Specifications:
- Device: ASUS 4g-AX56
- SoC: MT7621AT
- Flash: 128MB
- RAM: 512MB
- Switch: 1 WAN, 4 LAN (10/100/1000 Mbps)
- WiFi: MT7905 2x2 2.4G + MT7975 2x2 5G
- LTE : Fibocom FG621-EA
- LEDs: 1x POWER (white, configurable)
1x 2.4G (white, not configurable)
1x 5G (white, not configurable)
1x WAN (white, not configurable)
1x 3G/4G (white, not configurable)
3x signal (white, not configurable)
Flash by U-Boot TFTP method:
- Configure your PC with IP 192.168.0.2
- Set up TFTP server and put the factory.bin image on your PC
- Connect serial port(rate:115200) and turn on AP, then interrupt "U-Boot Boot Menu" by hitting any key
Select "2. Upgrade firmware"
Press enter when show "Run firmware after upgrading? (Y/n):"
Select 0 for TFTP method
Input U-Boot's IP address: 192.168.0.1
Input TFTP server's IP address: 192.168.0.2
Input IP netmask: 255.255.255.0
Input file name: openwrt-ramips-mt7621-asus_4g-ax56-squashfs-factory.bin
- Restart AP aftre see the log "Firmware upgrade completed!"
Notice:
- LTE module is disable after flash openwrt image so you must active LTE by following two AT command
echo -e "AT+GTAUTOCONNECT=1\r\n" > /dev/ttyUSB0
echo -e "AT+GTRNDIS=1,1\r\n" > /dev/ttyUSB0
- After finish AT command once, you don't need to input command later even if reboot/restore default
Signed-off-by: Chuncheng Chen <ccchen1984@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16752
Signed-off-by: John Crispin <john@phrozen.org>
Hardware
* Mediatek MT7620A + Mediatek MT7610EN
* 64MB RAM
* 8MB NAND (Winbond 25064FVSIG )
Both 2.4GHZ and 5GHZ are working, it is enabled by default since there is no
physical ethernet port in the device.
All LED's and buttons work.
UART: 57600 8N1 3.3V
Installation
Upload the openwrt-ramips-mt7620-trendnet_tha103ac-initramfs-kernel.bin via
the manufacturer firmware upgrade page on the device.
Upon reboot wait +- 3 mins until the green power LED is not flashing anymore
(do not be tempted to switch the device off while the LED is flashing, unless
you are ready for soldering and TTL) and then press the WPS button to enable
the default OpenWrt Wifi AP, the BLUE wifi LED will start flash.
Then install openwrt-ramips-mt7620-trendnet_tha103ac-squashfs-sysupgrade.bin
via OpenWrt.
The integrated power monitoring and relay do not work in OpenWrt as the PL7223
chip source/documentation is unavailable.
Recovery
Mis-configuration can be dealt with using the RESET button to reset to factory,
worst case scenario will require some serious work and soldering, there's pads
on the PCB for both the UART and ETH0, and I soldered and tested that it does
work.
You will have to power the board using the header pins GND & 5V, see the 8-pin
header socket.
Signed-off-by: Die Peter Pan <diepeterpan@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17114
Signed-off-by: John Crispin <john@phrozen.org>
Keenetic KN-3211 is a 2.4 Ghz band 11n (Wi-Fi 4) Wi-Fi repeater, based on MT7628AN.
Specification:
- System-On-Chip: MT7628AN
- CPU/Speed: 575 MHz
- Flash-Chip: Winbond w25q256
- Flash size: 32768 KiB
- RAM: 64 MiB
- 1x 10/100 Mbps Ethernet
- 2x external, non-detachable antennas
- UART (J1) header on PCB (115200 8n1)
- Wireless No1 (2T2R): SoC Built-in 2.4 GHz 802.11bgn
- 3x LED, 1x button, 1x mode switch
Notes:
- The device supports dual boot mode
- The firmware partitions were concatenated into one
- The status button has been reassigned as the WPS button.
Flash instruction:
This device doesn't support sysupgrade, so the only way to flash OpenWrt image
is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24 and tftp server.
2. Rename "openwrt-ramips-mt76x8-keenetic_kn-3211-squashfs-factory.bin"
to "KN-3211_recovery.bin" and place it in tftp server directory.
3. Connect PC with the ethernet port, press the reset button, power up
the router and keep button pressed until power led starts blinking.
4. Router will download file from server, write it to flash and reboot.
Signed-off-by: Ivan Davydov <lotigara@lotigara.ru>
Link: https://github.com/openwrt/openwrt/pull/17080
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is required for upcoming Keenetic KN-3911 support
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16830
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Code cleanup. Simplify and unify how kernel image is passed to
Build/dna-bootfs
Signed-off-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Link: https://github.com/openwrt/openwrt/pull/16811
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The Zbtlink ZBT-WE2426-B is an indoor dual band WiFi router
with 4 external non detachable antennas and 5 Fast Ethernet ports.
Hardware of ZBT-WE2426-B:
- SoC: MT7628AN
- RAM: 64 MB (Winbond W9751G6K8-25)
- Storage: 8 MB SPI flash (S25FL064K)
- Ethernet: 5x 10/100 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
- Wireless: 2.4GHz: on SoC (802.11b/g/n)
- Wireless: 5GHz: Mediatek MT7612EN (802.11n/ac)
- LEDs: 8x
- Buttons: 1x reset
- USB: 1x 2.0
- MicroSD slot: 1x
- Power: 9 VDC, 1 A
- Uart: GND TX RX PWR - J1 on the PCB
- Board silkscreen: "ZBT-WE2426-C V04" "2018-02-28" "CTT" "13 18"
Backup the stock firmware, settings and calibration data:
This router comes with PandoraBox OpenWrt firmware, so it is
possible to get all MTD partitions using scp.
Installation:
- Using the bootloader web server. Hold the reset button while turning
the power on. Upload the sysupgrade image on http://192.168.1.1.
- Using the sysupgrade command in PandoraBox OpenWrt.
LEDs:
- LAN1,LAN2,LAN3,LAN4,WAN,WLAN2G use GPIO pins of the MT7628AN SoC
(GPIOs 43,42,41,40,39,44)
- WLAN5G uses pin of MT7612EN.
- The POWER LED is directly connected to the VCC. It can be reconnected to
the GPIO 37 of the MT7628AN SoC by resoldering SMD resistor on the PCB.
Buttons:
- The RESET button is connected to the GPIO 38 of the MT7628AN SoC.
MAC addresses as verified by OEM firmware:
use address source
2g *:b0 factory 0x4 (label)
5g *:b1 factory 0x8004
LAN *:b2 factory 0x28
WAN *:b3 factory 0x2e
Signed-off-by: Vaclav Svoboda <svoboda@neng.cz>
Link: https://github.com/openwrt/openwrt/pull/16927
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
IMAGE_SIZE was previously set to kernel1 + ubi size = 256768k, now
kernel1 is 6MB adjust this value to add 3072k to total image size.
Signed-off-by: Tim Lunn <tim@feathertop.org>
Link: https://github.com/openwrt/openwrt/pull/15194
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Edgerouter-X factory images have not built automatically since 19.x due
to images being over 3MB. While it was possible to build custom images
with very stripped down config, this is no longer possible with the size
increases of linux 6.1 and 6.6.
Drop code for generation of factory images, if some dev later wishes to
try custom images they can revert this commit.
Signed-off-by: Tim Lunn <tim@feathertop.org>
Link: https://github.com/openwrt/openwrt/pull/15194
Signed-off-by: Petr Štetiar <ynezz@true.cz>
With the new layout providing 6MB for kernel there will be no issues
with kernel size affecting build of images.
Re-enable image builds for Edgerouter-X and X-SFP.
Signed-off-by: Tim Lunn <tim@feathertop.org>
Tested-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Link: https://github.com/openwrt/openwrt/pull/15194
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Refer user to the wiki page for instructions on how to migrate to the
new kernel layout.
Signed-off-by: Tim Lunn <tim@feathertop.org>
Tested-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Link: https://github.com/openwrt/openwrt/pull/15194
Signed-off-by: Petr Štetiar <ynezz@true.cz>
With the updated partition layout set in dts, set the KERNEL_SIZE
parameter to 6MB allowing builds of Linux 6.1 and later to fit.
Signed-off-by: Tim Lunn <tim@feathertop.org>
Tested-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Link: https://github.com/openwrt/openwrt/pull/15194
Signed-off-by: Petr Štetiar <ynezz@true.cz>
A factory image for DNA EX400 depends on an initramfs image and they
were explicitly removed from the imagebuilder recently. Now the factory
image creation fails miserably and it also affects custom image creation
with the firmware selector.
Add the initramfs kernel to the staging so that it's shipped with the
imagebuilder. Also remove a image build target added solely for DNA EX400.
Tested by creating a factory and syspupgrade images locally with
the imagebuilder and verified their functionality.
Related work
c85348d9ab ("imagebuilder: remove initramfs image files")
Fixes: fea2264d9f ("ramips: mt7621: Add DNA Valokuitu Plus EX400")
Signed-off-by: Mauri Sandberg <maukka@ext.kapsi.fi>
---
v4: use append-image-stage, remove Build/kernel-initramfs-bin
v3: adjust commit subject
v2: remove fix for inconsistent line ending elsewhere in the file
Link: https://github.com/openwrt/openwrt/pull/16659
Signed-off-by: Robert Marko <robimarko@gmail.com>
Drop kmod-i2c-ralink from ASUS RP-AC56 as it was wrongly added. Such
kmod is not supported on mt7621 as i2c is handled by the mediatek driver
and not bay the ralink downstream one.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
The Gemtek WVRTM-127ACN is an indoor dual band wifi router
with internal antennas and 3 Gigabit Ethernet ports.
The Gemtek WVRTM-130ACN is an indoor dual band wifi router
with external antennas and 5 Gigabit Ethernet ports.
Hardware of WVRTM-127ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB
- Storage: 128 MB NAND SLC flash
- Ethernet: 3x 10/100/1000 Mbps LAN1,LAN2 & WAN
- Wireless: 2.4GHz: Mediatek MT7603EN (802.11b/g/n)
- Wireless: 5GHz: Mediatek MT7612EN (802.11n/ac)
- LEDs: 11x
- Buttons: 2x WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ IN (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-127ACN_V02" "19K-513-8500R" "RoHS" "1717"
Hardware of WVRTM-130ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB (Kioxia TC58BVG0S3HTA00)
- Storage: 128 MB NAND SLC (Winbond W971GG6SB-25)
- Ethernet: 5x 10/100/1000 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
- Wireless: 2.4GHz and 5GHz Mediatek MT7615DN (802.11ac/b/g/n) (DBDC)
- LEDs: 10x
- Buttons: 3x Power, WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-130ACN_V01" "19K-515-4500R" "RoHS" "2112"
Enable access to uboot menu (needed in wvrtm-130acn):
- The access to uboot menu is blocked by `bootdelay = 0` set in ubootenv.
With stock firmware version 01.01.02.163 and previous, you can use CVE 2020-24365
command injection https://nvd.nist.gov/vuln/detail/CVE-2020-24365
python3 exploit.py -t 192.168.1.1 -c "fw_setenv bootdelay 3; fw_saveenv"
Backup the stock firmware:
- Connect via uart
- Connect via ethernet and assign your pc the address 192.168.15.x/24
- Power on the device; and start typing '4' to enter uboot menu
- Set factory mode and boot
MT7621 # setenv factory 2; saveenv
MT7621 # nand read 2800000 2000000 81000000; bootm
- Telnet and copy all mtd blocks
telnet 192.168.15.1
- Copy all mtd blocks and start webserver
for N in $(seq 0 6); do dd if=/dev/mtd$N of=/tmp/eeprom_mtd$N.bin; done
mount -o bind /tmp /www
lighttpd -f /etc/lighttpd.conf
- Backup stock rootfs_data (optional)
dd if=/dev/mtd7 of=/tmp/eeprom_mtd7.bin
dd if=/dev/mtd8 of=/tmp/eeprom_mtd8.bin
- Download to your pc from http://192.168.15.1/eeprom_mtd$N.bin
Installation:
- Connect via uart
- Connect via ethernet and assign your pc the address 10.10.10.3/24
- Start a tftp server and serve the image initramfs-kernel.bin
mkdir /tmp/ftpd;
cp initramfs-kernel.bin /tmp/ftpd/kernel.bin
dnsmasq --enable-tftp --tftp-root=/tmp/ftpd
- Power on the device; and start typing '4' to halt the bootloader
- Change the active mtd partition from mtd6 to mtd5 (needed by uboot)
MT7621 # setenv mtddevnum 5; saveenv
- Write the openwrt initramfs in ram via tftp and boot it
MT7621 # tftpboot 81000000 kernel.bin; bootm
- From the initramfs create the ubi device and install openwrt via sysupgrade
ubiformat /dev/mtd11 -y
sysupgrade -n -v /tmp/sysupgrade.bin
Recovery:
Restore the stock firmware from the backup of the mtd blocks
mtd write eeprom_mtd5.bin firmware
mtd write eeprom_mtd6.bin Kernel2
mtd write eeprom_mtd7.bin Storage1
mtd write eeprom_mtd8.bin Storage2
ubiformat /dev/mtd8 -y
reboot
Links to previous works on wvrtm-127acn:
https://github.com/digiampietro/hacking-gemtekhttps://forum.openwrt.org/t/add-support-for-gemtek-wvrtm-127acn-linkem-provider/168757
Signed-off-by: Samuele Longhi <agave@dracaena.it>
Link: https://github.com/openwrt/openwrt/pull/16685
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Currently eth1 (which is the first "lan" interface) doesn't work on this device.
During boot the following can be seen in logs:
```
[ 2.252804] mt7530-mdio mdio-bus:1f: MT7530 adapts as multi-chip module
[ 2.266060] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 19
[ 2.277889] mtk_soc_eth 1e100000.ethernet eth1: mediatek frame engine at 0xbe100000, irq 19
...
[ 2.355157] mt7530-mdio mdio-bus:1f: MT7530 adapts as multi-chip module
[ 2.390312] mt7530-mdio mdio-bus:1f: configuring for fixed/rgmii link mode
[ 2.398597] mt7530-mdio mdio-bus:1f: Link is Up - 1Gbps/Full - flow control rx/tx
[ 2.403872] mt7530-mdio mdio-bus:1f eth1 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7530 PHY] (irq=21)
[ 2.416988] mtk_soc_eth 1e100000.ethernet eth0: error -17 registering interface eth1
[ 2.426973] mt7530-mdio mdio-bus:1f eth2 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7530 PHY] (irq=22)
[ 2.440996] mt7530-mdio mdio-bus:1f eth3 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7530 PHY] (irq=23)
[ 2.454405] mt7530-mdio mdio-bus:1f eth4 (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7530 PHY] (irq=24)
[ 2.467198] mtk_soc_eth 1e100000.ethernet eth0: entered promiscuous mode
[ 2.474117] DSA: tree 0 setup
...
[ 6.820998] mtk_soc_eth 1e100000.ethernet dsa: renamed from eth0
[ 6.919904] mtk_soc_eth 1e100000.ethernet wan: renamed from eth1
```
So the problem seems to be the fact that built-in gmacs get default
names (eth0/eth1) and are renamed after switch ports are initialized. This means
that when switch port with name `eth1` is brought up this name is still used by
gmac1 causing switch port's init to fail.
This patch just renames the ports to avoid name collision.
Note: this will break existing configs for this device because it renames all
the ports. This should not be major problem because this device doesn't have a
proper OEM image and is only flashable with serial access, meaning there should
not be many users.
Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15865
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware Specification:
SoC: Mediatek MT7621DAT (MIPS1004Kc 880 MHz, dual core)
RAM: 128 MB
Storage: 128 MB NAND flash
Ethernet: 5x 10/100/1000 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
Wireless: 2.4GHz: Mediatek MT7603EN up to 300Mbps (802.11b/g/n MIMO 2x2)
Wireless: 5GHz: Mediatek MT7615N up to 1733Mbps (802.11n/ac MU-MIMO 4x4)
LEDs: Power (white & amber), Internet (white & amber)
LEDs: 2.4G (White), 5Ghz (White)
Buttons: WPS, Reset
USB: Front V3.0 & Rear V2.0
MAC Table
Label xx:xx:xx:xx:xx:38
LAN xx:xx:xx:xx:xx:39
2.4Ghz xx:xx:xx:xx:xx:3A
5Ghz xx:xx:xx:xx:xx:3C
WAN xx:xx:xx:xx:xx:38
Flash Instructions:
D-Link normal OEM firmware update page
1. upload OpenWRT factory.bin like any D-Link upgrade image
D-Link Fail Safe GUI:
1. Push and hold reset button (on the bottom of the device) until power led starts flashing (about 10 secs or so) while plugging in the power cable.
2. Give it ~30 seconds, to boot the fail safe GUI
3. Connect your client computer to LAN1 of the device
4. Set your client IP address manually to 192.168.0.2 / 255.255.255.0
5. Call the fail safe page for the device at http://192.168.0.1/
6. Use the provided fail safe web GUI to upload the factory.bin to the device
Signed-off-by: Alan Luck <luckyhome2008@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16269
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SoC: MediaTek MT7621
Flash: 16MB (Macronix MX25L12805D)
RAM: 128MB
Serial: As marked on PCB, baudrate is 57600, DO NOT CONNECT 3.3V!!!
Ethernet: 4x 10/100/1000 Mbps (3x LAN + WAN)
WIFI0: MT7615 2.4GHz 802.11b/g/n
WIFI1: MT7615 5GHz 802.11ac
Antennas: 6x external (3 per radio), non-detachable
LEDs: Programmable power-LED (blue-colored)
Buttons: Reset
INSTALLATION:
Get rootshell using insructions from https://gist.github.com/ZIKH26/18693c67ee7d2f8d2c60231b19194c37
Download and flash image
On computer:
python -m http.server
On router:
cd /tmp
wget http://:8000/factory.bin
mtd -r write factory.bin firmware
Device should reboot at this point.
Reverting to stock:
Download archive with firmware from Ruijie's site and
get .bin file from it. Then write that binary to firmware
partition. After reboot, factory-reset the router using
reset button.
Signed-off-by: Yahor Leonenka <staryjakau@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16202
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
ELECOM WSC-X1800GS is a 2.4/5 GHz band 11ax (Wi-Fi 6) mesh extender,
based on MT7621A
Specification:
- SoC : MediaTek MT7621A
- RAM : DDR3 512 MiB (Nanya NT5CC256M16ER-EK)
- Flash : RAW-NAND 128 MiB (Winbond W29N01HVSINF)
- WLAN : 2.4/5 GHz 2T2R (MediaTek MT7915D + MT7975D)
- Ethernet : 2x 10/100/1000 Mbps
- switch : MediaTek MT7530 (SoC)
- LEDs/Keys (GPIO): 9x/2x
- UART : through-hole on PCB ("J4")
- arrangement : 3.3V, GND, TX, RX from tri-angle marking
- settings : 115200n8
- Power : 12 VDC, 1 A (Max. 10.5 W)
Flash instruction using initramfs-factory image
1. Boot WMC-X1800GST normally
2. Access to "http://192.168.2.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt initramfs-factory image and click apply ("適用")
button
4. On initramfs image, download sysupgrade image to the device and
perform sysupgrade with that image
5. Wait ~120 seconds to complete flashing
Notes:
- The "firmware" partition on the stock image is only 0xF00000 (15 MiB)
and it's too small for the current OpenWrt firmware with UBI format.
So use the unused area at the end of NAND flash for rootfs (UBI).
MAC addresses:
LAN : 04:AB:18:xx:xx:6E (Factory, 0x3fff4 (hex))
2.4 GHz: 04:AB:18:xx:xx:6F (Factory, 0x3fffa (hex))
5 GHz : 04:AB:18:xx:xx:70 (Factory, 0x4 (hex))
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16384
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
ELECOM WMC-X1800GST is a 2.4/5 GHz band 11ax (Wi-Fi 6) mesh router,
based on MT7621A
Specification:
- SoC : MediaTek MT7621A
- RAM : DDR3 512 MiB (Nanya NT5CC256M16ER-EK)
- Flash : RAW-NAND 128 MiB (Winbond W29N01HVSINF)
- WLAN : 2.4/5 GHz 2T2R (MediaTek MT7915D + MT7975D)
- Ethernet : 3x 10/100/1000 Mbps
- switch : MediaTek MT7530 (SoC)
- LEDs/Keys (GPIO): 9x/5x
- UART : through-hole on PCB ("J4")
- arrangement : 3.3V, GND, TX, RX from tri-angle marking
- settings : 115200n8
- Power : 12 VDC, 1 A (Max. 11.5 W)
Flash instruction using initramfs-factory image
1. Boot WMC-X1800GST normally with "Router" mode
2. Access to "http://192.168.2.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt initramfs-factory image and click apply ("適用")
button
4. On initramfs image, download sysupgrade image to the device and
perform sysupgrade with that image
5. Wait ~120 seconds to complete flashing
Notes:
- The "firmware" partition on the stock image is only 0xF00000 (15 MiB)
and it's too small for the current OpenWrt firmware with UBI format.
So use the unused area at the end of NAND flash for rootfs (UBI).
MAC addresses:
LAN : 04:AB:18:xx:xx:BF (Factory, 0x3fff4 (hex))
WAN : 04:AB:18:xx:xx:C0 (Factory, 0x3fffa (hex))
2.4 GHz: 04:AB:18:xx:xx:C1 (Factory, 0x4 (hex))
5 GHz : 04:AB:18:xx:xx:C2
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16384
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Rename the sysupgrade.tar step to sysupgrade.bin. The sysupgrade.tar is
used in other places and we prefer a sysupgrade.bin instead.
Fixes: fea2264d9f ("ramips: mt7621: Add DNA Valokuitu Plus EX400")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The sysupgrade-tar image build is not defined for this target, do not
add a build instruction for it. The build system will use the definition
from the dna_valokuitu-plus-ex400 board and the build will fail.
This fixes the build of the ramips target.
Fixes: 665c2154ef ("ramips: add basic support for tp-link er605-v2")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for netis N6 WiFi 6 router.
Specification
-------------
- SoC : MediaTek MT7621AT, MIPS, 880 MHz
- RAM : 256 MiB
- Flash : NAND 128 MiB (ESMT PSU1GA30DT)
- WLAN : MT7905DAN + MT7975DN
- 2.4 GHz : b/g/n/ax, 574 Mbps, MIMO 2x2
- 5 GHz : a/n/ac/ax, 1201 Mbps, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x5 (1x WAN, 4x LAN)
- USB : 1x 3.0
- UART : 3.3V, 115200n8
- Buttons : 1x Reset
1x WPS
- LEDs : 1x Power (green)
1x System (green)
1x WAN (green)
1x WiFi 2.4 GHz (green), controlled by phy
1x WiFi 5 GHz (green), controlled by phy
1x WPS (green)
1x USB (green)
5x ethernet leds (green), controlled by switch
- Power : 12 VDC, 1.5 A
Installation
------------
1. Update the router using stock firmware web interface and OpenWrt
factory.bin image.
Recovery and return to stock
----------------------------
1. Assign your PC a static IP 192.168.1.2 and connect to the router using
the ethernet cable;
2. Power off the router;
3. Press Reset button, power on the router and wait until ethernet led
start blinking;
4. Release the button;
5. Open http://192.168.1.1/ (N6 System Recovery Mode) in your browser;
6. Upload OpenWrt factory.bin (or stock firmware *.bin) image and proceed
with upgrade.
MAC addresses
-------------
+---------+-------------------+
| | MAC example |
+---------+-------------------+
| LAN | dc:xx:xx:49:xx:04 |
| WAN | dc:xx:xx:49:xx:05 |
| WLAN 2g | dc:xx:xx:19:xx:06 |
| WLAN 5g | dc:xx:xx:79:xx:06 |
+---------+-------------------+
The WLAN MAC prototype was found in 'Factory', 0x4
The LAN MAC was found in 'Factory', 0x7ef20
The WAN MAC was found in 'Factory', 0x7ef26
Known issue
-----------
2.4 GHz WLAN doesn't start with mt76 driver.
Probable reason:
Original Netis N6 EEPROM contains wrong MT_EE_WIFI_CONF value (0xd2).
Other routers with the same WLAN hardware (e.g., Routerich AX1800)
have MT_EE_WIFI_CONF = 0x92.
Workaround (already included in this commit):
Extract EEPROM to a file at the first time boot and change
MT_EE_WIFI_CONF (offset 0x190) value from 0xd2 to 0x92. See
/etc/hotplug.d/firmware/11-mt76-caldata for details.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16322
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This fixes a well-known "LZMA ERROR 1" error on Sercomm NA502s, reported
on the OpneWrt forum [0].
[0] https://forum.openwrt.org/t/206640
Signed-off-by: Andreas Böhler <dev@aboehler.at>
Specifications:
- Device: DNA Valokuitu Plus EX400
- SoC: MT7621A
- Flash: 256MB NAND
- RAM: 256MB
- Ethernet: Built-in, 2 x 1GbE
- Wifi: MT7603 2.4 GHz, MT7615 5 GHz (4x internal antennas)
- USB: 1x 3.0
- LED: 1x green/red, 1x green
- Buttons: Reset
MAC addresses:
- LAN: u-boot 'ethaddr' (label)
- WAN: label + 1
- 2.4 GHz: label + 6
- 5 GHz: label + 7
Serial:
There is a black block connector next to the red ethernet connector. It
is accessible also through holes in the casing.
Pinout (TTL 3.3V)
+---+---+
|Tx |Rx |
+---+---+
|Vcc|Gnd|
+---+---+
Firmware:
The vendor firmware is a fork of OpenWrt (Reboot) with a kernel version
4.4.93. The flash is arranged as below and there is a dual boot
mechanism alternating between rootfs_0 and rootfs_1.
+-------+------+------+-----------+-----------+
| | env1 | env2 | rootfs_0 | rootfs_1 |
| +------+------+-----------+-----------+
| | UBI volumes |
+-------+-------------------------------------+
|U-Boot | UBI |
+-------+-------------------------------------+
|mtd0 | mtd1 |
+-------+-------------------------------------+
| NAND |
+---------------------------------------------+
In OpenWrt rootfs_0 will be used as a boot partition that will contain the
kernel and the dtb. The squashfs rootfs and overlay are standard OpenWrt
behaviour.
+-------+------+------+-----------+--------+------------+
| | env1 | env2 | rootfs_0 | rootfs | rootfs_data|
| +------+------+-----------+--------+------------+
| | UBI volumes |
+-------+-----------------------------------------------+
|U-Boot | UBI |
+-------+-----------------------------------------------+
|mtd0 | mtd1 |
+-------+-----------------------------------------------+
| NAND |
+-------------------------------------------------------+
U-boot:
With proper serial access booting can be halted to U-boot by pressing any
key. TFTP and flash writes are available, but only the first one has been
tested.
NOTE: Recovery mode can be accessed by holding down the reset button while
powering on the device. The led 'Update' will show a solid green light
once ready. A web server will be running at 192.168.1.1:80 and it will
allow flashing a firmware package. You can cycle between rootfs_0 and
rootfs_1 by pressing the reset button once.
Root password:
With the vendor web UI create a backup of your settings and download the
archive to your computer. Within the archive in the file
/etc/shadow replace the password hash for root with that of a password you
know. Restore the configuration with the vendor web UI and you will have
changed the root password.
SSH access:
You might need to enable the SSH service for LAN interface as by default
it's enabled for WAN only.
Installing OpenWrt:
With the vendor web UI install the OpenWrt factory image. Alternatively,
ssh to the device and use sysupgrade -n from cli.
Finalize by installing the OpenWrt sysupgrade image to get a fully
functioning system.
Reverting to the vendor firmware:
Boot with OpenWrt initramfs image
- Remove volumes rootfs_0, rootfs and rootfs_data and create vendor
volumes.
ubirmvol /dev/ubi0 -n 2
ubirmvol /dev/ubi0 -n 3
ubirmvol /dev/ubi0 -n 4
ubimkvol /dev/ubi0 -N rootfs_0 -S 990
ubimkvol /dev/ubi0 -N rootfs_1 -S 990
Power off and enter to the U-boot recovery to install the vendor
firmware.
Known issues:
- MACs for wifi are stored in currently unknown place but it seems
to persist over power-off. They might be stored on the chip.
Signed-off-by: Mauri Sandberg <maukka@ext.kapsi.fi>
[rmilecki: try NVMEM for MACs]
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Yuncore CPE200 is an outdoor unit with IEEE 802.11ac radio.
Hardware:
- SoC: MediaTek MT7628DAN (MIPS 580MHz)
- Flash: 8 MiB Spansion S25FL064K
- RAM: 64 MiB (built-into SoC)
- WLAN: 5 GHz (MT7613AE)
- Ethernet: 1x 10/100 Mbps WAN, 1x 10/100 LAN (MT7628)
- Buttons: 1 Reset button, 2 buttons for display UI (unsupported)
- LEDs: 4x Green (Power, LAN, WAN, WiFi)
- Display: 4 digit 7-segment display driven by an additional
microcontroller (unsupported)
- Serial console: unpopulated header, 57600 8n1 (RX only)
- Power: 12 VDC, 1 A
Installation:
The installation can be done via the recovery HTTP server which is built
into the bootloader. Hold down the reset button while connecting the
device to power and keep holding a bit more than 3 seconds. Connect to
http://192.168.0.100/ and upload sysupgrade.bin file.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The company Zyxel rebranded some years ago.
Currently the casing is according to the old branding even
for newer devices which already use the new branding.
This commit aligns the casing of Zyxel everywhere.
Signed-off-by: Goetz Goerisch <ggoerisch@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15652
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware:
- SoC: MediaTek MT7628DAN (MIPS 580MHz)
- Flash: 8 MiB Spansion S25FL064K
- RAM: 64 MiB (built-into SoC)
- WLAN: 2.4 GHz (MT7628)
- Ethernet: 1x 10/100 Mbps WAN, 1x 10/100 LAN (MT7628)
- Buttons: 1 Reset button
- LEDs: 1x Red, 1x Green
- Serial console: unpopulated header, 57600 8n1 (RX only)
- Power: 12 VDC, 1 A
There are unpopulated areas on the board for 5 GHz WiFi via PCIe as well
as (most likely) Quectel EG25-G 4G module. As both are not populated on
my board support for both is missing for now.
Installation:
The installation can be done via the recovery HTTP server which is built
into the bootloader. Hold down the reset button while connecting the
device to power and keep holding a bit more than 3 seconds. Connect to
http://192.168.188.253/ and upload sysupgrade.bin file.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The second edition of international version of Mi Router 4A 100M is
very similar to the non-international one, but has another wireless chip.
Installation
--------------
1. Initialize build-in firmware (use webgui for 192.168.31.1)
You should install root password
2. Run OpenWRTInvasion for the first time (probably it will fail)
Version 0.0.10 is working as well as 0.0.1.
3. Run OpenWRTInvasion for the second time
It will create an access to your router
4. Upload sysupgrade image to router (/tmp/fw.bin)
pc# nc -l 8080 < …/ramips/mt76x8/…-100m-intl-v2-squashfs-sysupgrade.bin
router# nc 192.168.31.175 8080 > /tmp/fw.bin
5. Flash new firmware
router# run mtd -r write /tmp/fw.bin OS1
6. Check result
Wait about 5-10 minutes after flash. Router should reboot itself and
turn left led from orange to blue.
In case of failure one can use Xiaomi 4a 100m debrick tool
(it uploads special image via tftpd in recovery mode)
After that you can start again from step 1.
Another actions are very similar to original Mi Router 4A 100M
Original mtd paritions:
-------------------------
```
Creating 9 MTD partitions on "raspi":
0x000000000000-0x000001000000 : "ALL"
0x000000000000-0x000000020000 : "Bootloader"
0x000000020000-0x000000030000 : "Config"
0x000000030000-0x000000040000 : "Factory"
0x000000040000-0x000000050000 : "crash"
0x000000050000-0x000000060000 : "cfg_bak"
0x000000060000-0x000000160000 : "overlay"
0x000000160000-0x000000dc0000 : "OS1"
0x000000dc0000-0x000001000000 : "disk"
with special sub-partition
0x0000002c0000-0x000000dc0000 : "rootfs"
```
We will use OS1+disk space:
```
0x000000160000-0x000001000000 : "firmware"
```
Co-authored-by: Nita Vesa <nita.vesa@elektrik.link>
Signed-off-by: Anton Stratonnikov <billic@yandex.ru>
Link: https://github.com/openwrt/openwrt/pull/14304
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for a dual-band AX1800 wall plug manufactured
by Shenzhen Century Xinyang Tech Co., Ltd.
CPU: Mediatek MT7621A (2 cores, 4 threads)
RAM: 256i MiB DDR3 (Samsung K4B2G1646F-BCNB)
ROM: 16 MiB SPI NOR (Winbond W25Q128JVPQ)
Wired: one gigabit RJ45 port (with green/yellow non-GPIO LEDs)
WiFi: Mediatek MT7905DAN + MT7975DN (DBDC 2x 2T2R)
Ant.: four 2 dBi external antennas (two 2.4GHz, two 5 GHz)
GPIO: tri-color status LED (GPIO 13, 14, 16);
reset button (GPIO 18)
Power: 12V 2-pin JST-XH on main PCB
110/220V AC to 12V1A DC on auxiliary PCB
UART: 115200 8n1, SMD pads available on the PCB as J4
pinout is [3v3] (Rx) (Tx) (Gnd)
MAC: 1C:BF:CE:xx:xx:xx (2.4 GHz, label)
1C:BF:CE:xx:xx:xx + 1 (ethernet [1])
1C:BF:CE:xx:xx:xx + 2 (5 GHz)
Original firmware is LEDE Reboot 17.01-SNAPSHOT (kernel 4.4.198)
with a few custom packages and a non-LuCI web interface.
Telnet and SSH are enabled, requiring an unknown root password [2].
Root password is also needed to access the router via UART console,
but passwordless telnet can be enabled via a trivial web exploit [3]
and then the root password can be removed by editing `/etc/shadow`.
Installation: First upload `sysupgrade` binary via web interface at
`http://192.168.188.1/settings.shtml` and wait until getting back to
the home screen (select network to extend). The installation fails
since the original firmware uses `swconfig` and recent versions of
OpenWrt use DSA. However, the sysupgrade file is uploaded correctly
and stored at `/tmp/upgrade.bin`, so it can be written to flash via
the web exploit [4] (both `mtd -r write` and `sysupgrade -Fn` work
fine). Passwordless telnet/ssh is not needed for installation.
Alternatively, use u-boot menu to load image via TFTP.
Notes:
- Device model in LEDE is "MediaTek MT7621 RFB (802.11ax,SNOR)".
- It is sold under several names, among them are Wodesys WD-R1802U,
Fenvi F-AX1802U, and EDUP EP-2971; the Wodesys brand was selected
since it is referenced in `/etc/banner` and `/etc/hosts`, and the
PCB is marked "WD518A V1.0".
- Instead of a standard ethernet transformer, the PCB has a few tiny
SMD coils.
[1] Original firmware sets ethernet MAC to 1C:BF:CE:E7:62:1D based on
offset `0x3fff4` in the Factory partition; since this is the same
MAC for all units, whereas WiFi MACs stored at offsets 0x6 and 0xc
are unique, it was decided to use <label MAC + 1> for ethernet.
[2] root:$1$7rmMiPJj$91iv9LWhfkZE/t7aCBdo.0:18388:0:99999:7:::
[3] curl -X POST http://192.168.188.1/cgi-bin/adm.cgi \
-d page=Lang -d langType="en;killall telnetd;telnetd -l /bin/sh"
[4] curl -X POST http://192.168.188.1/cgi-bin/adm.cgi \
-d page=Lang -d langType="en;mtd -r write /tmp/upgrade.bin firmware"
Signed-off-by: Rani Hod <rani.hod@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15777
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Ubiquiti has a set of UniFi 802.11ax (Wi-Fi 6) AP devices. All models
include "U6" in their names and also have code names with no special
characters (including spaces).
Examples:
1. U6 Lite (codename U6-Lite)
2. U6 Long-Range (codename U6-LR)
3. U6+ (codename U6-PLUS)
4. U6 Pro (codename U6-Pro)
5. U6 Mesh (codename U6-Mesh)
6. U6 Mesh Pro (codename U6-Mesh-Pro)
7. U6 Enterprise (codename U6-Enterprise)
Use proper full names for those devices. Names in OpenWrt/DTS code may
need updating too but it can be handled later.
Cc: Elbert Mai <code@elbertmai.com>
Cc: Daniel Golle <daniel@makrotopia.org>
Cc: Henrik Riomar <henrik.riomar@gmail.com>
Cc: David Bauer <mail@david-bauer.net>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Keenetic KN-3510 is a 2.4/5 Ghz band 11ax access point
Specification:
- System-On-Chip: MT7621AT
- CPU/Speed: 880 MHz
- Flash-Chip: Macronix MX30LF1G28AD-TI
- Flash size: 128 MiB
- RAM: 256 MiB
- 2x 10/100/1000 Mbps Ethernet
- PoE, 802.3af/at
- 4x internal antennas
- UART (J1) header on PCB (115200 8n1)
- WiFi: MT7915 2x2 2.4G 573.5Mbps + 2x2 5G 1201Mbps
- 2x LED, 2x button, 1x mode switch
Notes:
- The device supports dual boot mode
- The firmware partitions were concatinated into one
Flash instruction:
The only way to flash OpenWrt image is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24 and tftp server.
2. Rename "openwrt-ramips-mt7621-keenetic_kn-3510-squashfs-factory.bin"
to "KN-3510_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed until power led start blinking.
4. Router will download file from server, write it to flash and reboot
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15744
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This device is exactly the same as WL-WN531G3 but with different partition layout and different MAC layout. Labeled as Quantum D4G Rev.: A2.
Hardware
--------
SoC: Mediatek MT7620A
RAM: 64MB
FLASH: 8MB NOR (GigaDevice GD25Q64CS)
ETH:
- 2x 10/100/1000 Mbps Ethernet (RTL8211F)
- 3x 10/100 Mbps Ethernet (integrated in SOC)
WIFI:
- 2.4GHz: 1x (integrated in SOC) (2x2:2)
- 5GHz: 1x MT7612E (2x2:2)
- 4 external antennas
BTN:
- 1x Reset button
- 1x Touchlink button
- 1x Turbo button
- 1x Wps button
- 1x ON/OFF switch
LEDS:
- 1x Red led (system status)
- 1x Blue led (system status)
- 5x Blue leds (ethernet ports)
- 1x Power led
- 1x Wifi led
UART:
- 57600-8-N-1
Everything works correctly.
Installation
------------
Flash the initramfs image in the OEM firmware interface
When Openwrt boots, flash the sysupgrade image otherwise you won't be
able to keep configuration between reboots.
Notes
-----
1) Router mac addresses:
LAN XX:XX:XX:XX:XX:0F (factory @ 0x28)
WAN XX:XX:XX:XX:XX:10 (factory @ 0x2e)
WIFI 2G XX:XX:XX:XX:XX:11 (factory @ 0x04)
WIFI 5G XX:XX:XX:XX:XX:12 (factory @ 0x8004)
LABEL XX:XX:XX:XX:XX:11
Signed-off-by: Eros Brigmann <erosbrigmann@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15876
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Remove kmod-switch-rtl8366-smi from the package list, as it is still loaded
because kmod-switch-rtl8367b depends on it
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/15757
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Now that the SDHC of MT762{0,1,8} has been supported upstream, it's
time to switch the default driver to the upstream one. We will still
keep the old driver for users to choose from.
Tested on HiWiFi HC5861 (MT7620A) and HiWiFi HC5661A (MT7628N).
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
The WLR-1240 (ZX-5434) is an AC1200 Wave 2 outdoor repeater
with omnidirectional antennas for wall or pole mounting.
The device is manufactured by Todaair and meant to be used with
a tuya-based app, there is no webinterface for configuration.
Specifications:
- MT7628AN, 8 MiB SPI NOR flash, 64 MiB RAM, 2x2 802.11n
- MT7613 2x2 802.11ac Wave 2
- 802.3af PoE or 12V 1A 5.5x2.1 power supply (included)
- top RGB LED ring
TFTP installation:
- rename sysupgrade to `firmware_auto.bin`
- provide at 192.168.1.10 during boot
HTTP installation:
- keep reset button pressed for 5 seconds during power on (light blue
LED flashes slowly, then quickly to confirm, then remains steady on)
- recovery web interface is at 192.168.1.1, upload sysupgrade
Opening the device
- use suction cup to remove top cap within LED ring
- two screws are located in holes underneath silicone sealant
- two further screws are located at the bottom
initramfs boot
- open device, connect serial console (pins are labelled)
- keep pressing `4` during second tftp attempt to enter uboot shell
- run `tftpboot 82000000` to avoid memory overlap, then `bootm`
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
The WLR-1230 (ZX-5207) is an AC1200 Wave 2 outdoor repeater
with sector antennas for wall or pole mounting.
The device is manufactured by Todaair and meant to be used with
a tuya-based app, there is no webinterface for configuration.
Specifications:
- MT7628AN, 8 MiB SPI NOR flash, 64 MiB RAM, 2x2 802.11n
- MT7613 2x2 802.11ac Wave 2
- 802.3af PoE or 12V 1A 5.5x2.1 power supply (included)
- 3 LEDs WLAN, LAN, RES; PWR LED is not software-controllable
TFTP installation:
- rename sysupgrade to `firmware_auto.bin`
- provide at 192.168.1.10 during boot
HTTP installation:
- keep reset button pressed for 5 seconds during power on (LEDs
flash slowly, then quickly to confirm, then remain steady on)
- recovery web interface is at 192.168.1.1, upload sysupgrade
Opening the device
- two screws are located in the bottom left and right corners
underneath the label, inner tray slides out easily
initramfs boot
- open device, connect serial console (pins are labelled)
- keep pressing `4` during second tftp attempt to enter uboot shell
- run `tftpboot 82000000` to avoid memory overlap, then `bootm`
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
Buffalo WSR-2533DHPL2 is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based
on MediaTek MT7621A.
Specification:
- SoC : MediaTek MT7621AT
- RAM : DDR3 128 MiB (Winbond W631GG6MB12J)
- Flash : RAW-NAND 128 MiB (Winbond W29N01HVSINF)
- WLAN : 2.4/5 GHz (2x MediaTek MT7615N)
- Ethernet : 10/100/1000 Mbps x4
- Switch : MediaTek MT7530 (SoC)
- LED/keys : 8x/6x (2x buttons, 1x slide-switch)
- UART : through-hole on PCB (J4)
- arrangement : 3.3V, GND, TX, RX from triangle-mark
- settings : 57600n8
- Power : 12VDC 1.5A
Flash instruction using factory.bin image:
1. boot WSR-2533DHPL2 normally with "Router" mode
2. access to the WebI ("http://192.168.11.1/") on the device and open
firmware update page
("管理" -> "ファームウェア更新")
3. select the OpenWrt factory.bin image and click update ("更新実行")
button
Attention: do not use "factory-uboot.bin" image
4. Wait ~120 seconds to complete flashing
Flash instruction using initramfs image:
1. prepare the TFTP server with the initramfs image renamed to
"linux.trx-recovery" and IP address "192.168.11.2"
2. press the "AOSS" button while powering on the WSR-2533DHPL2
3. after 10 seconds, release the "AOSS" button, WSR-2533DHPL2 downloads
the initramfs image and boot with it automatically
4. on the initramfs image, download the factory-uboot.bin image to the
device and perform sysupgrade with it and "-F" option
5. wait ~120 seconds to complete flashing
Notes:
- There are 2x factory*.bin images for different purposes.
- factory.bin : for flashing on OEM WebUI
- factory-uboot.bin: for flashing on OEM bootloader or initramfs image
factory-uboot.bin is useful for recoverying the device, or refreshing
when the kernel partition is expanded in the future. sysupgrade on
this device accepts factory-uboot.bin with option "-F", but on that
situation, user configurations won't be kept, so it's not for normal
use.
MAC addresses:
LAN : 18:EC:E7:xx:xx:E0 (board_data, "mac" (text))
WAN : 18:EC:E7:xx:xx:E0 (board_data, "mac" (text))
2.4 GHz: 18:EC:E7:xx:xx:E1 (Factory, 0x4 (hex))
5 GHz : 18:EC:E7:xx:xx:E4 (Factory, 0x8004 (hex))
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Buffalo WSR-2533DHPLS is a 2.4/5 GHz band 11ac router, based on MediaTek
MT7621A.
Very similar to Buffalo WSR-2533DHPL, but with NAND, different GPIO
and TRX partitions.
Specification:
- SoC : MediaTek MT7621AT
- RAM : DDR3 256 MiB (Samsung K4B2G1646F-BYMA)
- Flash : RAW-NAND 128 MiB
(Winbond W29N01HV or KIOXIA TC58BVG0S3HTAI0)
- WLAN : 2.4/5 GHz (2x MediaTek MT7615N)
- Ethernet : 10/100/1000 Mbps
- Switch : MediaTek MT7530 (SoC) 4 ports
- LED/keys : 8x/6x (2x buttons, 1x slide-switch)
- UART : through-hole on PCB (J4)
- arrangement : 3.3V, GND, TX, RX from triangle-mark
- settings : 115200n8
- Power : 12VDC 1.5A
Flash instruction using factory.bin image:
1. boot WSR-2533DHPLS normally with "Router" mode
2. access to the WebI ("http://192.168.11.1/") on the device and open
firmware update page
("管理" -> "ファームウェア更新")
3. select the OpenWrt factory.bin image and click update ("更新実行")
button
Attention: do not use "factory-uboot.bin" image
4. Wait ~120 seconds to complete flashing
Flash instruction using initramfs image:
1. prepare the TFTP server with the initramfs image renamed to
"linux.trx-recovery" and IP address "192.168.11.2"
2. press the "AOSS" button while powering on the WSR-2533DHPLS
3. after 10 seconds, release the "AOSS" button, WSR-2533DHPLS downloads
the initramfs image and boot with it automatically
4. on the initramfs image, download the factory-uboot.bin image to the
device and perform sysupgrade with it and "-F" option
5. wait ~120 seconds to complete flashing
Notes:
- The embedded addresses in eeprom data in Factory partition have
Buffalo's OUI, but they don't match with the actual addresses
assigned to wlan devices. So fixup addresses by the user-space
script.
root@localhost:/# hexdump -C /dev/mtdblock3 | grep "^0000[08]000\s"
00000000 15 76 a0 00 88 57 ee bc 01 a8 15 76 c3 14 00 80 |.v...W.....v....|
00008000 15 76 a0 00 88 57 ee bc 01 f8 15 76 c3 14 00 80 |.v...W.....v....|
See "MAC addresses" below for actual addresses.
- There are 2x factory*.bin images for different purposes.
- factory.bin : for flashing on OEM WebUI
- factory-uboot.bin: for flashing on OEM bootloader or initramfs image
factory-uboot.bin is useful for recoverying the device, or refreshing
when the kernel partition is expanded in the future. sysupgrade on
this device accepts factory-uboot.bin with option "-F", but on that
situation, user configurations won't be kept, so it's not for normal
use.
MAC addresses:
LAN : 90:96:F3:xx:xx:30 (board_data, "mac" (text))
WAN : 90:96:F3:xx:xx:30 (board_data, "mac" (text))
2.4 GHz: 90:96:F3:xx:xx:31
5 GHz : 90:96:F3:xx:xx:38
[original work]
Signed-off-by: Audun-Marius Gangstø <audun@gangsto.org>
[convert to ubi, fix/improve DT, add sysupgrade support]
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
The Yafut tool now has limited capabilities for working on filesystem
images stored in regular files. This enables preparing Yaffs2 images
for devices with NOR flash using upstream Yaffs2 filesystem code instead
of the custom kernel2minor tool.
Since minimizing the size of the resulting filesystem image size is
important and upstream Yaffs2 code requires two allocator reserve blocks
to be available when writing a file to the filesystem, a trick is
employed while preparing an OpenWRT image: the blank filesystem image
that Yafut operates on initially contains two extra erase blocks that
are chopped off after the kernel file is written. This is safe to do
because Yaffs2 has a true log structure and therefore only ever writes
sequentially (and the size of the kernel file is known beforehand).
While the two extra erase blocks are necessary for writes, Yaffs2 code
seems to be perfectly capable of reading back files from a "truncated"
filesystem that does not contain these extra erase blocks.
In terms of image size, this new approach is only marginally worse than
the current kernel2minor-based one: specifically, upstream Yaffs2 code
needs to write three object headers (each of which takes up an entire
data chunk) when the kernel file is written to the filesystem:
- an object header for the kernel file when it is created,
- an object header for the root directory when the kernel file is
created,
- an updated object header for the kernel file when the latter is
fully written (so that its new size can be recorded).
kernel2minor only writes two of these headers, which is the absolute
minimum required for reading the file back. This means that the
Yafut-based approach causes firmware images to be at most one erase
block (64 kB) larger than those created using kernel2minor, but only in
the very unfortunate scenario where the size of the kernel file is
really close to a multiple of the erase block size.
The rest of the calculations performed when the empty filesystem image
is first prepared stems from the Yaffs2 layout used by MikroTik NOR
devices: each 65,536-byte erase block contains 63 chunks, each of which
consists of 1024 bytes of data followed by 16-byte Yaffs tags without
ECC data; each such group of 63 chunks is then followed by 16 bytes of
padding, which translates to "-C 1040 -B 64k -E" in the Yafut
invocation. Yaffs2 checkpoints and summaries are disabled (using
Yafut's -P and -S switches, respectively) as they are merely performance
optimizations that require extra storage space. The -L and -M switches
are used to force little-endian or big-endian byte order (respectively)
in the resulting filesystem image, no matter what byte order the build
host uses. The tr invocation is used to ensure that the filesystem
image is initialized with 0xFF bytes (which are an indicator of unused
space for Yaffs2 code).
Signed-off-by: Michał Kępień <openwrt@kempniu.pl>
Link: https://github.com/openwrt/openwrt/pull/13453
Signed-off-by: Robert Marko <robimarko@gmail.com>
Hardware:
- SoC: MediaTek MT7628AN (MIPS 580MHz)
- Flash: 16 MiB XMC 25QH128CH10
- RAM: 128 MiB ESMT M14D1G1664A
- WLAN: 2.4 GHz (MT7628), 5 GHz (MT7613BEN 802.11ac)
- Ethernet: 1x 10/100 Mbps WAN, 1x 10/100 LAN (MT7628)
- USB 2.0 port
- Buttons: 1 Reset button, 1 slider button
- LEDs: 1x Red, 1x White
- Serial console: unpopulated header, 115200 8n1
- Power: 5 VDC, 2 A
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| WAN | 80:af:ca:xx:xx:x0 | label |
| LAN | 80:af:ca:xx:xx:x0 | label |
| WLAN 2g | 80:af:ca:xx:xx:x0 | label |
| WLAN 5g | 80:af:ca:xx:xx:x2 | label+2 |
+---------+-------------------+-----------+
Installation:
The installation must be done via TFTP by disassembling the router.
On other occasions Cudy has distributed intermediate firmware to make
installation easier, and so I recommend checking the Wiki for this
device if there is a more convenient solution than the one below.
To install using TFTP:
1. Upgrade to a beta firmware (signed by Cudy) that can be downloaded
from the wiki. This is required in order to use an unlocked u-boot.
2. Connect to UART.
3. While the router is turning on, press 1.
4. Connect to LAN and set your IP to 192.168.1.88/24. Configure a TFTP
server and an OpenWrt initramfs-kernel.bin firmware file as recovery.bin.
5. Press Enter three times. Verify the filename.
6. If you can reach LuCI or SSH now, just use the sysupgrade image with
the 'Keep settings' option turned off.
If you don't want to use the beta firmware nor the unlocked u-boot, you
can install the firmware writing the sysupgrade image on the firmware
partition of the SPI flash.
Signed-off-by: Luis Mita <luis@luismita.com>
Add support for D-Link DIR-2055 A1 based on similarities to DIR-1960 A1,
as well as various DIR-8xx A1 models. Existing DIR-1960 A1 openwrt
"factory" firmware installs without modifications via the D-Link Recovery
GUI and has no known incompatibilities with the DIR-2055 A1.
Changes to be committed:
new file: target/linux/ramips/dts/mt7621_dlink_dir-2055-a1.dts
modified: target/linux/ramips/image/mt7621.mk
modified: target/linux/ramips/mt7621/base-files/etc/board.d/01_leds
modified: target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh
Specifications:
Board: Not known
SoC: MediaTek MT7621 Family (MT7621AT)
RAM: 256 MB (Micron 9OK17 D9PTK, should be DDR3 MT41K128M16JT-125)
Flash: 128 MB (Winbond W29N01HVSINA)
WiFi: MediaTek MT7615 Family (MT7615N x2)
Switch: 1 WAN, 4 LAN (Gigabit)
Ports: 1 USB 3.0 (front)
Buttons: Reset, WiFi Toggle, WPS
LEDs: Power (white/orange), Internet (white/orange),
WiFi 2.4G (white), WiFi 5G (white)
Notes:
Only known difference vs. the DIR-1960 A1 is that the DIR-2055 A1
doesn't have a USB activity LED
Serial port:
Tested to be identical to various DIR-8xx A1 models with a similar
enclosure/pcb design:
Parameters: 57600, 8N1, 3.3V TTL no flow control
Location: J1 header (close to the Reset, WiFi and WPS buttons)
Pinout: 1 - VCC 2 - RXD 3 - TXD 4 - GND
Did not connect VCC when using
Installation:
D-Link Recovery GUI: power down the router, press and hold the reset
button, then re-plug it. Keep the reset button pressed until the power
LED starts flashing orange, manually assign a static IP address under
the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to
http://192.168.0.1
Some modern browsers may have problems flashing via the Recovery GUI,
if that occurs consider uploading the firmware through cURL:
curl -v -i -F "firmware=@file.bin" 192.168.0.1
Signed-off-by: Keith Harrison <keithh@protonmail.com>
ELECOM WRC-X1800GS is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on
MT7621A.
Specification:
- SoC : MediaTek MT7621A
- RAM : DDR3 256 MiB
- Flash : RAW-NAND 128 MiB (Macronix MX30LF1G28AD-TI)
- WLAN : 2.4/5 GHz 2T2R (MediaTek MT7915D)
- Ethernet : 5x 10/100/1000 Mbps
- switch : MediaTek MT7530 (SoC)
- LEDs/Keys (GPIO) : 7x/4x
- UART : pin-header on PCB ("J5")
- arrangement : 3.3V, TX, RX, NC, GND from tri-angle marking
- settings : 115200n8
- Power : 12 VDC, 1 A
Flash instruction using initramfs-factory image:
1. Boot WRC-X1800GS normally with "Router" mode
2. Access to "http://192.168.2.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt initramfs-factory image and click apply ("適用")
button
4. After flashing initramfs-factory image and reboot, upload the
sysupgrade image and perform sysupgrade with it
5. Wait ~120 seconds to complete flashing
Notes:
- WRC-X1800GS has 2x os images. Those are switched on every firmware
updating on stock firmware, but dual-boot feature on this device
cannot be handled on OpenWrt. So the 1st image is always used on
OpenWrt.
This is controlled by "bootnum" variable embedded in "persist"
partition (addr: 0x4).
- WRC-X1800GS has 2x HW revisions. There are some small changes, but the
same DeviceTree in stock firmware is used for both revisions.
On this support of WRC-X1800GS, 2x green:wlan-2g-N LEDs are defined
for each revision and the same default triggers are set.
MAC addresses:
LAN : 38:97:A4:xx:xx:38 (Factory, 0x1fdfa (hex) / Ubootenv, ethaddr (text))
WAN : 38:97:A4:xx:xx:3B (Factory, 0x1fdf4 (hex))
2.4 GHz: 38:97:A4:xx:xx:39
5 GHz : 38:97:A4:xx:xx:3A
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
