Also known as the "Xiaomi Router AX3200" in western markets,
but only the AX6S is widely installation-capable at this time.
SoC: MediaTek MT7622B
RAM: DDR3 256 MiB (ESMT M15T2G16128A)
Flash: SPI-NAND 128 MiB (ESMT F50L1G41LB or Gigadevice GD5F1GQ5xExxG)
WLAN: 2.4/5 GHz 4T4R
2.4 GHz: MediaTek MT7622B
5 GHz: MediaTek MT7915E
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531B
LEDs/Keys: 2/2 (Internet + System LED, Mesh button + Reset pin)
UART: Marked J1 on board VCC RX GND TX, beginning from "1". 3.3v, 115200n8
Power: 12 VDC, 1.5 A
Notes:
U-Boot passes through the ethaddr from uboot-env partition,
but also has been known to reset it to a generic mac address
hardcoded in the bootloader.
However, bdata is also populated with the ethernet mac addresses,
but is also typically never written to. Thus this is used instead.
Installation:
1. Flash stock Xiaomi "closed beta" image labelled
'miwifi_rb03_firmware_stable_1.2.7_closedbeta.bin'.
(MD5: 5eedf1632ac97bb5a6bb072c08603ed7)
2. Calculate telnet password from serial number and login
3. Execute commands to prepare device
nvram set ssh_en=1
nvram set uart_en=1
nvram set boot_wait=on
nvram set flag_boot_success=1
nvram set flag_try_sys1_failed=0
nvram set flag_try_sys2_failed=0
nvram commit
4. Download and flash image
On computer:
python -m http.server
On router:
cd /tmp
wget http://<IP>:8000/factory.bin
mtd -r write factory.bin firmware
Device should reboot at this point.
Reverting to stock:
Stock Xiaomi recovery tftp that accepts their signed images,
with default ips of 192.168.31.1 + 192.168.31.100.
Stock image should be renamed to tftp server ip in hex (Eg. C0A81F64.img)
Triggered by holding reset pin on powerup.
A simple implementation of this would be via dnsmasq's
dhcp-boot option or using the vendor's (Windows only)
recovery tool available on their website.
Signed-off-by: Richard Huynh <voxlympha@gmail.com>
X32 Pro is another product name for it in the Chinese market.
Specifications:
- SoC: MT7622B
- RAM: 256MB
- Flash: XMC XM25QH128C or Winbond WQ25Q128JVSQ 16MB SPI NOR
- Ethernet: 5x1GbE
- Switch: MT7531BE
- WiFi: 2.4G: MT7622 5G: MT7915AN+MT7975AN
- 3LEDs: System LED(blue) + Mesh LED(green) + Mesh LED(red)
- 2Keys: Mesh button + Reset button
- UART: Marked J19 on board. 3.3v, 115200n1
- Power: 12V 2.5A
MAC addresses as verified by OEM firmware:
use address source
WAN *:F4 ethaddr@product_info
LAN *:F5
5g *:F6
2g *:F7
Flash instruction:
1. Serve the initramfs.img using a TFTP server with address 10.10.10.3.
2. Interrupt the uboot startup process via UART.
3. Select "System Load Linux to SDRAM via TFTP" item.
4. (important) Back up firmware(mtd7) partitions with:
dd if=/dev/mtd7 of=/tmp/firmware.bin
and then download the firmware.bin image via SCP.
5. Flash the OpenWrt sysupgrade firmware.
Recovery stock firmware:
1. Transfer the firmware.bin image to the device.
2. Flash the image with:
mtd write firmware.bin firmware
Signed-off-by: Langhua Ye <y1248289414@outlook.com>
Now that both, fw_printenv/fw_setenv and fwtool are always present
during stage2 sysupgrade, we no longer need to list them in
RAMFS_COPY_BIN and RAMFS_COPY_DATA in platform.sh.
Drop both variables as they are now unneeded.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Limit bmt remapping range to cover everything up to and including the kernel image,
use the rest of the flash area for ubi.
Fix partition table and sysupgrade support
Signed-off-by: Felix Fietkau <nbd@nbd.name>
There's no such thing as ucidef_set_interfaces_lan. It's
ucidef_set_interface_lan.
Cc: David Bauer <mail@david-bauer.net>
Signed-off-by: Mark Mentovai <mark@moxienet.com>
Similar to mt7623, also no longer use 'blockdev' and stop relying on
in-kernel partition parsers. Instead, strip off all metadata using
'fwtool' while writing the firmware image and scrape the number of
blocks written from 'dd', then use that block offset to stash the
configuration backup.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Use find_mmc_part instead of previously introduced
get_partition_by_name which requires a custom kernel patch.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
In case of the block device still being in use, re-reading the
partition table fails. In that case, abort sysupgrade to avoid
corrupting the just-written image because of wrong offsets caused
by failure to re-read the partition table.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Specifications:
- SoC: MT7622
- RAM: 512MB
- Flash: MX35LF1GE4AB 128MB SPI NAND
- Ethernet: RTL8367S 5x1GbE
- WiFi: 2.4G: MT7622 5G: MT7615N x2
- Other ports: USB3.0 x1
Flash instruction:
*important*: upgrade vendor firmware to at least V7.1cu.643_B20200521
1. hold the reset button and power on the device. wait for about 10s
before releasing the reset button.
2. upload sysupgrade.bin via u-boot recovery page on http://192.168.1.1
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
Some of bpi-r64 boards have serial NAND attached to SPI bus.
Add SD card image support for installing openwrt to it.
Default to nand upgrade if root device is not mmc block device.
Separate preloader and uboot images for snand are generated.
Signed-off-by: Oskari Lemmela <oskari@lemmela.net>
Builds images for the Ubiquiti Network UniFi 6 LR device running the
U-Boot build added by the previous commits.
Everything but MTD partitions is moved to dtsi.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This adds support for the Buffalo WSR-2533DHP2.
The device uses the Broadcom TRX image format with a special magic. To
be able to boot the images or load them they have to be wrapped with
different headers depending how it is loaded.
There are multiple ways to install OpenWrt on this device.
Boot ramdisk from U-Boot
----------------------------
This will load the image and not write it into the flash.
1. Stop boot menu with "space" key
2. Select "System Load Linux to SDRAM via TFTP."
3. Load this image:
openwrt-mediatek-mt7622-buffalo_wsr-2533dhp2-initramfs-kernel.bin
4. The system boots the image
Write to flash from U-Boot
-----------------------------
This will load the image over tftp and directly write it into the flash.
1. Stop boot menu with "space" key
2. Select "System Load Linux Kernel then write to Flash via TFTP."
3. Load this image:
openwrt-mediatek-mt7622-buffalo_wsr-2533dhp2-squashfs-factory-uboot.bin
4. The system writes this image into the flash and boots into it.
Write to flash from Web UI
-----------------------------
This will load the image over over the Web UI and write it into the flash
1. Open the Web UI
2. Go to "管理" -> "ファームウェア更新"
3. Select "ローカルファイル指定" and click "更新実行"
4. Load this image:
openwrt-mediatek-mt7622-buffalo_wsr-2533dhp2-squashfs-factory.bin
5. The system writes this image into the flash and boots into it.
Specifications
-------------------
* SoC: MT7622 (4x4 2.4 GHz Wifi)
* Wifi: MT7615 (4x4 5 GHz Wifi)
* Flash: Winbond W29N01HZ 128MB SLC NAND
* RAM 256MB
* Ethernet: Realtek RTL8367S (5 x 1GBit/s, SoC via 2.5GBit/s)
Co-Developed-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This was added recently and thus overlooked in 85b1f4d8ca
("treewide: remove execute bit and shebang from board.d files").
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
So far, board.d files were having execute bit set and contained a
shebang. However, they are just sourced in board_detect, with an
apparantly unnecessary check for execute permission beforehand.
Replace this check by one for existance and make the board.d files
"normal" files, as would be expected in /etc anyway.
Note:
This removes an apparantly unused '#!/bin/sh /etc/rc.common' in
target/linux/bcm47xx/base-files/etc/board.d/01_network
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
All mt7622 devices except for the UBI-variant of the mt7622-rfb1 carry
metadata appended to the sysupgrade image.
Add it for the mt7622-rfb1-ubi as well and check it on sysupgrade to
avoid accidentally flashing firmware for the wrong device (or variant
or future DEVICE_COMPAT_VERSION).
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
**What's new**
* Bring support for the Bananapi BPi-R64 to the level desirable for
a nice hackable routerboard.
* Use ARM Trusted Firmware A from source. (goodbye binary preloader)
* Use Das U-Boot from source. (see previous commit)
* Assemble SD-card image using OpenWrt image-commands.
(no gen_sd_cruz_foo.sh added, this is not Raspbian)
* Updated kernel options to support root filesystem.
* Updated DTS to match OpenWrt LAN ports, known LEDs, buttons, ...
* Detect root device, handle sysupgrade, config restore, ...
* Wire up (known) LEDs and buttons in OpenWrt-fashion.
* Build one set of images from SD-card and eMMC.
* Hopefully provide a good example of how things can be done right
from scratch.
**Installation and images**
* Have an empty SD-card at hand
* Write stuff to the card, as root (card device is /dev/mmcblkX)
- write header, gpt, bl2, atf, u-boot and recovery kernel:
`cat *bpi-r64-boot-sdcard.img *bpi-r64-initramfs-recovery.fit > /dev/mmcblkX`
- rescan partitions:
`blockdev --rereadpt /dev/mmcblkX`
- write main system to production partition:
`cat *bpi-r64-squashfs-sysupgrade.fit > /dev/mmcblkXp5`
* Installation to eMMC works using SD-card bootloader via TFTP
When running OpenWrt of SD-card, issue this to trigger installation
to eMMC:
`fw_setenv bootcmd run emmc_init`
Be prepared to serve the content of bin/targets/mediatek/mt7622 on
TFTP server address 192.168.1.254.
**What's missing**
* The red LED is always on, probably a hardware bug.
* AHCI (probably needs DTS changes)
* Ship SD-card image ready with every needed for eMMC install.
* The eMMC has a second, currently unused boot partition. This would
be ideal to store the WiFi EEPROM and Ethernet MAC address(es).
@sinovoip ideas?
Thanks to Thomas Hühn @thuehn for providing the hardware!
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The vendor flash layout of the Linksys E8450 is problematic as it uses
the SPI-NAND chip without any wear-leveling while at the same time
wasting a lot of space for padding.
Use an all-UBI layout instead, storing the kernel+dtb+squashfs in
uImage.FIT standard format in UBI volume 'fit', the read-write
overlay in UBI volume 'rootfs_data' as well as reduntant U-Boot
environments 'ubootenv' and 'ubootenv2', and a 'recovery'
kernel+dtb+initramfs uImage.FIT for dual-boot.
** WARNING **
THIS PROCEDURE CAN EASILY BRICK YOUR DEVICE PERMANENTLY IF NOT CARRIED
OUT VERY CAREFULLY AND EXACTLY AS DESCRIBED!
Step 0
* Configure your PC to have the static IPv4 address 192.168.1.254/24
* Provide bin/targets/mediatek/mt7622 via TFTP
Now continue EITHER with step 1A or 1B, depending on your preference
(and on having serial console wired up or not).
Step 1A (Using the vendor web interface (or non-UBI OpenWrt install))
In order to update to the new bootloader and UBI-based firmware,
use the web browser of your choice to open the routers web-interface
accessible on http://192.168.1.1
* Navigate to
'Configuration' -> 'Administration' -> 'Firmware Upgrade'
* Upload the file
openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb
and proceed with the upgrade.
* Once OpenWrt comes up, use SCP to upload the new bootloader files to
/tmp on the router:
*-mt7622-linksys_e8450-ubi-preloader.bin
*-mt7622-linksys_e8450-ubi-bl31-uboot.fip
* Connect via SSH as you will now need to replace the bootloader in
the Flash.
ssh root@192.168.1.1
(the usual warnings)
* First of all, backup all the flash now:
for mtd in /dev/mtdblock*; do
dd if=$mtd of=/tmp/$(basename $mtd);
done
* Then use SCP to copy /tmp/mtdblock* from the router and keep them
safe. You will need them should you ever want to return to the
factory firmware!
* Now flow the uploaded files:
mtd -e /dev/mtd0 write /tmp/*linksys_e8450-ubi-preloader.bin /dev/mtd0
mtd -e /dev/mtd1 write /tmp/*linksys_e8450-ubi-bl31-uboot.fip /dev/mtd1
If and only if both writes look like the completed successfully
reboot the router. Now continue with step 2.
Step 1B (Using the vendor bootloader serial console)
* Use the serial to backup all /dev/mtd* devices before using the
stock firmware (you got root shell when connected to serial).
* Then reboot and select 'U-Boot Console' in the boot menu.
* Copy the following lines, one by one:
tftpboot 0x40080000 openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin
tftpboot 0x40100000 openwrt-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip
nand erase 0x0 0x180000
nand write 0x40080000 0x0 0x180000
reset
Now continue with step 2
Step 2
Once the new bootchain comes up, the loader will initialize UBI and the
ubootenv volumes. It will then of course fail to find any bootable
volume and hence resort to load kernel via TFTP from server
192.168.1.254 while giving itself the address 192.168.1.1
The requested file is called
openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb
and your TFTP server should provide exactly that :)
It will be written to UBI as recovery image and booted.
You can then continue and flash the production OS image, either
by using sysupgrade in the booted initramfs recovery OS, or by using
the bootloader menu and TFTP.
That's it. Go ahead and mess around with a bootchain built almost
completely from source (only DRAM calibration blobs are fitted in bl2,
and the irreplacable on-chip ROM loader remains, of course).
And enjoy U-Boot built with many great features out-of-the-box.
You can access the bootloader environment from within OpenWrt using the
'fw_printenv' and 'fw_setenv' commands. Don't be afraid, once you got
the new bootchain installed the device should be fairly unbrickable
(holding reset button before and during power-on resets things and
allows reflashing recovery image via TFTP)
Special thanks to @dvn0 (Devan Carpenter) for providing amazingly fast
infra for test-builds, allowing for `make clean ; make -j$(nproc)` in
less than two minutes :)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The Linksys E8450, also known as Belkin RT3200, is a dual-band
IEEE 802.11bgn/ac/ax router based on MediaTek MT7622BV and
MediaTek MT7915AN chips.
FCC: K7S-03571 and K7S-03572
Hardware highlights:
- CPU: MediaTek MT7622BV (2x ARM Cortex-A53 @ 1350 MHz max.)
- RAM: 512MB DDR3
- Flash: 128MB SPI-NAND (2k+64)
- Ethernet: MT7531BE switch with 5 1000Base-T ports
CPU port connected with 2500Base-X
- WiFi 2.4 GHz: 802.11bgn 4T4R built-in antennas
MT7622VB built-in
- WiFi 5 GHz: 802.11ac/ax 4T4R built-in antennas
MT7915AN chip on-board via PCIe
MT7975AN front-end
- Buttons: Reset and WPS
- LEDS: 3 user controllable LEDs, 4 wired to switch
- USB: USB2.0, single port
- no Bluetooth (supported by SoC, not wired on board)
- Serial: JST PH 2.0MM 6 Pin connector inside device
----_____________----
[ GND RX - TX - - ]
---------------------
- JTAG: unpopulated ARM JTAG 20-pin connector (works)
This commit adds support for the device in a way that is compatible
with the vendor firmware's bootloader and dual-boot flash layout, the
resulting image can directly be flashed using the vendor firmware.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Hardware
--------
MediaTek MT7622
512MB DDR3 RAM
64M SPI-NOR Flash (Winbond W25Q512JV)
MediaTek MT7622 802.11bgn 4T4R WMAC
MediaTek MT7915 802.11ax 4T4R
Marvell AQR1112 100/1000/2500 NBase-T PHY
Holtek HT32F52241 LED controller
Reset Switch
UART
----
CPU UART0 at the pinout next to the Holtek MCU.
Pinout (first pin next to SoC / MCU)
0 3V3
1 RX
2 TX
3 GND
Settings are 115200 8N1.
Opening the case
----------------
Opening the case is not a nice task, as itis glued together. Insert a
flat knife between the front and back casing below the ethernet port.
Open up a gap this way and insert a flat scredriver, remove the knife.
Work your way around the casing by applying force to seperate the front
and back casing. This losens the glue and opens the plastic clips. Be
gentle, as these clips are very cheap and break quickly.
Installation
------------
1. Connect to the booted device at 192.168.1.20 using username/password
"ubnt".
2. Transfer the OpenWrt sysupgrade image to the device using SCP.
3. Check the mtd partition number for bs / kernel0 / kernel1
$ cat /proc/mtd
4. Set the bootselect flag to boot from kernel0
$ dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock6
5. Write the OpenWrt sysupgrade image to both kernel0 as well as kernel1
$ dd if=openwrt.bin of=/dev/mtdblock8
$ dd if=openwrt.bin of=/dev/mtdblock9
6. Reboot the device. It should boot into OpenWrt.
Signed-off-by: David Bauer <mail@david-bauer.net>
This drops the shebang from another bunch of files in various /lib
folders, as these are sourced and the shebang is useless.
Fix execute bit in one case, too.
This should cover almost all trivial cases now, i.e. where /lib is
actually used for library files.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This commit adds support for the MT7622-based Elecom WRC-2533gent router,
with spi-nand storage and 512MB RAM.
The device has the following specifications:
* MT7622 (arm64 dual-core)
* 512MB RAM (DDR3)
* 4GB storage (spi-nand)
* 5x 1Gbps Ethernet (RTL8337C switch)
* 1x UART header
* 1x USB 3.0 port
* 5x LEDs
* 1x reset button
* 1x WPS button
* 1x slider switch
* 1x DC jack for main power (12V)
The following has been tested and is working:
* Ethernet switch
* 2.4g and 5g wifi
* USB 3.0 port
* sysupgrade
* buttons/leds
Not working:
* bluetooth firmware does not load even though it is present int he rootfs
Signed-off-by: John Crispin <john@phrozen.org>
This splits some base-files across subtargets, as done previously
on ath79 and ramips and also introduced for mt7629 subtarget here
already. Most of the existing base-files content is specific to
mt7623.
While at it, apply the following fixes:
- Remove lots of trailing whitespaces
- Remove wildcard on unielec,u7623-02-emmc-512m
- Remove inconsistent quotation marks in cases
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Acked-by: John Crispin <john@phrozen.org>
