Commit Graph

191 Commits

Author SHA1 Message Date
Emir Efe Kucuk
53a1fede1f ramips: Add support for Xiaomi Mi Router(Black,R2100)
The Xiaomi Mi Router AC2100 is a *black* cylindrical router that shares many
characteristics (apart from its looks and the GPIO ports) with the 6-antenna
*white* "Xiaomi Redmi Router AC2100"

See the visual comparison of the two routers here:
https://github.com/emirefek/openwrt-R2100/raw/imgcdn/rm2100-r2100.jpg

Specification of R2100:
- CPU: MediaTek MT7621A
- RAM: 128 MB DDR3
- FLASH: 128 MB ESMT NAND
- WIFI: 2x2 802.11bgn (MT7603)
- WIFI: 4x4 802.11ac (MT7615)
- ETH: 3xLAN+1xWAN 1000base-T
- LED: Power, WAN in Yellow and Blue
- UART: On board (Don't know where is should be confirmed by anybody else)
- Modified u-boot

Hacking of official firmware process is same at both RM2100 and R2100.
Thanks to @namidairo

Here is the detailed guide Hack: https://github.com/impulse/ac2100-openwrt-guide
Guide is written for MacOS but it will work at linux.
needed packages: python3(with scapy), netcat, http server, telnet client

1. Run PPPoE&exploit to get nc and wget busybox, get telnet and wget firmware
2. mtd write openwrt-ramips-mt7621-xiaomi_mi-router-ac2100-kernel1.bin kernel1
3. nvram set uart_en=1
4. nvram set bootdelay=5
5. nvram set flag_try_sys1_failed=1
6. nvram commit
7. mtd -r write openwrt-ramips-mt7621-xiaomi_mi-router-ac2100-rootfs0.bin rootfs0

other than these I specified in here. Everything is same with:
f3792690c4
Thanks for all community and especially for this device:
@Ilyas @scp07 @namidairo @Percy @thorsten97 @impulse (names@forum.openwrt.com)

MAC Locations:
WAN *:b5 = factory 0xe006
LAN *:b6 = factory 0xe000
WIFI 5ghz *:b8 = factory 0x8004
WIFI 2.4ghz *:b7 = factory 0x0004

Signed-off-by: Emir Efe Kucuk <emirefek@gmail.com>
[refactored common image bits into Device/xiaomi-ac2100, fixed From:]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2020-07-08 16:07:05 +02:00
Davide Fioravanti
8c13ebd3ad ramips: add support for Edimax Gemini RE23S
Hardware
--------
SoC:   Mediatek MT7621AT (880 MHz, 2 cores 4 threads)
RAM:   128MB
FLASH: 16MB NOR (Macronix MX25L12805D)
ETH:   1x 10/100/1000 Mbps Ethernet (MT7530)
WIFI:
  - 2.4GHz: 1x MT7615 (4x4:4)
  - 5GHz:   1x MT7615 (4x4:4)
  - 4 antennas: 2 external detachable and 2 internal
BTN:
  - 1x Reset button
  - 1x WPS button
LEDS:
  - 1x Green led (Power)
  - 1x Green-Amber-Red led (Wifi)
UART:
  - 57600-8-N-1

Everything works correctly.

Installation
------------
Flash the factory image directly from OEM web interface.
(You can login using these credentials: admin/1234)

Restore OEM Firmware
--------------------
Flash the OEM "bin" firmware directly from LUCI.
The firmware is downloadable from the OEM web page.
Warning: Remember to not keep settings!
Warning2: Remember to force the flash.

Restoring procedure tested with RE23_1.08.bin

MAC addresses
-------------
factory 0x4     *:24
factory 0x8004  *:25
Cimage  0x07    *:24
Cimage  0x0D    *:24
Cimage  0x13    *:24
Cimage  0x19    *:25

No other addresses were found in factory partition.

Since the label contains both the 2.4GHz and 5GHz mac address I decided
to set the 5GHz one as label-mac-device. Moreover it also corresponds
to the lan mac address.

Notes
-----
The wifi led in the OEM firmware changes colour depending on the signal
strength. This can be done in OpenWrt but just for one interface.
So for now will not be any default action for this led.

If you want to open the case, pay attention to the antenna placed on
the bottom part of the front cover.
The wire is a bit short and it breaks easily. (I broke it)

Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
[fix two typos and add extended MAC address section to commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-08 13:28:17 +02:00
Christoph Krapp
ba0f4f0cfd ramips: add support for TP-Link RE500 v1
This device uses the same hardware as RE650 v1 which got supported in
8c51dde.

Hardware specification:

- SoC 880 MHz - MediaTek MT7621AT
- 128 MB of DDR3 RAM
- 16 MB - Winbond 25Q128FVSG
- 4T4R 2.4 GHz - MediaTek MT7615E
- 4T4R 5 GHz - MediaTek MT7615E
- 1x 1 Gbps Ethernet - MT7621AT integrated
- 7x LEDs (Power, 2G, 5G, WPS(x2), Lan(x2))
- 4x buttons (Reset, Power, WPS, LED)
- UART header (J1) - 2:GND, 3:RX, 4:TX
  Serial console @ 57600,8n1

Flash instructions:

Upload
openwrt-ramips-mt7621-tplink_re500-v1-squashfs-factory.bin
from the RE500 web interface.

TFTP recovery to stock firmware:

Unfortunately, I can't find an easy way to recover the RE
without opening the device and using modified binaries. The
TFTP upload will only work if selected from u-boot, which
means you have to open the device and attach to the serial
console. The TFTP update procedure does *not* accept the
published vendor firmware binaries. However, it allows to
flash kernel + rootfs binaries, and this works if you have
a backup of the original contents of the flash. It's probably
possible to create special image out of the vendor binaries
and use that as recovery image.

Signed-off-by: Christoph Krapp <achterin@googlemail.com>
[remove dts-v1 in DTSI, do not touch WiFi LEDs for RE650, keep
state_default in DTS files, fix label-mac-device, use lower case
for WiFi LEDs]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-07 00:40:04 +02:00
Jan Hoffmann
b1d5ab1a69 ramips: add support for NETGEAR WAC124
The WAC124 hardware appears to be identical to R6260/R6350/R6850.

SoC:   MediaTek MT7621AT
RAM:   128M DDR3
FLASH: 128M NAND (Macronix MX30LF1G18AC)
WiFI:  MediaTek MT7603 bgn 2T2R
       MediaTek MT7615 nac 4T4R
ETH:   SoC Integrated Gigabit Switch (1x WAN, 4x LAN)
USB:   1x USB 2.0
BTN:   Reset, WPS
LED:   Power, Internet, WiFi, USB (all green)

Installation:
The factory image can be flashed from the stock firmware web interface
or using nmrpflash. With nmrpflash it is also possible to revert to
stock firmware.

Signed-off-by: Jan Hoffmann <jan@3e8.eu>
2020-06-27 00:33:29 +02:00
INAGAKI Hiroshi
3a8d65010d ramips: add support for ELECOM WRC-2533GST2
ELECOM WRC-2533GST2 is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based
on MT7621A.

Specification:

- SoC		: MediaTek MT7621A
- RAM		: DDR3 256 MiB
- Flash		: SPI-NOR 32 MiB
- WLAN		: 2.4/5 GHz 4T4R (2x MediaTek MT7615)
- Ethernet	: 10/100/1000 Mbps x5
  - Switch	: MediaTek MT7530 (SoC)
- LED/keys	: 4x/6x (2x buttons, 1x slide-switch)
- UART		: through-hole on PCB
  - J4: 3.3V, GND, TX, RX from ethernet port side
  - 57600n8
- Power		: 12VDC, 1.5A

Flash instruction using factory image:

1. Boot WRC-2533GST2 normally
2. Access to "http://192.168.2.1/" and open firmware update page
   ("ファームウェア更新")
3. Select the OpenWrt factory image and click apply ("適用") button
4. Wait ~150 seconds to complete flashing

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2020-06-21 20:56:42 +02:00
INAGAKI Hiroshi
39f2f9b1bf ramips: add MT7615 wireless support for ELECOM WRC-GST devices
ELECOM WRC-1900GST and WRC-2533GST have two MT7615 chips for 2.4/5 GHz
wireless.

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
[WRC-1900GST]
Acked-by: NOGUCHI Hiroshi <drvlabo@gmail.com>
2020-06-21 20:52:30 +02:00
Pawel Dembicki
221d8a1c60 ramips: mt7621: add support for NETGEAR WAC104
NETGEAR WAC104 is an AP based on castrated R6220, without WAN
port and USB.

SoC: MediaTek MT7621ST
RAM: 128M DDR3
FLASH: 128M NAND
WiFi: MediaTek MT7612EN an+ac
MediaTek MT7603EN bgn
ETH: MediaTek MT7621ST (4x LAN)
BTN: 1x Connect (WPS), 1x WLAN, 1x Reset
LED: 7x (3x GPIO controlled)

Installation:

Login to netgear webinterface and flash factory.img

Back to stock:

Use nmrpflash to revert stock image.

Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
2020-06-12 14:13:32 +02:00
Felix Fietkau
81b59efefd ramips/mediatek: select kmod-mt7615-firmware where kmod-mt7615e is selected
The new mt76 version splits out the firmware, because the driver can also be
used for MT7663/MT7613

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-06-04 21:52:57 +02:00
INAGAKI Hiroshi
7b01567976 ramips: add alternative name for Buffalo WSR-2533DHP
Buffalo WSR-2533DHP is identical to the WSR-2533DHPL, Buffalo sold it
with renaming.

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2020-05-24 18:14:59 +02:00
Richard Huynh
f3792690c4 ramips: Add support for Xiaomi Redmi Router AC2100 (RM2100)
Specification:
- CPU: MediaTek MT7621A
- RAM: 128 MB DDR3
- FLASH: 128 MB ESMT NAND
- WIFI: 2x2 802.11bgn (MT7603)
- WIFI: 4x4 802.11ac (MT7615)
- ETH: 3xLAN+1xWAN 1000base-T
- LED: Power, WAN, in Amber and White
- UART: On board near ethernet, opposite side from power
- Modified u-boot

Installation:

1. Run linked exploit to get shell, startup telnet and wget the files over
2. mtd write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-kernel1.bin kernel1
3. nvram set uart_en=1
4. nvram set bootdelay=5
5. nvram set flag_try_sys1_failed=1
6. nvram commit
7. mtd -r write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-rootfs0.bin rootfs0

Restore to stock:

1. Setup PXE and TFTP server serving stock firmware image
(See dhcp-boot option of dnsmasq)
2. Hold reset button down before powering on and wait for flashing amber led
3. Release reset button
4. Wait until status led changes from flashing amber to white

Notes:
This device has dual kernel and rootfs slots like other Xiaomi devices currently
supported (mir3g, etc.) thus, we use the second slot and overwrite the first
rootfs onwards in order to get more space.

Exploit and detailed instructions:

https://openwrt.org/toh/xiaomi/xiaomi_redmi_router_ac2100

An implementation of CVE-2020-8597 against stock firmware version 1.0.14

This requires a computer with ethernet plugged into the wan port and an active
PPPoE session, and if successful will open a reverse shell to 192.168.31.177
on port 31337.

As this shell is somewhat unreliable and likely to be killed in a random amount
of time, it is recommended to wget a static compiled busybox binary onto the
device and start telnetd with it.

The stock telnetd and dropbear unfortunately appear inoperable.
(Disabled on release versions of stock firmware likely)
Ie. wget https://yourip/busybox-mipsel -O /tmp/busybox
chmod a+x /tmp/busybox
/tmp/busybox telnetd -l /bin/sh

Tested-by: David Martinez <bonkilla@gmail.com>
Signed-off-by: Richard Huynh <voxlympha@gmail.com>
2020-05-20 15:26:22 +02:00
INAGAKI Hiroshi
0a05d71f6f ramips: fix initramfs image for I-O DATA mt7621 devices
This is additional fix of c998ae7f0e.

The sysupgrade image of I-O DATA MT7621 devices manufactured by MSTC
(MitraStar Technology Corp.) faced to the booting issue. This was caused
by imcomplete extraction of large kernel image by U-Boot, and this issue
is occurred in initramfs image after fixing of sysupgrade image.
So, use lzma-loader for initramfs image to fix the issue.

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Co-developed-by: Yanase Yuki <dev@zpc.sakura.ne.jp>
Signed-off-by: Yanase Yuki <dev@zpc.sakura.ne.jp>
Tested-by: Yanase Yuki <dev@zpc.sakura.ne.jp> [wn-ax2033gr]
2020-05-19 19:03:07 +08:00
Fabian Bläse
33b2078528 mt7621: Make ER-X-SFP factory image compatible with EP-R6
The version inside the compat file determines, if a firmware supports
a specific device. I have not yet fully understood, how this is checked,
but it only seems to indicate which devices are supported by a specific
version of the combined vendor firmware. Devices assume that subsequent
versions, starting with the version that initially added support for a
specific device, are always compatible.

The first compat version that added support for the EP-R6 was '21001:7',
but OpenWrt did use '21001:6' before. This is why the factory image could
not be flashed using the vendor software, but only using TFTP.

The compat version has been bumped by the vendor a few times, but more
devices have been added since (e.g. ER-10X). Because OpenWrt currently
only supports the ER-X, ER-X-SFP and EP-R6, the compat version is
incremented to the version that first supported the EP-R6, which is
'21001:7'.

This allows the factory image to be flashed on EP-R6 without TFTP.

Signed-off-by: Fabian Bläse <fabian@blaese.de>
2020-05-18 21:11:47 +02:00
Davide Fioravanti
31b49f02ca ramips: add support for Linksys EA7500 v2
The Linksys EA7500 v2 is advertised as AC1900, but its internal
hardware is AC2600 capable.

Hardware
--------
SoC:   Mediatek MT7621AT (880 MHz, 2 cores 4 threads)
RAM:   256M (Nanya NT5CC128M16IP-DI)
FLASH: 128MB NAND (Macronix MX30LF1G18AC-TI)
ETH:   5x 10/100/1000 Mbps Ethernet (MT7530)
WIFI:
  - 2.4GHz: 1x MT7615N (4x4:4)
  - 5GHz:   1x MT7615N (4x4:4)
  - 4 antennas: 3 external detachable antennas and 1 internal
USB:
  - 1x USB 3.0
  - 1x USB 2.0
BTN:
  - 1x Reset button
  - 1x WPS button
LEDS:
  - 1x White led (Power)
  - 6x Green leds (link lan1-lan4, link wan, wps)
  - 5x Orange leds (act lan1-lan4, act wan) (working but unmodifiable)

Everything works correctly.

Installation
------------
The “factory” openwrt image can be flashed directly from OEM stock
firmware. After the flash the router will reboot automatically.

However, due to the dual boot system, the first installation could fail
(if you want to know why, read the footnotes).
If the flash succeed and you can reach OpenWrt through the web
interface or ssh, you are done.
Otherwise the router will try to boot 3 times and then will
automatically boot the OEM firmware (don’t turn off the router.
Simply wait and try to reach the router through the web interface
every now and then, it will take few minutes).

After this, you should be back in the OEM firmware.

Now you have to flash the OEM Firmware over itself using the OEM web
interface (I tested it using the FW_EA7500v2_2.0.8.194281_prod.img
downloaded from the Linksys website).

When the router reboots flash the “factory” OpenWrt image and this
time it should work.

After the OpenWrt installation you have to use the sysupgrade image
for future updates.

Restore OEM Firmware
--------------------
After the OpenWrt flash, the OEM firmware is still stored in the
second partition thanks to the dual boot system.
You can switch from OpenWrt to OEM firmware and vice-versa failing
the boot 3 times in a row:
 1) power on the router
 2) wait 15 seconds
 3) power off the router
 4) repeat steps 1-2-3 twice more.
 5) power on the router and you should be in the “other” firmware

If you want to completely remove OpenWrt from your router, switch to
the OEM firmware and then flash OEM firmware from the web interface
as a normal update.
This procedure will overwrite the OpenWrt partition.

Footnotes
---------
The Linksys EA7500-v2 has a dual boot system to avoid bricks.
This system works using 2 pair of partitions:
 1) "kernel" and "rootfs"
 2) "alt_kernel" and "alt_rootfs".
After 3 failed boot attempts, the bootloader tries to boot the other
pair of partitions and so on.

This system is managed by the bootloader, which writes a bootcount in
the s_env partition, and if successfully booted, the system add a
"zero-bootcount" after the previous value.

A system update performed from OEM firmware, writes the firmware on the
other pair of partitions and sets the bootloader to boot the new pair
of partitions editing the “boot_part” variable in the bootloader vars.
Effectively it's a quick and safe system to switch the selected boot
partition.

Another way to switch the boot partition is:
 1) power on the router
 2) wait 15 seconds
 3) power off the router
 4) repeat steps 1-2-3 twice more.
 5) power on the router and you should be in the “other” firmware

In this OpenWrt port, this dual boot system is partially working
because the bootloader sets the right rootfs partition in the cmdline
but unfortunately OpenWrt for ramips platform overwrites the cmdline
so is not possible to detect the right rootfs partition.

Because all of this, I preferred to simply use the first pair of
partitions and set read-only the other pair.

However this solution is not optimal because is not possible to know
without opening the case which is the current booted partition.
Let’s take for example a router booting the OEM firmware from the first
pair of partitions. If we flash the OpenWrt image, it will be written
on the second pair. In this situation the router will bootloop 3 times
and then will automatically come back to the first pair of partitions
containg the OEM firmware.
In this situation, to flash OpenWrt correctly is necessary to switch
the booting partition, flashing again the OEM firmware over itself.
At this point the OEM firmware is on both pair of partitions but the
current booted pair is the second one.
Now, flashing the OpenWrt factory image will write the firmware on
the first pair and then will boot correctly.

If this limitation in the ramips platform about the cmdline will be
fixed, the dual boot system can also be implemented in OpenWrt with
almost no effort.

Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
Co-Developed-by: Jackson Lim <jackcolentern@gmail.com>
Signed-off-by: Jackson Lim <jackcolentern@gmail.com>
2020-05-17 18:44:28 +02:00
Sungbo Eo
a4e9c8f14b ramips: add support for netis WF2770
netis WF2770 is a 2.4/5GHz band AC750 router, based on MediaTek MT7620A.

Specifications:
- SoC: MT7620A
- RAM: DDR2 64MB
- Flash: SPI NOR 16MB
- WiFi:
  - 2.4GHz: SoC internal
  - 5GHz: MT7610EN
- Ethernet: 5x 10/100/1000Mbps
  - Switch: MT7530BU
- UART:
  - J2: 3.3V, RX, TX, GND (3.3V is the square pad) / 57600 8N1

MAC addresses in factory partition:
0x0004: LAN, WiFi 2.4GHz (label_mac-6)
0x0028: not used (label_mac-1)
0x002e: WAN (label_mac)
0x8004: WiFi 5GHz (label_mac+2)

Installation via web interface:
1.  Flash **initramfs** image through the stock web interface.
2.  Boot into OpenWrt and perform sysupgrade with sysupgrade image.

Revert to stock firmware:
1.  Perform sysupgrade with stock image.

Reviewed-by: Pawel Dembicki <paweldembicki@gmail.com>
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
2020-05-17 18:41:48 +02:00
Sungbo Eo
a5720d3276 ramips: tidy up image subtarget Makefiles
- use tab indent in image build recipes for consistency
- harmonize line wrapping

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
[use different line wrapping for one recipe]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-05-08 18:58:39 +02:00
Adrian Schmutzler
1553f58a98 ramips: create common definition for I-O DATA NAND devices
Three of the I-O DATA devices with NAND flash share a lot of
variables. Create a common definition for them to reduce duplicate
code.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-04-27 22:37:23 +02:00
INAGAKI Hiroshi
c998ae7f0e ramips: use lzma-loader for I-O DATA mt7621 devices
The official sysupgrade images for I-O DATA devices manufactured by
MSTC (MitraStar Technology Corp.) cannot be booted normally and the
kernel panics after switching to kernel 5.4.

This commit fixes the issue by using lzma-loader.

Note:
  These devices use Z-LOADER to read the kernel from NAND flash and boot
  it. Z-LOADER cannot load and start plain lzma-loader, so additional
  lzma-compression is needed.

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Co-developed-by: Yanase Yuki <dev@zpc.sakura.ne.jp>
Signed-off-by: Yanase Yuki <dev@zpc.sakura.ne.jp>
Tested-by: Yanase Yuki <dev@zpc.sakura.ne.jp> [wn-ax2033gr]
2020-04-27 12:22:02 +02:00
INAGAKI Hiroshi
a25bb8610f ramips: use lzma-loader for Japanese mt7621 devices
In several Japanese routers with MT7621 SoC, the official sysupgrade
image cannot be booted properly after switching to kernel 5.4.

This commit fixes the issue by using lzma-loader.

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2020-04-27 12:22:02 +02:00
Szabolcs Hubai
ce19571004 ramips: mt7621: use lzma-loader for D-Link DIR-860L B1
This device has trouble extracting big kernel from flash,
and supports LZMA compressed kernels only.

Using OpenWrt kernel loader saves us 64 KB compared to the dictionary
size limiting workaround.

Factory image sizes (commit: 5f126c541a) with "CONFIG_ALL_KMODS=y":
- original ("-d23", default): 4784188 bytes, LZMA ERROR 1
- with "-d19": 4915260, LZMA ERROR 1
- with "-d18": 4915260, diff to original: +128 KB
- with "-d17": 4980796, diff to original: +192 KB
- with this patch: 4849724, diff to original: +64 KB

To save some CPU cycle, use minimal compression ("-a0") for the LZMA
compressed uImage.

The most robust solution would use a different loader,
which reads the compressed kernel directly from the flash.
See the thread at [0] for more details!

[0] http://lists.infradead.org/pipermail/openwrt-devel/2020-April/022926.html

Signed-off-by: Szabolcs Hubai <szab.hu@gmail.com>
Tested-by: Stijn Segers <foss@volatilesystems.org>
[fixed identation]
Signed-off-by: David Bauer <mail@david-bauer.net>
2020-04-27 12:22:02 +02:00
René van Dorst
ec2f7a47d3 kernel: add module to support SFP cages
Enables kernel SFP case support.

Signed-off-by: René van Dorst <opensource@vdorst.com>
2020-04-25 23:45:16 +02:00
Pawel Dembicki
08f5cac6fb ramips: mt7621: add NETGEAR R7200 as DEVICE_ALT1
Netgear R7200 is another clone of Netgear R6700v2, introduced in:
6e80df5 ("ramips: add support for NETGEAR R6700v2/AC2400")

Reported-by: Joel Pinsker, github user @joelp64
Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
2020-04-20 11:13:39 +01:00
Chuanhong Guo
19d9db5a96 ramips: mt7621: use lzma-loader for newifi d1/d2/thunder timecloud
These devices failed to properly extract kernel. enable lzma loader
for them.

Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
2020-04-18 14:19:38 +08:00
DENG Qingfang
7dc82528a2 ramips: increase HiWiFi HC5962 kernel partition to 4M
Increase kernel partition because 2M is insufficient for 5.4
Because the partition changes, previous version of OpenWrt cannot upgrade
to this version, and requires a new installation

Recovery to stock instruction:
1. Download stock firmware at
   http://ur.ikcd.net/HC5962-sysupgrade-20171221-b00a04d1.bin
2. Power off the router
3. Press and hold the reset button for 4~6 sec while power it back on
4. Connect a PC to router's LAN
5. Visit http://192.168.2.1 and upload the firmware

Then repeat the instruction in edae3479e6 to install OpenWrt

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
2020-04-18 11:50:57 +08:00
Chuanhong Guo
ad19751edc ramips: mt7621: enable lzma-loader for some devices
ubnt er-x/xiaomi/netgear sercomm devices are known to have troble
extracting a big kernel from flash and has support for uncompressed
uimage
This commit uses uncompressed uimage with lzma-loader for these devices
to fix boot issue.

Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
2020-04-15 10:14:19 +08:00
Chuanhong Guo
d9e9a0e6b1 ramips: define lzma loader platform in target
Loader platform is a per-soc variable instead of a per-device one.
Determine corresponding loader platform at the beginning of image
Makefile.

Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
2020-04-14 11:17:47 +08:00
Adrian Schmutzler
e8931b309f ramips: mt7621: tidy up names for Ubiquiti devices
The "proper" vendor prefix for Ubiquiti is "ubnt", this is used in
all targets except ramips and also recommended by the kernel.

This patch adjusts the various board/image/device name variables
accordingly. Since we touch it anyway, this also adds the space
in "EdgeRouter X" as a hyphen to those variables to really make
them consistent with the model name.

While at it, create a real shared definition for the devices in
image/mt7621.mk instead of deriving one device from another.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-04-12 13:25:42 +02:00
Yanase Yuki
e66becb490 ramips: add support for I-O DATA WN-AX2033GR
I-O DATA WN-AX2033GR is roughly the same as I-O DATA
WN-AX1167GR2. The difference is Wi-Fi feature.

Specification
=============
- SoC: MediaTek MT7621A
- RAM: DDR3 128 MiB
- Flash Memory: NAND 128 MiB (Spansion S34ML01G200TF100)
- Wi-Fi: MediaTek MT7603E
- Wi-Fi: MediaTek MT7615
- Ethernet: 5x 10 Mbps / 100 Mbps / 1000 Mbps (1x WAN, 4x LAN)
- LED: 2x green LED
- Input: 2x tactile switch, 1x slide switch
- Serial console: 57600bps, PCB through hole J5 (Vcc, TX, RX, NC, GND)
- Power: DC 12V

This device only supports channel 1-13 and 36-140.
Thus, narrower frequency limits compared to other devices are required
for limiting wi-fi frequency correctly.
Without this, non-supported frequencies are activated.

Flash instructions
==================
1. Open the router management page (192.168.0.1).
2. Update router firmware using "initramfs-kernel.bin".
3. After updating, run sysupgrade with "sysupgrade.bin".

Recovery instructions
=====================
WN-AX2033GR contains Zyxel Z-LOADER
1. Setup TFTP server (IP address: 10.10.10.3).
2. Put official firmware into TFTP server directory (distribution site:
   https://www.iodata.jp/lib/software/w/2068.htm)
3. Connect WX-AX2033GR Ethernet port and computer that runs TFTP server.
4. Connect to serial console.
5. Interrupt booting by Esc key.
6. Flash firmware using "ATNR 1,[firmware filename]" command.

Signed-off-by: Yanase Yuki <dev@zpc.sakura.ne.jp>
[adjust for kernel 5.4, add recovery instructions/frequency comment]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-04-12 00:43:09 +02:00
Adrian Schmutzler
f761f4052c ramips: mt7621: harmonize naming scheme for Mikrotik
So far, image/device/board names for Mikrotik devices in mt7621 have
been used quite inconsistently.

This patch harmonizes the naming scheme by applying the same style
as used lately in ath79, i.e. using "RouterBOARD" as separate word
in the model name (instead of RB prefix for the number) and deriving
the board/device name from that (= make lower case and replace spaces
by hyphens).

This style has already been used for most the model/DEVICE_MODEL
variables in mt7621, so this is essentially just adjusting the remaining
variables to that.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-04-08 13:46:30 +02:00
Tobias Schramm
48b4aab80c ramips: mt7621: reenable rbm11g
I have a rbm11g and can confirm that the LAN port is indeed
switch port 0.

Signed-off-by: Tobias Schramm <t.schramm@manjaro.org>
2020-04-08 13:42:58 +02:00
INAGAKI Hiroshi
e8787291b3 ramips: add support for Buffalo WSR-2533DHPL
Buffalo WSR-2533DHPL is a 2.4/5 GHz band 11ac router, based on MediaTek
MT7621A.

Specification:

- SoC		: MediaTek MT7621A
- RAM		: DDR3 128 MiB
- Flash		: SPI-NOR 16 MiB
- WLAN		: 2.4/5 GHz 4T4R (2x MediaTek MT7615N)
- Ethernet	: 10/100/1000 Mbps
  - Switch	: MediaTek MT7530 (SoC)
- LED/keys	: 8x/6x (3x buttons, 2x slide-switches)
- UART		: through-hole on PCB
  - J4: 3.3V, GND, TX, RX from triangle-mark
  - 57600n8
- Power		: 12VDC 1.5A

Flash instruction using initramfs image:

1. prepare the TFTP server with the initramfs image renamed to
   "linux.trx-recovery" and IP address "192.168.11.2"
2. press the "AOSS" button while powering on the WSR-2533DHPL
3. after 10 seconds, release the "AOSS" button, WSR-2533DHPL downloads
   the initramfs image and boot with it automatically
4. on the initramfs image, download the sysupgrade image to the device
   and perform sysupgrade with it
5. wait ~120 seconds to complete flashing

Switch position overview:

- slide-switch1 (2x positions)
  - "AUTO"
  - "MANUAL" (not connected to gpio)

- slide-switch2 (3x positions)
  - "ROUTER"
  - "AP" (not connected to gpio)
  - "WB"

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
[add note on switches, fix group->groups for state_default]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-04-07 17:04:18 +02:00
Chuanhong Guo
838f1fbb50 ramips: mt7621: disable image for mikrotik_rbm11g
It's unknown which switch port is used on mikrotik_rbm11g.
Disable this image until someone with actual device fixes this problem.

Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
2020-04-04 15:25:36 +08:00
DENG Qingfang
437aaae6ca Revert "ramips: mt7621: disable images for gehua_ghl-r-001"
This reverts commit 28080d54d2.
Support for MX25L25635F flash is fixed upstream

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
2020-04-04 14:56:14 +08:00
DENG Qingfang
53b66248f4 ramips: use SoC I2C instead of bitbanged for Ubiquiti ER-X-SFP
The original idea of bitbanged I2C is to use i2c-gpio-custom
Since i2c-gpio-custom is no longer available on 5.4, use SoC I2C instead

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
2020-04-04 14:56:14 +08:00
Sungbo Eo
3f14f034fb treewide: omit IMAGE_SIZE argument from check-size
Now that check-size uses IMAGE_SIZE by default, we can skip the argument from
image recipes to reduce redundancy.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
[do not touch ar71xx]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-03-21 20:02:55 +01:00
Sungbo Eo
5b392c7119 treewide: gather DEVICE_VARS into one place
Place DEVICE_VARS assignments at the top of the file or above Device/Default
to make them easier to find.

For ramips, remove redundant values already present in parent file.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
[do not touch ar71xx, extend commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-03-21 19:55:12 +01:00
Sungbo Eo
228bb84744 kernel: make kmod-ata-core selected by dependent modules
Currently kmod-ata-* will not get into images unless kmod-ata-core is added to
DEVICE_PACKAGES as well. By changing the dependencies from "depends on" to
"select", we do not have the issue anymore.

Furthermore, we can remove most occurrences of the package from DEVICE_PACKAGES
and similar variables, as it is now pulled by dependent modules such as:
- kmod-ata-ahci
- kmod-ata-ahci-mtk
- kmod-ata-sunxi

While at it, use AddDepends/ata for kmod-ata-pdc202xx-old.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
2020-03-11 19:40:03 +01:00
David Bauer
4c8446bf39 ramips: add support for Ubiquiti UniFi nanoHD
Hardware
--------
SoC:   MediaTek MT7621AT
WiFi:  MediaTek MT7603 bgn 2T2R
       MediaTek MT7615 ac  4T4R
Flash: 32M SPI (Macronix MX25L25635F)
RAM:   128M DDR3 (Winbond W631GG6KB)
LED:   Dome (Blue / White)
BTN:   Reset

Installation
------------

These instructions were written for firmware version v3.9.27.
Downgrade if necessary.

1. Copy the OpenWrt sysupgrade image to the devices /tmp folder
   via scp. On factory defaults, user and password is "ubnt" at
   192.168.1.20/24.

2. Write the bootselect flag. Otherwise, the device might boot from the
   wrong partition. Verify the mtd partition used in the command below
   is the one labled "bs" in /proc/mtd (as this might change in the
   future).

   > dd if=/dev/zero bs=1 count=1 of=/dev/mtd4

3. Write the OpenWrt sysupgrade to the mtd partitions labled
   "kernel0" and "kernel1".

   > dd if=/tmp/openwrt-sysupgrade.bin of=/dev/mtdblock6
   > dd if=/tmp/openwrt-sysupgrade.bin of=/dev/mtdblock7

4. Reboot or powercycle the device.

Signed-off-by: David Bauer <mail@david-bauer.net>
2020-03-10 21:54:46 +01:00
Adrian Schmutzler
6e80df5e33 ramips: add support for NETGEAR R6700v2/AC2400
SoC: MediaTek MT7621AT
RAM: 256M DDR3
FLASH: 128M NAND
WiFi: MediaTek MT7615N an+ac
MediaTek MT7615N bgn
ETH: MediaTek MT7621AT
BTN: 1x Connect (WPS), 1x WLAN, 1x Reset
LED: Power (white/amber), WAN(white/amber), 2.4G(white), 5G(white),
USB(white) , GuestWifi(white) 4x LAN(white/amber), Wifi Button(white),
WPS Button(white)

Installation:

Login to netgear webinterface and flash factory.img

Based on a discontinued GitHub Pull Request by
kuyokushin <codenamezero@protonmail.com>

https://github.com/openwrt/openwrt/pull/2545

NOTE: Netgear R6700 v2 have five clones: R6900 v2, R7450, Nighthawk
AC2400, Nighthawk AC2100 and already added R6800. Rest of them  should
be really easy supportable. Image for R6700v2 should work perfectly with
them. Please refer:

https://github.com/openwrt/openwrt/pull/2614

Tested-by: Víctor Gibrán <victorgibranmz@hotmail.com> [R6700v2]
Tested-by: John Landrum <jl31m10@yahoo.com> [AC2400]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
[add guest led to mt7621_netgear_r6700-v2.dts end edit commit message]
Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
2020-03-04 23:02:46 +01:00
Pawel Dembicki
4e9317201d ramips: mt7621: add support for Netgear R6800
This patch adds support for the Netgear R6800, aka Netgear AC1900 and
R6800-100PES.

Specification:
- SoC: MediaTek MT7621AT (880 MHz)
- Flash: 128 MiB NAND
- RAM: 256 MiB
- Wireless: MediaTek MT7615EN b/g/n , MediaTek MT7615EN an+ac
- LAN speed: 10/100/1000
- LAN ports: 4
- WAN speed: 10/100/1000
- WAN ports: 1
- USB 2.0
- USB 3.0
- Serial baud rate of Bootloader and factory firmware: 57600

Known issues:
- Device has 3 wifi LEDs: Wifi 5Ghz, Wifi 2.4Ghz and Wifi on/off.
  Wifi on/off is not used.

Installation:
- apply factory image via stock web-gui.

Back to stock:
- nmrpflash can be used to recover to the stock Netgear firmware.

Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
2020-03-04 23:02:46 +01:00
Sungbo Eo
be3e98ce26 ramips: append tail to WF2881 initramfs image
Stock firmware has a vendor-defined tail at the end of uImage for image
validation. This patch enables OpenWrt installation from stock firmware
without having to access the UART console.

Installation via web interface:
1.  Flash **initramfs** image through the stock web interface.
2.  Boot into OpenWrt and perform sysupgrade with sysupgrade image.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
2020-02-11 15:13:52 +01:00
Sungbo Eo
cc89c5fe27 ramips: fix device name of netis WF-2881 to WF2881
The correct model name of WF-2881 is WF2881 without hyphen. The former used
boardnames are not added to SUPPORTED_DEVICES, to make it explicit that the
sysupgrade-tar image, which is newly added in the previous commit, should
not be used to upgrade from older version.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
[adjust commit title]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-02-07 14:33:17 +01:00
Sungbo Eo
e030d162f7 ramips: use nand_do_upgrade for netis WF-2881
WF-2881 sysupgrade image uses UBI rootfs, but still relies on
default_do_upgrade. Because of this, config backup is not restored after
sysupgrade. It can be fixed by switching to nand_do_upgrade and
sysupgrade-tar image. default_do_upgrade does not handle sysupgrade-tar
properly, so one should use factory image to upgrade from older version.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
2020-02-07 14:28:50 +01:00
INAGAKI Hiroshi
867db0a283 ramips: add support for I-O DATA WN-AX1167GR2
I-O DATA WN-AX1167GR2 is a 2.4/5 GHz band 11ac router, based on MediaTek
MT7621A.

Specification:

- SoC		: MediaTek MT7621A
- RAM		: DDR3 128 MiB
- Flash		: NAND 128 MiB
- WLAN		: MediaTek MT7615D (2.4/5 GHz, 2T2R)
- Ethernet	: 5x 10/100/1000 Mbps
  - Switch	: MediaTek MT7621A (MT7530)
- LEDs/Input	: 2x/3x (2x buttons, 1x slide-switch)
- UART		: through-hole on PCB
  - J5: Vcc, TX, RX, NC, GND
  - 57600 bps

Flash instruction using initramfs image:

1. Boot WN-AX1167GR2 normally
2. Access to "http://192.168.0.1/" and open firmware update page
("ファームウェア")
3. Select the OpenWrt initramfs image and click update ("更新")
button to perform firmware update
4. On the initramfs image, perform sysupgrade with squashfs-sysupgrade
image
5. Wait ~120 seconds to complete flashing

Notes:

- configuration in DeviceTree of DBDC (Dual-Band-Dual-Concurrent) mode
for MT7615D chip is not supported in mt76 driver
- last 0x80000 (512 KiB) in NAND flash is not used on stock firmware
- stock firmware requires "customized uImage header" by MSTC
(MitraStar Technology Corp.), but U-Boot doesn't
  - uImage magic (0x0 - 0x3) : 0x434F4D42 (COMB)
  - header crc32 (0x4 - 0x7) : with data length and data crc32
  - image name (0x20 - 0x37) : model ID and firmware versions
  - data length (0x38 - 0x3b): kernel + rootfs
  - data crc32 (0x3c - 0x3f) : kernel + rootfs

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Reviewed-by: Sungbo Eo <mans0n@gorani.run>
2020-02-05 17:03:34 +01:00
INAGAKI Hiroshi
3c0e2aa63e ramips: add support for I-O DATA WN-DX1167R
I-O DATA WN-DX1167R is a 2.4/5 GHz band 11ac rotuer, based on MediaTek
MT7621A.

Specification:

- SoC		: MediaTek MT7621A
- RAM		: DDR3 128 MiB
- Flash		: NAND 128 MiB
- WLAN		: MediaTek MT7615D (2.4/5 GHz, 2T2R)
- Ethernet	: 5x 10/100/1000 Mbps
  - Switch	: MediaTek MT7621A (MT7530)
- LEDs/Input	: 2x/3x (2x buttons, 1x slide-switch)
- UART		: through-hole on PCB
  - J5: Vcc, TX, RX, NC, GND
  - 57600 bps

Flash instruction using initramfs image:

1. Boot WN-DX1167R normally
2. Access to "http://192.168.0.1/" and open firmware update page
("ファームウェア")
3. Select the OpenWrt initramfs image and click update ("更新")
button to perform firmware update
4. On the initramfs image, perform sysupgrade with squashfs-sysupgrade
image
5. Wait ~120 seconds to complete flashing

Notes:

- configuration in DeviceTree of DBDC (Dual-Band-Dual-Concurrent) mode
for MT7615D chip is not supported in mt76 driver
- last 0x80000 (512 KiB) in NAND flash is not used on stock firmware
- stock firmware requires "customized uImage header" by MSTC
(MitraStar Technology Corp.), but U-Boot doesn't
  - uImage magic (0x0 - 0x3) : 0x434F4D43 (COMC)
  - header crc32 (0x4 - 0x7) : with data length and data crc32
  - image name (0x20 - 0x37) : model ID and firmware versions
  - data length (0x38 - 0x3b): kernel + rootfs
  - data crc32 (0x3c - 0x3f) : kernel + rootfs

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Reviewed-by: Sungbo Eo <mans0n@gorani.run>
2020-02-05 17:03:27 +01:00
INAGAKI Hiroshi
be4d53bf69 ramips: extend and rename wr1201-factory-header
This commit adds the ability to set custom uImage magic to
Build/wr1201-factory-header and renames it to
"Build/custom-initramfs-uimage".

Custom uImage header in initramfs image is required on following
devices:

- I-O DATA WN-AX1167GR2
- I-O DATA WN-AX2033GR
- I-O DATA WN-AX2033GR2
- I-O DATA WN-DX1167R

While at it, fix typo in comment.

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Reviewed-by: Sungbo Eo <mans0n@gorani.run>
[shorten commit title, minor commit message adjustments]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-02-05 17:03:21 +01:00
Adrian Schmutzler
3227afbbab ramips: collect and harmonize TP-Link image variants in common file
This moves the various variants of common device definitions for
TP-Link devices to a common Makefile common-tp-link.mk. This
provides the opportunity to reorganize and move parameters between
individual device definitions and the common ones.

While at it, also use the common definitions for previously
independent definitions where appropriate.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-02-01 19:35:35 +01:00
Adrian Schmutzler
dc862be301 ramips: define SOC only once for uniform targets
In ramips, all devices in mt7621, mt76x8 and rt288x subtarget have
the same value set to the SOC variable for each device individually.

This patch introduces a non-device-dependent variable DEFAULT_SOC,
which is used if no specific SOC is set for a device, and thus reduces
the number of redundant definitions drastically.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-01-24 17:16:11 +01:00
Petr Štetiar
28080d54d2 ramips: mt7621: disable images for gehua_ghl-r-001
This device OOPs during the boot due to broken flash. It can be probably
fixed with `broken-flash-reset` once ramips is on 4.19 kernel.

So disable images for this device until its fixed.

Ref: FS#2695, PR#2483
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2020-01-14 00:06:03 +01:00
David Bauer
8f0effc462 ramips: disable image build for HiWiFi HC5962
Image builds for the ramips-mt7621 target currently fail with:
> WARNING: Image file ./hiwifi_hc5962-kernel.bin is too big
Disable this board for now. It can still be built using the SDK.

Signed-off-by: David Bauer <mail@david-bauer.net>
2020-01-09 12:32:16 +01:00
Yong-hyu Ban
99dd2709b8 ramips: add support for ipTIME A8004T
ipTIME A8004T is a 2.4/5GHz band AC2600 router, based on Mediatek
MT7621A.

Specifications:
- SoC: MT7621A
- RAM: DDR3 256M
- Flash: SPI NOR 16MB
- WiFi:
  - 2.4GHz: MT7615E
  - 5GHz: MT7615E
- Ethernet: 5x 10/100/1000Mbps
  - Switch: SoC internal
- USB: 1 * USB3.0 port
- UART:
  - J4: 3.3V, TX, RX, GND (3.3V is the square pad) / 57600 8N1
- Other info:
  - J9: Unknown unpopulated header.

Installation via web interface:
1.  Flash **initramfs** image through the stock web interface.
2.  Boot into OpenWrt and perform sysupgrade with sysupgrade image.

Revert to stock firmware:
1.  Perform sysupgrade with stock image.

Signed-off-by: Yong-hyu Ban <perillamint@quendi.moe>
[do not enable xhci node in DTS which is already enabled in DTSI]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-01-05 23:38:00 +01:00