Specification:
- MT7981 CPU using 2.4GHz and 5GHz WiFi (both AX)
- MT7531 switch
- 512MB RAM
- 128MB NAND flash with two UBI partitions with identical size
- 1 multi color LED (red, green, blue, white) connected via GCA230718
- 3 buttons (WPS, reset, LED on/off)
- 1 1Gbit WAN port
- 4 1Gbit LAN ports
Disassembly:
- There are four screws at the bottom: 2 under the rubber feets, 2 under the label.
- After removing the screws, the white plastic part can be shifted out of the blue part.
- Be careful because the antennas are mounted on the side and the top of the white part.
Serial Interface
- The serial interface can be connected to the 4 pin holes on the side of the board.
- Pins (from front to rear):
- 3.3V
- RX
- TX
- GND
- Settings: 115200, 8N1
MAC addresses:
- WAN MAC is stored in partition "Odm" at offset 0x81
- LAN (as printed on the device) is WAN MAC + 1
- WLAN MAC (2.4 GHz) is WAN MAC + 2
- WLAN MAC (5GHz) is WAN MAC + 3
Flashing via Recovery Web Interface:
- The recovery web interface always flashes to the currently active partition.
- If OpenWrt is flahsed to the second partition, it will not boot.
- Ensure that you have an OEM image available (encrypted and decrypted version). Decryption is described in the end.
- Set your IP address to 192.168.200.10, subnetmask 255.255.255.0
- Press the reset button while powering on the device
- Keep the reset button pressed until the LED blinks red
- Open a Chromium based and goto http://192.168.200.1 (recovery web interface)
- Download openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-recovery.bin
- The recovery web interface always reports successful flashing, even if it fails
- After flashing, the recovery web interface will try to forward the browser to 192.168.0.1 (can be ignored)
- If OpenWrt was flashed to the first partition, OpenWrt will boot (The status LED will start blinking white and stay white in the end). In this case you're done and can use OpenWrt.
- If OpenWrt was flashed to the second partition, OpenWrt won't boot (The status LED will stay red forever). In this case, the following steps are reuqired:
- Start the web recovery interface again and flash the **decrypted OEM image**. This will be flashed to the second partition as well. The OEM firmware web interface is afterwards accessible via http://192.168.200.1.
- Now flash the **encrypted OEM image** via OEM firmware web interface. In this case, the new firmware is flashed to the first partition. After flashing and the following reboot, the OEM firmware web interface should still be accessible via http://192.168.200.1.
- Start the web recovery interface again and flash the OpenWrt recovery image. Now it will be flashed to the first partition, OpenWrt will boot correctly afterwards and is accessible via 192.168.1.1.
Flashing via U-Boot:
- Open the case, connect to the UART console
- Set your IP address to 192.168.200.2, subnet mask 255.255.255.0. Connect to one of the LAN interfaces of the router
- Run a tftp server which provides openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-initramfs-kernel.bin.
- Power on the device and select "7. Load image" in the U-Boot menu
- Enter image file, tftp server IP and device IP (if they differ from the default).
- TFTP download to RAM will start. After a few seconds OpenWrt initramfs should start
- The initramfs is accessible via 192.168.1.1, change your IP address accordingly (or use multiple IP addresses on your interface)
- Perform a sysupgrade using openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-sysupgrade.bin
- Reboot the device. OpenWrt should start from flash now
Revert back to stock using the Recovery Web Interface:
- Set your IP address to 192.168.200.2, subnetmask 255.255.255.0
- Press the reset button while powering on the device
- Keep the reset button pressed until the LED blinks red
- Open a Chromium based and goto http://192.168.200.1 (recovery web interface)
- Flash a decrypted firmware image from D-Link. Decrypting an firmware image is described below.
Decrypting a D-Link firmware image:
- Download https://github.com/RolandoMagico/firmware-utils/blob/M32/src/m32-firmware-util.c
- Compile a binary from the downloaded file, e.g. gcc m32-firmware-util.c -lcrypto -o m32-firmware-util
- Run ./m32-firmware-util M30 --DecryptFactoryImage <OriginalFirmware> <OutputFile>
- Example for firmware M30A1_FW101B05: ./m32-firmware-util M30 --DecryptFactoryImage M30A1_FW101B05\(0725091522\).bin M30A1_FW101B05\(0725091522\)_decrypted.bin
Flashing via OEM web interface is not possible, as it will change the active partition and OpenWrt is only running on the first UBI partition.
Controlling the LEDs:
- The LEDs are controlled by a chip called "GCA230718" which is connected to the main CPU via I2C (address 0x40)
- I didn't find any documentation or driver for it, so the information below is purely based on my investigations
- If there is already I driver for it, please tell me. Maybe I didn't search enough
- I implemented a kernel module (leds-gca230718) to access the LEDs via DTS
- The LED controller supports PWM for brightness control and ramp control for smooth blinking. This is not implemented in the driver
- The LED controller supports toggling (on -> off -> on -> off) where the brightness of the LEDs can be set individually for each on cycle
- Until now, only simple active/inactive control is implemented (like when the LEDs would have been connected via GPIO)
- Controlling the LEDs requires three sequences sent to the chip. Each sequence consists of
- A reset command (0x81 0xE4) written to register 0x00
- A control command (for example 0x0C 0x02 0x01 0x00 0x00 0x00 0xFF 0x01 0x00 0x00 0x00 0xFF 0x87 written to register 0x03)
- The reset command is always the same
- In the control command
- byte 0 is always the same
- byte 1 (0x02 in the example above) must be changed in every sequence: 0x02 -> 0x01 -> 0x03)
- byte 2 is set to 0x01 which disables toggling. 0x02 would be LED toggling without ramp control, 0x03 would be toggling with ramp control
- byte 3 to 6 define the brightness values for the LEDs (R,G,B,W) for the first on cycle when toggling
- byte 7 defines the toggling frequency (if toggling enabled)
- byte 8 to 11 define the brightness values for the LEDs (R,G,B,W) for the second on cycle when toggling
- byte 12 is constant 0x87
Comparison to M32/R32:
- The algorithms for decrypting the OEM firmware are the same for M30/M32/R32, only the keys differ
- The keys are available in the GPL sources for the M32
- The M32/R32 contained raw data in the firmware images (kernel, rootfs), the R30 uses a sysupgrade tar instead
- Creation of the recovery image is quite similar, only the header start string changes. So mostly takeover from M32/R32 for that.
- Turned out that the bytes at offset 0x0E and 0x0F in the recovery image header are the checksum over the data area
- This checksum was not checked in the recovery web interface of M32/R32 devices, but is now active in R30
- I adapted the recovery image creation to also calculate the checksum over the data area
- The recovery image header for M30 contains addresses which don't match the memory layout in the DTS. The same addresses are also present in the OEM images
- The recovery web interface either calculates the correct addresses from it or has it's own logic to determine where which information must be written
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
The recovery image is reqired for D-Link M30 as well. So I moved it to include/image-commands.mk to be able to use it for MT7622 and filogic devices.
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Hardware specification:
SoC: MediaTek MT7986A 4x A53
Flash: ESMT F50L1G41LB 128MB
RAM: W632GU6NB DDR3 256MB
Ethernet: 1x 2.5G + 4x 1G
WiFi1: MT7975N 2.4GHz 4T4R
WiFi2: MT7975PN 5GHz 4T4R
Button: Reset, WPS
Power: DC 12V 2A
Flash instructions:
1. Connect to the router using ssh or telnet,
username: useradmin, password is the web
login password of the router.
2. Use scp to upload bl31-uboot.fip and flash:
"mtd write xxx-preloader.bin spi0.0"
"mtd write xxx-bl31-uboot.fip FIP"
"mtd erase ubi"
3. Connect to the router via the Lan port,
set a static ip of your PC.
(ip 192.168.1.254, gateway 192.168.1.1)
4. Download initramfs image, reboot router,
waiting for tftp recovery to complete.
5. After openwrt boots up, perform sysupgrade.
Note:
1. Back up all mtd partitions before flashing.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 8GB eMMC or 128 MB SPI-NAND
RAM: 256MB
Ethernet: 5x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset
USB: M.2(B-key) for 4G/5G Module
Power: DC 12V 1A
UART: 3.3v, 115200n8
--------------------------
| Layout |
| ----------------- |
| 4 | VCC RX TX GND | <= |
| ----------------- |
--------------------------
The U-boot menu will automatically appear at startup, and then select
the required options through UP/DOWN Key.
NAND Flash and eMMC Flash instructions:
1. Set your computers IP adress to 192.168.1.2.
2. Run a TFTP server providing the sysupgrade.bin image.
3. Power on the router, into the U-Boot menu.
4. Select "2. Upgrade firmware"
5. Update sysupgrade.bin file name, input server IP and input device
IP (if they deviate from the defaults)
6. Wait for automatic startup after burning
Signed-off-by: Allen Zhao <allenzhao@unielecinc.com>
When building MT7629 with ALL_KMODS then we get prompted for
LEDS_SMARTRG_LED and this will break CI and in future buildbot compilation.
It depends on I2C so the symbol is hidden until ALL_KMODS is used and I2C
support is available, so disable the LEDS_SMARTRG_LED symbol in 6.6 config
intentionally as is done in the 6.1 mt7629 config.
Signed-off-by: Robert Marko <robimarko@gmail.com>
The vendor u-boot knows nothing about UBI, and we used to have a
fixed-size kernel partition for vendor u-boot and UBI for rootfs.
However, that fixed partition becomes too small eventually, and
expanding it requires complicated procedure.
This commit changed the flash layout and added a second u-boot
where the kernel supposed to be.
Now the vendor u-boot chainloads our mainline u-boot, and our
u-boot reads kernel+rootfs from UBI, verifies it, and boot
into OpenWrt.
There are two possible ways to convert from the old fw:
Flash the factory image using mtd (provided by @rany2):
mount -o remount,ro /
mount -o remount,ro /overlay
cd /tmp
dd if=factory.bin bs=1M count=4 | mtd write - kernel
dd if=factory.bin bs=1M skip=4 | mtd -r write - ubi
Or, flash the 2nd u-boot via mtd and upload the firmware
to the 2nd u-boot using tftp:
1. prepare a tftp server at 192.168.1.254 to serve the
sysupgrade image:
openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-squashfs-sysupgrade.itb
2. upload the ubi-loader.itb to OpenWrt /tmp, and flash it to
the old kernel partition:
mtd -r write openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-ubi-loader.itb
3. The router should reboot and flash the sysupgrade image via TFTP.
Procedure for flashing from vendor firmware shouldn't change.
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
Most mt7622 devices use the mt7531 switch, which have been
switched to dsa driver for a long time. So use dsa as the
default configuration and configure these rtl8367s devices
separately. This reduces the amount of code.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
In kernel 6.6, dts files for mediatek arm target are moved into
arch/arm/boot/dts/mediatek instead of legacy path arch/arm/boot/dts.
To avoid dts compile failure, change DTS_DIR to the mediatek subfolder
for kernel 6.6.
Signed-off-by: Weijie Gao <hackpascal@gmail.com>
Add missing CLK_TOP_PEXTP_Px_SEL clock for each of the 4 PCIe interfaces
of the MT7988 SoC. Without that clock PCIe doesn't work reliable.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The GL.iNet X3000 and XE3000 are Wi-Fi 6 5G cellular routers, based on
MediaTek MT7981A SoC. The XE3000 is the same device as the X3000,
except for an additional battery.
Specifications:
- SoC: Filogic 820 MT7981A (1.3GHz)
- RAM: DDR4 512M
- Flash: eMMC 8G, MicroSD card slot
- WiFi: 2.4GHz and 5GHz with 6 antennas
- Ethernet:
- 1x LAN (10/100/1000M)
- 1x WAN (10/100/1000/2500M)
- 5G: Quectel RM520N-GL with two nano-SIM card slots
- USB: 1x USB 2.0 port
- UART:
- 3.3V, TX, RX, GND / 115200 8N1
MAC addresses as verified by OEM firmware:
vendor OpenWrt address source
WAN eth0 label factory 0x0a (label)
LAN eth1 label + 1
2g phy0-ap0 label + 2 factory 0x04
5g phy1-ap0 label + 3
Installation via U-Boot rescue:
1. Press and hold reset button while booting the device
2. Wait for the Internet led to blink 5 times
3. Release reset button
4. The rescue page is accessible via http://192.168.1.1
5. Select the OpenWrt sysupgrade image and start upgrade
6. Wait for the router to flash new firmware and reboot
Revert to stock firmware:
1. Download the stock firmware from GL.iNet website
2. Use the method explained above to flash the stock firmware
Switch the modem network port between PCIe and USB interfaces:
1. Connect to the AT commands (/dev/ttyUSB2) port using
e.g. minicom: minicom -D /dev/ttyUSB2
2. Check the current modem mode with 'AT+QCFG="data_interface"':
- 0,0 indicates that the network port uses the USB interface
- 1,0 indicates that the network port uses the PCIe interface
3. Switch the active interface with:
- 'AT+QCFG="data_interface",0,0' to use the USB interface
- 'AT+QCFG="data_interface",1,0' to use the PCIe interface
4. Reboot
Signed-off-by: Jean Thomas <jean.thomas@wifirst.fr>
Add new emmc groups in the pinctrl driver for the
MediaTek MT7981 SoC:
* emmc reset, with pin 15.
* emmc 4-bit bus-width, with pins 16 to 19, and 24 to 25.
* emmc 8-bit bus-width, with pins 16 to 25.
The existing emmc_45 group is kept for legacy reasons, even
if this is the union of emmc_reset and emmc_8 groups.
Signed-off-by: Jean Thomas <jean.thomas@wifirst.fr>
As shared remove functions now returns void instead of int we need to
use .remove_new instead of .remove.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Due to what seems to be an undocumented oddity in MediaTek's MT7988
SoC design the CLK_INFRA_PCIE_PERI_26M_CK_P2 clock requires
CLK_INFRA_PCIE_PERI_26M_CK_P3 to be enabled.
This currently leads to PCIe port 2 not working in Linux.
Reflect the apparent relationship in the clk driver to make sure PCIe
port 2 of the MT7988 SoC works.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Include a statement about having to run the installer in the
sysupgrade compat warning for the Linksys E8450 (UBI).
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Probing of the fitblk driver in some situations happens after the kernel
attempts to mount rootfs, which then fails.
Always use 'rootwait' when using fitblk for rootfs.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Commit 2d63d42f5e ("mediatek: convert to new LED color/function
format where possible") leaves Xiaomi Redmi AX6000 un-converted,
the two LEDs become dead.
Now, LEDs are alive again.
Fixes: 2d63d42f5e ("mediatek: convert to new LED color/function
format where possible")
Signed-off-by: Furong Xu <xfr@outlook.com>
Use type casts to prevent compiler warnings which are going to turn
into errors when we switch to Linux 6.6.
In the long run we should try to get rid of this downstream driver
now that RTL8367S is support by the rtl8365mb DSA driver.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Rename kernel patches accepted upstream to indicate at which version
they have been accepted, replacing downstream variants which what was
accepted upstream. Note that some of them are fixes which will
find their way to older kernel versions as well via linux-stable.
No functional changes.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Some backported thermal patches ended up with the wrong kernel
version in their filename. Fix this.
Fixes: c36de2e73a ("mediatek: backport a hell of thermal commits")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
MT7981B /256MB /16MB SPI (XM25QH128C)
AX 2.4Ghz
AX 5Ghz 160Mhz wide
1Gbit LAN
OEM:
root@RE3000:~# ifconfig |grep HWaddr
br-lan Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0 (label)
br-wan Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
eth0 Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
ra0 Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
ra2 Link encap:Ethernet HWaddr 82:XX:XX:28:XX:X0
rax0 Link encap:Ethernet HWaddr 82:XX:XX:38:XX:X0
rax2 Link encap:Ethernet HWaddr 82:XX:XX:58:XX:X0
OpenWrt
root@OpenWrt:/# ifconfig |grep HW
br-lan Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
eth0 Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
phy0-ap0 Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
phy1-ap0 Link encap:Ethernet HWaddr 82:XX:XX:08:XX:X1
tftp Installation via u-boot:
Connect TTL3.3V converter
connector is under the radiator Set speed 115200 8 N 1
Interrupt boot process by holding down-arrow key during boot then
>> 6. Load image
>> 0 - TFTP client (Default)
enter IP adresses and initramfs-kernel.bin
write to flash via sysupgrade or gui
Signed-off-by: Robert Senderek <robert.senderek@10g.pl>
The boot loader does not have a fixed size limit for the kernel,
so we're free to change the layout. This may break sysupgrade, but a fresh
flash from initramfs works.
Fixes: 6e2962d4c5 ("mediatek: mt7622: skip build for MT7622 rfb1 (UBI)")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
If selected on a per-board base, fitblk doesn't end up in initramfs
images which always only come with the subtarget's default packages.
Hence fitblk needs to be included as a default package of all
subtargets making use of fitblk instead of it being selected for
individual boards.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Now that we got fitblk_get_bootdev in /lib/upgrade/common.sh we don't
need platform_get_bootdev in each of the subtargets any longer.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The device booting successfully indicates that bootloader has been
updated. Set compat_version to 1.1 on new configs and bump
compat_version to 1.1 on first boot after a successful sysupgrade.
Fixes: 6368ed1ae5 ("mediatek: mt7623: phase out uImage.FIT partition parser")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Set root=/dev/fit0 cmdline parameter as the kernel won't mount rootfs
otherwise after the change from the FIT partition parser to the fitblk
driver which replaces it.
Fixes: 6368ed1ae5 ("mediatek: mt7623: phase out uImage.FIT partition parser")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Use the new fitblk driver on the BananaPi R2 as well as UniElec U7623.
Introduce boot device selection for fitblk's /chosen/rootdisk
handle, similar to how it is already done on MT7622, MT7986 and MT7988.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
All mt7622 board previously using the FIT partition parser have been
converted to use the fitblk driver:
6aec3c7b5b mediatek: mt7622: modernize Linksys E8450 / Belkin RT3200 UBI build
41c053141e mediatek: mt7622: convert unifi6lr-v{1,2,3}-ubootmod to fitblk
208f6c1232 mediatek: mt7622: convert BPi-R64 to all-UBI layout and fitblk
Remove the now no longer needed FIT partition parser from builds for
mt7622.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Use newly added support for NVMEM-on-UBI instead of extracting MAC
address and WiFi EEPROM data in userspace.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Use newly added support for NVMEM-on-UBI instead of extracting MAC
address and WiFi EEPROM data in userspace.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Use newly added support for NVMEM-on-UBI instead of extracting MAC
address and WiFi EEPROM data in userspace.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
