Specification:
- MT7981 CPU using 2.4GHz and 5GHz WiFi (both AX)
- MT7531 switch
- 512MB RAM
- 128MB NAND flash with two UBI partitions with identical size
- 1 multi color LED (red, green, blue, white) connected via GCA230718
- 3 buttons (WPS, reset, LED on/off)
- 1 1Gbit WAN port
- 4 1Gbit LAN ports
Disassembly:
- There are four screws at the bottom: 2 under the rubber feets, 2 under the label.
- After removing the screws, the white plastic part can be shifted out of the blue part.
- Be careful because the antennas are mounted on the side and the top of the white part.
Serial Interface
- The serial interface can be connected to the 4 pin holes on the side of the board.
- Pins (from front to rear):
- 3.3V
- RX
- TX
- GND
- Settings: 115200, 8N1
MAC addresses:
- WAN MAC is stored in partition "Odm" at offset 0x81
- LAN (as printed on the device) is WAN MAC + 1
- WLAN MAC (2.4 GHz) is WAN MAC + 2
- WLAN MAC (5GHz) is WAN MAC + 3
Flashing via Recovery Web Interface:
- The recovery web interface always flashes to the currently active partition.
- If OpenWrt is flahsed to the second partition, it will not boot.
- Ensure that you have an OEM image available (encrypted and decrypted version). Decryption is described in the end.
- Set your IP address to 192.168.200.10, subnetmask 255.255.255.0
- Press the reset button while powering on the device
- Keep the reset button pressed until the LED blinks red
- Open a Chromium based and goto http://192.168.200.1 (recovery web interface)
- Download openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-recovery.bin
- The recovery web interface always reports successful flashing, even if it fails
- After flashing, the recovery web interface will try to forward the browser to 192.168.0.1 (can be ignored)
- If OpenWrt was flashed to the first partition, OpenWrt will boot (The status LED will start blinking white and stay white in the end). In this case you're done and can use OpenWrt.
- If OpenWrt was flashed to the second partition, OpenWrt won't boot (The status LED will stay red forever). In this case, the following steps are reuqired:
- Start the web recovery interface again and flash the **decrypted OEM image**. This will be flashed to the second partition as well. The OEM firmware web interface is afterwards accessible via http://192.168.200.1.
- Now flash the **encrypted OEM image** via OEM firmware web interface. In this case, the new firmware is flashed to the first partition. After flashing and the following reboot, the OEM firmware web interface should still be accessible via http://192.168.200.1.
- Start the web recovery interface again and flash the OpenWrt recovery image. Now it will be flashed to the first partition, OpenWrt will boot correctly afterwards and is accessible via 192.168.1.1.
Flashing via U-Boot:
- Open the case, connect to the UART console
- Set your IP address to 192.168.200.2, subnet mask 255.255.255.0. Connect to one of the LAN interfaces of the router
- Run a tftp server which provides openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-initramfs-kernel.bin.
- Power on the device and select "7. Load image" in the U-Boot menu
- Enter image file, tftp server IP and device IP (if they differ from the default).
- TFTP download to RAM will start. After a few seconds OpenWrt initramfs should start
- The initramfs is accessible via 192.168.1.1, change your IP address accordingly (or use multiple IP addresses on your interface)
- Perform a sysupgrade using openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-sysupgrade.bin
- Reboot the device. OpenWrt should start from flash now
Revert back to stock using the Recovery Web Interface:
- Set your IP address to 192.168.200.2, subnetmask 255.255.255.0
- Press the reset button while powering on the device
- Keep the reset button pressed until the LED blinks red
- Open a Chromium based and goto http://192.168.200.1 (recovery web interface)
- Flash a decrypted firmware image from D-Link. Decrypting an firmware image is described below.
Decrypting a D-Link firmware image:
- Download https://github.com/RolandoMagico/firmware-utils/blob/M32/src/m32-firmware-util.c
- Compile a binary from the downloaded file, e.g. gcc m32-firmware-util.c -lcrypto -o m32-firmware-util
- Run ./m32-firmware-util M30 --DecryptFactoryImage <OriginalFirmware> <OutputFile>
- Example for firmware M30A1_FW101B05: ./m32-firmware-util M30 --DecryptFactoryImage M30A1_FW101B05\(0725091522\).bin M30A1_FW101B05\(0725091522\)_decrypted.bin
Flashing via OEM web interface is not possible, as it will change the active partition and OpenWrt is only running on the first UBI partition.
Controlling the LEDs:
- The LEDs are controlled by a chip called "GCA230718" which is connected to the main CPU via I2C (address 0x40)
- I didn't find any documentation or driver for it, so the information below is purely based on my investigations
- If there is already I driver for it, please tell me. Maybe I didn't search enough
- I implemented a kernel module (leds-gca230718) to access the LEDs via DTS
- The LED controller supports PWM for brightness control and ramp control for smooth blinking. This is not implemented in the driver
- The LED controller supports toggling (on -> off -> on -> off) where the brightness of the LEDs can be set individually for each on cycle
- Until now, only simple active/inactive control is implemented (like when the LEDs would have been connected via GPIO)
- Controlling the LEDs requires three sequences sent to the chip. Each sequence consists of
- A reset command (0x81 0xE4) written to register 0x00
- A control command (for example 0x0C 0x02 0x01 0x00 0x00 0x00 0xFF 0x01 0x00 0x00 0x00 0xFF 0x87 written to register 0x03)
- The reset command is always the same
- In the control command
- byte 0 is always the same
- byte 1 (0x02 in the example above) must be changed in every sequence: 0x02 -> 0x01 -> 0x03)
- byte 2 is set to 0x01 which disables toggling. 0x02 would be LED toggling without ramp control, 0x03 would be toggling with ramp control
- byte 3 to 6 define the brightness values for the LEDs (R,G,B,W) for the first on cycle when toggling
- byte 7 defines the toggling frequency (if toggling enabled)
- byte 8 to 11 define the brightness values for the LEDs (R,G,B,W) for the second on cycle when toggling
- byte 12 is constant 0x87
Comparison to M32/R32:
- The algorithms for decrypting the OEM firmware are the same for M30/M32/R32, only the keys differ
- The keys are available in the GPL sources for the M32
- The M32/R32 contained raw data in the firmware images (kernel, rootfs), the R30 uses a sysupgrade tar instead
- Creation of the recovery image is quite similar, only the header start string changes. So mostly takeover from M32/R32 for that.
- Turned out that the bytes at offset 0x0E and 0x0F in the recovery image header are the checksum over the data area
- This checksum was not checked in the recovery web interface of M32/R32 devices, but is now active in R30
- I adapted the recovery image creation to also calculate the checksum over the data area
- The recovery image header for M30 contains addresses which don't match the memory layout in the DTS. The same addresses are also present in the OEM images
- The recovery web interface either calculates the correct addresses from it or has it's own logic to determine where which information must be written
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Hardware specification:
SoC: MediaTek MT7986A 4x A53
Flash: ESMT F50L1G41LB 128MB
RAM: W632GU6NB DDR3 256MB
Ethernet: 1x 2.5G + 4x 1G
WiFi1: MT7975N 2.4GHz 4T4R
WiFi2: MT7975PN 5GHz 4T4R
Button: Reset, WPS
Power: DC 12V 2A
Flash instructions:
1. Connect to the router using ssh or telnet,
username: useradmin, password is the web
login password of the router.
2. Use scp to upload bl31-uboot.fip and flash:
"mtd write xxx-preloader.bin spi0.0"
"mtd write xxx-bl31-uboot.fip FIP"
"mtd erase ubi"
3. Connect to the router via the Lan port,
set a static ip of your PC.
(ip 192.168.1.254, gateway 192.168.1.1)
4. Download initramfs image, reboot router,
waiting for tftp recovery to complete.
5. After openwrt boots up, perform sysupgrade.
Note:
1. Back up all mtd partitions before flashing.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 8GB eMMC or 128 MB SPI-NAND
RAM: 256MB
Ethernet: 5x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset
USB: M.2(B-key) for 4G/5G Module
Power: DC 12V 1A
UART: 3.3v, 115200n8
--------------------------
| Layout |
| ----------------- |
| 4 | VCC RX TX GND | <= |
| ----------------- |
--------------------------
The U-boot menu will automatically appear at startup, and then select
the required options through UP/DOWN Key.
NAND Flash and eMMC Flash instructions:
1. Set your computers IP adress to 192.168.1.2.
2. Run a TFTP server providing the sysupgrade.bin image.
3. Power on the router, into the U-Boot menu.
4. Select "2. Upgrade firmware"
5. Update sysupgrade.bin file name, input server IP and input device
IP (if they deviate from the defaults)
6. Wait for automatic startup after burning
Signed-off-by: Allen Zhao <allenzhao@unielecinc.com>
The GL.iNet X3000 and XE3000 are Wi-Fi 6 5G cellular routers, based on
MediaTek MT7981A SoC. The XE3000 is the same device as the X3000,
except for an additional battery.
Specifications:
- SoC: Filogic 820 MT7981A (1.3GHz)
- RAM: DDR4 512M
- Flash: eMMC 8G, MicroSD card slot
- WiFi: 2.4GHz and 5GHz with 6 antennas
- Ethernet:
- 1x LAN (10/100/1000M)
- 1x WAN (10/100/1000/2500M)
- 5G: Quectel RM520N-GL with two nano-SIM card slots
- USB: 1x USB 2.0 port
- UART:
- 3.3V, TX, RX, GND / 115200 8N1
MAC addresses as verified by OEM firmware:
vendor OpenWrt address source
WAN eth0 label factory 0x0a (label)
LAN eth1 label + 1
2g phy0-ap0 label + 2 factory 0x04
5g phy1-ap0 label + 3
Installation via U-Boot rescue:
1. Press and hold reset button while booting the device
2. Wait for the Internet led to blink 5 times
3. Release reset button
4. The rescue page is accessible via http://192.168.1.1
5. Select the OpenWrt sysupgrade image and start upgrade
6. Wait for the router to flash new firmware and reboot
Revert to stock firmware:
1. Download the stock firmware from GL.iNet website
2. Use the method explained above to flash the stock firmware
Switch the modem network port between PCIe and USB interfaces:
1. Connect to the AT commands (/dev/ttyUSB2) port using
e.g. minicom: minicom -D /dev/ttyUSB2
2. Check the current modem mode with 'AT+QCFG="data_interface"':
- 0,0 indicates that the network port uses the USB interface
- 1,0 indicates that the network port uses the PCIe interface
3. Switch the active interface with:
- 'AT+QCFG="data_interface",0,0' to use the USB interface
- 'AT+QCFG="data_interface",1,0' to use the PCIe interface
4. Reboot
Signed-off-by: Jean Thomas <jean.thomas@wifirst.fr>
MT7981B /256MB /16MB SPI (XM25QH128C)
AX 2.4Ghz
AX 5Ghz 160Mhz wide
1Gbit LAN
OEM:
root@RE3000:~# ifconfig |grep HWaddr
br-lan Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0 (label)
br-wan Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
eth0 Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
ra0 Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
ra2 Link encap:Ethernet HWaddr 82:XX:XX:28:XX:X0
rax0 Link encap:Ethernet HWaddr 82:XX:XX:38:XX:X0
rax2 Link encap:Ethernet HWaddr 82:XX:XX:58:XX:X0
OpenWrt
root@OpenWrt:/# ifconfig |grep HW
br-lan Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
eth0 Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
phy0-ap0 Link encap:Ethernet HWaddr 80:XX:XX:08:XX:X0
phy1-ap0 Link encap:Ethernet HWaddr 82:XX:XX:08:XX:X1
tftp Installation via u-boot:
Connect TTL3.3V converter
connector is under the radiator Set speed 115200 8 N 1
Interrupt boot process by holding down-arrow key during boot then
>> 6. Load image
>> 0 - TFTP client (Default)
enter IP adresses and initramfs-kernel.bin
write to flash via sysupgrade or gui
Signed-off-by: Robert Senderek <robert.senderek@10g.pl>
Use newly added support for NVMEM-on-UBI instead of extracting MAC
address and WiFi EEPROM data in userspace.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Use newly added support for NVMEM-on-UBI instead of extracting MAC
address and WiFi EEPROM data in userspace.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Use newly added support for NVMEM-on-UBI instead of extracting MAC
address and WiFi EEPROM data in userspace.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Now that we can reference MMC partitions in device tree, use that
to get rid of Wi-Fi EEPROM and MAC address setup in userspace.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Hardware specification
----------------------
SoC: MediaTek MT7986A 4x A53
Flash: 128MB SPI-NAND, 8GB eMMC
RAM: 2GB DDR4
Ethernet: 2x 2.5GbE (Airoha EN8811H)
WiFi: MediaTek MT7976C 2x2 2.4G + 3x3 5G
Interfaces:
* M.2 Key-M: PCIe 2.0 x2 for NVMe SSD
* M.2 Key-B: USB 3.0 with SIM slot
* front USB 2.0 port
LED: Power, Status, WLAN2G, WLAN5G, LTE, SSD
Button: Reset, internal boot switch
Fan: PWM-controlled 5V fan
Power: 12V Type-C PD
Installation instructions for eMMC
----------------------------------
0. Set boot switch to boot from SPI-NAND (assuming stock rom or immortalwrt
running there).
1. Write GPT partition table to eMMC
Move openwrt-mediatek-filogic-bananapi_bpi-r3-mini-emmc-gpt.bin to
the device /tmp using scp and write it to /dev/mmcblk0:
dd if=/tmp/openwrt-*-r3-mini-emmc-gpt.bin of=/dev/mmcblk0
2. Reboot (to reload partition table)
3. Write bootloader and OpenWrt images
Move files to the device /tmp using scp:
- openwrt-*-bananapi_bpi-r3-mini-emmc-preloader.bin
- openwrt-*-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip
- openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb
- openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb
Write them to the appropriate partitions:
echo 0 > /sys/block/mmcblk0boot0/force_ro
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-preloader.bin of=/dev/mmcblk0boot0
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip of=/dev/mmcblk0p3
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb of=/dev/mmcblk0p4
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb of=/dev/mmcblk0p5
sync
4. Remove the device from power, set boot switch to eMMC and boot into
OpenWrt. The device will come up with IP 192.168.1.1 and assume the
Ethernet port closer to the USB-C power connector as LAN port.
5. If you like to have Ethernet support inside U-Boot (eg. to boot via
TFTP) you also need to write the PHY firmware to /dev/mmcblk0boot1:
echo 0 > /sys/block/mmcblk0boot1/force_ro
dd if=/lib/firmware/airoha/EthMD32.dm.bin of=/dev/mmcblk0boot1
dd if=/lib/firmware/airoha/EthMD32.DSP.bin bs=16384 seek=1 of=/dev/mmcblk0boot1
Installation instructions for NAND
----------------------------------
0. Set boot switch to boot from eMMC (assuming OpenWrt is installed there
by instructions above. Using stock rom or immortalwrt does NOT work!)
1. Write things to NAND
Move files to the device /tmp using scp:
- openwrt-*-bananapi_bpi-r3-mini-snand-preloader.bin
- openwrt-*-bananapi_bpi-r3-mini-snand-bl31-uboot.fip
- openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb
- openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb
Write them to the appropriate locations:
mtd write /tmp/openwrt-*-bananapi_bpi-r3-mini-snand-preloader.bin /dev/mtd0
ubidetach -m 1
ubiformat /dev/mtd1
ubiattach -m 1
volsize=$(wc -c < /tmp/openwrt-*-bananapi_bpi-r3-mini-snand-bl31-uboot.fip)
ubimkvol /dev/ubi0 -N fip -n 0 -s $volsize -t static
ubiupdatevol /dev/ubi0_0 /tmp/openwrt-*-bananapi_bpi-r3-mini-snand-bl31-uboot.fip
cd /lib/firmware/airoha
cat EthMD32.dm.bin EthMD32.DSP.bin > /tmp/en8811h-fw.bin
ubimkvol /dev/ubi0 -N en8811h-firmware -n 1 -s 147456 -t static
ubiupdatevol /dev/ubi0_1 /tmp/en8811h-fw.bin
ubimkvol /dev/ubi0 -n 2 -N ubootenv -s 126976
ubimkvol /dev/ubi0 -n 3 -N ubootenv2 -s 126976
volsize=$(wc -c < /tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb)
ubimkvol /dev/ubi0 -n 4 -N recovery -s $volsize
ubiupdatevol /dev/ubi0_4 /tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb
volsize=$(wc -c < /tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb)
ubimkvol /dev/ubi0 -n 4 -N recovery -s $volsize
ubiupdatevol /dev/ubi0_4 /tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb
3. Remove the device from power, set boot switch to NAND, power up and
boot into OpenWrt.
Partially based on immortalwrt support for the R3 mini, big thanks for
doing the ground work!
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* Switch to all-UBI layout on SPI-NAND
* use fitblk driver instead of uImage.FIT partition parser
* adapt sysupgrade
* bump COMPAT_VERSION
Remove BROKEN mark now that all needed changes are done.
Boards running images generated before this commit will require
full reflash of the bootloader, re-install from SD card is the
easiest way to achieve that.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Hardware
--------
SOC: MediaTek MT7988A (4x Cortex-A73)
RAM: 4 GiB DDR4
Flash: 128 MiB Winbond SPI-NAND
MMC: 8 GiB eMMC *or* microSD (cannot be used both)
ETH: 4x 1GE (1x WAN, 3x LAN)
2x SFP+ (10G, 5G, 2.5G, 1G)
USB: on-board USB 3.2 4-port hub
1x USB 3.2 port (type A connector)
1x M.2 for 4G/5G modem
2x mPCIe for additional modems
WiFi: optional MediaTek MT7996 Wi-Fi 7 module
(using 2x PCIe gen3 x2 on the mPCIe slots and 12V power)
Installation
------------
1. Decompress and write the sdcard image to a micro SD card and use that
to boot the R4 (both dip switches in upper position).
2. Use the bootloader menu accessible via the serial console to install
to SPI-NAND.
3. Switch to boot from SPI-NAND and install to eMMC.
Known issues
------------
- The RST button is hard-wired to the SoC reset and can't be read
from software. This can be changed by modifying the board (ie.
moving a 0-ohm resistor). However, in order to maintain compatibility
with the board as it comes from factory the button isn't used by
OpenWrt and the WPS button is used as factory/reset button instead.
- various small things still need to be fixed in DT
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Comfast CF-E393AX is a dual-band Wi-Fi 6 POE ceiling mount access point.
Oem firmware is a custom openwrt 21.02 snapshot version.
We can gain access via ssh once we remove the root password.
Hardware specification:
SoC: MediaTek MT7981A 2x A53
Flash: 128 MB SPI-NAND
RAM: 256MB DDR3
Ethernet: 1x 10/100/1000 Mbps built-in PHY (WAN)
1x 10/100/1000/2500 Mbps MaxLinear GPY211C (LAN)
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976D
LEDS: 1x (Red, Blue and Green)
Button: Reset
UART: 3.3v, 115200n8
--------------------------
| Layout |
| ----------------- |
| 4 | VCC GND TX RX | <= |
| ----------------- |
--------------------------
Gain SSH access:
1. Login into web interface (http://apipaddress/computer/login.html),
and download the
configuration(http://apipaddress/computer/config.html).
2. Rename downloaded backup config - 'backup.file to backup.tar.gz',
Enter 'fakeroot' command then decompress the configuration:
tar -zxf backup.tar.gz
3. Edit 'etc/shadow', update (remove) root password:
With password =
'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
to
Without password =
'root::0:99999:7:::'
'root::0:99999:7:::'
4. Repack 'etc' directory back to a new backup file:
tar -zcf backup-ssh.tar.gz etc/
5. Rename new config tar.gz file to 'backup-ssh.file'
Exit fakeroot - 'exit'
6. Upload new configuration via web interface, now you
can SSH with the following:
'ssh -vv -o HostKeyAlgorithms=+ssh-rsa \
-o PubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.10.1'.
Backup the mtd partitions
- https://openwrt.org/docs/guide-user/installation/generic.backup
7. Copy openwrt factory firmware to the tmp folder to install via ssh:
'scp -o HostKeyAlgorithms=+ssh-rsa \
-o PubkeyAcceptedAlgorithms=+ssh-rsa \
*-mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin \
root@192.168.10.1:/tmp/'
'sysupgrade -n -F \
/tmp/*--mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin'
8. Once led has stopped flashing - Connect via ssh with the
default openwrt ip address - 'ssh root@192.168.1.1'
9. SSH copy the openwrt sysupgrade firmware and upgrade
as per the default instructions.
Signed-off-by: David Bentham <db260179@gmail.com>
This reverts commit dcdcfc1511.
This is a firmware for third-party u-boot mod, which should not
be carried here by us.
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 16MB NOR
RAM: 256MB
Ethernet: 2x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset
Power: DC 12V 1A, PoE 802.3af 48V
Flash instructions:
Option #1 - SSH
I was able to SSH into the stock firmware of my device.
1. Attach the router to the network
2. Use scp (-O) to copy the sysupgrade image
3. Connect using SSH and run `sysupgrade -n`
Option #2 - U-Boot
One way to use the bootloader for flashing is using TFTP:
1. Connect to the router using an ethernet cable
2 Spin up a TFTP server serving the sysupgrade file
3. Open the case and attach a UART
4. Attach power to the router and interrupt the countdown by pressing
any key
5. Select option #2 (Upgrade firmware)
6. Enter IP address information and image name
7. Wait patiently
Co-Authored-By: Enrique Rodríguez Valencia <enrique.rodriguez@galgus.net>
Co-Authored-By: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
(based on support for ASUS RT-AX59U by liushiyou006)
SOC: MediaTek MT7986
RAM: 512MB DDR4
FLASH: 128MB SPI-NAND (Winbond W25N01GV)
WIFI: Mediatek MT7986 DBDC 802.11ax 2.4/5 GHz
ETH: MediaTek MT7531 Switch
UART: 3V3 115200 8N1 (Pinout silkscreened / Do not connect VCC)
Upgrade from AsusWRT to OpenWRT using UART
Download the OpenWrt initramfs image.
Copy the image to a TFTP server reachable at 192.168.1.70/24. Rename the image to rtax59u.bin.
Connect the PC with TFTP server to the RT-AX59U.
Set a static ip on the ethernet interface of your PC.
(ip address: 192.168.1.70, subnet mask:255.255.255.0)
Conect to the serial console, interrupt the autoboot process by pressing '4' when prompted.
Download & Boot the OpenWrt initramfs image.
$ setenv ipaddr 192.168.1.1
$ setenv serverip 192.168.1.70
$ tftpboot 0x46000000 rtax59u.bin
$ bootm 0x46000000
Wait for OpenWrt to boot. Transfer the sysupgrade image to the device using scp and install using sysupgrade.
$ sysupgrade -n <path-to-sysupgrade.bin>
Upgrade from AsusWRT to OpenWRT using WebUI
Download transit TRX file from https://drive.google.com/drive/folders/1A20QdjK7Udagu31FSszpWAk8-cGlCwsq
Upgrade firmware from WebUI (192.168.50.1) using downloaded TRX file
Wait for OpenWRT to boot (192.168.1.1).
Upgrade system with sysupgrade image using luci or uploading it through scp and executing sysupgrade command
MAC Address for WLAN 5g is not following the same algorithm as in AsusWRT.
We have increased by one the WLAN 5g to avoid collisions with other networks from WLAN 2g
when bit 28 is already set.
: Stock : OpenWrt
WLAN 2g (1) : C8:xx:xx:0D:xx:D4 : C8:xx:xx:0D:xx:D4
WLAN 2g (2) : : CA:xx:xx:0D:xx:D4
WLAN 2g (3) : : CE:xx:xx:0D:xx:D4
WLAN 5g (1) : CA:xx:xx:1D:xx:D4 : CA:xx:xx:1D:xx:D5
WLAN 5g (2) : : CE:xx:xx:1D:xx:D5
WLAN 5g (3) : : C2:xx:xx:1D:xx:D5
WLAN 2g (1) : 08:xx:xx:76:xx:BE : 08:xx:xx:76:xx:BE
WLAN 2g (2) : : 0A:xx:xx:76:xx:BE
WLAN 2g (3) : : 0E:xx:xx:76:xx:BE
WLAN 5g (1) : 0A:xx:xx:76:xx:BE : 0A:xx:xx:76:xx:BF
WLAN 5g (2) : : 0E:xx:xx:76:xx:BF
WLAN 5g (3) : : 02:xx:xx:76:xx:BF
Signed-off-by: Xavier Franquet <xavier@franquet.es>
Specifications:
SoC: MediaTek MT7981B
RAM: 256MiB
Flash: SPI-NAND 128 MiB
Switch: 1 WAN, 3 LAN (Gigabit)
Buttons: Reset, Mesh
Power: DC 12V 1A
WiFi: MT7976CN
UART: 115200n8
UART Layout:
VCC-RX-TX-GND
No. of Antennas: 6
Note: Upon opening the router, only 5 antennas were connected
to the mainboard.
Led Layout:
Power-Mesh-5gwifi-WAN-LAN3-LAN2-LAN1-2gWiFi
Buttons:
Reset-Mesh
Installation:
A. Through OpenWrt Dashboard:
If your router comes with OpenWrt preinstalled (modified by the seller),
you can easily upgrade by going to the dashboard (192.168.1.1) and then
navigate to System -> Backup/Flash firmware, then flash the firmware
B. Through TFTP
Standard installation via UART:
1. Connect USB Serial Adapter to the UART, (NOTE: Don't connect the VCC pin).
2. Power on the router. Make sure that you can access your router via UART.
3. Restart the router then repeatedly press ctrl + c to skip default boot.
4. Type > bootmenu
5. Press '2' to select upgrade firmware
6. Press 'Y' on 'Run image after upgrading?'
7. Press '0' and hit 'enter' to select TFTP client (default)
8. Fill the U-Boot's IP address and TFTP server's IP address.
9. Finally, enter the 'firmware' filename.
Signed-off-by: Ian Oderon <ianoderon@gmail.com>
The Bonanza Peak series are a couple of MT7986-powered 2.5 GBit/s
Wi-Fi 6 residential gateway, access point and mesh router products.
All of them come with an eMMC to boot from, are powered via USB-C and
got a USB 3.0 type-A port. All of them got a Dialog (Renesas) DA14531
Bluetooth module connected via UART. If the device was previously
running stock firmware, the BT chip's internal flash has been loaded
with firmware and it can be attached using hciattach when using
OpenWrt.
SOC: MediaTek MT7986A
RAM: 2 GiB DDR4
eMMC: 8 GiB
Bluetooth: BLE5 (DA14531)
Serial: 3.3V level, 115200 8n1 on 4-pin connector
* SDG-8612 - Dual-band RJ-45 gateway
2x 2.5G MaxLinear PHY for WAN port
3x 1GE LAN ports via MT7531 switch
* SDG-8614 - Dual-band SFP gateway
1x SFP cage with up to 2.5G speed
1x 2.5G MaxLinear PHY for LAN port
3x 1GE LAN ports via MT7531 switch
* SDG-8622 - Tri-band mesh router
2x 2.5G MaxLinear PHY
The MT7986 2G and 5G are used as 2G and 5G high band.
There’s a MT7915 PCIe card for 5G low band.
* SDG-8632 - Tri-band mesh router with 6 GHz
2x 2.5G MaxLinear PHY
The MT7986 serves the 2G and 6G bands.
There’s a MT7915 PCIe card for 5G.
Installation via U-Boot serial console:
0. setup TFTP server with IP 192.168.1.10/24, place initramfs image
renamed to openwrt.XXX where XXX is the internal product number:
SDG-8612: XXX = 412
SDG-8614: XXX = 414
SDG-8622: XXX = 422
SDG-8632: XXX = 432
1. connect to the serial console and power on the device.
Interrupt the bootloader by pressing 'st'
2. setenv boot_mode openwrt ; saveenv
3. run boot1
Load firmware via TFTP and write to flash
4. run boot2
Now OpenWrt initramfs should boot
5. upload sysupgrade.bin via scp to /tmp
6. sysupgrade
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Acelink EW-7886CAX is an MT7986A (AKA Filogic 830) based access point.
It has 512 MiB of RAM, one 2.5 Gbps PoE (802.3at) Ethernet port and
on-SoC Wi-Fi. There is no printed MAC label (on my unit).
My unit came with Mediatek's firmware (based on OpenWrt 21.02)
installed. It was possible to simply upgrade using OpenWrt's sysupgrade
tool.
Another verified upgrade method is using U-Boot (requires UART). During
every boot there is "U-Boot Boot Menu". Selecting option "2. Upgrade
firmware" allows using U-Boot's tftp client to load and flash factory
image.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Confiabits MT7981 is a Wi-Fi 6 router based on MediaTek MT7981.
Specification:
- SoC: MediaTek MT7981B
- CPU: 2x 1.3 GHz Cortex-A53
- Flash: 128 MiB SPI NAND
- RAM: 256 MiB
- WLAN: 2.4 GHz, 5 GHz (MediaTek MT7976CN, 802.11ax)
- Ethernet: 4x 10/100/1000 Mbps MT7531AE (3xLAN, 1xWAN)
- USB 2.0 port
- Buttons: 1 Reset button, 1 Mesh button.
- LEDs: 7x light-blue, 2x warm-white
- Serial console: internal 4-pin header, 115200 8n1
- Power: 12 VDC, 1.5 A
MAC addresses in stock firmware and in this commit:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| WAN | 00:0c:43:xx:xx:e1 | label+1 |
| LAN | 00:0c:43:xx:xx:e0 | label |
| WLAN 2g | 00:0c:43:xx:xx:e0 | label |
| WLAN 5g | 02:0c:43:xx:xx:e0 | |
+---------+-------------------+-----------+
The label MAC was found in 'Factory', 0x4
Installation:
The stock firmware is OpenWrt-based. If you can reach LuCI or SSH, just use the sysupgrade image
with the 'Keep settings' option turned off.
Signed-off-by: Luis Mita <luis@luismita.com>
Hardware
--------
SoC: MediaTek MT7981BA
RAM: 1GB DDR4 (NANYA NT5AD512M16C4-JR)
MMC: 8GB eMMC (Samsung 8GTF4R)
ETH: 1000Base-T LAN (ePHY)
2500Base-T WAN (MaxLinear GPY211C)
BTN: 1x Reset Button
LED: System (blue/white)
VPN (white)
USB: 1x USB-A (USB 3.0)
UART: 115200 8N1 - Pinout on board next to LAN port
Don't connect 3.3V!
Known Issues
------------
U-Boot vendor recovery does not seem to accept any images, neither
GL.iNet images nor OpenWrt images. Recovery requires serial access!
Installation
------------
Upload the OpenWrt sysupgrade image to the Gl.iNet Web-UI. Make sure to
not retain existing settings.
Signed-off-by: David Bauer <mail@david-bauer.net>
The PGIO configuration should be added for the ZBT-Z8102AX and not the ZBT-Z8103AX
Fixes: c8c2f52262 ("mediatek: add support for Zbtlink ZBT-Z8102AX")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The flash procedure is similar to the Xiaomi AX6000 router.
Load openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb from original Zyxel U-Boot:
tftpboot openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb
bootm 0x46000000
Load mtd-rw
insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1
Format ubi and create ubootenv partitions
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
Copy openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb to /tmp and create recovery partition.
If your recovery image is larger than 10MiB, size the recovery partition accordingly to make it fit.
ubimkvol /dev/ubi0 -n 2 -N recovery -s 10MiB
ubiupdatevol /dev/ubi0_2 openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb
Copy preloader and uboot to /tmp and write them in the mtd
mtd write /tmp/openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-preloader.bin bl2
mtd write /tmp/openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fip fip
Now write the firmware:
sysupgrade -n /tmp/openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-squashfs-sysupgrade.itb
To create a correct BL2, I had to add a profile for 'spim:4k+256' as I could not find a way to value the variable 'NAND_TYPE'.
Features and fixes from hitech95 tree has been squashed, I'm attaching his commit message:
The Power LED was not working correctly and not reacting
to the boot process and statuses.
The board has space (footprint) for an unpopulated Zigbee chip,
while we dont know the device model having this chip populated
we have to assure that the common dts doesnt enable
interfaces that share pins with such device.
In this instance the PCIe and the uart1 and uart2 are disabled.
Some of the control PCIE pins seems to be used for the Zigbee chip,
UART1 seems to be used as a flash port while UART2 should be the
main comunication interface of Zigbee chip.
The Zigbee chip should be a EFR32MG21. But the pins used for UART
seems to be not on standard PINS used by other adapters.
So it cannot run firmwares shared on the web.
But it should be possible to build a custom firmware with
the corrtect pinmux.
This commit also contains the following squashed commit from hitech95
- mediatek: fix sysupgrade for Zyxel EX7601-T0 ubootmod
Changes and fixes added in common board:
- added aliases for boot status leds.
- added aliases for the mac-label-device.
- added pin claims for core features (MDIO and UART 0)
- added default LEDs configuration (01_leds)
- added default network configuration (02_network)
- added missing kmod-usb3 module for USB3
- fixed LED names
- fixed reset pin for SLIC chip
- removed unused pinmux configurations and devices
- fix LAN (switch) port numbering
- using nvmem cells for wifi eeprom, dropping deprecated "mediatek,mtd-eeprom"
- proper factory partition and mac address handling
- cleaned up spi_nand sections and partition
Changes and fixxes added in stock layout:
- added NMBM, if u-boot has it, the kernel must be informed.
Co-authored-by: Nicolò Veronese <nicveronese@gmail.com>
Co-developed-by: Nicolò Veronese <nicveronese@gmail.com>
Signed-off-by: Nicolò Veronese <nicveronese@gmail.com>
Signed-off-by: Valerio 'ftp21' Mancini <ftp21@ftp21.eu>
Specifications:
SoC: MediaTek MT7981B
RAM: 1024MiB
Flash: SPI-NAND 128 MiB
Switch: 1 WAN, 4 LAN (Gigabit)
USB: two M.2 slots for 5G modems via USB 3.0 hub, external USB 3.0 port
Buttons: Reset, Mesh
Power: DC 12V 1A
WiFi: MT7976CN
UART: 115200n8
UART Layout:
VCC-RX-TX-GND
Installation:
A. Through OpenWrt Dashboard:
If your router comes with OpenWrt preinstalled (modified by the seller),
you can easily upgrade by going to the dashboard (192.168.1.1) and then
navigate to System -> Backup/Flash firmware, then flash the firmware
B. Through TFTP
Standard installation via UART:
1. Connect USB Serial Adapter to the UART, (NOTE: Don't connect the VCC pin).
2. Power on the router. Make sure that you can access your router via UART.
3. Restart the router then repeatedly press ctrl + c to skip default boot.
4. Type > bootmenu
5. Press '2' to select upgrade firmware
6. Press 'Y' on 'Run image after upgrading?'
7. Press '0' and hit 'enter' to select TFTP client (default)
8. Fill the U-Boot's IP address and TFTP server's IP address.
9. Finally, enter the 'firmware' filename.
Based on patch adding support for similar Zbtlink ZBT-Z8103AX device by
Ian Ishmael C. Oderon.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: Winbond 128MB
RAM: DDR3 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset
Power: DC 12V 1A
Flash instructions:
1. Connect to your PC via the Gigabit port of the router,
set a static ip on the ethernet interface of your PC.
(ip 192.168.1.254, gateway 192.168.1.1)
2. Attach UART, pause at u-boot menu.
3. Select "Upgrade ATF BL2", then use preloader.bin
4. Select "Upgrade ATF FIP", then use bl31-uboot.fip
5. Download the initramfs image, and type "reset",
waiting for tftp recovery to complete.
6. After openwrt boots up, perform sysupgrade.
Note:
1. Since NMBM is disabled, we must back up all partitions.
2. Although we can upgrade new firmware in the stock firmware,
we need the special fit image signature of MediaTek and
dual boot (hack kernel) to make u-boot boot it. So just
abandon these hacks and flash it via the serial port.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Hardware
========
SOC: MediaTek MT7986
RAM: 512MB DDR3
FLASH: 256MB SPI-NAND
WIFI: Mediatek MT7986 DBDC 802.11ax 2.4/5 GHz 4T4R
ETH: MediaTek MT7530 Switch (LAN)
MaxLinear GPY211C 2.5 N-Base-T PHY (WAN)
MaxLinear GPY211C 2.5 N-Base-T PHY (LAN)
UART: 3V3 115200 8N1 (Do not connect VCC)
USB 3.1
Installation
============
Download the OpenWrt initramfs image. Copy the image to a TFTP server
reachable at 192.168.1.70/24. Rename the image to TUF-AX6000.bin.
Connect to the serial console, interrupt the auto boot process by
pressing '4' when prompted or press '1' and set client IP, server
IP and name of the image.
yOU don't need to open the case or even soldering anything.
use three goldpin wires, remove their plastic cover and connect
them to the console pinout via the case holes.
You can see three holes
From Bottom: RX, TX, Ground - partially covered
Download & Boot the OpenWrt initramfs image.
In case of option '4'
$ setenv ipaddr 192.168.1.1
$ setenv serverip 192.168.1.70
$ tftpboot 0x46000000 TUF-AX6000.bin
$ bootm 0x46000000
In case of option '1'
1: Load System code to SDRAM via TFTP.
Please Input new ones /or Ctrl-C to discard
Input device IP (192.168.1.1) ==:
Input server IP (192.168.1.70) ==:
Input Linux Kernel filename (TUF-AX6000.trx) ==:
Wait for OpenWrt to boot. Transfer the sysupgrade
image to the device using scp and install using sysupgrade.
$ sysupgrade -n <path-to-sysupgrade.bin>
Missing features
================
2.5Gb LAN port LED is ON during boot or when the LAN cable is disconnected
The cover yellow light is not supported. (only blue one)
Signed-off-by: Patryk Kowalczyk <patryk@kowalczyk.ws>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 64GB eMMC or 128 MB SPI-NAND
RAM: 512MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, Mesh
Power: DC 12V 1A
- UART: 3.3v, 115200n8
--------------------------
| Layout |
| ----------------- |
| 4 | GND TX VCC RX | <= |
| ----------------- |
--------------------------
Gain SSH access:
1. Login into web interface, and download the configuration.
2. Enter fakeroot, decompress the configuration:
tar -zxf cfg_export_config_file.conf
3. Edit 'etc/config/dropbear', set 'enable' to '1'.
4. Edit 'etc/shadow', update (remove) root password:
'root::19523:0:99999:7:::'
5. Repack 'etc' directory:
tar -zcf cfg_export_config_file.conf etc/
* If you find an error about 'etc/wireless/mediatek/DBDC_card0.dat',
just ignore it.
6. Upload new configuration via web interface, now you can SSH to RAX3000M.
Check stroage type:
Check the label on the back of the device:
"CH EC CMIIT ID: xxxx" is eMMC version
"CH CMIIT ID: xxxx" is NAND version
eMMC Flash instructions:
1. SSH to RAX3000M, and backup everything, especially 'factory' part.
('data' partition can be ignored, it's useless.)
2. Write new GPT table:
dd if=openwrt-mediatek-filogic-cmcc_rax3000m-emmc-gpt.bin of=/dev/mmcblk0 bs=512 seek=0 count=34 conv=fsync
3. Erase and write new BL2:
echo 0 > /sys/block/mmcblk0boot0/force_ro
dd if=/dev/zero of=/dev/mmcblk0boot0 bs=512 count=8192 conv=fsync
dd if=openwrt-mediatek-filogic-cmcc_rax3000m-emmc-preloader.bin of=/dev/mmcblk0boot0 bs=512 conv=fsync
4. Erase and write new FIP:
dd if=/dev/zero of=/dev/mmcblk0 bs=512 seek=13312 count=8192 conv=fsync
dd if=openwrt-mediatek-filogic-cmcc_rax3000m-emmc-bl31-uboot.fip of=/dev/mmcblk0 bs=512 seek=13312 conv=fsync
5. Set static IP on your PC:
IP 192.168.1.254, GW 192.168.1.1
6. Serve OpenWrt initramfs image using TFTP server.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt has booted, perform sysupgrade.
9. Additionally, if you want to have eMMC recovery boot feature:
(Don't worry! You will always have TFTP recovery boot feature.)
dd if=openwrt-mediatek-filogic-cmcc_rax3000m-initramfs-recovery.itb of=/dev/mmcblk0p4 bs=512 conv=fsync
NAND Flash instructions:
1. SSH to RAX3000M, and backup everything, especially 'Factory' part.
2. Erase and write new BL2:
mtd erase BL2
mtd write openwrt-mediatek-filogic-cmcc_rax3000m-nand-preloader.bin BL2
3. Erase and write new FIP:
mtd erase FIP
mtd write openwrt-mediatek-filogic-cmcc_rax3000m-nand-bl31-uboot.fip FIP
4. Set static IP on your PC:
IP 192.168.1.254, GW 192.168.1.1
5. Serve OpenWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After OpenWrt has booted, erase UBI volumes:
ubidetach -p /dev/mtd0
ubiformat -y /dev/mtd0
ubiattach -p /dev/mtd0
8. Create new ubootenv volumes:
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Additionally, if you want to have NAND recovery boot feature:
(Don't worry! You will always have TFTP recovery boot feature.)
ubimkvol /dev/ubi0 -n 2 -N recovery -s 20MiB
ubiupdatevol /dev/ubi0_2 openwrt-mediatek-filogic-cmcc_rax3000m-initramfs-recovery.itb
10. Perform sysupgrade.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Add build for the MTK3943 reference board for MT7981B+MT7976C.
**Hardware specification:**
- SoC: MediaTek MT7981B 2x A53
- Flash: various options
- RAM: 256MB DDR3
- Ethernet: 4 x 10/100/1000 Mbps via MT7531AE switch
EITHER 1 x 10/100/1000 Mbps built-in PHY
OR 1 x 10/100/1000/2500 Mbps MaxLinear GPY211C
- Switch: MediaTek MT7531AE
- WiFi: MediaTek MT7976C
- Button: RST, WPS
**Flash instructions for SPIM-NAND:**
- write *mt7981-rfb-spim-nand-preloader.bin to 'BL2' partition
- write *mt7981-rfb-spim-nand-bl31-uboot.fip to 'FIP' partition
- erase 'ubi' partition
- reset board
- create ubootenv and ubootenv2 UBI volumes in U-Boot
- edit environment and set bootcmd, e.g.
setenv bootconf 'config-1#mt7981-rfb-spim-nand#mt7981-rfb-mxl-2p5g-phy-eth1'
setenv bootcmd 'ubi read $loadaddr fit; bootm $loadaddr#$bootconf'
- load initramfs image via TFTP:
setenv serverip 192.168.1.254
setenv ipaddr 192.168.1.1
setenv bootfile openwrt-mediatek-filogic-mediatek_mt7981-rfb-initramfs.itb
saveenv ; saveenv
tftpboot
bootm $loadaddr#$bootconf
- Now use sysupgrade to write OpenWrt firmware to flash.
SNFI-NAND, SPIM-NOR and eMMC all work very similar, a bootable SD card image
is also being generated. However, as the board I've been provided only comes
with SPIM-NAND all other boot media are untested.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
**Hardware specification:**
- SoC: MediaTek MT7981B 2x A53
- Flash: ESMT F50L1G41LB 128MB
- RAM: Nanya NT5CC128M16JR-EK 256MB
- Ethernet: 4 x 10/100/1000 Mbps
- Switch: MediaTek MT7531AE
- WiFi: MediaTek MT7976C
- Button: Reset, Mesh
- Power: DC 12V 1A
- UART: 3.3v, 115200n8
| Layout: |
| :-------- |
| <Antenna> |
| VCC |
| GND |
| Tx |
| Rx |
**Flash instructions:**
1. Rename `openwrt-mediatek-filogic-cetron_ct3003-squashfs-factory.bin` to `factory.bin`.
2. Upload the `factory.bin` using the device's Web interface.
3. Click the upgrade button and wait for the process to finish.
4. Access the OpenWrt interface using the same password.
5. Use the 'Restore' function to reset the firmware to its initial state.
**Notes:**
If you plan to recovery the stock firmware in the future, it's advisable
to connect the device via the serial port and enter failsafe mode to
back up all the MTD partitions before proceeding the steps above.
Signed-off-by: Patricia Lee <patricialee320@gmail.com>
When adapting the network configuration for MT7988 RFB a stray quote
was left in a script. Remove it to fix generating the default network
configuration.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Switch to OpenWrt uImage.FIT bootmethod and include various bootloader
artifacts with the generated binaries.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Hardware
--------
SOC: MediaTek MT7986A
RAM: 1GB DDR4
FLASH: 4GB eMMC
WiFi: 2x2 2.4 GHz 802.11 b/g/n/ax MT7916 DBDC
4x4 5 GHz 802.11 a/n/ac/ax MT7986
2x2 6 GHz 802.11ax MT7916 DBDC
ETH: 4x LAN 1Gbit/s (MT7531)
1x WAN 2.5Gbit/s (GPY211)
BTN: RESET, WPS
LED: Antenna LEDs (GPIO)
Mood-LED (Kinetic KTD2601) - unsupported
UART: Header nest to USB port - 3V3 115200 8N1
[BUTTON] GND - RX - TX [USB]
Installation
------------
1. Connect to the device using serial console.
2. Interrupt the Autoboot process when promted by sending '0' twice.
3. Serve the OpenWrt initramfs image using TFTP at 192.168.1.66. Name
the image "predator.bin" and conenct the TFTP server to the routers
LAN port.
4. Configure U-Boot to allow loading unsigned images from MMC
$ setenv bootcmd 'mmc read 0x40000000 0x00004400 0x0010000;
fdt addr $(fdtcontroladdr); fdt rm /signature; bootm 0x40000000';
saveenv
5. Transfer the image from U-Boot
$ setenv serverip 192.168.1.66; setenv ipaddr 192.168.1.1;
tftpboot 0x46000000 predator.bin; fdt addr $(fdtcontroladdr);
fdt rm /signature; bootm
6. Wait for OpenWrt to boot
7. Transfer the OpenWrt sysupgrade image to the router using scp.
8. Install OpenWrt using sysupgrade.
Signed-off-by: David Bauer <mail@david-bauer.net>
Because this device enable NMBM by default, most users use custom
U-Boot with NMBM-Enabled in Chinese forums.
This layout is the same as the ubootmod layout but enabling NMBM.
Signed-off-by: Hank Moretti <mchank9999@gmail.com>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: ESMT F50L1G41LB 128MB
RAM: NT52B128M16JR-FL 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, Mesh
Power: DC 12V 1A
Flash instructions:
1. Get ssh access
Check this link: https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000ne/153769/22
2. Backup import partitions
```
dev: size erasesize name
mtd1: 00100000 00020000 "BL2"
mtd2: 00040000 00020000 "Nvram"
mtd3: 00040000 00020000 "Bdata"
mtd4: 00200000 00020000 "Factory"
mtd5: 00200000 00020000 "FIP"
mtd8: 02200000 00020000 "ubi"
mtd9: 02200000 00020000 "ubi1"
mtd12: 00040000 00020000 "KF"
```
Use these commands blow to backup your stock partitions.
```
nanddump -f /tmp/BL2.bin /dev/mtd1
nanddump -f /tmp/Nvram.bin /dev/mtd2
nanddump -f /tmp/Bdata.bin /dev/mtd3
nanddump -f /tmp/Factory.bin /dev/mtd4
nanddump -f /tmp/FIP.bin /dev/mtd5
nanddump -f /tmp/ubi.bin /dev/mtd8
nanddump -f /tmp/KF.bin /dev/mtd12
```
Then, transfer them to your computer via scp, netcat, tftp
or others and keep them in a safe place.
3. Setup Nvram
Get the current stock: `cat /proc/cmdline`
If you find `firmware=0` or `mtd=ubi`, use these commands:
```
nvram set boot_wait=on
nvram set uart_en=1
nvram set flag_boot_rootfs=1
nvram set flag_last_success=1
nvram set flag_boot_success=1
nvram set flag_try_sys1_failed=0
nvram set flag_try_sys2_failed=0
nvram commit
```
If you find `firmware=1` or `mtd=ubi1`, use these commands:
```
nvram set boot_wait=on
nvram set uart_en=1
nvram set flag_boot_rootfs=0
nvram set flag_last_success=0
nvram set flag_boot_success=1
nvram set flag_try_sys1_failed=0
nvram set flag_try_sys2_failed=0
nvram commit
```
4. Flash stock-initramfs-factory.ubi
If you find `firmware=0` or `mtd=ubi`:
`ubiformat /dev/mtd9 -y -f /tmp/stock-initramfs-factory.ubi`
If you find `firmware=1` or `mtd=ubi1`:
`ubiformat /dev/mtd8 -y -f /tmp/stock-initramfs-factory.ubi`
Then reboot your router, it should boot to the openwrt
initramfs system now.
5. Setup uboot-env
Now it will be setup automatically in upgrade process,
you can skip this step.
If your `fw_setenv` did not work, you need run this command:
`echo "/dev/mtd1 0x0 0x10000 0x20000" > /etc/fw_env.config`
Then setup uboot-env:
```
fw_setenv boot_wait on
fw_setenv uart_en 1
fw_setenv flag_boot_rootfs 0
fw_setenv flag_last_success 1
fw_setenv flag_boot_success 1
fw_setenv flag_try_sys1_failed 8
fw_setenv flag_try_sys2_failed 8
fw_setenv mtdparts "nmbm0:1024k(bl2),256k(Nvram),256k(Bdata),
2048k(factory),2048k(fip),256k(crash),256k(crash_log),
34816k(ubi),34816k(ubi1),32768k(overlay),12288k(data),256k(KF)"
```
6. Flash stock-squashfs-sysupgrade.bin
Use shell command:
`sysupgrade -n /tmp/stock-squashfs-sysupgrade.bin`
Or go to luci web.
If you need to change to Openwrt U-Boot layout, do next. If you
do not need, please ignore it.
Change to OpenWrt U-Boot:
1. Flash ubootmod-initramfs-factory.ubi
Check mtd partitions: `cat /proc/mtd`
```
mtd7: 00040000 00020000 "KF"
mtd8: 02200000 00020000 "ubi_kernel"
mtd9: 04e00000 00020000 "ubi"
```
Run following command:
`ubiformat /dev/mtd8 -y -f /tmp/ubootmod-initramfs-factory.ubi`
Then reboot your router, it should boot to the openwrt initramfs
system now.
2. Check mtd again
```
mtd7: 00040000 00020000 "KF"
mtd8: 07000000 00020000 "ubi"
```
Make sure mtd8 is ubi.
3. Install kmod-mtd-rw
Run command: `opkg update && opkg install kmod-mtd-rw`
Or get it in openwrt server, or build it yourself, then install
it manually
Then run this command:
`insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1`
4. Clean up pstore
Run Command: `rm -f /sys/fs/pstore/*`
5. Format ubi and create new ubootenv volume
```
ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
```
6. (Optional) Add recovery boot feature.
```
ubimkvol /dev/ubi0 -n 2 -N recovery -s 10MiB
ubiupdatevol /dev/ubi0_2 /tmp/ubootmod-initramfs-recovery.itb
```
7. Flash Openwrt U-Boot
```
mtd write /tmp/ubootmod-preloader.bin BL2
mtd write /tmp/ubootmod-bl31-uboot.fip FIP
```
6. Flash ubootmod-squashfs-sysupgrade.itb
Use shell command:
`sysupgrade -n /tmp/ubootmod-squashfs-sysupgrade.itb`
Or go to luci web.
Now everything is done, Enjoy!
Go Back to stock from Openwrt U-Boot:
1. Force flash ubootmod-initramfs-recovery.itb
Use shell command:
`sysupgrade -F -n /tmp/ubootmod-initramfs-recovery.itb`
Or go to luci web.
Then it should boot to the openwrt initramfs system now.
2. Format ubi and Nvram
```
ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8
mtd erase Nvram
```
3. Install kmod-mtd-rw
Run command: `opkg update && opkg install kmod-mtd-rw`
Or get it in openwrt server, or build it yourself, then install
it manually
Then run this command:
`insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1`
4. Flash stock U-Boot and ubi
```
mtd write /tmp/BL2.bin BL2
mtd write /tmp/FIP.bin FIP
mtd write /tmp/ubi.bin ubi
```
Then reboot your router, waiting it finished rollback in minutes.
Go Back to stock from stock layout Openwrt:
Just run command: `ubiformat /dev/mtd8 -y -f /tmp/ubi.bin`
Then reboot your router, waiting it finished rollback in minutes.
Notes:
1. Openwrt U-Boot and ubootmod openwrt did not enable NMBM.
Please make your backup safe.
Signed-off-by: Hank Moretti <mchank9999@gmail.com>
Hardware
--------
CPU: Mediatek MT7981
RAM: 512M DDR4
FLASH: 256M NAND
ETH: MaxLinear GPY211 (2.5GbE N Base-T)
WiFi: Mediatek MT7981 (2.4GHz 2T2R:2 5GHz 3T3R:2 802.11ax)
BTN: 1x Reset
LED: 1x Multi-Color
UART Console
------------
Available below the rubber cover next to the ethernet port.
Settings: 115200 8N1
Layout:
<12V> <LAN> GND-RX-TX-VCC
Logic-Level is 3V3. Don't connect VCC to your UART adapter!
Installation Web-UI
-------------------
Upload the Factory image using the devices Web-Interface.
As the device uses a dual-image partition layout, OpenWrt can only
installed on Slot A. This requires the current active image prior
flashing the device to be on Slot B.
In case this is not the case, OpenWrt will boot only one time, returning
to the ZyXEL firmware the second boot.
If this happens, first install a ZyXEL firmware upgrade of any version
and install OpenWrt after that.
Installation TFTP / Recovery
----------------------------
This installation routine is especially useful in case of a bricked
device.
Attach to the UART console header of the device. Interrupt the boot
procedure by pressing Enter.
The bootloader has a reduced command-set available from CLI, but more
commands can be executed by abusing the atns command.
Boot a OpenWrt initramfs image available on a TFTP server at
192.168.1.66. Rename the image to nwa50axpro-openwrt-initramfs.bin.
$ atnf nwa50axpro-openwrt-initramfs.bin
$ atna 192.168.1.88
$ atns "192.168.1.66; tftpboot; setenv fdt_high 0xffffffffffffffff;
bootm"
Upon booting, set the booted image to the correct slot:
$ zyxel-bootconfig /dev/mtd9 get-status
$ zyxel-bootconfig /dev/mtd9 set-image-status 0 valid
$ zyxel-bootconfig /dev/mtd9 set-active-image 0
Copy the OpenWrt sysupgrade image to the device using scp.
Write the sysupgrade image to NAND using sysupgrade.
$ sysupgrade -n image.bin
Signed-off-by: David Bauer <mail@david-bauer.net>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: W25N01GVZEIG 128MB
RAM: NT5CB128M16JR-FL 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, WPS
Power: DC 12V 1A
Flash instructions:
1. PC run command: "telnet 192.168.124.1 99"
Username: H3C, password is the web login
password of the router.
2. Download preloader.bin and bl31-uboot.fip
3. PC run command: "python3 -m http.server 80"
4. Download files in the telnet window:
"wget http://192.168.124.xx/xxx.bin"
Replace xx with your PC's IP and
the preloader.bin and bl31-uboot.fip.
5. Flushing openwrt's uboot:
"mtd write xxx-preloader.bin BL2"
"mtd write xxx-bl31-uboot.fip FIP"
6. Connect to the router via the Lan port,
set a static ip of your PC.
(ip 192.168.1.254, gateway 192.168.1.1)
7. Download initramfs image, reboot router,
waiting for tftp recovery to complete.
8. After openwrt boots up, perform sysupgrade.
Note:
1. The u-boot-env partition on mtd is empty,
OEM stores their env on ubi:u-boot-env.
2. Back up all mtd partitions before flashing.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
This commit adds support for Mercusys MR90X(EU) v1 router.
Device specification
--------------------
SoC Type: MediaTek MT7986BLA, Cortex-A53, 64-bit
RAM: MediaTek MT7986BLA (512MB)
Flash: SPI NAND GigaDevice GD5F1GQ5UEYIGY (128 MB)
Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8)
Ethernet: 1x2.5Gbe (WAN/LAN 2.5Gbps), 3xGbE (WAN/LAN 1Gbps, LAN1, LAN2)
WLAN 2g: MediaTek MT7975N, b/g/n/ax, MIMO 4x4
WLAN 5g: MediaTek MT7975P(N), a/n/ac/ax, MIMO 4x4
LEDs: 1 orange and 1 green status LEDs, 4 green gpio-controlled
LEDs on ethernet ports
Button: 1 (Reset)
USB ports: No
Power: 12 VDC, 2 A
Connector: Barrel
Bootloader: Main U-Boot - U-Boot 2022.01-rc4. Additionally, both UBI
slots contain "seconduboot" (also U-Boot 2022.01-rc4)
Serial console (UART)
---------------------
V
+-------+-------+-------+-------+
| +3.3V | GND | TX | RX |
+---+---+-------+-------+-------+
|
+--- Don't connect
The R3 (TX line) and R6 (RX line) are absent on the PCB. You should
solder them or solder the jumpers.
Installation (UART)
-------------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
tftpboot initramfs-kernel.bin
bootm
4. Once inside OpenWrt, set / update env variables:
fw_setenv baudrate 115200
fw_setenv bootargs "ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit"
fw_setenv fdtcontroladdr 5ffc0e70
fw_setenv ipaddr 192.168.1.1
fw_setenv loadaddr 0x46000000
fw_setenv mtdids "spi-nand0=spi-nand0"
fw_setenv mtdparts "spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)"
fw_setenv netmask 255.255.255.0
fw_setenv serverip 192.168.1.2
fw_setenv stderr serial@11002000
fw_setenv stdin serial@11002000
fw_setenv stdout serial@11002000
fw_setenv tp_boot_idx 0
5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image
Installation (without UART)
---------------------------
1. Login as root via SSH (router IP, port 20001, password - your web
interface password)
2. Open for editing /etc/hotplug.d/iface/65-iptv (e.g., using WinSCP and
SSH settings from the p.1)
3. Add a newline after "#!/bin/sh":
telnetd -l /bin/login.sh
4. Save "65-iptv" file
5. Toggle "IPTV/VLAN Enable" checkbox in the router web interface and
save
6. Make sure that telnetd is running:
netstat -ltunp | grep 23
7. Login via telnet to router IP, port 23 (no username and password are
required)
8 Upload OpenWrt "initramfs-kernel.bin" to the "/tmp" folder of the
router (e.g., using WinSCP and SSH settings from the p.1)
9. Stock busybox doesn't contain ubiupdatevol command. Hence, we need to
download and upload the full version of busybox to the router. For
example, from here:
https://github.com/xerta555/Busybox-Binaries/raw/master/busybox-arm64
Upload busybox-arm64 to the /tmp dir of the router and run:
in the telnet shell:
cd /tmp
chmod a+x busybox-arm64
10. Check "initramfs-kernel.bin" size:
du -h initramfs-kernel.bin
11. Delete old and create new "kernel" volume with appropriate size
(greater than "initramfs-kernel.bin" size):
ubirmvol /dev/ubi0 -N kernel
ubimkvol /dev/ubi0 -n 1 -N kernel -s 9MiB
12. Write OpenWrt "initramfs-kernel.bin" to the flash:
./busybox-arm64 ubiupdatevol /dev/ubi0_1 /tmp/initramfs-kernel.bin
13. u-boot-env can be empty so lets create it (or overwrite it if it
already exists) with the necessary values:
fw_setenv baudrate 115200
fw_setenv bootargs "ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit"
fw_setenv fdtcontroladdr 5ffc0e70
fw_setenv ipaddr 192.168.1.1
fw_setenv loadaddr 0x46000000
fw_setenv mtdids "spi-nand0=spi-nand0"
fw_setenv mtdparts "spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)"
fw_setenv netmask 255.255.255.0
fw_setenv serverip 192.168.1.2
fw_setenv stderr serial@11002000
fw_setenv stdin serial@11002000
fw_setenv stdout serial@11002000
fw_setenv tp_boot_idx 0
14. Reboot to OpenWrt initramfs:
reboot
15. Login as root via SSH (IP 192.168.1.1, port 22)
16. Upload OpenWrt sysupgrade.bin image to the /tmp dir of the router
17. Run sysupgrade:
sysupgrade -n /tmp/sysupgrade.bin
Recovery
--------
1. Press Reset button and power on the router
2. Navigate to U-Boot recovery web server (http://192.168.1.1/) and
upload the OEM firmware
Recovery (UART)
---------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
tftpboot initramfs-kernel.bin
bootm
4. Do what you need (restore partitions from a backup, install OpenWrt
etc.)
Stock layout
------------
0x000000000000-0x000000200000 : "boot"
0x000000200000-0x000000300000 : "u-boot-env"
0x000000300000-0x000003500000 : "ubi0"
0x000003500000-0x000006700000 : "ubi1"
0x000006700000-0x000006f00000 : "userconfig"
0x000006f00000-0x000007300000 : "tp_data"
ubi0/ubi1 format
----------------
U-Boot at boot checks that all volumes are in place:
+-------------------------------+
| Volume Name: uboot Vol ID: 0|
| Volume Name: kernel Vol ID: 1|
| Volume Name: rootfs Vol ID: 2|
+-------------------------------+
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| label | 00:eb:xx:xx:xx:be | label |
| LAN | 00:eb:xx:xx:xx:be | label |
| WAN | 00:eb:xx:xx:xx:bf | label+1 |
| WLAN 2g | 00:eb:xx:xx:xx:be | label |
| WLAN 5g | 00:eb:xx:xx:xx:bd | label-1 |
+---------+-------------------+-----------+
label MAC address was found in UBI partition "tp_data", file
"default-mac". OEM wireless eeprom is also there (file
"MT7986_EEPROM.bin").
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Hardware
--------
SOC: MediaTek MT7986
RAM: 1024MB DDR3
FLASH: 128MB SPI-NAND (Winbond)
WIFI: Mediatek MT7986 DBDC 802.11ax 2.4/5 GHz
ETH: Realtek RTL8221B-VB-CG 2.5 N-Base-T PHY with PoE
UART: 3V3 115200 8N1 (Pinout silkscreened / Do not connect VCC)
Installation
------------
1. Download the OpenWrt initramfs image. Copy the image to a TFTP server
2. Connect the TFTP server to the WAX220. Conect to the serial console,
interrupt the autoboot process by pressing '0' when prompted.
3. Download & Boot the OpenWrt initramfs image.
$ setenv ipaddr 192.168.2.1
$ setenv serverip 192.168.2.2
$ tftpboot openwrt.bin
$ bootm
4. Wait for OpenWrt to boot. Transfer the sysupgrade image to the device
using scp and install using sysupgrade.
$ sysupgrade -n <path-to-sysupgrade.bin>
Signed-off-by: Flole Systems <flole@flole.de>
Signed-off-by: Stefan Agner <stefan@agner.ch>
Sync device tree files for MT7986 boards with what landed in upstream
Linux tree to easy maintainance and also allow for a smooth update to
Linux 6.1.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
