NRadio C8-668GL is a Wi-Fi 6 5G cellular router based on MediaTek MT7981B SoC.
- **SoC**: MediaTek MT7981B (2x Cortex-A53, 1.3GHz)
- **RAM**: Nanya NT5AD512M16C4-JR 1GB DDR4
- **Flash**: ESMT FC51L08SFY3A 8GB eMMC
- **Ethernet**:
- 1x 2.5GbE (via GMAC0 and GPY211 PHY, shared with MT7531AE)
- 3x 10/100/1000 Mbps (via MT7531AE, connected to GMAC0)
- 5G Modem: GMAC1 (via GPY211 PHY - RTL8125BG - RM520N-GL)
- **Wi-Fi**: MediaTek MT7976CN (2.4GHz/5GHz, 802.11ax, 2x2 MIMO, AX3000)
- **Buttons**: Reset, WPS
- **LEDs**: Power, 5G, 4G, WiFi
- **SIM Slot**: 1x Nano SIM
- **5G Modem**: Quectel RM520N-GL (Snapdragon™ X62)
- **Power**: 12V/2A DC, 5.5×2.1 connector
The MAC addresses are derived from the `fac_mac` field in the `bdinfo` partition, formatted as `fac_mac = HWMAC`. The allocation is as follows:
| Vendor | OpenWrt Interface | Address | Notes |
|---------|-------------------|---------------|------------------------------------------------|
| LAN | br-lan | Label MAC | Default |
| WAN | lan4 | Label MAC+1 | Only when lan4 is switched to WAN |
| 2.4GHz | phy0-ap0 | Label MAC | |
| 5GHz | phy1-ap0 | Label MAC | (Local Admin bit set) |
| Modem | eth1 | Label MAC+2 | |
1. Log in to the router via `http://192.168.66.1`/.
2. Upgrade the official firmware to dual-system mode.
3. Select **Burn second system** and upload the `sysupgrade.bin` image.
- Download the image from the OpenWrt build system or build it yourself using the OpenWrt buildroot.
4. Wait for 30 seconds and click **Switch system**.
5. The device will reboot and switch to OpenWrt.
Set the U-Boot environment variable `boot_system=0` and reboot:
```bash
fw_setenv boot_system 0
```
Power off the router, hold the **WPS button**, and power it back on.
1. Rename the stock firmware file to **`recovery.bin`**.
2. Set your PC's Ethernet IP to **192.168.1.88** and connect it to the lan1 port on the router.
3. Run a TFTP server and place the `recovery.bin` file in its root directory.
4. Power off the router, press and hold the **Reset button**, and power it back on.
5. Release the Reset button when the TFTP server shows activity.
6. Wait for the router to flash the firmware and reboot automatically.
- By default, `lan4` is part of `br-lan` and uses the label MAC address.
- To query the RM520N-GL module, use the following command:
```bash
cat /dev/ttyUSB2 & printf 'ATI\r\n' > /dev/ttyUSB2
```
Signed-off-by: Yaoguang Bai <0xdeadc0de@badguys.club>
Link: https://github.com/openwrt/openwrt/pull/17093
Signed-off-by: John Crispin <john@phrozen.org>
Specification:
* Mediatek MT7981BA
* 256 MB SPI-NAND
* 512 MB DDR4 RAM
* MT7976CN DBDC AX Wi-Fi
* MediaTek MT7531AE (3x LAN Gigabit ports) + Internal Gbe Phy (1x WAN Gigabit port)
* 4x LED (power, internet, fn, wifi)
* 3x buttons (wps, fn, reset)
* 1x USB 3.0 port
Serial Interface:
* 3 Pins GND, RX, TX
* Settings: 115200, 8N1
Notes:
* The device supports dual boot mode
* Fn led reassigned to wlan 2.4
Flash instruction:
The only way to flash OpenWrt image is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24 and tftp server.
2. Rename "openwrt-mediatek-filogic-keenetic_kn-3811-squashfs-factory.bin"
to "KN-3811_recovery.bin" and place it in tftp server directory.
3. Connect PC with ethernet port, press the reset button, power up
the device and keep button pressed until status led start blinking.
4. Device will download file from server, write it to flash and reboot.
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17135
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
- MT7981 CPU using 2.4GHz and 5GHz WiFi (both AX)
- 512MB RAM
- 128MB SPI NAND
- 2 LEDs (green, orange)
- 3 buttons (fn, reset, wps)
- 2 2.5Gbit ethernet ports based on Airoha EN8811H phy
Serial Interface:
- 3 Pins GND, RX, TX
- Settings: 115200, 8N1
Notes:
- The device supports dual boot mode
Flash instruction:
The only way to flash OpenWrt image is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24 and tftp server.
2. Rename "openwrt-mediatek-filogic-keenetic_kn-3911-squashfs-factory.bin"
to "KN-3911_recovery.bin" and place it in tftp server directory.
3. Connect PC with ethernet port, press the reset button, power up
the device and keep button pressed until status led start blinking.
4. Device will download file from server, write it to flash and reboot.
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16830
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds kmod-leds-ktd202x to the OpenWrt image for the device
"Acer Connect Vero W6m" which is equipped with one KTD2026 controlling the
device's status LED via I2C.
Signed-off-by: George Oldfort <openwrt@10099.de>
Link: https://github.com/openwrt/openwrt/pull/16860
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Image build fails with PR #16861 merged while PR #16860 not merged.
Removing kmod-leds-ktd202x from filogic.mk will fix the build process.
Fixes: 2898d1d126 ("mediatek: add support for Acer Predator W6d and Acer Vero W6m")
Signed-off-by: George Oldfort <openwrt@10099.de>
Link: https://github.com/openwrt/openwrt/pull/17087
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds OpenWrt U-Boot layout support for Routerich AX3000. The
aims:
1. Get open-source U-Boot;
2. Get maximum available free space in OpenWrt.
Install
-------
1. Copy OpenWrt ubootmod-bl31-uboot.fip, ubootmod-preloader.bin, to the
/tmp folder of the router using scp.
2. Make mtd partitions backups:
http://192.168.1.1/cgi-bin/luci/admin/system/flash -> Save mtdblock
contents
3. Install kmod-mtd-rw:
```
opkg update && opkg install kmod-mtd-rw
```
4. Write FIP and preloader:
```
insmod mtd-rw i_want_a_brick=1
mtd unlock BL2
mtd erase BL2
mtd write /tmp/ubootmod-preloader.bin BL2
mtd unlock FIP
mtd erase FIP
mtd write /tmp/ubootmod-bl31-uboot.fip FIP
```
5. Copy OpenWrt ubootmod-initramfs-recovery.itb to the tftp server root
with IP 192.168.1.254.
6. Reboot router:
```
reboot
```
U-Boot will automatically download from the tftp server and boot OpenWrt
initramfs system.
7. Copy OpenWrt ubootmod-squashfs-sysupgrade.itb to the /tmp dir of the
router using scp.
8. Run sysupgrade:
```
sysupgrade -n /tmp/squashfs-sysupgrade.itb
```
Recovery
--------
1. Place OpenWrt initramfs-recovery.itb image (with original name) on the
tftp server (IP: 192.168.1.254).
2. Press "reset" button and power on the router. After ~10 sec release the
button.
3. Use OpenWrt initramfs system for recovery.
BL2 and FIP recovery
--------------------
Use mtk_uartboot and UART connection if BL2 or FIP in UBI is destroyed:
Link: https://github.com/981213/mtk_uartboot
Return to stock:
----------------
1. Copy partition backups (BL2.bin and FIP.bin) to the /tmp dir of the
router using scp.
2. Install kmod-mtd-rw:
```
opkg update && opkg install kmod-mtd-rw
```
3. Restore stock U-Boot and reboot:
```
insmod mtd-rw i_want_a_brick=1
mtd unlock BL2
mtd erase BL2
mtd write /tmp/BL2.bin BL2
mtd unlock FIP
mtd erase FIP
mtd write /tmp/FIP.bin FIP
reboot
```
4. Open U-Boot web recovery, upload stock firmware image and start
upgrade.
Link: http://192.168.1.1
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16791
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware
--------
MediaTek MT7981 WiSoC
256MB DDR3 RAM
128MB SPI-NAND (XMC XM25QH128C)
MediaTek MT7981 2x2 DBDC 802.11ax 2T2R (2.4 / 5)
UART: 115200 8N1 3.3V
MAC:
LAN MAC: label mac
WAN MAC: label mac + 1
2.4G MAC: label mac
5G MAC: label mac + 1 with LA bit set
Installation
------------
1. Connect to the serial port as described in the "Hardware" section.
2. Power on the device + press reset pin. Keep pressing reset pin to enter the U-Boot shell.
3. Download the OpenWrt initramfs image. Place it on an TFTP server
connected to the Cudy LAN ports. Make sure the server is reachable at
192.168.1.88. Rename the image to "cudy3000s.bin"
4. Download and boot the OpenWrt initramfs image.
$ tftpboot 0x46000000 cudy3000s.bin; bootm 0x46000000
5. Transfer the OpenWrt sysupgrade image to the device using scp.
Install with sysupgrade.
Signed-off-by: David Ignjic <ignjic@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16939
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for two variants of the already supported router
Acer Predator Connect W6: The Acer Predator Connect W6d (W6 without 6 GHz
wifi) and the Acer Connect Vero W6m (W6 without 2.5G eth1 port, usb3 port,
and the 6 on-board gpio RGB LEDs, and with a KTD2026 RGB LED controller
instead of the KTD2061 LED controller of the W6/W6d).
The device tree for the W6m refers to the KTD202x driver suggested in
PR #16860.
Patching target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
removes the code repetition in (old) lines 121 to 124 on the occasion.
This is the last of four commits into which the original commit was split
to make reviews easier and more targeted.
Signed-off-by: George Oldfort <openwrt@10099.de>
Link: https://github.com/openwrt/openwrt/pull/16861
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
In order to prepare for OpenWrt support other Acer W6 devices and to get
a step further to full hardware support for Acer Predator Connect W6, this
commit
- adjusts the product name ("Acer Predator Connect W6")
- updates gpio LED labels to function/color scheme
- show router status by using first rgb led instead of it's red color only
(blue: booting/failsafe mode; red: sysupgrade; green: running – was: red)
- changes switch/eth1 led configuration to reflect RX/TX activity and speed
(green: full 1Gbps/2.5Gbps speed; amber: lower speed; blink: RX/TX)
- shortens dummy dm-mod.create string in bootargs
- enables W6's i2c interface
This is the third of four commits into which the original commit was split
to make reviews easier and more targeted.
Signed-off-by: George Oldfort <openwrt@10099.de>
Link: https://github.com/openwrt/openwrt/pull/16861
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
All new routers are shipped with ubi size 112MB since early September.
Bootloader update required (ask vendor , see wiki)
These partitions weren't used:
firmware_backup
zrsave
config2
Signed-off-by: Romanov Danila <pervokur@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16686
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The GatoNetworks GDSP is a re-branded version of the R5000 5G Industrial
router from Yinghua Technologies.
The re-branded device comes with OpenWrt preinstalled, and an OpenWrt-based
U-Boot bootloader version. While the flash layout has been kept compatible
with the OpenWrt version found on the stock device (see [5]), the image format
changed, making a bootloader upgrade necessary.
Specifications:
SoC: Mediatek MT7981BA
RAM: 256MB
Flash: SPI-NOR 32 MiB (Winbond W25Q256)
WLAN: MT7976CN DBDC AX Wi-Fi
Switch: MT7531AE (4x LAN Gigabit ports, 1x WAN Gigabit port)
5G: Quectel RM520N modem
Watchdog: an external WDT connected to GPIO 6 is present and always running;
the built-in Mediatek watchdog is also present and effective, but
not used at the moment.
This porting has been tested only with 1x 5G modems installed (the device
supports up to two).
Installation:
Installation is possible via sysupgrade both in the stock device and
re-branded version. However, in the former case, updating the bootloader is
required.
OpenWrt-based U-Boot Bootloader installation
--------------------------------------------
The firmware flashed in the re-branded device at manifacturing time will
flash an OpenWrt-based U-Boot bootloader with some extra recovery features
(see [1]) at first boot.
To update the bootloader, you need to install the mtd-rw module and
insmod it:
insmod mtd-rw i_want_a_brick=1
Then update relevant flash partitions:
mtd erase u-boot-env
mtd erase BL2
mtd erase FIP
mtd write openwrt-mediatek-filogic-gatonetworks_gdsp-preloader.bin BL2
mtd write openwrt-mediatek-filogic-gatonetworks_gdsp-bl31-uboot.fip FIP
And reboot, making sure all previous commands ran succesfully.
If something goes wrong, you can recover your device via the mtk_uartboot
tool.
In my testing, it was possible to start the process even without (un)-plugging
the device, may be handy for remote recovery.
Installation from stock device and firmware
-------------------------------------------
To install vanilla OpenWrt in the stock device (R5000 5G Industrial router
from Yinghua Technologies) running the stock vendor firmware, you will need
to update your bootloader as described in previous section. Remember to use
-F (force upgrade) and -n (not keeping settings).
U-Boot Recovery
---------------
This procedure has been tested only with the OpenWrt-based U-boot bootloader.
Assign your system static IP address 192.168.1.1 and start a TFTP server. The
device will look for an initramfs image named
openwrt-mediatek-filogic-gatonetworks_gdsp-initramfs-kernel.bin
(so you may use openwrt/bin/targets/mediatek/filogic as root dir for your
TFTP server).
Power on the device while keeping the reset button pressed, until you see
a TFTP request from 192.168.1.10. Your environment will be restored to it's
default state.
MAC addresses assignment
------------------------
MAC addresses are assigned slightly differently than in stock firmware. In
particular, the 5 GHz Wi-Fi uses 2.4 GHZ MAC + 1, rather than reusing it with
LA bit set as done in stock firmware. This MAC address is allocated to the
device, so it can be used.
The 2.4 GHz Wi-Fi MAC address is the label MAC. LAN MAC is used to set the
special U-Boot environment ethaddr variable.
device MAC address U-Boot env variable factory partition offset
2.4 GHz Wi-Fi :84 wifi_mac 0x4
5.8 GHz Wi-Fi :85 not present not present
WAN :86 wan_mac 0x24
LAN :87 lan_mac 0x2A
Notes
-----
[1]: the OpenWrt-based U-Boot bootloader you will find installed in the
re-branded device is configured to request for the initramfs image via
TFTP for $gdsp_tftp_tries times before trying normal boot from NOR flash.
Setting this U-Boot environment variable to 0x0 will disable the feature,
which is not implemented in this patch.
[2]: the exposed UART port is connected to ttyS1; the ttyS0 console port is
not exposed.
[3]: the provided bootloader environment has no provision for operating on
BL2 and the FIP partitions. This is an intentional choice to make it
(slightly) more difficult to brick the device.
[4]: it seems GPIO 6 is used both for the "SYS" LED and external WDT.
[5] BL2 expects to find FIP payload at a fixed offset, so some constraints
apply.
Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com>
The ImageBuilder when using the profile for the OpenWrt One has been
failing because the initramfs image included in the ubinized image could
not be found.
Fix that by using the staged initramfs instead when using the
ImageBuilder.
Fixes: 797904b3cb ("mediatek/filogic: add OpenWrt One support")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Select MT7996 2+3+3 firmware for the Adtran SmartRG SDG-8733A device
and also add it to the image for the BPi-R4 which supports both,
BE19000 (4+5+5) as well as BE14000 (2+3+3) Wi-Fi 7 modules.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Add u-boot support based on the kernel dts introduced in d1016446 and
the GL-MT6000 u-boot support in fe10f974.
The pcie-mediatek-gen3 kernel driver doesn't like hotplug, so to work in
PCIe mode, the 5G modem on this device needs to be switched on by u-boot
before starting the kernel. Include an init_modem step in the boot_system
action to set the relevant gpios. (The factory bootloader does the same,
using Mediatek SDK-specific gpio_power_clr and gpio_pull_up.)
Ideally the modem would be started using gpio-hog in the device tree, but
this will need to wait until mediatek gpio-hog support is fixed upstream:
https://lore.kernel.org/u-boot/6ef2583e85eea60560d7776377d662779e7c44e5.1722419839.git.chris@arachsys.com/
The bootloader can be replaced using the built-in web interface of the
factory bootloader. Hold the reset button for five seconds while powering
on the device and it will boot into a recovery http server.
http://192.168.1.1/uboot.html and http://192.168.1.1/bl2.html can then
be used to upload openwrt-mediatek-filogic-glinet_gl-x3000-bl31-uboot.fip
and openwrt-mediatek-filogic-glinet_gl-x3000-preloader.bin respectively.
Alternatively, from a root shell on the running system, unlock the boot
partition with
echo 0 >/sys/block/mmcblk0boot0/force_ro
then write openwrt-mediatek-filogic-glinet_gl-x3000-bl31-uboot.fip to
/dev/mmcblk0p4 and openwrt-mediatek-filogic-glinet_gl-x3000-preloader.bin
to /dev/mmcblk0boot0.
Signed-off-by: Chris Webb <chris@arachsys.com>
Link: https://github.com/openwrt/openwrt/pull/15645
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification is similar to other devices of the MT Stuart series:
* Mediatek MT7988D (3x Cortex-A73, up to 1.8 GHz clock speed)
* 8 GiB eMMC
* 2 GiB DDR4 RAM
* 2500M/1000M/100M LAN port
* 10000M/5000M/2500M/1000M/100M/10M WAN port
* MT7992 Tri-band (2.4G, 5G, 6G) 2T2R+3T3R+3T3R 802.11be Wi-Fi
* Renesas DA14531MOD Bluetooth
* 2 buttons (Reset, Mesh/WPS)
* uC-controlled RGB LED via I2C
* 2x LED for the 2.5G port, 3x LED for the 10G port
* 3.3V-level 115200 baud UART console via 4-pin Dupont connector
exposed at the bottom of the device
* USB-C PD power input
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The company Zyxel rebranded some years ago.
Currently the casing is according to the old branding even
for newer devices which already use the new branding.
This commit aligns the casing of Zyxel everywhere.
Signed-off-by: Goetz Goerisch <ggoerisch@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15652
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
- MT7629 CPU
- MT7531 switch
- MT7761N and MT7762N wifi
- 256 MB RAM
- 128 MB NAND flash with dual-boot partitions
- 2 buttons: WPS and reset
- 1 WAN port (1G)
- 4 LAN ports (1G)
- 1 USB port
Limitations (same as other MT7629/MT7761N/MT7762N devices):
- Wifi is not working
- Second core is not working (kernel error message "CPU1: failed to come online")
Disassembly:
- There are two screws under the front rubber feet and two under the label on the bottom (in the corners towards the back, you should be able to feel them).
Serial Interface:
- UART pin header is already soldered on the board. Pinning from front to back:
1 - VCC
2 - TX
3 - RX
4 - n/a
5 - GND
GPIO:
- 1 white LED, connected to GPIO 52
- 1 reset button, connected to GPIO 60
- 1 WPS button, connected to GPIO 58
MAC Adresses:
- The MAC address printed on the device label is used for LAN and WAN
- The MAC address is stored in the devinfo partition in ASCII format (hw_mac_addr=aa:bb:cc:dd:ee)
- 2.4 GHz wifi uses MAC of the device label + 1
- 5 GHz wifi uses MAC of the device label + 2
Flashing:
- OpenWrt is only runnig in the first partition of dual boot
- To ensure to be able to go back to the factory image, flash the last OEM firmware via OEM web interface. This will ensure that the OEM firmware is present on both partitions
- Because of dual boot partitions, flashing via OEM interface is not supported
- Start a TFTP server and provide the initramfs image. Default settings:
- Router IP: 192.168.1.1
- TFTP server IP: 192.168.1.100
- TFTP file name: 7531.bin
- Open the device, connect UART and select " 1. System Load Linux to SDRAM via TFTP." during startup
- Adapt the settings to your environment, if required
- After initramfs is booted, flash the sysupgrade image
Return to OEM firmware:
- Run the following commands in OpenWrt to switch to the second partition
fw_setenv boot_part 2
fw_setenv bootimage 2
- Reboot the device. OEM firmware will start up again
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16067
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware specification:
SoC: MediaTek MT7986A 4x A53
Flash: ESMT F50L1G41LB 128MB
RAM: MT40A512M16TB-062ER 1GB
Ethernet: 2x 2.5G, 4x 1G Lan
WiFi1: MT7976GN 2.4GHz 4T4R
WiFi2: MT7976AN 5.2GHz 4T4R
WiFi3: MT7915AN 5.8GHz 4T4R
Button: Reset, WPS, Turbo
USB: 1 x USB 3.0
Power: DC 12V 5A
Flash instructions:
1. Execute the following operation to open nc shell:
https://openwrt.org/inbox/toh/tp-link/xdr-6086#rooting
2. Replace the stock bootloader to OpenWrt's:
dd bs=131072 conv=sync of=/dev/mtdblock9 if=/tmp/xxx-preloader.bin
dd bs=131072 conv=sync of=/dev/mtdblock9 seek=28 if=/tmp/xxx-bl31-uboot.fip
3. Connect to your PC via the Gigabit port of the router,
set a static ip on the ethernet interface of your PC.
4. Download the initramfs image, and restart the router,
waiting for tftp recovery to complete.
5. After openwrt boots up, perform sysupgrade.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/15930
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Ubiquiti has a set of UniFi 802.11ax (Wi-Fi 6) AP devices. All models
include "U6" in their names and also have code names with no special
characters (including spaces).
Examples:
1. U6 Lite (codename U6-Lite)
2. U6 Long-Range (codename U6-LR)
3. U6+ (codename U6-PLUS)
4. U6 Pro (codename U6-Pro)
5. U6 Mesh (codename U6-Mesh)
6. U6 Mesh Pro (codename U6-Mesh-Pro)
7. U6 Enterprise (codename U6-Enterprise)
Use proper full names for those devices. Names in OpenWrt/DTS code may
need updating too but it can be handled later.
Cc: Elbert Mai <code@elbertmai.com>
Cc: Daniel Golle <daniel@makrotopia.org>
Cc: Henrik Riomar <henrik.riomar@gmail.com>
Cc: David Bauer <mail@david-bauer.net>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 128 MB SPI-NAND
RAM: 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, Mesh
Power: DC 12V 1A
Gain telnet access:
1. Login into web interface, and download the configuration.
2. Decode and uncompress the configuration:
* Enter fakeroot if you are not login as root.
base64 -d e-xxxxxxxxxxxx-cfg.tar.gz | tar -zx
3. Edit 'etc/passwd', remove root password: 'root::1:0:99999:7:::'.
4. Edit 'etc/rc.local', insert telnetd command before 'exit 0':
( sleep 3s; /usr/sbin/telnetd; ) &
5. Repack the configuration:
tar -zc etc/ | base64 > e-xxxxxxxxxxxx-cfg.tar.gz
6. Upload new configuration via web interface, now you can connect to
ASR3000 via telnet.
Flash instructions:
1. Connect to ASR3000, backup everything, especially 'Factory' part.
2. Write new BL2:
mtd write openwrt-mediatek-filogic-abt_asr3000-preloader.bin BL2
3. Write new FIP:
mtd write openwrt-mediatek-filogic-abt_asr3000-bl31-uboot.fip FIP
4. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
5. Serve OpenWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After OpenWrt has booted, perform sysupgrade.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Link: https://github.com/openwrt/openwrt/pull/15887
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for TP-LINK RE6000XD.
The device is quite similar to the Mercusys MR90X V1,
except only 3 LAN ports and more LEDs.
So thanks to csharper2005 for doing all the groundwork.
Device specification
--------------------
SoC Type: MediaTek MT7986BLA, Cortex-A53, 64-bit
RAM: MediaTek MT7986BLA (512MB)
Flash: SPI NAND GigaDevice (128 MB)
Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8)
Ethernet: 1x2.5Gbe (LAN3 2.5Gbps), 2xGbE (LAN 1Gbps, LAN1,
LAN2)
WLAN 2g: MediaTek MT7975N, b/g/n/ax, MIMO 4x4
WLAN 5g: MediaTek MT7975P(N), a/n/ac/ax, MIMO 4x4
LEDs: 8 LEDs, 1 status blue, 2x WIFI blue, 2x signal
blue/red, 3 LAN blue gpio-controlled
Button: 2 (Reset, WPS)
USB ports: No
Power: 12 VDC, 2 A
Connector: Barrel
Bootloader: Main U-Boot - U-Boot 2022.01-rc4. Additionally, ubi0
partition contain "seconduboot" (also U-Boot 2022.01-rc4)
Serial console (UART), unpopulated
---------------------
V
+-------+-------+-------+-------+
| +3.3V | GND | TX | RX |
+---+---+-------+-------+-------+
|
+--- Don't connect
Disassemble: rm the 2 screws at the bottom and the one at the backside.
un-clip the case starting at the edge above the LEDs.
Installation (UART)
-------------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
tftpboot openwrt-mediatek-filogic-tplink_re6000xd-initramfs-kernel.bin bootm
4. Run 'sysupgrade -n' with the sysupgrade OpenWrt image
Notice: while I was successfull at activating ssh (as described
here:
https://www.lisenet.com/2023/gaining-ssh-access-to-tp-link-re200-wi-fi-range-extender/)
Unfortunately I haven't found the correct root password.
Looks like they are using a static password
(md5crypt, salt + 21 characters) that is not the web
interface admin password.
The TP-LINK RE900XD looks like the very same device,
according to the pictures and the firmware.
But I haven't checked if the OpenWrt firmware works as well
on that device.
The second ubi partition (ubi1) is empty and there is no known
dual-partition mechanism, neither in u-boot nor in the stock firmware.
Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
Add the kmod-mt7915e wifi driver to the default packages for the Ruijie
RG-X60 Pro. kmod-mt7915e has to be added recently and was not done
before merging the support for Ruijie RG-X60 Pro.
Fixes: 3de3c2bdfa ("mediatek: add support for Ruijie RG-X60 Pro")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware
--------
- SOC: MediaTek MT7981
- ram: 256MB DDR3
- FLASH: 16MB SPI-NOR
- Ethernet: 2x1Gb Lan 1x1Gb Wan
- WIFI: MediaTek MT7981 2x2 DBDC 802.11ax 2T2R (2.4/5)
- LEDs: 2xLan 1x Wan 1x WIFI 1xSTATUS
MAC table, same as stock firmware:
LAN: 80:3F:5D:xx:xx:x1 partition "hw" at 0x44e (ASCII)
WAN: 80:3F:5D:xx:xx:x2 partition "hw" at 0x460 (ASCII)
2G: 80:3F:5D:xx:xx:x3 partition "factory" at 0x4 (binary), on label
5G: 80:3F:5D:xx:xx:x3 Same as 2G
Installation Method 1: ssh
--------------------------
1. Connect PC to the lan port. Set the PC IP to 192.168.10.100 if
required.
2. Navigate to http://192.168.10.1/
3. Log into the Wavlink WebGUI. Default username/password is
admin/admin.
4. Use WebGUI to upgrade the firmware to
WAVLINK_WN586X3-A_M86X3A_V240113_WO-GDBYFM-modified.bin
downloaded from
https://github.com/themaverickdm/firmware-misc/tree/main/wavlink/wl-wn586x3
Warning: All settings will be lost!
5. Wait about 5 minutes, and after flashing is completed, log into
the router using (with admin123 as password):
ssh root@192.168.10.1
6. scp the openwrt image file onto the router, usually under /tmp
somewhere.
openwrt-mediatek-filogic-wavlink_wl-wn586x3-squashfs-sysupgrade.bin
7. Flash openwrt image file like so:
mtd write \
openwrt-mediatek-filogic-wavlink_wl-wn586x3-squashfs-sysupgrade.bin \
firmware
Warning: Previous firmware will be overwritten!
8. Wait about 5 minutes, and after the flashing is completed, set
the PC IP to 192.168.1.100 if required and log into the router
like so:
ssh root@192.168.1.1
Installation Method 2: u-boot
-----------------------------
1. Connect UART: TX-> 586X3 RX, RX-> 586X3 TX, GND-> 586 GND.
2. Connect PC to the wan (not lan!) port.
3. Setup the tftp server on PC, set IP to 192.168.10.100,
4. Power on the device. Select '2' to upgrade firmware in Uboot.
5. Input the image name and start to upgrade.
Uboot console log:
CPU: MediaTek MT7981
Model: mt7981-rfb
DRAM: 256 MiB
Core: 34 devices, 13 uclasses, devicetree: embed
Loading Environment from nowhere... OK
In: serial@11002000
Out: serial@11002000
Err: serial@11002000
Net:
Warning: ethernet@15100000 (eth0) using random MAC address -
02:47:fb:b2:53:2d
eth0: ethernet@15100000
UBOOT WN586X3A
gpio: pin 9 (gpio 9) value is 0
gpio: pin 10 (gpio 10) value is 0
gpio: pin 5 (gpio 5) value is 0
gpio: pin 12 (gpio 12) value is 0
gpio: pin 13 (gpio 13) value is 0
*** U-Boot Boot Menu ***
1. Startup system (Default)
2. Upgrade firmware
3. Upgrade ATF BL2
4. Upgrade ATF FIP
5. Upgrade single image
6. Load image
0. U-Boot console
Co-authored-by: R Maru <deviantmaru@gmail.com>
Signed-off-by: R Maru <deviantmaru@gmail.com>
Signed-off-by: Sijia Huang <engineer31@win-star.com>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 128 MB SPI-NAND
RAM: 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, WPS/Mesh
Power: DC 12V 1A
Gain SSH access:
1. Login into web interface, and download the configuration.
2. Download the configration utilities:
https://firmware.download.immortalwrt.eu.org/cnsztl/mediatek/filogic/openwrt-mediatek-mt7981-nokia-ea0326gmp-config-utils.tar.gz
These binaries are extraced from the factory firmware, which are
dynamically linked with aarch64 musl 1.1.24. To use them, you
must run them under the same runtime environment, otherwise the
binaries will not work properly!
3. Upload the configuration and utilities to a suitable environment.
4. Uncompress the utilities, move them to '/bin' and give them executable permisison:
tar -zxf openwrt-mediatek-mt7981-nokia-ea0326gmp-config-utils.tar.gz
mv mkconfig seama /bin
chmod +x /bin/mkconfig
chmod +x /bin/seama
5. Decrypt and uncompress the configuration:
Enter fakeroot if you are not login as root.
mkconfig -a de-enca -m EA0326GMP_3FE79221BAAA -i EA0326GMP_3FE79221BAAA-xxxxxxxx-backup.tar.gz -o backup.tar.gz
tar -zxf backup.tar.gz
6. Edit 'etc/config/dropbear', set 'enable' to '1'.
7. Edit 'etc/passwd', remove root password: 'root::1:0:99999:7:::'.
8. Repack the configuration:
tar -zcf backup.tar.gz etc/
mkconfig -a enca -m EA0326GMP_3FE79221BAAA -i backup.tar.gz -o EA0326GMP_3FE79221BAAA-xxxxxxxx-backup.tar.gz
9. Upload new configuration via web interface, now you can SSH to EA0326GMP.
A minimum configuration which enabled SSH access is also provided
to simplify the process:
https://firmware.download.immortalwrt.eu.org/cnsztl/mediatek/filogic/openwrt-mediatek-mt7981-nokia-ea0326gmp-enable-ssh.tar.gz
Flash instructions:
1. SSH to EA0326GMP, backup everything, especially 'Factory' part.
2. Write new BL2:
mtd write openwrt-mediatek-filogic-nokia_ea0326gmp-preloader.bin BL2
3. Write new FIP:
mtd write openwrt-mediatek-filogic-nokia_ea0326gmp-bl31-uboot.fip FIP
4. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
5. Serve OpenWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After OpenWrt has booted, perform sysupgrade.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Move Build/buffalo-trx to image-commands.mk from image/mt7622.mk to use
that definition from ramips as well.
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
This pull request ports Ruijie RG-X60 Pro router support to the main branch.
Parameters:
- SoC : MediaTek MT7986A Quad-core ARM Cortex-A53 2.0GHz
- RAM : DDR3 512MiB (W634GU6QB)
- Flash : SPI-NAND 128 MiB (W25N01GVZEIG)
- WLAN : MediaTek MT7986A integration dual-band WiFi 6
- 2.4 GHz : b/g/n/ax, MIMO 4x4
- 5 GHz : a/n/ac/ax, MIMO 4x4
- Ethernet : 10/100/1000 Mbps x4 (MediaTek MT7531AE)
2500Mbps x 1 (Realtek RTL8221B-VB-CG)
- UART : through-hole on PCB
- [J500] GND, TX, RX, 3.3V (115200n1)
- Buttons : Mesh, Reset
- LEDs : 1x Power (Blue)
1x Turbo (Purple)
- Power : 12 VDC, 3 A
How to Installation:
1. Remove the case and connect the TTL cable to the corresponding position.
2. Power on the device and quickly press "down" on the keyboard, then
U-Boot will stay in the menu.
3. Select "1. Upgrade Firmware", select "0. TFTP Client(Default)".
4. Input the IP address, input the Openwrt image file name to be
flashed, start the TFTP server, and press "Enter".
5. Wait for the flashing to complete.
How return to stock:
1. Remove the case and connect the TTL cable to the corresponding
position.
2. Power on the device and quickly press "down" on the keyboard, then
U-Boot will stay in the menu.
3. Select "1. Upgrade Firmware", select "0. TFTP Client(Default)".
4. Input the IP address, input the Stock “E-WEBOS” image file name to
be flashed, start the TFTP server, and press "Enter".
5. Wait for the flashing to complete.
About recovery:
Connect uart, use u-boot menu to flash stock firmware image or boot
OpenWrt initramfs image.
About MAC Address:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| WAN | 10:82:3D:XX:XX:9E | label |
| LAN | 10:82:3D:XX:XX:9F | label+1 |
| WLAN 2g | 10:82:3D:XX:XX:A0 | label+2 |
| WLAN 5g | 10:82:3D:XX:XX:A1 | label+3 |
+---------+-------------------+-----------+
Signed-off-by: Ashley Lee <code@emtips.net>
Common specifications:
* Mediatek MT7988A (4x Cortex-A73, up to 1.8 GHz clock speed)
* 8 GiB eMMC
* 2 GiB DDR4 RAM
* 1x 10000M/1000M/100M + 3x 1000M/100M/10M LAN ports
* MT7996 Tri-band (2.4G, 5G, 6G) 4T4R 802.11be Wi-Fi
* Airoha AG3352 GPS
* Renesas DA14531MOD Bluetooth
* 2 buttons (Reset, Mesh/WPS)
* uC-controlled RGB LED via I2C
* 2x LED for each 1G port, 3x LED for each 10G port
* USB 3.0 type A port
* 3.3V-level 115200 baud UART console via 4-pin Dupont connector
exposed at the bottom of the device
* USB-C PD power input
SDG-8733: 1x 10000M/1000M/100M WAN port
SDG-8734: 1x USXGMII/10GBase-R/5GBase-R/2500Base-X/1000Base-X/SGMII SFP+
Both models are also available in versions including 2x FXS POTS interfaces
for analog phones. Those interfaces are not supported by OpenWrt.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
mt7915e driver supports MT7915 & MT7916 devices and MT7981 & MT7986
on-SoC wireless controllers. Devices based on MT7988 and possibly other
next chipsets are quite unlikely to need it (MT7988 was designed to be
used with MT7996).
Move kmod-mt7915e to DEVICE_PACKAGES of relevant devices.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
filogic: Add support for D-Link AQUILA PRO AI M30
Specification:
- MT7981 CPU using 2.4GHz and 5GHz WiFi (both AX)
- 1GB RAM
- 16MB NOR
- 128MB NAND
- 3 LEDs (red, green, blue, white)
- 2 buttons (reset, user defined)
- 1 2.5Gbit WAN port (Airoha EN8811h)
- 1 1Gbit LAN ports
- 1 single lane M.2 SSD slot
- 1 mikroBus socket
- externel HW WDT (25s refresh time)
- i2c RTC (with battery backup)
Serial Interface
- UBS-C CDC-ACM
- 3 Pins GND, RX, TX
- Settings: 115200, 8N1
MAC addresses are not populated on the early samples.
Signed-off-by: John Crispin <john@phrozen.org>
Add ubi volumes for mt7988a-rfb and support for using factory data
for Ethernet MAC addresses and MT7996 WLAN calibration data.
Also add rootdisk handle. Removes the need to keep using nmbm
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Hardware:
SoC: MT7981b
RAM: 256 MB
Flash: 128 MB SPI NAND
Ethernet:
1x 2.5Gbps (rtl8221b)
1x 1Gbps (integrated phy)
WiFi: 2x2 MT7981
Buttons: Reset, WPS
LED: 1x multicolor
Solder on UART:
- remove rubber ring on the bottom
- remove screws
- pull up the cylinder, maybe help by push on an ethernet socket with a screwdriver
- remove the (3) screws holding the board in the frame
- remove the board from the frame to get to the screws for the silver, flat heat shield
- remove the (3) screws holding the heat shield
- solder UART pins to the back of the board
- make sure to have the pins point out on side with the black, finned heat spread
- the markings for the pins are going to be below the silver heat shield
- Vcc is not needed
If you don't intend on using the UART outside of the installation process, you might not
want to solder:
- carefully scrape off the thin layer of epoxy on the holes (not the copper)
- place your pin header with the UART attached in the holes
- the pins, starting with the one closest to the socket:
- Vcc (not required)
- GND
- RX
- TX
- either wedge the header or hold it with your fingers so that the pins stay in contact with the board
Installation (UART):
- attach an Ethernet cable to the 1Gbps port (black) on the router
- hold the reset button while powering the router
- press CTRL-C or wait for the timeout to get to the U-Boot prompt
- prepare a TFTP server on the network to supply ..-initramfs-kernel.bin
- use 'tftpboot' in the U-Boot shell to pull the image
- boot the image using 'bootm'
- push the ..-sysupgrade to the router using your preferred method
- perform the upgrade with 'sysupgrade -n'
There is a recovery mechanism that involves fetching a file called 'recovery.bin' but that is not understood yet.
Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
Hardware:
- SoC: MediaTek MT7981B
- CPU: 2x 1.3 GHz Cortex-A53
- Flash: 128 MiB SPI NAND
- RAM: 512 MiB
- WLAN: 2.4 GHz, 5 GHz (MediaTek MT7976CN, 802.11ax)
- Ethernet: 1x 10/100/1000/2500 Mbps RTL8221B WAN, 1x10/100/1000 Mbps MT7981 LAN
- USB 3.0 port
- Buttons: 1 Reset button, 1 slider button
- LEDs: 1x Red, 1x White
- Serial console: internal test points, 115200 8n1
- Power: 5 VDC, 3 A
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| WAN | 80:af:ca:xx:xx:x1 | label+1 |
| LAN | 80:af:ca:xx:xx:x0 | label |
| WLAN 2g | 80:af:ca:xx:xx:x0 | label |
| WLAN 5g | 82:af:ca:xx:xx:x0 | |
+---------+-------------------+-----------+
Installation:
The installation must be done via TFTP by disassembling the router. On other occasions Cudy has distributed intermediate firmware to make installation easier, and so I recommend checking the Wiki for this device if there is a more convenient solution than the one below.
To install using TFTP:
1. Connect to UART.
2. With the router off, press the RESET button. While the router is turning on, the button should continue to be pressed for at least 5 seconds.
3. A u-boot shell will automatically open.
4. Connect to LAN and set your IP to 192.168.1.88/24. Configure a TFTP server and an OpenWrt initramfs-kernel.bin firmware file.
5. Run these steps in u-boot using the name of your file.
setenv bootfile initramfs-kernel.bin
tftpboot
bootm
6. If you can reach LuCI or SSH now, just use the sysupgrade image with the 'Keep settings' option turned off.
Signed-off-by: Luis Mita <luis@luismita.com>
This adds support for the bpi-r4 variant with internal 2.5G PHY and
additional ethernet port instead of second sfp.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
HW specifications:
* Mediatek MT7981A
* 256MB SPI-NAND
* 512MB DRAM
* Uplink: 1 x 10/100/1000Base-T Ethernet, Auto MDIX, RJ-45 with 802.3at
PoE (Built-in GBe PHY)
* LAN: 1 x 10/100/1000Base-T Ethernet, Auto MDIX, RJ-45 (Airoha EN8801SC)
* 1 Tricolor LED
* Reset button
* 12V/2.0A DC input
Installation:
Board comes with OpenWifi/TIP which is OpenWrt based, so sysupgrade can
be used directly over SSH.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Specification:
- MT7981 CPU using 2.4GHz and 5GHz WiFi (both AX)
- MT7531 switch
- 512MB RAM
- 128MB NAND flash with two UBI partitions with identical size
- 1 multi color LED (red, green, blue, white) connected via GCA230718
- 3 buttons (WPS, reset, LED on/off)
- 1 1Gbit WAN port
- 4 1Gbit LAN ports
Disassembly:
- There are four screws at the bottom: 2 under the rubber feets, 2 under the label.
- After removing the screws, the white plastic part can be shifted out of the blue part.
- Be careful because the antennas are mounted on the side and the top of the white part.
Serial Interface
- The serial interface can be connected to the 4 pin holes on the side of the board.
- Pins (from front to rear):
- 3.3V
- RX
- TX
- GND
- Settings: 115200, 8N1
MAC addresses:
- WAN MAC is stored in partition "Odm" at offset 0x81
- LAN (as printed on the device) is WAN MAC + 1
- WLAN MAC (2.4 GHz) is WAN MAC + 2
- WLAN MAC (5GHz) is WAN MAC + 3
Flashing via Recovery Web Interface:
- The recovery web interface always flashes to the currently active partition.
- If OpenWrt is flahsed to the second partition, it will not boot.
- Ensure that you have an OEM image available (encrypted and decrypted version). Decryption is described in the end.
- Set your IP address to 192.168.200.10, subnetmask 255.255.255.0
- Press the reset button while powering on the device
- Keep the reset button pressed until the LED blinks red
- Open a Chromium based and goto http://192.168.200.1 (recovery web interface)
- Download openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-recovery.bin
- The recovery web interface always reports successful flashing, even if it fails
- After flashing, the recovery web interface will try to forward the browser to 192.168.0.1 (can be ignored)
- If OpenWrt was flashed to the first partition, OpenWrt will boot (The status LED will start blinking white and stay white in the end). In this case you're done and can use OpenWrt.
- If OpenWrt was flashed to the second partition, OpenWrt won't boot (The status LED will stay red forever). In this case, the following steps are reuqired:
- Start the web recovery interface again and flash the **decrypted OEM image**. This will be flashed to the second partition as well. The OEM firmware web interface is afterwards accessible via http://192.168.200.1.
- Now flash the **encrypted OEM image** via OEM firmware web interface. In this case, the new firmware is flashed to the first partition. After flashing and the following reboot, the OEM firmware web interface should still be accessible via http://192.168.200.1.
- Start the web recovery interface again and flash the OpenWrt recovery image. Now it will be flashed to the first partition, OpenWrt will boot correctly afterwards and is accessible via 192.168.1.1.
Flashing via U-Boot:
- Open the case, connect to the UART console
- Set your IP address to 192.168.200.2, subnet mask 255.255.255.0. Connect to one of the LAN interfaces of the router
- Run a tftp server which provides openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-initramfs-kernel.bin.
- Power on the device and select "7. Load image" in the U-Boot menu
- Enter image file, tftp server IP and device IP (if they differ from the default).
- TFTP download to RAM will start. After a few seconds OpenWrt initramfs should start
- The initramfs is accessible via 192.168.1.1, change your IP address accordingly (or use multiple IP addresses on your interface)
- Perform a sysupgrade using openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-sysupgrade.bin
- Reboot the device. OpenWrt should start from flash now
Revert back to stock using the Recovery Web Interface:
- Set your IP address to 192.168.200.2, subnetmask 255.255.255.0
- Press the reset button while powering on the device
- Keep the reset button pressed until the LED blinks red
- Open a Chromium based and goto http://192.168.200.1 (recovery web interface)
- Flash a decrypted firmware image from D-Link. Decrypting an firmware image is described below.
Decrypting a D-Link firmware image:
- Download https://github.com/RolandoMagico/firmware-utils/blob/M32/src/m32-firmware-util.c
- Compile a binary from the downloaded file, e.g. gcc m32-firmware-util.c -lcrypto -o m32-firmware-util
- Run ./m32-firmware-util M30 --DecryptFactoryImage <OriginalFirmware> <OutputFile>
- Example for firmware M30A1_FW101B05: ./m32-firmware-util M30 --DecryptFactoryImage M30A1_FW101B05\(0725091522\).bin M30A1_FW101B05\(0725091522\)_decrypted.bin
Flashing via OEM web interface is not possible, as it will change the active partition and OpenWrt is only running on the first UBI partition.
Controlling the LEDs:
- The LEDs are controlled by a chip called "GCA230718" which is connected to the main CPU via I2C (address 0x40)
- I didn't find any documentation or driver for it, so the information below is purely based on my investigations
- If there is already I driver for it, please tell me. Maybe I didn't search enough
- I implemented a kernel module (leds-gca230718) to access the LEDs via DTS
- The LED controller supports PWM for brightness control and ramp control for smooth blinking. This is not implemented in the driver
- The LED controller supports toggling (on -> off -> on -> off) where the brightness of the LEDs can be set individually for each on cycle
- Until now, only simple active/inactive control is implemented (like when the LEDs would have been connected via GPIO)
- Controlling the LEDs requires three sequences sent to the chip. Each sequence consists of
- A reset command (0x81 0xE4) written to register 0x00
- A control command (for example 0x0C 0x02 0x01 0x00 0x00 0x00 0xFF 0x01 0x00 0x00 0x00 0xFF 0x87 written to register 0x03)
- The reset command is always the same
- In the control command
- byte 0 is always the same
- byte 1 (0x02 in the example above) must be changed in every sequence: 0x02 -> 0x01 -> 0x03)
- byte 2 is set to 0x01 which disables toggling. 0x02 would be LED toggling without ramp control, 0x03 would be toggling with ramp control
- byte 3 to 6 define the brightness values for the LEDs (R,G,B,W) for the first on cycle when toggling
- byte 7 defines the toggling frequency (if toggling enabled)
- byte 8 to 11 define the brightness values for the LEDs (R,G,B,W) for the second on cycle when toggling
- byte 12 is constant 0x87
Comparison to M32/R32:
- The algorithms for decrypting the OEM firmware are the same for M30/M32/R32, only the keys differ
- The keys are available in the GPL sources for the M32
- The M32/R32 contained raw data in the firmware images (kernel, rootfs), the R30 uses a sysupgrade tar instead
- Creation of the recovery image is quite similar, only the header start string changes. So mostly takeover from M32/R32 for that.
- Turned out that the bytes at offset 0x0E and 0x0F in the recovery image header are the checksum over the data area
- This checksum was not checked in the recovery web interface of M32/R32 devices, but is now active in R30
- I adapted the recovery image creation to also calculate the checksum over the data area
- The recovery image header for M30 contains addresses which don't match the memory layout in the DTS. The same addresses are also present in the OEM images
- The recovery web interface either calculates the correct addresses from it or has it's own logic to determine where which information must be written
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
The recovery image is reqired for D-Link M30 as well. So I moved it to include/image-commands.mk to be able to use it for MT7622 and filogic devices.
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Hardware specification:
SoC: MediaTek MT7986A 4x A53
Flash: ESMT F50L1G41LB 128MB
RAM: W632GU6NB DDR3 256MB
Ethernet: 1x 2.5G + 4x 1G
WiFi1: MT7975N 2.4GHz 4T4R
WiFi2: MT7975PN 5GHz 4T4R
Button: Reset, WPS
Power: DC 12V 2A
Flash instructions:
1. Connect to the router using ssh or telnet,
username: useradmin, password is the web
login password of the router.
2. Use scp to upload bl31-uboot.fip and flash:
"mtd write xxx-preloader.bin spi0.0"
"mtd write xxx-bl31-uboot.fip FIP"
"mtd erase ubi"
3. Connect to the router via the Lan port,
set a static ip of your PC.
(ip 192.168.1.254, gateway 192.168.1.1)
4. Download initramfs image, reboot router,
waiting for tftp recovery to complete.
5. After openwrt boots up, perform sysupgrade.
Note:
1. Back up all mtd partitions before flashing.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 8GB eMMC or 128 MB SPI-NAND
RAM: 256MB
Ethernet: 5x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset
USB: M.2(B-key) for 4G/5G Module
Power: DC 12V 1A
UART: 3.3v, 115200n8
--------------------------
| Layout |
| ----------------- |
| 4 | VCC RX TX GND | <= |
| ----------------- |
--------------------------
The U-boot menu will automatically appear at startup, and then select
the required options through UP/DOWN Key.
NAND Flash and eMMC Flash instructions:
1. Set your computers IP adress to 192.168.1.2.
2. Run a TFTP server providing the sysupgrade.bin image.
3. Power on the router, into the U-Boot menu.
4. Select "2. Upgrade firmware"
5. Update sysupgrade.bin file name, input server IP and input device
IP (if they deviate from the defaults)
6. Wait for automatic startup after burning
Signed-off-by: Allen Zhao <allenzhao@unielecinc.com>
