Hardware:
SoC: MT7981b
RAM: 256 MB
Flash: 128 MB SPI NAND
Ethernet:
1x 2.5Gbps (rtl8221b)
1x 1Gbps (integrated phy)
WiFi: 2x2 MT7981
Buttons: Reset, WPS
LED: 1x multicolor
Solder on UART:
- remove rubber ring on the bottom
- remove screws
- pull up the cylinder, maybe help by push on an ethernet socket with a screwdriver
- remove the (3) screws holding the board in the frame
- remove the board from the frame to get to the screws for the silver, flat heat shield
- remove the (3) screws holding the heat shield
- solder UART pins to the back of the board
- make sure to have the pins point out on side with the black, finned heat spread
- the markings for the pins are going to be below the silver heat shield
- Vcc is not needed
If you don't intend on using the UART outside of the installation process, you might not
want to solder:
- carefully scrape off the thin layer of epoxy on the holes (not the copper)
- place your pin header with the UART attached in the holes
- the pins, starting with the one closest to the socket:
- Vcc (not required)
- GND
- RX
- TX
- either wedge the header or hold it with your fingers so that the pins stay in contact with the board
Installation (UART):
- attach an Ethernet cable to the 1Gbps port (black) on the router
- hold the reset button while powering the router
- press CTRL-C or wait for the timeout to get to the U-Boot prompt
- prepare a TFTP server on the network to supply ..-initramfs-kernel.bin
- use 'tftpboot' in the U-Boot shell to pull the image
- boot the image using 'bootm'
- push the ..-sysupgrade to the router using your preferred method
- perform the upgrade with 'sysupgrade -n'
There is a recovery mechanism that involves fetching a file called 'recovery.bin' but that is not understood yet.
Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
(cherry picked from commit 20e4a18feb)
The MAC address assigned to lan/wan was reversed.
Fixes: 6e51ff88b0 ("mediatek: add support for JDCloud RE-CP-03")
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
With upstream accepted "mac-base" binding there is no need for a
downstream "mac-address-ascii" workaround anymore.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit daaa0c1b25)
Link: https://github.com/openwrt/openwrt/pull/15917
In the past few years, we have received several reports about SPI
Flash not working properly. This is caused by excessively fast
clock frequency. It's really annoying to fix them one by one. Let's
reduce these aggressive frequencies to 50 MHz. This is a safe and
suggested value in the vendor SDK.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
(cherry picked from commit 73eeac49be)
Link: https://github.com/openwrt/openwrt/pull/15919
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The WLAN + WED reset sequence relies on being able to receive interrupts from
the card, in order to synchronize individual steps with the firmware.
When WED is stopped, leave interrupts running and rely on the driver turning
off unwanted ones.
WED DMA also needs to be disabled before resetting.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 2c5b3bee38)
Add patch implementing operations to get and set flow-control link
parameters of mtk_eth_soc via ethtool.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 4a2f712f85)
Import patch accepted upstream.
Initial import:
- net: ethernet: mtk_ppe: Change PPE entries number to 16K
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 27b6838afa)
In preparation to update mtk_eth_soc move accepted patches from mediatek
target to backport folder, so other patches on top can be applied more
easily.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 8730f9e536)
Specifications:
- Device: Edimax BR-6208AC V2
- SoC: MT7620A
- Flash: 16 MiB
- RAM: 64 MiB
- Switch: 1 WAN, 3 LAN (10/100 Mbps)
- WiFi: MT7620 2.4 GHz + MT7610E 5 GHz
- LEDs: 1x POWER (green, not configurable)
1x Firmware (green, configurable)
1x Internet (green, configurable)
1x VPN (green, configurable)
1x 2.4G (green, not configurable)
1x 5G (green, not configurable)
Normal installation:
- Upload the sysupgrade image via the default web interface
Installation with U-Boot and TFTP:
- Requires a TFTP server which provides the sysupgrade image
- Requires a connection to the serial port of the device, rate 57600
Signed-off-by: Stefan Weil <sw@weilnetz.de>
(cherry picked from commit 8d06bc1751)
Netgear EAX12, EAX11v2, EAX15v2 are wall-plug 802.11ax (Wi-Fi 6)
extenders that share the SoC, WiFi chip, and image format with the
WAX202.
Specifications:
* MT7621, 256 MiB RAM, 128 MiB NAND
* MT7915: 2.4/5 GHz 2x2 802.11ax (DBDC)
* Ethernet: 1 port 10/100/1000
* UART: 115200 baud (labeled on board)
All LEDs and buttons appear to work without state_default.
Installation:
* Flash the factory image through the stock web interface, or TFTP to
the bootloader. NMRP can be used to TFTP without opening the case.
Revert to stock firmware:
* Flash the stock firmware to the bootloader using TFTP/NMRP.
References in GPL source:
https://www.downloads.netgear.com/files/GPL/EAX12_EAX11v2_EAX15v2_GPL_V1.0.3.34_src.tar.gz
* target/linux/ramips/dts/mt7621-rfb-ax-nand.dts
DTS file for this device.
Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
(cherry picked from commit 32ea8a9a7e)
The PHY of the wan2 port on MQmaker WiTi is wired to the second MAC of the
SoC. Rename the wan interface to wan1 and define it under the switch node,
effectively disabling the PHY muxing of the MT7530 switch's phy4.
Define the PHY of the wan2 port and adjust the gmac1 node accordingly. Now
that the PHY muxing feature is not being used anymore, the wan2 port can be
used to achieve 2 Gbps total bandwidth to the CPU.
Tested-by: Demetris Ierokipides <ierokipides.dem@gmail.com>
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
(cherry picked from commit 8bf9a8a5e6)
General specification:
SoC Type: MediaTek MT7620A (580MHz)
ROM: 8 MB SPI-NOR (MX25L6406E)
RAM: 64 MB DDR (W9751G6KB-25)
Switch: MediaTek MT7530
Ethernet: 5 ports - 5×100MbE (WAN, LAN1-4)
Wireless: 2.4 GHz (MediaTek RT5390): b/g/n
Wireless: 5 GHz (MediaTek MT7610EN): ac/n
Buttons: 2 button (POWER, WPS/RESET)
Bootloader: U-Boot 1.1.3
Power: 12 VDC, 0.5 A
MACs:
| LAN | [Factory + 0x04] - 2 |
| WLAN 2.4g | [Factory + 0x04] - 1 |
| WLAN 5g | [Factory + 0x8004] - 3 |
| WAN | [Factory + 0x04] - 2 |
OEM easy installation:
1. Use a PC to browse to http://192.168.0.1.
2. Go to the System section and open the Firmware Update section.
3. Under the Local Update at the right, click on the CHOOSE FILE...
4. When a modal window appears, choose the firmware file and click on
the Open.
5. Next click on the UPDATE FIRMWARE button and upload the firmware image.
Wait for the router to flash and reboot.
OEM installation using the TFTP method (need level converter):
1. Download the latest firmware image.
2. Set up a Tftp server on a PC (e.g. Tftpd32) and place the firmware
image to the root directory of the server.
3. Power off the router and use a twisted pair cable to connect the PC
to any of the router's LAN ports.
4. Configure the network adapter of the PC to use IP address 192.168.0.180
and subnet mask 255.255.255.0.
5. Connect serial port (57600 8N1) and turn on the router.
6. Then interrupt "U-Boot Boot Menu" by hitting 2 key (select "2: Load
system code then write to Flash via TFTP.").
7. Press Y key when show "Warning!! Erase Linux in Flash then burn new
one. Are you sure? (Y/N)"
Input device IP (192.168.0.1) ==:192.168.0.1
Input server IP (192.168.0.180) ==:192.168.0.180
Input Linux Kernel filename () ==:firmware_name
The router should download the firmware via TFTP and complete flashing in
a few minutes.
After flashing is complete, use the PC to browse to http://192.168.1.1 or
ssh to proceed with the configuration.
Signed-off-by: Alexey Bartenev <41exey@proton.me>
(cherry picked from commit ce998cb6e1)
Specification:
- MT7981 CPU using 2.4GHz and 5GHz WiFi (both AX)
- MT7531 switch
- 512MB RAM
- 128MB NAND flash with two UBI partitions with identical size
- 1 multi color LED (red, green, blue, white) connected via GCA230718
- 3 buttons (WPS, reset, LED on/off)
- 1 1Gbit WAN port
- 4 1Gbit LAN ports
Disassembly:
- There are four screws at the bottom: 2 under the rubber feets, 2 under the label.
- After removing the screws, the white plastic part can be shifted out of the blue part.
- Be careful because the antennas are mounted on the side and the top of the white part.
Serial Interface
- The serial interface can be connected to the 4 pin holes on the side of the board.
- Pins (from front to rear):
- 3.3V
- RX
- TX
- GND
- Settings: 115200, 8N1
MAC addresses:
- WAN MAC is stored in partition "Odm" at offset 0x81
- LAN (as printed on the device) is WAN MAC + 1
- WLAN MAC (2.4 GHz) is WAN MAC + 2
- WLAN MAC (5GHz) is WAN MAC + 3
Flashing via Recovery Web Interface:
- The recovery web interface always flashes to the currently active partition.
- If OpenWrt is flahsed to the second partition, it will not boot.
- Ensure that you have an OEM image available (encrypted and decrypted version). Decryption is described in the end.
- Set your IP address to 192.168.200.10, subnetmask 255.255.255.0
- Press the reset button while powering on the device
- Keep the reset button pressed until the LED blinks red
- Open a Chromium based and goto http://192.168.200.1 (recovery web interface)
- Download openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-recovery.bin
- The recovery web interface always reports successful flashing, even if it fails
- After flashing, the recovery web interface will try to forward the browser to 192.168.0.1 (can be ignored)
- If OpenWrt was flashed to the first partition, OpenWrt will boot (The status LED will start blinking white and stay white in the end). In this case you're done and can use OpenWrt.
- If OpenWrt was flashed to the second partition, OpenWrt won't boot (The status LED will stay red forever). In this case, the following steps are reuqired:
- Start the web recovery interface again and flash the **decrypted OEM image**. This will be flashed to the second partition as well. The OEM firmware web interface is afterwards accessible via http://192.168.200.1.
- Now flash the **encrypted OEM image** via OEM firmware web interface. In this case, the new firmware is flashed to the first partition. After flashing and the following reboot, the OEM firmware web interface should still be accessible via http://192.168.200.1.
- Start the web recovery interface again and flash the OpenWrt recovery image. Now it will be flashed to the first partition, OpenWrt will boot correctly afterwards and is accessible via 192.168.1.1.
Flashing via U-Boot:
- Open the case, connect to the UART console
- Set your IP address to 192.168.200.2, subnet mask 255.255.255.0. Connect to one of the LAN interfaces of the router
- Run a tftp server which provides openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-initramfs-kernel.bin.
- Power on the device and select "7. Load image" in the U-Boot menu
- Enter image file, tftp server IP and device IP (if they differ from the default).
- TFTP download to RAM will start. After a few seconds OpenWrt initramfs should start
- The initramfs is accessible via 192.168.1.1, change your IP address accordingly (or use multiple IP addresses on your interface)
- Perform a sysupgrade using openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-sysupgrade.bin
- Reboot the device. OpenWrt should start from flash now
Revert back to stock using the Recovery Web Interface:
- Set your IP address to 192.168.200.2, subnetmask 255.255.255.0
- Press the reset button while powering on the device
- Keep the reset button pressed until the LED blinks red
- Open a Chromium based and goto http://192.168.200.1 (recovery web interface)
- Flash a decrypted firmware image from D-Link. Decrypting an firmware image is described below.
Decrypting a D-Link firmware image:
- Download https://github.com/RolandoMagico/firmware-utils/blob/M32/src/m32-firmware-util.c
- Compile a binary from the downloaded file, e.g. gcc m32-firmware-util.c -lcrypto -o m32-firmware-util
- Run ./m32-firmware-util M30 --DecryptFactoryImage <OriginalFirmware> <OutputFile>
- Example for firmware M30A1_FW101B05: ./m32-firmware-util M30 --DecryptFactoryImage M30A1_FW101B05\(0725091522\).bin M30A1_FW101B05\(0725091522\)_decrypted.bin
Flashing via OEM web interface is not possible, as it will change the active partition and OpenWrt is only running on the first UBI partition.
Controlling the LEDs:
- The LEDs are controlled by a chip called "GCA230718" which is connected to the main CPU via I2C (address 0x40)
- I didn't find any documentation or driver for it, so the information below is purely based on my investigations
- If there is already I driver for it, please tell me. Maybe I didn't search enough
- I implemented a kernel module (leds-gca230718) to access the LEDs via DTS
- The LED controller supports PWM for brightness control and ramp control for smooth blinking. This is not implemented in the driver
- The LED controller supports toggling (on -> off -> on -> off) where the brightness of the LEDs can be set individually for each on cycle
- Until now, only simple active/inactive control is implemented (like when the LEDs would have been connected via GPIO)
- Controlling the LEDs requires three sequences sent to the chip. Each sequence consists of
- A reset command (0x81 0xE4) written to register 0x00
- A control command (for example 0x0C 0x02 0x01 0x00 0x00 0x00 0xFF 0x01 0x00 0x00 0x00 0xFF 0x87 written to register 0x03)
- The reset command is always the same
- In the control command
- byte 0 is always the same
- byte 1 (0x02 in the example above) must be changed in every sequence: 0x02 -> 0x01 -> 0x03)
- byte 2 is set to 0x01 which disables toggling. 0x02 would be LED toggling without ramp control, 0x03 would be toggling with ramp control
- byte 3 to 6 define the brightness values for the LEDs (R,G,B,W) for the first on cycle when toggling
- byte 7 defines the toggling frequency (if toggling enabled)
- byte 8 to 11 define the brightness values for the LEDs (R,G,B,W) for the second on cycle when toggling
- byte 12 is constant 0x87
Comparison to M32/R32:
- The algorithms for decrypting the OEM firmware are the same for M30/M32/R32, only the keys differ
- The keys are available in the GPL sources for the M32
- The M32/R32 contained raw data in the firmware images (kernel, rootfs), the R30 uses a sysupgrade tar instead
- Creation of the recovery image is quite similar, only the header start string changes. So mostly takeover from M32/R32 for that.
- Turned out that the bytes at offset 0x0E and 0x0F in the recovery image header are the checksum over the data area
- This checksum was not checked in the recovery web interface of M32/R32 devices, but is now active in R30
- I adapted the recovery image creation to also calculate the checksum over the data area
- The recovery image header for M30 contains addresses which don't match the memory layout in the DTS. The same addresses are also present in the OEM images
- The recovery web interface either calculates the correct addresses from it or has it's own logic to determine where which information must be written
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
(cherry picked from commit 29cca6cfee)
The recovery image is reqired for D-Link M30 as well. So I moved it to include/image-commands.mk to be able to use it for MT7622 and filogic devices.
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
(cherry picked from commit 0e2b7e3bd6)
Rename network devices to their label set in DT without invocation of
a sub-shell.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 983222605c)
Implement the functionality of
target/linux/ramips/patches-5.15/700-net-ethernet-mediatek-support-net-labels.patch
in userspace, since the driver patch has been rejected as a generic solution:
https://github.com/openwrt/openwrt/pull/11435
Signed-off-by: Bjørn Mork <bjorn@mork.no>
(cherry picked from commit 1dd1ac2c35)
The option CONFIG_SND_DRIVERS is activated by default in the generic
configuration, do not deactivate it for tegra. This fixes the build of
the kmod-sound-dummy package on tegra.
(cherry picked from commit 21213c8156)
Link: https://github.com/openwrt/openwrt/pull/15898
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware specification:
SoC: MediaTek MT7986A 4x A53
Flash: ESMT F50L1G41LB 128MB
RAM: W632GU6NB DDR3 256MB
Ethernet: 1x 2.5G + 4x 1G
WiFi1: MT7975N 2.4GHz 4T4R
WiFi2: MT7975PN 5GHz 4T4R
Button: Reset, WPS
Power: DC 12V 2A
Flash instructions:
1. Connect to the router using ssh or telnet,
username: useradmin, password is the web
login password of the router.
2. Use scp to upload bl31-uboot.fip and flash:
"mtd write xxx-preloader.bin spi0.0"
"mtd write xxx-bl31-uboot.fip FIP"
"mtd erase ubi"
3. Connect to the router via the Lan port,
set a static ip of your PC.
(ip 192.168.1.254, gateway 192.168.1.1)
4. Download initramfs image, reboot router,
waiting for tftp recovery to complete.
5. After openwrt boots up, perform sysupgrade.
Note:
1. Back up all mtd partitions before flashing.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
(cherry picked from commit 4ae474afbd)
Cudy assigns hardware versions to its devices on its website, and
the Cudy TR1200 router is now Cudy TR1200 v1.
OpenWrt currently uses both variants, and this commit removes
inconsistencies using only the new name.
Signed-off-by: Luis Mita <luis@luismita.com>
(cherry picked from commit d780d530dd)
Link: https://github.com/openwrt/openwrt/pull/15875
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware:
- SoC: MediaTek MT7628AN (MIPS 580MHz)
- Flash: 16 MiB XMC 25QH128CH10
- RAM: 128 MiB ESMT M14D1G1664A
- WLAN: 2.4 GHz (MT7628), 5 GHz (MT7613BEN 802.11ac)
- Ethernet: 1x 10/100 Mbps WAN, 1x 10/100 LAN (MT7628)
- USB 2.0 port
- Buttons: 1 Reset button, 1 slider button
- LEDs: 1x Red, 1x White
- Serial console: unpopulated header, 115200 8n1
- Power: 5 VDC, 2 A
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| WAN | 80:af:ca:xx:xx:x0 | label |
| LAN | 80:af:ca:xx:xx:x0 | label |
| WLAN 2g | 80:af:ca:xx:xx:x0 | label |
| WLAN 5g | 80:af:ca:xx:xx:x2 | label+2 |
+---------+-------------------+-----------+
Installation:
The installation must be done via TFTP by disassembling the router.
On other occasions Cudy has distributed intermediate firmware to make
installation easier, and so I recommend checking the Wiki for this
device if there is a more convenient solution than the one below.
To install using TFTP:
1. Upgrade to a beta firmware (signed by Cudy) that can be downloaded
from the wiki. This is required in order to use an unlocked u-boot.
2. Connect to UART.
3. While the router is turning on, press 1.
4. Connect to LAN and set your IP to 192.168.1.88/24. Configure a TFTP
server and an OpenWrt initramfs-kernel.bin firmware file as recovery.bin.
5. Press Enter three times. Verify the filename.
6. If you can reach LuCI or SSH now, just use the sysupgrade image with
the 'Keep settings' option turned off.
If you don't want to use the beta firmware nor the unlocked u-boot, you
can install the firmware writing the sysupgrade image on the firmware
partition of the SPI flash.
Signed-off-by: Luis Mita <luis@luismita.com>
(cherry picked from commit f1091ef7ac)
Link: https://github.com/openwrt/openwrt/pull/15875
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This adds two more common PHY brands to the image.
Realtek is used on the Google Coral "Phanbell" board (i.MX8MQ).
SMSC has been used on various Raspberry Pi boards.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(cherry picked from commit bcbdde00c3)
Link: https://github.com/openwrt/openwrt/pull/15808
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This was discovered when trying to run OpenWrt on Hetzner Cloud's
Arm-based instances.
Hetzner uses QEMU/KVM with virtio-gpu as the main display device,
together with an ACPI firmware. This was not displaying a console
previously.
This setup can be emulated by qemu using options below:
qemu-system-aarch64 \
-machine virt \
-bios QEMU_EFI.fd \
-device virtio-gpu \
-usb \
-device qemu-xhci,id=xhci \
-device usb-tablet,bus=xhci.0 \
-device usb-kbd,bus=xhci.0 \
-vnc :0
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(cherry picked from commit ea7383e721)
Link: https://github.com/openwrt/openwrt/pull/15808
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Support for Renesas Arm families was added in commit 1ff4f4df23
("armsr: armv8: enable CONFIG_ARCH_RENESAS"), but this did not
enable the console/tty hardware for these SoCs, which is derived
from the SuperH family (CONFIG_SERIAL_SH_SCI).
Link: https://github.com/openwrt/openwrt/issues/15284
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(cherry picked from commit 683355d0a6)
Link: https://github.com/openwrt/openwrt/pull/15808
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
R32 is like the M32 part of the EAGLE PRO AI series from D-Link.
Specification:
- MT7622BV SoC with 2.4GHz wifi
- MT7975AN + MT7915AN for 5GHz
- MT7531BE Switch
- 512MB RAM
- 128 MB flash
- 2 LEDs (Status and Internet, both can be either orange or white)
- 2 buttons (WPS and Reset)
Compared to M32, the R32 has the following differences:
- 4 LAN ports instead of 2
- The recory image starts with DLK6E6015001 instaed of DLK6E6010001
- Individual LEDs for power and internet
- MAC address is stored at another offset in the ODM partition
MAC addresses:
- WAN MAC is stored in partition "Odm" at offset 0x81
- LAN (as printed on the device) is WAN MAC + 1
- WLAN MAC (2.4 GHz) is WAN MAC + 2
- WLAN MAC (5GHz) is WAN MAC + 3
Flashing via Recovery Web Interface:
- Set your IP address to 192.168.0.10, subnetmask 255.255.255.0
- Press the reset button while powering on the deivce
- Keep the reset button pressed until the internet LED blinks fast
- Open a Chromium based and goto http://192.168.0.1
- Download openwrt-mediatek-mt7622-dlink_eagle-pro-ai-r32-a1-squashfs-recovery.bin
Flashing via uBoot:
- Open the case, connect to the UART console
- Set your IP address to 10.10.10.3, subnet mask 255.255.255.0. Connect to one of the LAN interfaces of the router
- Run a tftp server which provides openwrt-mediatek-mt7622-dlink_eagle-pro-ai-r32-initramfs-kernel.bin.
- You can rename the file to iverson_uImage (no extension), then you don't have to enter the whole file name in uboot later.
- Power on the device and select "1. System Load Linux to SDRAM via TFTP." in the boot menu
- Enter image file, tftp server IP and device IP (if they differ from the default).
- TFTP download to RAM will start. After a few seconds OpenWrt initramfs should start
- The initramfs is accessible via 192.168.1.1, change your IP address accordingly (or use multiple IP addresses on your interface)
- Create a backup of the Kernel1 partition, this file is required if a revert to stock should be done later
- Perform a sysupgrade using openwrt-mediatek-mt7622-dlink_eagle-pro-ai-r32-squashfs-sysupgrade.bin
- Reboot the device. OpenWrt should start from flash now
Revert back to stock using the Recovery Web Interface:
- Set your IP address to 192.168.0.10, subnetmask 255.255.255.0
- Press the reset button while powering on the deivce
- Keep the reset button pressed until the internet LED blinks fast
- Open a Chromium based and goto http://192.168.0.1
- Flash a decrypted firmware image from D-Link. Decrypting an firmware image is described below.
Decrypting a D-Link firmware image:
- Download https://github.com/RolandoMagico/firmware-utils/blob/M32/src/m32-firmware-util.c
- Compile a binary from the downloaded file, e.g. gcc m32-firmware-util.c -lcrypto -o m32-firmware-util
- Run ./m32-firmware-util R32 --DecryptFactoryImage <OriginalFirmware> <OutputFile>
- Example for firmware R32A1_FW103B01: ./m32-firmware-util R32 --DecryptFactoryImage R32A1_FW103B01.bin R32A1_FW103B01.decrypted.bin
Revert back to stock using uBoot:
- Open the case, connect to the UART console
- Set your IP address to 10.10.10.3, subnet mask 255.255.255.0. Connect to one of the LAN interfaces of the router
- Run a tftp server which provides the previously created backup of the Kernel1 partition.
- You can rename the file to iverson_uImage (no extension), then you don't have to enter the whole file name in uboot later.
- Power on the device and select "2. System Load Linux Kernel then write to Flash via TFTP." in the boot menu
- Enter image file, tftp server IP and device IP (if they differ from the default).
- TFTP download to FLASH will start. After a few seconds the stock firmware should start again
There is also an image openwrt-mediatek-mt7622-dlink_eagle-pro-ai-r32-a1-squashfs-tftp.bin which can directly be flashed via U-Boot and TFTP.
It can be used if no backup of the Kernel1 partition is reuqired.
Flahsing via OEM web interface is currently not possible, the OEM images are encrypted. Creating images is only possible manually at the moment.
The support for the M32/R32 already includes support for flashing from the OEM web interface:
- The device tree contains both partitions (Kernel1 and Kernel2) with conditions to select the correct one based on the kernel command line
- The U-Boot variable "boot_part" is set accordingly during startup to finish the partition swap after flashing from the OEM web interface
- OpenWrt sysupgrade flashing always uses the partition where it was initially flashed to (no partition swap)
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
(cherry picked from commit fdb87a91b4)
Link: https://github.com/openwrt/openwrt/pull/15776
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Comfast CF-E393AX is a dual-band Wi-Fi 6 POE ceiling mount access point.
Oem firmware is a custom openwrt 21.02 snapshot version.
We can gain access via ssh once we remove the root password.
Hardware specification:
SoC: MediaTek MT7981A 2x A53
Flash: 128 MB SPI-NAND
RAM: 256MB DDR3
Ethernet: 1x 10/100/1000 Mbps built-in PHY (WAN)
1x 10/100/1000/2500 Mbps MaxLinear GPY211C (LAN)
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976D
LEDS: 1x (Red, Blue and Green)
Button: Reset
UART: 3.3v, 115200n8
--------------------------
| Layout |
| ----------------- |
| 4 | VCC GND TX RX | <= |
| ----------------- |
--------------------------
Gain SSH access:
1. Login into web interface (http://apipaddress/computer/login.html),
and download the
configuration(http://apipaddress/computer/config.html).
2. Rename downloaded backup config - 'backup.file to backup.tar.gz',
Enter 'fakeroot' command then decompress the configuration:
tar -zxf backup.tar.gz
3. Edit 'etc/shadow', update (remove) root password:
With password =
'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
to
Without password =
'root::0:99999:7:::'
'root::0:99999:7:::'
4. Repack 'etc' directory back to a new backup file:
tar -zcf backup-ssh.tar.gz etc/
5. Rename new config tar.gz file to 'backup-ssh.file'
Exit fakeroot - 'exit'
6. Upload new configuration via web interface, now you
can SSH with the following:
'ssh -vv -o HostKeyAlgorithms=+ssh-rsa \
-o PubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.10.1'.
Backup the mtd partitions
- https://openwrt.org/docs/guide-user/installation/generic.backup
7. Copy openwrt factory firmware to the tmp folder to install via ssh:
'scp -o HostKeyAlgorithms=+ssh-rsa \
-o PubkeyAcceptedAlgorithms=+ssh-rsa \
*-mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin \
root@192.168.10.1:/tmp/'
'sysupgrade -n -F \
/tmp/*--mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin'
8. Once led has stopped flashing - Connect via ssh with the
default openwrt ip address - 'ssh root@192.168.1.1'
9. SSH copy the openwrt sysupgrade firmware and upgrade
as per the default instructions.
Signed-off-by: David Bentham <db260179@gmail.com>
(cherry picked from commit d8f4453bf2)
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 16MB NOR
RAM: 256MB
Ethernet: 2x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset
Power: DC 12V 1A, PoE 802.3af 48V
Flash instructions:
Option #1 - SSH
I was able to SSH into the stock firmware of my device.
1. Attach the router to the network
2. Use scp (-O) to copy the sysupgrade image
3. Connect using SSH and run `sysupgrade -n`
Option #2 - U-Boot
One way to use the bootloader for flashing is using TFTP:
1. Connect to the router using an ethernet cable
2 Spin up a TFTP server serving the sysupgrade file
3. Open the case and attach a UART
4. Attach power to the router and interrupt the countdown by pressing
any key
5. Select option #2 (Upgrade firmware)
6. Enter IP address information and image name
7. Wait patiently
Co-Authored-By: Enrique Rodríguez Valencia <enrique.rodriguez@galgus.net>
Co-Authored-By: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
(cherry picked from commit b4086f44cd)
The Bonanza Peak series are a couple of MT7986-powered 2.5 GBit/s
Wi-Fi 6 residential gateway, access point and mesh router products.
All of them come with an eMMC to boot from, are powered via USB-C and
got a USB 3.0 type-A port. All of them got a Dialog (Renesas) DA14531
Bluetooth module connected via UART. If the device was previously
running stock firmware, the BT chip's internal flash has been loaded
with firmware and it can be attached using hciattach when using
OpenWrt.
SOC: MediaTek MT7986A
RAM: 2 GiB DDR4
eMMC: 8 GiB
Bluetooth: BLE5 (DA14531)
Serial: 3.3V level, 115200 8n1 on 4-pin connector
* SDG-8612 - Dual-band RJ-45 gateway
2x 2.5G MaxLinear PHY for WAN port
3x 1GE LAN ports via MT7531 switch
* SDG-8614 - Dual-band SFP gateway
1x SFP cage with up to 2.5G speed
1x 2.5G MaxLinear PHY for LAN port
3x 1GE LAN ports via MT7531 switch
* SDG-8622 - Tri-band mesh router
2x 2.5G MaxLinear PHY
The MT7986 2G and 5G are used as 2G and 5G high band.
There’s a MT7915 PCIe card for 5G low band.
* SDG-8632 - Tri-band mesh router with 6 GHz
2x 2.5G MaxLinear PHY
The MT7986 serves the 2G and 6G bands.
There’s a MT7915 PCIe card for 5G.
Installation via U-Boot serial console:
0. setup TFTP server with IP 192.168.1.10/24, place initramfs image
renamed to openwrt.XXX where XXX is the internal product number:
SDG-8612: XXX = 412
SDG-8614: XXX = 414
SDG-8622: XXX = 422
SDG-8632: XXX = 432
1. connect to the serial console and power on the device.
Interrupt the bootloader by pressing 'st'
2. setenv boot_mode openwrt ; saveenv
3. run boot1
Load firmware via TFTP and write to flash
4. run boot2
Now OpenWrt initramfs should boot
5. upload sysupgrade.bin via scp to /tmp
6. sysupgrade
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 3aa686f8d4)
Openwrt supports hundreds of devices. These newly added LED colors
and functions can help developers better describe LED indicators.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
(cherry picked from commit 6c41c585e3)
Specifications:
SoC: MediaTek MT7981B
RAM: 256MiB
Flash: SPI-NAND 128 MiB
Switch: 1 WAN, 3 LAN (Gigabit)
Buttons: Reset, Mesh
Power: DC 12V 1A
WiFi: MT7976CN
UART: 115200n8
UART Layout:
VCC-RX-TX-GND
No. of Antennas: 6
Note: Upon opening the router, only 5 antennas were connected
to the mainboard.
Led Layout:
Power-Mesh-5gwifi-WAN-LAN3-LAN2-LAN1-2gWiFi
Buttons:
Reset-Mesh
Installation:
A. Through OpenWrt Dashboard:
If your router comes with OpenWrt preinstalled (modified by the seller),
you can easily upgrade by going to the dashboard (192.168.1.1) and then
navigate to System -> Backup/Flash firmware, then flash the firmware
B. Through TFTP
Standard installation via UART:
1. Connect USB Serial Adapter to the UART, (NOTE: Don't connect the VCC pin).
2. Power on the router. Make sure that you can access your router via UART.
3. Restart the router then repeatedly press ctrl + c to skip default boot.
4. Type > bootmenu
5. Press '2' to select upgrade firmware
6. Press 'Y' on 'Run image after upgrading?'
7. Press '0' and hit 'enter' to select TFTP client (default)
8. Fill the U-Boot's IP address and TFTP server's IP address.
9. Finally, enter the 'firmware' filename.
Signed-off-by: Ian Oderon <ianoderon@gmail.com>
(cherry picked from commit 4300bc6688)
Include XHCI USB drivers on the ZBT-Z8102AX router, the drivers are
required to be able to use the USB-connected M.2 slots for 4G/5G modems.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 507ad4f078)
The EnGenius EAP1300 and EAP1300EXT use identical boards and firmware
(as flashed) from the vendor.
As with the EAP1300, the EAP1300EXT requires a specific firmware version
to flash OpenWRT. Unfortunately, the required firmware is truncated on
the vendor's website.
A working file can be created as follows:
```
curl \
https://www.engeniustech.com/wp_firmware/eap1300-all-v3.5.3.5_c1.9.04.bin \
| perl -pe 's/\x09EAP1300_A/\x0cEAP1300EXT_A/' \
> eap1300ext-all-v3.5.3.5_c1.9.04.bin
```
The file should have sha256:
`58a1197a426139a12b03fd432334e677124cbe3384349bd7337f2ee71f1dcfd4`.
Please see commit 2b4ac79 for further
details.
The vendor firmware must be decrypted before it can be flashed from
OpenWRT. A tool able to do that is available from:
https://github.com/ryancdotorg/enfringement/blob/main/decrypt.py
Signed-off-by: Ryan Castellucci <code@ryanc.org>
(cherry picked from commit 85f6f88223)
Turns out the device got two buttons, while the currently listed on is
actually WPS, and the other (will hidden) button is intended as RESET.
Update DT accordingly.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 646ebbd32c)
The WS-AP3710i does not correctly expose its label-mac on eth0 anymore
since the change to simpleLoader.
Fix this by obtaining the label-mac from the U-Boot environment.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit e321e70ddc)
With the introduction of the simpleImage loader, the MAC address is not
set by the bootloader anymore.
Fix this by reading the MAC address from the U-Boot environment
partition.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 22f92cce22)
On master, the bootwrapper link-address for all simpleImage targets was
relocated to 0x15000000 due to growing kernel size.
This was not done on OpenWrt 23.05, as the decompressed kernel still
fits. However, with the wrapper for the WS-AP3710i, the bootloader
attempts execute in-place with the uImage load-address of 0x1000000. As
the image is compiled without the uImage header in mind, this naturally
fails.
In order to fix this, link the WS-AP3715i simpleImage at 0x15000000 as
done in master. This will force the bootloader to relocate the code to
the proper address and skip XIP.
Signed-off-by: David Bauer <mail@david-bauer.net>
All NETGEAR EX6150v2 validate the rootfs for which OpenWrt places a
fakeheader at the position, where the bootloader expects it.
Some EX6150v2 bootloaders do however make a broken assumption about
where the rootfs starts. This is due to them calculating the rootfs
start not based upon the kernel-length but the string-offset of the
FIT-image.
We have to be compatible with both this broken as well as the valid
calculation. So we do relocate the FDT string section to a
block-boundary and enlarge the FIT image to end at this boundary +
BLOCKSIZE / 2. This way, both the broken as well as correct calculations
do expect the rootfs-header at the same position.
It is worth noting, that this is a rare edge-case in which only happens
if the image-length as well as the start of the string-section are not
placed in the same erase-block. This is an edge-case which happens very
rarely (thus it was not spotted prior).
Affected:
- U-Boot 2012.07 (Jun 16 2016 - 11:59:37)
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit de59fc4540)
Hardware
--------
CPU: Freescale P1020 2xe500 PPC
RAM: 256M DDR3 (Micron MT41J64M16JT-15E:G "D9MNJ")
NAND: 128M (Micron 2CA1)
BTN: 1x Reset
LED: Power - ETH - Radio1 - Radio2
UART: RJ-45 Cisco Pinout - 115200 8N1
Installation
------------
NOTE: You can find a repo with up-to-date instructions as well as
the required files here:
https://github.com/blocktrron/msm460-flashing
Required files
==============
You need a command-files as well as a U-Boot image.
The command-file has the following content (padded to 131072 bytes).
If you copy paste these, remove the newlines!
```
U-BOOT setenv ethaddr 02:03:04:05:06:07; setenv ipaddr 192.168.1.1;
setenv serverip 192.168.1.66; tftpboot 0x3000000 msm460-uboot.bin;
nand device; nand erase 0 0xC0000; nand write 0x3000000 0x0 0xC0000; reset
```
You can download the required U-Boot from this repository:
https://github.com/blocktrron/u-boot-msm/releases
Preparation
===========
Prepare a TFTP server serving two files:
- U-Boot NAND image as `msm460-uboot.bin`.
- OpenWrt factory image as `msm460-factory.bin`
- Command-file names `commands.tftp`
You can start a TFTP server in the current directory using dnsmasq:
```bash
sudo dnsmasq --no-daemon --listen-address=0.0.0.0 \
--port=0 --enable-tftp=enxd0 --tftp-root="$(pwd)" \
--user=root --group=root
```
Replace `enxd0` with the name of your network interface.
Procedure
=========
1. Assign yourself the IP-Address 192.168.1.66/24.
3. Connect the Router to the PC while keeping the reset button
pressed.
4. The LEDs will eventually begin to flash.
They will start to flash faster after around 15 seconds.
5. Release the reset button.
6. Start a new shell
7. Make sure you are currently in the directory where the tftp server
is located.
8. Run the following command:
```bash
tftp 192.168.1.1 -m binary -c put commands.tftp nflashd.cccc9999
```
You get the message "Transfer timed out."
To find out if you have been successful, please check the
blinking LED Pattern.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit af329ec389)
Signed-off-by: David Bauer <mail@david-bauer.net>
