For HiWiFi series devices, label_mac can be read from bdinfo partition,
and lan_mac, wlan2g_mac are same as the label_mac. Converting label_mac
to wlan5g_mac only needs to unset 6th bit. (It seems that all HiWiFi's
label_mac start with D4:EE)
For example:
label D4:EE:07:32:84:88
lan D4:EE:07:32:84:88
wan D4:EE:07:32:84:89
wlan2g D4:EE:07:32:84:88
wlan5g D0:EE:07:32:84:88
Tested on HiWiFi HC5661.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
MAC addresses on OEM firmware:
04:xx:xx:xx:xx:c8 factory 0x4 wlan2g
06:xx:xx:xx:xx:c8 [not on flash] wlan5g
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
The wireless mac address difference of this machine is similar
to that of D-Link DIR-853-R1, so use the same practice.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Zbtlink ZBT-WG1608 is a Wi-Fi router intendent to use with WWAN (4G/5G)
modems.
Specifications:
* SoC: MediaTek MT7621A
* RAM: 256/512 MiB
* Flash: 16/32 MiB (SPI NOR)
* Wi-Fi:
* MediaTek MT7603E : 2.4Ghz
* MediaTek MT7613BE : 5Ghz
* Ethernet: 10/100/1000 Mbps Ethernet x5 ports (4xLAN + WAN)
* M.2: 1x slot with USB&SIM
* EM7455/EM12-G/EM160R/RM500Q-AE
* USB: 1x 3.0 Type-A port
* External storage: 1x microSD (SDXC) slot
* UART: console (115200 baud)
* LED:
* 1 power indicator
* 1 WLAN 2.4G controlled (wlan 2G)
* 3 SoC controlled (wlan 5G, wwan, internet)
* 5 per Eth phy (4xLAN + WAN)
MAC Addresses:
* LAN : f8:5e:3c:xx:xx:e0 (Factory, 0xe000 (hex))
* WAN : f8:5e:3c:xx:xx:e1 (Factory, 0xe006 (hex))
* 2.4 GHz: f8:5e:3c:xx:xx:de (Factory, 0x0004 (hex))
* 5 GHz : f8:5e:3c:xx:xx:df (Factory, 0x8004 (hex))
Installation:
* Vendor's firmware is OpenWrt (LEDE) based, so the sysupgrade image can
be directly used to install OpenWrt. Firmware must be upgraded using the
'force' and 'do not save configuration' command line options (or
correspondig web interface checkboxes) since the vendor firmware is from
the pre-DSA era.
Recovery Mode:
* Press reset button, power up the device, wait for about 10sec.
* Upload sysupgrade image through the firmware recovery mode web page at
192.168.1.1.
Signed-off-by: Kim Namu <namu@theseed.io>
This adds support for the Renkforce WS-WN530HP3-A ceiling-
mountable Wireless Access Point, which is powered over PoE.
Hardware:
- SoC: Mediatek MT7621DAT
- RAM: 128MiB on SoC
- Flash: 16MiB GigaDevice GD25Q128C
- 2.4Ghz Wifi: Mediatek MT603EN
- 5GHz Wifi: MT613BEN
- Ethernet:
- 1x 1GBit WAN port, passive PoE capable
- 2x 1GBit LAN ports
LEDs: 1x Bi-Color LED (red/blue)
Buttons: 1x Reset Button, 1x Power Button
Installation:
Power on the access point and immedately press the reset
button for 10 seconds. Connect web-browser to 192.168.10.1
and upload sysupgrade image. Flash uploaded image and wait
about 2 minutes for reboot.
Signed-off-by: Birger Koblitz <mail@birger-koblitz.de>
Signed-off-by: Petr Štetiar <ynezz@true.cz> [fixed SoB]
AV1300 Gigabit Passthrough Powerline ac Wi-Fi Extender
Specifications
--------------
* SoC: MediaTek MT7621AT
* CPU: 880 MHz MIPS 1004KEc dual-core CPU
* RAM: 64 MiB DDR2 (Zentel A3R12E40DBF-8E)
* Flash: 8 MiB SPI NOR (GigaDevice GD25Q64CSIG)
* Ethernet: SoC built-in Switch 5x 1GbE
* Port 0: PLC (connected through AR8035-A)
* Port 1-3: LAN
* WLAN: 2x2 2.4GHz 300 Mbps + 2x2 5GHz 867 Mbps (MT7603EN + MT7613BEN)
* PLC: HomePlug AV2 (Qualcomm QCA7500)
* PLC Flash: 2MiB SPI NOR (GigaDevice GD25Q16CSIG)
* Buttons: Reset, LED, Pair, Wi-Fi
* LEDs: Power (green), PLC (green/amber), LAN (green), 2.4G (green),
5G (green)
* UART: J1 (57600 baud)
* Pinout: (3V3) (GND) (RX) (TX)
* Visually identify GND from connection to PCB ground plane
Installation
------------
Installation is possible from the OEM web interface. Make sure to install
the latest OEM firmware first, so that the PLC firmware is at the latest
version. However, please first check the OpenWRT Wiki page for
confirmation that your OEM firmware version is supported.
Signed-off-by: Joe Mullally <jwmullally@gmail.com>
Add support for the TP-Link EAP615-Wall, an AX1800 Wall Plate WiFi 6 AP.
The device is very similar to the TP-Link EAP235-Wall.
Hardware:
* SoC: MediaTek MT7621AT
* RAM: 128MiB
* Flash: 16MiB SPI-NOR
* Ethernet: 4x GbE
* Back: ETH0 (PoE-PD)
* Bottom: ETH1, ETH2, ETH3 (PoE passthrough)
* WiFi: MT7905DAN/MT7975DN 2.4/5 GHz 2T2R
* LEDS: 1x white
* Buttons: 1x LED, 1x reset
Stock firmware uses a random MAC address for ethernet. OpenWrt uses the
MAC address that is on the device label for ethernet and the wireless
interfaces. MAC address must not be incremented, as this will cause MAC
address conflicts in case you have two devices with consecutive MAC
addresses. Instead, different locally administered addresses will be
generated automatically, based on the MAC on the label.
Installation via stock firmware:
* Enable SSH in the TP-Link web interface
* SSH to the device
* Run `cliclientd stopcs`
* Upload the OpenWrt factory image via the TP-Link web interface
Installation via bootloader:
* Solder TTL header. Pinout: 1: TX, 2: RX, 3: GND, 4: VCC, with pin 1
closest to ETH1. Baud rate 115200
* Interrupt boot process by holding a key during boot
* Boot the OpenWrt initramfs:
# tftpboot 0x84000000 openwrt-ramips-mt7621-tplink_eap615-wall-v1-initramfs-kernel.bin
# bootm
* Copy openwrt-ramips-mt7621-tplink_eap615-wall-v1-squashfs-sysupgrade.bin
to /tmp and use sysupgrade to install it
Thanks to Sander Vanheule for his work on the EAP235-Wall, which made
adding support for the EAP615-Wall very easy.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Reviewed-by: Sander Vanheule <sander@svanheule.net>
Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Add support for ipTIME A3002MESH.
Hardware:
- SoC: MediaTek MT7621AT (880MHz, Duel-Core)
- RAM: DDR3 128MB
- Flash: XMC XM25QH128AHIG (SPI-NOR 16MB)
- WiFi: MediaTek MT7615D (2.4GHz, 5GHz, DBDC)
- Ethernet: MediaTek MT7530 (WAN x1, LAN x2, SoC built-in)
- UART: [GND, RX, TX, 3.3V] (57600 8N1, J4)
MAC addresses:
| interface | MAC | source | comment
|-----------|-------------------|----------------|----------
| LAN | 70:XX:XX:5X:XX:X3 | |
| WAN | 70:XX:XX:5X:XX:X1 | u-boot 0x1fc40 |
| WLAN 2G | 72:XX:XX:4X:XX:X0 | |
| WLAN 5G | 70:XX:XX:5X:XX:X0 | factory 0x4 |
| | 70:XX:XX:5X:XX:X0 | u-boot 0x1fc20 | unknown
| | 70:XX:XX:5X:XX:X2 | factory 0x8004 | unknown
- WLAN 2G MAC address is not the same as stock firmware since OpenWrt
uses LAN MAC address with local bit sets.
Installation:
1. Flash initramfs image. This can be done using stock web ui or TFTP
2. Connect to OpenWrt with an SSH connection to 192.168.1.1
3. Perform sysupgrade with sysupgrade image
Revert to stock firmware:
- Flash stock firmware via OEM TFTP Recovery mode
- Perform sysupgrade with stock image
TFTP Recovery method:
1. Unplug the router
2. Hold the reset button and plug in
3. Release when the power LED stops flashing and go off
4. Set your computer IP address manually to 192.168.0.x / 255.255.255.0
5. Flash image with TFTP client to 192.168.0.1
Signed-off-by: Yoonji Park <koreapyj@dcmys.kr>
[wrap/rephrase commit message]
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Reported MAC addresses:
| interface | MAC address | source | comment
|-----------|-------------------|----------------|---------
| LAN | 90:xx:xx:18:xx:1F | | [1]
| WAN | 90:xx:xx:18:xx:1D | |
| WLAN 2G | 92:xx:xx:48:xx:1C | |
| WLAN 5G | 90:xx:xx:18:xx:1C | factory 0x4 |
| | 90:xx:xx:18:xx:1C | config ethaddr |
[1] Used in this patch as WLAN 2G MAC address with the local bit set
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
ipTIME AX2004M is an 802.11ax (Wi-Fi 6) router, based on MediaTek
MT7621A.
Specifications:
* SoC: MT7621A
* RAM: 256 MiB
* Flash: NAND 128 MiB
* Wi-Fi:
* MT7915D: 2.4/5 GHz (DBDC)
* Ethernet: 5x 1GbE
* Switch: SoC built-in
* USB: 1x 3.0
* UART: J4 (115200 baud)
* Pinout: [3V3] (TXD) (RXD) (GND)
MAC addresses:
| interface | MAC address | source | comment
|-----------|-------------------|----------------|---------
| LAN | 58:xx:xx:00:xx:9B | | [1]
| WAN | 58:xx:xx:00:xx:99 | |
| WLAN 2G | 58:xx:xx:00:xx:98 | factory 0x4 |
| WLAN 5G | 5A:xx:xx:40:xx:98 | |
| | 58:xx:xx:00:xx:98 | config ethaddr |
[1] Used in this patch as WLAN 5G MAC address with the local bit set
Load addresses:
* stock
* 0x80010000: FIT image
* 0x81001000: kernel image -> entry
* OpenWrt
* 0x80010000: FIT image
* 0x82000000: uncompressed kernel+relocate image
* 0x80001000: relocated kernel image -> entry
Notes:
* This device has a dual-boot partition scheme, but this firmware works
only on boot partition 1. The stock web interface will flash only on the
inactive boot partition, but the recovery web page will always flash on
boot partition 1.
Installation via recovery mode:
1. Press reset button, power up the device, wait >10s for CPU LED
to stop blinking.
2. Upload recovery image through the recovery web page at 192.168.0.1.
Revert to stock firmware:
1. Install stock image via recovery mode.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Add support for MediaTek Gigabit Ethernet PHYs found in MT7530 and
MT7531. Fix some link up/down issues.
The errornous check for the PHY mode which broke things with MT7531
has been removed as suggested by patch
net: phy: mediatek: remove PHY mode check on MT7531
As a result, things are working fine now on MT7622+MT7531 as well.
Signed-off-by: DENG Qingfang <dqfext@gmail.com>
Tested-by: Daniel Golle <daniel@makrotopia.org>
Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Tested-by: Stijn Tintel <stijn@linux-ipv6.be>
Xiaomi Mi Router CR6606 is a Wi-Fi6 AX1800 Router with 4 GbE Ports.
Alongside the general model, it has three carrier customized models:
CR6606 (China Unicom), CR6608 (China Mobile), CR6609 (China Telecom)
Specifications:
- SoC: MediaTek MT7621AT
- RAM: 256MB DDR3 (ESMT M15T2G16128A)
- Flash: 128MB NAND (ESMT F59L1G81MB)
- Ethernet: 1000Base-T x4 (MT7530 SoC)
- WLAN: 2x2 2.4GHz 574Mbps + 2x2 5GHz 1201Mbps (MT7905DAN + MT7975DN)
- LEDs: System (Blue, Yellow), Internet (Blue, Yellow)
- Buttons: Reset, WPS
- UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1)
- Power: 12VDC, 1A
Jailbreak Notes:
1. Get shell access.
1.1. Get yourself a wireless router that runs OpenWrt already.
1.2. On the OpenWrt router:
1.2.1. Access its console.
1.2.2. Create and edit
/usr/lib/lua/luci/controller/admin/xqsystem.lua
with the following code (exclude backquotes and line no.):
```
1 module("luci.controller.admin.xqsystem", package.seeall)
2
3 function index()
4 local page = node("api")
5 page.target = firstchild()
6 page.title = ("")
7 page.order = 100
8 page.index = true
9 page = node("api","xqsystem")
10 page.target = firstchild()
11 page.title = ("")
12 page.order = 100
13 page.index = true
14 entry({"api", "xqsystem", "token"}, call("getToken"), (""),
103, 0x08)
15 end
16
17 local LuciHttp = require("luci.http")
18
19 function getToken()
20 local result = {}
21 result["code"] = 0
22 result["token"] = "; nvram set ssh_en=1; nvram commit; sed -i
's/channel=.*/channel=\"debug\"/g' /etc/init.d/dropbear; /etc/init.d/drop
bear start;"
23 LuciHttp.write_json(result)
24 end
```
1.2.3. Browse http://{OWRT_ADDR}/cgi-bin/luci/api/xqsystem/token
It should give you a respond like this:
{"code":0,"token":"; nvram set ssh_en=1; nvram commit; ..."}
If so, continue; Otherwise, check the file, reboot the rout-
er, try again.
1.2.4. Set wireless network interface's IP to 169.254.31.1, turn
off DHCP of wireless interface's zone.
1.2.5. Connect to the router wirelessly, manually set your access
device's IP to 169.254.31.3, make sure
http://169.254.31.1/cgi-bin/luci/api/xqsystem/token
still have a similar result as 1.2.3 shows.
1.3. On the Xiaomi CR660x:
1.3.1. Login to the web interface. Your would be directed to a
page with URL like this:
http://{ROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/web/home#r-
outer
1.3.2. Browse this URL with {STOK} from 1.3.1, {WIFI_NAME}
{PASSWORD} be your OpenWrt router's SSID and password:
http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/misy-
stem/extendwifi_connect?ssid={WIFI_NAME}&password={PASSWO-
RD}
It should return 0.
1.3.3. Browse this URL with {STOK} from 1.3.1:
http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/xqsy-
stem/oneclick_get_remote_token?username=xxx&password=xxx&-
nonce=xxx
1.4. Before rebooting, you can now access your CR660x via SSH.
For CR6606, you can calculate your root password by this project:
https://github.com/wfjsw/xiaoqiang-root-password, or at
https://www.oxygen7.cn/miwifi.
The root password for carrier-specific models should be the admi-
nistration password or the default login password on the label.
It is also feasible to change the root password at the same time
by modifying the script from step 1.2.2.
You can treat OpenWrt Router however you like from this point as
long as you don't mind go through this again if you have to expl-
oit it again. If you do have to and left your OpenWrt router unt-
ouched, start from 1.3.
2. There's no official binary firmware available, and if you lose the
content of your flash, no one except Xiaomi can help you.
Dump these partitions in case you need them:
"Bootloader" "Nvram" "Bdata" "crash" "crash_log"
"firmware" "firmware1" "overlay" "obr"
Find the corespond block device from /proc/mtd
Read from read-only block device to avoid misoperation.
It's recommended to use /tmp/syslogbackup/ as destination, since files
would be available at http://{ROUTER_ADDR}/backup/log/YOUR_DUMP
Keep an eye on memory usage though.
3. Since UART access is locked ootb, you should get UART access by modify
uboot env. Otherwise, your router may become bricked.
Excute these in stock firmware shell:
a. nvram set boot_wait=on
b. nvram set bootdelay=3
c. nvram commit
Or in OpenWrt:
a. opkg update && opkg install kmod-mtd-rw
b. insmod mtd-rw i_want_a_brick=1
c. fw_setenv boot_wait on
d. fw_setenv bootdelay 3
e. rmmod mtd-rw
Migrate to OpenWrt:
1. Transfer squashfs-firmware.bin to the router.
2. nvram set flag_try_sys1_failed=0
3. nvram set flag_try_sys2_failed=1
4. nvram commit
5. mtd -r write /path/to/image/squashfs-firmware.bin firmware
Additional Info:
1. CR660x series routers has a different nand layout compared to other
Xiaomi nand devices.
2. This router has a relatively fresh uboot (2018.09) compared to other
Xiaomi devices, and it is capable of booting fit image firmware.
Unfortunately, no successful attempt of booting OpenWrt fit image
were made so far. The cause is still yet to be known. For now, we use
legacy image instead.
Signed-off-by: Raymond Wang <infiwang@pm.me>
This reverts commit 8b4cba53a9.
This broke the mt7530 on Linksys e8450 (mt7622) for me.
[ 1.312943] mt7530 mdio-bus:00 lan1 (uninitialized): failed to connect to PHY: -EINVAL
[ 1.320890] mt7530 mdio-bus:00 lan1 (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 0
[ 1.331163] mt7530 mdio-bus:00 lan2 (uninitialized): failed to connect to PHY: -EINVAL
[ 1.339085] mt7530 mdio-bus:00 lan2 (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 1
[ 1.349321] mt7530 mdio-bus:00 lan3 (uninitialized): failed to connect to PHY: -EINVAL
[ 1.357241] mt7530 mdio-bus:00 lan3 (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 2
[ 1.367452] mt7530 mdio-bus:00 lan4 (uninitialized): failed to connect to PHY: -EINVAL
[ 1.375367] mt7530 mdio-bus:00 lan4 (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 3
[ 1.385750] mt7530 mdio-bus:00 wan (uninitialized): failed to connect to PHY: -EINVAL
[ 1.393575] mt7530 mdio-bus:00 wan (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 4
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add support for MediaTek Gigabit Ethernet PHYs found in MT7530.
Fix some link up/down issues.
Signed-off-by: DENG Qingfang <dqfext@gmail.com>
Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Tested-by: Stijn Tintel <stijn@linux-ipv6.be>
Commit f4a79148f8 ("ramips: add support for ipTIME AX2004M") seems to
leak KERNEL_LOADADDR 0x82000000 to other devices, causing the to no
longer boot. The leak is visible in u-boot:
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: MIPS OpenWrt Linux-5.10.92
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x840000e4
Data Size: 10750165 Bytes = 10.3 MiB
Architecture: MIPS
OS: Linux
Load Address: 0x82000000
Entry Point: 0x82000000
Normally, it should look like this:
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: MIPS OpenWrt Linux-5.10.92
Type: Kernel Image
Compression: lzma compressed
Data Start: 0xbfca00e4
Data Size: 2652547 Bytes = 2.5 MiB
Architecture: MIPS
OS: Linux
Load Address: 0x80001000
Entry Point: 0x80001000
Revert the commit to avoid more people soft-bricking their devices.
This reverts commit f4a79148f8.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
I2C_CHARDEV used to be enabled in mt7621/config-5.4. Enable it in the
5.10 config, as it's required for PoE control on Unifi Switch Flex.
Fixes: b4aad29a1d ("ramips: add support for kernel 5.10")
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
The current MAC address assignment is still incorrect.
Use the same MAC address as seen on the stock firmware
for both wireless interfaces.
The 5GHz MAC address OUI is +2 in the first EUI octet. We currently
don't do this in OpenWrt. Ignore this offset for now. With the current
assignment, recurring MAC addresses between radios is already taken care
of.
Signed-off-by: David Bauer <mail@david-bauer.net>
Specifications:
- SoC: MT7621DAT (880MHz, 2 Cores)
- RAM: 128 MB
- Flash: 128 MB NAND
- Ethernet: 5x 1GiE MT7530
- WiFi: MT7603/MT7613
- USB: 1x USB 3.0
This is another MT7621 device, very similar to other Linksys EA7300
series devices.
Installation:
Upload the generated factory.bin image via the stock web firmware
updater.
Reverting to factory firmware:
Like other EA7300 devices, this device has an A/B router configuration
to prevent bricking. Hard-resetting this device three (3) times will
put the device in failsafe (default) mode. At this point, flash the
OEM image to itself and reboot. This puts the router back into the 'B'
image and allows for a firmware upgrade.
Troubleshooting:
If the firmware will not boot, first restore the factory as described
above. This will then allow the factory.bin update to be applied
properly.
Signed-off-by: Nick McKinney <nick@ndmckinney.net>
RAISECOM MSG1500 X.00 is a 2.4/5 GHz band 11ac (Wi-Fi 5) router.
Apart from the general model, there are two ISP customized models:
China Mobile and China Telecom.
Specifications:
- SoC: Mediatek MT7621AT
- RAM: 256MiB DDR3
- Flash: 128MiB NAND
- Ethernet: 5 * 10/100/1000Mbps: 4 * LAN + 1 * WAN
- Switch: MediaTek MT7530 (SoC)
- WLAN: 1 * MT7615DN Dual-Band 2.4GHz 2T2R (400Mbps) 5GHz 2T2R (867Mbps)
- USB: 1 * USB 2.0 port
- Button: 1 * RESET button, 1 * WPS button, 1 * WIFI button
- LED: blue color: POWER, WAN, WPS, 2.4G, 5G, LAN1, LAN2, LAN3, LAN4, USB
- UART: 1 * serial port header (4-pin)
- Power: DC 12V, 1A
- Switch: 1 * POWER switch
MAC addresses as verified by vendor firmware:
use address source
LAN C8:XX:XX:3A:XX:E7 Config "protest_lan_mac" ascii (label)
WAN C8:XX:XX:3A:XX:EA Config "protest_wan_mac" ascii
5G C8:XX:XX:3A:XX:E8 Factory "0x4" hex
2.4G CA:XX:XX:4A:XX:E8 [not on flash]
The increment of the 4th byte for the 2.4g address appears to vary.
Reported cases:
5g 2.4g increment
C8:XX:XX:90:XX:C3 CA:XX:XX:C0:XX:C3 0x30
C8:XX:XX:3A:XX:08 CA:XX:XX:4A:XX:08 0x10
C8:XX:XX:3A:XX:E8 CA:XX:XX:4A:XX:E8 0x10
Since increment is inconsistent and there is no obvious pattern
in swapping bytes, and the 2.4g address has local bit set anyway,
it seems safer to use the LAN address with flipped byte here in
order to prevent collisions between OpenWrt devices and OEM devices
for this interface. This way we at least use an address as base
that is definitely owned by the device at hand.
Notes:
1. The vendor firmware allows you to connect to the router by telnet.
(known version 1.0.0 can open telnet.)
There is no official binary firmware available.
Backup the important partitions data:
"Bootloader", "Config", "Factory", and "firmware".
Note that with the vendor firmware the memory is detected only 128MiB
and the last 512KiB in NAND flash is not used.
2. The POWER LED is default on after press POWER switch.
The WAN and LAN1 - 4 LEDs are wired to ethernet switch.
The WPS LED is controlled by MT7615DN's GPIO.
Currently there is no proper way to configure it.
3. At the time of adding support the wireless config needs to be set up
by editing the wireless config file:
* Setting the country code is mandatory, otherwise the router loses
connectivity at the next reboot. This is mandatory and can be done
from luci. After setting the country code the router boots correctly.
A reset with the reset button will fix the issue and the user has to
reconfigure.
* This is minor since the 5g interface does not come up online although
it is not set as disabled. 2 options here:
1- Either run the "wifi" command. Can be added from LuCI in system -
startup - local startup and just add wifi above "exit 0".
2- Or add the serialize option in the wireless config file as shown
below. This one would work and bring both interfaces automatically
at every boot:
config wifi-device 'radio0'
option serialize '1'
config wifi-device 'radio1'
option serialize '1'
Flash instructions using initramfs image:
1. Press POWER switch to power down if the router is running.
2. Connect PC to one of LAN ports, and set
static IP address to "10.10.10.2", netmask to "255.255.255.0",
and gateway to "10.10.10.1" manually on the PC.
3. Push and hold the WIFI button, and then power up the router.
After about 10s (or you can call the recovery page, see "4" below)
you can release the WIFI button.
There is no clear indication when the router
is entering or has entered into "RAISECOM Router Recovery Mode".
4. Call the recovery page for the router at "http://10.10.10.1".
Keep an eye on the "WARNING!! tip" of the recovery page.
Click "Choose File" to select initramfs image, then click "Upload".
5. If image is uploaded successfully, you will see the page display
"Device is upgrading the firmware... %".
Keep an eye on the "WARNING!! tip" of the recovery page.
When the page display "Upgrade Successfully",
you can set IP address as "automatically obtain".
6. After the rebooting (PC should automatically obtain an IP address),
open the SSH connection, then download the sysupgrade image
to the router and perform sysupgrade with it.
Flash back to vendor firmware:
See "Flash instructions 1 - 5" above.
The only difference is that in step 4
you should select the vendor firmware which you backup.
Signed-off-by: Liangkuan Yang <ylk951207@gmail.com>
ipTIME T5004 is a 5-port Gigabit Ethernet router, based on MediaTek MT7621A.
Specifications:
* SoC: MT7621AT
* RAM: 128 MiB
* Flash: NAND 128 MiB
* Ethernet: 5x 1GbE
* Switch: SoC built-in
* UART: J4 (57600 baud)
* Pinout: [3V3] (TXD) (RXD) (GND)
Installation via web interface:
1. Flash **initramfs** image through the stock web interface.
2. Boot into OpenWrt and perform sysupgrade with sysupgrade image.
Revert to stock firmware via recovery mode:
1. Press reset button, power up the device, wait >15s for CPU LED
to stop blinking.
2. Upload stock image to TFTP server at 192.168.0.1.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
ipTIME A3004T is a 2.4/5GHz band router, based on Mediatek MT7621.
Specifications:
- SoC: MT7621 (880MHz)
- RAM: DDR3 256M
- Flash: NAND 128MB (Macronix NAND 128MiB 3,3V 8-bit)
- WiFi:
- 2.4GHz: MT7615E
- 5GHz : MT7615E
- Ethernet:
- 4x LAN
- 1x WAN
- USB: 1 * USB3.0 port
- UART:
- 3.3V, TX, RX, GND / 57600 8N1
Installation via web interface:
1. Flash initramfs image using OEM's Recovery mode
2. Boot into OpenWrt and perform sysupgrade with sysupgrade image.
Revert to stock firmware:
- Flash stock firmware via OEM's Recovery mode
How to use OEM's Recovery mode:
1. Power up with holding down the reset key until CPU LED stop blinking.
2. Set fixed ip with `192.168.0.2` with subnet mask `255.255.255.0`
3. Flash image via tftp to `192.168.0.1`
Additional Notes:
This router shares one MT7915E chip for both 2.4Ghz/5Ghz.
radio0 will not working on 5Ghz as it's not connected to the antenna.
Signed-off-by: WonJung Kim <git@won-jung.kim>
(added led dt-bindings)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Each of
- CRYPTO_AEAD2
- CRYPTO_AEAD
- CRYPTO_GF128MUL
- CRYPTO_GHASH
- CRYPTO_HASH2
- CRYPTO_HASH
- CRYPTO_MANAGER2
- CRYPTO_MANAGER
- CRYPTO_NULL2
either directly required for mac80211 crypto support, or directly
selected by such options. Support for the mac80211 crypto was enabled in
the generic config since c7182123b9 ("kernel: make cryptoapi support
needed by mac80211 built-in"). So move the above options from the target
configs to the generic config to make it clear why do we need them.
CC: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Both CLANG_VERSION and LLD_VERISON are autogenerated runtime
configuration options, so add them to the kernel configuration filter
and remove from generic and per-target configs to keep configs clean.
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
It was reported, that Tenbay T-MB5EU v1 do have incorrect Wireless MAC
address set on 2.4 and 5 GHz.
Some boards do not seem to have the correct MAC address set for the
external PHY of the MT7915 radio at caldata offset 0xa.
As the external PHY does not expose a DT binding (yet), fix up the mac
address in userspace.
Signed-off-by: David Bauer <mail@david-bauer.net>
HUMAX E10 (also known as HUMAX QUANTUM E10) is a 2.4/5GHz band AC router,
based on MediaTek MT7621A.
Specifications:
- SoC: MT7621A
- RAM: DDR3 128MB
- Flash: SPI NOR 16MB (MXIC MX25L12805D)
- WiFi:
- 2.4GHz: MT7615
- 5GHz: MT7615
- Ethernet: 2x 10/100/1000Mbps
- Switch: SoC internal
- USB: 1x USB 2.0 Type-A
- UART: J1 (57600 8N1)
- pinout: [3V3] (RXD) (GND) (TXD)
Installation via web interface:
- Flash **factory** image through the stock web interface.
Recovery procedure:
1. Connect ethernet cable between Router **LAN** port and PC Ethernet port.
2. Set your computer to a static IP **192.168.1.1**
3. Turn the device off and wait a few seconds. Hold the WPS button on front
of device and insert power.
4. Send a firmware image to **192.168.1.6** using TFTP.
You can use any TFTP client. (tftp, curl, Tftpd64...)
- It can accept both images which is
HUMAX stock firmware dump (0x70000-0x1000000) image
and OpenWRT **sysupgrade** image.
Signed-off-by: Kyoungkyu Park <choryu.park@choryu.space>
[remove trailing whitespace]
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
With the various variants of Netgear R**** devices, make it more
obvious which image should be used for the R7200.
Signed-off-by: Dale Hui <strokes-races0b@icloud.com>
[provide proper commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Expose I2C busses with a chardev device. This is required to control the
PSE controller on the Ubiquiti UniFi Flex Switch.
Signed-off-by: David Bauer <mail@david-bauer.net>
Hardware
--------
MediaTek MT7621AT
16M SPI-NOR Macronix MX25L12835FMI
Microchip PD69104B1 4-Channel PoE-PSE controller
TI TPS2373 PoE-PD controller
PoE-Controller
--------------
By default, the PoE outputs do not work with OpenWrt. To make them output
power, install the "poemgr" package from the packages feed.
This package can control the PD69104B1 PSE controller.
Installation
------------
1. Connect to the booted device at 192.168.1.20 using username/password
"ubnt" via SSH.
2. Add the uboot-envtools configuration file /etc/fw_env.config with the
following content
$ echo "/dev/mtd1 0x0 0x1000 0x10000 1" > /etc/fw_env.config
3. Update the bootloader environment.
$ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr);
fdt rm /signature; bootubnt"
$ fw_setenv bootcmd "run boot_openwrt"
4. Transfer the OpenWrt sysupgrade image to the device using SCP.
5. Check the mtd partition number for bs / kernel0 / kernel1
$ cat /proc/mtd
6. Set the bootselect flag to boot from kernel0
$ dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock4
7. Write the OpenWrt sysupgrade image to both kernel0 as well as kernel1
$ dd if=openwrt.bin of=/dev/mtdblock6
$ dd if=openwrt.bin of=/dev/mtdblock7
8. Reboot the device. It should boot into OpenWrt.
Restore to UniFi
----------------
To restore the vendor firmware, follow the Ubiquiti UniFi TFTP
recovery guide for access points. The process is the same for
the Flex switch.
Signed-off-by: David Bauer <mail@david-bauer.net>
I-O DATA WN-DX2033GR is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on
MT7621A.
Specification:
- SoC : MediaTek MT7621A
- RAM : DDR3 128 MiB
- Flash : Raw NAND 128 MiB (Macronix MX30LF1G18AC-TI)
- WLAN : 2.4/5 GHz
- 2.4 GHz : 2T2R, MediaTek MT7603E
- 5 GHz : 4T4R, MediaTek MT7615
- Ethernet : 5x 10/100/1000 Mbps
- Switch : MediaTek MT7530 (SoC)
- LEDs/Keys : 2x/3x (2x buttons, 1x slide-switch)
- UART : through-hole on PCB
- J5: 3.3V, TX, RX, NC, GND from triangle mark
- 57600n8
- Power : 12 VDC, 1 A
Flash instruction using initramfs image:
1. Boot WN-DX2033GR normally
2. Access to "http://192.168.0.1/" and open firmware update page
("ファームウェア")
3. Select the OpenWrt initramfs image and click update ("更新") button
to perform firmware update
4. On the initramfs image, download the sysupgrade.bin image to the
device and perform sysupgrade with it
5. Wait ~120 seconds to complete flashing
Notes:
- The hardware of WN-DX2033GR and WN-AX2033GR are almost the same, and
it is certified under the same radio-wave related regulations in Japan
- The last 0x80000 (512 KiB) in NAND flash is not used on stock firmware
- stock firmware requires "customized uImage header" (called as "combo
image") by MSTC (MitraStar Technology Corp.), but U-Boot doesn't
- uImage magic ( 0x0 - 0x3 ) : 0x434F4D42 ("COMB")
- header crc32 ( 0x4 - 0x7 ) : with "data length" and "data crc32"
- image name (0x20 - 0x37) : model ID and firmware versions
- data length (0x38 - 0x3b) : kernel + rootfs
- data crc32 (0x3c - 0x3f) : kernel + rootfs
- There are 2x important flags in the flash:
- bootnum : select os partition for booting (persist, 0x4)
- 0x01: firmware
- 0x02: firmware_2
- debugflag : allow interrupt kernel loader, it's named as "Z-LOADER"
(Factory, 0xFE75)
- 0x00: disable debug
- 0x01: enable debug
MAC addresses:
LAN : 50:41:B9:xx:xx:90 (Factory, 0xE000 (hex) / Ubootenv, ethaddr (text))
WAN : 50:41:B9:xx:xx:92 (Factory, 0xE006 (hex))
2.4 GHz : 50:41:B9:xx:xx:90 (Factory, 0x4 (hex))
5 GHz : 50:41:B9:xx:xx:91 (Factory, 0x8004 (hex))
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
CONFIG_RCU_{NEED_SEGCBLIST,STALL_COMMON} are set basically everywhere. Move them
to the generic kconfigs. And resort the generic kconfigs while at it.
Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
MAC address retrieval was switched to more generic upstream (5.13) NVMEM
based solution in commit 06bb4a5018 ("ramips: convert mtd-mac-address
to nvmem implementation") , but NVMEM subsystem wasn't enabled in the
kernel, so fix it now.
References: https://github.com/openwrt/openwrt/pull/4041#issuecomment-883322801
Fixes: 06bb4a5018 ("ramips: convert mtd-mac-address to nvmem implementation")
Signed-off-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Petr Štetiar <ynezz@true.cz> [commit message]
Commands in 10_fix_wifi_mac were not properly concatenated, so
this was also triggered for the second phy without giving a
MAC address as argument.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Specifications:
* SoC: MT7621AT
* RAM: 256MB
* Flash: 128MB NAND flash
* WiFi: MT7615DN (2.4GHz+5Ghz) with DBDC
* LAN: 5x1000M
* Firmware layout is Uboot with extra 96 bytes in header
* Base PCB is DIR-1360 REV1.0
* LEDs Power Blue+Orange,Wan Blue+Orange,WPS Blue,"2.4G"Blue, "5G" Blue,
USB Blue
* Buttons Reset,WPS, Wifi
MAC addresses on OEM firmware:
lan factory 0xe000 f4:*:*:a8:*:65 (label)
wan factory 0xe006 f4:*:*:a8:*:68
2.4 GHz [not on flash] f6:*:*:c8:*:66
5.0 GHz factory 0x4 f4:*:*:a8:*:66
The increment of the 4th byte for the 2.4g address appears to vary.
Reported cases:
5g 2.4g increment
f4:XX:XX:a8:XX:66 f6:XX:XX:c8:XX:66 +0x20
x0:xx:xx:68:xx:xx x2:xx:xx:48:xx:xx -0x20
x4:xx:xx:6a:xx:xx x6:xx:xx:4a:xx:xx -0x20
Since increment is inconsistent and there is no obvious pattern
in swapping bytes, and the 2.4g address has local bit set anyway,
it seems safer to use the LAN address with flipped byte here in
order to prevent collisions between OpenWrt devices and OEM devices
for this interface. This way we at least use an address as base
that is definitely owned by the device at hand.
Flashing instruction:
The Dlink "Emergency Room" cannot be accessed through the reset
button on this device. You can either use console or use the
encrypted factory image availble in the openwrt forum.
Once the encrypted image is flashed throuh the stock Dlink web
interface, the sysupgrade images can be used.
Header pins needs to be soldered near the WPS and Wifi buttons.
The layout for the pins is (VCC,RX,TX,GND). No need to connect the VCC.
the settings are:
Bps/Par/Bits : 57600 8N1
Hardware Flow Control : No
Software Flow Control : No
Connect your client computer to LAN1 of the device
Set your client IP address manually to 192.168.0.101 / 255.255.255.0.
Call the recovery page or tftp for the device at http://192.168.0.1
Use the provided emergency web GUI to upload and flash a new firmware to
the device
At the time of adding support the wireless config needs to be set up by
editing the wireless config file:
* Setting the country code is mandatory, otherwise the router loses
connectivity at the next reboot. This is mandatory and can be done
from luci. After setting the country code the router boots correctly.
A reset with the reset button will fix the issue and the user has to
reconfigure.
* This is minor since the 5g interface does not come up online although
it is not set as disabled. 2 options here:
1- Either run the "wifi" command. Can be added from LUCI in system -
startup - local startup and just add wifi above "exit 0".
2- Or add the serialize option in the wireless config file as shown
below. This one would work and bring both interfaces automatically
at every boot:
config wifi-device 'radio0'
option serialize '1'
config wifi-device 'radio1'
option serialize '1'
Signed-off-by: Karim Dehouche <karimdplay@gmail.com>
[rebase, improve MAC table, update wireless config comment, fix
2.4g macaddr setup]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Specifications:
- SoC: MT7621AT
- RAM: 256MB
- Flash: 128MB NAND
- Ethernet: 5 Gigabit ports
- WiFi: 2.4G/5G MT7615N
- USB: 1 USB 3.0, 1 USB 2.0
This device is very similar to the EA7300 v1/v2, EA7500 v2, and EA8100 v1.
Installation:
Upload the generated factory image through the factory web interface.
(following part taken from EA7300 v2 commit message:)
This might fail due to the A/B nature of this device. When flashing, OEM
firmware writes over the non-booted partition. If booted from 'A',
flashing over 'B' won't work. To get around this, you should flash the
OEM image over itself. This will then boot the router from 'B' and
allow you to flash OpenWRT without problems.
Reverting to factory firmware:
Hard-reset the router three times to force it to boot from 'B.' This is
where the stock firmware resides. To remove any traces of OpenWRT from
your router simply flash the OEM image at this point.
With thanks to Tom Wizetek (@wizetek) for testing.
Signed-off-by: Tee Hao Wei <angelsl@in04.sg>
This PR adds support for router D-Link DIR-853-R1
Specifications:
SoC: MT7621AT
RAM: 128MB
Flash: 16MB SPI
WiFi: MT7615DN (2.4GHz+5Ghz) with DBDC (This mode allows this
single chip act as an 2x2 11n radio and an 2x2 11ac radio at the
same time)
LAN: 5x1000M
LEDs Power Blue+Orange,Wan Blue+Orange,WPS Blue,"2.4G"Blue, "5G" Blue
USB Blue
Buttons Reset,WPS, Wifi
MAC addresses:
|Interface | MAC | Factory |Comment
|------------|-----------------|-------------|----------------
|WAN sticker |C4:XX:XX:6E:XX:2A| |Sticker
|LAN |C4:XX:XX:6E:XX:2B| |
|Wifi (5g) |C4:XX:XX:6E:XX:2C|0x4 |
|Wifi (2.4g) |C6:XX:XX:7E:XX:2C| |
| | | |
| |C4:XX:XX:6E:XX:2E|0x8004 0xe000|
| |C4:XX:XX:6E:XX:2F|0xe006 |
The increment of the 4th byte for the 2.4g address appears to vary.
Reported cases:
5g 2.4g increment
C4:XX:XX:6E:XX:2C C6:XX:XX:7E:XX:2C 0x10
f4:XX:XX:16:XX:32 f6:XX:XX:36:XX:32 0x20
F4:XX:XX:A6:XX:E3 F6:XX:XX:B6:XX:E3 0x10
Since increment is inconsistent and there is no obvious pattern
in swapping bytes, and the 2.4g address has local bit set anyway,
it seems safer to use the LAN address with flipped byte here in
order to prevent collisions between OpenWrt devices and OEM devices
for this interface. This way we at least use an address as base
that is definitely owned by the device at hand.
Flashing instruction:
The Dlink "Emergency Room"
Connect your client computer to LAN1 of the device
Set your client IP address manually to 192.168.0.101 / 255.255.255.0.
Then, power down the router, press and hold the reset button, then
re-plug it. Keep the reset button pressed until the internet LED stops
flashing
Call the recovery page or tftp for the device at http://192.168.0.1
Use the provided emergency web GUI to upload and flash a new firmware to
the device.
Signed-off-by: Stas Fiduchi <fiduchi@protonmail.com>
[commit title/message improvements, use correct label MAC address,
calculate MAC addresses based on 0x4, minor DTS style fixes, add
uart2 to state_default, remove factory image, add 2.4g MAC address,
use partition DTSI, add macaddr comment in DTS]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Hardware
--------
MediaTek MT7621 SoC
256M DDR3
16MB BoHong SPI-NOR
MediaTek MT7905+7975 2x2T2R DBDC bgnax / acax
RGB LED
WPS + RESET Button
UART on compute module (silkscreened / 115200n8)
The router itself is just a board with Power / USB / RJ-45 connectors
and DC/DC converters. The SoC and WiFi components are on a
daughterboard which connect using two M.2 connectors.
The compute module has the model number "T-CB1800K-DM2 V02" printed on
it. The main baord has "T-MB5EU V01" printed on it. This information
might be useful, as it's highly likely either of these two will be
reused in similar designs.
The router itself is sold as Tenbay T-MB5EU directly from the OEM as
well as "KuWFI AX1800 Smart WiFi 6 Eouter" on Amazon.de for ~50€ in a
slightly different case.
Installation
------------
A Tool for creating a factory image for the Vendor Web Interface can be
found here: https://github.com/blocktrron/t-mb5eu-v01-factory-creator/
As the OEM Firmware is just a modified LEDE 17.01, you can also access
failsafe mode via UART while the OS boots, by connecting to UART
and pressing "f" when prompted. The Router is reachable at
192.168.1.1 via root without password.
Transfer the OpenWrt sysupgrade image via scp and apply with sysupgrade
using the -n and -F flags.
Alternatively, the board can be flashed by attaching to the UART
console, interrupting the boot process by keeping "0" pressed while
attaching power.
Serve the OpenWrt initramfs using a TFTP server with address
192.168.1.66. Rename the initramfs to ax1800.bin.
Attach your TFTP server to one of the LAN ports. Execute the following
commands.
$ setenv ipaddr 192.168.1.67
$ setenv serverip 192.168.1.66
$ tftpboot 0x84000000 ax1800.bin
$ bootm
Wait for the device to boot. Then transfer the OpenWrt sysupgrade image
to the device using SCP and apply sysupgrade.
Signed-off-by: David Bauer <mail@david-bauer.net>
This adds a driver for the AW9523 I2C GPIO expander.
This driver is required to make LEDs as well as buttons on the Tenbay
T-MB5EU-V01 work.
This driver already had several upstream iterations. I'm working to
push this driver to mainline.
Ref: https://patchwork.ozlabs.org/project/linux-gpio/list/?series=226287
Signed-off-by: David Bauer <mail@david-bauer.net>
The patch adds support for the TP-Link Archer C6 v3 (FCC ID TE7A6V3)
The patch adds identification changes to the existing TP-Link Archer A6,
by Vinay Patil <post2vinay@gmail.com>, which has identical hardware.
Specification
-------------
MediaTek MT7621 SOC
RAM: 128MB DDR3
SPI Flash: W25Q128 (16MB)
Ethernet: MT7530 5x 1000Base-T
WiFi 5GHz: Mediatek MT7613BE
WiFi 2.4GHz: Mediatek MT7603E
UART/Serial: 115200 8n1
Device Configuration & Serial Port Pins
---------------------------------------
ETH Ports: LAN4 LAN3 LAN2 LAN1 WAN
_______________________
| |
Serial Pins: | VCC GND TXD RXD |
|_____________________|
LEDs: Power Wifi2G Wifi5G LAN WAN
Build Output
------------
The build will generate following set of files
[1] openwrt-ramips-mt7621-tplink_archer-c6-v3-initramfs-kernel.bin
[2] openwrt-ramips-mt7621-tplink_archer-c6-v3-squashfs-factory.bin
[3] openwrt-ramips-mt7621-tplink_archer-c6-v3-squashfs-sysupgrade.bin
How to Use - Flashing from TP-Link Web Interface
------------------------------------------------
* Go to "Advanced/System Tools/Firmware Update".
* Click "Browse" and upload the OpenWrt factory image: factory.bin[2]
* Click the "Upgrade" button, and select "Yes" when prompted.
TFTP Booting
------------
Setup a TFTP boot server with address 192.168.0.5.
While starting U-boot press '4' key to stop autoboot.
Copy the initramfs-kernel.bin[1] to TFTP server folder, rename as test.bin
From u-boot command prompt run tftpboot followed by bootm.
Recovery
--------
Archer A6 V3 has recovery page activated if SPI booting from flash fails.
Recovery page can be activated by powercycling the router four times
before the boot process is complete.
Note: TFTP boot can be activated only from u-boot serial console.
Device recovery address: 192.168.0.1
Signed-off-by: Amish Vishwakarma <vishwakarma.amish@gmail.com>
[fix indent]
Signed-off-by: David Bauer <mail@david-bauer.net>
The SERCOMM NA502 is a smart home gateway manufactured by SERCOMM and sold
under different brands (among others, A1 Telekom Austria SmartHome
Gateway). It has multi-protocol radio support in addition to LAN and WiFi.
Note: BLE is currently unsupported.
Specifications
--------------
- MT7621ST 880MHz, Single-Core, Dual-Thread
- MT7603EN 2.4GHz WiFi
- MT7662EN 5GHz WiFi + BLE
- 128MiB NAND
- 256MiB DDR3 RAM
- SD3503 ZWave Controller
- EM357 Zigbee Coordinator
MAC address assignment
----------------------
LAN MAC is read from the config partition, WiFi 2.4GHz is LAN+2 and matches
the OEM firmware. WiFi 5GHz with LAN+1 is an educated guess since the
OEM firmware does not enable 5GHz WiFi.
Installation
------------
Attach serial console, then boot the initramfs image via TFTP.
Once inside OpenWrt, run sysupgrade -n with the sysupgrade file.
Attention: The device has a dual-firmware design. We overwrite kernel2,
since kernel1 contains an automatic recovery image.
If you get NAND ECC errors and are stuck with bad eraseblocks, try to
erase the mtd partition first with
mtd unlock ubi
mtd erase ubi
This should only be needed once.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
[use kiB for IMAGE_SIZE]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Specifications:
- SoC: MT7621AT
- RAM: 256MB
- Flash: 128MB NAND
- Ethernet: 5 Gigabit ports
- WiFi: 2.4G/5G MT7615N
- USB: 1 USB 3.0, 1 USB 2.0
This device is very similar to the EA7300 v1/v2 and EA7500 v2.
Installation:
Upload the generated factory image through the factory web interface.
(following part taken from EA7300 v2 commit message:)
This might fail due to the A/B nature of this device. When flashing, OEM
firmware writes over the non-booted partition. If booted from 'A',
flashing over 'B' won't work. To get around this, you should flash the
OEM image over itself. This will then boot the router from 'B' and
allow you to flash OpenWRT without problems.
Reverting to factory firmware:
Hard-reset the router three times to force it to boot from 'B.' This is
where the stock firmware resides. To remove any traces of OpenWRT from
your router simply flash the OEM image at this point.
With thanks to Leon Poon (@LeonPoon) for the initial bringup.
Signed-off-by: Tee Hao Wei <angelsl@in04.sg>
[add missing entry in 10_fix_wifi_mac]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Amped Wireless ALLY is a whole-home WiFi kit, with a router (model
ALLY-R1900K) and an Extender (model ALLY-00X19K). Both are devices are
11ac and based on MediaTek MT7621AT and MT7615N chips. The units are
nearly identical, except the Extender lacks a USB port and has a single
Ethernet port.
Specification:
- SoC: MediaTek MT7621AT (2C/4T) @ 880MHz
- RAM: 128MB DDR3 (Nanya NT5CC64M16GP-DI)
- FLASH: 128MB NAND (Winbond W29N01GVSIAA)
- WiFi: 2.4/5 GHz 4T4R
- 2.4GHz MediaTek MT7615N bgn
- 5GHz MediaTek MT7615N nac
- Switch: SoC integrated Gigabit Switch
- USB: 1x USB3 (Router only)
- BTN: Reset, WPS
- LED: single RGB
- UART: through-hole on PCB.
J1: pin1 (square pad, towards rear)=3.3V, pin2=RX,
pin3=GND, pin4=TX. Settings: 57600/8N1.
Note regarding dual system partitions
-------------------------------------
The vendor firmware and boot loader use a dual partition scheme. The boot
partition is decided by the bootImage U-boot environment variable: 0 for
the 1st partition, 1 for the 2nd.
OpenWrt does not support this scheme and will always use the first OS
partition. It will set bootImage to 0 during installation, making sure
the first partition is selected by the boot loader.
Also, because we can't be sure which partition is active to begin with, a
2-step flash process is used. We first flash an initramfs image, then
follow with a regular sysupgrade.
Installation:
Router (ALLY-R1900K)
1) Install the flashable initramfs image via the OEM web-interface.
(Alternatively, you can use the TFTP recovery method below.)
You can use WiFi or Ethernet.
The direct URL is: http://192.168.3.1/07_06_00_firmware.html
a. No login is needed, and you'll be in their setup wizard.
b. You might get a warning about not being connected to the Internet.
c. Towards the bottom of the page will be a section entitled "Or
Manually Upgrade Firmware from a File:" where you can manually choose
and upload a firmware file.
d: Click "Choose File", select the OpenWRT "initramfs" image and click
"Upload."
2) The Router will flash the OpenWrt initramfs image and reboot. After
booting, LuCI will be available on 192.168.1.1.
3) Log into LuCI as root; there is no password.
4) Optional (but recommended) is to backup the OEM firmware before
continuing; see process below.
5) Complete the Installation by flashing a full OpenWRT image. Note:
you may use the sysupgrade command line tool in lieu of the UI if
you prefer.
a. Choose System -> Backup/Flash Firmware.
b. Click "Flash Image..." under "Flash new firmware image"
c. Click "Browse..." and then select the sysupgrade file.
d. Click Upload to upload the sysupgrade file.
e. Important: uncheck "Keep settings and retain the current
configuration" for this initial installation.
f. Click "Continue" to flash the firmware.
g. The device will reboot and OpenWRT is installed.
Extender (ALLY-00X19K)
1) This device requires a TFTP recovery procedure to do an initial load
of OpenWRT. Start by configuring a computer as a TFTP client:
a. Install a TFTP client (server not necessary)
b. Configure an Ethernet interface to 192.168.1.x/24; don't use .1 or .6
c. Connect the Ethernet to the sole Ethernet port on the X19K.
2) Put the ALLY Extender in TFTP recovery mode.
a. Do this by pressing and holding the reset button on the bottom while
connecting the power.
b. As soon as the LED lights up green (roughly 2-3 seconds), release
the button.
3) Start the TFTP transfer of the Initramfs image from your setup machine.
For example, from Linux:
tftp -v -m binary 192.168.1.6 69 -c put initramfs.bin
4) The Extender will flash the OpenWrt initramfs image and reboot. After
booting, LuCI will be available on 192.168.1.1.
5) Log into LuCI as root; there is no password.
6) Optional (but recommended) is to backup the OEM firmware before
continuing; see process below.
7) Complete the Installation by flashing a full OpenWRT image. Note: you
may use the sysupgrade command line tool in lieu of the UI if you prefer.
a. Choose System -> Backup/Flash Firmware.
b. Click "Flash Image..." under "Flash new firmware image"
c. Click "Browse..." and then select the sysupgrade file.
d. Click Upload to upload the sysupgrade file.
e. Important: uncheck "Keep settings and retain the current
configuration" for this initial installation.
f. Click "Continue" to flash the firmware.
g. The device will reboot and OpenWRT is installed.
Backup the OEM Firmware:
-----------------------
There isn't any downloadable firmware for the ALLY devices on the Amped
Wireless web site. Reverting back to the OEM firmware is not possible
unless we have a backup of the original OEM firmware.
The OEM firmware may be stored on either /dev/mtd3 ("firmware") or
/dev/mtd6 ("oem"). We can't be sure which was overwritten with the
initramfs image, so backup both partitions to be safe.
1) Once logged into LuCI, navigate to System -> Backup/Flash Firmware.
2) Under "Save mtdblock contents," first select "firmware" and click
"Save mtdblock" to download the image.
3) Repeat the process, but select "oem" from the pull-down menu.
Revert to the OEM Firmware:
--------------------------
* U-boot TFTP:
Follow the TFTP recovery steps for the Extender, and use the
backup image.
* OpenWrt "Flash Firmware" interface:
Upload the backup image and select "Force update"
before continuing.
Signed-off-by: Jonathan Sturges <jsturges@redhat.com>
