previous commit ffa4b5283b introduced a bug which broke the MAC address
assignment for belkin,rt1800 and linksys,e7350.
Fixes: ffa4b5283b ("ramips: add support for Mikrotik LtAP-2HnD")
Signed-off-by: Arne Zachlod <arne@nerdkeller.org>
Specifications:
- SoC: MediaTek MT7621AT
- RAM: 128 MB (DDR3)
- Flash: 16 MB (SPI NOR)
- WiFi: MediaTek MT7603E, MediaTek MT7613BE
- Switch: 1 WAN, 4 LAN (Gigabit)
- Ports: 1 USB 3.0
- Buttons: Reset, WPS
- LEDs: System, Wan, Lan 1-4, WiFi 2.4G, WiFi 5G, WPS
- Power: DC 12V 1A tip positive
Download and flash the manufacturer's built OpenWRT image available at
http://www.cudytech.com/openwrt_software_download
Install the new OpenWRT image via luci (System -> Backup/Flash firmware)
Be sure to NOT keep settings. The force upgrade may need to be checked
due to differences in router naming conventions.
Recovery:
- Loads only signed manufacture firmware due to bootloader RSA verification
- serve tftp-recovery image as /recovery.bin on 192.168.1.88/24
- connect to any lan ethernet port
- power on the device while holding the reset button
- wait at least 8 seconds before releasing reset button for image to
download
- See http://www.cudytech.com/newsinfo/547425.html
Signed-off-by: Óscar García Amor <ogarcia@connectical.com>
Fix the LZMA ERROR 1 with a single line of recipe instead of duplicating
"uimage-lzma-loader".
While reviewing my original submission of commit ce19571004 David
suggested to use $(Device/uimage-lzma-loader), but due to the specific
needs of the vendor bootloader that simple oneliner didn't work.
The new $(Device/seama-lzma-loader) is for those SEAMA capable
bootloaders.
Signed-off-by: Szabolcs Hubai <szab.hu@gmail.com>
In the support topic [0] of the GitHub issue #10634 it was found out
(based on boot logs) that the uimage-lzma-loader (commit 09faa73c53)
never worked, as an earlier workaround (commit 6fba88de19) negated
the recipe:
3: System Boot system code via Flash.
## Booting image at bc050000 ...
raspi_read: from:50000 len:40
.raspi_read: from:50000 len:c
.raspi_read: from:50000 len:1fa000
................................We have SEAMA, Image Size = 2072512
Verifying Checksum ...
Uncompressing SEAMA linux.lzma ... OK
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64
Starting kernel ...
[ 0.000000] Linux version 5.4.188 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16554-1d4dea6d4f)) #0 Sat Apr 16 12:59:34 2022
[ 0.000000] SoC Type: Ralink RT3883 ver:1 eco:5
[ 0.000000] printk: bootconsolde [early0] enabled
[ 0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[ 0.000000] MIPS: machine is D-Link DIR-645
[ 0.000000] Initrd not found or empty - disabling initrd
Using the new seama-lzma-loader it's able to boot OpenWrt 22.03
and OpenWrt SNAPSHOT too:
3: System Boot system code via Flash.
## Booting image at bc050000 ...
raspi_read: from:50000 len:40
.raspi_read: from:50000 len:c
.raspi_read: from:50000 len:48b004
.........................................................................We have SEAMA, Image Size = 4763588
Verifying Checksum ...
Uncompressing SEAMA linux.lzma ... OK
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64
Starting kernel ...
OpenWrt kernel loader for MIPS based SoC
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80000000...
[ 0.000000] Linux version 5.10.144 (xabolcs@ut2004) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r20774+2-b71affaf8b) 11.3.0, GNU ld (GNU Binutils) 2.37) #0 Tue Sep 27 23:02:30 2022
[ 0.000000] SoC Type: Ralink RT3883 ver:1 eco:5
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[ 0.000000] MIPS: machine is D-Link DIR-645
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16256
[ 0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
The OKLI Loader is unable to read the flash on this SoC:
Looking for OpenWrt image... not found! ('0xddbaddba' at 0xbc051000)
0: https://forum.openwrt.org/t/136435
Fixes: GitHub issue #10634 ("V22.03.0 release currently does not work on D-Link DIR-645")
Fixes: 09faa73c53 ("ramips: rt3883: use lzma-loader for DIR-645")
Tested-by: Glenn Fowler <gfowler1@outlook.com>
Signed-off-by: Szabolcs Hubai <szab.hu@gmail.com>
Define "Device/seama-lzma-loader" recipe for SEAMA devices to help
contributors avoid doing recipe mistakes.
In a forum topic [0] I was under the impression that the good old
uimage-lzma-loader didn't fix the LZMA ERROR 1 for a device.
It was found out, that the uimage-lzma-loader never worked because the
KERNEL variable was overriden earlier (also an LZMA ERROR 1 related
commit, 6fba88de19), and the "use lzma-loader" fix (commit
09faa73c53) didn't catch that to include the "loader-kernel" part.
I contributed an LZMA ERROR 1 fix (commit ce19571004) for the SEAMA
device D-Link DIR-860L B1, where I had to duplicate the whole
uimage-lzma-loader recipe because of the special needs of the vendor
bootloader.
This new recipe reuse most of uimage-lzma-loader's KERNEL definiton to
avoid duplication.
It uses "relocate-kernel" as it needed for D-Link DIR-860L B1 to
boot from flash, and it's compatible with D-Link DIR-645 too.
It repacks lzma-loader with lzma for kernel (without uImage), because
these weird hacked vendor bootloaders accepts only LZMA compressed
kernels from flash:
We have SEAMA, Image Size = 4759794
Verifying Checksum ...
Uncompressing SEAMA linux.lzma ... OK
It uses uImage header for initramfs kernel to be little bit verbose.
0: https://forum.openwrt.org/t/136435/10
Signed-off-by: Szabolcs Hubai <szab.hu@gmail.com>
Mikrotik LtAP-2HnD is a outdoor/automotive WLAN 4 router with integrated GPS
receiver and two mPCIe slots.
Specifications:
* SoC: MT7621A
* RAM: 128 MiB Nanya NT5CC64M16GP-DI
* Flash: 16 MiB winbond W25Q128JV
* WLAN:
* Atheros AR9382 with power amplifier SKY 85330 (2x2 internal antennas,
with RF switches for external connectors)
* Ethernet: 1 Gbps, single port
* USB Host: USB 2.0 Speeds
* Serial: 115200 baud
* LEDs: Power, System, GPS, 5* RSSI
* mPCIe:
* miniPCIe slot 1: PCIe and USB 2.0 Host (via switch shared with USB Host)
* miniPCIe slot 2: USB 2.0 and 3.0
* SIM Cards:
* Slot 1 Connected to mPCIe slot 1
* Slot 2 and 3 connected to mPCIe slot 2 via switch
* GPS: MTK 3333 on serial port 2 (/dev/ttyS1), 115200 baud and PPS on gpio 14
gpios are exposed to /sys/class/gpio:
* usb-select: swithes USB 2.0 interface between external port and internal
mPCIe slot 1 default is the external USB interface
* gps-reset: resets the GPS interface chip
* sim-select: switches between sim slot 2 and 3 connected to mPCIe slot 2
* gps-ant-select: switches GPS antenna between internal antenna and SMA
connected antenna
* lte-reset: resets mPCIe slot 2
Flashing:
TFTP boot initramfs image and then perform sysupgrade. Follow common
MikroTik procedure as in https://openwrt.org/toh/mikrotik/common.
Signed-off-by: Arne Zachlod <arne@nerdkeller.org>
- implement multiqueue via qdma hardware shaper to deal with ports with different speeds
- implement hardware DSA untagging
- add NETIF_F_ALL_TSO to reduce unnecessary segmentation
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The Ubiquiti UniFi 6 Lite does not correctly align the FDT by always
setting fdt_high to 0xffffffff when invoking the bootubnt command.
Work around this issue by loading the DTB to a valid,aligned address, so
the bootloader does not have to relocate the FDT automatically.
Note: The device does read the kernel before invoking bootm on the FIT
image to 0x86000000.
Signed-off-by: David Bauer <mail@david-bauer.net>
The SPI max frequency was set to 80MHz, considerably higher than the
vendor clocks it in their firmware (10MHz). Multiple users reported
jffs2 corruption/instability in GitHub issue #10461.
My unit has a W25Q256; datasheet specifies maximum SPI frequency for
read command of 50MHz.
Thanks to @DragonBlueP for suggesting to eliminate m25p,fast-read;
and @MPannen1979 for identifying the problem.
Fixes: #10461
Signed-off-by: Michael Lyle <mlyle@lyle.org>
Set power LED to gpio 43 instead of 44 for v3 and v4.
Set red wifi LED to gpio 40 (was assigned to `red:wifi5g`).
Tested by the author of the initial v3 and v4 commit.
Reported-by: Richard Fröhning <misanthropos@gmx.de>
Tested-by: Richard Fröhning <misanthropos@gmx.de>
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Signed-off-by: Jan-Niklas Burfeind <git@aiyionpri.me>
MR600 V2(EU) is an LTE router that also supports 4G+ band aggregation
etc. and can reportedly achieve higher bandwidth with it.
- Specifications:
* SoC: Mediatek MT7621DAT 880MHz
* RAM: 128MB DDR3
* Flash: 16MB SPI NOR flash (GD25Q128C)
* LTE Modem: Qualcomm MDM9240
* WiFi 5GHz: Mediatek MT7613BEN
* WiFi 2.4GHz: Mediatek MT7603EN
* Ethernet: MT7530, 4x 1000Base-T.
* UART: Serial console (115200 8n1), J1(GND:3)
* Buttons: Reset, WPS.
* LED: Power, WAN, LTE, WiFi 2GHz and 5GHz, LAN, Signal1, Signal2,
Signal3
- MAC Addresses:
OEM firmware configuration:
54:af:97:xx:xx:7b : 2.4G
54:af:97:xx:xx:7a : 5G
54:af:97:xx:xx:7c : LTE
54:af:97:xx:xx:7b : LAN (label)
54:af:97:xx:xx:7c : WAN
- Installation:
1. Download the OpenWrt initramfs-image.
Place it into a TFTP server root directory and rename it to openwrt.img
Configure the TFTP server to listen at 192.168.0.5/24.
3. Connect to the serial console.
Attach power and interrupt the boot procedure when prompted (type `tpl`).
Credentials are admin / 1234
4. Configure U-Boot for booting OpenWrt from ram
$ tftpboot
$ bootm
5. Transfer the OpenWrt sysupgrade image to the device.
- LTE:
In order to setup the wwan0 interface:
1. Add a `qmi` proto interface under `/etc/config/network`, e.g.:
```
config interface 'wwan0'
option device '/dev/cdc-wdm0'
option proto 'qmi'
option pincode 'XXXX'
option apn 'your_isp_apn'
```
2. Add `wwan0` interface to the `wan` firewall zone
3. `/etc/init.d/network restart`
Signed-off-by: Linos Giannopoulos <linosgian00@gmail.com>
SIM AX18T and Haier HAR-20S2U1 Wi-Fi6 AX1800 routers are designed based
on Tenbay WR1800K. They have the same hardware circuits and u-boot.
SIM AX18T has three carrier customized models: SIMAX1800M (China Mobile),
SIMAX1800T (China Telecom) and SIMAX1800U (China Unicom). All of these
models run the same firmware.
Specifications:
SOC: MT7621 + MT7905 + MT7975
ROM: 128 MiB
RAM: 256 MiB
LED: status *3 R/G/B
Button: reset *1 + wps/mesh *1
Ethernet: lan *3 + wan *1 (10/100/1000Mbps)
TTL Baudrate: 115200
TFTP Server: 192.168.1.254
TFTP IP: 192.168.1.28 or 192.168.1.160 (when envs is broken)
MAC Address:
use address source
label 30:xx:xx:xx:xx:62 wan
lan 30:xx:xx:xx:xx:65 factory.0x8004
wan 30:xx:xx:xx:xx:62 factory.0x8004 -3
wlan2g 30:xx:xx:xx:xx:64 factory.0x0004
wlan5g 32:xx:xx:xx:xx:64 factory.0x0004 set 7th bit
TFTP Installation (initramfs image only & recommend):
1. Set local tftp server IP: 192.168.1.254 and NetMask: 255.255.255.0
2. Rename initramfs-kernel.bin to "factory.bin" and put it in the root
directory of the tftp server. (tftpd64 is a good choice for Windows)
3. Start the TFTP server, plug in the power supply, and wait for the
system to boot.
4. Backup "firmware" partition and rename it to "firmware.bin", we need
it to back to stock firmware.
5. Use "fw_printenv" command to list envs.
If "firmware_select=2" is observed then set u-boot enviroment:
/# fw_setenv firmware_select 1
6. Apply sysupgrade.bin in OpenWrt LuCI.
Web UI Installation:
1. Apply update by uploading initramfs-factory.bin to the web UI.
2. Use "fw_printenv" command to list envs.
If "firmware_select=2" is observed then set u-boot enviroment:
/# fw_setenv firmware_select 1
3. Apply squashfs-sysupgrade.bin in OpenWrt LuCI.
Recovery to stock firmware:
a. Upload "firmware.bin" to OpenWrt /tmp, then execute:
/# mtd -r write /tmp/firmware.bin firmware
b. We can also write factory image "UploadBrush-bin.img" to firmware
partition to recovery. Upload image file to /tmp, then execute:
/# mtd erase firmware
/# mtd -r write /tmp/UploadBrush-bin.img firmware
How to extract stock firmware image:
Download stock firmware, then use openssl:
openssl aes-256-cbc -d -salt -in [Downloaded_Firmware] \
-out "firmware.tar.tgz" -k QiLunSmartWL
Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Description heavily based on commit
7e89421a7c by
Sergey Ryazanov <ryazanov.s.a@gmail.com> Details I cannot confirm have
been removed
Completed with great help from \x on IRC. Thanks, \x!
Zbtlink ZBT-WG1602-V04 is a Wi-Fi router intendend for use with WWAN
(UMTS/LTE/3G/4G) modems. The router board offers a couple of miniPCIe
slots with USB and SIM only and another one which is a pure miniPCIe
slot as well as five Gigabit Ethernet ports (4xLAN + WAN).
Specification:
* SoC: MT7621A
* RAM: 256/512 MiB
* Flash: 16/32 MiB
* Eth: 10/100/1000 Mbps Ethernet x5 ports (4xLAN + WAN)
* WLAN 2GHz: MT7603E (.11bgn, MIMO 2x2)
* WLAN 5GHz: MT7662E (.11nac, MIMO 2x2)
* WLAN Ants: detachable x2, shared by 2GHz & 5GHz radios
* miniPCIe: 2x slots with USB&SIM + 1x slot with regular PCIe bus
* WWAN Ants: detachable x4
* External storage: microSD (SDXC) slot
* USB: 3.0 Type-A port
* LED: 11 (5 per Eth phy, 3 SoC controlled, 2 WLAN 2/5 controlled,
1 power indicator)
* Button: 1 (reset)
* UART: console (115200 baud)
* Power: DC jack (12 V / 2.5 A)
Additional HW information:
* SoC USB port 1 is shared by internal miniPCIe slot and external
Type-A USB port, USB D+/D- lines are toggled between ports using a
GPIO controlled DPDT switch.
Installation:
The kernel image can be installed directly onto the device via a browser
to 192.168.1.1 using the built in firmware recovery Web UI available.
It can be accessed by pushing the reset button in, applying power and
holding the reset button for approximately 10 seconds. When the kernel
image has been flashed, you can access LuCI and upload the sysupgrade
as normal.
Signed-off-by: Alexander Horner <ahorner@programmer.net>
Add UIMAGE_NAME and UIMAGE_MAGIC to allow users to directly install
initramfs-kernel.bin from the stock firmware Web UI. At the same time,
this change makes it possible to boot OpenWrt with the official u-boot.
Notice:
Since the stock firmware is based on OpenWrt and the configuration
will be retained by default during the upgrade process, so we must use
initramfs-kernel.bin to do a initial installation. After the system
restarts, install sysupgrade.bin and do not retain any configuration.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
It is an in-wall 802.11ax (Wi-Fi 6) router, based on MediaTek MT7621A.
Specifications:
- SoC: MT7621AT (880MHz, 2 Cores)
- RAM: 128 MB
- Flash: 16 MB SPI NOR
- Wi-Fi:
- MT7915DN + MT7905DAN: 2.4/5 GHz
- Ethernet: 1x 1GiE via MT7530
- UART: J4 (115200 baud)
- Pinout: [3V3] (TXD) (RXD) (GND)
- Bootloader: U-Boot
- Buttons:
- SW1 - no label on the box, combined with led
- Led: Status. RGB controlled by
- GPIO 14 - green color
- GPIO 15 - red color
- GPIO 16 - blue color
Installation:
OEM firmware is based on LEDE with custom UI and support standard sysupgrade
variant of firmware. However it requires "*.ubin" extension for sysupgrade file.
Always select "Factory reset" switch on upgrade to OpenWRT, otherwise
it will not boot.
MAC addresses as verified by OEM firmware:
vendor source
LAN factory 0x4 (label)
5g factory 0x4 (label)
2g label with flipped bits bit in 1-st byte and bits 5, 6, 7 in
4-th byte
Example
label: 44:xx:xx:b7:xx:xx
lan: 44:xx:xx:b7:xx:xx
2g 46:xx:xx:c7:xx:xx
5g 44:xx:xx:b7:xx:xx
Signed-off-by: Volodymyr Puiul <volodymyr.puiul@gmail.com>
Manufacturer has predetermined mac address values for lan and wan ports.
This change keeps inline with other mt7621 devices mac address allocation
from factory mtd partition.
Example from hexdump output:
0xe000 0x6 (lan) - 0xe006 0x6 (wan)
0000e000 70 b3 d5 10 02 96 70 b3 d5 10 02 95 ff ff ff ff
Previous change had created an overlapping mac address situation as it
would increment by one based on the lan mac address location found in the
factory partition, which would sometimes increment to the same as the
mt7603 wifi chip.
Tested on Unielec u7621-01 model
Signed-off-by: David Bentham <db260179@gmail.com>
The hardware of Nokia A-040W-Q and RAISECOM MSG1500 X.00 are
exactly the same, both of which are customized by operators.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Endianness depends on CPU architecture. CONFIG_CPU_(BIG/LITTLE)_ENDIAN should
be enabled on target or subtarget based on SoC architecture.
Fixes warning:
$ make kernel_oldconfig CONFIG_TARGET=subtarget
...
.config:1008:warning: override: CPU_LITTLE_ENDIAN changes choice state
....
Summary:
- ARC - only the CONFIG_CPU_BIG_ENDIAN symbol is defined for this architeture.
If it is disabled then the processor operates in LITTLE_ENDIAN mode (default),
- ARM32 - CONFIG_CPU_LITTLE_ENDIAN symbol available since kernel 5.19. This
option should be enabled after OpenWRT moves to kernel 6.x. After refreshing
the kernel, the symbol disappears,
- ARM64 - enabled CONFIG_CPU_LITTLE_ENDIAN,
- MIPS - enabled relevant symbols,
- POWERPC - enabled CONFIG_CPU_BIG_ENDIAN,
- UML - Symbols are not defined for this architecture,
- X86 - always little endian. Symbols are not defined for this architecture.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
To use from the following devices in ath79 target, move edimax-header to
image-commands.mk.
- ELECOM WRC-300GHBK2-I
- ELECOM WRC-1750GHBK2-I/C
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
This fixes a well known "LZMA ERROR 1" error, reported previously on
numerous of similar devices.
Fixes: #10645
Signed-off-by: Petr Štetiar <ynezz@true.cz>
The device has only 1 WAN + 3 LAN ports. Remove "lan4" interface
corresponding to the non-existing port.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
At some point after 21.02.3 and before 22.03.0, the size limits of the
Linksys RE6500 were reached and prevent booting from the 22.03.0 release
or builds of current SNAPSHOT. This patch allows builds of master to boot
again and has been tested on my device.
Fixes: #8577
Signed-off-by: Mark King <mark@vemek.co>
Convert MAC address and label_mac configuration of Buffalo
WSR-1166DHP to use the generic function of OpenWrt.
Apply commit 770cfe9 for WCR-1166DS to WSR-1166DHP too.
Tested on the device and MAC address is kept before and after this
change.
Signed-off-by: Kazuhiro Ito <kzhr@d1.dion.ne.jp>
Change phy-mode of gmac1 to rgmii on mt7621.dtsi. Same code path is
followed for delayed rgmii and rgmii phy-mode on mtk_eth_soc.c.
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Add the missing LEDs for GB-PC2. Some of these LEDs don't exist on the
device schematics. Tests on a GB-PC2 by me and Petr proved otherwise.
Remove ethblack-green and ethblue-green LEDs for GB-PC1. They are not wired
to GPIO 3 or 4 and the wiring is currently unknown.
Set ethyellow-orange to display link state and activity of the ethyellow
interface for GB-PC2.
Link: https://github.com/ngiger/GnuBee_Docs/blob/master/GB-PCx/Documents/GB-PC2_V1.1_schematic.pdf
Tested-by: Petr Louda <petr.louda@outlook.cz>
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Otherwise kernel 5.15 will fail to build on subtargets except for mt7621
that has enabled the config.
The disabled PINCTRL_AW9523 config disappears after a refresh, it needs
to be added back manually.
Fixes: 675cf75578 ("ramips: add config-5.15 for mt7620 subtarget")
Fixes: 001176994a ("ramips: add config-5.15 for mt76x8 subtarget")
Fixes: b9d9f33c33 ("ramips: add config-5.15 for rt288x subtarget")
Fixes: 0164dc0c25 ("ramips: add config-5.15 for rt305x subtarget")
Fixes: ef59da8669 ("ramips: add config-5.15 for rt3883 subtarget")
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
When converting this device to use both GMACs, I mistakenly removed
state_default, which prevented GPIO LEDs and keys from being used.
Fixes: f4eef5f2a1 ("ramips: add support for Linksys E7350")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
When converting this device to use both GMACs, I mistakenly removed
state_default, which prevented GPIO LEDs and keys from being used.
Add back and and extra LEDs that were missing.
Tested all LEDs by turning them on.
Fixes: 26a6a6a60b ("ramips: add support for Belkin RT1800")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Serge Vasilugin reports:
To improve mt7620 built-in wifi performance some changes:
1. Correct BW20/BW40 switching (see comments with mark (1))
2. Correct TX_SW_CFG1 MAC reg from v3 of vendor driver see
https://gitlab.com/dm38/padavan-ng/-/blob/master/trunk/proprietary/rt_wifi/rtpci/3.0.X.X/mt76x2/chips/rt6352.c#L531
3. Set bbp66 for all chains.
4. US_CYC_CNT init based on Programming guide, default value was 33 (pci),
set chipset bus clock with fallback to cpu clock/3.
5. Don't overwrite default values for mt7620.
6. Correct some typos.
7. Add support for external LNA:
a) RF and BBP regs never be corrected for this mode
b) eLNA is driven the same way as ePA with mt7620's pin PA
but vendor driver explicitly pin PA to gpio mode (for forrect calibration?)
so I'm not sure that request for pa_pin in dts-file will be enough
First 5 changes (really 2) improve performance for boards w/o eLNA/ePA.
Changes 7 add support for eLNA
Configuration w/o eLAN/ePA and with eLNA show results
tx/rx (from router point of view) for each stream:
35-40/30-35 Mbps for HT20
65-70/60-65 Mbps for HT40
Yes. Max results for 2T2R client is 140-145/135-140
with peaks 160/150, It correspond to mediatek driver results.
Boards with ePA untested.
Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Specification:
SoC: RT5350
CPU Frequency: 360 MHz
Flash Chip: Macronix MX25L6406E (8192 KiB)
RAM: Winbond W9825G6JH-6 (32768 KiB)
3x 10/100 Mbps Ethernet (2x LAN, 1x WAN)
1x external antenna
UART (J1) header on PCB (57800 8n1)
Wireless: SoC-intergated: 2.4GHz 802.11bgn
USB: Yes
8x LED, 2x button
Flash instruction:
Configure PC with static IP 192.168.99.8/24 and start TFTP server.
Rename "openwrt-ramips-rt305x-zyxel_keenetic-4g-b-squashfs-sysupgrade.bin"
to "rt305x_firmware.bin" and place it in TFTP server directory.
Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed until power LED start blinking.
Router will download file from TFTP server, write it to flash and reboot.
Signed-off-by: Sergei Burakov <senior.anonymous@mail.ru>
Background radar detection is not supported on devices that
using MT7905, so disable this feature in the following devices:
asus,rt-ax53u
jcg,q20
tplink,eap615-wall-v1
xiaomi,mi-router-cr6606
xiaomi,mi-router-cr6608
xiaomi,mi-router-cr6609
yuncore,ax820
Devices with MT7915 lacking a DFS antenna also do not support
background DFS:
totolink,x5000r
cudy,x6
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Hardware
--------
- SoC: MediaTek MT7621AT with 128 MiB RAM and 32 MiB Flash
- Wi-Fi: MediaTek MT7603 (b/g/n, 2x2) and MediaTek MT7615 (ac, 4x4)
- Bluetooth: CSR8811 (internal USB, install kmod-bluetooth)
Installation
------------
1. Connect to the booted device at 192.168.1.20 using username/password
"ubnt".
2. Update the bootloader environment.
$ fw_setenv devmode TRUE
$ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr);
fdt rm /signature; bootubnt"
$ fw_setenv bootcmd "run boot_openwrt"
3. Transfer the OpenWrt sysupgrade image to the device using SCP.
4. Check the mtd partition number for bs / kernel0 / kernel1
$ cat /proc/mtd
5. Set the bootselect flag to boot from kernel0
$ dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock4
6. Write the OpenWrt sysupgrade image to both kernel0 as well as kernel1
$ dd if=openwrt.bin of=/dev/mtdblock6
$ dd if=openwrt.bin of=/dev/mtdblock7
7. Reboot the device. It should boot into OpenWrt.
Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
phy[01]radio leaves the leds always on, if they are set through sysfs the leds
get off.
Set the triggers to phy[01]tpt to make them work.
Signed-off-by: David Santamaría Rogado <howl.nsp@gmail.com>
Add Kernel config for testing Linux 5.15 for the rt305x subtarget.
Tested on ZyXEL NBG-419N, works but bad wireless performance.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
RT-N600 is internally the same as RT-AC1200, as veryfied by @russinnes .
Adding alt_name so that people can find it in firmware selector.
Signed-off-by: Ray Wang <raywang777@foxmail.com>
Tested-by: Russ Innes <russ.innes@gmail.com>
Aka Kroks Rt-Cse5 UW DRSIM (KNdRt31R16), ID 1958:
https://kroks.ru/search/?text=1958
See Kroks OpenWrt fork for support of other models:
https://github.com/kroks-free/openwrt
Device specs:
- CPU: MediaTek MT7628AN
- Flash: 16MB SPI NOR
- RAM: 64MB
- Bootloader: U-Boot
- Ethernet: 5x 10/100 Mbps
- 2.4 GHz: b/g/n SoC
- USB: 1x
- SIM-reader: 2x (driven by a dedicated chip with it's own firmware)
- Buttons: reset
- LEDs: 1x Power, 1x Wi-Fi, 12x others (SIM status, Internet, etc.)
Flashing:
- sysupgrade image via stock firmware WEB interface, IP: 192.168.1.254
- U-Boot launches a WEB server if Reset button is held during power up,
IP: 192.168.1.1
MAC addresses as verified by OEM firmware:
vendor OpenWrt source
LAN eth0 factory 0x4 (label)
2g wlan0 label
Signed-off-by: Andrey Butirsky <butirsky@gmail.com>
Aka "Kroks KNdRt31R19".
Ported from v19.07.8 of OpenWrt fork:
see https://github.com/kroks-free/openwrt
for support of other models.
Device specs:
- CPU: MediaTek MT7628AN
- Flash: 16MB SPI NOR
- RAM: 64MB
- Bootloader: U-Boot
- Ethernet: 1x 10/100 Mbps
- 2.4 GHz: b/g/n SoC
- mPCIe: 1x (usually equipped with an LTE modem by vendor)
- Buttons: reset
- LEDs: 1x Modem, 1x Injector, 1x Wi-Fi, 1x Status
Flashing:
- sysupgrade image via stock firmware WEB interface.
- U-Boot launches a WEB server if Reset button is held during power up.
Server IP: 192.168.1.1
SIM card switching:
The device supports up to 4 SIM cards - 2 locally on board and 2 on
remote SIM-injector.
By default, 1-st local SIM is active.
To switch to e.g. 1-st remote SIM:
echo 0 > /sys/class/gpio/modem1power/value
echo 0 > /sys/class/gpio/modem1sim1/value
echo 1 > /sys/class/gpio/modem1rsim1/value
echo 1 > /sys/class/gpio/modem1power/value
MAC addresses as verified by OEM firmware:
vendor OpenWrt source
LAN eth0 factory 0x4 (label)
2g wlan0 label
Signed-off-by: Kroks <dev@kroks.ru>
[butirsky@gmail.com: port to master; drop dts-v1]
Signed-off-by: Andrey Butirsky <butirsky@gmail.com>
Add Kernel config for testing Linux 5.15 for the mt7620 subtarget.
Tested on Youku YK-L1 which boots fine.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Backport generic phylink validate series and make use of it for
mtk_eth_soc Ethernet driver as well as mt7530 DSA driver.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This patch defines the two switch LED to bring them under user control.
Fixes: a0e1d3ab7b ("ramips: improve YunCore AX820 LEDs")
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
[rmilecki: leave "label"s in place]
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Mux the MT7530 switch's phy0/4 to the SoC's gmac1 on devices where RGMII2
pins are available. This achieves 2 Gbps total bandwidth to the CPU using
the second RGMII.
The ports called "wan" are muxed where possible. On a minority of devices,
this is not possible. Those cases:
mt7621_ampedwireless_ally-r1900k.dts: lan3
mt7621_ubnt_edgerouter-x.dts: eth0
mt7621_gnubee_gb-pc1.dts: ethblue
mt7621_linksys_re6500.dts: lan1
mt7621_netgear_wac104.dts: lan4
mt7621_tplink_eap235-wall-v1.dts: lan0
mt7621_tplink_eap615-wall-v1.dts: lan0
mt7621_ubnt_usw-flex.dts: lan1
The "wan" port is just what the vendor designated on the board/plastic
chasis of the device. On a technical level, there is no difference between
a lan and wan port on MT7621AT, MT7621DAT and MT7621ST SoCs. Prefer
connecting to WAN via the port described above for these devices to benefit
the feature brought with this patch.
mt7621_d-team_newifi-d2.dts cannot benefit this feature, although it looks
like it should, because the rgmii2 pins are wired to unused components.
Tested on a range of devices documented on the GitHub PR.
Link: https://github.com/openwrt/openwrt/pull/10238
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Remove DTS_LEGACY put for claiming pin groups for the ethernet node from
the ethernet node. It's not an old kernel trait. These bindings need to be
there on the newer kernels as well.
Fixes: a3764ee29d ("ramips: add linux 5.15 support for mt7621")
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
These devices do not use rgmii2 as gpio, therefore remove rgmii2 pin group
from state-default. Remove overwriting the ethernet node for these devices.
Move claiming the rgmii2 group from mt7621_zyxel_nwa-ax.dtsi to
mt7621_zyxel_nwa50ax.dts as it's only the latter using rgmii2 pins as gpio.
Remove duplicate ethernet overwrite from mt7621_tplink_archer-x6-v3.dtsi.
Claim rgmii2 group as gpio on mt7621_bolt_arion.dts as it uses an rgmii2
pin, 26, as gpio.
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Change switch port labels to ethblack & ethblue.
Change lan1 & lan2 LEDs to ethblack_act & ethblue_act and fix GPIO pins.
Add the external phy with ethyellow label on the GB-PC2 devicetree.
Do not claim rgmii2 as gpio, it's used for ethernet with rgmii2 function.
Enable ICPlus PHY driver for IP1001 which GB-PC2 has got.
Update interface name and change netdev function.
Enable lzma compression to make up for the increased size of the kernel.
Make spi flash bindings on par with mainline Linux to fix read errors.
Tested on GB-PC2 by Petr.
Tested-by: Petr Louda <petr.louda@outlook.cz>
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
This commit resolves#10062. Adds decryption of the Arcadyan WG4xx223
configuration partition (board_data)to get base MAC address from it.
As a result, after this change the hack with saving MAC addressees to
u-boot-env before installation of OpenWrt is no longer necessary.
This is necessary for the following devices:
- Beeline Smartbox Flash (Arcadyan WG443223)
- MTS WG430223 (Arcadyan WG430223)
Example:
+----------------+-------------------+------------------------+
| | MTS WG430223 | Beeline Smartbox Flash |
+----------------+-------------------+------------------------+
| base mac (mtd) | A4:xx:xx:51:xx:F4 | 30:xx:xx:51:xx:06 |
| label | A4:xx:xx:51:xx:F4 | 30:xx:xx:51:xx:09 |
| LAN | A4:xx:xx:51:xx:F6 | 30:xx:xx:51:xx:09 |
| WAN | A4:xx:xx:51:xx:F4 | 30:xx:xx:51:xx:06 |
| WLAN_2g | A4:xx:xx:51:xx:F5 | 30:xx:xx:51:xx:07 |
| WLAN_5g | A6:xx:xx:21:xx:F5 | 32:xx:xx:41:xx:07 |
+----------------+-------------------+------------------------+
Collected statistic shows that the 2-4th bits of the 7th byte of the
WLAN_5g MAC are the constant (see #10062 for more details):
- Beeline Smartbox Flash - 100
- MTS WG430223 - 010
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Beeline SmartBox TURBO is a wireless WiFi 5 router manufactured by
Sercomm company.
Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 256 MiB
Flash: 256 MiB, Micron MT29F2G08ABAGA3W
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7615E): a/n/ac, 4x4
Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4)
USB ports: 1xUSB3.0
Button: 2 buttons (Reset & WPS)
LEDs: 1 RGB LED
Power: 12 VDC, 1.5 A
Connector type: barrel
Bootloader: U-Boot
Installation
-----------------
1. Login to the router web interface (admin:admin)
2. Navigate to Settings -> WAN -> Add static IP interface (e.g.
10.0.0.1/255.255.255.0)
3. Navigate to Settings -> Remote cotrol -> Add SSH, port 22,
10.0.0.0/255.255.255.0 and interface created before
4. Change IP of your client to 10.0.0.2/255.255.255.0 and connect the
ethernet cable to the WAN port of the router
5. Connect to the router using SSH shell (SuperUser:SNxxxxxxxxxx, where
SNxxxxxxxxxx is the serial number from the backplate label)
6. Run in SSH shell:
sh
7. Make a mtd backup (optional, see related section)
8. Change bootflag to Sercomm1 and reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
reboot
9. Login to the router web interface (admin:admin)
10. Remove dots from the OpenWrt factory image filename
11. Update firmware via web using OpenWrt factory image
Revert to stock
---------------
1. Change bootflag to Sercomm1 in OpenWrt CLI and then reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
2. Optional: Update with any stock (Beeline) firmware if you want to
overwrite OpenWrt in Slot 0 completely.
mtd backup
----------
1. Set up a tftp server (e.g. tftpd64 for windows)
2. Connect to a router using SSH shell and run the following commands:
cd /tmp
for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \
tftp -l mtd$i -p 10.0.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done
tftp -l mtd.md5 -p 10.0.0.2
MAC Addresses
-------------
+-----+-----------+---------+
| use | address | example |
+-----+-----------+---------+
| LAN | label | *:54 |
| WAN | label + 1 | *:55 |
| 2g | label + 4 | *:58 |
| 5g | label + 5 | *:59 |
+-----+-----------+---------+
The label MAC address was found in Factory 0x21000
Co-developed-by: Maximilian Weinmann <x1@disroot.org>
Signed-off-by: Maximilian Weinmann <x1@disroot.org>
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
All targets expect the malta target already activate the CONFIG_GPIOLIB
option. Move it to generic kernel configuration and also activate it for
malta.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Musl libc does not support the non-POSIX "%F" format for strptime() so
replace all occurrences of it with an equivalent "%Y-%m-%d" format.
Fixes: #10419
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
The ZyXEL LTE3301-PLUS is an 4G indoor CPE with 2 external LTE antennas.
Specifications:
- SoC: MediaTek MT7621AT
- RAM: 256 MB
- Flash: 128 MB MB NAND (MX30LF1G18AC)
- WiFi: MediaTek MT7615E
- Switch: 4 LAN ports (Gigabit)
- LTE: Quectel EG506 connected by USB3 to SoC
- SIM: 1 micro-SIM slot
- USB: USB3 port
- Buttons: Reset, WPS
- LEDs: Multicolour power, internet, LTE, signal, Wifi, USB
- Power: 12V, 1.5A
The device is built as an indoor ethernet to LTE bridge or router with
Wifi.
UART Serial:
57600N1
Located on populated 5 pin header J5:
[o] GND
[ ] key - no pin
[o] RX
[o] TX
[o] 3.3V Vcc
MAC assignment:
lan: 98:0d:67:ee:85:54 (base, on the device back)
wlan: 98:0d:67:ee:85:55
Installation from web GUI:
- Log in as "admin" on http://192.168.1.1/
- Upload OpenWrt initramfs-recovery.bin image on the
Maintenance -> Firmware page
- Wait for OpenWrt to boot and ssh to root@192.168.1.1
- format ubi device: ubiformat /dev/mtd6
- attach ubi device: ubiattach -m6
- create rootfs volume: ubimkvol /dev/ubi0 -n0 -N rootfs -s 1MiB
- rootfs_data volume: ubimkvol /dev/ubi0 -n1 -N rootfs_data -s 1MiB
- run sysupgrade with sysupgrade image
For more details about flashing see
commit 2449a63208 ("ramips: mt7621: Add support for ZyXEL NR7101").
Please note that this commit is needed:
firmware-utils: add marcant changes for ZyXEL NBG6716 and LTE3301-PLUS
Signed-off-by: André Valentin <avalentin@marcant.net>
According to MediaTek MT7688 Datasheet v1.4, as well as the MT7628
counterpart, the memory controller reset bit (MC_RST) is 10, not 20.
Reset bit 20 is used for for UART 2 (UART2_RST).
Please note: Due to the lack of hardware, I was not able to test this
change.
Signed-off-by: Reto Schneider <reto.schneider@husqvarnagroup.com>
This patch adds support for Netcore NW5212, provided by some carrier in
China.
Specifications:
--------------
* SoC: Mediatek MT7620A
* RAM: 128MB DDR2
* Flash: 16MB SPI NOR flash (Winbond W25Q128BV)
* WiFi 2.4GHz: builtin
* Ethernet: builtin
* LED: Power, WAN, LAN 1-4, WiFi
* Buttons: Reset (GPIO 13)
* UART: Serial console (57600 8n1)
* USB: 1 x USB2
Installation:
------------
The router comes with OpenWrt 14.07 built with MTK SDK. However, as the
modem is provided by carriers, so the web interface is highly minimized and
only contains a static page with no interaction options.
There are two possible ways to gain the access.
1) Open the shell and use a UART2USB convert to gain TTY access. Please
notice you have to remove resistance R54 at the back of the board
otherwise you won't be able to input anything.
2) Use built-in backdoor. Access http://192.168.1.1/cgi-bin/_/testxst to
start dropbear service at port 9122. Be warned the software is super
old and only diffie-hellman-group1-sha1, diffie-hellman-group14-sha1,
kexguess2@matt.ucc.asn.au is support, you may not be able to connect it
with an up-to-date ssh client.
After you can control the device, flash the firmware as usual. Here are
some hints for that.
Option 1 (via original firmware):
1) Setup HTTP server on your computer, for example:
python3 -m http.server
2) Connect to the route and flash:
cd /tmp
wget http://<your-computer-host>/<your-firmware-name>
mtd -r write <your-firmware-name> firmware
Option 2 (replacing u-boot via breed):
1) Download breed-mt7620-reset13.bin from https://breed.hackpascal.net/
2) Setup HTTP server on your computer, for example:
python3 -m http.server
You can skip this step if your breed is already accessible from HTTP,
since the original wget does not support HTTPS.
3) Connect to the route and flash breed:
cd /tmp
wget http://<your-computer-host>/breed-mt7620-reset13.bin
mtd write breed-mt7620-reset13.bin Bootloader
4) Reboot. Hold reset key or press any key in TTY to enter breed.
5) Access breed web interface (http://192.168.1.1/). Choose the flash
layout to be 0x50000 and flash new firmware.
MAC addresses:
-------------
There are three MACs stored in factory, as in MT7620A reference design:
source address usage
0x4 label WLAN
0x28 label MAC 1
0x2e label + 1 MAC 2
However, the OEM firmware only uses one single MAC (label) for all
interfaces, probably a misconfiguration.
Signed-off-by: David Yang <mmyangfl@gmail.com>
This patch adds support for Netgear PR2000, sold as "Travel Router and
Range Extender".
Specifications:
--------------
* SoC: Mediatek MT7620N
* RAM: 64MB DDR2
* Flash: 16MB SPI NOR flash (Macronix MX25L12805D)
* WiFi 2.4GHz: builtin
* Ethernet: builtin
* LED: Power, Internet, WiFi, USB
* Buttons: Reset (GPIO 1/2)
* UART: Serial console (57600 8n1)
* USB: 1 x USB2
SPECIAL NOTES:
-------------
Problem: WiFi is super weak, but SSID beacons seems to be right.
Solve: Change 36h in factory partition (namely 0xf60036) to be 0x0.
Explain: Clearly Netgear have different ideas on how EEPROM is used. Bit 2
of 36h indicates the presence of External LNA for 11g (2.4 GHz) band,
which seems to be incorrectly set by Netgear (originally 0x04). Lifting it
solves the problem of weak RX signal.
Installation:
------------
There are two possible ways to install the firmware. Flashing via web
interface of original firmware is not tested due to a broken firmware.
1) Open the shell and use a UART2USB convert to gain TTY access (TP7: RXD,
TP9: TXD, TP10: GND). Please notice you have to remove resistance R54
next to TP7 otherwise you won't be able to input anything.
2) Use well-known Netgear debug switch. Access
http://192.168.168.1/setup.cgi?todo=debug to start telnet service
(username: root, password: <none>).
Please back up firmware if you want to go back to the original.
After you can control the device, flash the firmware as usual. Here are
some hints for that.
Option 1 (via nmrpflash):
1) Download nmrpflash from https://github.com/jclehner/nmrpflash
2) Use *-factory.img and flash:
nmrpflash -L
nmrpflash -i net* -f <your-firmware-name>
3) Turn off then turn on the device, wait it finishing flash.
Option 2 (replacing u-boot via breed):
1) Download breed-mt7620-reset1.bin from https://breed.hackpascal.net/
2) Setup HTTP server on your computer, for example:
python3 -m http.server
You can skip this step if your breed is already accessible from HTTP,
since the original wget does not support HTTPS.
3) Connect to the route and flash breed:
cd /tmp
wget http://<your-computer-host>/breed-mt7620-reset1.bin
dd if=breed-mt7620-reset1.bin of=/dev/mtdblock0 bs=64k
4) Reboot. Hold reset key or press any key in TTY to enter breed.
5) Access breed web interface (http://192.168.1.1/). Choose memory layout
to be 0x40000 and flash new firmware.
Remark:
------
As a "Range Extender", it has a switch to switch between Wired mode (GPIO
21 low) and Wireless mode (GPIO 20 low), which is not implemented in this
patch. However, the router will be turned off when it switches to the
middle, which makes this switch much less useful.
MAC addresses:
-------------
The OEM firmware uses one single MAC for all interfaces, located at
0xf700b0.
Signed-off-by: David Yang <mmyangfl@gmail.com>
Specifications:
CPU: MT7621A dual-core 880MHz
RAM: 64MB DDR2
FLASH: 16MB MX25L12805D NOR SPI
WIFI: 2.4GHz 2x2 MT7603 b/g/n PCI
WIFI: 5GHz 2x2 MT7662 a/b/ac PCI
ETH: 1xLAN 1000base-T integrated
SWITCH: MT7530 Port 0: LAN, Port 6: CPU
LED: Power, 2.4GHz WiFi, 5GHz WiFi
BTN: WPS, Reset
UART: Near ETH port, from ETH: 3V3-TxD-GND-RxD 57600 8n1
MISC: Audio support
Installation:
1. Update using recovery mode
- while holdig "reset" button, power on the device
- keep holding "reset" until power led is flashing yellow
- set own IP to 192.168.1.75, subnet mask: 255.255.255.0
- push firmware image (can be factory.bin or sysupgrade.bin)
using tftp client in binary mode to 192.168.1.1
Notes:
This board has only two MAC addresses programmed in the "factory" partition:
- MAC for wlan0 (2.4GHz) at offset 0x0004
- MAC for wlan1 (5GHz) at offset 0x8004
- stock firmware re-uses wlan0 MAC for ethernet
- no valid addresses found in 0x28, 0x2e, 0xe000 and 0xe006
Signed-off-by: Lea Teuberth <lea.teuberth@outlook.com>
H3C TX180x series WiFi6 routers are customized by different carrier.
While these three devices look different, they use the same motherboard
inside. Another minor difference comes from the model name definition
in the u-boot environment variable.
Specifications:
SOC: MT7621 + MT7915
ROM: 128 MiB
RAM: 256 MiB
LED: status *2
Button: reset *1 + wps/mesh *1
Ethernet: lan *3 + wan *1 (10/100/1000Mbps)
TTL Baudrate: 115200
TFTP server IP: 192.168.124.99
MAC Address:
use address(sample 1) address(sample 2) source
label 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 u-boot-env@ethaddr
lan 88:xx:xx:98:xx:13 88:xx:xx:a2:xx:a6 $label +1
wan 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 $label
WiFi4_2G 8a:xx:xx:58:xx:14 8a:xx:xx:52:xx:a7 (Compatibility mode)
WiFi5_5G 8a:xx:xx:b8:xx:14 8a:xx:xx:b2:xx:a7 (Compatibility mode)
WiFi6_2G 8a:xx:xx:18:xx:14 8a:xx:xx:12:xx:a7
WiFi6_5G 8a:xx:xx:78:xx:14 8a:xx:xx:72:xx:a7
Compatibility mode is used to guarantee the connection of old devices
that only support WiFi4 or WiFi5.
TFTP + TTL Installation:
Although a TTL connection is required for installation, we do not need
to tear down it. We can find the TTL port from the cooling hole at the
bottom. It is located below LAN3 and the pins are defined as follows:
|LAN1|LAN2|LAN3|----|WAN|
--------------------
|GND|TX|RX|VCC|
1. Set tftp server IP to 192.168.124.99 and put initramfs firmware in
server's root directory, rename it to a simple name "initramfs.bin".
2. Plug in the power supply and wait for power on, connect the TTL cable
and open a TTL session, enter "reboot", then enter "Y" to confirm.
Finally push "0" to interruput boot while booting.
3. Execute command to install a initramfs system:
# tftp 0x80010000 192.168.124.99:initramfs.bin
# bootm 0x80010000
4. Backup nand flash by OpenWrt LuCI or dd instruction. We need those
partitions if we want to back to stock firmwre due to official
website does not provide download link.
# dd if=/dev/mtd1 of=/tmp/u-boot-env.bin
# dd if=/dev/mtd4 of=/tmp/firmware.bin
5. Edit u-boot env to ensure use default bootargs and first image slot:
# fw_setenv bootargs
# fw_setenv bootflag 0
6. Upgrade sysupgrade firmware.
7. About restore stock firmware: flash the "firmware" and "u-boot-env"
partitions that we backed up in step 4.
# mtd write /tmp/u-boot-env.bin u-boot-env
# mtd write /tmp/firmware.bin firmware
Additional Info:
The H3C stock firmware has a 160-byte firmware header that appears to
use a non-standard CRC32 verification algorithm. For this part of the
data, the u-boot does not check it so we can just directly replace it
with a placeholder.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Hardware
--------
CPU: Mediatek MT7621
RAM: 256M DDR3
FLASH: 128M NAND
ETH: 1x Gigabit Ethernet
WiFi: Mediatek MT7915 (2.4/5GHz 802.11ax 2x2 DBDC)
BTN: 1x Reset (NWA50AX only)
LED: 1x Multi-Color (NWA50AX only)
UART Console
------------
NWA50AX:
Available below the rubber cover next to the ethernet port.
NWA55AXE:
Available on the board when disassembling the device.
Settings: 115200 8N1
Layout:
<12V> <LAN> GND-RX-TX-VCC
Logic-Level is 3V3. Don't connect VCC to your UART adapter!
Installation Web-UI
-------------------
Upload the Factory image using the devices Web-Interface.
As the device uses a dual-image partition layout, OpenWrt can only
installed on Slot A. This requires the current active image prior
flashing the device to be on Slot B.
If the currently installed image is started from Slot A, the device will
flash OpenWrt to Slot B. OpenWrt will panic upon first boot in this case
and the device will return to the ZyXEL firmware upon next boot.
If this happens, first install a ZyXEL firmware upgrade of any version
and install OpenWrt after that.
Installation TFTP
-----------------
This installation routine is especially useful in case
* unknown device password (NWA55AXE lacks reset button)
* bricked device
Attach to the UART console header of the device. Interrupt the boot
procedure by pressing Enter.
The bootloader has a reduced command-set available from CLI, but more
commands can be executed by abusing the atns command.
Boot a OpenWrt initramfs image available on a TFTP server at
192.168.1.66. Rename the image to owrt.bin
$ atnf owrt.bin
$ atna 192.168.1.88
$ atns "192.168.1.66; tftpboot; bootm"
Upon booting, set the booted image to the correct slot:
$ zyxel-bootconfig /dev/mtd10 get-status
$ zyxel-bootconfig /dev/mtd10 set-image-status 0 valid
$ zyxel-bootconfig /dev/mtd10 set-active-image 0
Copy the OpenWrt ramboot-factory image to the device using scp.
Write the factory image to NAND and reboot the device.
$ mtd write ramboot-factory.bin firmware
$ reboot
Signed-off-by: David Bauer <mail@david-bauer.net>
Netgear WAX202 is an 802.11ax (Wi-Fi 6) router.
Specifications:
* SoC: MT7621A
* RAM: 512 MiB NT5CC256M16ER-EK
* Flash: NAND 128 MiB F59L1G81MB-25T
* Wi-Fi:
* MT7915D: 2.4/5 GHz (DBDC)
* Ethernet: 4x 1GbE
* Switch: SoC built-in
* USB: None
* UART: 115200 baud (labeled on board)
Load addresses (same as ipTIME AX2004M):
* stock
* 0x80010000: FIT image
* 0x81001000: kernel image -> entry
* OpenWrt
* 0x80010000: FIT image
* 0x82000000: uncompressed kernel+relocate image
* 0x80001000: relocated kernel image -> entry
Installation:
* Flash the factory image through the stock web interface, or TFTP to
the bootloader. NMRP can be used to TFTP without opening the case.
* Note that the bootloader accepts both encrypted and unencrypted
images, while the stock web interface only accepts encrypted ones.
Revert to stock firmware:
* Flash the stock firmware to the bootloader using TFTP/NMRP.
References in WAX202 GPL source:
https://www.downloads.netgear.com/files/GPL/WAX202_V1.0.5.1_Source.rar
* openwrt/target/linux/ramips/dts/mt7621-ax-nand-wax202.dts
DTS file for this device.
Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
The international version of Mi Router 4A 100M is physically
identical to the non-international one, but appears to be
using a different partitioning scheme with the "overlay"
partition being 2MiB in size instead of 1MiB. This means
the following "firmware" partition starts at a different
address and the DTS needs to be adjusted for the firmware
to work.
Signed-off-by: Nita Vesa <werecatf@outlook.com>
Specifications:
Chipset:MT7628DA+MT7612E
Antenna : 2.4Ghz:2x5dbi Antenna + 5.8Ghz:2x5dbi Antenna
Wireless Rate:2.4Ghz 300Mbps , 5.8Ghz 867Mbps
Output Power :100mW(20dbm)
Physical port:110/100Mbps RJ45 WAN Port , 310/100Mbps RJ45 LAN Port
Flash: 8Mb
DRam: 64Mb
Flashing: default bootloader attempts to boot from tftp://192.168.1.10/firmware_auto.bin using 192.168.1.1
Known issues:
mac-address-increment for 5GHZ doesnt work, i failed to figure out why. Original firmware using +1 from original value in factory partition.
Signed-off-by: Sergei Iudin <tsipa740@gmail.com>
Beeline SmartBox GIGA is a wireless WiFi 5 router manufactured by
Sercomm company.
Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 256 MiB, Nanya NT5CC128M16JR-EK
Flash: 128 MiB, Macronix MX30LF1G18AC
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7613BE): a/n/ac, 2x2
Ethernet: 3 ports - 2xGbE (WAN, LAN1), 1xFE (LAN2)
USB ports: 1xUSB3.0
Button: 1 button (Reset/WPS)
PCB ID: DBE00B-1.6MM
LEDs: 1 RGB LED
Power: 12 VDC, 1.5 A
Connector type: barrel
Bootloader: U-Boot
Installation
-----------------
1. Downgrade stock (Beeline) firmware to v.1.0.02;
2. Give factory OpenWrt image a shorter name, e.g. 1001.img;
3. Upload and update the firmware via the original web interface.
Remark: You might need make the 3rd step twice if your running firmware
is booted from the Slot 1 (Sercomm0 bootflag). The stock firmware
reverses the bootflag (Sercomm0 / Sercomm1) on each firmware update.
Revert to stock
---------------
1. Change the bootflag to Sercomm1 in OpenWrt CLI and then reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
2. Optional: Update with any stock (Beeline) firmware if you want to
overwrite OpenWrt in Slot 0 completely.
MAC Addresses
-------------
+-----+-----------+---------+
| use | address | example |
+-----+-----------+---------+
| LAN | label | *:16 |
| WAN | label + 1 | *:17 |
| 2g | label + 4 | *:1a |
| 5g | label + 5 | *:1b |
+-----+-----------+---------+
The label MAC address was found in Factory 0x21000
Notes
-----
1. The following scripts are required for the build:
sercomm-crypto.py - already exists in OpenWrt
sercomm-partition-tag.py - already exists in OpenWrt
sercomm-payload.py - already exists in OpenWrt
sercomm-pid.py - new, the part of this pull request
sercomm-kernel-header.py - new, the part of this pull request
2. This device (same as other Sercomm S2,S3-based devices) requires
special LZMA and LOADADDR settings for successful boot:
LZMA_TEXT_START=0x82800000
KERNEL_LOADADDR=0x81001000
LOADADDR=0x80001000
3. This device (same as several other Sercomm-based devices - Beeline,
Netgear, Etisalat, Rostelecom) has partition map (mtd1) containing
real partition offsets, which may differ from device to device
depending on the number and location of bad blocks on NAND.
"fixed-partitions" is used if the partition map is not found or
corrupted. This behavour (it's the same as on stock firmware) is
provided by MTD_SERCOMM_PARTS module.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
At least two AX820 hardware variants are known to exist, but they cannot
be distinguished (same hardware revision, no specific markings).
They appear to have the same LED hardware, but wired differently:
- One has a red system LED at GPIO 15, a green wlan2g LED at GPIO 14 and
a blue wlan5g LED at GPIO 16;
- The other only offers a green system LED at GPIO 15, with GPIO 14 and
16 being apparently not connected
Finally, a Yuncore datasheet says the canonical wiring should be:
- Blue wlan2g GPIO 14, green system GPIO 15, red wlan5g GPIO 16
All GPIOs are tied to a single RGB LED which is exposed via lightpipe on
the device front casing.
Considering the above, this patch exposes all three LEDs, preserves the
common system LED (GPIO 15) as the openwrt status LED, and removes the
color information from the LEDs names since it is not consistent across
hardware. The LED naming is made consistent with other YunCore devices.
A note is added in DTS to ensure this information is always available
and prevent unwanted changes in the future.
Fixes: #10131 "YunCore AX820: GPIO LED not correct"
Reviewed-by: Sander Vanheule <sander@svanheule.net>
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
Since 4e0c54bc5b ("kernel: add support for kernel 5.4"),
the spi-nor limit 4k erasesize to spi-nor chips below a configured size
patch has not functioned as intended.
For uniform erasesize SPI-NOR devices, both
nor->erase_opcode & mtd->erasesize are used in erase operations.
These are set before, and not modified by, this
CONFIG_MTD_SPI_NOR_USE_4K_SECTORS_LIMIT patch.
Thus, an SPI-NOR device with CONFIG_MTD_SPI_NOR_USE_4K_SECTORS will
always use 4k erasesize (where the device supports it).
If this patch was fixed to function as intended, there would be
cases where devices change from a 4K to a 64K erasesize.
Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au>
Asus RP-AC87 ac2600 Repeater
2.4GHz 800Mbps
5GHz 1733Mbps
Hardware specifications:
SoC: MT7621A 2 cores 4 threads @880MHz
WiFi2G: MT7615E 2G 4x4 b/g/n
Wifi5G: MT7615E 5G 4x4 n/ac
DRAM: 128MB DDR3 @1200mhz
Flash: 16MB MX25L12805D SPI-NOR
LAN/WAN: MT7530 1x1000M
MAC addresses as verified by OEM firmware:
use address source
Lan/W5G *:B0 factory 0x8004 (label)
W2G *:B4 factory 0x0
Installation:
Asus windows recovery tool:
install the Asus firmware restoration utility
unplug the router, hold the reset button while powering it on
release when the power LED flashes slowly
specify a static IP on your computer:
IP address: 192.168.1.75
Subnet mask 255.255.255.0
Start the Asus firmware restoration utility, specify the factory image
and press upload
Do not power off the device after OpenWrt has booted until the LED flashing.
TFTP Recovery method:
set computer to a static ip, 192.168.1.2
connect computer to the LAN 1 port of the router
hold the reset button while powering on the router for a few seconds
send firmware image using a tftp client; i.e from linux:
$ tftp
tftp> binary
tftp> connect 192.168.1.1
tftp> put factory.bin
tftp> quit
Signed-off-by: Tamas Balogh <tamasbalogh@hotmail.com>
