Specification:
SoC: RT5350
CPU Frequency: 360 MHz
Flash Chip: Macronix MX25L6406E (8192 KiB)
RAM: Winbond W9825G6JH-6 (32768 KiB)
3x 10/100 Mbps Ethernet (2x LAN, 1x WAN)
1x external antenna
UART (J1) header on PCB (57800 8n1)
Wireless: SoC-intergated: 2.4GHz 802.11bgn
USB: Yes
8x LED, 2x button
Flash instruction:
Configure PC with static IP 192.168.99.8/24 and start TFTP server.
Rename "openwrt-ramips-rt305x-zyxel_keenetic-4g-b-squashfs-sysupgrade.bin"
to "rt305x_firmware.bin" and place it in TFTP server directory.
Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed until power LED start blinking.
Router will download file from TFTP server, write it to flash and reboot.
Signed-off-by: Sergei Burakov <senior.anonymous@mail.ru>
Hardware
--------
- SoC: MediaTek MT7621AT with 128 MiB RAM and 32 MiB Flash
- Wi-Fi: MediaTek MT7603 (b/g/n, 2x2) and MediaTek MT7615 (ac, 4x4)
- Bluetooth: CSR8811 (internal USB, install kmod-bluetooth)
Installation
------------
1. Connect to the booted device at 192.168.1.20 using username/password
"ubnt".
2. Update the bootloader environment.
$ fw_setenv devmode TRUE
$ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr);
fdt rm /signature; bootubnt"
$ fw_setenv bootcmd "run boot_openwrt"
3. Transfer the OpenWrt sysupgrade image to the device using SCP.
4. Check the mtd partition number for bs / kernel0 / kernel1
$ cat /proc/mtd
5. Set the bootselect flag to boot from kernel0
$ dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock4
6. Write the OpenWrt sysupgrade image to both kernel0 as well as kernel1
$ dd if=openwrt.bin of=/dev/mtdblock6
$ dd if=openwrt.bin of=/dev/mtdblock7
7. Reboot the device. It should boot into OpenWrt.
Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
RT-N600 is internally the same as RT-AC1200, as veryfied by @russinnes .
Adding alt_name so that people can find it in firmware selector.
Signed-off-by: Ray Wang <raywang777@foxmail.com>
Tested-by: Russ Innes <russ.innes@gmail.com>
Aka Kroks Rt-Cse5 UW DRSIM (KNdRt31R16), ID 1958:
https://kroks.ru/search/?text=1958
See Kroks OpenWrt fork for support of other models:
https://github.com/kroks-free/openwrt
Device specs:
- CPU: MediaTek MT7628AN
- Flash: 16MB SPI NOR
- RAM: 64MB
- Bootloader: U-Boot
- Ethernet: 5x 10/100 Mbps
- 2.4 GHz: b/g/n SoC
- USB: 1x
- SIM-reader: 2x (driven by a dedicated chip with it's own firmware)
- Buttons: reset
- LEDs: 1x Power, 1x Wi-Fi, 12x others (SIM status, Internet, etc.)
Flashing:
- sysupgrade image via stock firmware WEB interface, IP: 192.168.1.254
- U-Boot launches a WEB server if Reset button is held during power up,
IP: 192.168.1.1
MAC addresses as verified by OEM firmware:
vendor OpenWrt source
LAN eth0 factory 0x4 (label)
2g wlan0 label
Signed-off-by: Andrey Butirsky <butirsky@gmail.com>
Aka "Kroks KNdRt31R19".
Ported from v19.07.8 of OpenWrt fork:
see https://github.com/kroks-free/openwrt
for support of other models.
Device specs:
- CPU: MediaTek MT7628AN
- Flash: 16MB SPI NOR
- RAM: 64MB
- Bootloader: U-Boot
- Ethernet: 1x 10/100 Mbps
- 2.4 GHz: b/g/n SoC
- mPCIe: 1x (usually equipped with an LTE modem by vendor)
- Buttons: reset
- LEDs: 1x Modem, 1x Injector, 1x Wi-Fi, 1x Status
Flashing:
- sysupgrade image via stock firmware WEB interface.
- U-Boot launches a WEB server if Reset button is held during power up.
Server IP: 192.168.1.1
SIM card switching:
The device supports up to 4 SIM cards - 2 locally on board and 2 on
remote SIM-injector.
By default, 1-st local SIM is active.
To switch to e.g. 1-st remote SIM:
echo 0 > /sys/class/gpio/modem1power/value
echo 0 > /sys/class/gpio/modem1sim1/value
echo 1 > /sys/class/gpio/modem1rsim1/value
echo 1 > /sys/class/gpio/modem1power/value
MAC addresses as verified by OEM firmware:
vendor OpenWrt source
LAN eth0 factory 0x4 (label)
2g wlan0 label
Signed-off-by: Kroks <dev@kroks.ru>
[butirsky@gmail.com: port to master; drop dts-v1]
Signed-off-by: Andrey Butirsky <butirsky@gmail.com>
Change switch port labels to ethblack & ethblue.
Change lan1 & lan2 LEDs to ethblack_act & ethblue_act and fix GPIO pins.
Add the external phy with ethyellow label on the GB-PC2 devicetree.
Do not claim rgmii2 as gpio, it's used for ethernet with rgmii2 function.
Enable ICPlus PHY driver for IP1001 which GB-PC2 has got.
Update interface name and change netdev function.
Enable lzma compression to make up for the increased size of the kernel.
Make spi flash bindings on par with mainline Linux to fix read errors.
Tested on GB-PC2 by Petr.
Tested-by: Petr Louda <petr.louda@outlook.cz>
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
This commit resolves#10062. Adds decryption of the Arcadyan WG4xx223
configuration partition (board_data)to get base MAC address from it.
As a result, after this change the hack with saving MAC addressees to
u-boot-env before installation of OpenWrt is no longer necessary.
This is necessary for the following devices:
- Beeline Smartbox Flash (Arcadyan WG443223)
- MTS WG430223 (Arcadyan WG430223)
Example:
+----------------+-------------------+------------------------+
| | MTS WG430223 | Beeline Smartbox Flash |
+----------------+-------------------+------------------------+
| base mac (mtd) | A4:xx:xx:51:xx:F4 | 30:xx:xx:51:xx:06 |
| label | A4:xx:xx:51:xx:F4 | 30:xx:xx:51:xx:09 |
| LAN | A4:xx:xx:51:xx:F6 | 30:xx:xx:51:xx:09 |
| WAN | A4:xx:xx:51:xx:F4 | 30:xx:xx:51:xx:06 |
| WLAN_2g | A4:xx:xx:51:xx:F5 | 30:xx:xx:51:xx:07 |
| WLAN_5g | A6:xx:xx:21:xx:F5 | 32:xx:xx:41:xx:07 |
+----------------+-------------------+------------------------+
Collected statistic shows that the 2-4th bits of the 7th byte of the
WLAN_5g MAC are the constant (see #10062 for more details):
- Beeline Smartbox Flash - 100
- MTS WG430223 - 010
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Beeline SmartBox TURBO is a wireless WiFi 5 router manufactured by
Sercomm company.
Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 256 MiB
Flash: 256 MiB, Micron MT29F2G08ABAGA3W
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7615E): a/n/ac, 4x4
Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4)
USB ports: 1xUSB3.0
Button: 2 buttons (Reset & WPS)
LEDs: 1 RGB LED
Power: 12 VDC, 1.5 A
Connector type: barrel
Bootloader: U-Boot
Installation
-----------------
1. Login to the router web interface (admin:admin)
2. Navigate to Settings -> WAN -> Add static IP interface (e.g.
10.0.0.1/255.255.255.0)
3. Navigate to Settings -> Remote cotrol -> Add SSH, port 22,
10.0.0.0/255.255.255.0 and interface created before
4. Change IP of your client to 10.0.0.2/255.255.255.0 and connect the
ethernet cable to the WAN port of the router
5. Connect to the router using SSH shell (SuperUser:SNxxxxxxxxxx, where
SNxxxxxxxxxx is the serial number from the backplate label)
6. Run in SSH shell:
sh
7. Make a mtd backup (optional, see related section)
8. Change bootflag to Sercomm1 and reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
reboot
9. Login to the router web interface (admin:admin)
10. Remove dots from the OpenWrt factory image filename
11. Update firmware via web using OpenWrt factory image
Revert to stock
---------------
1. Change bootflag to Sercomm1 in OpenWrt CLI and then reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
2. Optional: Update with any stock (Beeline) firmware if you want to
overwrite OpenWrt in Slot 0 completely.
mtd backup
----------
1. Set up a tftp server (e.g. tftpd64 for windows)
2. Connect to a router using SSH shell and run the following commands:
cd /tmp
for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \
tftp -l mtd$i -p 10.0.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done
tftp -l mtd.md5 -p 10.0.0.2
MAC Addresses
-------------
+-----+-----------+---------+
| use | address | example |
+-----+-----------+---------+
| LAN | label | *:54 |
| WAN | label + 1 | *:55 |
| 2g | label + 4 | *:58 |
| 5g | label + 5 | *:59 |
+-----+-----------+---------+
The label MAC address was found in Factory 0x21000
Co-developed-by: Maximilian Weinmann <x1@disroot.org>
Signed-off-by: Maximilian Weinmann <x1@disroot.org>
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
The ZyXEL LTE3301-PLUS is an 4G indoor CPE with 2 external LTE antennas.
Specifications:
- SoC: MediaTek MT7621AT
- RAM: 256 MB
- Flash: 128 MB MB NAND (MX30LF1G18AC)
- WiFi: MediaTek MT7615E
- Switch: 4 LAN ports (Gigabit)
- LTE: Quectel EG506 connected by USB3 to SoC
- SIM: 1 micro-SIM slot
- USB: USB3 port
- Buttons: Reset, WPS
- LEDs: Multicolour power, internet, LTE, signal, Wifi, USB
- Power: 12V, 1.5A
The device is built as an indoor ethernet to LTE bridge or router with
Wifi.
UART Serial:
57600N1
Located on populated 5 pin header J5:
[o] GND
[ ] key - no pin
[o] RX
[o] TX
[o] 3.3V Vcc
MAC assignment:
lan: 98:0d:67:ee:85:54 (base, on the device back)
wlan: 98:0d:67:ee:85:55
Installation from web GUI:
- Log in as "admin" on http://192.168.1.1/
- Upload OpenWrt initramfs-recovery.bin image on the
Maintenance -> Firmware page
- Wait for OpenWrt to boot and ssh to root@192.168.1.1
- format ubi device: ubiformat /dev/mtd6
- attach ubi device: ubiattach -m6
- create rootfs volume: ubimkvol /dev/ubi0 -n0 -N rootfs -s 1MiB
- rootfs_data volume: ubimkvol /dev/ubi0 -n1 -N rootfs_data -s 1MiB
- run sysupgrade with sysupgrade image
For more details about flashing see
commit 2449a63208 ("ramips: mt7621: Add support for ZyXEL NR7101").
Please note that this commit is needed:
firmware-utils: add marcant changes for ZyXEL NBG6716 and LTE3301-PLUS
Signed-off-by: André Valentin <avalentin@marcant.net>
This patch adds support for Netcore NW5212, provided by some carrier in
China.
Specifications:
--------------
* SoC: Mediatek MT7620A
* RAM: 128MB DDR2
* Flash: 16MB SPI NOR flash (Winbond W25Q128BV)
* WiFi 2.4GHz: builtin
* Ethernet: builtin
* LED: Power, WAN, LAN 1-4, WiFi
* Buttons: Reset (GPIO 13)
* UART: Serial console (57600 8n1)
* USB: 1 x USB2
Installation:
------------
The router comes with OpenWrt 14.07 built with MTK SDK. However, as the
modem is provided by carriers, so the web interface is highly minimized and
only contains a static page with no interaction options.
There are two possible ways to gain the access.
1) Open the shell and use a UART2USB convert to gain TTY access. Please
notice you have to remove resistance R54 at the back of the board
otherwise you won't be able to input anything.
2) Use built-in backdoor. Access http://192.168.1.1/cgi-bin/_/testxst to
start dropbear service at port 9122. Be warned the software is super
old and only diffie-hellman-group1-sha1, diffie-hellman-group14-sha1,
kexguess2@matt.ucc.asn.au is support, you may not be able to connect it
with an up-to-date ssh client.
After you can control the device, flash the firmware as usual. Here are
some hints for that.
Option 1 (via original firmware):
1) Setup HTTP server on your computer, for example:
python3 -m http.server
2) Connect to the route and flash:
cd /tmp
wget http://<your-computer-host>/<your-firmware-name>
mtd -r write <your-firmware-name> firmware
Option 2 (replacing u-boot via breed):
1) Download breed-mt7620-reset13.bin from https://breed.hackpascal.net/
2) Setup HTTP server on your computer, for example:
python3 -m http.server
You can skip this step if your breed is already accessible from HTTP,
since the original wget does not support HTTPS.
3) Connect to the route and flash breed:
cd /tmp
wget http://<your-computer-host>/breed-mt7620-reset13.bin
mtd write breed-mt7620-reset13.bin Bootloader
4) Reboot. Hold reset key or press any key in TTY to enter breed.
5) Access breed web interface (http://192.168.1.1/). Choose the flash
layout to be 0x50000 and flash new firmware.
MAC addresses:
-------------
There are three MACs stored in factory, as in MT7620A reference design:
source address usage
0x4 label WLAN
0x28 label MAC 1
0x2e label + 1 MAC 2
However, the OEM firmware only uses one single MAC (label) for all
interfaces, probably a misconfiguration.
Signed-off-by: David Yang <mmyangfl@gmail.com>
This patch adds support for Netgear PR2000, sold as "Travel Router and
Range Extender".
Specifications:
--------------
* SoC: Mediatek MT7620N
* RAM: 64MB DDR2
* Flash: 16MB SPI NOR flash (Macronix MX25L12805D)
* WiFi 2.4GHz: builtin
* Ethernet: builtin
* LED: Power, Internet, WiFi, USB
* Buttons: Reset (GPIO 1/2)
* UART: Serial console (57600 8n1)
* USB: 1 x USB2
SPECIAL NOTES:
-------------
Problem: WiFi is super weak, but SSID beacons seems to be right.
Solve: Change 36h in factory partition (namely 0xf60036) to be 0x0.
Explain: Clearly Netgear have different ideas on how EEPROM is used. Bit 2
of 36h indicates the presence of External LNA for 11g (2.4 GHz) band,
which seems to be incorrectly set by Netgear (originally 0x04). Lifting it
solves the problem of weak RX signal.
Installation:
------------
There are two possible ways to install the firmware. Flashing via web
interface of original firmware is not tested due to a broken firmware.
1) Open the shell and use a UART2USB convert to gain TTY access (TP7: RXD,
TP9: TXD, TP10: GND). Please notice you have to remove resistance R54
next to TP7 otherwise you won't be able to input anything.
2) Use well-known Netgear debug switch. Access
http://192.168.168.1/setup.cgi?todo=debug to start telnet service
(username: root, password: <none>).
Please back up firmware if you want to go back to the original.
After you can control the device, flash the firmware as usual. Here are
some hints for that.
Option 1 (via nmrpflash):
1) Download nmrpflash from https://github.com/jclehner/nmrpflash
2) Use *-factory.img and flash:
nmrpflash -L
nmrpflash -i net* -f <your-firmware-name>
3) Turn off then turn on the device, wait it finishing flash.
Option 2 (replacing u-boot via breed):
1) Download breed-mt7620-reset1.bin from https://breed.hackpascal.net/
2) Setup HTTP server on your computer, for example:
python3 -m http.server
You can skip this step if your breed is already accessible from HTTP,
since the original wget does not support HTTPS.
3) Connect to the route and flash breed:
cd /tmp
wget http://<your-computer-host>/breed-mt7620-reset1.bin
dd if=breed-mt7620-reset1.bin of=/dev/mtdblock0 bs=64k
4) Reboot. Hold reset key or press any key in TTY to enter breed.
5) Access breed web interface (http://192.168.1.1/). Choose memory layout
to be 0x40000 and flash new firmware.
Remark:
------
As a "Range Extender", it has a switch to switch between Wired mode (GPIO
21 low) and Wireless mode (GPIO 20 low), which is not implemented in this
patch. However, the router will be turned off when it switches to the
middle, which makes this switch much less useful.
MAC addresses:
-------------
The OEM firmware uses one single MAC for all interfaces, located at
0xf700b0.
Signed-off-by: David Yang <mmyangfl@gmail.com>
Specifications:
CPU: MT7621A dual-core 880MHz
RAM: 64MB DDR2
FLASH: 16MB MX25L12805D NOR SPI
WIFI: 2.4GHz 2x2 MT7603 b/g/n PCI
WIFI: 5GHz 2x2 MT7662 a/b/ac PCI
ETH: 1xLAN 1000base-T integrated
SWITCH: MT7530 Port 0: LAN, Port 6: CPU
LED: Power, 2.4GHz WiFi, 5GHz WiFi
BTN: WPS, Reset
UART: Near ETH port, from ETH: 3V3-TxD-GND-RxD 57600 8n1
MISC: Audio support
Installation:
1. Update using recovery mode
- while holdig "reset" button, power on the device
- keep holding "reset" until power led is flashing yellow
- set own IP to 192.168.1.75, subnet mask: 255.255.255.0
- push firmware image (can be factory.bin or sysupgrade.bin)
using tftp client in binary mode to 192.168.1.1
Notes:
This board has only two MAC addresses programmed in the "factory" partition:
- MAC for wlan0 (2.4GHz) at offset 0x0004
- MAC for wlan1 (5GHz) at offset 0x8004
- stock firmware re-uses wlan0 MAC for ethernet
- no valid addresses found in 0x28, 0x2e, 0xe000 and 0xe006
Signed-off-by: Lea Teuberth <lea.teuberth@outlook.com>
H3C TX180x series WiFi6 routers are customized by different carrier.
While these three devices look different, they use the same motherboard
inside. Another minor difference comes from the model name definition
in the u-boot environment variable.
Specifications:
SOC: MT7621 + MT7915
ROM: 128 MiB
RAM: 256 MiB
LED: status *2
Button: reset *1 + wps/mesh *1
Ethernet: lan *3 + wan *1 (10/100/1000Mbps)
TTL Baudrate: 115200
TFTP server IP: 192.168.124.99
MAC Address:
use address(sample 1) address(sample 2) source
label 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 u-boot-env@ethaddr
lan 88:xx:xx:98:xx:13 88:xx:xx:a2:xx:a6 $label +1
wan 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 $label
WiFi4_2G 8a:xx:xx:58:xx:14 8a:xx:xx:52:xx:a7 (Compatibility mode)
WiFi5_5G 8a:xx:xx:b8:xx:14 8a:xx:xx:b2:xx:a7 (Compatibility mode)
WiFi6_2G 8a:xx:xx:18:xx:14 8a:xx:xx:12:xx:a7
WiFi6_5G 8a:xx:xx:78:xx:14 8a:xx:xx:72:xx:a7
Compatibility mode is used to guarantee the connection of old devices
that only support WiFi4 or WiFi5.
TFTP + TTL Installation:
Although a TTL connection is required for installation, we do not need
to tear down it. We can find the TTL port from the cooling hole at the
bottom. It is located below LAN3 and the pins are defined as follows:
|LAN1|LAN2|LAN3|----|WAN|
--------------------
|GND|TX|RX|VCC|
1. Set tftp server IP to 192.168.124.99 and put initramfs firmware in
server's root directory, rename it to a simple name "initramfs.bin".
2. Plug in the power supply and wait for power on, connect the TTL cable
and open a TTL session, enter "reboot", then enter "Y" to confirm.
Finally push "0" to interruput boot while booting.
3. Execute command to install a initramfs system:
# tftp 0x80010000 192.168.124.99:initramfs.bin
# bootm 0x80010000
4. Backup nand flash by OpenWrt LuCI or dd instruction. We need those
partitions if we want to back to stock firmwre due to official
website does not provide download link.
# dd if=/dev/mtd1 of=/tmp/u-boot-env.bin
# dd if=/dev/mtd4 of=/tmp/firmware.bin
5. Edit u-boot env to ensure use default bootargs and first image slot:
# fw_setenv bootargs
# fw_setenv bootflag 0
6. Upgrade sysupgrade firmware.
7. About restore stock firmware: flash the "firmware" and "u-boot-env"
partitions that we backed up in step 4.
# mtd write /tmp/u-boot-env.bin u-boot-env
# mtd write /tmp/firmware.bin firmware
Additional Info:
The H3C stock firmware has a 160-byte firmware header that appears to
use a non-standard CRC32 verification algorithm. For this part of the
data, the u-boot does not check it so we can just directly replace it
with a placeholder.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Hardware
--------
CPU: Mediatek MT7621
RAM: 256M DDR3
FLASH: 128M NAND
ETH: 1x Gigabit Ethernet
WiFi: Mediatek MT7915 (2.4/5GHz 802.11ax 2x2 DBDC)
BTN: 1x Reset (NWA50AX only)
LED: 1x Multi-Color (NWA50AX only)
UART Console
------------
NWA50AX:
Available below the rubber cover next to the ethernet port.
NWA55AXE:
Available on the board when disassembling the device.
Settings: 115200 8N1
Layout:
<12V> <LAN> GND-RX-TX-VCC
Logic-Level is 3V3. Don't connect VCC to your UART adapter!
Installation Web-UI
-------------------
Upload the Factory image using the devices Web-Interface.
As the device uses a dual-image partition layout, OpenWrt can only
installed on Slot A. This requires the current active image prior
flashing the device to be on Slot B.
If the currently installed image is started from Slot A, the device will
flash OpenWrt to Slot B. OpenWrt will panic upon first boot in this case
and the device will return to the ZyXEL firmware upon next boot.
If this happens, first install a ZyXEL firmware upgrade of any version
and install OpenWrt after that.
Installation TFTP
-----------------
This installation routine is especially useful in case
* unknown device password (NWA55AXE lacks reset button)
* bricked device
Attach to the UART console header of the device. Interrupt the boot
procedure by pressing Enter.
The bootloader has a reduced command-set available from CLI, but more
commands can be executed by abusing the atns command.
Boot a OpenWrt initramfs image available on a TFTP server at
192.168.1.66. Rename the image to owrt.bin
$ atnf owrt.bin
$ atna 192.168.1.88
$ atns "192.168.1.66; tftpboot; bootm"
Upon booting, set the booted image to the correct slot:
$ zyxel-bootconfig /dev/mtd10 get-status
$ zyxel-bootconfig /dev/mtd10 set-image-status 0 valid
$ zyxel-bootconfig /dev/mtd10 set-active-image 0
Copy the OpenWrt ramboot-factory image to the device using scp.
Write the factory image to NAND and reboot the device.
$ mtd write ramboot-factory.bin firmware
$ reboot
Signed-off-by: David Bauer <mail@david-bauer.net>
Netgear WAX202 is an 802.11ax (Wi-Fi 6) router.
Specifications:
* SoC: MT7621A
* RAM: 512 MiB NT5CC256M16ER-EK
* Flash: NAND 128 MiB F59L1G81MB-25T
* Wi-Fi:
* MT7915D: 2.4/5 GHz (DBDC)
* Ethernet: 4x 1GbE
* Switch: SoC built-in
* USB: None
* UART: 115200 baud (labeled on board)
Load addresses (same as ipTIME AX2004M):
* stock
* 0x80010000: FIT image
* 0x81001000: kernel image -> entry
* OpenWrt
* 0x80010000: FIT image
* 0x82000000: uncompressed kernel+relocate image
* 0x80001000: relocated kernel image -> entry
Installation:
* Flash the factory image through the stock web interface, or TFTP to
the bootloader. NMRP can be used to TFTP without opening the case.
* Note that the bootloader accepts both encrypted and unencrypted
images, while the stock web interface only accepts encrypted ones.
Revert to stock firmware:
* Flash the stock firmware to the bootloader using TFTP/NMRP.
References in WAX202 GPL source:
https://www.downloads.netgear.com/files/GPL/WAX202_V1.0.5.1_Source.rar
* openwrt/target/linux/ramips/dts/mt7621-ax-nand-wax202.dts
DTS file for this device.
Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
The international version of Mi Router 4A 100M is physically
identical to the non-international one, but appears to be
using a different partitioning scheme with the "overlay"
partition being 2MiB in size instead of 1MiB. This means
the following "firmware" partition starts at a different
address and the DTS needs to be adjusted for the firmware
to work.
Signed-off-by: Nita Vesa <werecatf@outlook.com>
Specifications:
Chipset:MT7628DA+MT7612E
Antenna : 2.4Ghz:2x5dbi Antenna + 5.8Ghz:2x5dbi Antenna
Wireless Rate:2.4Ghz 300Mbps , 5.8Ghz 867Mbps
Output Power :100mW(20dbm)
Physical port:110/100Mbps RJ45 WAN Port , 310/100Mbps RJ45 LAN Port
Flash: 8Mb
DRam: 64Mb
Flashing: default bootloader attempts to boot from tftp://192.168.1.10/firmware_auto.bin using 192.168.1.1
Known issues:
mac-address-increment for 5GHZ doesnt work, i failed to figure out why. Original firmware using +1 from original value in factory partition.
Signed-off-by: Sergei Iudin <tsipa740@gmail.com>
Beeline SmartBox GIGA is a wireless WiFi 5 router manufactured by
Sercomm company.
Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 256 MiB, Nanya NT5CC128M16JR-EK
Flash: 128 MiB, Macronix MX30LF1G18AC
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7613BE): a/n/ac, 2x2
Ethernet: 3 ports - 2xGbE (WAN, LAN1), 1xFE (LAN2)
USB ports: 1xUSB3.0
Button: 1 button (Reset/WPS)
PCB ID: DBE00B-1.6MM
LEDs: 1 RGB LED
Power: 12 VDC, 1.5 A
Connector type: barrel
Bootloader: U-Boot
Installation
-----------------
1. Downgrade stock (Beeline) firmware to v.1.0.02;
2. Give factory OpenWrt image a shorter name, e.g. 1001.img;
3. Upload and update the firmware via the original web interface.
Remark: You might need make the 3rd step twice if your running firmware
is booted from the Slot 1 (Sercomm0 bootflag). The stock firmware
reverses the bootflag (Sercomm0 / Sercomm1) on each firmware update.
Revert to stock
---------------
1. Change the bootflag to Sercomm1 in OpenWrt CLI and then reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
2. Optional: Update with any stock (Beeline) firmware if you want to
overwrite OpenWrt in Slot 0 completely.
MAC Addresses
-------------
+-----+-----------+---------+
| use | address | example |
+-----+-----------+---------+
| LAN | label | *:16 |
| WAN | label + 1 | *:17 |
| 2g | label + 4 | *:1a |
| 5g | label + 5 | *:1b |
+-----+-----------+---------+
The label MAC address was found in Factory 0x21000
Notes
-----
1. The following scripts are required for the build:
sercomm-crypto.py - already exists in OpenWrt
sercomm-partition-tag.py - already exists in OpenWrt
sercomm-payload.py - already exists in OpenWrt
sercomm-pid.py - new, the part of this pull request
sercomm-kernel-header.py - new, the part of this pull request
2. This device (same as other Sercomm S2,S3-based devices) requires
special LZMA and LOADADDR settings for successful boot:
LZMA_TEXT_START=0x82800000
KERNEL_LOADADDR=0x81001000
LOADADDR=0x80001000
3. This device (same as several other Sercomm-based devices - Beeline,
Netgear, Etisalat, Rostelecom) has partition map (mtd1) containing
real partition offsets, which may differ from device to device
depending on the number and location of bad blocks on NAND.
"fixed-partitions" is used if the partition map is not found or
corrupted. This behavour (it's the same as on stock firmware) is
provided by MTD_SERCOMM_PARTS module.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Asus RP-AC87 ac2600 Repeater
2.4GHz 800Mbps
5GHz 1733Mbps
Hardware specifications:
SoC: MT7621A 2 cores 4 threads @880MHz
WiFi2G: MT7615E 2G 4x4 b/g/n
Wifi5G: MT7615E 5G 4x4 n/ac
DRAM: 128MB DDR3 @1200mhz
Flash: 16MB MX25L12805D SPI-NOR
LAN/WAN: MT7530 1x1000M
MAC addresses as verified by OEM firmware:
use address source
Lan/W5G *:B0 factory 0x8004 (label)
W2G *:B4 factory 0x0
Installation:
Asus windows recovery tool:
install the Asus firmware restoration utility
unplug the router, hold the reset button while powering it on
release when the power LED flashes slowly
specify a static IP on your computer:
IP address: 192.168.1.75
Subnet mask 255.255.255.0
Start the Asus firmware restoration utility, specify the factory image
and press upload
Do not power off the device after OpenWrt has booted until the LED flashing.
TFTP Recovery method:
set computer to a static ip, 192.168.1.2
connect computer to the LAN 1 port of the router
hold the reset button while powering on the router for a few seconds
send firmware image using a tftp client; i.e from linux:
$ tftp
tftp> binary
tftp> connect 192.168.1.1
tftp> put factory.bin
tftp> quit
Signed-off-by: Tamas Balogh <tamasbalogh@hotmail.com>
Asus RT-N12+ B1 and Asus RT-N300 B1 are the same device
with a different name.
The OEM firmwares have the same MD5 with Asus RT-N11P B1.
Same instructions for Asus RT-N11P B1 see:
commit c3dc52e39a ("ramips: add support for Asus RT-N10P V3 / RT-N11P B1 / RT-N12 VP B1")
Signed-off-by: Semih Baskan <strstgs@gmail.com>
(Added id from the PR review to commit message)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Specifications:
- Device: ASUS RT-AX53U
- SoC: MT7621AT
- Flash: 128MB
- RAM: 256MB
- Switch: 1 WAN, 3 LAN (10/100/1000 Mbps)
- WiFi: MT7905 2x2 2.4G + MT7975 2x2 5G
- Ports: USB 3.0
- LEDs: 1x POWER (blue, configurable)
3x LAN (blue, configurable)
1x WAN (blue, configurable)
1x USB (blue, not configurable)
1x 2.4G (blue, not configurable)
1x 5G (blue, not configurable)
Flash by U-Boot TFTP method:
- Configure your PC with IP 192.168.1.2
- Set up TFTP server and put the factory.bin image on your PC
- Connect serial port(rate:115200) and turn on AP, then interrupt "U-Boot Boot Menu" by hitting any key
Select "2. Upgrade firmware"
Press enter when show "Run firmware after upgrading? (Y/n):"
Select 0 for TFTP method
Input U-Boot's IP address: 192.168.1.1
Input TFTP server's IP address: 192.168.1.2
Input IP netmask: 255.255.255.0
Input file name: openwrt-ramips-mt7621-asus_rt-ax53u-squashfs-factory.bin
- Restart AP aftre see the log "Firmware upgrade completed!"
Signed-off-by: Chuncheng Chen <ccchen1984@gmail.com>
(replaced led label, added key-* prefix to buttons, added note about
BBT)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This fixes a well known "LZMA ERROR 1" error, reported previously on
numerous of other devices from 'ramips' target.
Fixes: #9842Fixes: #8964
Reported-by: Juergen Hench <jurgen.hench@gmail.com>
Tested-by: Juergen Hench <jurgen.hench@gmail.com>
Signed-off-by: Demetris Ierokipides <ierokipides.dem@gmail.com>
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
MTS WG430223 is a wireless AC1300 (WiFi 5) router manufactured by
Arcadyan company. It's very similar to Beeline Smartbox Flash (Arcadyan
WG443223).
Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 128 MiB
Flash: 128 MiB (Winbond W29N01HV)
Wireless 2.4 GHz (MT7615DN): b/g/n, 2x2
Wireless 5 GHz (MT7615DN): a/n/ac, 2x2
Ethernet: 3xGbE (WAN, LAN1, LAN2)
USB ports: No
Button: 1 (Reset/WPS)
LEDs: 2 (Red, Green)
Power: 12 VDC, 1 A
Connector type: Barrel
Bootloader: U-Boot (Ralink UBoot Version: 5.0.0.2)
OEM: Arcadyan WG430223
Installation
------------
1. Login to the router web interface (superadmin:serial number)
2. Navigate to Administration -> Miscellaneous -> Access control lists &
enable telnet & enable "Remote control from any IP address"
3. Connect to the router using telnet (default admin:admin)
4. Place *factory.trx on any web server (192.168.1.2 in this example)
5. Connect to the router using telnet shell (no password required)
6. Save MAC adresses to U-Boot environment:
uboot_env --set --name eth2macaddr --value $(ifconfig | grep eth2 | \
awk '{print $5}')
uboot_env --set --name eth3macaddr --value $(ifconfig | grep eth3 | \
awk '{print $5}')
uboot_env --set --name ra0macaddr --value $(ifconfig | grep ra0 | \
awk '{print $5}')
uboot_env --set --name rax0macaddr --value $(ifconfig | grep rax0 | \
awk '{print $5}')
7. Ensure that MACs were saved correctly:
uboot_env --get --name eth2macaddr
uboot_env --get --name eth3macaddr
uboot_env --get --name ra0macaddr
uboot_env --get --name rax0macaddr
8. Download and write the OpenWrt images:
cd /tmp
wget http://192.168.1.2/factory.trx
mtd_write erase /dev/mtd4
mtd_write write factory.trx /dev/mtd4
9. Set 1st boot partition and reboot:
uboot_env --set --name bootpartition --value 0
Back to Stock
-------------
1. Run in the OpenWrt shell:
fw_setenv bootpartition 1
reboot
2. Optional step. Upgrade the stock firmware with any version to
overwrite the OpenWrt in Slot 1.
MAC addresses
-------------
+-----------+-------------------+----------------+
| Interface | MAC | Source |
+-----------+-------------------+----------------+
| label | A4:xx:xx:51:xx:F4 | No MACs was |
| LAN | A4:xx:xx:51:xx:F6 | found on Flash |
| WAN | A4:xx:xx:51:xx:F4 | [1] |
| WLAN_2g | A4:xx:xx:51:xx:F5 | |
| WLAN_5g | A6:xx:xx:21:xx:F5 | |
+-----------+-------------------+----------------+
[1]:
a. Label wasb't found neither in factory nor in other places.
b. MAC addresses are stored in encrypted partition "glbcfg". Encryption
key hasn't known yet. To ensure the correct MACs in OpenWrt, a hack
with saving of the MACs to u-boot-env during the installation was
applied.
c. Default Ralink ethernet MAC address (00:0C:43:28:80:A0) was found in
"Factory" 0xfff0. It's the same for all MTS WG430223 devices. OEM
firmware also uses this MAC when initialazes ethernet driver. In
OpenWrt we use it only as internal GMAC (eth0), all other MACs are
unique. Therefore, there is no any barriers to the operation of several
MTS WG430223 devices even within the same broadcast domain.
Stock firmware image format
---------------------------
The same as Beeline Smartbox Flash but with another trx magic
+--------------+---------------+----------------------------------------+
| Offset | | Description |
+==============+===============+========================================+
| 0x0 | 31 52 48 53 | TRX magic "1RHS" |
+--------------+---------------+----------------------------------------+
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
This commit:
1. Renames beeline-trx recipe in mt7621.mk to arcadyan-trx. The recipe
is necessary for:
- MTS WG430223 (Arcadyan WG430223)
- Beeline Smartbox Flash (Arcadyan WG443223)
2. Allows specify custom trx magic which is different for the routers
mentined above.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
The SERCOMM NA502s is a smart home gateway manufactured by SERCOMM and sold
under different brands (among others, A1 Telekom Austria SmartHome Premium
Gateway). It has multi-protocol radio support in addition to LAN and WiFi.
Note: BLE and audio are currently unsupported.
Specifications
--------------
- MT7621ST 880MHz, Single-Core, Dual-Thread
- MT7603EN 2.4GHz WiFi
- MT7662EN 5GHz WiFi + BLE
- 128MiB NAND
- 256MiB DDR3 RAM
- SD3503 ZWave Controller
- EM357 Zigbee Coordinator
- Telit UMTS module
- Rechargeable battery
- speaker and microphone
MAC address assignment
----------------------
LAN MAC is read from the config partition, WiFi 2.4GHz is LAN+2 and matches
the OEM firmware. WiFi 5GHz with LAN+1 is an educated guess since the
OEM firmware does not enable 5GHz WiFi.
Installation
------------
Attach serial console, then boot the initramfs image via TFTP.
Once inside OpenWrt, run sysupgrade -n with the sysupgrade file.
Attention: The device has a dual-firmware design. We overwrite kernel2,
since kernel1 contains an automatic recovery image.
If you get NAND ECC errors and are stuck with bad eraseblocks, try to
erase the mtd partition first with
mtd unlock ubi
mtd erase ubi
This should only be needed once.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
This fixes a well known "LZMA ERROR 1" error, reported previously on
numerous of similar devices.
Fixes: #9824
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Specifications:
SoC: MediaTek MT7621
RAM: 256 MB
Flash: 32 MB
WiFi: MediaTek MT7915E
Switch: 1 WAN, 4 LAN (Gigabit)
Ports: 1 USB 3.0
Buttons: Reset, WPS
LEDs: Power, System, Wan, Lan 1-4, WiFi 2.4G, WiFi 5G, WPS, USB
Power: DC 12V 1A tip positive
Installation:
Download and flash the manufacturer's built OpenWRT image available at
http://www.cudytech.com/openwrt_software_download
Install the new OpenWRT image via luci (System -> Backup/Flash firmware)
Be sure to NOT keep settings. The force upgrade may need to be checked
due to differences in router naming conventions.
Recovery:
Loads only signed manufacture firmware due to bootloader RSA verification
serve tftp-recovery image as /recovery.bin on 192.168.1.88/24
connect to any lan ethernet port
power on the device while holding the reset button
wait at least 8 seconds before releasing reset button for image to
download
Signed-off-by: Alessio Prescenzo <alessioprescenzo@gmail.com>
[ensure unique wireless MAC, fix GPIO pingroup]
Signed-off-by: David Bauer <mail@david-bauer.net>
The Wavlink WL-WN533A8 is an AC3000 router with 5 gigabit ethernet ports
and one USB 3.0 port.
It's also known as Wavlink QUANTUM T8.
Hardware
--------
SoC: Mediatek MT7621A
RAM: 128MB (Nanya NT5CB64M16GP-EK)
FLASH: 16MB NOR (GigaDevice GD25Q127CSIG3)
ETH:
- 5x 10/100/1000 Mbps Ethernet (4x LAN + 1x WAN)
WIFI:
- 1x MT7615DN (2x 2x2:2) 2.4GHz and 5GHz DBDC
- 1x MT7615NE (4x4:4) 5GHz
- 8 external antennas
BTN:
- 1x Reset button
- 1x WPS button
- 1x Turbo button
- 1x Touchlink button
- 1x ON/OFF switch
LEDS:
- 1x Red led (system status)
- 1x Blue led (system status)
- 7x Blue leds (wifi led + 5 ethernet ports + power)
USB:
- 1x USB 3.0 port
UART:
- 57600-8-N-1
J4
Everything works correctly.
Installation
------------
Flash the initramfs image in the OEM firmware interface
(http://192.168.10.1/update.shtml).
When Openwrt boots, flash the sysupgrade image otherwise you won't be
able to keep configuration between reboots.
(Procedure tested on fw M33A8.V5030.190716 and M33A8.V5030.201204)
Restore OEM Firmware
--------------------
Flash the firmware update available online directly from LUCI.
You can download it from:
https://www.wavlink.com/en_us/firmware/details/f2d247ecba.html
Warning: Remember to not keep settings!
Warning2: Remember to force the flash.
Notes
-----
1) Router mac addresses:
LAN XX:XX:XX:XX:XX:63 (factory @ 0xe006)
WAN XX:XX:XX:XX:XX:64 (factory @ 0xe000)
WIFI 2G/5G XX:XX:XX:XX:XX:65 (factory @ 0x04)
WIFI 5G XX:XX:XX:XX:XX:66 (factory @ 0x8004)
LABEL XX:XX:XX:XX:XX:65
In OEM firmware the DBDC wifi interfaces have these mac addresses:
2G) 82:XX:XX:XX:XX:65
5G) 80:XX:XX:XX:XX:65
While in OpenWrt the addresses are:
2G) 80:XX:XX:XX:XX:65
5G) 02:XX:XX:XX:XX:65
2) radio0 will show as 2G/5G interface but only 2G is really usable.
3) There is just one wifi led for all wifi interfaces.
It currently shows only the radio0 GHz wifi activity.
4) My unit was shipped with M33A8.V5030.190716 firmware which contains
the http://192.168.10.1/webcmd.shtml page. Entering "telnetd" in
the input box it will start the telnet daemon. Now you can access
the telnet console on port 2323 with these credentials:
username: admin2860
password: admin
5) The M33A8.V5030.201204 firmware version, doesn't contain anymore the
webcmd.shtml page. If your router is shipped with a previous firmware
version and you want to back it up, you can follow the back up
procedure of the WS-WN583A6.
Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
TP-Link RE650 v2 is largely similar to v1 that
is already supported by OpenWrt. Notable differences
is differnt SPI Flash - 8 MB instead of 16 MB
(from cFeon instead of Winbond) and a different
configuration of PCIE connections to wifi chips.
Otherwise it's largely the same product as v1
Hardware specification:
- SoC 880 MHz - MediaTek MT7621AT
- 128 MB of DDR3 RAM
- 8 MB - cFeon QH64A-104HIP
- 4T4R 2.4 GHz - MediaTek MT7615E
- 4T4R 5 GHz - MediaTek MT7615E
- 1x 1 Gbps Ethernet - MT7621AT integrated
- 7x LEDs (Power, 2G, 5G, WPS(x2), Lan(x2))
- 4x buttons (Reset, Power, WPS, LED)
- UART pinout - GND, RX, TX, labeled in the middle of the PCB,
requires soldering because they're not through holes.
Serial console @ 57600,8n1
Flash instructions:
Upload
openwrt-ramips-mt7621-tplink_re650-v2-squashfs-factory.bin
from the RE650 web interface.
TFTP recovery to stock firmware:
I didn't try recovering back to the stock firmware, however,
if there is such process for other RExxx devices, it seems like
it could be similar here.
Signed-off-by: Marcin Gordziejewski <openwrt@flicksfix.com>
There are two versions which are identical apart from the enclosure:
YunCore AX820: indoor ceiling mount AP with integrated antennas
YunCore HWAP-AX820: outdoor enclosure with external (N) connectors
Hardware specs:
SoC: MediaTek MT7621DAT
Flash: 16 MiB SPI NOR
RAM: 128MiB (DDR3, integrated)
WiFi: MT7905DAN+MT7975DN 2.4/5GHz 2T2R 802.11ax
Ethernet: 10/100/1000 Mbps x2 (WAN/PoE+LAN)
LED: Status (green)
Button: Reset
Power: 802.11af/at PoE; DC 12V,1A
Antennas: AX820(indoor): 4dBi internal; HWAP-AX820(outdoor): external
Flash instructions:
The "OpenWRT support" version of the AX820 comes with a LEDE-based
firmware with proprietary MTK drivers and a luci webinterface and
ssh accessible under 192.168.1.1 on LAN; user root, no password.
The sysupgrade.bin can be flashed using luci or sysupgrade via ssh,
you will have to force the upgrade due to a different factory name.
Remember: Do *not* preserve factory configuration!
MAC addresses as used by OEM firmware:
use address source
2g 44:D1:FA:*:0b Factory 0x0004 (label)
5g 46:D1:FA:*:0b LAA of 2g
lan 44:D1:FA:*:0c Factory 0xe000
wan 44:D1:FA:*:0d Factory 0xe000 + 1
The wan MAC can also be found in 0xe006 but is not used by OEM dtb.
Due to different MAC handling in mt76 the LAA derived from lan is used
for 2g to prevent duplicate MACs when creating multiple interfaces.
Signed-off-by: Clemens Hopfer <openwrt@wireloss.net>
OrayBox X3A is a 2.4/5GHz dual band AC router, based on MediaTek MT7621.
Specification:
* SoC: MT7621
* RAM: DDR3 128 MiB
* Flash: 16 MiB NOR (XM25Q128)
* Wi-Fi: (single chip hosting both 2.4G and 5G)
* 2.4GHz: MT7615
* 5GHz: MT7615
* Ethernet: 3x 1000Mbps
* Switch: MT7530
* LED:
* Ethernet LEDs: On the back of the router, hardware-controlled.
* Status LEDs: One "pixel-like" RGB LED in the front of the router,
which is actually made up of 3 individual LEDs (with
dedicated GPIO pins) with the color of Red, Green,
and Blue.
The OEM firmware only lights up one color at a time to
indicate status, but that's very boring, and the colors
actually look great when combined, so I've improvised a
little and made them indicate netdev activities.
My test results:
GPIO 13/14/15
000 white (actually more like bright green or cyan
because the brightness of the green LED is
higher than red and blue)
001 bright purple
010 bright green
011 red
100 bright cyan
101 blue
110 green
111 off
Flash Layout:
0x0000000-0x0030000 : "u-boot"
0x0030000-0x0040000 : "u-boot-env"
0x0040000-0x0050000 : "factory"
0x0050000-0x0f50000 : "firmware"
/*0x0f50000 to 0x0fe0000 is undefined, same as OEM firmware*/
0x0fe0000-0x0ff0000 : "bdinfo"
0x0ff0000-0x1000000 : "reserve"
MAC address:
MAC Source Description Fix
A0:CX:XX:BX:XX:0D BDINFO_9 LAN(LABEL) DTS
A0:CX:XX:BX:XX:0E BDINFO_9 + 1 WAN DTS
A2:CX:XX:BX:XX:0F FACTORY_4 WIFI2G DTS
A2:CX:XX:CX:XX:0F SETBIT 7 (FACTORY_4 + 0x100000) WIFI5G HOTPLUG
A6:CX:XX:BX:XX:0F N/A WIFI2G_CLIENT N/A
A6:DX:XX:BX:XX:0F N/A WIFI5G_CLIENT N/A
Stock dmesg:
https://pastebin.com/2t2jwLdf
Stock Dumps:
https://pastebin.com/LDLxSWX3
Installation via SSH (does not void your warranty):
1. -----UNLOCK SSH-----
1.1 Set computer IP to DHCP mode, load 'http://10.168.1.1/cgi-bin/luci' in
your browser. Password is 'admin'.
1.2 Click the "备份且导出" (backup and export) button, and download the
config file.
1.3 Open the downloaded file with 7zip, navigate to '/etc/config/'.
1.4 Edit the file './system'. Change the '0' into '1' under
"config sys 'ssh'".
1.5 Save the file.
1.6 Upload the file by clicking the "导入且恢复" (import and recover)
button. The router will automatically reboot.
2. -----FLASH THE OPENWRT FIRMWARE-----
2.1 Use any scp tool to upload the 'sysupgrade' firmware to the '/tmp/'
folder to your router. It should be root@10.168.1.1 and the password
is 'admin'.
2.2 SSH into the router, also root@10.168.1.1 and the password is 'admin'.
2.3 **IMPORTANT** Type command 'dd if=/dev/mtd3 of=/tmp/firmware.bin', to
backup the stock firmware. Since the OEM does not provide firmware
download on their website, this is the only way to get it.
2.3 **ALSO IMPORTANT** Use any scp tool to download your backed-up stock
firmware from '/tmp/' to your local drive. Then you'd better use a hex
reading tool to have a rough look at it to make sure nothing is
corrupt. Or u can just back up again and cross check the MD5.
2.4 Type command 'mtd write /tmp/XXX.bin firmware', and it should flash
the firmware.
2.5 Verify that nothing went wrong. If you're confident, type 'reboot' and
reboot the router.
Revert to stock firmware:
1. load stock firmware using mtd (make sure u have a backup).
Signed-off-by: Ray Wang <raywang777@foxmail.com>
Hardware specifications:
SoC: MT7628DAN MIPS_24KEc@580MHz 2.4G-n 2x2
WiFi: MT7613BEN 5G-ac 160MHz 2x2
Switch: 4x100M built-in SoC
Flash: 16MB W25Q128JVSQ SPI-NOR
DRAM: 64MB built-in SoC
MAC addresses as verified by OEM firmware:
use address source
Lan/Wan/2G *:60 factory 0x4 (label)
5G *:64 factory 0x8000
Serial console: 57600,8n1
Installation:
Asus windows recovery tool:
install the Asus firmware restoration utility
unplug the router, hold the reset button while powering it on
release when the power LED flashes slowly
specify a static IP on your computer:
IP address: 192.168.1.75
Subnet mask 255.255.255.0
start the Asus firmware restoration utility, specify the factory image
and press upload
do NOT power off the device after OpenWrt has booted until the LED flashing
after flashing OpenWrt, there will be first no 5GHz Wifi available probably,
wait until blinking finishes and do a reboot
TFTP Recovery method:
set computer to a static ip, 192.168.1.75
connect computer to the LAN 1 port of the router
hold the reset button while powering on the router for a few seconds
send firmware image using a tftp client; i.e from linux:
$ tftp
tftp> binary
tftp> connect 192.168.1.1
tftp> put factory.bin
tftp> quit
do NOT power off the device after OpenWrt has booted until the LED flashing
after flashing OpenWrt, there will be first no 5GHz Wifi available probably,
wait until blinking finishes and do a reboot
Signed-off-by: Tamas Balogh <tamasbalogh@hotmail.com>
This device is from now-defunct BOLT! ISP in Indonesia.
The original firmware is based on mediatek SDK running linux 2.6 or 3.x in later revision.
Specifications:
- SoC: MediaTek MT7621
- Flash: 32 MiB NOR SPI
- RAM: 128 MiB DDR3
- Ethernet: 2x 10/100/1000 Mbps (switched, LAN + WAN)
- WIFI0: MT7603E 2.4GHz 802.11b/g/n
- WIFI1: MT7612E 5GHz 802.11ac
- Antennas: 2x internal, non-detachable
- LEDs: Programmable LEDs: 5 blue LEDs (wlan, tel, sig1-3) and 2 red LEDs (wlan and sig1)
Non-programmable "Power" LED
- Buttons: Reset and WPS
Instalation:
Install from TFTP
Set your PC IP to 10.10.10.3 and gateway to 10.10.10.123
Press "1" when turning on the router, and type the initramfs file name
You also need to solder pin header or cable to J4 or neighboring test points (T19-T21)
Pinouts from top to bottom: GND, TX, RX, VCC (3.3v)
Baudrate: 57600n8
There's also an additional gigabit transformer and RTL8211FD managed by the LTE module on the backside of the PCB.
Signed-off-by: Abdul Aziz Amar <abdulaziz.amar@gmail.com>
The Wavlink WL-WN531A3 is an AC1200 router with 5 fast ethernet ports
and one USB 2.0 port.
It's also known as Wavlink QUANTUM D4.
Hardware
--------
SoC: Mediatek MT7628AN
RAM: 64MB
FLASH: 8MB NOR (GigaDevice GD25Q64CSIG3)
ETH:
- 5x 10/100 Mbps Ethernet (4x LAN + 1x WAN)
WIFI:
- 2.4GHz: 1x (integrated in SOC) (2x2:2)
- 5GHz: 1x MT7612E (2x2:2)
- 4 external antennas
BTN:
- 1x Reset button
- 1x WPS button
- 1x Turbo button
- 1x Touchlink button
- 1x ON/OFF switch
LEDS:
- 1x Red led (system status)
- 1x Blue led (system status)
- 7x Blue leds (wifi led + 5 ethernet ports + power)
USB:
- 1x USB 2.0 port
UART:
- 57600-8-N-1
J1
O VCC +3,3V (near lan ports)
o RX
o TX
o GND
Everything works correctly.
Currently there is no firmware update available. Because of this, in
order to restore the OEM firmware, you must firstly dump the OEM
firmware from your router before you flash the OpenWrt image.
Backup the OEM Firmware
-----------------------
The following steps are to be intended for users having little to none
experience in linux. Obviously there are many ways to backup the OEM
firmware, but probably this is the easiest way for this router.
Procedure tested on M31A3.V4300.200420 firmware version.
1) Go to http://192.168.10.1/webcmd.shtml
2) Type the following line in the "Command" input box and then press enter:
mkdir /etc_ro/lighttpd/www/dev; cp /dev/mtd0ro /etc_ro/lighttpd/www/dev/mtd0ro; ls -la /etc_ro/lighttpd/www/dev/mtd0ro
3) After few seconds in the textarea should appear this output:
-rw-r--r-- 1 0 0 8388608 /etc_ro/lighttpd/www/dev/mtd0ro
If your output doesn't match mine, stop reading and ask for
help in the forum.
4) Open in another tab http://192.168.10.1/dev/mtd0ro to download the
content of the whole NOR. If the file size is 0 byte, stop reading
and ask for help in the forum.
5) Come back to the http://192.168.10.1/webcmd.shtml webpage and type:
rm /etc_ro/lighttpd/www/dev/mtd0ro; for i in 1 2 3 4 ; do cp /dev/mtd${i}ro /etc_ro/lighttpd/www/dev/mtd${i}ro; done; ls -la /etc_ro/lighttpd/www/dev/
6) After few seconds, in the textarea should appear this output:
-rw-r--r-- 1 0 0 196608 mtd1ro
-rw-r--r-- 1 0 0 65536 mtd2ro
-rw-r--r-- 1 0 0 65536 mtd3ro
-rw-r--r-- 1 0 0 8060928 mtd4ro
drwxr-xr-x 7 0 0 0 ..
drwxr-xr-x 2 0 0 0 .
If your output doesn't match mine, stop reading and ask for
help in the forum.
7) Open the following links to download the partitions of the OEM FW:
http://192.168.10.1/dev/mtd1rohttp://192.168.10.1/dev/mtd2rohttp://192.168.10.1/dev/mtd3rohttp://192.168.10.1/dev/mtd4ro
If one (or more) of these files are 0 byte, stop reading and ask
for help in the forum.
8) Store these downloaded files in a safe place.
9) Reboot your router to remove any temporary file in ram.
Installation
------------
Flash the initramfs image in the OEM firmware interface
(http://192.168.10.1/update.shtml).
When Openwrt boots, flash the sysupgrade image otherwise you won't be
able to keep configuration between reboots.
Restore OEM Firmware
--------------------
Flash the "mtd4ro" file you previously backed-up directly from LUCI.
Warning: Remember to not keep settings!
Warning2: Remember to force the flash.
Notes
-----
1) Router mac addresses:
LAN XX:XX:XX:XX:XX:9B (factory @ 0x28)
WAN XX:XX:XX:XX:XX:9C (factory @ 0x2e)
WIFI 2G XX:XX:XX:XX:XX:9D (factory @ 0x04)
WIFI 5G XX:XX:XX:XX:XX:9E (factory @ 0x8004)
LABEL XX:XX:XX:XX:XX:9D
2) There is just one wifi led for both wifi interfaces.
It currently shows only the 2.4 GHz wifi activity.
Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
Specifications:
- SoC: MediaTek MT7621AT
- RAM: 128 MB (DDR3)
- Flash: 16 MB (SPI NOR)
- WiFi: MT7615N (2.4GHz) and MT7615N (5Ghz)
- Switch: 1 WAN, 4 LAN (Gigabit)
- Buttons: Reset, WiFi Toggle, WPS
- LEDs: Power, Internet, WiFi 2.4G WiFi 5G
The R1 revision is identical to the A1 revision except
- No Config2 Parition, therefore
- factory partition resized to 64k from 128K
- Firmware partition offset is 0x50000 not 0x60000
- Firmware partitions size increased by 64K
- Firmware partition type is "denx,uimage", not "sge,uimage"
- Padding of image creation "uimage-padhdr 96" removed
Installation:
Update to the last D-Link firmware through web-ui before OpenWRT
installation then follow the instructions to patch your device using
D-Link FailsafeUI.
- D-Link FailsafeUI:
Power down the router, press and hold the reset button, then
re-plug it. Keep the reset button pressed until the internet LED stops
flashing, then jack into any lan port and manually assign a static IP
address in 192.168.0.0/24 other than 192.168.0.1 (e.g. 192.168.0.2)
and go to http://192.168.0.1
Flash with the factory image.
Signed-off-by: Igor Nazarov <tigron.dev@gmail.com>
This patch adds support for the Netgear WN3100RPv2
http://www.netgear.com/support/product/wn3100rpv2.aspx
Specifications:
- SoC: MediaTek MT7620A (580MHz, ramips)
- RAM: 32MB DDR
- Storage: 8MB NOR SPI flash
- Wireless: builtin MT7620A, 2x2:2 with u.FL connectors
- Ethernet: 1x100M
- Stock firmware based on OpenWRT Kamikaze
Like the EX2700, the bootloader expects a secondary image signature,
see https://forum.openwrt.org/viewtopic.php?pid=312577#p312577
This device seems to be same hardware as a WN3000RPv3
Flash instructions:
- Use the Netgear WebUI to upgrade to OpenWRT using the factory image
(see note below),
- Use the sysupgrade image for upgrading versions from OpenWRT,
- TFTP recovery procedure can be used to flash the factory image
(preferred method).
Note:
- The WebUI may not reboot automatically, wait at least 5 minutes before
powercycling the device
Flashing using TFTP:
- Set you IP address to 192.168.1.10/24 (no gateway)
- Connect your machine to the Ethernet port
- Power off the device and wait for 10 seconds,
- Hold the reset button and power on the device (do not release reset),
- Hold the reset button until the green light is flashing (Approx. 15s)
- launch tftp, set mode to binary and connect to 192.168.1.1
- put the factory firmware image
- All leds will switch off (like a power off), this is normal
- Wait for the device to reboot in the new OpenWRT image (max 5 mins)
- The first boot will take longer than usual.
- After boot, the Device IP on the ethernet port is 192.168.1.1
Signed-off-by: Rodolphe de Saint Léger <rdesaintleger@gmail.com>
[drop unneeded includes in dts, wrap commit message]
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
This reverts commit 7bc20cb614.
It adds support for Netgear WN3100RPv2, but the commit title is wrong.
It will be re-added with the correct title.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
This patch adds support for the Netgear WN3100RPv2
http://www.netgear.com/support/product/wn3100rpv2.aspx
Specifications:
- SoC: MediaTek MT7620A (580MHz, ramips)
- RAM: 32MB DDR
- Storage: 8MB NOR SPI flash
- Wireless: builtin MT7620A, 2x2:2 with u.FL connectors
- Ethernet: 1x100M
- Stock firmware based on OpenWRT Kamikaze
Like the EX2700, the bootloader expects a secondary image signature,
see https://forum.openwrt.org/viewtopic.php?pid=312577#p312577
This device seems to be same hardware as a WN3000RPv3
Flash instructions:
- Use the Netgear WebUI to upgrade to OpenWRT using the factory image
(see note below),
- Use the sysupgrade image for upgrading versions from OpenWRT,
- TFTP recovery procedure can be used to flash the factory image
(preferred method).
Note:
- The WebUI may not reboot automatically, wait at least 5 minutes before
powercycling the device
Flashing using TFTP:
- Set you IP address to 192.168.1.10/24 (no gateway)
- Connect your machine to the Ethernet port
- Power off the device and wait for 10 seconds,
- Hold the reset button and power on the device (do not release reset),
- Hold the reset button until the green light is flashing (Approx. 15s)
- launch tftp, set mode to binary and connect to 192.168.1.1
- put the factory firmware image
- All leds will switch off (like a power off), this is normal
- Wait for the device to reboot in the new OpenWRT image (max 5 mins)
- The first boot will take longer than usual.
- After boot, the Device IP on the ethernet port is 192.168.1.1
Signed-off-by: Rodolphe de Saint Léger <rdesaintleger@gmail.com>
[drop unneeded includes in dts, wrap commit message]
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
The DWR-961 A1 Wireless Router is based on the MT7620A SoC.
It's a merge of two Amit boards: DWR-960 with ethernet part
of Lava LR-25G001.
ROMID it's taken from Telenor branded version and it works with tested
device. Images from D-Link site for this router are from DWR-953 and it
have ROMID DLK6E2424001. I don't know if it's mistake on web-site
or if it's will require different image.
Specification:
- MediaTek MT7620A (580 Mhz)
- 128 MB of RAM
- 16 MB of FLASH
- 1x 802.11bgn radio
- 1x 802.11ac radio (MT7612 mpcie card)
- 5x 10/100/1000 Mbps Ethernet: 4xLAN and 1xWAN (QCA8337)
- 2x internal, non-detachable antennas (Wifi 2.4G)
- 3x external, detachable antennas (2x LTE, 1x Wifi 5G)
- 1x LTE modem cat 6
- UART (J5) header on PCB (57600 8n1)
- 13x LED, 2x button
- JBOOT bootloader
Installation:
Apply factory image via http web-gui or JBOOT recovery page
How to revert to OEM firmware:
- push the reset button and turn on the power. Wait until LED start
blinking (~10sec.)
- upload original factory image via JBOOT http (IP: 192.168.123.254)
Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
Dual-Q H721 is a router platform board, it is the smaller model of
the U7621-06.
The device has the following specifications:
MT7621AT (880 MHz)
256 of RAM (DDR3)
16 MB of FLASH (MX25l12805d SPI)
5x 1 Gbps Ethernet (MT7621 built-in switch)
1x M.2 (NGFF) 3.7V 3A max for 5G M.2 Modem work at USB3.0 mode
1x Minipcie 3.7V 3A max for LTE Modem work at USB2.0 Mode
2x Minipcie for WIFI card
4x Lan+1x Wan 10/100M/1000M RJ45 port
14x LEDs (1x GPIO-controlled)
1x reset button
1x UART header (4-pins)
1x mico SD-card reader
1x DC jack for main power (5~27 V)
The following has been tested and is working:
Ethernet switch
miniPCIe slots (tested with Wi-Fi cards and LTE modem cards)
miniSIM slot (works with normal size simcard)
sysupgrade
reset button
micro SD-card reader
Installation:
This board has no locked down bootloader. The seller can be asked to
install openwrt, so upgrades are standard sysupgrade method.
Recovery:
This board contains a Chinese, closed-source bootloader called Breed
(Boot and Recovery Environment for Embedded Devices). Breed supports web
recovery and to enter it, you keep the reset button pressed for around
5 seconds during boot. Your machine will be assigned an IP through DHCP
and the router will use IP address 192.168.1.1. The recovery website is
in Chinese, but is easy to use. Click on the second item in the list to
access the recovery page, then the second item on the next page is where
you select the firmware. In order to start the recovery, you click the
button at the bottom.
Signed-off-by: Dawsen Gao <dawsen_gao@163.com>
[change author name (used SoB one), add ethernet pinctrl,
apply sorting to device recipe]
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
In commit ee66fe4ea9 ("ramips: convert DEVICE_TITLE to new variables"),
DEVICE_VENDOR of some unbranded devices were set incorrectly:
* WR512-3GN is not a dev board from Ralink.
* "XDX-RN502J" is the whole model name and should be not split.
This patch sets their DEVICE_VENDOR to "Unbranded", and changes their DTS
model properties accordingly.
Ref: d0bf15f235 ("ramips: add support for A5-V11 board (resubmit)")
Ref: 9085b05d9e ("ramips: rt305x: support for wr512-3gn-like routers")
Ref: 0e486d2fd2 ("ramips: add support for unbranded XDX-RN502J board")
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Zbtlink ZBT-WG1608 is a Wi-Fi router intendent to use with WWAN (4G/5G)
modems.
Specifications:
* SoC: MediaTek MT7621A
* RAM: 256/512 MiB
* Flash: 16/32 MiB (SPI NOR)
* Wi-Fi:
* MediaTek MT7603E : 2.4Ghz
* MediaTek MT7613BE : 5Ghz
* Ethernet: 10/100/1000 Mbps Ethernet x5 ports (4xLAN + WAN)
* M.2: 1x slot with USB&SIM
* EM7455/EM12-G/EM160R/RM500Q-AE
* USB: 1x 3.0 Type-A port
* External storage: 1x microSD (SDXC) slot
* UART: console (115200 baud)
* LED:
* 1 power indicator
* 1 WLAN 2.4G controlled (wlan 2G)
* 3 SoC controlled (wlan 5G, wwan, internet)
* 5 per Eth phy (4xLAN + WAN)
MAC Addresses:
* LAN : f8:5e:3c:xx:xx:e0 (Factory, 0xe000 (hex))
* WAN : f8:5e:3c:xx:xx:e1 (Factory, 0xe006 (hex))
* 2.4 GHz: f8:5e:3c:xx:xx:de (Factory, 0x0004 (hex))
* 5 GHz : f8:5e:3c:xx:xx:df (Factory, 0x8004 (hex))
Installation:
* Vendor's firmware is OpenWrt (LEDE) based, so the sysupgrade image can
be directly used to install OpenWrt. Firmware must be upgraded using the
'force' and 'do not save configuration' command line options (or
correspondig web interface checkboxes) since the vendor firmware is from
the pre-DSA era.
Recovery Mode:
* Press reset button, power up the device, wait for about 10sec.
* Upload sysupgrade image through the firmware recovery mode web page at
192.168.1.1.
Signed-off-by: Kim Namu <namu@theseed.io>
Asus RT-AC1200 is a 2.4/5GHz dual band AC router,
based on MediaTek MT7628AN.
Specification:
* SoC: MT7628AN
* RAM: DDR2 64 MiB
* Flash: 16 MiB NOR (W25Q128BV)
* Wi-Fi:
* 2.4GHz: SoC Built-in
* 5GHz: MT7612EN
* Ethernet: 5x 100Mbps
* Switch: SoC built-in
* USB: 1x 2.0
Flash Layout:
0x0000000-0x0030000 : "bootloader"
0x0030000-0x0040000 : "nvram"
0x0040000-0x0050000 : "factory"
0x0050000-0x1000000 : "firmware"
MAC address:
LAN: factory 0x28
WAN: factory 0x22
2.4G: factory 0x4
5G: factory 0x8004
Installation via **recovery** mode:
1. Download the Asus recovery firmware (windows) tool from
http://dlcdnet.asus.com/pub/ASUS/LiveUpdate/Release/Wireless/Rescue.zip
2. Set your ethernet IP manually 192.168.1.5 / 255.255.255.0 with NO
gateway.
3. Plug in your ethernet to LAN port 1 on the router.
4. Load up the recovery software with the firmware file, but don't press
"Upload" yet.
5. Plug in the router to power WHILE HOLDING the reset button in. While
CONTINUING to hold the button, select "Upload" Continue to hold the
reset button in until it finishes and verifies!
6. If that doesn't work try pressing "Upload" first just before you do
step 5. At some point while holding reset the rescue tool will finally
detect and upload the firmware. That's when you can let go of the
reset button.
7. The router will reboot and not much will happen. Wait a minute or 2.
8. Power off and on the router again. Voila. Set everything your Ethernet
IP back to DHCP (automatically) and you're good to go.
Revert to stock firmware:
1. Install stock image via recovery mode.
Tested-by: Ivan Pavlov <AuthorReflex@gmail.com>
Signed-off-by: Ray Wang <raywang777@foxmail.com>
This adds support for the Renkforce WS-WN530HP3-A ceiling-
mountable Wireless Access Point, which is powered over PoE.
Hardware:
- SoC: Mediatek MT7621DAT
- RAM: 128MiB on SoC
- Flash: 16MiB GigaDevice GD25Q128C
- 2.4Ghz Wifi: Mediatek MT603EN
- 5GHz Wifi: MT613BEN
- Ethernet:
- 1x 1GBit WAN port, passive PoE capable
- 2x 1GBit LAN ports
LEDs: 1x Bi-Color LED (red/blue)
Buttons: 1x Reset Button, 1x Power Button
Installation:
Power on the access point and immedately press the reset
button for 10 seconds. Connect web-browser to 192.168.10.1
and upload sysupgrade image. Flash uploaded image and wait
about 2 minutes for reboot.
Signed-off-by: Birger Koblitz <mail@birger-koblitz.de>
Signed-off-by: Petr Štetiar <ynezz@true.cz> [fixed SoB]
