TP-Link RE205 v3 is a wireless range extender with Ethernet and 2.4G and 5G
WiFi with external antennas.
It's based on MediaTek MT7628AN+MT7610EN like the RE200 v3/v4 but with
external antennas.
Specifications
--------------
- MediaTek MT7628AN (580 Mhz)
- 64 MB of RAM
- 8 MB of FLASH
- 2T2R 2.4 GHz and 1T1R 5 GHz
- 1x 10/100 Mbps Ethernet
- 5x LED (GPIO-controlled), 2x button
- UART connection holes on PCB (57600 8n1)
There are 2.4G and 5G LEDs in blue which are controlled separately.
Installation
------------
Installation is identical to RE200 v3 devices as described at
https://openwrt.org/toh/tp-link/re200#installation
Web Interface
-------------
It is possible to upgrade to OpenWrt via the web interface. Simply flash
the -factory.bin from OEM. In contrast to a stock firmware, this will not
overwrite U-Boot.
Recovery
--------
U-Boot seems to be locked on newer versions, if not it can be accessed over
the UART as described in the link above.
Signed-off-by: Steffen Loley <slo-src@web.de>
With kernel 6.1 image size is too large for Edgerouter X current size
limit and is causing the buildbots to fail building so images for other
devices are not updated as well.
So, disable building Edgerouter X images until a workaround is found.
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit adds support for Z-ROUTER ZR-2660 (also known as Routerich
AX1800) wireless WiFi 6 router.
Specification
-------------
- SoC : MediaTek MT7621AT, MIPS, 880 MHz
- RAM : 256 MiB
- Flash : NAND 128 MiB (AMD/Spansion S34ML01G2)
- WLAN :
- 2.4 GHz : MediaTek MT7905D/MT7975 (14c3:7916), b/g/n/ax, MIMO 2x2
- 5 GHz : MediaTek MT7915E (14c3:7915), a/n/ac/ax, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x4 (1x WAN, 3x LAN)
- USB : 1x 2.0
- UART : 3.3V, 115200n8, pins are silkscreened on the pcb
- Buttons : 1x Reset
- LEDs : 1x WiFi 2.4 GHz (green)
1x WiFi 5 GHz (green)
1x LAN (green)
1x WAN (green)
1x WAN no-internet (red)
- Power : 12 VDC, 1 A
Installation
------------
1. Run tftp server on your PC (IP: 192.168.2.2) and put OpenWrt initramfs
image (initramfs.bin) to the tftp root dir
2. Open the following link in the browser to enable telnet:
http://192.168.2.1/cgi-bin/telnet_ssh
3. Connect to the router (default IP: 192.168.2.1) using telnet shell
(credentials - user:admin)
4. Run the following commands in the telnet shell (this will install
OpenWrt initramfs image on nand flash):
cd /tmp
tftp -g -r initramfs.bin 192.168.2.2
mtd write initramfs.bin firmware
mtd erase firmware_backup
reboot
5. Copy OpenWrt sysupgrade image (sysupgrade.bin) to the /tmp dir of the
router
6. Connect to the router (IP: 192.168.1.1) using ssh shell and run
sysupgrade command:
sysupgrade -n /tmp/sysupgrade.bin
Return to stock
---------------
1. Copy stock firmware (stock.bin) to the /tmp dir of the router using scp
2. Run following command in the router shell:
cd /tmp
mtd write stock.bin firmware
reboot
Recovery
--------
Connect uart (pins are silkscreened on the pcb), interrupt boot process by
pressing any key, use u-boot menu to flash stock firmware image or OpenWrt
initramfs image.
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 24:0f:5e:xx:xx:4c | label |
| WAN | 24:0f:5e:xx:xx:4d | label+1 |
| WLAN 2g | 24:0f:5e:xx:xx:4e | label+2 |
| WLAN 5g | 24:0f:5e:xx:xx:4f | label+3 |
+---------+-------------------+-----------+
The WLAN 2.4 MAC was found in 'factory', 0x4
The LAN MAC was found in 'factory', 0xfff4
The WAN MAC was found in 'factory', 0xfffa
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
The YunCore G720 is a dual band 802.11ax router with 5 GbE ports.
Specs:
- SoC: MediaTek MT7621
- Ethernet: 5x GbE ports (built-in MT7530)
- Wireless 2.4GHz / 5GHz: MediaTek MT7915E
- RAM: 256MiB
- ROM: 16MiB (W25Q128)
- 1 Button (reset)
- 8 LEDs (1x system, 2x wifi, 5x switch ports)
Flash instructions:
The vendor firmware is based on OpenWrt, the sysupgrade image can be
flashed using the '-F' (force) option on the CLI.
Make sure not to keep settings when doing so.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* Increase flash SPI frequency to 50MHz
The maximum SPI frequency of MX25L6406EM2I is 86 MHz,
but in this patch 50 MHz was chosen as a safe value.
* Update Ethernet MAC addresses
Till now LAN/WAN MAC addresses were flipped
compared to stock firmware.
* Fix Wi-Fi LEDs by adding mt76 led nodes
* Fix LAN port order
LAN ports are in reverse order of switch ports.
* Fix the well-known "LZMA ERROR 1" error by using lzma-loader
* Set uImage name, which enables installation via stock web interface:
1. Upload **initramfs** image file to the web page.
2. Boot into OpenWrt and perform sysupgrade with sysupgrade image.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Unlike the recovery image, this initramfs-factory image can be flashed
using the stock firmware web interface (from any active boot partition),
as well as the bootloader recovery web page. Drop the recovery image in
favor of the factory image.
Installation via stock/recovery web interface:
1. Flash **initramfs-factory** image through the web page.
2. Boot into OpenWrt and perform sysupgrade with sysupgrade image.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
The "0x80001000" address logically comes from "loadaddr-y" variable for
mt7621 subtarget. Let's replace the hardcoded value with the predefined
variable. This change is purely cosmetic.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Contrary to common ipTIME NOR devices, the "Config" partition of T5004
and AX2004M contain normal U-Boot environment variables. Renaming the
partition into "u-boot-env" serves for better description, and it also
conforms to common naming practice in OpenWrt.
This patch might also be extended to A3004T, but its u-boot-env
partition layout has not been confirmed yet.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
AX2004M uses NMBM on its NAND flash, but it was not enabled in DTS as the
device support [1] had been added before NMBM feature in mtk_bmt driver [2].
Let's enable it now.
With this change, there is a low possibility of boot failure after
sysupgrade from older versions. As AX2004M already has gone through
two stable releases in the meantime, it would be safe to warn users
by bumping DEVICE_COMPAT_VERSION.
[1] 37753f34ac ("ramips: add support for ipTIME AX2004M")
[2] 06382d1af7 ("kernel: add support for mediatek NMBM flash mapping support")
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
TP-Link Archer C5 v4 is a dual band router with 5 GbE ports
Advertised as AC1200 for its 867Mbps (2x2) 5GHz band
and 300 Mbps (2x2) 2.4GHz band.
Specs:
- SoC: MediaTek MT7620A
- Ethernet: 5x GbE ports (Realtek RTL8367S)
- Wireless 2.4GHz: MediaTek MT7620A
- Wireless 5GHz: MediaTek MT7612E
- RAM: 64MiB
- ROM: 8MiB (GD25Q64CSIG)
- 1 USB 2.0 port
- 2 Buttons (WPS and reset)
- 8 LEDs
Flash instructions:
Currently one has to install OpenWrt only via the serial console
1. Rename the factory.bin to to test.bin
2. start a TFTP server from IP address 192.168.0.225 and serve the image named test.bin
3. connect your device to the LAN port
4. power up the router and press 4 on the console to stop the boot process.
5. enter the following commands on the router console
tftp 0x80060000 test.bin
erase tplink 0x20000 0x7a0000
cp.b 0x80060000 0x20000 0x7a0000
reset
Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
[Update leds, add fast-read]
Signed-off-by: Gaspare Bruno <gaspare@anlix.io>
[Rebuilt version based on mt7620 tplink_archer.dtsi, support for external LNA, remove bad cell count info]
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
The U-Boot binary for the RAVPower RP-WD009 has been renamed.
In order to be uniform with all other U-Boot binaries generated the SoC type has been prepended.
Set that new name also in the image build recipe for that device in order to fix build.
Fixes: 927334a8f7 ("uboot-mediatek: add basic build for ZBT-WG3526 (MT7621, 16M SPI-NOR)")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
TP-Link RE365 is a wireless range extender, hardware-wise resembles
RE305 with slight changes regarding buttons and LEDs.
Specification
SoC: MediaTek MT7628AN
RAM: 64 MiB DDR2
Flash: 8 MiB SPI NOR
WiFi: 2.4 GHz 2T2R integrated
5 GHz 2T2R MediaTek MT7612EN conncted to PCIe lanes
Ethernet: 1x 10/100 Mbps integrated
LEDs: 6x GPIO controlled
Buttons: 4x GPIO controlled
UART: row of 4 holes marked on PCB as J1, starting count from white
triangle
1. VCC (3.3V), 2. GND, 3. RX, 4. TX
baud: 57600, parity: none, flow control: none
Installation
1. Open web management interface.
2. Go to Settings > System Tools > Firmware upgrade.
3. Select "Browse" and select the OpenWrt image with factory.bin suffix.
4. After selecting "Upgrade" firmware writing process will start.
5. Wait till device reboots, power LED should stay solid when it's fully
booted, then it's ready for configuration through LAN port.
Additional information
With how device manufacturer patrtitioned the flash memory, it's possible
that with default packages set, initial factory.bin image won't be
created. In such case, try to reduce packages amount or use older release
for initial conversion to OpenWrt. Later You can use sysupgrade.bin
image with full set of packages because OpenWrt uses unpartitioned flash
memory space unused by vendor firmware.
Reverting to vendor firmware involves converting firmware using
tplink-safeloader with -z option (can be found in ImageBuilder or SDK)
and forcibly applying converted firmware as sysupgrade.
Known issues
WARNING: after removing casing of the device one is exposed to high
voltage and is in a risk of being electrocuted.
Caution when interfacing whith bootloader, saving its environment either
by issuing "saveenv" or selecting option "1: Load system code to SDRAM
via TFTP." in boot menu, any of those will lead to overwriting part of
kernel. This will lead to need of firmware recovery. The cause of this
issue is bootloader having environment offset on flash at 0x40000,
while kernel starts from 0x20000.
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
[Wrap long line in DTS]
Signed-off-by: Sander Vanheule <sander@svanheule.net>
The rt305x series SOC have two UART devices,
and the one at bus address 0x500 is disabled by default.
Some boards do not even have a pinout for the first one,
so use the same one that the kernel uses at 0xc00 instead.
This allows the lzma-loader printing to be visible
alongside the kernel log in the same console.
Tested-by: Lech Perczak <lech.perczak@gmail.com> # zte,mf283plus
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Before this was reworked, in the file for mt7621 subtarget
(target/linux/ramips/image/lzma-loader/src/board-mt7621.c)
the "Transmitter shift register empty" bit TEMT was used instead of
the "Transmitter holding register empty" bit THRE,
but after the rework, this value was labeled as the THRE bit instead.
Functionally there is no difference, but this is confusing to read,
as it suggests that the subtargets have different bits for the same
register in UART when in reality they are exactly the same.
One can use either bit, or both, at user's descretion
in order to determine whether the UART TX buffer is ready.
The generic kernel early-printk uses both,
(arch/mips/kernel/early_printk_8250.c)
while the ralink-specific early-printk uses only THRE,
(arch/mips/ralink/early_printk.c).
Define both bits and rewrite macros for readability,
keep the same values, as changing which to use should be tested first.
Ref: c31319b66 ("ramips: lzma-loader: Refactor loader")
Signed-off-by: Michael Pratt <mcpratt@pm.me>
The native bus address for UART was entered for rt305x UART_BASE,
but the bootloaders have memory space remapped with the same
virtual memory map the kernel uses for program addressing at boot time.
In UBoot, the remapped address is often defined as TEXT_BASE.
In the kernel, for rt305x this remapped address is RT305X_SYSC_BASE.
(arch/mips/include/asm/mach-ralink/rt305x.h)
Because the ralink I/O busses begin at a low address of 0x10000000,
they are remapped using KSEG0 or KSEG1, which for all 32-bit MIPS SOCs
(arch/mips/include/asm/addrspace.h)
are offsets of 0x80000000 and 0xa0000000 respectively.
This is consistent with the other UART_BASE macros here
and with MIPS memory map documentation.
Before the recent rework of the lzma-loader for ramips,
the original board-$(PLATFORM).c files also did not
use KSEG1ADDR for UART_BASE despite being defined,
which made this mistake easier to occur.
Fix this by defining KSEG1ADDR again and actually use it.
Copy and paste from the kernel's macros for consistency.
Link: https://training.mips.com/basic_mips/PDF/Memory_Map.pdf
Fixes: c31319b66 ("ramips: lzma-loader: Refactor loader")
Reported-by: Lech Perczak <lech.perczak@gmail.com>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Seems to be very similar to: https://openwrt.org/toh/tp-link/tl-wr902ac_v3
1 x usb
1 x eth
Powered by mini usb port.
Installation:
Can use TFTP method to install:
1. establish TFTP server at 192.168.0.66
2. provide tp_recover.bin file to the TFTP server
3. turn on router with reset button pressed
4. wait for led blinking, then release reset
Specification based on dmesg from already flashed device:
SoC Type: MediaTek MT7628AN ver:1 eco:2
CPU0 revision is: 00019655 (MIPS 24KEc)
Memory: 56028K/65536K available
CPU Clock: 580MHz
WiFi: MT7613BE
MAC addresses are all the same, except wifi5g which last part is decrement by one, ie.:
eth0 40:ed:00:cf:b9:9b
br-lan 40:ed:00:cf:b9:9b
phy0-ap0 40:ed:00:cf:b9:9b
phy1-ap0 40:ed:00:cf:b9:9a
Signed-off-by: Kamil Jońca <kjonca@onet.pl>
Rostelecom RT-FE-1A is a wireless WiFi 5 router manufactured by Sercomm
company.
Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 256 MiB
Flash: 128 MiB
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7615E): a/n/ac, 4x4
Ethernet: 5x GbE (WAN, LAN1, LAN2, LAN3, LAN4)
USB ports: No
Button: 2 buttons (Reset & WPS)
LEDs:
- 1x Power (green, unmanaged)
- 1x Status (green, gpio)
- 1x 2.4G (green, hardware, mt76-phy0)
- 1x 2.4G (blue, gpio)
- 1x 5G (green, hardware, mt76-phy1)
- 1x 5G (blue, gpio)
- 5x Ethernet (green, hardware, 4x LAN & WAN)
Power: 12 VDC, 1.5 A
Connector type: barrel
Bootloader: U-Boot
Installation
-----------------
1. Login to the router web interface (default http://192.168.0.1/)
under "admin" account
2. Navigate to Settings -> Configuration -> Save to Computer
3. Decode the configuration. For example, using cfgtool.py tool (see
related section):
cfgtool.py -u configurationBackup.cfg
4. Open configurationBackup.xml and find the following block:
<OBJECT name="User." type="object" writable="1" encryption="0" >
<OBJECT name="1." type="object" writable="1" encryption="0" >
<PARAMETER name="Password" type="string" value="<some value>" writable="1" encryption="1" password="1" />
</OBJECT>
5. Replace <some value> by a new superadmin password and add a line
which enabling superadmin login after. For example, the block after
the changes:
<OBJECT name="User." type="object" writable="1" encryption="0" >
<OBJECT name="1." type="object" writable="1" encryption="0" >
<PARAMETER name="Password" type="string" value="s0meP@ss" writable="1" encryption="1" password="1" />
<PARAMETER name="Enable" type="boolean" value="1" writable="1" encryption="0"/>
</OBJECT>
6. Encode the configuration. For example, using cfgtool.py tool:
cfgtool.py -p configurationBackup.xml
7. Upload the changed configuration (configurationBackup_changed.cfg) to
the router
8. Login to the router web interface (superadmin:xxxxxxxxxx, where
xxxxxxxxxx is a new password from the p.5)
9. Enable SSH access to the router (Settings -> Access control -> SSH)
10. Connect to the router using SSH shell using superadmin account
11. Run in SSH shell:
sh
12. Make a mtd backup (optional, see related section)
13. Change bootflag to Sercomm1 and reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
reboot
14. Login to the router web interface under admin account
15. Remove dots from the OpenWrt factory image filename
16. Update firmware via web using OpenWrt factory image
Revert to stock
---------------
Change bootflag to Sercomm1 in OpenWrt CLI and then reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
mtd backup
----------
1. Set up a tftp server (e.g. tftpd64 for windows)
2. Connect to a router using SSH shell and run the following commands:
cd /tmp
for i in 0 1 2 3 4 5 6 7 8 9; do nanddump -f mtd$i /dev/mtd$i; \
tftp -l mtd$i -p 192.168.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done
tftp -l mtd.md5 -p 192.168.0.2
MAC Addresses
-------------
+-----+------------+---------+
| use | address | example |
+-----+------------+---------+
| LAN | label | f4:*:66 |
| WAN | label + 11 | f4:*:71 |
| 2g | label + 2 | f4:*:68 |
| 5g | label + 3 | f4:*:69 |
+-----+------------+---------+
The label MAC address was found in Factory, 0x21000
cfgtool.py
----------
A tool for decoding and encoding Sercomm configs.
Link: https://github.com/r3d5ky/sercomm_cfg_unpacker
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Add the make function 'exp_units' for helping evaluate k/m/g size units in
expressions, and use this to consistently replace many ad hoc substitutions
like '$(subst k,* 1024,$(subst m, * 1024k,$(IMAGE_SIZE)))' in makefiles.
Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
This device is very similar, if not identical, to the TP-Link AX23 v1
but is targeted at service providers and features a completely different
flash layout.
Hardware
--------
CPU: MediaTek MT7621 DAT
RAM: 128MB DDR3 (integrated)
FLASH: 16MB SPI-NOR
WiFi: MediaTek MT7905 + MT7975 (2.4 / 5 DBDC) 802.11ax
SERIAL: 115200 8N1
LEDs - (3V3 - GND - RX - TX) - ETH ports
Installation
------------
Flashing is only possible via a serial connection using the sysupgrade
image; the factory image must be signed. You can flash the sysupgrade
image directly through the U-Boot console, or preferably, by booting the
initramfs image and flashing with the sysupgrade command. Follow these
steps for sysupgrade flashing:
1. Establish a UART serial connection.
2. Set up a TFTP server at 192.168.0.2 and copy the initramfs image
there.
3. Power on the device and press any key to interrupt normal boot.
4. Load the initramfs image using tftpboot.
5. Boot with bootm.
6. If you haven't done so already, back up all stock mtd partitions.
7. Copy the sysupgrade image to the router.
8. Flash OpenWrt through either LuCI or the sysupgrade command. Remember
not to attempt saving settings.
Revert to stock firmware
------------------------
Flash stock firmware via OEM web-recovery mode. If you don't have access
to the stock firmware image, you will need to restore the firmware
partition backed up earlier.
Web-Recovery
------------
The router supports an HTTP recovery mode:
1. Turn off the router.
2. Press the reset button and power on the device.
3. When all LEDs start flashing, release reset and quickly press it
again.
The interface is reachable at 192.168.0.1 and supports installation of
the OEM factory image. Note that flashing OpenWrt this way is not
possible, as mentioned above.
Signed-off-by: Darlan Pedro de Campos <darlanpedro@gmail.com>
Specifications:
- SoC: MediaTek MT7621AT
- RAM: 128 MB (DDR3)
- Flash: 16 MB (SPI NOR)
- WiFi: MediaTek MT7603E, MediaTek MT7613BE
- Switch: 1 WAN, 4 LAN (Gigabit)
- Buttons: Reset, WPS
- LEDs: System, Wan, Lan 1-4, WiFi 2.4G, WiFi 5G, WPS
- Power: DC 12V 1A tip positive
Download and flash the manufacturer's built OpenWRT image available at
http://www.cudytech.com/openwrt_software_download
Install the new OpenWRT image via luci (System -> Backup/Flash firmware)
Be sure to NOT keep settings. The force upgrade may need to be checked
due to differences in router naming conventions.
Cudy WR1300 v3 differs from v2 only in swapped WiFi chip PCIe slots. Common
nodes are extracted to .dtsi and new v2 and v3 dts are created.
Cudy WR1300 v2 dts now contains ieee80211-freq-limit and has
eeprom_factory_8000 length fixed.
The same manufacturer's built OpenWRT image is provided for both v2 and v3
devices as a step in installing, but for proper WiFi functionality,
a separate build is required.
Recovery:
- Loads only signed manufacture firmware due to bootloader RSA verification
- serve tftp-recovery image as /recovery.bin on 192.168.1.88/24
- connect to any lan ethernet port
- power on the device while holding the reset button
- wait at least 8 seconds before releasing reset button for image to
download
- See http://www.cudytech.com/newsinfo/547425.html
Signed-off-by: Filip Milivojevic <zekica@gmail.com>
This commit adds support for following wireless routers:
- Rostelecom RT-FL-1 (Serсomm RT-FL-1)
- Rostelecom S1010 (Serсomm S1010.RT)
The devices are almost identical and the only difference is one bit in the
factory image PID (thanks to Maximilian Weinmann <x1@disroot.org>
(@MaxS0niX) for the info and idea to make one PR for two devices at once).
Devices specification
---------------------
SoC: MediaTek MT7620A, MIPS
RAM: 64 MB
Flash: 16 MB SPI NOR
Wireless 2.4: MT7620 (b/g/n, 2x2)
Wireless 5: MT7612EN (a/n/ac, 2x2)
Ethernet: 5xFE (WAN, LAN1-4)
BootLoader: U-Boot
Buttons: 2 (wps, reset)
LEDs: 1 amber and 1 green status GPIO leds
5 green ethernet GPIO leds
1 green GPIO 2.4 GHz WLAN led
1 green PHY 5 GHz WLAN led
1 green unmanaged power led
USB ports: No
Power: 12 VDC, 1 A
Connector: Barrel
OEM easy installation
---------------------
1. Remove all dots from the factory image filename (except the dot
before file extension)
2. Upload and update the firmware via the original web interface
3. Wait until green status led stops blinking (can take several minutes)
4. Login to OpenWrt initramsfs. It's recommended to make a backup of the
mtd partitions at this point.
4. Perform sysupgrade using the following command (or use Luci):
sysupgrade -n sysupgrade.bin
5. Wait until green status les stops blinking (can take several minutes)
6. Mission acomplished
Return to Stock
---------------
Option 1. Restore firmware Slot1 from a backup (firmware2.bin):
cd /tmp
mtd -e Firmware2 write firmware2.bin Firmware2
printf 1 | dd bs=1 seek=$((0x18007)) count=1 of=/dev/mtdblock2
reboot
Option 2. Decrypt, ungzip and split stock firmware image into the parts,
take Slot1 parts (kernel2.bin, rootfs2.bin) and write them:
cd /tmp
mtd -e Kernel2 write kernel2.bin Kernel2
mtd -e RootFS2 write rootfs2.bin RootFS2
printf 1 | dd bs=1 seek=$((0x18007)) count=1 of=/dev/mtdblock2
reboot
More about stock firmware decryption:
Link: https://github.com/Psychotropos/sercomm_fwutils/
Debricking
----------
Use sercomm-recovery tool. You can use "ALL" mtd partition backup as a
recovery image.
Link: https://github.com/danitool/sercomm-recovery
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| label | 48:3e:xx:xx:xx:1e | label |
| LAN | 48:3e:xx:xx:xx:1e | label |
| WAN | 48:3e:xx:xx:xx:28 | label+10 |
| WLAN 2g | 48:3e:xx:xx:xx:20 | label+2 |
| WLAN 5g | 48:3e:xx:xx:xx:24 | label+6 |
+---------+-------------------+-----------+
Co-authored-by: Vadzim Vabishchevich <bestmc2009@gmail.com>
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
This commit makes a common recipe to set bit in Sercomm factory pid since
this is necessary for several devices (WiFire S1500.nbn, Rostelecom
RT-FL-1) at different offsets.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Three fixes for D-Link DAP-1620 rev B and its twin D-Link DRA-1360:
1. `uboot-envtools` is removed from default package list.
2. Makefile variable is doubly escaped, i.e. `$$$$(DLINK_HWID)`.
3. Previously the size of `factory.bin` was always 10.5 MiB, same as
D-Link firmwares. This commit makes it possible to use smaller images
(with no lost space due to padding) as well as larger images. Tested
successfully flashing a 6.5 MiB image and a 14.5 MiB image.
Recall that factory images need to be installed via D-Link Web Recovery
(at http://192.168.0.50/, server ignores pings and DHCP requests).
P.S.
I implemented the OEM firmware encryption algorithm, so firmware can be
flashed via OEM firmware, but after successful flashing the device
reboots to web recovery, so further debugging is required.
Signed-off-by: Rani Hod <rani.hod@gmail.com>
This adds support for the TP-Link Archer C50 v6 (CA/EU/RU).
(The ES variant is a rebranded Archer C54 and NOT supported.)
CPU: MediaTek MT7628 (580MHz)
RAM: 64M DDR2
FLASH: 8M SPI
WiFi: 2.4GHz 2x2 MT7628 b/g/n integrated
WiFi: 5GHz 2x2 MT7613 a/n/ac
ETH: 1x WAN 4x LAN
LED: Power, WiFi2, WiFi5, LAN, WAN, WPS
BTN: WPS/WiFi, RESET
UART: Near ETH ports, 115200 8n1, TP-Link pinout
Create Factory image
--------------------
As all installation methods require a U-Boot to be integrated into the
image (and we do not ship one with the image). We are not able to create
an image in the OpenWRT build-process.
Download a TP-Link image for your device variant (CA/EU or RU) from their
website and a OpenWRT sysupgrade image for the device
and build yourself a factory image like following:
TP-Link image: tpl.bin
OpenWRT sysupgrade image: owrt.bin
> dd if=tpl.bin of=boot.bin bs=131584 count=1
> cat owrt.bin >> boot.bin
Installing via Web-UI
---------------------
Upload the boot.bin via TP-Links firmware upgrade tool in the
web-interface.
Installing via Recovery
-----------------------
Activate Web-Recovery by beginning the upgrade Process with a
Firmware-Image from TP-Link. After starting the Firmware Upgrade,
wait ~3 seconds (When update status is switching to 0%), then
disconnect the power supply from the device. Upgrade flag (which
activates Web-Recovery) is written before the OS-image is touched and
removed after write is succesfull, so this procedure should be safe.
Plug the power back in. It will come up in Recovery-Mode on 192.168.0.1.
When active, all LEDs but the WPS LED are off.
Remeber to assign yourself a static IP-address as DHCP is not active in
this mode.
The boot.bin can now be uploaded and flashed using the web-recovery.
Installing via TFTP
-------------------
Prepare an image like following (Filenames from factory image steps
apply here)
> dd if=/dev/zero of=tp_recovery.bin bs=196608 count=1
> dd if=tpl.bin of=tmp.bin bs=131584 count=1
> dd if=tmp.bin of=boot.bin bs=512 skip=1
> cat boot.bin >> tp_recovery.bin
> cat owrt.bin >> tp_recovery.bin
Place tp_recovery.bin in root directory of TFTP server and listen on
192.168.0.66/24.
Connect router LAN ports with your computer and power up the router
while pressing the reset button. The router will download the image via
tftp and after ~1 Minute reboot into OpenWRT.
U-Boot CLI
----------
U-Boot CLI can be activated by holding down '4' on bootup.
Dual U-Boot
-----------
This is the first TP-Link MediaTek device to feature a split-uboot
design. The first (factory-uboot) provides recovery via TFTP and HTTP,
jumping straight into the second (firmware-uboot) if no recovery needs
to be performed. The firmware-uboot unpacks and executed the kernel.
Web-Recovery
------------
TP-Link integrated a new Web-Recovery like the one on the Archer C7v4 /
TL-WR1043v5. Stock-firmware sets a flag in the "romfile" partition
before beginning to write and removes it afterwards. If the router boots
with this flag set, bootloader will automatically start Web-recovery and
listens on 192.168.0.1. This way, the vendor-firmware or an OpenWRT
factory image can be written.
By doing the same while performing sysupgrade, we can take advantage of
the Web-recovery in OpenWRT.
It is important to note that Web-Recovery is only based on this flag. It
can't detect e.g. a crashing kernel or other means. Once activated it
won't boot the OS before a recovery action (either via TFTP or HTTP) is
performed. This recovery-mode is indicated by an illuminated WPS-LED on
boot.
Co-authored-by: Julius Schwartzenberg <julius.schwartzenberg@gmail.com>
Signed-off-by: Renaud Gaspard <gaspardrenaud@hotmail.com>
Signed-off-by: Julius Schwartzenberg <julius.schwartzenberg@gmail.com>
Tested-by: Julius Schwartzenberg <julius.schwartzenberg@gmail.com>
Tested-by: Jaroslav Mikulík <byczech@gmail.com>
Tested-by: Ashipa Eko <ashipa.eko@gmail.com>
The COVR-X1860 are MT7621-based AX1800 devices (similar to DAP-X1860, but
with two Ethernet ports and external power supply) that are sold in sets
of two (COVR-X1862) and three (COVR-X1863).
Specification:
- MT7621
- MT7915 + MT7975 2x2 802.11ax (DBDC)
- 256MB RAM
- 128 MB flash
- 3 LEDs (red, orange, white), routed to one indicator in the top of the device
- 2 buttons (WPS in the back and Reset at the bottom of the device)
MAC addresses:
- LAN MAC (printed on the device) is stored in config2 partition as ASCII (entry factory_mac=xx:xx:xx:xx:xx:xx)
- WAN MAC: LAN MAC + 3
- 2.4G MAC: LAN MAC + 1
- 5G MAC: LAN MAC + 2
The pins for the serial console are already labeled on the board (VCC, TX, RX, GND). Serial settings: 3.3V, 115200,8n1
Flashing via OEM Web Interface:
- Download openwrt-ramips-mt7621-dlink_covr-x1860-a1-squashfs-factory.bin via the OEM web interface firmware update
- The configuration wizard can be skipped by directly going to http://192.168.0.1/UpdateFirmware_Simple.html
Flashing via Recovery Web Interface:
- Set your IP address to 192.168.0.10, subnetmask 255.255.255.0
- Press the reset button while powering on the deivce
- Keep the reset button pressed until the status LED blinks red
- Open a Chromium based browser and goto http://192.168.0.1
- Download openwrt-ramips-mt7621-dlink_covr-x1860-a1-squashfs-recovery.bin
Revert back to stock using the Recovery Web Interface:
- Set your IP address to 192.168.0.10, subnetmask 255.255.255.25
- Press the reset button while powering on the deivce
- Keep the reset button pressed until the status LED blinks red
- Open a Chromium based browser and goto http://192.168.0.1
- Flash a decrypted firmware image from D-Link. Decrypting an firmware image is described below.
Decrypting a D-Link firmware image:
- Download https://github.com/openwrt/firmware-utils/blob/master/src/dlink-sge-image.c and https://raw.githubusercontent.com/openwrt/firmware-utils/master/src/dlink-sge-image.h
- Compile a binary from the downloaded file, e.g. gcc dlink-sge-image.c -lcrypto -o dlink-sge-image
- Run ./dlink-sge-image COVR-X1860 <OriginalFirmware> <OutputFile> -d
- Example for firmware 102b01: ./dlink-sge-image COVR-X1860 COVR-X1860_RevA_Firmware_102b01.bin COVR-X1860_RevA_Firmware_102b01_Decrypted.bin -d
The pull request is based on the discussion in https://forum.openwrt.org/t/add-support-for-d-link-covr-x1860
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
This fixes a well known "LZMA ERROR 1" error on Sercomm NA502,
reported on the OpenWrt forum. [1]
[1]: https://forum.openwrt.org/t/176942
Signed-off-by: Szabolcs Hubai <szab.hu@gmail.com>
creates SGE encrypted factory images
to use via the D-Link web interface
rename the old factory unencrypted images to recovery
for use in the recovery console when recovery is needed
DIR-1935-A1 , DIR-853-A1 , DIR-853-A3 , DIR-867-A1 ,
DIR-878-A1 and DIR-882-A1
Signed-off-by: Alan Luck <luckyhome2008@gmail.com>
Hardware:
- SoC: Mediatek MT7621 (MT7621AT)
- Flash: 32 MiB SPI-NOR (Macronix MX25L25635E)
- RAM: 128 MiB
- Ethernet: Built-in, 2 x 1GbE
- 3G/4G Modem: MEIG SLM828 (currently only supported with ModemManager)
- SLIC: Si32185 (unsupported)
- Power: 12V via barrel connector
- Wifi 2.4GHz: Mediatek MT7603BE 802.11b/g/b
- Wifi 5GHz: Mediatek MT7613BE 802.11ac/n/a
- LEDs: 8x (7 controllable)
- Buttons: 2x (RESET, WPS)
Installing OpenWrt:
- sysupgrade image is compatible with vendor firmware.
Recovery:
- Connect to any of the Ethernet ports, configure local IP:
10.10.10.3/24 (or 192.168.10.19/24, depending on OEM)
- Provide firmware file named 'mt7621.img' on TFTP server.
- Hold down both, RESET and WPS, then power on the board.
- Watch network traffic using tcpdump or wireshark in realtime to
observe progress of device requesting firmware. Once download has
completed, release both buttons and wait until firmware comes up.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
HiWiFi HC5861 has a GbE port which connected to the RTL8211E PHY
chip. This patch adds the missing Realtek PHY driver package and
sets the correct external PHYs base address to make it work again.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Telco Electronics X1 has MT7603E and MT7612E PCIe NICs. They are
driven by kmod-mt7603 and kmod-mt76x2.
Ref: 73e0f52b6e ("ramips: add support for Telco Electronics X1")
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Add support for COMFAST CF-EW72 V2
Hardware:
- SoC: Mediatek MT7621 (MT7621DAT or MT7621AT)
- Flash: 16 MiB NOR
- RAM: 128 MiB
- Ethernet: Built-in, 2 x 1GbE
- Power: only 802.3af PD on any port, injector supplied in the box
- PoE passthrough: No
- Wifi 2.4GHz: Mediatek MT7603BE 802.11b/g/b
- Wifi 5GHz: Mediatek MT7613BEN 802.11ac/n/a
- LEDs: 8x (only 1 is both visible and controllable, see below)
- Buttons: 1x (RESET)
Installing OpenWrt:
Flashing is done using Mediatek U-Boot System Recovery Mode
- make wired connection with 2 cables like this:
- - PC (LAN) <-> PoE Injector (LAN)
- - PoE Injector (POE) <-> CF-EW72 V2 (LAN). Leave unconnected to CF-EW72 V2 yet.
- configure 192.168.1.(2-254)/24 static ip address on your PC LAN
- press and keep pressed RESET button on device
- power the device by plugging PoE Injector (POE) <-> CF-EW72 V2 (LAN) cable
- wait for about 10 seconds until wifi led stops blinking and release RESET button
- navigate from your PC to http://192.168.1.1 and upload OpenWrt *-factory.bin firmware file
- proceed until router starts blinking with wifi led again (flashing) and stops (rebooting to OpenWrt)
MAC addresses as verified by OEM firmware:
vendor OpenWrt address
LAN lan\eth0 label
WAN wan label + 1
2g phy0 label + 2
5g phy1 label + 3
The label MAC address was found in 0xe000.
LEDs detailed:
The only both visible and controllable indicator is blue:wlan LED.
It is not bound by default to indicate activity of any wireless interfaces.
Place (WAN->ANT) | Num | GPIO | LED name (LuCI) | Note
-----------------|-----|-----------------------------------------------------------------------------------------
power | 1 | | | POWER LED. Not controlled with GPIO.
hidden_led_2 | 2 | 13 | blue:hidden_led_2 | This LED does not have proper hole in shell.
wan | 3 | | | WAN LED. Not controlled with GPIO.
hidden_led_4 | 4 | 16 | blue:hidden_led_4 | This LED does not have proper hole in shell.
lan | 5 | | | LAN LED. Not controlled with GPIO.
noconn_led_6 | 6 | | | Not controlled with GPIO, possibly not connected
wlan | 7 | 15 | blue:wlan | WLAN LED. Wireless indicator.
noconn_led_8 | 8 | | | Not controlled with GPIO, possibly not connected
mt76-phy0 and mt76-phy1 leds also exist in OpenWrt, but do not exist on board.
Signed-off-by: Alexey D. Filimonov <alexey@filimonic.net>
This commit removes the padded zeros in the date formatting.
The padded zeros from the date command causes the numbers
to be interpreted as an octal number by printf. Months, days,
and years with the number 08 or 09 raise an error in printf as an
"invalid octal number" and get interpreted as a zero.
Signed-off-by: Max Qian <public@maxqia.com>
ALFA Network AX1800RM (FCC ID: 2AB877621) is a dual-band Wi-Fi 6
(AX1800) router, based on MediaTek MT7621A + MT79x5D platform.
Specifications:
- SOC: MT7621A (880 MHz)
- DRAM: DDR3 256 MiB (Nanya NT5CC128M16JR-EK)
- Flash: 16 MiB SPI NOR (EN25QH128A-104HIP)
- Ethernet: 4x 10/100/1000 Mbps (SOC's built-in switch)
- Wi-Fi: 2x2:2 2.4/5 GHz (MT7905DAN + MT7975DN)
(MT7905DAN doesn't support background DFS scan/BT)
- LED: 6x green, 1x green/red
- Buttons: 2x (reset, WPS)
- Antenna: 4x external, non-detachable omnidirectional
- UART: 1x 4-pin (2.54 mm pitch, J4, not populated)
- Power: 12 V DC/1 A (DC jack)
MAC addresses:
LAN: 00:c0:ca:xx:xx:4e (factory 0x4, +2)
WAN: 00:c0:ca:xx:xx:4f (factory 0x4, +3)
2.4 GHz: 00:c0:ca:xx:xx:4c (factory 0x4, device's label)
5 GHz: 00:c0:ca:xx:xx:4c (factory 0xa)
Flash instructions for web-based U-Boot recovery:
1. Power the device with WPS button pressed and wait around 10 seconds.
2. Setup static IP 192.168.1.2/24 on your PC.
3. Go to 192.168.1.1 in browser and upload 'recovery' image.
The device runs LEDE 17.01 (kernel 4.4.x) based firmware with 'failsafe'
mode available which allows alternative upgrade method:
1. Run device in 'failsafe' mode and change password for default user.
2. SSH to the device, transfer 'sysupgrade' image and perform upgrade
in forced mode, without preserving settings: 'sysupgrade -n -F ...'.
Other notes:
If you own early version of this device, the vendor firmware might
refuse OpenWrt image because of missing custom header. In that case,
ask vendor's customer support for stock firmware without custom header
support/requirement.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
The DRA-1360 rev A is a wall-plug AC1300 repeater.
Hardware is identical (same FCC ID, black case instead of white)
to D-Link DAP-1620 rev B, which is already supported, but a
different model name, revision, and hardware ID are needed.
Thus, the bulk of the DAP-1620 device tree is extracted to a
common dtsi included by the two models' device trees.
Repeating specs and installation instructions from e4c7703:
(note that the RAM size mentioned there was incorrect, oops)
Specs:
- SoC: MT7621AT (880MHz dual-core MIPS1004Kc)
- Memory: 128 MiB RAM, 16 MiB NOR SPI
- WiFi: MT7615DN 2x2 802.11n + 2x2 802.11ac (DBDC)
- Ethernet: 1 RJ45 port 10/100/1000
- Power/status LED: red+green
- LED RSSI bargraph: 2x green, 1x red+green
Installation:
- Keep reset button pressed during plug-in
- Web Recovery Updater is at 192.168.0.50
(pings are ignored, it listens only for http)
- Upload factory.bin, confirm flashing
(seems to work best with Chromium-based browsers)
Revert to OEM firmware:
- tail -c+117 DRA1360A1_FW112B03.bin | \
openssl aes-256-cbc -d -md md5 -out decrypted.bin \
-k c471706398cb147c6619f8a04a18d53e9c17ede8
- flash decrypted.bin via D-Link Web Recovery
Signed-off-by: Rani Hod <rani.hod@gmail.com>
I-O DATA WN-DEAX1800GR is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based
on MT7621A.
Specification:
- SoC : MediaTek MT7621A
- RAM : DDR3 256 MiB (Nanya NT5CC128M16JR-EK)
- Flash : RAW NAND 128 MiB (Winbond W29N01HVSINF)
- WLAN : 2.4/5 GHz (MediaTek MT7915)
- Ethernet : 5x 10/100/1000 Mbps
- Switch : MT7530 (SoC)
- LEDs/Keys : 6x/3x
- UART : through-hole on PCB (J2)
- assignment: 3.3V, GND, TX, RX from "1" marking
- settings : 115200n8
- Power : 12 VDC, 1 A
Flash instruction using initramfs-factory image:
1. Boot WN-DEAX1800GR normally
2. Access to "http://192.168.0.1/" and open firmware update page
("ファームウェア")
3. Select the OpenWrt initramfs-factory.bin image and click update
("更新") button to perform firmware update
4. On the initramfs image, perform sysupgrade with the
squashfs-sysupgrade.bin image
5. Wait ~120 seconds to complete flashing
Note:
- This device has 2x OS images on the flash storage. In this support,
the first one will be used.
Warning:
- Do not use "saveenv" command on U-Boot CLI.
This device has wrong u-boot-env data. The actual length of individual
env data installed to the device is 0x1000 (4 KiB), but installed
U-Boot requires 0x20000 (128 KiB). So U-Boot determines the data is
invalid. Then, if you perform saving environment data with saveenv on
U-Boot CLI, installed env data will be overwritten with too few
default values without individual values (SSID, password, MAC
addresses, etc...).
MAC addresses:
LAN : 50:41:B9:xx:xx:F4 (Config, ethaddr (text))
WAN : 50:41:B9:xx:xx:F6 (Config, wanaddr (text))
2.4 GHz: 50:41:B9:xx:xx:F4 (Config, rmac (text) / Factory, 0x4 (hex))
5 GHz : 50:41:B9:xx:xx:F5 (none)
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Rename GB-PC1 to GnuBee GB-PC1, and GB-PC2 to GnuBee GB-PC2. Let's not make
naming exceptions because of marketing whims.
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
The TP-Link EAP613 v1 is a ceiling-mount 802.11ax access point. It can
be powered via PoE or a DC barrel connector (12V). Connecting to the
UART requires fine soldering and careful manipulation of any soldered
wires.
Device details:
* SoC: MT7621AT
* Flash: 16 MiB SPI NOR
* RAM: 256 MiB DDR3L
* Wi-Fi:
* MT7905DA + MT7975D: 2.4 GHz + 5 GHz (DBDC), 2x2:2
* Two stamped metal antennas (ANT1, ANT2)
* One PCB antenna (ANT3)
* One unpopulated antenna (ANT4)
* Ethernet:
* 1× 10/100/1000 Mbps port with PoE
* LEDs:
* Array of four blue LEDs with one control line
* Buttons:
* Reset
* Board test points:
* UART: next to CPU RF-shield and power circuits
* JTAG: under CPU RF-shield (untested)
* Watchdog: 3PEAK TPV706 (not implemented)
Althought three antennas are populated, the MT7905DA does not support
the additional Rx chain for background DFS detection (or Bluetooth)
according to commit 6cbcc34f50 ("ramips: disable unsupported
background radar detection").
MAC addresses:
* LAN: 48:22:54:xx:xx:a2 (device label)
* WLAN 2.4 GHz: 48:22:54:xx:xx:a2
* WLAN 5 GHz: 48:22:54:xx:xx:a3
The radio calibration blob stored in flash also contains valid MAC
addresses for both radio bands (OUI 00:0c:43).
Factory install:
1. Enable SSH on the device via web interface
2. Log in with SSH, and run `cliclientd stopcs`
3. Upload -factory.bin image via web interface. It may be necessary to
shorten the filename of the image to e.g. 'factory.bin'.
Recovery:
1. Open the device by unscrewing four screws from the backside
2. Carefully remove board from the housing
3. Connect to UART (3.3V):
* Find test points labelled "VCC", "GND", "UART_TX", "UART_RX"
* Solder wires to test points or connect otherwise. Be careful not
to damage the PCB e.g. by pulling on soldered wires.
* Open console with 115200n8 settings
4. Interrupt bootloader and use tftpboot to start an initramfs:
setenv ipaddr $DEVICE_IP
setenv serverip $SERVER_IP
tftpboot 84000000 openwrt-initramfs-kernel.bin
bootm
DO NOT use saveenv to store modified u-boot environment variables. The
environment is saved at flash offset 0x30000, which erases part of the
(secondary) bootloader.
The device uses two bootloader stages. The first stage will load the
second stage from a uImage stored at flash offset 0x10000. In case of
a damaged second stage, the first stage should allow uploading a new
image via y-modem (untested).
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Add support for ComFast CF-E390AX. It is a 802.11 wifi6 cieling AP, based on MediaTek MT7261AT.
Specifications:
SoC: MediaTek MT7621AT
RAM: 128 MiB
Flash: 16 MiB NOR (Macronix mx25l12805d)
Wireless: MT7915E (2.4G) 802.11ax/b/g/n MT7915E (5G) 802.11ac/ax/n
Ethernet: 2 x 1Gbs
Button: 1 x "Reset" button
LED: 1x Blue LED + 1x Red LED + 1x green LED
Power: PoE
Manufacturer Page:
http://en.comfast.com.cn/index.php?m=content&c=index&a=show&catid=84&id=75
Flash Layout:
0x000000000000-0x000000030000 : "bootloader"
0x000000030000-0x000000040000 : "config"
0x000000050000-0x000000060000 : "factory"
0x000000090000-0x000001000000 : "firmware"
First install:
1. Set device into http firmware fail safe upload mode by pressing the reset button for 10 seconds while powering
it on. Once the LED stops flashing, safe mode will be running.
2. Set PC IP address to 192.168.1.2
3. Browse to 192.168.1.1 and upload the factory image using the web interface.
Signed-off-by: Usama Nassir <usama.nassir@gmail.com>
This commit adds support for following wireless routers:
- Beeline SmartBox PRO (Serсomm S1500 AWI)
- WiFire S1500.NBN (Serсomm S1500 BUC)
This commit is based on this PR:
- Link: https://github.com/openwrt/openwrt/pull/4770
- Author: Maximilian Weinmann <x1@disroot.org>
The opening of this PR was agreed with author.
My changes:
- Sorting, minor changes and some movings between dts and dtsi
- Move leds to dts when possible
- Recipes for the factory image
- Update of the installation/recovery/return to stock guides
- Add reset GPIO for the pcie1
Common specification
--------------------
SoC: MediaTek MT7621AT (880 MHz, 2 cores)
Switch: MediaTek MT7530 (via SoC MT7621AT)
Wireless: 2.4 GHz, MT7602EN, b/g/n, 2x2
Wireless: 5 GHz, MT7612EN, a/n/ac, 2x2
Ethernet: 5 ports - 5×GbE (WAN, LAN1-4)
Mini PCIe: via J2 on PCB, not soldered on the board
UART: J4 -> GND[], TX, VCC(3.3V), RX
BootLoader: U-Boot SerComm/Mediatek
Beeline SmartBox PRO specification
----------------------------------
RAM (Nanya NT5CB128M16FP): 256 MiB
NAND-Flash (ESMT F59L2G81A): 256 MiB
USB ports: 2xUSB2.0
LEDs: Status (white), WPS (blue), 2g (white), 5g (white) + 10 LED Ethernet
Buttons: 2 button (reset, wps), 1 switch button (ROUT<->REP)
Power: 12 VDC, 1.5 A
PCB Sticker: 970AWI0QW00N256SMT Ver. 1.0
CSN: SG15********
MAC LAN: 94:4A:0C:**:**:**
Manufacturer's code: 0AWI0500QW1
WiFire S1500.NBN specification
------------------------------
RAM (Nanya NT5CC64M16GP): 128 MiB
NAND-Flash (ESMT F59L1G81MA): 128 MiB
USB ports: 1xUSB2.0
LEDs: Status (white), WPS (white), 2g (white), 5g (white) + 10 LED Ethernet
Buttons: 2 button (RESET, WPS)
Power: 12 VDC, 1.0 A
PCB Sticker: 970BUC0RW00N128SMT Ver. 1.0
CSN: MH16********
MAC WAN: E0:60:66:**:**:**
Manufacturer's code: 0BUC0500RW1
MAC address table (PRO)
-----------------------
use address source
LAN *:23 factory 0x1000 (label)
WAN *:24 factory $label +1
2g *:23 factory $label
5g *:25 factory $label +2
MAC addresses (NBN)
-------------------
use address source
LAN *:0e factory 0x1000
WAN *:0f LAN +1 (label)
2g *:0f LAN +1
5g *:10 LAN +2
OEM easy installation
---------------------
1. Remove all dots from the factory image filename (except the dot
before file extension)
2. Upload and update the firmware via the original web interface
3. Two options are possible after the reboot:
a. OpenWrt - that's OK, the mission accomplished
b. Stock firmware - install Stock firmware (to switch booflag from
Sercomm0 to Sercomm1) and then OpenWrt factory image.
Return to Stock
---------------
1. Change the bootflag to Sercomm1 in OpenWrt CLI and then reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock2
reboot
2. Install stock firmware via the web OEM firmware interface
Recovery
--------
Use sercomm-recovery tool.
Link: https://github.com/danitool/sercomm-recovery
Tested-by: Pavel Ivanov <pi635v@gmail.com>
Tested-by: Denis Myshaev <denis.myshaev@gmail.com>
Tested-by: Oleg Galeev <olegingaleev@gmail.com>
Tested-By: Ivan Pavlov <AuthorReflex@gmail.com>
Co-authored-by: Maximilian Weinmann <x1@disroot.org>
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
This commit moves a part of the code from the "sercomm-factory-cqr" recipe
to the separate "sercomm-mkhash" recipe. This simplifies recipes and
allows insert additional recipes between these code blocks (required for
the future support for Beeline SmartBox PRO router).
dd automatically fills the file by 0x00 if the filesize is less than
offset where we start writing. We drop such dd command so we need to add
--extra-padding-size 0x190 to the sercomm-pid.py call.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Netgear EAX12, EAX11v2, EAX15v2 are wall-plug 802.11ax (Wi-Fi 6)
extenders that share the SoC, WiFi chip, and image format with the
WAX202.
Specifications:
* MT7621, 256 MiB RAM, 128 MiB NAND
* MT7915: 2.4/5 GHz 2x2 802.11ax (DBDC)
* Ethernet: 1 port 10/100/1000
* UART: 115200 baud (labeled on board)
All LEDs and buttons appear to work without state_default.
Installation:
* Flash the factory image through the stock web interface, or TFTP to
the bootloader. NMRP can be used to TFTP without opening the case.
Revert to stock firmware:
* Flash the stock firmware to the bootloader using TFTP/NMRP.
References in GPL source:
https://www.downloads.netgear.com/files/GPL/EAX12_EAX11v2_EAX15v2_GPL_V1.0.3.34_src.tar.gz
* target/linux/ramips/dts/mt7621-rfb-ax-nand.dts
DTS file for this device.
Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
These fields are used for EAX12 and EX6250v2 series, and perhaps other
devices. Compatibility is preserved with the WAX202 and WAX206.
In addition, adds the related vars to DEVICE_VARS so that the variables
work correctly with multiple devices.
References in GPL source:
https://www.downloads.netgear.com/files/GPL/EAX12_EAX11v2_EAX15v2_GPL_V1.0.3.34_src.tar.gz
* tools/imgencoder/src/gj_enc.c
Contains code that generates the encrypted image.
Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
General specification:
SoC Type: MediaTek MT7620A (580MHz)
ROM: 8 MB SPI-NOR (MX25L6406E)
RAM: 64 MB DDR (W9751G6KB-25)
Switch: MediaTek MT7530
Ethernet: 5 ports - 5×100MbE (WAN, LAN1-4)
Wireless: 2.4 GHz (MediaTek RT5390): b/g/n
Wireless: 5 GHz (MediaTek MT7610EN): ac/n
Buttons: 2 button (POWER, WPS/RESET)
Bootloader: U-Boot 1.1.3
Power: 12 VDC, 0.5 A
MACs:
| LAN | [Factory + 0x04] - 2 |
| WLAN 2.4g | [Factory + 0x04] - 1 |
| WLAN 5g | [Factory + 0x8004] - 3 |
| WAN | [Factory + 0x04] - 2 |
OEM easy installation:
1. Use a PC to browse to http://192.168.0.1.
2. Go to the System section and open the Firmware Update section.
3. Under the Local Update at the right, click on the CHOOSE FILE...
4. When a modal window appears, choose the firmware file and click on
the Open.
5. Next click on the UPDATE FIRMWARE button and upload the firmware image.
Wait for the router to flash and reboot.
OEM installation using the TFTP method (need level converter):
1. Download the latest firmware image.
2. Set up a Tftp server on a PC (e.g. Tftpd32) and place the firmware
image to the root directory of the server.
3. Power off the router and use a twisted pair cable to connect the PC
to any of the router's LAN ports.
4. Configure the network adapter of the PC to use IP address 192.168.0.180
and subnet mask 255.255.255.0.
5. Connect serial port (57600 8N1) and turn on the router.
6. Then interrupt "U-Boot Boot Menu" by hitting 2 key (select "2: Load
system code then write to Flash via TFTP.").
7. Press Y key when show "Warning!! Erase Linux in Flash then burn new
one. Are you sure? (Y/N)"
Input device IP (192.168.0.1) ==:192.168.0.1
Input server IP (192.168.0.180) ==:192.168.0.180
Input Linux Kernel filename () ==:firmware_name
The router should download the firmware via TFTP and complete flashing in
a few minutes.
After flashing is complete, use the PC to browse to http://192.168.1.1 or
ssh to proceed with the configuration.
Signed-off-by: Alexey Bartenev <41exey@proton.me>
Specifications:
- Device: Edimax BR-6208AC V2
- SoC: MT7620A
- Flash: 16 MiB
- RAM: 64 MiB
- Switch: 1 WAN, 3 LAN (10/100 Mbps)
- WiFi: MT7620 2.4 GHz + MT7610E 5 GHz
- LEDs: 1x POWER (green, not configurable)
1x Firmware (green, configurable)
1x Internet (green, configurable)
1x VPN (green, configurable)
1x 2.4G (green, not configurable)
1x 5G (green, not configurable)
Normal installation:
- Upload the sysupgrade image via the default web interface
Installation with U-Boot and TFTP:
- Requires a TFTP server which provides the sysupgrade image
- Requires a connection to the serial port of the device, rate 57600
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Zbtlink ZBT-WG1608 is a Wi-Fi router intendent to use with WWAN (4G/5G)
modems.
Specifications:
* SoC: MediaTek MT7621A
* RAM: 256/512 MiB
* Flash: 16/32 MiB (SPI NOR)
* Wi-Fi:
* MediaTek MT7603E : 2.4Ghz
* MediaTek MT7613BE : 5Ghz
* Ethernet: 10/100/1000 Mbps Ethernet x5 ports (4xLAN + WAN)
* M.2: 1x slot with USB&SIM
* EM7455/EM12-G/EM160R/RM500Q-AE
* USB: 1x 3.0 Type-A port
* External storage: 1x microSD (SDXC) slot
* UART: console (115200 baud)
* LED:
* 1 power indicator
* 1 WLAN 2.4G controlled (wlan 2G)
* 3 SoC controlled (wlan 5G, wwan, internet)
* 5 per Eth phy (4xLAN + WAN)
MAC Addresses:
* LAN : f8:5e:3c:xx:xx:e0 (Factory, 0xe000 (hex))
* WAN : f8:5e:3c:xx:xx:e1 (Factory, 0xe006 (hex))
* 2.4 GHz: f8:5e:3c:xx:xx:de (Factory, 0x0004 (hex))
* 5 GHz : f8:5e:3c:xx:xx:df (Factory, 0x8004 (hex))
Installation:
* Vendor's firmware is OpenWrt (LEDE) based, so the sysupgrade image can
be directly used to install OpenWrt. Firmware must be upgraded using the
'force' and 'do not save configuration' command line options (or
correspondig web interface checkboxes) since the vendor firmware is from
the pre-DSA era.
Recovery Mode:
* Press reset button, power up the device, wait for about 10sec.
* Upload sysupgrade image through the firmware recovery mode web page at
192.168.1.1.
Signed-off-by: Kim DoHyoung <azusahmr@k-on.kr>
Aligned to size of mtd-concat partition (firmware)
- in this device we have mtd-concat driver that joins multiple flash partitions
- since sysupgrade works with mtd devices the rootfs partition is already joined
- we can use a bigger sysupgrade image than factory/TFTP install images
Checked on hardware, no issues seen.
No modifications to images other than sysupgrade (i.e. TFTP / recovery images not touched).
Signed-off-by: Russell Morris <rmorris@rkmorris.us>
This adds support for Beeline Smart Box TURBO+ (Serсomm S3 CQR) router.
Device specification
--------------------
SoC Type: MediaTek MT7621AT (880 MHz, 2 cores)
RAM (Nanya NT5CC64M16GP): 128 MiB
Flash (Macronix MX30LF1G18AC): 128 MiB
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7615N): a/n/ac, 4x4
Ethernet: 5 ports - 5×GbE (WAN, LAN1-4)
USB ports: 1xUSB3.0
Buttons: 2 button (reset, wps)
LEDs: Red, Green, Blue
Zigbee (EFR32MG1B232GG): 3.0
Stock bootloader: U-Boot 1.1.3
Power: 12 VDC, 1.5 A
Installation (fw 2.0.9)
-----------------------
1. Login to the web interface under SuperUser (root) credentials.
Password: SDXXXXXXXXXX, where SDXXXXXXXXXX is serial number of the
device written on the backplate stick.
2. Navigate to Setting -> WAN. Add:
Name - WAN1
Connection Type - Static
IP Address - 172.16.0.1
Netmask - 255.255.255.0
Save -> Apply. Set default: WAN1
3. Enable SSH and HTTP on WAN. Setting -> Remote control. Add:
Protocol - SSH
Port - 22
IP Address - 172.16.0.1
Netmask - 255.255.255.0
WAN Interface - WAN1
Save ->Apply
Add:
Protocol - HTTP
Port - 80
IP Address - 172.16.0.1
Netmask - 255.255.255.0
WAN interface - WAN1
Save -> Apply
4. Set up your PC ethernet:
Connection Type - Static
IP Address - 172.16.0.2
Netmask - 255.255.255.0
Gateway - 172.16.0.1
5. Connect PC using ethernet cable to the WAN port of the router
6. Connect to the router using SSH shell under SuperUser account
7. Make a mtd backup (optional, see related section)
8. Change bootflag to Sercomm1 and reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
reboot
9. Login to the router web interface under admin account
10. Remove dots from the OpenWrt factory image filename
11. Update firmware via web using OpenWrt factory image
Revert to stock
---------------
Change bootflag to Sercomm1 in OpenWrt CLI and then reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
mtd backup
----------
1. Set up a tftp server (e.g. tftpd64 for windows)
2. Connect to a router using SSH shell and run the following commands:
cd /tmp
for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \
tftp -l mtd$i -p 172.16.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done
tftp -l mtd.md5 -p 171.16.0.2
Recovery
--------
Use sercomm-recovery tool.
Link: https://github.com/danitool/sercomm-recovery
MAC Addresses (fw 2.0.9)
------------------------
+-----+------------+---------+
| use | address | example |
+-----+------------+---------+
| LAN | label | *:e8 |
| WAN | label + 1 | *:e9 |
| 2g | label + 4 | *:ec |
| 5g | label + 5 | *:ed |
+-----+------------+---------+
The label MAC address was found in Factory 0x21000
Factory image format
--------------------
+---+-------------------+-------------+--------------------+
| # | Offset | Size | Description |
+---+-------------------+-------------+--------------------+
| 1 | 0x0 | 0x200 | Tag Header Factory |
| 2 | 0x200 | 0x100 | Tag Header Kernel1 |
| 3 | 0x300 | 0x100 | Tag Header Kernel2 |
| 4 | 0x400 | SIZE_KERNEL | Kernel |
| 5 | 0x400+SIZE_KERNEL | SIZE_ROOTFS | RootFS(UBI) |
+---+-------------------+-------------+--------------------+
Co-authored-by: Mikhail Zhilkin <csharper2005@gmail.com>
Signed-off-by: Maximilian Weinmann <x1@disroot.org>
The MR600v2 does not find its rootfs if it is neither directly after the
kernel or aligned to an erase block boundary (64k).
This aligns the rootfs to 0x10000 allowing the device to boot again. Based
on investigation by forum user relghuar.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
The 'KERNEL' is not referenced by other objects, so double '$$' will
cause shell unable to parse the variable 'BLOCKSIZE':
dd ... bs=$(BLOCKSIZE) conv=sync
bash: line 1: BLOCKSIZE: command not found
Fixes: 09a0efbe83(ramips: set default BLOCKSIZE to 64k for nor flash devices)
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
These same codes are repeated for many devices now, it's better to
move them to shared definition. This commit also add the missing
KERNEL_SIZE of the ZyXEL NR7101 and ZyXEL LTE3301-PLUS.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
In kernel 5.15, the default erase sector size of the nor flash has
been switched from 4k to 64k. This may cause the configuration not
be preserved across upgrades. To avoid this issue, change the default
BLOCKSIZE to 64k.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Rename Newifi D2 to D-Team Newifi D2, and Newifi D1 to Lenovo Newifi D1.
Let's not make naming exceptions because of marketing whims.
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
The TOZED ZLT S12 PRO is an AC1200 router featuring 4 Ethernet ports with a
TOZED TL70-C cellular modem which supports the NCM mode.
The stock firmware does SIM locking on the modem by stopping dialing when a
different PLMN is detected. This is not the case on OpenWrt.
Specifications:
- CPU: MediaTek MT7621AT
- RAM: 256MB DDR3
- NOR Flash: MX25L12833FM2I 16MB SPI Flash
- Wi-Fi 2.4Ghz: MT7603E
- Wi-Fi 5Ghz: MT7612E
- Switch: MT7530 4x 1Gbit Ports
- WWAN: Unisoc SL8563 based TOZED TL70-C LTE CAT6 cellular modem
- USB: 1x optional USB2.0 external port
- Switches/Buttons: WPS, Reset, Power Switch
- LEDs: Power, Wi-Fi, Data, Signal 1-5, Phone
Installation and TFTP Recovery:
- Connect to serial console.
- Boot initramfs image by choosing option 1 when U-Boot prompts.
- Install sysupgrade image via OpenWrt.
Serial Pins:
Located at the bottom right when looking from the front, right under the
Reset/WPS buttons. The pinout from the left is:
- RX
- GND
- TX
Baudrate is 115200.
When connecting from a powered off state, disconnect RX as it blocks the
boot process.
Link: http://www.sztozed.com/en/contents/58/84.html
Co-developed-by: Andre Cruz <me@1conan.com>
Signed-off-by: Andre Cruz <me@1conan.com>
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Hardware specification:
- SoC: MediaTek MT7621AT (880 MHz)
- Flash: 16 MB (Macronix MX25L12835FM2I-10G)
- RAM: 128 MB (Nanya NT5CC64M16GP-DI)
- WLAN 2.4 GHz: 2x2 MediaTek MT7603EN
- WLAN 5 GHz: 2x2 MediaTek MT7615N
- Ethernet: 1x 10/100/1000 Mbps
- LED: Power, Wifi, WPS
- Button: Reset, WPS
- UART: 1:VCC, 2:GND, 3:TX, 4:RX (from LAN port)
Serial console @ 57600,8n1
Flash instructions:
Connect to serial console and start up the device. As the bootloader got
locked you need to type in a password to unlock U-Boot access.
When you see the following output on the console:
relocate_code Pointer at: 87f1c000
type in the super secure password:
1234567890
Then select TFTP boot from RAM by selecting option 1 in the boot menu.
As Linksys decided to leave out a basic TFTP configuration you need to
set server- & client ip as well as the image filename the device will
search for. You need to use the initramfs openwrt image for the TFTP
boot process.
Once openwrt has booted up, upload the sysupgrade image via scp and run
sysupgrade as normal.
Signed-off-by: Christoph Krapp <achterin@gmail.com>
Rename existing device to v1 and create common .dtsi
Difference to v1: 16MB Flash
Specifications:
SoC: MediaTek MT7621
RAM: 256 MB
Flash: 16 MB (SPI NOR, XM25QH128C on my device)
WiFi: MediaTek MT7915E
Switch: 1 WAN, 4 LAN (Gigabit)
Buttons: Reset, WPS
LEDs: Two Power LEDs (blue and red; together they form purple)
Power: DC 12V 1A center positive
Serial: 115200 8N1
C440 - (3V3 - GND - RX - TX) - C41 | v1 and v2
(P - G - R - T) | v2 labels them on the board
Installation:
Download and flash the manufacturer's built OpenWrt image available at
http://www.cudytech.com/openwrt_software_download
Install the new OpenWrt image via luci (System -> Backup/Flash firmware)
Be sure to NOT keep settings.
Recovery:
Loads only signed manufacture firmware due to bootloader RSA verification
Serve tftp-recovery image as /recovery.bin on 192.168.1.88/24
Connect to any lan ethernet port
Power on the device while holding the reset button
Wait at least 8 seconds before releasing reset button for image to
download
MAC addresses as verified by OEM firmware:
use address source
LAN f4:a4:54:86:75:a2 label
WAN f4:a4:54:86:75:a3 label + 1
2g f4:a4:54:86:75:a2 label
5g f6:a4:54:b6:75:a2 label + LA-Bit set + 4th oktet increased
The label MAC address is found in bdinfo 0xde00.
Signed-off-by: Felix Baumann <felix.bau@gmx.de>
This commit adds factory.bin image for TP-Link EC330-G5u v1. This allows
to install OpenWrt without connecting a serial cable (UART).
Installation using factory image
--------------------------------
Tested with "3.16.0 0.9.1 v6037.0 Build 191016 Rel.30619nb" TP-Link
firmware.
1. Login to the router web interface (http://192.168.0.1/ by default) and
save running config to "conf.bin" file
2. Open configuration file in any TP-Link config editor (e.g.
https://jahed.github.io/tp-link-config-editor/)
3. Find "DeviceInfo" section and insert a new string "<Description
val="Modem Router`telnetd -p 1023 -l login`" />" according to the
following example:
<DeviceInfo>
...
<Description val="Modem Router`telnetd -p 1023 -l login`" />
...
</DeviceInfo>
4. Save configuration file and upload changed configuration using stock
firmware interface
5. Login using telnet to IP:192.168.0.1 (Username:admin, password:1234)
6. Run "cat /proc/mtd | grep mtd7"
a. If the result is 'mtd7: 03000000 00020000 "rootfs" 03400000',
then install stock firmware using web interface to toggle booted
firmware image from "os1" to "os0"
b. If the result is 'mtd7: 03000000 00020000 "rootfs" 00400000',
then all is ok, go to the next step
7. Set up a tftp server with OpenWrt factory.bin image (IP:192.168.0.100
in this example)
8. Login using telnet to 192.168.0.1
9. Download OpenWrt factory.bin image from the tftp server:
cd /tmp
tftp -g -r factory.bin 192.168.0.100
10. Write OpenWrt factory.bin image:
dd if=/tmp/factory.bin of=/dev/mtdblock1
11. Power cycle the router
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
* Delete unused lantiq makefile
* Delete redundant makefiles and unify them into the main makefile
* Refactor and unify board code into a single file
* Add support and review subtarget specific board support
Signed-off-by: Antonio Vázquez <antoniovazquezblanco@gmail.com>
The ZyXEL WSM20 aka Multy M1 is a cheap mesh router system by ZyXEL
based on the MT7621 CPU.
Specifications
==============
SoC: MediaTek MT7621AT (880MHz)
RAM: 256MiB
Flash: 128MiB NAND
Wireless: 802.11ax (2x2 MT7915E DBDC)
Ethernet: 4x 10/100/1000 (MT7530)
Button: 1x WPS, 1x Reset, 1x LED On/Off
LED: 7 LEDs (3x white, 2x red, 2x green)
MAC address assignment
======================
The MAC address assignment follows stock: The label MAC address is the LAN
MAC address, the WAN address is read from flash.
The WiFi MAC addresses are set in userspace to label MAC + 1 and label MAC
+ 2.
Installation (web interface)
============================
The device is cloud-managed, but there is a hidden local firmware upgrade
page in the OEM web interface. The device has to be registered in the
cloud in order to be able to access this page.
The system has a dual firmware design, there is no way to tell which
firmware is currently booted. Therefore, an -initramfs version is flashed
first.
1. Log into the OEM web GUI
2. Access the hidden upgrade page by navigating to
https://192.168.212.1/gui/#/main/debug/firmwareupgrade
3. Upload the -initramfs-kernel.bin file and flash it
4. Wait for OpenWrt to boot and log in via SSH
5. Transfer the sysupgrade file via SCP
6. Run sysupgrade to install the image
7. Reboot and enjoy
NB: If the initramfs version was installed in RAS2, the sysupgrade script
sets the boot number to the first partition. A backup has to be performed
manually in case the OEM firwmare should be kept.
Installation (UART method)
==========================
The UART method is more difficult, as the boot loader does not have a
timeout set. A semi-working stock firmware is required to configure it:
1. Attach UART
2. Boot the stock firmware until the message about failsafe mode appears
3. Enter failsafe mode by pressing "f" and "Enter"
4. Type "mount_root"
5. Run "fw_setenv bootmenu_delay 3"
6. Reboot, U-Boot now presents a menu
7. The -initramfs-kernel.bin image can be flashed using the menu
8. Run the regular sysupgrade for a permanent installation
Changing the partition to boot is a bit cumbersome in U-Boot, as there is
no menu to select it. It can only be checked using mstc_bootnum. To change
it, issue the following commands in U-Boot:
nand read 1800000 53c0000 800
mw.b 1800004 1 1
nand erase 53c0000 800
nand write 1800000 53c0000 800
This selects FW1. Replace "mw.b 1800004 1 1" by "mw.b 1800004 2 1" to
change to the second slot.
Back to stock
=============
It is possible to flash back to stock, but a OEM firmware upgrade is
required. ZyXEL does not provide the link on its website, but the link
can be acquired from the OEM web GUI by analyzing the transferred JSON
objects.
It is then a matter of writing the firmware to Kernel2 and setting the
boot partition to FW2:
mtd write zyxel.bin Kernel2
echo -ne "\x02" | dd of=/dev/mtdblock7 count=1 bs=1 seek=4 conv=notrunc
Signed-off-by: Andreas Böhler <dev@aboehler.at>
Credits to forum users Annick and SirLouen for their initial work on this
device
- Correct WiFi MACs, they didn't match oem firmware
- Move nvmem-cells to bdinfo partition and remove &bdinfo reference
- Add OEM device model name R13 to SUPPORTED_DEVICES
This allows sysupgrading from Cudy's OpenWrt fork without force
- Label red_led and use it during failsafe mode and upgrades
MAC addresses as verified by OEM firmware:
use address source
LAN b4:4b:d6:2d:c8:4a label
WAN b4:4b:d6:2d:c8:4b label + 1
2g b4:4b:d6:2d:c8:4a label
5g b6:4b:d6:3d:c8:4a label + LA-Bit set + 4th oktet increased
The label MAC address is found in bdinfo 0xde00.
Signed-off-by: Felix Baumann <felix.bau@gmx.de>
[read wifi mac from flash offset]
Signed-off-by: David Bauer <mail@david-bauer.net>
This fixes a well known "LZMA ERROR 1" error, reported previously on
numerous of similar devices.
Fixes: #11919
Signed-off-by: Haoan Li <lihaoan1001@163.com>
Instead of passing an array of hex bytes for the Sercomm PID we can now use
the --pid-file parameter.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Add support for OrayBox X1. It is a 802.11n router, based on MediaTek MT7628N.
Specifications:
SoC: MediaTek MT7628N (580MHz)
RAM: 64 MiB
Flash: 16 MiB NOR (Winbond W25Q128JVSIQ)
Wireless: 802.11b/g/n 2x2 2.4GHz (Built In)
Ethernet: 1x 100Mbps only
USB: 1x USB Type-A 2.0 Host Port
Button: 1x "Reset" button
LED: 1x Blue LED + 1x Red LED + 1x White LED
Power: 5V Micro-USB input
Manufacturer Page:
https://pgy.oray.com/router/x1.html/parameter
Flash Layout:
0x000000000000-0x000000030000 : "u-boot"
0x000000030000-0x000000040000 : "kpanic"
0x000000040000-0x000000050000 : "factory"
0x000000050000-0x000000fe0000 : "firmware"
0x000000fe0000-0x000000ff0000 : "bdinfo"
0x000000ff0000-0x000001000000 : "reserve"
Install via SSH:
Original firmware is based on OpenWRT, but SSH is not start by default,
You should enable it first
1. Login into web admin (10.168.1.1), default password is 'admin'
2. Open the following link, and the result should be {"code":0};
SSH is now started, username is root, password is same as web admin password
http://10.168.1.1/cgi-bin/oraybox?_api=ssh_set&enabled=1
4. You can flash firmware via mtd: mtd write /tmp/firmware_image.bin firmware
Signed-off-by: Bin We <me@udp.pw>
Hanyang Digitech Co., Ltd.
MSIP-CMM-HYD-HYC-G920
CJ-Hello HYC-G920
SoC : MediaTek MT7621AT
RAM : 256M (SK hynix H5TQ2G63FFR)
FLASH : 16MB (Winbond W25Q128BV)
WiFi : MediaTek MT7602EN bgn 2SS
WiFi : MediaTek MT7612EN nac 2SS
BTN : Reset
LED : - Power RED
- WAN Green
- LAN {1-4}
- WiFi 2.4 GHz Blue
- WiFi 5 GHz Blue
- USB Green
**For MT7621 stage1 DDR Test**
UART : J4 GND - 3V3 - TX - RX - GND / 57600-8N1
```
MT7621 stage1 code 10:33:55 (ASIC)
CPU=500000000 HZ BUS=166666666 HZ
```
**For u boot environment**
UART : J4 GND - 3V3 - TX - RX - GND / 115200-8N1
**UART Menu**
```
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
```
**Steps**
Press 4: Entr boot command line interface.
On the pormpt enter.
`setenv firmware_size 0xf60000`
Then enter.
`saveenv`
Then enter.
`reset`
**Device will reboot**
Set your IP 192.168.100.100/24
Connect your lan cable to wan port.
**On the UART Menu**
Press 2: Load system code then write to Flash via TFTP.
Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N) **enter** `Y`
Please Input new ones /or Ctrl-C to discard
Input device IP (192.168.100.55) ==:`192.168.100.55`
Input server IP (192.168.100.100) ==:`192.168.100.100`
Input Linux Kernel filename () ==:`openwrt-22.03.0-ramips-mt7621-hanyang_hyc-g920-squashfs-sysupgrade.bin`
After uploading firmware image, device will boot Openwrt.
Signed-off-by: Muhammad AL-Qadhy <m.ismael@gmail.com>
General specification:
SoC Type: MediaTek MT7620N (580MHz)
ROM: 8 MB SPI-NOR (W25Q64FV)
RAM: 64 MB DDR (EM6AB160TSD-5G)
Switch: MediaTek MT7530
Ethernet: 5 ports - 5×100MbE (WAN, LAN1-4)
Wireless: 2.4 GHz (MediaTek RT5390): b/g/n
Buttons: 3 button (POWER, RESET, WPS)
Slide switch: 4 position (BASE, ADAPTER, BOOSTER, ACCESS POINT)
Bootloader: U-Boot 1.1.3
Power: 9 VDC, 0.6 A
MAC in stock:
|- + |
| LAN | RF-EEPROM + 0x04 |
| WLAN | RF-EEPROM + 0x04 |
| WAN | RF-EEPROM + 0x28 |
OEM easy installation
1. Use a PC to browse to http://my.keenetic.net.
2. Go to the System section and open the Files tab.
3. Under the Files tab, there will be a list of system
files. Click on the Firmware file.
4. When a modal window appears, click on the Choose File
button and upload the firmware image.
5. Wait for the router to flash and reboot.
OEM installation using the TFTP method
1. Download the latest firmware image and rename it to
klite3_recovery.bin.
2. Set up a Tftp server on a PC (e.g. Tftpd32) and place the
firmware image to the root directory of the server.
3. Power off the router and use a twisted pair cable to connect
the PC to any of the router's LAN ports.
4. Configure the network adapter of the PC to use IP address
192.168.1.2 and subnet mask 255.255.255.0.
5. Power up the router while holding the reset button pressed.
6. Wait approximately for 5 seconds and then release the
reset button.
7. The router should download the firmware via TFTP and
complete flashing in a few minutes.
After flashing is complete, use the PC to browse to
http://192.168.1.1 or ssh to proceed with the configuration.
Signed-off-by: Alexey Bartenev <41exey@proton.me>
Hardware
========
- SoC: MediaTek MT7621AT (880MHz, Duel-Core)
- RAM: DDR3 128MB
- Flash: Winbond W25Q128JV (SPI-NOR 16MB)
- WiFi: MediaTek MT7915D (2.4GHz, 5GHz, DBDC)
- Ethernet: MediaTek MT7530 (WAN x1, LAN x3, SoC)
- UART: >TX RX GND 3v3 (115200 8N1, J1)
Do not connect 3v3. TX is marked with an arrow.
Installation
============
Flash factory image. This can be done using stock web ui.
Revert to stock firmware
========================
Flash stock firmware via OEM Web UI Recovery mode.
Web UI Recovery method
======================
1. Unplug the router
2. Plug in and hold reset button 5~10 secs
3. Set your computer IP address manually to 192.168.1.x / 255.255.255.0
4. Flash image with web browser to 192.168.1.1
Co-authored-by: Robert Senderek <robert.senderek@10g.pl>
Co-authored-by: Yoonji Park <koreapyj@dcmys.kr>
Signed-off-by: David Bauer <mail@david-bauer.net>
This commit includes some additional changes:
- better handling of iv and keys in openssl/wolfssl variants
- fix compiler warnings and whitespace
- build all 3 variants as separate packages
- adjust the new package name in targets' DEVICE_PACKAGES
- remove PKG_FLAGS:=nonshared
[Beeline SmartBox Flash - OK]
Tested-by: Mikhail Zhilkin <csharper2005@gmail.com>
[after test: replaced a hardcoded IV size of 16 by cipher_info->iv_size]
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
Hardware
--------
CPU: MediaTek MT7621 DAT
RAM: 128MB DDR3 (integrated)
FLASH: 16MB SPI-NOR ()
WiFi: MediaTek MT7905 + MT7975 (2.4 / 5 DBDC) 802.11ax
SERIAL: 115200 8N1
LEDs - (3V3 - GND - RX - TX) - ETH ports
Installation
------------
Upload the factory image using the Web-UI.
Web-Recovery
------------
The router supports a HTTP recovery mode by holding the reset-button
when powering on. The interface is reachable at 192.168.0.1 and supports
installation using the factory image.
Signed-off-by: David Bauer <mail@david-bauer.net>
Specifications:
* SoC: MT7621AT
* RAM: 256MB (NT5CC64M16GP-DI)
* Flash: 16MB NOR SPI flash (GD25Q127CSIG, using GD25Q128C driver)
* WiFi: MT7615DN (2.4GHz+5Ghz) with DBDC
* Ethernet: 4x1000M LAN, 1x 1000M WAN
* LEDs: Power Blue+Orange,Wan Blue+Orange,WPS Blue,"2.4G"Blue, "5G" Blue,
USB Blue
* Buttons: Reset,WPS, Wifi
* Serial interface: on board but not populated, pinout (from the DC jack
side to the WAN port side) is "3.3V Input Output Gnd". Baud rate is 57600,
settings are 8 data bits, no parity bit, one stop bit, and no flow control.
Stock flash layout:
```
GD25Q128C(c8 40180000) (16384 Kbytes)
mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K)
.numeraseregions = 0
Creating 7 MTD partitions on "raspi":
0x000000000000-0x000001000000 : "ALL"
0x000000000000-0x000000030000 : "Bootloader"
0x000000030000-0x000000040000 : "Config"
0x000000040000-0x000000050000 : "Factory"
0x000000050000-0x000000060000 : "Config2"
0x000000060000-0x000000fb0000 : "Kernel"
0x000000fb0000-0x000001000000 : "Private"
```
The kernel partition will be replaced with the OpenWrt image, the other
partitions are left untouched.
"Config2" seems to be the config storage used by the stock firmware.
"Private" is a 320kB empty JFFS2 partition that comes with the stock
firmware. One can get a larger space for OpenWrt by merging it with
"Kernel".
OpenWrt flash layout:
```
0x000000000000-0x000000030000 : "u-boot"
0x000000030000-0x000000040000 : "u-boot-env"
0x000000040000-0x000000050000 : "factory"
0x000000050000-0x000000060000 : "config2_stock"
0x000000060000-0x000000fb0000 : "firmware"
0x000000fb0000-0x000001000000 : "private_stock"
```
The OpenWrt image must have 96 bytes of padding in the header.
MAC addresses on OEM firmware:
| | location on the flash | notes |
|------ |----------------------- |---------- |
| lan (eth2) | factory + 0xe000 | on label |
| wan (eth3) | factory + 0xe006 | |
| 2.4g (rax0) | not on flash | lan + 1 |
| 5g (ra0) | not on flash | lan + 2 |
Mac addresses of the 2.4g and 5g interface are stored as ASCII strings in
the u-boot-env partition, but they are not used. OpenWrt calculates
Wifi Mac addresses based on the LAN Mac.
Flash and test instructions:
Flash the encrypted image (available in the OpenWrt forum) through the
stock D-Dink web interface.
1. Open the case, and solder the 4-pin header near the WAN port.
2. Connect it to a USB-UART TTL (3.3V) adapter, no need to connect VCC.
3. Open a terminal emulator (e.g. `screen /dev/ttyUSB0` on linux) with
the settings mentioned above.
4. Setup a TFTP server on your PC that can serve
`xxx-ramips-mt7621-dlink_dir-853-a1-initramfs-kernel.bin`.
5. Connect any LAN port to your PC and set a static IPv4 address to
192.168.0.101 (netmask 255.255.255.0).
6. Power on the device and keeps pressing 1 until you see the prompt.
7. Use default IP addresses and enter the file name accordingly, then hit
enter.
8. Wait until it boots to OpenWrt, the default IP address is 192.168.1.1,
you need to change your PC network adapter to use DHCP in order to access
LUCI.
9. So far, the OpenWrt runs in RAM and the flash contents are not touched.
You can try OpenWrt without having to overwrite the stock firmware, a
reboot clears all changes.
10. Optionally, backup the stock firmware (the "firmware" partition) in
Luci.
11. To permantly install OpenWrt to the device , click
on "System -> Backup/Flash Firmware" in Luci and flash
`xxx-ramips-mt7621-dlink_dir-853-a1-squashfs-sysupgrade.bin`
Known problems:
* WLAN0 defaults to 5G after a fresh installation, to enable 2.4G network,
you need to config it manually in LUCI.
* If you see jffs2 related warnings/errors after updating from the stock
web interface, you need to do a reset in LUCI. The error will be gone after
a cold reboot.
Signed-off-by: Hang Zhou <929513338qq@gmail.com>
Several devices depend on fw_printenv during sysupgrade. Make sure
it always is present in all images, including initramfs images built
by the buildbots.
Fixes: 2449a63208 ("ramips: mt7621: Add support for ZyXEL NR7101")
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Wiflyer WF3526-P and Zbtlink ZBT-WE1326 have the same circuit design.
Installing the misunderstading firmware of ZBT-WE3526 will cause Wi-Fi
not work due to allocate the wrong pcie port. Add alternative name to
help users easily build or download the correct firmware.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
FCC ID: A8J-EPG600
Engenius EPG600 is an indoor wireless router with
1 Gb ethernet switch, dual-band wireless,
internal antenna plates, USB, and phone lines (not supported)
this board is a Senao device:
the hardware is equivalent to EnGenius ESR600 (except for phone lines)
the software is Senao SDK which is based on openwrt and uboot
which uses the legacy Senao header with Vendor / Product IDs
to verify the firmware upgrade image.
**Specification:**
- MT7620 SOC MIPS 24kec, 2.4 GHz WMAC, 2x2
- RT5592N WLAN PCI chip, 5 GHz, 2x2
- QCA8337N Gb SW RGMII GbE, SW P0 -- SOC P5, 5 LEDs
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 64 MB RAM NT5TU32M16
- UART console J2, populated
- USB 2.0 port direct to SOC
- 6 GPIO LEDs power, 2G, 5G, wps2g, wps5g, line
- 3 buttons reset, wps, "reg" (registeration)
- 4 antennas internal omni-directional plates
NOT YET SUPPORTED: VoIP
- Si3050-FT + Si3019-FT Voice DAA, SPI control, PCM data
- Phone Ports "TEL", "LINE" RJ11, 4P2C (2 pins)
**MAC addresses:**
MAC address labeled as MAC ADDRESS
MACs present in both wifi cal data and uboot environment
eth0.1/phy1 ---- *:82 rf 0x4
phy0 ---- *:83 factory 0x4
eth0.2 MAC *:b8 "wanaddr"
**Installation:**
Method 1: Firmware upgrade page:
(if you cannot access the APs webpage)
factory reset with the reset button
connect ethernet to a computer
OEM webpage at 192.168.0.1
username and password 'admin'
Navigate to gear icon, "Device Management", "Tools"
select the factory.dlf image
Upload and verify checksum
Method 2: Serial to upload initramfs:
Follow directions for TFTP recovery
upload and boot initramfs and do a sysupgrade
**TFTP recovery:**
Requires UART serial console, reset button does nothing
rename initramfs-kernel.bin to 'uImageEPG600'
make available on TFTP server at 192.168.99.8
power board, interrupt boot with "4"
execute `tftpboot` and `bootm` (with the load address)
**Return to OEM:**
Images from OEM are provided, but not compatible
with openwrt sysupgrade. So it must be modified.
Alternatively, back up all mtd partitions before flashing
**Note on switch registers:**
The necessary registers needed for the QCA8337 switch
can be read from interrupted boot (tftpboot, bootm)
by using the following lines in the switch driver ar8327.c
in the function 'ar8327_hw_config_of'
where 'qca,ar8327-initvals' is parsed from DTS
before the new register values are written:
pr_info("0x04 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD0_MODE));
pr_info("0x08 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD5_MODE));
pr_info("0x0c %08x\n", ar8xxx_read(priv, AR8327_REG_PAD6_MODE));
pr_info("0x10 %08x\n", ar8xxx_read(priv, AR8327_REG_POWER_ON_STRAP));
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Specifications:
- Device: ASUS RT-AX54 (AX1800S/HP,AX54HP)
- SoC: MT7621AT
- Flash: 128MB
- RAM: 256MB
- Switch: 1 WAN, 4 LAN (10/100/1000 Mbps)
- WiFi: MT7905 2x2 2.4G + MT7975 2x2 5G
- LEDs: 1x POWER (blue, configurable)
1x LAN (blue, configurable)
1x WAN (blue, configurable)
1x 2.4G (blue, not configurable)
1x 5G (blue, not configurable)
Flash by U-Boot TFTP method:
- Configure your PC with IP 192.168.1.2
- Set up TFTP server and put the factory.bin image on your PC
- Connect serial port(rate:115200) and turn on AP, then interrupt "U-Boot Boot Menu" by hitting any key
Select "2. Upgrade firmware"
Press enter when show "Run firmware after upgrading? (Y/n):"
Select 0 for TFTP method
Input U-Boot's IP address: 192.168.1.1
Input TFTP server's IP address: 192.168.1.2
Input IP netmask: 255.255.255.0
Input file name: openwrt-ramips-mt7621-asus_rt-ax1800hp-squashfs-factory.bin
- Restart AP aftre see the log "Firmware upgrade completed!"
Signed-off-by: Karl Chan <exkc@exkc.moe>
This commit adds support for the V4 hardware revision of the Deco M4R.
V4 is a complete overhaul of the hardware compared to V1 and V2,
and is much more similar to the Archer C6 V3 and C6U V1.
Specifications:
SoC: MediaTek MT7621AT (2 cores at 880 MHz, 4 threads)
RAM: Kingston D1216ECMDXGJD (256 MB)
Wireless 2.4 GHz: MediaTek MT7603EN
Wireless 5 GHz: MediaTek MT7613BEN
Flash: 16 MB SPI NOR
Installation:
Flash the *-factory.bin image in the U-Boot recovery webserver.
You can trigger this webserver by holding the reset button until the LED
flashes yellow, or by hooking up to serial pads on the board (clearly
labeled GND, RX and TX) and pressing `x` early in boot.
Once the factory image has been flashed, you can use the regular upgrade
procedure with sysupgrade images for subsequent flashes.
Signed-off-by: Mark Ceeha <hi@shiz.me>
Tested-by: Mark Ceeha <hi@shiz.me>
Device is the same as Xiaomi Mi Router 4A Gigabit, except of:
- 5G WiFi is MT7663
- addresses of leds, wifi and eth ports are slightly changed
Specs:
SoC: MT7621
CPU: 2 x 880 MHz
ROM: 16 MB
RAM: 128 MB
WLAN: MT7603, MT7663
MAC addresses:
WAN **** factory 0xe006 (label)
LAN *:f7 factory 0xe000
2.4 GHz *:f8 factory 0x0000+0x4 (mtd-eeprom+0x4)
5 GHz *:f9 factory 0x8000+0x4 (mtd-eeprom+0x4)
Installation:
Factory firmware is based on a custom OpenWrt 17.x.
Installation is the same as for Xiaomi Mi Router 4A Gigabit.
Probably the easiest way to install is to use the script from
this repository: https://github.com/acecilia/OpenWRTInvasion/pull/155
In a more advanced case, you can do everything yourself:
- gain access to the device through one of the exploits described
in the link above
- upload sysupgrade image to /tmp
- overwrite stock firmware:
# mtd -e OS1 -r write /tmp/sysupgrade.bin OS1
Recovery:
Recovery procedure is the same as for Xiaomi Mi Router 4A Gigabit.
Possible options can be found here:
https://openwrt.org/inbox/toh/xiaomi/xiaomi_mi_router_4a_gigabit_edition
One of the ways is to use another router with OpenWrt:
- connect both routers by their LAN ports
- download stock firmware from [1]
- place it inside /tmp/test.bin on the main router
- configure PXE/TFTP on the main router
- power off 4Av2, hold Reset button, power on
- as soon as image download via TFTP starts, Reset can be released
- blinking blue wan LED will indicate the end of the flashing process,
now router can be rebooted
[1] http://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/r4av2/miwifi_r4av2_firmware_release_2.30.28.bin
Signed-off-by: Dmitry Sokolov <e323w@proton.me>
- drop unneeded default-state for led_power
- concat firmware partitions to extend available free space
- increase spi flash frequency to 32 Mhz (value from stock firmware bootlog)
- drop broken-flash-reset because of onboard flash chip W25Q256FV has reset support
- add compatible for pcie wifi according to kernel documetation
- switch to wan mac address with offset 0x28 in rf-eeprom
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
This is cosmetic change. The hex value is related to the device
model and more human friendly.
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
The Arcadyan WE420223-99 is a WiFi AC simultaneous dual-band access
point distributed as Experia WiFi by KPN in the Netherlands. It features
two ethernet ports and 2 internal antennas.
Specifications
--------------
SOC : Mediatek MT7621AT
ETH : Two 1 gigabit ports, built into the SOC
WIFI : MT7615DN
BUTTON: Reset
BUTTON: WPS
LED : Power (green+red)
LED : WiFi (green+blue)
LED : WPS (green+red)
LED : Followme (green+red)
Power : 12 VDC, 1A barrel plug
Winbond variant:
RAM : Winbond W631GG6MB12J, 1GBIT DDR3 SDRAM
Flash : Winbond W25Q256JVFQ, 256Mb SPI
U-Boot: 1.1.3 (Nov 23 2017 - 16:40:17), Ralink 5.0.0.1
Macronix variant:
RAM : Nanya NT5CC64M16GP-DI, 1GBIT DDR3 SDRAM
Flash : MX25l25635FMI-10G, 256Mb SPI
U-Boot: 1.1.3 (Dec 4 2017 - 11:37:57), Ralink 5.0.0.1
Serial
------
The serial port needs a TTL/RS-232 3V3 level converter! The Serial
setting is 57600-8-N-1. The board has an unpopulated 2.54mm straight pin
header.
The pinout is: VCC (the square), RX, TX, GND.
Installation
------------
See the Wiki page [1] for more details, it comes down to:
1. Open the device, take off the heat sink
2. Connect the SPI flash chip to a flasher, e.g. a Raspberry Pi. Also
connect the RESET pin for stability (thanks @FPSUsername for reporting)
3. Make a backup in case you want to revert to stock later
4. Flash the squashfs-factory.trx file to offset 0x50000 of the flash
5. Ensure the bootpartition variable is set to 0 in the U-Boot
environment located at 0x30000
Note that the U-Boot is password protected, this can optionally be
removed. See the forum [2] for more details.
MAC Addresses(stock)
--------------------
+----------+------------------+-------------------+
| use | address | example |
+----------+------------------+-------------------+
| Device | label | 00:00:00:11:00:00 |
| Ethernet | + 3 | 00:00:00:11:00:03 |
| 2g | + 0x020000f00001 | 02:00:00:01:00:01 |
| 5g | + 1 | 00:00:00:11:00:01 |
+----------+------------------+-------------------+
The label address is stored in ASCII in the board_data partition
Notes
-----
- This device has a dual-boot partition scheme, but OpenWRT will claim
both partitions for more storage space.
Known issues
------------
- 2g MAC address does not match stock due to missing support for that in
macaddr_add
- Only the power LED is configured by default
References
----------
[1] https://openwrt.org/inbox/toh/arcadyan/astoria/we420223-99
[2] https://forum.openwrt.org/t/adding-openwrt-support-for-arcadyan-we420223-99-kpn-experia-wifi/132653
Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Signed-off-by: Harm Berntsen <git@harmberntsen.nl>
Add support for D-Link DIR-1935 A1 based on similarities to DIR-882 A1,
DIR-867 A1 and other DIR-8xx A1 models. Existing DIR-882 A1 openwrt
"factory" firmware installs without modificaitons via the D-Link
Recovery GUI and has no known incompatibilities with the DIR-1935 A1.
Changes to be committed:
new file: target/linux/ramips/dts/mt7621_dlink_dir-1935-a1.dts
modified: target/linux/ramips/image/mt7621.mk
modified: target/linux/ramips/mt7621/base-files/etc/board.d/01_leds
Specifications:
* Board: Not known
* SoC: MediaTek MT7621 Family
* RAM: 128 MB (DDR3)
* Flash: 16 MB (SPI NOR)
* WiFi: MediaTek MT7615 Family (x2)
* Switch: 1 WAN, 4 LAN (Gigabit)
* Ports: 1 USB 3.0
* Buttons: Reset, WiFi Toggle, WPS
* LEDs: Power (green/orange), Internet (green/orange), WiFi 2.4G (green),
WiFi 5G (green)
Notes:
* 160MHz 5GHz is available in LuCi but does not appear to work (i.e. no
SSID is visible in wifi scanning apps on other devices) with either
official DIR-882 A1 firmware or a test build for the DIR-1935 A1 based
on the 22.03.2 branch. 80 MHz 5GHz works.
Serial port:
* Untested (potential user damage/error)
* Expected to be identical to other DIR-8xx A1 models:
* Parameters: 57600, 8N1
* Location: J1 header (close to the Reset, WiFi and WPS buttons)
* Pinout: 1 - VCC
2 - RXD
3 - TXD
4 - GND
Installation:
* D-Link Recovery GUI: power down the router, press and hold the reset
button, then re-plug it. Keep the reset button pressed until the power
LED starts flashing orange, manually assign a static IP address under
the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1
* Some modern browsers may have problems flashing via the Recovery GUI,
if that occurs consider uploading the firmware through cURL:
curl -v -i -F "firmware=@file.bin" 192.168.0.1
Signed-off-by: Keith Harrison <keithh@protonmail.com>
The Asus RT-AX1800U is identical to the already supported Asus RT-AX53U.
Use the ALT0 buildroot tags to show both devices.
Tested-by: Marian Sarcinschi <znevna@gmail.com>
Signed-off-by: Felix Baumann <felix.bau@gmx.de>
This device is a 'Range extender' variant of the Xiaomi 4A router.
Its identical to the 100m non-intl/chinese version as much as it can run
the same firmware, differences being form factor, LEDs, WPS button
and one 100M port only.
The stock firmware differs significantly, being 'app managed only'.
Device specification
--------------------
SoC: MT7628DAN MIPS_24KEc@580MHz 2.4G-n 2x2
WiFi: MT7612EN 5G-ac 80MHz 2T2R
Flash: 16MB W25Q128BV
DRAM: 64MB built-in SoC
Switch: built-in SoC
Ethernet: 1x10/100 Mbps
USB: None
Antennas: 2 x external, non-detachable
LEDs: 2 programmable blue/amber
Buttons: WPS and reset (hidden)
Housing: Range Extender / Wall wart
Serial: 115200,8n1
MAC Addresses
-------------
All 3 MACs are read from flash and identical to stock.
Label MAC is WIFI 2G
Installation
------------
No HTML UI on this device, serial console only. The serial connector
is unpopulated but standard size and clearly marked. Flash from the
U-Boot shell at boot by choosing (2) and flashing the sysupgrade file
via tftp.
Recovery/Debricking procedures of the xiaomi 4A and variants should
work, but there currently is no official source for the stock firmware.
Signed-off-by: Jo Deisenhofer <jo.deisenhofer@gmail.com>
This adds basic support for TP-Link EC330-G5u Ver:1.0 router (also known
as TP-Link Archer C9ERT).
Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 128 MiB, Nanya NT5CC64M16GP-DI
Flash: 128 MiB NAND, ESMT F59L1G81MA-25T
Wireless 2.4 GHz (MediaTek MT7615N): b/g/n, 4x4
Wireless 5 GHz (MediaTek MT7615N): a/n/ac, 4x4
Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4)
USB ports: 1xUSB3.0
Button: 4 (Led, WiFi On/Off, Reset, WPS)
LEDs: 7 blue LEDs, 1 orange(amber) LED, 1 white(non-gpio) LED
Power: 12 VDC, 2 A
Connector type: Barrel
Bootloader: First U-Boot (1.1.3), Main U-Boot (1.1.3). Additionally,
original TP-Link firmware contains Image U-Boot (1.1.3).
Serial console (UART)
---------------------
V
+-------+-------+-------+-------+
| +3.3V | GND | TX | RX |
+---+---+-------+-------+-------+
| J2
|
+--- Don't connect
Installation
------------
1. Rename OpenWrt initramfs image to test.bin and place it on tftp server
with IP 192.168.0.5
2. Attach UART, switch on the router and interrupt the boot process by
pressing 't'
3. Load and run OpenWrt initramfs image:
tftpboot
bootm
4. Once inside OpenWrt, switch to the first boot image:
fw_setenv BootImage 0
5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image
Back to Stock
-------------
1. Run in the OpenWrt shell:
fw_setenv BootImage 1
reboot
Recovery
--------
1. Press Reset button and power on the router
2. Navigate to U-Boot recovery web server (http://192.168.0.1/) and upload
the OEM firmware
MAC addresses
-------------
+---------+-------------------+-------------------+-------------+
| | MAC example 1 | MAC example 2 | Algorithm |
+---------+-------------------+-------------------+-------------+
| label | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label |
| LAN | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label |
| WAN | 72:ff:7b:xx:xx:f5 | 54:d4:f7:xx:xx:db | label+1 [1] |
| WLAN 2g | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label |
| WLAN 5g | 68:ff:7b:xx:xx:f6 | 50:d4:f7:xx:xx:dc | label+2 |
+---------+-------------------+-------------------+-------------+
label MAC address was found in factory at 0x165 (text format
xx:xx:xx:xx:xx:xx).
Notes
-----
[1] WAN MAC address:
a. First octet of WAN MAC is differ than others and OUI is not related
to TP-Link company. This probably should be fixed.
b. Flipping bits in first octet and hex delta are different for the
different MAC examples:
+-----------------+----------------+----------------+
| | Example 1 | Example 2 |
+-----------------+----------------+----------------+
| LAN | 68 = 0110 1000 | 50 = 0101 0000 |
| MAC (1st octet) | ^ ^ ^ | |
+-----------------+----------------+----------------+
| WAN | 72 = 0111 0010 | 54 = 0101 0100 |
| MAC (1st octet) | ^ ^ ^ | ^ |
+-----------------+----------------+----------------+
| HEX delta | 0xa | 0x4 |
+-----------------+----------------+----------------+
| DEC delta | 4 | 4 |
+-----------------+----------------+----------------+
c. DEC delta is a constant (4). This looks like a mistake in OEM
firmware and probably should be fixed.
Based on the above, I decided to keep correct OUI and make WAN MAC =
label + 1.
[2] Bootloaders
The device contains 3 bootloaders:
- First U-Boot: U-Boot 1.1.3 (Mar 18 2019 - 12:50:24). The First U-Boot
located on NAND Flash to load next full-feature Uboot.
- Main U-Boot + its backup: U-Boot 1.1.3 (Mar 18 2019 - 12:50:29). This
bootloader includes recovery webserver. Requires special uImages to
continue the boot process:
0x00 (os0, os1) - firmware uImage
0x40 (os0, os1) - standalone uImage (OpenWrt kernel is here)
- Additionally, both slots of the original TP-Link firmware contains
Image U-Boot: U-Boot 1.1.3 (Oct 16 2019 - 08:14:45). It checks image
magics and CRCs. We don't use this U-Boot with OpenWrt.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
