-WAN-LAN3-LAN2-LAN1-2gWiFi
Buttons:
Reset-Mesh
Installation:
A. Through OpenWrt Dashboard:
If your router comes with OpenWrt preinstalled (modified by the seller),
you can easily upgrade by going to the dashboard (192.168.1.1) and then
navigate to System -> Backup/Flash firmware, then flash the firmware
B. Through TFTP
Standard installation via UART:
1. Connect USB Serial Adapter to the UART, (NOTE: Don't connect the VCC pin).
2. Power on the router. Make sure that you can access your router via UART.
3. Restart the router then repeatedly press ctrl + c to skip default boot.
4. Type > bootmenu
5. Press '2' to select upgrade firmware
6. Press 'Y' on 'Run image after upgrading?'
7. Press '0' and hit 'enter' to select TFTP client (default)
8. Fill the U-Boot's IP address and TFTP server's IP address.
9. Finally, enter the 'firmware' filename.
Signed-off-by: Ian Oderon <ianoderon@gmail.com>
(cherry picked from commit 4300bc6688)
Hardware:
- SoC: MediaTek MT7981B
- CPU: 2x 1.3 GHz Cortex-A53
- Flash: 128 MiB SPI NAND
- RAM: 512 MiB
- WLAN: 2.4 GHz, 5 GHz (MediaTek MT7976CN, 802.11ax)
- Ethernet: 1x 10/100/1000/2500 Mbps RTL8221B WAN, 1x10/100/1000 Mbps MT7981 LAN
- USB 3.0 port
- Buttons: 1 Reset button, 1 slider button
- LEDs: 1x Red, 1x White
- Serial console: internal test points, 115200 8n1
- Power: 5 VDC, 3 A
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| WAN | 80:af:ca:xx:xx:x1 | label+1 |
| LAN | 80:af:ca:xx:xx:x0 | label |
| WLAN 2g | 80:af:ca:xx:xx:x0 | label |
| WLAN 5g | 82:af:ca:xx:xx:x0 | |
+---------+-------------------+-----------+
Installation:
The installation must be done via TFTP by disassembling the router. On other occasions Cudy has distributed intermediate firmware to make installation easier, and so I recommend checking the Wiki for this device if there is a more convenient solution than the one below.
To install using TFTP:
1. Connect to UART.
2. With the router off, press the RESET button. While the router is turning on, the button should continue to be pressed for at least 5 seconds.
3. A u-boot shell will automatically open.
4. Connect to LAN and set your IP to 192.168.1.88/24. Configure a TFTP server and an OpenWrt initramfs-kernel.bin firmware file.
5. Run these steps in u-boot using the name of your file.
setenv bootfile initramfs-kernel.bin
tftpboot
bootm
6. If you can reach LuCI or SSH now, just use the sysupgrade image with the 'Keep settings' option turned off.
Signed-off-by: Luis Mita <luis@luismita.com>
(cherry picked from commit 63b8d98dd0)
The NMBM-Enabled layout did not use fit image,
it just need default process. So it was been removed in platform.sh.
It will fix sysupgrade error for xiaomi,mi-router-wr30u-112m-nmbm.
Signed-off-by: Hank Moretti <mchank9999@gmail.com>
(cherry picked from commit 02214ab8dc)
This reverts commit dcdcfc1511.
This is a firmware for third-party u-boot mod, which should not
be carried here by us.
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
(cherry picked from commit 1b7e62b20b)
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 8GB eMMC or 128 MB SPI-NAND
RAM: 256MB
Ethernet: 5x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset
USB: M.2(B-key) for 4G/5G Module
Power: DC 12V 1A
UART: 3.3v, 115200n8
--------------------------
| Layout |
| ----------------- |
| 4 | VCC RX TX GND | <= |
| ----------------- |
--------------------------
The U-boot menu will automatically appear at startup, and then select
the required options through UP/DOWN Key.
NAND Flash and eMMC Flash instructions:
1. Set your computers IP adress to 192.168.1.2.
2. Run a TFTP server providing the sysupgrade.bin image.
3. Power on the router, into the U-Boot menu.
4. Select "2. Upgrade firmware"
5. Update sysupgrade.bin file name, input server IP and input device
IP (if they deviate from the defaults)
6. Wait for automatic startup after burning
Signed-off-by: Allen Zhao <allenzhao@unielecinc.com>
(cherry picked from commit 640b0b79ff)
Fixes: d522ccecb2 ("filogic: add support for ASUS TUF AX6000")
Signed-off-by: Patryk Kowalczyk <patryk@kowalczyk.ws>
(cherry picked from commit 0c3f4bd85e)
Signed-off-by: Tom Herbers <mail@tomherbers.de>
MT7981B /256MB /16MB SPI (XM25QH128C)
AX 2.4Ghz
AX 5Ghz 160Mhz wide
1Gbit LAN
OEM:
root@RE3000:~# ifconfig |grep HWaddr
br-lan Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0 (label)
br-wan Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
eth0 Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
ra0 Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
ra2 Link encap:Ethernet HWaddr 82:XX:XX:28:XX:X0
rax0 Link encap:Ethernet HWaddr 82:XX:XX:38:XX:X0
rax2 Link encap:Ethernet HWaddr 82:XX:XX:58:XX:X0
OpenWrt
root@OpenWrt:/# ifconfig |grep HW
br-lan Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
eth0 Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
phy0-ap0 Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
phy1-ap0 Link encap:Ethernet HWaddr 82:XX:XX:08:XX:X1
tftp Installation via u-boot:
Connect TTL3.3V converter
connector is under the radiator Set speed 115200 8 N 1
Interrupt boot process by holding down-arrow key during boot then
>> 6. Load image
>> 0 - TFTP client (Default)
enter IP adresses and initramfs-kernel.bin
write to flash via sysupgrade or gui
Signed-off-by: Robert Senderek <robert.senderek@10g.pl>
(cherry picked from commit e8f7597317)
The flash procedure is similar to the Xiaomi AX6000 router.
Load openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb from original Zyxel U-Boot:
tftpboot openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb
bootm 0x46000000
Load mtd-rw
insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1
Format ubi and create ubootenv partitions
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
Copy openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb to /tmp and create recovery partition.
If your recovery image is larger than 10MiB, size the recovery partition accordingly to make it fit.
ubimkvol /dev/ubi0 -n 2 -N recovery -s 10MiB
ubiupdatevol /dev/ubi0_2 openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb
Copy preloader and uboot to /tmp and write them in the mtd
mtd write /tmp/openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-preloader.bin bl2
mtd write /tmp/openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fip fip
Now write the firmware:
sysupgrade -n /tmp/openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-squashfs-sysupgrade.itb
To create a correct BL2, I had to add a profile for 'spim:4k+256' as I could not find a way to value the variable 'NAND_TYPE'.
Features and fixes from hitech95 tree has been squashed, I'm attaching his commit message:
The Power LED was not working correctly and not reacting
to the boot process and statuses.
The board has space (footprint) for an unpopulated Zigbee chip,
while we dont know the device model having this chip populated
we have to assure that the common dts doesnt enable
interfaces that share pins with such device.
In this instance the PCIe and the uart1 and uart2 are disabled.
Some of the control PCIE pins seems to be used for the Zigbee chip,
UART1 seems to be used as a flash port while UART2 should be the
main comunication interface of Zigbee chip.
The Zigbee chip should be a EFR32MG21. But the pins used for UART
seems to be not on standard PINS used by other adapters.
So it cannot run firmwares shared on the web.
But it should be possible to build a custom firmware with
the corrtect pinmux.
This commit also contains the following squashed commit from hitech95
- mediatek: fix sysupgrade for Zyxel EX7601-T0 ubootmod
Changes and fixes added in common board:
- added aliases for boot status leds.
- added aliases for the mac-label-device.
- added pin claims for core features (MDIO and UART 0)
- added default LEDs configuration (01_leds)
- added default network configuration (02_network)
- added missing kmod-usb3 module for USB3
- fixed LED names
- fixed reset pin for SLIC chip
- removed unused pinmux configurations and devices
- fix LAN (switch) port numbering
- using nvmem cells for wifi eeprom, dropping deprecated "mediatek,mtd-eeprom"
- proper factory partition and mac address handling
- cleaned up spi_nand sections and partition
Changes and fixxes added in stock layout:
- added NMBM, if u-boot has it, the kernel must be informed.
Co-authored-by: Nicolò Veronese <nicveronese@gmail.com>
Co-developed-by: Nicolò Veronese <nicveronese@gmail.com>
Signed-off-by: Nicolò Veronese <nicveronese@gmail.com>
Signed-off-by: Valerio 'ftp21' Mancini <ftp21@ftp21.eu>
(cherry picked from commit b5df398a36)
(based on support for ASUS RT-AX59U by liushiyou006)
SOC: MediaTek MT7986
RAM: 512MB DDR4
FLASH: 128MB SPI-NAND (Winbond W25N01GV)
WIFI: Mediatek MT7986 DBDC 802.11ax 2.4/5 GHz
ETH: MediaTek MT7531 Switch
UART: 3V3 115200 8N1 (Pinout silkscreened / Do not connect VCC)
Upgrade from AsusWRT to OpenWRT using UART
Download the OpenWrt initramfs image.
Copy the image to a TFTP server reachable at 192.168.1.70/24. Rename the image to rtax59u.bin.
Connect the PC with TFTP server to the RT-AX59U.
Set a static ip on the ethernet interface of your PC.
(ip address: 192.168.1.70, subnet mask:255.255.255.0)
Conect to the serial console, interrupt the autoboot process by pressing '4' when prompted.
Download & Boot the OpenWrt initramfs image.
$ setenv ipaddr 192.168.1.1
$ setenv serverip 192.168.1.70
$ tftpboot 0x46000000 rtax59u.bin
$ bootm 0x46000000
Wait for OpenWrt to boot. Transfer the sysupgrade image to the device using scp and install using sysupgrade.
$ sysupgrade -n <path-to-sysupgrade.bin>
Upgrade from AsusWRT to OpenWRT using WebUI
Download transit TRX file from https://drive.google.com/drive/folders/1A20QdjK7Udagu31FSszpWAk8-cGlCwsq
Upgrade firmware from WebUI (192.168.50.1) using downloaded TRX file
Wait for OpenWRT to boot (192.168.1.1).
Upgrade system with sysupgrade image using luci or uploading it through scp and executing sysupgrade command
MAC Address for WLAN 5g is not following the same algorithm as in AsusWRT.
We have increased by one the WLAN 5g to avoid collisions with other networks from WLAN 2g
when bit 28 is already set.
: Stock : OpenWrt
WLAN 2g (1) : C8:xx:xx:0D:xx:D4 : C8:xx:xx:0D:xx:D4
WLAN 2g (2) : : CA:xx:xx:0D:xx:D4
WLAN 2g (3) : : CE:xx:xx:0D:xx:D4
WLAN 5g (1) : CA:xx:xx:1D:xx:D4 : CA:xx:xx:1D:xx:D5
WLAN 5g (2) : : CE:xx:xx:1D:xx:D5
WLAN 5g (3) : : C2:xx:xx:1D:xx:D5
WLAN 2g (1) : 08:xx:xx:76:xx:BE : 08:xx:xx:76:xx:BE
WLAN 2g (2) : : 0A:xx:xx:76:xx:BE
WLAN 2g (3) : : 0E:xx:xx:76:xx:BE
WLAN 5g (1) : 0A:xx:xx:76:xx:BE : 0A:xx:xx:76:xx:BF
WLAN 5g (2) : : 0E:xx:xx:76:xx:BF
WLAN 5g (3) : : 02:xx:xx:76:xx:BF
Signed-off-by: Xavier Franquet <xavier@franquet.es>
(cherry picked from commit 782eb05008)
Setting/clearing bits on the first byte of the mac address causes collisions
when using multiple SSIDs on both PHYs. Change the allocation to alter the
last byte instead.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 38bec08e87)
Confiabits MT7981 is a Wi-Fi 6 router based on MediaTek MT7981.
Specification:
- SoC: MediaTek MT7981B
- CPU: 2x 1.3 GHz Cortex-A53
- Flash: 128 MiB SPI NAND
- RAM: 256 MiB
- WLAN: 2.4 GHz, 5 GHz (MediaTek MT7976CN, 802.11ax)
- Ethernet: 4x 10/100/1000 Mbps MT7531AE (3xLAN, 1xWAN)
- USB 2.0 port
- Buttons: 1 Reset button, 1 Mesh button.
- LEDs: 7x light-blue, 2x warm-white
- Serial console: internal 4-pin header, 115200 8n1
- Power: 12 VDC, 1.5 A
MAC addresses in stock firmware and in this commit:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| WAN | 00:0c:43:xx:xx:e1 | label+1 |
| LAN | 00:0c:43:xx:xx:e0 | label |
| WLAN 2g | 00:0c:43:xx:xx:e0 | label |
| WLAN 5g | 02:0c:43:xx:xx:e0 | |
+---------+-------------------+-----------+
The label MAC was found in 'Factory', 0x4
Installation:
The stock firmware is OpenWrt-based. If you can reach LuCI or SSH, just use the sysupgrade image
with the 'Keep settings' option turned off.
Signed-off-by: Luis Mita <luis@luismita.com>
(cherry picked from commit 2af07eb853)
Acelink EW-7886CAX is an MT7986A (AKA Filogic 830) based access point.
It has 512 MiB of RAM, one 2.5 Gbps PoE (802.3at) Ethernet port and
on-SoC Wi-Fi. There is no printed MAC label (on my unit).
My unit came with Mediatek's firmware (based on OpenWrt 21.02)
installed. It was possible to simply upgrade using OpenWrt's sysupgrade
tool.
Another verified upgrade method is using U-Boot (requires UART). During
every boot there is "U-Boot Boot Menu". Selecting option "2. Upgrade
firmware" allows using U-Boot's tftp client to load and flash factory
image.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 07765f28b7)
The PGIO configuration should be added for the ZBT-Z8102AX and not the ZBT-Z8103AX
Fixes: c8c2f52262 ("mediatek: add support for Zbtlink ZBT-Z8102AX")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit d99aed31a0)
Specifications:
SoC: MediaTek MT7981B
RAM: 1024MiB
Flash: SPI-NAND 128 MiB
Switch: 1 WAN, 4 LAN (Gigabit)
USB: two M.2 slots for 5G modems via USB 3.0 hub, external USB 3.0 port
Buttons: Reset, Mesh
Power: DC 12V 1A
WiFi: MT7976CN
UART: 115200n8
UART Layout:
VCC-RX-TX-GND
Installation:
A. Through OpenWrt Dashboard:
If your router comes with OpenWrt preinstalled (modified by the seller),
you can easily upgrade by going to the dashboard (192.168.1.1) and then
navigate to System -> Backup/Flash firmware, then flash the firmware
B. Through TFTP
Standard installation via UART:
1. Connect USB Serial Adapter to the UART, (NOTE: Don't connect the VCC pin).
2. Power on the router. Make sure that you can access your router via UART.
3. Restart the router then repeatedly press ctrl + c to skip default boot.
4. Type > bootmenu
5. Press '2' to select upgrade firmware
6. Press 'Y' on 'Run image after upgrading?'
7. Press '0' and hit 'enter' to select TFTP client (default)
8. Fill the U-Boot's IP address and TFTP server's IP address.
9. Finally, enter the 'firmware' filename.
Based on patch adding support for similar Zbtlink ZBT-Z8103AX device by
Ian Ishmael C. Oderon.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit c8c2f52262)
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: Winbond 128MB
RAM: DDR3 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset
Power: DC 12V 1A
Flash instructions:
1. Connect to your PC via the Gigabit port of the router,
set a static ip on the ethernet interface of your PC.
(ip 192.168.1.254, gateway 192.168.1.1)
2. Attach UART, pause at u-boot menu.
3. Select "Upgrade ATF BL2", then use preloader.bin
4. Select "Upgrade ATF FIP", then use bl31-uboot.fip
5. Download the initramfs image, and type "reset",
waiting for tftp recovery to complete.
6. After openwrt boots up, perform sysupgrade.
Note:
1. Since NMBM is disabled, we must back up all partitions.
2. Although we can upgrade new firmware in the stock firmware,
we need the special fit image signature of MediaTek and
dual boot (hack kernel) to make u-boot boot it. So just
abandon these hacks and flash it via the serial port.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
(cherry picked from commit 626344c992)
Hardware
========
SOC: MediaTek MT7986
RAM: 512MB DDR3
FLASH: 256MB SPI-NAND
WIFI: Mediatek MT7986 DBDC 802.11ax 2.4/5 GHz 4T4R
ETH: MediaTek MT7530 Switch (LAN)
MaxLinear GPY211C 2.5 N-Base-T PHY (WAN)
MaxLinear GPY211C 2.5 N-Base-T PHY (LAN)
UART: 3V3 115200 8N1 (Do not connect VCC)
USB 3.1
Installation
============
Download the OpenWrt initramfs image. Copy the image to a TFTP server
reachable at 192.168.1.70/24. Rename the image to TUF-AX6000.bin.
Connect to the serial console, interrupt the auto boot process by
pressing '4' when prompted or press '1' and set client IP, server
IP and name of the image.
yOU don't need to open the case or even soldering anything.
use three goldpin wires, remove their plastic cover and connect
them to the console pinout via the case holes.
You can see three holes
From Bottom: RX, TX, Ground - partially covered
Download & Boot the OpenWrt initramfs image.
In case of option '4'
$ setenv ipaddr 192.168.1.1
$ setenv serverip 192.168.1.70
$ tftpboot 0x46000000 TUF-AX6000.bin
$ bootm 0x46000000
In case of option '1'
1: Load System code to SDRAM via TFTP.
Please Input new ones /or Ctrl-C to discard
Input device IP (192.168.1.1) ==:
Input server IP (192.168.1.70) ==:
Input Linux Kernel filename (TUF-AX6000.trx) ==:
Wait for OpenWrt to boot. Transfer the sysupgrade
image to the device using scp and install using sysupgrade.
$ sysupgrade -n <path-to-sysupgrade.bin>
Missing features
================
2.5Gb LAN port LED is ON during boot or when the LAN cable is disconnected
The cover yellow light is not supported. (only blue one)
Signed-off-by: Patryk Kowalczyk <patryk@kowalczyk.ws>
(cherry picked from commit d522ccecb2)
Commit mt76: drop default eeprom file for mt7986-firmware
(e3aa645b26) breaks eeprom loading for
Mercusys MR90X v1. As a result WiFi is not working at all.
This commit adds Mercusus MR90x to the caldata script (it works after the
commit mentioned above). And we can safely drop "81_fix_eeprom" script
as it's no longer required.
Fixes: 5a0bdab24c ("mt76: drop default eeprom file for mt7986-firmware")
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
(cherry picked from commit 85b0d7592c)
[rmilecki: fix commit hash in Fixes]
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
**Hardware specification:**
- SoC: MediaTek MT7981B 2x A53
- Flash: ESMT F50L1G41LB 128MB
- RAM: Nanya NT5CC128M16JR-EK 256MB
- Ethernet: 4 x 10/100/1000 Mbps
- Switch: MediaTek MT7531AE
- WiFi: MediaTek MT7976C
- Button: Reset, Mesh
- Power: DC 12V 1A
- UART: 3.3v, 115200n8
| Layout: |
| :-------- |
| <Antenna> |
| VCC |
| GND |
| Tx |
| Rx |
**Flash instructions:**
1. Rename `openwrt-mediatek-filogic-cetron_ct3003-squashfs-factory.bin` to `factory.bin`.
2. Upload the `factory.bin` using the device's Web interface.
3. Click the upgrade button and wait for the process to finish.
4. Access the OpenWrt interface using the same password.
5. Use the 'Restore' function to reset the firmware to its initial state.
**Notes:**
If you plan to recovery the stock firmware in the future, it's advisable
to connect the device via the serial port and enter failsafe mode to
back up all the MTD partitions before proceeding the steps above.
Signed-off-by: Patricia Lee <patricialee320@gmail.com>
(cherry picked from commit 907e9e0bd3)
Telenor quirks
--------------
The operator specific firmware running on the Telenor branded
ZyXEL EX5700 includes U-Boot modifications affecting the OpenWrt
installation.
Notable changes to U-Boot include
- environment is stored in RAM and reset to defaults when power
cycled
- dual partition scheme with "nomimal" or "rescue" systems, falling
back to "rescue" unless the OS signals success in 3 attempts
- several runtime additions to the device-tree
Some of these modifications have side effects requiring workarounds
- U-Boot modifies /chosen/bootargs in an unsafe manner, and will crash
unless this node exists
- U-Boot verifies that the selected rootfs UBI volume exists, and
refuses to boot if it doesn't. The chosen "rootfs" volume must contain
a squashfs signature even for tftp or initramfs booting.
- U-Boot parses the "factoryparams" UBI volume, setting the "ethaddr"
variable to the label mac. But "factoryparams" does not always
exist. Instead there is a "RIP" volume containing all the factory
data. Copying the "RIP" volume to "factoryparams" will fix this
Hardware
--------
SOC: MediaTek MT7986
RAM: 1GB DDR4
FLASH: 512MB SPI-NAND (Mikron xxx)
WIFI: Mediatek MT7986 802.11ax 5 GHz
Mediatek MT7916 DBDC 802.11ax 2.4 + 6 GHz
ETH: MediaTek MT7531 Switch + SoC
3 x builtin 1G phy (lan1, lan2, lan3)
2 x MaxLinear GPY211C 2.5 N-Base-T phy (lan4, wan)
USB: 1 x USB 3.2 Enhanced SuperSpeed port
UART: 3V3 115200 8N1 (Pinout: GND KEY RX TX VCC)
Installation
------------
1. Download the OpenWrt initramfs image. Copy the image to a TFTP server
reachable at 192.168.1.2/24. Rename the image to C0A80101.img.
2. Connect the TFTP server to lan1, lan2 or lan3. Connect to the serial
console, Interrupt the autoboot process by pressing ESC when prompted.
3. Download and boot the OpenWrt initramfs image.
$ env set uboot_bootcount 0
$ env set firmware nominal
$ tftpboot
$ bootm
4. Wait for OpenWrt to boot. Transfer the sysupgrade image to the device
using scp and install using sysupgrade.
$ sysupgrade -n <path-to-sysupgrade.bin>
Missing features
----------------
- The "lan1", "lan2" and "lan3" port LEDs are driven by the switch but
OpenWrt does not correctly configure the output.
- The "lan4" and "wan" port LEDs are driven by the GPH211C phys and
not configured by OpenWrt.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
(cherry picked from commit 6cc14bf66a)
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 64GB eMMC or 128 MB SPI-NAND
RAM: 512MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, Mesh
Power: DC 12V 1A
- UART: 3.3v, 115200n8
--------------------------
| Layout |
| ----------------- |
| 4 | GND TX VCC RX | <= |
| ----------------- |
--------------------------
Gain SSH access:
1. Login into web interface, and download the configuration.
2. Enter fakeroot, decompress the configuration:
tar -zxf cfg_export_config_file.conf
3. Edit 'etc/config/dropbear', set 'enable' to '1'.
4. Edit 'etc/shadow', update (remove) root password:
'root::19523:0:99999:7:::'
5. Repack 'etc' directory:
tar -zcf cfg_export_config_file.conf etc/
* If you find an error about 'etc/wireless/mediatek/DBDC_card0.dat',
just ignore it.
6. Upload new configuration via web interface, now you can SSH to RAX3000M.
Check stroage type:
Check the label on the back of the device:
"CH EC CMIIT ID: xxxx" is eMMC version
"CH CMIIT ID: xxxx" is NAND version
eMMC Flash instructions:
1. SSH to RAX3000M, and backup everything, especially 'factory' part.
('data' partition can be ignored, it's useless.)
2. Write new GPT table:
dd if=openwrt-mediatek-filogic-cmcc_rax3000m-emmc-gpt.bin of=/dev/mmcblk0 bs=512 seek=0 count=34 conv=fsync
3. Erase and write new BL2:
echo 0 > /sys/block/mmcblk0boot0/force_ro
dd if=/dev/zero of=/dev/mmcblk0boot0 bs=512 count=8192 conv=fsync
dd if=openwrt-mediatek-filogic-cmcc_rax3000m-emmc-preloader.bin of=/dev/mmcblk0boot0 bs=512 conv=fsync
4. Erase and write new FIP:
dd if=/dev/zero of=/dev/mmcblk0 bs=512 seek=13312 count=8192 conv=fsync
dd if=openwrt-mediatek-filogic-cmcc_rax3000m-emmc-bl31-uboot.fip of=/dev/mmcblk0 bs=512 seek=13312 conv=fsync
5. Set static IP on your PC:
IP 192.168.1.254, GW 192.168.1.1
6. Serve OpenWrt initramfs image using TFTP server.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt has booted, perform sysupgrade.
9. Additionally, if you want to have eMMC recovery boot feature:
(Don't worry! You will always have TFTP recovery boot feature.)
dd if=openwrt-mediatek-filogic-cmcc_rax3000m-initramfs-recovery.itb of=/dev/mmcblk0p4 bs=512 conv=fsync
NAND Flash instructions:
1. SSH to RAX3000M, and backup everything, especially 'Factory' part.
2. Erase and write new BL2:
mtd erase BL2
mtd write openwrt-mediatek-filogic-cmcc_rax3000m-nand-preloader.bin BL2
3. Erase and write new FIP:
mtd erase FIP
mtd write openwrt-mediatek-filogic-cmcc_rax3000m-nand-bl31-uboot.fip FIP
4. Set static IP on your PC:
IP 192.168.1.254, GW 192.168.1.1
5. Serve OpenWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After OpenWrt has booted, erase UBI volumes:
ubidetach -p /dev/mtd0
ubiformat -y /dev/mtd0
ubiattach -p /dev/mtd0
8. Create new ubootenv volumes:
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Additionally, if you want to have NAND recovery boot feature:
(Don't worry! You will always have TFTP recovery boot feature.)
ubimkvol /dev/ubi0 -n 2 -N recovery -s 20MiB
ubiupdatevol /dev/ubi0_2 openwrt-mediatek-filogic-cmcc_rax3000m-initramfs-recovery.itb
10. Perform sysupgrade.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 423186d7d8)
[rebased to 23.05]
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Add build for the MTK3943 reference board for MT7981B+MT7976C.
**Hardware specification:**
- SoC: MediaTek MT7981B 2x A53
- Flash: various options
- RAM: 256MB DDR3
- Ethernet: 4 x 10/100/1000 Mbps via MT7531AE switch
EITHER 1 x 10/100/1000 Mbps built-in PHY
OR 1 x 10/100/1000/2500 Mbps MaxLinear GPY211C
- Switch: MediaTek MT7531AE
- WiFi: MediaTek MT7976C
- Button: RST, WPS
**Flash instructions for SPIM-NAND:**
- write *mt7981-rfb-spim-nand-preloader.bin to 'BL2' partition
- write *mt7981-rfb-spim-nand-bl31-uboot.fip to 'FIP' partition
- erase 'ubi' partition
- reset board
- create ubootenv and ubootenv2 UBI volumes in U-Boot
- edit environment and set bootcmd, e.g.
setenv bootconf 'config-1#mt7981-rfb-spim-nand#mt7981-rfb-mxl-2p5g-phy-eth1'
setenv bootcmd 'ubi read $loadaddr fit; bootm $loadaddr#$bootconf'
- load initramfs image via TFTP:
setenv serverip 192.168.1.254
setenv ipaddr 192.168.1.1
setenv bootfile openwrt-mediatek-filogic-mediatek_mt7981-rfb-initramfs.itb
saveenv ; saveenv
tftpboot
bootm $loadaddr#$bootconf
- Now use sysupgrade to write OpenWrt firmware to flash.
SNFI-NAND, SPIM-NOR and eMMC all work very similar, a bootable SD card image
is also being generated. However, as the board I've been provided only comes
with SPIM-NAND all other boot media are untested.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit ce7209bd21)
When adapting the network configuration for MT7988 RFB a stray quote
was left in a script. Remove it to fix generating the default network
configuration.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 8f5986355c)
Switch to OpenWrt uImage.FIT bootmethod and include various bootloader
artifacts with the generated binaries.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 035a88ae55)
Enable building a factory image which can be flashed through the OEM
firmware's web interface. It seems that the web interface requires a
minimum file size of 10MiB, otherwise it will not accept the image.
The update image is a regular sysupgrade tarball packed in a Netgear
encrypted image. The Netgear encrypted image is the same as used in
WAX202 or WAX206, including the encryption keys and IV.
This adds a script which creates the rootfs_data volume on first
startup. This is required since the OEM firmware's sysupgrade scripts
do not create such a paritition. Note that any script ordered after
70_initramfs_test will not get executed on initramfs. Hence this new
script 75_rootfs_prepare won't create the rootfs_data volume when
using the recovery initramfs.
Also, this deletes the kernel_backup and rootfs_backup volumes in case
we have to create the rootfs_data volumes. This makes sure that
OpenWrt is the actual backup firmware instead of the stock firmware.
References in WAX220 GPL source:
https://www.downloads.netgear.com/files/GPL/WAX220-V1.0.2.8-gpl-src.tar.gz
* package/base-files/files/lib/upgrade/nand.sh:186
Creation of rootfs_data is disabled
* Uboot-upstream/board/mediatek/common/ubi_helper.c
Automatic creation of UBI backup volumes
Signed-off-by: Stefan Agner <stefan@agner.ch>
(cherry picked from commit fa9d977f97)
Changes introduced in commit 54dc1cde48 ("mediatek: filogic: add
support for Xiaomi WR30U") missed to end the case item with mandatory
`;;` which lead to a broken sysupgrade.
Fixes: 54dc1cde48 ("mediatek: filogic: add support for Xiaomi WR30U")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Because this device enable NMBM by default, most users use custom
U-Boot with NMBM-Enabled in Chinese forums.
This layout is the same as the ubootmod layout but enabling NMBM.
Signed-off-by: Hank Moretti <mchank9999@gmail.com>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: ESMT F50L1G41LB 128MB
RAM: NT52B128M16JR-FL 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, Mesh
Power: DC 12V 1A
Flash instructions:
1. Get ssh access
Check this link: https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000ne/153769/22
2. Backup import partitions
```
dev: size erasesize name
mtd1: 00100000 00020000 "BL2"
mtd2: 00040000 00020000 "Nvram"
mtd3: 00040000 00020000 "Bdata"
mtd4: 00200000 00020000 "Factory"
mtd5: 00200000 00020000 "FIP"
mtd8: 02200000 00020000 "ubi"
mtd9: 02200000 00020000 "ubi1"
mtd12: 00040000 00020000 "KF"
```
Use these commands blow to backup your stock partitions.
```
nanddump -f /tmp/BL2.bin /dev/mtd1
nanddump -f /tmp/Nvram.bin /dev/mtd2
nanddump -f /tmp/Bdata.bin /dev/mtd3
nanddump -f /tmp/Factory.bin /dev/mtd4
nanddump -f /tmp/FIP.bin /dev/mtd5
nanddump -f /tmp/ubi.bin /dev/mtd8
nanddump -f /tmp/KF.bin /dev/mtd12
```
Then, transfer them to your computer via scp, netcat, tftp
or others and keep them in a safe place.
3. Setup Nvram
Get the current stock: `cat /proc/cmdline`
If you find `firmware=0` or `mtd=ubi`, use these commands:
```
nvram set boot_wait=on
nvram set uart_en=1
nvram set flag_boot_rootfs=1
nvram set flag_last_success=1
nvram set flag_boot_success=1
nvram set flag_try_sys1_failed=0
nvram set flag_try_sys2_failed=0
nvram commit
```
If you find `firmware=1` or `mtd=ubi1`, use these commands:
```
nvram set boot_wait=on
nvram set uart_en=1
nvram set flag_boot_rootfs=0
nvram set flag_last_success=0
nvram set flag_boot_success=1
nvram set flag_try_sys1_failed=0
nvram set flag_try_sys2_failed=0
nvram commit
```
4. Flash stock-initramfs-factory.ubi
If you find `firmware=0` or `mtd=ubi`:
`ubiformat /dev/mtd9 -y -f /tmp/stock-initramfs-factory.ubi`
If you find `firmware=1` or `mtd=ubi1`:
`ubiformat /dev/mtd8 -y -f /tmp/stock-initramfs-factory.ubi`
Then reboot your router, it should boot to the openwrt
initramfs system now.
5. Setup uboot-env
Now it will be setup automatically in upgrade process,
you can skip this step.
If your `fw_setenv` did not work, you need run this command:
`echo "/dev/mtd1 0x0 0x10000 0x20000" > /etc/fw_env.config`
Then setup uboot-env:
```
fw_setenv boot_wait on
fw_setenv uart_en 1
fw_setenv flag_boot_rootfs 0
fw_setenv flag_last_success 1
fw_setenv flag_boot_success 1
fw_setenv flag_try_sys1_failed 8
fw_setenv flag_try_sys2_failed 8
fw_setenv mtdparts "nmbm0:1024k(bl2),256k(Nvram),256k(Bdata),
2048k(factory),2048k(fip),256k(crash),256k(crash_log),
34816k(ubi),34816k(ubi1),32768k(overlay),12288k(data),256k(KF)"
```
6. Flash stock-squashfs-sysupgrade.bin
Use shell command:
`sysupgrade -n /tmp/stock-squashfs-sysupgrade.bin`
Or go to luci web.
If you need to change to Openwrt U-Boot layout, do next. If you
do not need, please ignore it.
Change to OpenWrt U-Boot:
1. Flash ubootmod-initramfs-factory.ubi
Check mtd partitions: `cat /proc/mtd`
```
mtd7: 00040000 00020000 "KF"
mtd8: 02200000 00020000 "ubi_kernel"
mtd9: 04e00000 00020000 "ubi"
```
Run following command:
`ubiformat /dev/mtd8 -y -f /tmp/ubootmod-initramfs-factory.ubi`
Then reboot your router, it should boot to the openwrt initramfs
system now.
2. Check mtd again
```
mtd7: 00040000 00020000 "KF"
mtd8: 07000000 00020000 "ubi"
```
Make sure mtd8 is ubi.
3. Install kmod-mtd-rw
Run command: `opkg update && opkg install kmod-mtd-rw`
Or get it in openwrt server, or build it yourself, then install
it manually
Then run this command:
`insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1`
4. Clean up pstore
Run Command: `rm -f /sys/fs/pstore/*`
5. Format ubi and create new ubootenv volume
```
ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
```
6. (Optional) Add recovery boot feature.
```
ubimkvol /dev/ubi0 -n 2 -N recovery -s 10MiB
ubiupdatevol /dev/ubi0_2 /tmp/ubootmod-initramfs-recovery.itb
```
7. Flash Openwrt U-Boot
```
mtd write /tmp/ubootmod-preloader.bin BL2
mtd write /tmp/ubootmod-bl31-uboot.fip FIP
```
6. Flash ubootmod-squashfs-sysupgrade.itb
Use shell command:
`sysupgrade -n /tmp/ubootmod-squashfs-sysupgrade.itb`
Or go to luci web.
Now everything is done, Enjoy!
Go Back to stock from Openwrt U-Boot:
1. Force flash ubootmod-initramfs-recovery.itb
Use shell command:
`sysupgrade -F -n /tmp/ubootmod-initramfs-recovery.itb`
Or go to luci web.
Then it should boot to the openwrt initramfs system now.
2. Format ubi and Nvram
```
ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8
mtd erase Nvram
```
3. Install kmod-mtd-rw
Run command: `opkg update && opkg install kmod-mtd-rw`
Or get it in openwrt server, or build it yourself, then install
it manually
Then run this command:
`insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1`
4. Flash stock U-Boot and ubi
```
mtd write /tmp/BL2.bin BL2
mtd write /tmp/FIP.bin FIP
mtd write /tmp/ubi.bin ubi
```
Then reboot your router, waiting it finished rollback in minutes.
Go Back to stock from stock layout Openwrt:
Just run command: `ubiformat /dev/mtd8 -y -f /tmp/ubi.bin`
Then reboot your router, waiting it finished rollback in minutes.
Notes:
1. Openwrt U-Boot and ubootmod openwrt did not enable NMBM.
Please make your backup safe.
Signed-off-by: Hank Moretti <mchank9999@gmail.com>
Hardware
--------
SOC: MediaTek MT7986A
RAM: 1GB DDR4
FLASH: 4GB eMMC
WiFi: 2x2 2.4 GHz 802.11 b/g/n/ax MT7916 DBDC
4x4 5 GHz 802.11 a/n/ac/ax MT7986
2x2 6 GHz 802.11ax MT7916 DBDC
ETH: 4x LAN 1Gbit/s (MT7531)
1x WAN 2.5Gbit/s (GPY211)
BTN: RESET, WPS
LED: Antenna LEDs (GPIO)
Mood-LED (Kinetic KTD2601) - unsupported
UART: Header nest to USB port - 3V3 115200 8N1
[BUTTON] GND - RX - TX [USB]
Installation
------------
1. Connect to the device using serial console.
2. Interrupt the Autoboot process when promted by sending '0' twice.
3. Serve the OpenWrt initramfs image using TFTP at 192.168.1.66. Name
the image "predator.bin" and conenct the TFTP server to the routers
LAN port.
4. Configure U-Boot to allow loading unsigned images from MMC
$ setenv bootcmd 'mmc read 0x40000000 0x00004400 0x0010000;
fdt addr $(fdtcontroladdr); fdt rm /signature; bootm 0x40000000';
saveenv
5. Transfer the image from U-Boot
$ setenv serverip 192.168.1.66; setenv ipaddr 192.168.1.1;
tftpboot 0x46000000 predator.bin; fdt addr $(fdtcontroladdr);
fdt rm /signature; bootm
6. Wait for OpenWrt to boot
7. Transfer the OpenWrt sysupgrade image to the router using scp.
8. Install OpenWrt using sysupgrade.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 7e7eb5312d)
Hardware
--------
CPU: Mediatek MT7981
RAM: 512M DDR4
FLASH: 256M NAND
ETH: MaxLinear GPY211 (2.5GbE N Base-T)
WiFi: Mediatek MT7981 (2.4GHz 2T2R:2 5GHz 3T3R:2 802.11ax)
BTN: 1x Reset
LED: 1x Multi-Color
UART Console
------------
Available below the rubber cover next to the ethernet port.
Settings: 115200 8N1
Layout:
<12V> <LAN> GND-RX-TX-VCC
Logic-Level is 3V3. Don't connect VCC to your UART adapter!
Installation Web-UI
-------------------
Upload the Factory image using the devices Web-Interface.
As the device uses a dual-image partition layout, OpenWrt can only
installed on Slot A. This requires the current active image prior
flashing the device to be on Slot B.
In case this is not the case, OpenWrt will boot only one time, returning
to the ZyXEL firmware the second boot.
If this happens, first install a ZyXEL firmware upgrade of any version
and install OpenWrt after that.
Installation TFTP / Recovery
----------------------------
This installation routine is especially useful in case of a bricked
device.
Attach to the UART console header of the device. Interrupt the boot
procedure by pressing Enter.
The bootloader has a reduced command-set available from CLI, but more
commands can be executed by abusing the atns command.
Boot a OpenWrt initramfs image available on a TFTP server at
192.168.1.66. Rename the image to nwa50axpro-openwrt-initramfs.bin.
$ atnf nwa50axpro-openwrt-initramfs.bin
$ atna 192.168.1.88
$ atns "192.168.1.66; tftpboot; setenv fdt_high 0xffffffffffffffff;
bootm"
Upon booting, set the booted image to the correct slot:
$ zyxel-bootconfig /dev/mtd9 get-status
$ zyxel-bootconfig /dev/mtd9 set-image-status 0 valid
$ zyxel-bootconfig /dev/mtd9 set-active-image 0
Copy the OpenWrt sysupgrade image to the device using scp.
Write the sysupgrade image to NAND using sysupgrade.
$ sysupgrade -n image.bin
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit f0445746f6)
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: W25N01GVZEIG 128MB
RAM: NT5CB128M16JR-FL 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, WPS
Power: DC 12V 1A
Flash instructions:
1. PC run command: "telnet 192.168.124.1 99"
Username: H3C, password is the web login
password of the router.
2. Download preloader.bin and bl31-uboot.fip
3. PC run command: "python3 -m http.server 80"
4. Download files in the telnet window:
"wget http://192.168.124.xx/xxx.bin"
Replace xx with your PC's IP and
the preloader.bin and bl31-uboot.fip.
5. Flushing openwrt's uboot:
"mtd write xxx-preloader.bin BL2"
"mtd write xxx-bl31-uboot.fip FIP"
6. Connect to the router via the Lan port,
set a static ip of your PC.
(ip 192.168.1.254, gateway 192.168.1.1)
7. Download initramfs image, reboot router,
waiting for tftp recovery to complete.
8. After openwrt boots up, perform sysupgrade.
Note:
1. The u-boot-env partition on mtd is empty,
OEM stores their env on ubi:u-boot-env.
2. Back up all mtd partitions before flashing.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
(cherry picked from commit e78d1a06c8)
This commit adds support for Mercusys MR90X(EU) v1 router.
Device specification
--------------------
SoC Type: MediaTek MT7986BLA, Cortex-A53, 64-bit
RAM: MediaTek MT7986BLA (512MB)
Flash: SPI NAND GigaDevice GD5F1GQ5UEYIGY (128 MB)
Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8)
Ethernet: 1x2.5Gbe (WAN/LAN 2.5Gbps), 3xGbE (WAN/LAN 1Gbps, LAN1, LAN2)
WLAN 2g: MediaTek MT7975N, b/g/n/ax, MIMO 4x4
WLAN 5g: MediaTek MT7975P(N), a/n/ac/ax, MIMO 4x4
LEDs: 1 orange and 1 green status LEDs, 4 green gpio-controlled
LEDs on ethernet ports
Button: 1 (Reset)
USB ports: No
Power: 12 VDC, 2 A
Connector: Barrel
Bootloader: Main U-Boot - U-Boot 2022.01-rc4. Additionally, both UBI
slots contain "seconduboot" (also U-Boot 2022.01-rc4)
Serial console (UART)
---------------------
V
+-------+-------+-------+-------+
| +3.3V | GND | TX | RX |
+---+---+-------+-------+-------+
|
+--- Don't connect
The R3 (TX line) and R6 (RX line) are absent on the PCB. You should
solder them or solder the jumpers.
Installation (UART)
-------------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
tftpboot initramfs-kernel.bin
bootm
4. Once inside OpenWrt, set / update env variables:
fw_setenv baudrate 115200
fw_setenv bootargs "ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit"
fw_setenv fdtcontroladdr 5ffc0e70
fw_setenv ipaddr 192.168.1.1
fw_setenv loadaddr 0x46000000
fw_setenv mtdids "spi-nand0=spi-nand0"
fw_setenv mtdparts "spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)"
fw_setenv netmask 255.255.255.0
fw_setenv serverip 192.168.1.2
fw_setenv stderr serial@11002000
fw_setenv stdin serial@11002000
fw_setenv stdout serial@11002000
fw_setenv tp_boot_idx 0
5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image
Installation (without UART)
---------------------------
1. Login as root via SSH (router IP, port 20001, password - your web
interface password)
2. Open for editing /etc/hotplug.d/iface/65-iptv (e.g., using WinSCP and
SSH settings from the p.1)
3. Add a newline after "#!/bin/sh":
telnetd -l /bin/login.sh
4. Save "65-iptv" file
5. Toggle "IPTV/VLAN Enable" checkbox in the router web interface and
save
6. Make sure that telnetd is running:
netstat -ltunp | grep 23
7. Login via telnet to router IP, port 23 (no username and password are
required)
8 Upload OpenWrt "initramfs-kernel.bin" to the "/tmp" folder of the
router (e.g., using WinSCP and SSH settings from the p.1)
9. Stock busybox doesn't contain ubiupdatevol command. Hence, we need to
download and upload the full version of busybox to the router. For
example, from here:
https://github.com/xerta555/Busybox-Binaries/raw/master/busybox-arm64
Upload busybox-arm64 to the /tmp dir of the router and run:
in the telnet shell:
cd /tmp
chmod a+x busybox-arm64
10. Check "initramfs-kernel.bin" size:
du -h initramfs-kernel.bin
11. Delete old and create new "kernel" volume with appropriate size
(greater than "initramfs-kernel.bin" size):
ubirmvol /dev/ubi0 -N kernel
ubimkvol /dev/ubi0 -n 1 -N kernel -s 9MiB
12. Write OpenWrt "initramfs-kernel.bin" to the flash:
./busybox-arm64 ubiupdatevol /dev/ubi0_1 /tmp/initramfs-kernel.bin
13. u-boot-env can be empty so lets create it (or overwrite it if it
already exists) with the necessary values:
fw_setenv baudrate 115200
fw_setenv bootargs "ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit"
fw_setenv fdtcontroladdr 5ffc0e70
fw_setenv ipaddr 192.168.1.1
fw_setenv loadaddr 0x46000000
fw_setenv mtdids "spi-nand0=spi-nand0"
fw_setenv mtdparts "spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)"
fw_setenv netmask 255.255.255.0
fw_setenv serverip 192.168.1.2
fw_setenv stderr serial@11002000
fw_setenv stdin serial@11002000
fw_setenv stdout serial@11002000
fw_setenv tp_boot_idx 0
14. Reboot to OpenWrt initramfs:
reboot
15. Login as root via SSH (IP 192.168.1.1, port 22)
16. Upload OpenWrt sysupgrade.bin image to the /tmp dir of the router
17. Run sysupgrade:
sysupgrade -n /tmp/sysupgrade.bin
Recovery
--------
1. Press Reset button and power on the router
2. Navigate to U-Boot recovery web server (http://192.168.1.1/) and
upload the OEM firmware
Recovery (UART)
---------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
tftpboot initramfs-kernel.bin
bootm
4. Do what you need (restore partitions from a backup, install OpenWrt
etc.)
Stock layout
------------
0x000000000000-0x000000200000 : "boot"
0x000000200000-0x000000300000 : "u-boot-env"
0x000000300000-0x000003500000 : "ubi0"
0x000003500000-0x000006700000 : "ubi1"
0x000006700000-0x000006f00000 : "userconfig"
0x000006f00000-0x000007300000 : "tp_data"
ubi0/ubi1 format
----------------
U-Boot at boot checks that all volumes are in place:
+-------------------------------+
| Volume Name: uboot Vol ID: 0|
| Volume Name: kernel Vol ID: 1|
| Volume Name: rootfs Vol ID: 2|
+-------------------------------+
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| label | 00:eb:xx:xx:xx:be | label |
| LAN | 00:eb:xx:xx:xx:be | label |
| WAN | 00:eb:xx:xx:xx:bf | label+1 |
| WLAN 2g | 00:eb:xx:xx:xx:be | label |
| WLAN 5g | 00:eb:xx:xx:xx:bd | label-1 |
+---------+-------------------+-----------+
label MAC address was found in UBI partition "tp_data", file
"default-mac". OEM wireless eeprom is also there (file
"MT7986_EEPROM.bin").
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
(cherry picked from commit e4fe3097ef)
[Fix merging conflict]
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Hardware
--------
SOC: MediaTek MT7986
RAM: 1024MB DDR3
FLASH: 128MB SPI-NAND (Winbond)
WIFI: Mediatek MT7986 DBDC 802.11ax 2.4/5 GHz
ETH: Realtek RTL8221B-VB-CG 2.5 N-Base-T PHY with PoE
UART: 3V3 115200 8N1 (Pinout silkscreened / Do not connect VCC)
Installation
------------
1. Download the OpenWrt initramfs image. Copy the image to a TFTP server
2. Connect the TFTP server to the WAX220. Conect to the serial console,
interrupt the autoboot process by pressing '0' when prompted.
3. Download & Boot the OpenWrt initramfs image.
$ setenv ipaddr 192.168.2.1
$ setenv serverip 192.168.2.2
$ tftpboot openwrt.bin
$ bootm
4. Wait for OpenWrt to boot. Transfer the sysupgrade image to the device
using scp and install using sysupgrade.
$ sysupgrade -n <path-to-sysupgrade.bin>
Signed-off-by: Flole Systems <flole@flole.de>
Signed-off-by: Stefan Agner <stefan@agner.ch>
(cherry picked from commit 984786a2f7)
If the board comes up with OpenWrt that means that the bootloader is
recent enough and knows about the new device tree overlays.
Using /etc/board.d/ is not enough in this case because it doesn't
overwrite existing configuration which may exist (and is fine to exist)
if the user updated with 'sysupgrade -F *.itb' and has kept
configuration. They would still need to manually set compat_version
even though the fact that the bootloader env has been updated can be
implied by the fact that the system has started.
Hence we can always set compat_version=1.1 for those two boards using
uci-defaults.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 25e27c4af3)
Sync device tree files for MT7986 boards with what landed in upstream
Linux tree to easy maintainance and also allow for a smooth update to
Linux 6.1.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 7a0ec001ff)
