Commit Graph

1079 Commits

Author SHA1 Message Date
Hang Zhou
e451957166 ramips: add support for D-Link Dir-853 A1
Specifications:
* SoC: MT7621AT
* RAM: 256MB (NT5CC64M16GP-DI)
* Flash: 16MB NOR SPI flash (GD25Q127CSIG, using GD25Q128C driver)
* WiFi: MT7615DN (2.4GHz+5Ghz) with DBDC
* Ethernet: 4x1000M LAN, 1x 1000M WAN
* LEDs: Power Blue+Orange,Wan Blue+Orange,WPS Blue,"2.4G"Blue, "5G" Blue,
  USB Blue
* Buttons: Reset,WPS, Wifi
* Serial interface: on board but not populated, pinout (from the DC jack
side to the WAN port side) is "3.3V Input Output Gnd". Baud rate is 57600,
settings are 8 data bits, no parity bit, one stop bit, and no flow control.

Stock flash layout:
```
GD25Q128C(c8 40180000) (16384 Kbytes)
mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K)
.numeraseregions = 0
Creating 7 MTD partitions on "raspi":
0x000000000000-0x000001000000 : "ALL"
0x000000000000-0x000000030000 : "Bootloader"
0x000000030000-0x000000040000 : "Config"
0x000000040000-0x000000050000 : "Factory"
0x000000050000-0x000000060000 : "Config2"
0x000000060000-0x000000fb0000 : "Kernel"
0x000000fb0000-0x000001000000 : "Private"
```
The kernel partition will be replaced with the OpenWrt image, the other
partitions are left untouched.

"Config2" seems to be the config storage used by the stock firmware.

"Private" is a 320kB empty JFFS2 partition that comes with the stock
firmware. One can get a larger space for OpenWrt by merging it with
"Kernel".

OpenWrt flash layout:
```
0x000000000000-0x000000030000 : "u-boot"
0x000000030000-0x000000040000 : "u-boot-env"
0x000000040000-0x000000050000 : "factory"
0x000000050000-0x000000060000 : "config2_stock"
0x000000060000-0x000000fb0000 : "firmware"
0x000000fb0000-0x000001000000 : "private_stock"
```

The OpenWrt image must have 96 bytes of padding in the header.

MAC addresses on OEM firmware:
|      		| location on the flash 	| notes    	|
|------		|-----------------------	|----------	|
| lan (eth2) 	| factory + 0xe000      	| on label 	|
| wan (eth3) 	| factory + 0xe006      	|          	|
| 2.4g (rax0) 	| not on flash          	| lan + 1  	|
| 5g (ra0) 	| not on flash          	| lan + 2  	|

Mac addresses of the 2.4g and 5g interface are stored as ASCII strings in
the u-boot-env partition, but they are not used. OpenWrt calculates
Wifi Mac addresses based on the LAN Mac.

Flash and test instructions:
Flash the encrypted image (available in the OpenWrt forum) through the
stock D-Dink web interface.

1. Open the case, and solder the 4-pin header near the WAN port.
2. Connect it to a USB-UART TTL (3.3V) adapter, no need to connect VCC.
3. Open a terminal emulator (e.g. `screen /dev/ttyUSB0` on linux) with
the settings mentioned above.
4. Setup a TFTP server on your PC that can serve
`xxx-ramips-mt7621-dlink_dir-853-a1-initramfs-kernel.bin`.
5. Connect any LAN port to your PC and set a static IPv4 address to
192.168.0.101 (netmask 255.255.255.0).
6. Power on the device and keeps pressing 1 until you see the prompt.
7. Use default IP addresses and enter the file name accordingly, then hit
enter.
8. Wait until it boots to OpenWrt, the default IP address is 192.168.1.1,
you need to change your PC network adapter to use DHCP in order to access
LUCI.
9. So far, the OpenWrt runs in RAM and the flash contents are not touched.
You can try OpenWrt without having to overwrite the stock firmware, a
reboot clears all changes.
10. Optionally, backup the stock firmware (the "firmware" partition) in
Luci.
11. To permantly install OpenWrt to the device , click
on "System -> Backup/Flash Firmware" in Luci and flash
`xxx-ramips-mt7621-dlink_dir-853-a1-squashfs-sysupgrade.bin`

Known problems:
* WLAN0 defaults to 5G after a fresh installation, to enable 2.4G network,
you need to config it manually in LUCI.

* If you see jffs2 related warnings/errors after updating from the stock
web interface, you need to do a reset in LUCI. The error will be gone after
a cold reboot.

Signed-off-by: Hang Zhou <929513338qq@gmail.com>
2023-03-04 13:23:18 +01:00
Bjørn Mork
79bd0172ca mt7621: move uboot-envtools to DEFAULT_PACKAGES
Several devices depend on fw_printenv during sysupgrade.  Make sure
it always is present in all images, including initramfs images built
by the buildbots.

Fixes: 2449a63208 ("ramips: mt7621: Add support for ZyXEL NR7101")
Signed-off-by: Bjørn Mork <bjorn@mork.no>
2023-03-01 23:24:23 +01:00
Sergio Paracuellos
84c04ff406 ramips: rt5350: enable lzma-loader for ALLNET ALL5003
Fixes the boot loader LZMA decompression issue:
LZMA ERROR 1 - must RESET board to recover

Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
2023-03-01 22:15:13 +01:00
Karl Chan
5c04c3943e ramips: Alternative name Asus RT-AC750L for Asus RT-AC1200V2
The Asus RT-AC750L is identical to the already supported Asus RT-AC1200V2. Use the ALT0 buildroot tags to show both devices.

Reference : https://forum.openwrt.org/t/asus-rt-ac750l-is-the-same-as-rt-ac1200-v2/151783

Signed-off-by: Karl Chan <exkc@exkc.moe>
2023-02-26 17:46:27 +01:00
Shiji Yang
68004f1942 ramips: add alternative device name for Wiflyer WF3526-P
Wiflyer WF3526-P and Zbtlink ZBT-WE1326 have the same circuit design.
Installing the misunderstading firmware of ZBT-WE3526 will cause Wi-Fi
not work due to allocate the wrong pcie port. Add alternative name to
help users easily build or download the correct firmware.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2023-02-19 18:37:55 +01:00
Arınç ÜNAL
efbb623deb ramips: add support for Huasifei WS1208V2
The Huasifei WS1208V2 is an AC1200 router featuring 5 Ethernet ports with a
Quectel RM520N-GL cellular modem which supports QMI and MBIM modes.

Specifications:
- MT7621AT, 256 MiB RAM, 16 MiB SPI Flash
- MT7603EN 2.4 GHz & MT7612EN 5 GHz WLAN
- Quectel RM520N-GL Cellular Modem
- 2 WLAN & 4 Cellular Antennas
- 5 Gigabit Ethernet Ports
- 1 USB 2.0 port
- 1 PCI-E Slot
- 1 M.2 slot
- 1 SIM card slot
- 1 SD card slot

Installation:
- Install sysupgrade image via ROOter OS.

TFTP Recovery:
- Connect to serial console.
- Boot initramfs image by choosing option 1 when U-Boot prompts.
- Install sysupgrade image via OpenWrt.

Link: https://www.huasifei.com/a/Products/5G%20CPE/240.html
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
2023-02-18 19:56:37 +01:00
Michael Pratt
4ef86c620f ramips: add support for Senao Engenius EPG600
FCC ID: A8J-EPG600

Engenius EPG600 is an indoor wireless router with
1 Gb ethernet switch, dual-band wireless,
internal antenna plates, USB, and phone lines (not supported)

this board is a Senao device:
the hardware is equivalent to EnGenius ESR600 (except for phone lines)
the software is Senao SDK which is based on openwrt and uboot
which uses the legacy Senao header with Vendor / Product IDs
to verify the firmware upgrade image.

**Specification:**

  - MT7620 SOC		MIPS 24kec, 2.4 GHz WMAC, 2x2
  - RT5592N WLAN	PCI chip, 5 GHz, 2x2
  - QCA8337N Gb SW	RGMII GbE, SW P0 -- SOC P5, 5 LEDs
  - 40 MHz clock
  - 16 MB FLASH		MX25L12845EMI-10G
  - 64 MB RAM		NT5TU32M16
  - UART console	J2, populated
  - USB 2.0 port	direct to SOC
  - 6 GPIO LEDs		power, 2G, 5G, wps2g, wps5g, line
  - 3 buttons		reset, wps, "reg" (registeration)
  - 4 antennas		internal omni-directional plates

NOT YET SUPPORTED: VoIP

  - Si3050-FT + Si3019-FT	Voice DAA, SPI control, PCM data
  - Phone Ports "TEL", "LINE"	RJ11, 4P2C (2 pins)

**MAC addresses:**

  MAC address labeled as MAC ADDRESS
  MACs present in both wifi cal data and uboot environment

  eth0.1/phy1	----	*:82	rf 0x4
  phy0		----	*:83	factory 0x4
  eth0.2	MAC	*:b8	"wanaddr"

**Installation:**

  Method 1: Firmware upgrade page:

    (if you cannot access the APs webpage)
    factory reset with the reset button
    connect ethernet to a computer
    OEM webpage at 192.168.0.1
    username and password 'admin'

    Navigate to gear icon, "Device Management", "Tools"
    select the factory.dlf image
    Upload and verify checksum

  Method 2: Serial to upload initramfs:

    Follow directions for TFTP recovery
    upload and boot initramfs and do a sysupgrade

**TFTP recovery:**

  Requires UART serial console, reset button does nothing

  rename initramfs-kernel.bin to 'uImageEPG600'
  make available on TFTP server at 192.168.99.8
  power board, interrupt boot with "4"
  execute `tftpboot` and `bootm` (with the load address)

**Return to OEM:**

  Images from OEM are provided, but not compatible
  with openwrt sysupgrade. So it must be modified.

  Alternatively, back up all mtd partitions before flashing

**Note on switch registers:**

  The necessary registers needed for the QCA8337 switch
  can be read from interrupted boot (tftpboot, bootm)
  by using the following lines in the switch driver ar8327.c
  in the function 'ar8327_hw_config_of'
  where 'qca,ar8327-initvals' is parsed from DTS
  before the new register values are written:

    pr_info("0x04 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD0_MODE));
    pr_info("0x08 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD5_MODE));
    pr_info("0x0c %08x\n", ar8xxx_read(priv, AR8327_REG_PAD6_MODE));
    pr_info("0x10 %08x\n", ar8xxx_read(priv, AR8327_REG_POWER_ON_STRAP));

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-02-18 16:55:35 +01:00
Karl Chan
8ef81b4a19 ramips: fix the name of ASUS AX54 because it has dupilcated twice
The name of ASUS AX54 has dupilcated in the DEVICE_ALT0_VENDOR/DEVICE_ALT0_MODEL

Signed-off-by: Karl Chan <exkc@exkc.moe>
2023-02-18 16:01:30 +01:00
Karl Chan
92276eef70 ramips: add support for ASUS RT-AX54
Specifications:
- Device: ASUS RT-AX54 (AX1800S/HP,AX54HP)
- SoC: MT7621AT
- Flash: 128MB
- RAM: 256MB
- Switch: 1 WAN, 4 LAN (10/100/1000 Mbps)
- WiFi: MT7905 2x2 2.4G + MT7975 2x2 5G
- LEDs: 1x POWER (blue, configurable)
        1x LAN (blue, configurable)
        1x WAN (blue, configurable)
	1x 2.4G (blue, not configurable)
	1x 5G (blue, not configurable)

Flash by U-Boot TFTP method:
- Configure your PC with IP 192.168.1.2
- Set up TFTP server and put the factory.bin image on your PC
- Connect serial port(rate:115200) and turn on AP, then interrupt "U-Boot Boot Menu" by hitting any key
   Select "2. Upgrade firmware"
   Press enter when show "Run firmware after upgrading? (Y/n):"
   Select 0 for TFTP method
   Input U-Boot's IP address: 192.168.1.1
   Input TFTP server's IP address: 192.168.1.2
   Input IP netmask: 255.255.255.0
   Input file name: openwrt-ramips-mt7621-asus_rt-ax1800hp-squashfs-factory.bin
- Restart AP aftre see the log "Firmware upgrade completed!"

Signed-off-by: Karl Chan <exkc@exkc.moe>
2023-02-12 18:27:45 +01:00
Rosen Penev
2630e5063d treewide: replace wpad-basic-wolfssl default
The newly merged mbedtls backend is smaller and has fewer ABI related
issues than the wolfSSL one.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2023-02-04 02:35:03 +01:00
Mark Ceeha
d4c63c7786 ramips: add support for TP-Link Deco M4R v4
This commit adds support for the V4 hardware revision of the Deco M4R.
V4 is a complete overhaul of the hardware compared to V1 and V2,
and is much more similar to the Archer C6 V3 and C6U V1.

Specifications:

  SoC: MediaTek MT7621AT (2 cores at 880 MHz, 4 threads)
  RAM: Kingston D1216ECMDXGJD (256 MB)
  Wireless 2.4 GHz: MediaTek MT7603EN
  Wireless 5 GHz: MediaTek MT7613BEN
  Flash: 16 MB SPI NOR

Installation:

Flash the *-factory.bin image in the U-Boot recovery webserver.
You can trigger this webserver by holding the reset button until the LED
flashes yellow, or by hooking up to serial pads on the board (clearly
labeled GND, RX and TX) and pressing `x` early in boot.

Once the factory image has been flashed, you can use the regular upgrade
procedure with sysupgrade images for subsequent flashes.

Signed-off-by: Mark Ceeha <hi@shiz.me>
Tested-by: Mark Ceeha <hi@shiz.me>
2023-02-03 12:13:50 +01:00
Dmitry Sokolov
39e4f03fd3 ramips: mt7621: add support for Xiaomi Mi Router 4A Gigabit v2
Device is the same as Xiaomi Mi Router 4A Gigabit, except of:
- 5G WiFi is MT7663
- addresses of leds, wifi and eth ports are slightly changed

Specs:
  SoC:  MT7621
  CPU:  2 x 880 MHz
  ROM:  16 MB
  RAM:  128 MB
  WLAN: MT7603, MT7663

MAC addresses:
  WAN     ****  factory 0xe006 (label)
  LAN     *:f7  factory 0xe000
  2.4 GHz *:f8  factory 0x0000+0x4 (mtd-eeprom+0x4)
  5 GHz   *:f9  factory 0x8000+0x4 (mtd-eeprom+0x4)

Installation:

Factory firmware is based on a custom OpenWrt 17.x.
Installation is the same as for Xiaomi Mi Router 4A Gigabit.

Probably the easiest way to install is to use the script from
this repository: https://github.com/acecilia/OpenWRTInvasion/pull/155

In a more advanced case, you can do everything yourself:
- gain access to the device through one of the exploits described
  in the link above
- upload sysupgrade image to /tmp
- overwrite stock firmware:
  # mtd -e OS1 -r write /tmp/sysupgrade.bin OS1

Recovery:

Recovery procedure is the same as for Xiaomi Mi Router 4A Gigabit.
Possible options can be found here:
https://openwrt.org/inbox/toh/xiaomi/xiaomi_mi_router_4a_gigabit_edition

One of the ways is to use another router with OpenWrt:
- connect both routers by their LAN ports
- download stock firmware from [1]
- place it inside /tmp/test.bin on the main router
- configure PXE/TFTP on the main router
- power off 4Av2, hold Reset button, power on
- as soon as image download via TFTP starts, Reset can be released
- blinking blue wan LED will indicate the end of the flashing process,
  now router can be rebooted
[1] http://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/r4av2/miwifi_r4av2_firmware_release_2.30.28.bin

Signed-off-by: Dmitry Sokolov <e323w@proton.me>
2023-01-28 22:11:44 +01:00
Maxim Anisimov
3690c4a092 ramips: improve support for Zyxel Keenetic Extra II
- drop unneeded default-state for led_power
- concat firmware partitions to extend available free space
- increase spi flash frequency to 32 Mhz (value from stock firmware bootlog)
- drop broken-flash-reset because of onboard flash chip W25Q256FV has reset support
- add compatible for pcie wifi according to kernel documetation
- switch to wan mac address with offset 0x28 in rf-eeprom

Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
2023-01-28 21:45:34 +01:00
Maxim Anisimov
2fe29794b1 ramips: use hex value in zyimage command for Keenetic KN-3010
This is cosmetic change. The hex value is related to the device
model and more human friendly.

Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
2023-01-28 21:40:37 +01:00
Harm Berntsen
09f313bfd7 ramips: mt7621: Add Arcadyan WE420223-99 support
The Arcadyan WE420223-99 is a WiFi AC simultaneous dual-band access
point distributed as Experia WiFi by KPN in the Netherlands. It features
two ethernet ports and 2 internal antennas.

Specifications
--------------
SOC   : Mediatek MT7621AT
ETH   : Two 1 gigabit ports, built into the SOC
WIFI  : MT7615DN
BUTTON: Reset
BUTTON: WPS
LED   : Power (green+red)
LED   : WiFi (green+blue)
LED   : WPS (green+red)
LED   : Followme (green+red)
Power : 12 VDC, 1A barrel plug

Winbond variant:
RAM   : Winbond W631GG6MB12J, 1GBIT DDR3 SDRAM
Flash : Winbond W25Q256JVFQ, 256Mb SPI
U-Boot: 1.1.3 (Nov 23 2017 - 16:40:17), Ralink 5.0.0.1

Macronix variant:
RAM   : Nanya NT5CC64M16GP-DI, 1GBIT DDR3 SDRAM
Flash : MX25l25635FMI-10G, 256Mb SPI
U-Boot: 1.1.3 (Dec  4 2017 - 11:37:57), Ralink 5.0.0.1

Serial
------
The serial port needs a TTL/RS-232 3V3 level converter! The Serial
setting is 57600-8-N-1. The board has an unpopulated 2.54mm straight pin
header.

The pinout is: VCC (the square), RX, TX, GND.

Installation
------------
See the Wiki page [1] for more details, it comes down to:

1. Open the device, take off the heat sink
2. Connect the SPI flash chip to a flasher, e.g. a Raspberry Pi. Also
   connect the RESET pin for stability (thanks @FPSUsername for reporting)
3. Make a backup in case you want to revert to stock later
4. Flash the squashfs-factory.trx file to offset 0x50000 of the flash
5. Ensure the bootpartition variable is set to 0 in the U-Boot
   environment located at 0x30000

Note that the U-Boot is password protected, this can optionally be
removed. See the forum [2] for more details.

MAC Addresses(stock)
--------------------
+----------+------------------+-------------------+
| use      | address          | example           |
+----------+------------------+-------------------+
| Device   | label            | 00:00:00:11:00:00 |
| Ethernet | + 3              | 00:00:00:11:00:03 |
| 2g       | + 0x020000f00001 | 02:00:00:01:00:01 |
| 5g       | + 1              | 00:00:00:11:00:01 |
+----------+------------------+-------------------+

The label address is stored in ASCII in the board_data partition

Notes
-----
- This device has a dual-boot partition scheme, but OpenWRT will claim
  both partitions for more storage space.

Known issues
------------
- 2g MAC address does not match stock due to missing support for that in
  macaddr_add
- Only the power LED is configured by default

References
----------
[1] https://openwrt.org/inbox/toh/arcadyan/astoria/we420223-99
[2] https://forum.openwrt.org/t/adding-openwrt-support-for-arcadyan-we420223-99-kpn-experia-wifi/132653

Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Signed-off-by: Harm Berntsen <git@harmberntsen.nl>
2023-01-15 13:41:02 +01:00
Keith Harrison
c13263ca07 ramips: add support for D-Link DIR-1935 A1
Add support for D-Link DIR-1935 A1 based on similarities to DIR-882 A1,
DIR-867 A1 and other DIR-8xx A1 models. Existing DIR-882 A1 openwrt
"factory" firmware installs without modificaitons via the D-Link
Recovery GUI and has no known incompatibilities with the DIR-1935 A1.

Changes to be committed:
       new file:   target/linux/ramips/dts/mt7621_dlink_dir-1935-a1.dts
       modified:   target/linux/ramips/image/mt7621.mk
       modified:   target/linux/ramips/mt7621/base-files/etc/board.d/01_leds

Specifications:
* Board: Not known
* SoC: MediaTek MT7621 Family
* RAM: 128 MB (DDR3)
* Flash: 16 MB (SPI NOR)
* WiFi: MediaTek MT7615 Family (x2)
* Switch: 1 WAN, 4 LAN (Gigabit)
* Ports: 1 USB 3.0
* Buttons: Reset, WiFi Toggle, WPS
* LEDs: Power (green/orange), Internet (green/orange), WiFi 2.4G (green),
        WiFi 5G (green)

Notes:
* 160MHz 5GHz is available in LuCi but does not appear to work (i.e. no
  SSID is visible in wifi scanning apps on other devices) with either
  official DIR-882 A1 firmware or a test build for the DIR-1935 A1 based
  on the 22.03.2 branch. 80 MHz 5GHz works.

Serial port:
* Untested (potential user damage/error)
* Expected to be identical to other DIR-8xx A1 models:
	* Parameters: 57600, 8N1
	* Location: J1 header (close to the Reset, WiFi and WPS buttons)
	* Pinout: 1 - VCC
		  2 - RXD
	          3 - TXD
		  4 - GND

Installation:
* D-Link Recovery GUI: power down the router, press and hold the reset
  button, then re-plug it. Keep the reset button pressed until the power
  LED starts flashing orange, manually assign a static IP address under
  the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1

* Some modern browsers may have problems flashing via the Recovery GUI,
  if that occurs consider uploading the firmware through cURL:

    curl -v -i -F "firmware=@file.bin" 192.168.0.1

Signed-off-by: Keith Harrison <keithh@protonmail.com>
2023-01-14 19:09:56 +01:00
Felix Baumann
acd3b5e83b ramips: Alternative name Asus RT-AX1800U for Asus RT-AX53U
The Asus RT-AX1800U is identical to the already supported Asus RT-AX53U.
Use the ALT0 buildroot tags to show both devices.

Tested-by: Marian Sarcinschi <znevna@gmail.com>
Signed-off-by: Felix Baumann <felix.bau@gmx.de>
2023-01-14 19:05:41 +01:00
Jo Deisenhofer
f204c812e9 ramips: add support for xiaomi RA75 Range Extender
This device is a 'Range extender' variant of the Xiaomi 4A router.
Its identical to the 100m non-intl/chinese version as much as it can run
the same firmware, differences being form factor, LEDs, WPS button
and one 100M port only.
The stock firmware differs significantly, being 'app managed only'.

Device specification
--------------------
SoC:      MT7628DAN MIPS_24KEc@580MHz 2.4G-n 2x2
WiFi:     MT7612EN 5G-ac 80MHz 2T2R
Flash:    16MB W25Q128BV
DRAM:     64MB built-in SoC
Switch:   built-in SoC
Ethernet: 1x10/100 Mbps
USB:      None
Antennas: 2 x external, non-detachable
LEDs:     2 programmable blue/amber
Buttons:  WPS and reset (hidden)
Housing:  Range Extender / Wall wart
Serial:   115200,8n1

MAC Addresses
-------------
All 3 MACs are read from flash and identical to stock.
Label MAC is WIFI 2G

Installation
------------
No HTML UI on this device, serial console only. The serial connector
is unpopulated but standard size and clearly marked. Flash from the
U-Boot shell at boot by choosing (2) and flashing the sysupgrade file
via tftp.

Recovery/Debricking procedures of the xiaomi 4A and variants should
work, but there currently is no official source for the stock firmware.

Signed-off-by: Jo Deisenhofer <jo.deisenhofer@gmail.com>
2023-01-14 19:02:21 +01:00
Mikhail Zhilkin
1a35edfbdb ramips: add basic support for TP-Link EC330-G5u v1
This adds basic support for TP-Link EC330-G5u Ver:1.0 router (also known
as TP-Link Archer C9ERT).

Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 128 MiB, Nanya NT5CC64M16GP-DI
Flash: 128 MiB NAND, ESMT F59L1G81MA-25T
Wireless 2.4 GHz (MediaTek MT7615N): b/g/n, 4x4
Wireless 5 GHz (MediaTek MT7615N): a/n/ac, 4x4
Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4)
USB ports: 1xUSB3.0
Button: 4 (Led, WiFi On/Off, Reset, WPS)
LEDs: 7 blue LEDs, 1 orange(amber) LED, 1 white(non-gpio) LED
Power: 12 VDC, 2 A
Connector type: Barrel
Bootloader: First U-Boot (1.1.3), Main U-Boot (1.1.3). Additionally,
original TP-Link firmware contains Image U-Boot (1.1.3).

Serial console (UART)
---------------------
                            V
+-------+-------+-------+-------+
| +3.3V |  GND  |  TX   |  RX   |
+---+---+-------+-------+-------+
    |              J2
    |
    +--- Don't connect

Installation
------------
1. Rename OpenWrt initramfs image to test.bin and place it on tftp server
   with IP 192.168.0.5
2. Attach UART, switch on the router and interrupt the boot process by
   pressing 't'
3. Load and run OpenWrt initramfs image:
      tftpboot
      bootm
4. Once inside OpenWrt, switch to the first boot image:
      fw_setenv BootImage 0
5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image

Back to Stock
-------------
1. Run in the OpenWrt shell:
      fw_setenv BootImage 1
      reboot

Recovery
--------
1. Press Reset button and power on the router
2. Navigate to U-Boot recovery web server (http://192.168.0.1/) and upload
   the OEM firmware

MAC addresses
-------------
+---------+-------------------+-------------------+-------------+
|         | MAC example 1     | MAC example 2     | Algorithm   |
+---------+-------------------+-------------------+-------------+
| label   | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label       |
| LAN     | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label       |
| WAN     | 72:ff:7b:xx:xx:f5 | 54:d4:f7:xx:xx:db | label+1 [1] |
| WLAN 2g | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label       |
| WLAN 5g | 68:ff:7b:xx:xx:f6 | 50:d4:f7:xx:xx:dc | label+2     |
+---------+-------------------+-------------------+-------------+
label MAC address was found in factory at 0x165 (text format
xx:xx:xx:xx:xx:xx).

Notes
-----
[1] WAN MAC address:
   a. First octet of WAN MAC is differ than others and OUI is not related
      to TP-Link company. This probably should be fixed.
   b. Flipping bits in first octet and hex delta are different for the
      different MAC examples:
      +-----------------+----------------+----------------+
      |                 | Example 1      | Example 2      |
      +-----------------+----------------+----------------+
      | LAN             | 68 = 0110 1000 | 50 = 0101 0000 |
      | MAC (1st octet) |         ^ ^ ^  |                |
      +-----------------+----------------+----------------+
      | WAN             | 72 = 0111 0010 | 54 = 0101 0100 |
      | MAC (1st octet) |         ^ ^ ^  |            ^   |
      +-----------------+----------------+----------------+
      | HEX delta       | 0xa            | 0x4            |
      +-----------------+----------------+----------------+
      | DEC delta       | 4              | 4              |
      +-----------------+----------------+----------------+
   c. DEC delta is a constant (4). This looks like a mistake in OEM
      firmware and probably should be fixed.
   Based on the above, I decided to keep correct OUI and make WAN MAC =
   label + 1.

[2] Bootloaders
   The device contains 3 bootloaders:
   - First U-Boot: U-Boot 1.1.3 (Mar 18 2019 - 12:50:24). The First U-Boot
     located on NAND Flash to load next full-feature Uboot.
   - Main U-Boot + its backup: U-Boot 1.1.3 (Mar 18 2019 - 12:50:29). This
     bootloader includes recovery webserver. Requires special uImages to
     continue the boot process:
        0x00 (os0, os1) - firmware uImage
        0x40 (os0, os1) - standalone uImage (OpenWrt kernel is here)
   - Additionally, both slots of the original TP-Link firmware contains
     Image U-Boot: U-Boot 1.1.3 (Oct 16 2019 - 08:14:45). It checks image
     magics and CRCs. We don't use this U-Boot with OpenWrt.

Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2023-01-14 18:36:33 +01:00
INAGAKI Hiroshi
1f5f2e588a ramips: add support for ELECOM WRC-2533GHBK2-T
ELECOM WRC-2533GHBK2-T is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based
on MT7621A.

Specification:

- SoC      : MediaTek MT7621A
- RAM      : DDR3 128 MiB
- Flash    : SPI-NOR 16 MiB (Macronix MX25L12835FM2I-10G)
- WLAN     : 2.4/5 GHz 4T4R (2x MediaTek MT7615)
- Ethernet : 10/100/1000 Mbps x5
  - Switch : MediaTek MT7530 (SoC)
- LED/keys : 4x/3x (2x buttons, 1x slide-switch)
- UART     : through-hole on PCB
  - J4: 3.3V, RX, GND, TX from SoC side
  - 57600n8
- Power    : 12 VDC, 1.5 A

Flash instruction using factory image:

1. Boot WRC-2533GHBK2-T normally
2. Access to "http://192.168.2.1/" and open firmware update page
   ("ファームウェア更新")
3. Select the OpenWrt factory image and click apply ("適用") button
4. Wait ~150 seconds to complete flashing

MAC addresses:

LAN    : BC:5C:4C:xx:xx:FD (Config,  "ethaddr" (text))
WAN    : BC:5C:4C:xx:xx:FC (Config,  "wanaddr" (text), Label)
2.4 GHz: BC:5C:4C:xx:xx:FE (Factory, 0x4       (hex))
5 GHz  : BC:5C:4C:xx:xx:FF (Factory, 0x8004    (hex))

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2023-01-14 15:41:00 +01:00
Sebastian Schaper
3c31f6b521 ramips: add support for D-Link DAP-X1860 A1
The DAP-X1860 is a wall-plug AX1800 repeater.

Specifications:
- MT7621, 256 MiB RAM, 128 MiB SPI NAND
- MT7915 + MT7975 2x2 802.11ax (DBDC)
- Ethernet: 1 port 10/100/1000
- LED RSSI bargraph (2x green, 1x red/orange), status
  and RSSI LEDs are incorrectly populated red/orange
  (should be red/green according to documentation)

Installation:
- Keep reset button pressed during plug-in
- Web Recovery Updater is at 192.168.0.50
- Upload factory.bin, confirm flashing
  (seems to work best with Chromium-based browsers)

Revert to OEM firmware:
- tar -xvf DAP-X1860_RevA_Firmware_101b94.bin
- openssl enc -d -md md5 -aes-256-cbc -in FWImage.st2 \
  -out FWImage.st1 -k MB0dBx62oXJXDvt12lETWQ==
- tar -xvf FWImage.st1
- flash kernel_DAP-X1860.bin via Recovery

Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2023-01-07 17:56:10 +01:00
Shiji Yang
9a07895729 mt76: add stand-alone MT7622 firmware package
Add a separate firmware package to avoid installing the MT7615 firmware
on all MT7622 target devices by default. Now we only add MT7615 firmware
packages for devices that use MT7615E. This commit also removes the
explicit dependency on kmod-mt7615e to refine the package dependency.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2023-01-07 17:11:00 +01:00
Shiji Yang
fc9dd3f083 mt76: add stand-alone MT7915 firmware package
The mt7915e driver supports MT7915, MT7916 and MT7986 chips. And Only
MT7915 series chips need the MT7915 firmware. To save storage, extract
them from the common code package and create a new package to provide
the firmware.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2023-01-07 17:11:00 +01:00
Shiji Yang
3dbaf89296 ramips: use default lzma dictionary size for better performance
limit dictionary size patch was introduced to solve the well known
"LZMA ERROR 1 - must RESET board to recover" error.
09b6755946 "ramips: limit dictionary size for lzma compression"

It seems that it has failed recently and we can use lzma loader to fix
this error by adding "$(Device/uimage-lzma-loader)". So just remove it
to use the default parameter -d24 for a higher compression ratio.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2023-01-07 16:56:16 +01:00
David Bauer
8036fb8dd0 ramips: combine USW-Flex dual firmware-partitions
In order to maximize the available space on USW-Flex boards using a
dual-image partition layout, combine the two OS partitions into a single
partition.

This allows users to access more usable space for additional packages.

Don't limit the usable image size to the size of a single OS partition.
The initial installation has to be done with an older version of OpenWrt
in case the generated image exceeds the space of a single kernel
partition in the future.

Signed-off-by: David Bauer <mail@david-bauer.net>
2023-01-07 01:32:58 +01:00
Leon M. Busch-George
f6d394e9f2 ramips: add support for Cudy M1800
Specifications

  SoC:       MT7621
  CPU:       880 MHz
  Flash:     32 MiB
  RAM:       256 MiB
  WLAN:      MT7915 WiFi 6 (2.4/5 GHz)
  Ethernet:  2x Gbit ports

                  MAC
LAN        b4:4b:d6:2e:c7:b0 (label)
WAN        b4:4b:d6:2e:c7:b1
WiFi 2.4   00:0c:43:26:46:08
WiFi 5     00:0c:43:26:59:97

Installation

There are two known options:
1) The Luci-based UI.
2) Press and hold the reset button during power up.
   The router will request 'recovery.bin' from a TFTP server at
   192.168.1.88.

Both options require a signed firmware binary.
The openwrt image supplied by cudy is signed and can be used to
install unsigned images.

Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
2023-01-06 19:22:52 +01:00
Maxim Anisimov
dbebfb88b5 ramips: add support for Keenetic KN-1613
Keenetic KN-1613 is a 2.4/5 Ghz band 11ac (Wi-Fi 5) router, based on MT7628AN.

Specification:
- System-On-Chip: MT7628AN
- CPU/Speed: 580 MHz
- Flash-Chip: Winbond w25q256
- Flash size: 32768 KiB
- RAM: 128 MiB
- 4x 10/100 Mbps Ethernet
- 2x external, non-detachable antennas
- UART (J1) header on PCB (115200 8n1)
- Wireless No1 (2T2R): SoC Built-in 2.4 GHz 802.11bgn
- Wireless No2 (2T2R): MT7613BE 5 GHz 802.11ac
- 4x LED, 2x button, 1x mode switch

Notes:
- The device supports dual boot mode
- The firmware partitions were concatinated into one
- The FN button led indicator has been reassigned as the 2.4GHz
  wifi indicator.

Flash instruction:
The only way to flash OpenWrt image is to use tftp recovery mode in U-Boot:

1. Configure PC with static IP 192.168.1.2/24 and tftp server.
2. Rename "openwrt-ramips-mt76x8-keenetic_kn-1613-squashfs-factory.bin"
   to "KN-1613_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
   the router and keep button pressed until power led start blinking.
4. Router will download file from server, write it to flash and reboot.

Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
2023-01-06 17:53:10 +01:00
Ignas Poklad
7801e814dd ramips: add Unielec U7621-06 32M build target
Add 32M build target

Rest of the details as per commit 46ab81e405 ("ramips add support for
UniElec U7621-06")

Signed-off-by: Ignas Poklad <ignas2526@gmail.com>
2023-01-05 00:10:14 +01:00
Nikolay Martynov
665c2154ef ramips: add basic support for tp-link er605-v2
This is a MT7621-based device with 128MB NAND flash, 256MB RAM, and a USB port.
The board has headers to attach console. In order for them to work two solder
bridges near those pads need to be made.

The defice has the following partition table:

```
0x000000000000-0x000000080000 : "u-boot"
0x000000080000-0x000000100000 : "u-boot-env"
0x000000100000-0x000000140000 : "factory"
0x000000140000-0x000007e00000 : "firmware"
0x000007e00000-0x000008000000 : "panic-ops"
```

`firmware` partition contains UBI volumes. Unfortunately I accidentally wiped
partition and I no longer have access to it.

`firmware` partition contains 'secondary' U-Boot which is run by 'first' u-boot.
It also contains various configuration partitions that include device info and
MAC address. There also seems to be 'primary' and 'backup' set of 'main' volumes.

U-boot has `mtkupgrade` command that just overrides data on firmware partitions.
Firmware file provided by TP-Link cannot be used with that command.

U-boot also has 'recovery' http server. Unfortunately I was not able to make it
work with manufacturer's firmware.

Manufacturer's firmware essentially contains multiple UBI volumes along with
'partition table'. Unfortunately I no longer can properly run manufacturer's
firmware so I cannot at the moment try to a support for building 'factory' images.

This patch adds support for initramfs image as well as sysupgrade image.

This seems to be pretty standard MT7621 board otherwise.

Things that work:
* network
* leds
* usb
* factory MAC detection

Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
2023-01-04 23:19:19 +01:00
Marian Sarcinschi
c4b806d5c4 ramips: add missing LEDs to Asus RT-AX53U
This patch adds the missing LEDs to Asus RT-AX53U.
Based on PR #10400 and patch provided in #11068
 - enable the two LEDs controlled by mt7915e for wireless;
 - add label to power LED so it works properly and fix formatting;
 - add the USB LED;
 - switch LEDs are best left to be controlled by hardware for now.

Co-Authored-By: Ivan Rozhuk <rozhuk.im@gmail.com>
Co-Authored-By: Shiji Yang <yangshiji66@qq.com>
Co-Authored-By: Hartmut Birr <e9hack@gmail.com>
Tested-by: Felix Baumann <felix.bau@gmx.de>
Tested-by: Marian Sarcinschi <znevna@gmail.com>
Signed-off-by: Marian Sarcinschi <znevna@gmail.com>
2023-01-04 21:56:49 +01:00
Julien Dusser
b893aa7992 ramips: add support for Linksys E5400 and clones
Linksys E5400 is a 2.4/5GHz dual band AC router, based on MediaTek
MT7628AN. This device is also sold as Linksys E2500v4, E5300 and E5350
with the same hardware, but software speed limitations in vendor
firmwares.

Specification:
 * SoC: MT7628AN (580 MHz)
 * RAM: DDR2 64 MiB
 * Flash: 16 MiB NOR (W25Q128BV)
 * Wi-Fi:
   * 2.4GHz: SoC Built-in
   * 5GHz: MT7612EN
 * Ethernet: 5x 100Mbps
   * Switch: SoC built-in
 * UART:
   * 115200, 8N1, 3.3V (real u-boot speed: 119050)
   * Pinout JB4: 1:[3V3] (TXD) (RXD) [NC] (GND)

Flash Layout:
  0x0000000-0x0030000 : "Bootloader"
  0x0030000-0x0040000 : "Config"
  0x0040000-0x0050000 : "Factory"
  0x0050000-0x0ff0000 : "Kernel"
  0x0ff0000-0x1000000 : "CBTinfo"

MAC address:
  LAN: factory 0x28
  WAN: LAN + 1
  2.4G: LAN + 2
  5G: LAN + 3

Installation:
1. Connect to UART, use LF as EOL (not CRLF)
2. Set IP address
  - Press 4 during boot
  - setenv serverip <TFTPSERVER_IP>
  - setenv ipaddr <DEVICE_IP>
  - setenv bootfile openwrt-ramips-mt76x8-linksys_e5400-initramfs-kernel.bin
  - saveenv
  - reset
3. Load Openwrt Kernel image from TFTP:
  - Press 1 during boot
  - IP and filename should be already set
4. Boot into OpenWrt and perform sysupgrade with sysupgrade image.

Signed-off-by: Julien Dusser <julien.dusser@free.fr>
2022-12-18 21:24:57 +01:00
Alexey Bartenev
3f201d1f8e ramips: add support for SNR-CPE-W4N-MT router
General specification:
- SoC Type: MediaTek MT7620N (580MHz)
- ROM: 8 MB SPI-NOR (W25Q64FV)
- RAM: 64 MB DDR (M13S5121632A)
- Switch: MediaTek MT7530
- Ethernet: 5 ports - 5×100MbE (WAN, LAN1-4)
- Wireless 2.4 GHz: b/g/n
- Buttons: 1 button (RESET)
- Bootloader: U-Boot 1.1.3, MediaTek U-Boot: 5.0.0.5
- Power: 12 VDC, 1.0 A

Flash by the native uploader in 2 stages:
1. Use the native uploader to flash an initramfs image. Choose
 openwrt-ramips-mt7620-snr_cpe-w4n-mt-initramfs-kernel.bin file by
 "Administration/Management/Firmware update/Choose File" in vendor's
 web interface (ip: 192.168.1.10, login: Admin, password: Admin).
 Wait ~160 seconds.
2. Flash a sysupgrade image via the initramfs image. Choose
 openwrt-ramips-mt7620-snr_cpe-w4n-mt-squashfs-sysupgrade.bin
 file by "System/Backup/Flash Firmware/Flash image..." in
 LuCI web interface (ip: 192.168.1.1, login: root, no password).
 Wait ~240 seconds.

Flash by U-Boot TFTP method:
1. Configure your PC with IP 192.168.1.131
2. Set up TFTP server and put the
 openwrt-ramips-mt7620-snr_cpe-w4n-mt-squashfs-sysupgrade.bin
 image on your PC
3. Connect serial port (57600 8N1) and turn on the router.
 Then interrupt "U-Boot Boot Menu" by hitting 2 key (select "2:
 Load system code then write to Flash via TFTP.").
Press Y key when show "Warning!! Erase Linux in Flash then burn
 new one. Are you sure? (Y/N)"
Input device IP (192.168.1.1) ==:192.168.1.1
Input server IP (192.168.1.131) ==:192.168.1.131
Input Linux Kernel filename () ==:
openwrt-ramips-mt7620-snr_cpe-w4n-mt-squashfs-sysupgrade.bin
3. Wait ~120 seconds to complete flashing

Signed-off-by: Alexey Bartenev <41exey@proton.me>
2022-12-17 22:34:44 +01:00
Shiji Yang
6361a952af ramips: improve support for SIM SIMAX1800T and Haier HAR-20S2U1
1. Use ARTIFACTS to build factory image. This change allows users to
   generate initramfs factory image using OpenWrt ImageBuilder.

2. Override the default bootargs property defined in "mt7621.dtsi".
   Although we use the "bootargs-override" property to set bootargs,
   the default "bootargs" property will still be written into the
   device tree, so it is better to override it.

Tested on SIM SIMAX1800T

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2022-12-17 21:08:14 +01:00
Mikhail Zhilkin
0ec8d991c2 ramips: add support for Etisalat S3
Etisalat S3 is a wireless WiFi 5 router manufactured by Sercomm company.

Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 256 MiB
Flash: 128 MiB
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7615E): a/n/ac, 4x4
Ethernet: 5x GbE (WAN, LAN1, LAN2, LAN3, LAN4)
USB ports: 1x USB3.0
Button: 2 buttons (Reset & WPS)
LEDs:
   - 1x Status (RGB)
   - 1x 2.4G (blue, hardware, mt76-phy0)
   - 1x 5G (blue, hardware, mt76-phy1)
Power: 12 VDC, 1.5 A
Connector type: barrel
Bootloader: U-Boot

Installation
-----------------
1.  Login to the router web interface under admin account
2.  Navigate to Settings -> Configuration -> Save to Computer
3.  Decode the configuration. For example, using cfgtool.py tool (see
    related section):
       cfgtool.py -u configurationBackup.cfg
4.  Open configurationBackup.xml and find the following line:
    <PARAMETER name="Password" type="string" value="<your router serial \
       is here>" writable="1" encryption="1" password="1"/>
5.  Insert the following line after and save:
<PARAMETER name="Enable" type="boolean" value="1" writable="1" encryption="0"/>
6.  Encode the configuration. For example, using cfgtool.py tool:
       cfgtool.py -p configurationBackup.xml
7.  Upload the changed configuration (configurationBackup_changed.cfg) to
    the router
8.  Login to the router web interface (SuperUser:ETxxxxxxxxxx, where
    ETxxxxxxxxxx is the serial number from the backplate label)
9.  Navigate to Settings -> WAN -> Add static IP interface (e.g.
    10.0.0.1/255.255.255.0)
10. Navigate to Settings -> Remote cotrol -> Add SSH, port 22,
    10.0.0.0/255.255.255.0 and interface created before
11. Change IP of your client to 10.0.0.2/255.255.255.0 and connect the
    ethernet cable to the WAN port of the router
12. Connect to the router using SSH shell under SuperUser account
13. Run in SSH shell:
       sh
14. Make a mtd backup (optional, see related section)
15. Change bootflag to Sercomm1 and reboot:
       printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
       reboot
16. Login to the router web interface under admin account
17. Remove dots from the OpenWrt factory image filename
18. Update firmware via web using OpenWrt factory image

Revert to stock
---------------
Change bootflag to Sercomm1 in OpenWrt CLI and then reboot:
   printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3

mtd backup
----------
1. Set up a tftp server (e.g. tftpd64 for windows)
2. Connect to a router using SSH shell and run the following commands:
      cd /tmp
      for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \
      tftp -l mtd$i -p 10.0.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done
      tftp -l mtd.md5 -p 10.0.0.2

Recovery
--------
Use sercomm-recovery tool.
Link: https://github.com/danitool/sercomm-recovery

MAC Addresses
-------------
+-----+------------+---------+
| use | address    | example |
+-----+------------+---------+
| LAN | label      | *:50    |
| WAN | label + 11 | *:5b    |
| 2g  | label + 2  | *:52    |
| 5g  | label + 3  | *:53    |
+-----+------------+---------+
The label MAC address was found in Factory 0x21000

cfgtool.py
----------
A tool for decoding and encoding Sercomm configs.
Link: https://github.com/r3d5ky/sercomm_cfg_unpacker

Co-authored-by: Karim Dehouche <karimdplay@gmail.com>
Co-authored-by: Maximilian Weinmann <x1@disroot.org>
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-12-13 23:06:20 +01:00
Jan-Niklas Burfeind
dce66899bf ramips: add support for Wavlink WS-WN572HP3 4G
Wavlink WS-WN572HP3 4G is an 802.11ac
dual-band outdoor router with LTE support.

Specifications;
* Soc: MT7621DAT
* RAM: 128MiB
* Flash: NOR 16MiB GD-25Q128ESIG3
* Wi-Fi:
  * MT7613BEN: 5GHz
  * MT7603EN: 2.4GHz
* Ethernet: 2x 1GbE
* USB: None - only used internally
* LTE Modem: Quectel EC200T-EU
* UART: 115200 baud
* LEDs:
  * 7 blue at the front
    * 1 Power
    * 2 LAN / WAN
    * 1 Status
    * 3 RSSI (annotated 4G)
  * 1 green at the bottom (4G LED)
* Buttons: 1 reset button

Installation:
* press and hold the reset button while powering on the device
* keep it pressed for ten seconds
* connect to 192.168.10.1 via webbrowser (chromium/chrome works, at
  least Firefox 106.0.3 does not)
* upload the sysupgrade image, confirm the checksum, wait 2 minutes
  until the device reboots

Revert to stock firmware:
* same as installation but use the recovery image for WL-WN572HP3

Signed-off-by: Jan-Niklas Burfeind <git@aiyionpri.me>
Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com>
2022-12-07 12:30:45 +01:00
David Bauer
bc14925f3d ramips: define loadaddr for all UniFi devices
Define the load-address for the DTB of all Ubiquiti UniFi devices using
FIT images. From the GPL code we can assume these boards are affected by
the same relocating issue with the vendor bootloader.

Signed-off-by: David Bauer <mail@david-bauer.net>
2022-12-07 12:30:29 +01:00
Joonhyuk Song
25ede5170d ramips: mt7621: enable lzma-loader for netis WF2881
Fixes boot loader LZMA decompression issues (LZMA ERROR 1)

Signed-off-by: Joonhyuk Song <thenoface303@gmail.com>
2022-12-06 01:51:00 +01:00
INAGAKI Hiroshi
a224412bbc ramips: use ARTIFACTS for initramfs-factory of I-O DATA WN-AX1167GR
Use ARTIFACTS to generate initramfs-based factory image of I-O DATA
WN-AX1167GR instead of redundant recipe which generate on
KERNEL_INITRAMFS.

Note:

WN-AX1167GR has 2x OS images on stock firmware.

stock log:

flash manufacture id: c2, device id 20 18
MX25L12805D(c2 2018c220) (16384 Kbytes)
mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 10 MTD partitions on "raspi":
0x000000000000-0x000001000000 : "ALL"
0x000000000000-0x000000030000 : "Bootloader"
0x000000030000-0x000000040000 : "Config "
0x000000040000-0x000000050000 : "Factory"
0x000000050000-0x000000060000 : "iNIC_rf"
0x000000060000-0x0000007e0000 : "Kernel"
0x000000800000-0x000000f80000 : "app"
0x000000f90000-0x000000fa0000 : "Key"
0x000000fa0000-0x000000fb0000 : "backup"
0x000000fb0000-0x000001000000 : "storage"

1st image is "Kernel" and 2nd is "app" when booted from 1st image.
In OpenWrt, those 2x partitions are combined to "firmware" with
undefined (empty) areas (0x7e0000-0x7fffff, 0xf80000-0xf8ffff).

The size of an OS image partition is 0x780000 (7680 KiB = 7.5 MiB), so
check-size for initramfs-factory image needs to be called with the size.

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2022-12-05 01:28:28 +00:00
Senis John
a8f3c97ce8 ramips: add support for HiWiFi HC5611
CPU: MediaTek MT7628AN @ 575 MHz
Flash: 16 MB
RAM: 128 MB
Ethernet: 10/100Mbps x 1
Wlan: 300 Mbps
USB: USB 2.0 x 1
LED: red/green x 1
Button: reset x 1

1. Open https://www.hiwifi.wtf/, Get Cloud token and unlock ssh
2. Upload the openwrt firmware to the router via SCP
3. Login the router via SSH
4. Run `mtd -r write path_to_firmware.bin firmware`

I have tested on my device.
- The LED will display RED on power-on, After system start completed, trun GREEN
- Reset button working now. Long press after 5s will reset factory. Short press less 1s will reboot the device
- USB can working under official u-boot

Signed-off-by: Senis John <thank243@gmail.com>
2022-12-04 15:21:12 +08:00
Bjørn Mork
8719f73fa2 ramips: mt7621: enable lzma-loader for ZyXEL WAP6805
Fixing "Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board
to recover".

Signed-off-by: Bjørn Mork <bjorn@mork.no>
2022-12-03 21:04:38 +01:00
Maxim Anisimov
21762e4653 ramips: add support for Keenetic KN-3010
Keenetic KN-3010 is a 2.4/5 Ghz band 11ac (Wi-Fi 5) router, based on MT7621DAT.

Specification:
- System-On-Chip: MT7621DAT
- CPU/Speed: 880 MHz
- Flash-Chip: Winbond w25q256
- Flash size: 32768 KiB
- RAM: 128 MiB
- 5x 10/100/1000 Mbps Ethernet
- 4x external, non-detachable antennas
- UART (J1) header on PCB (115200 8n1)
- Wireless No1 (2T2R): MT7603E 2.4 GHz 802.11bgn
- Wireless No2 (2T2R): MT7613BE 5 GHz 802.11ac
- 4x LED, 2x button, 1x mode switch

Notes:
- The device supports dual boot mode
- The firmware partitions were concatinated into one
- The FN button led indicator has been reassigned as the 2.4GHz
  wifi indicator.

Flash instruction:
The only way to flash OpenWrt image is to use tftp recovery mode in U-Boot:

1. Configure PC with static IP 192.168.1.2/24 and tftp server.
2. Rename "openwrt-ramips-mt7621-keenetic_kn-3010-squashfs-factory.bin"
   to "KN-3010_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
   the router and keep button pressed until power led start blinking.
4. Router will download file from server, write it to flash and reboot.

Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
2022-11-20 16:44:24 +01:00
Moritz Warning
c0fb12c42e treewide: uniform vendor name for ASUS
Their own website (https://www.asus.com)
always uses the upper case style name.

Signed-off-by: Moritz Warning <moritzwarning@web.de>
2022-11-16 23:30:11 +01:00
Ivaylo Ivanov
6afc355b2e ramips: Add support for D-Link DIR-3060 A1
Hardware specification:
SoC: MediaTek MT7621AT
Flash: Winbond W29N01HVSINA 128MB
RAM: Micron MT41K128M16JT-125 256MB
Ethernet: 4x 10/100/1000 Mbps
WiFi1: MT7615DN 2.4GHz N 2x2:2
WiFi2: MT7615DN 5GHz AC 2x2:2
WiFi3: MT7615N 5GHz AC 4x4:4
Button: WPS, Reset

Flash instructions:
OpenWrt can be installed via D-Link Recovery GUI:

    Push and hold reset button (on the bottom of the device) until power led starts flashing (about 10 secs or so) while plugging in the power cable.
    Give it ~30 seconds, to boot the recovery mode GUI
    Connect your client computer to LAN1 of the device
    Set your client IP address manually to 192.168.0.2 / 255.255.255.0.
    Call the recovery page for the device at http://192.168.0.1/
    Use the provided emergency web GUI to upload and flash a new firmware to the device

Signed-off-by: Ivaylo Ivanov <iivailo@mail.bg>
2022-11-13 22:36:06 +01:00
Daniel Fuchs
794d1645b3 ramips: add support for Amped Wireless B1200EX
This device is almost identical to the already supported Edimax
EW-7476RP5, the only differences are:
- There is no mode selection slider switch on this device
- The two wireless LEDs are green instead of blue
- Model name in the CSYS header is RN10

Additional changes:
- Moved WiFi LEDs and the slider switch to the individual dt files
- Added ieee80211-freq-limit to the mt7612e radio to properly disable
  2.4GHz band on this radio

Device specifications:
SoC:	MediaTek MT7620a @ 580MHz
RAM:	64M (Winbond W9751G6KB-25)
FLASH:	8MB (Macronix)
WiFi:	SoC-integrated: MediaTek MT7620a bgn
WiFi:	MediaTek MT7612EN nac
GbE:	1x (RTL8211E)
BTN:	WPS/RESET
LED:	- WiFi 5G (green)
	- WiFi 2.4G (green)
	- Signal Strength (green)
	- Power (green)
	- WPS (green)
	- LAN (green)
UART:	UART is present as Pads with throughholes on the PCB. They are
	located next to the WPS button
	3.3V - RX - GND - TX / 57600-8N1
	3.3V is the square pad

Installation:
Upload the sysupgrade image via the default web interface

Signed-off-by: Daniel Fuchs <software@sagacioussuricata.com>
2022-11-13 22:36:06 +01:00
Mikhail Zhilkin
0cfd15552e ramips: add support for Rostelecom RT-SF-1
Rostelecom RT-SF-1 is a wireless WiFi 5 router manufactured by Sercomm
company.

Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 256 MiB
Flash: 256 MiB, Micron MT29F2G08ABAGA3W
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7615E): a/n/ac, 4x4
Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4)
USB ports: 1xUSB3.0
ZigBee: 3.0, EFR32 MG1B232GG
Button: 2 buttons (Reset & WPS)
LEDs:
   - 1x Status (RGB)
   - 1x 2.4G (blue, hardware, mt76-phy0)
   - 1x 5G (blue, hardware, mt76-phy1)
Power: 12 VDC, 1.5 A
Connector type: barrel
Bootloader: U-Boot

Installation
-----------------
1. Remove dots from the OpenWrt factory image filename
2. Login to the router web interface
3. Update firmware using web interface with the OpenWrt factory image
4. If OpenWrt is booted, then no further steps are required. Enjoy!
   Otherwise (Stock firmware has booted again) proceed to the next step.
5. Update firmware using web interface with any version of the Stock
   firmware
6. Update firmware using web interface with the OpenWrt factory image

Revert to stock
---------------
Change bootflag to Sercomm1 in OpenWrt CLI and then reboot:
    printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3

Recovery
--------
Use sercomm-recovery tool.
Link: https://github.com/danitool/sercomm-recovery

MAC Addresses
-------------
+-----+------------+------------+
| use | address    | example    |
+-----+------------+------------+
| LAN | label      | *:72, *:d2 |
| WAN | label + 11 | *:7d, *:dd |
| 2g  | label + 2  | *:74, *:d4 |
| 5g  | label + 3  | *:75, *:d5 |
+-----+------------+------------+
The label MAC address was found in Factory 0x21000

Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2022-11-13 21:51:22 +01:00
Óscar García Amor
62efb34071 ramips: add support for Cudy WR1300 v2
Specifications:
 - SoC: MediaTek MT7621AT
 - RAM: 128 MB (DDR3)
 - Flash: 16 MB (SPI NOR)
 - WiFi: MediaTek MT7603E, MediaTek MT7613BE
 - Switch: 1 WAN, 4 LAN (Gigabit)
 - Ports: 1 USB 3.0
 - Buttons: Reset, WPS
 - LEDs: System, Wan, Lan 1-4, WiFi 2.4G, WiFi 5G, WPS
 - Power: DC 12V 1A tip positive

Download and flash the manufacturer's built OpenWRT image available at
http://www.cudytech.com/openwrt_software_download
Install the new OpenWRT image via luci (System -> Backup/Flash firmware)
Be sure to NOT keep settings. The force upgrade may need to be checked
due to differences in router naming conventions.

Recovery:
 - Loads only signed manufacture firmware due to bootloader RSA verification
 - serve tftp-recovery image as /recovery.bin on 192.168.1.88/24
 - connect to any lan ethernet port
 - power on the device while holding the reset button
 - wait at least 8 seconds before releasing reset button for image to
   download
 - See http://www.cudytech.com/newsinfo/547425.html

Signed-off-by: Óscar García Amor <ogarcia@connectical.com>
2022-11-12 18:15:55 +01:00
Szabolcs Hubai
18801f2648 ramips: mt7621: use seama-lzma-loader for D-Link DIR-860L B1
Fix the LZMA ERROR 1 with a single line of recipe instead of duplicating
"uimage-lzma-loader".

While reviewing my original submission of commit ce19571004 David
suggested to use $(Device/uimage-lzma-loader), but due to the specific
needs of the vendor bootloader that simple oneliner didn't work.

The new $(Device/seama-lzma-loader) is for those SEAMA capable
bootloaders.

Signed-off-by: Szabolcs Hubai <szab.hu@gmail.com>
2022-11-12 18:15:55 +01:00
Szabolcs Hubai
c293b492df ramips: rt3883: use seama-lzma-loader for D-Link DIR-645
In the support topic [0] of the GitHub issue #10634 it was found out
(based on boot logs) that the uimage-lzma-loader (commit 09faa73c53)
never worked, as an earlier workaround (commit 6fba88de19) negated
the recipe:

    3: System Boot system code via Flash.
    ## Booting image at bc050000 ...
    raspi_read: from:50000 len:40
    .raspi_read: from:50000 len:c
    .raspi_read: from:50000 len:1fa000
    ................................We have SEAMA, Image Size = 2072512
    Verifying Checksum ...
    Uncompressing SEAMA linux.lzma ... OK
    ## Transferring control to Linux (at address 80000000) ...
    ## Giving linux memsize in MB, 64

    Starting kernel ...

    [    0.000000] Linux version 5.4.188 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16554-1d4dea6d4f)) #0 Sat Apr 16 12:59:34 2022
    [    0.000000] SoC Type: Ralink RT3883 ver:1 eco:5
    [    0.000000] printk: bootconsolde [early0] enabled
    [    0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
    [    0.000000] MIPS: machine is D-Link DIR-645
    [    0.000000] Initrd not found or empty - disabling initrd

Using the new seama-lzma-loader it's able to boot OpenWrt 22.03
and OpenWrt SNAPSHOT too:

    3: System Boot system code via Flash.
    ## Booting image at bc050000 ...
    raspi_read: from:50000 len:40
    .raspi_read: from:50000 len:c
    .raspi_read: from:50000 len:48b004
    .........................................................................We have SEAMA, Image Size = 4763588
    Verifying Checksum ...
    Uncompressing SEAMA linux.lzma ... OK
    ## Transferring control to Linux (at address 80000000) ...
    ## Giving linux memsize in MB, 64

    Starting kernel ...

    OpenWrt kernel loader for MIPS based SoC
    Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
    Decompressing kernel... done!
    Starting kernel at 80000000...

    [    0.000000] Linux version 5.10.144 (xabolcs@ut2004) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r20774+2-b71affaf8b) 11.3.0, GNU ld (GNU Binutils) 2.37) #0 Tue Sep 27 23:02:30 2022
    [    0.000000] SoC Type: Ralink RT3883 ver:1 eco:5
    [    0.000000] printk: bootconsole [early0] enabled
    [    0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
    [    0.000000] MIPS: machine is D-Link DIR-645
    [    0.000000] Initrd not found or empty - disabling initrd
    [    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
    [    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
    [    0.000000] Zone ranges:
    [    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
    [    0.000000] Movable zone start for each node
    [    0.000000] Early memory node ranges
    [    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
    [    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
    [    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16256
    [    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2

The OKLI Loader is unable to read the flash on this SoC:

    Looking for OpenWrt image... not found! ('0xddbaddba' at 0xbc051000)

0: https://forum.openwrt.org/t/136435

Fixes: GitHub issue #10634 ("V22.03.0 release currently does not work on D-Link DIR-645")
Fixes: 09faa73c53 ("ramips: rt3883: use lzma-loader for DIR-645")
Tested-by: Glenn Fowler <gfowler1@outlook.com>
Signed-off-by: Szabolcs Hubai <szab.hu@gmail.com>
2022-11-12 18:15:55 +01:00
Szabolcs Hubai
e7ad68d682 ramips: define lzma-loader recipe for SEAMA devices
Define "Device/seama-lzma-loader" recipe for SEAMA devices to help
contributors avoid doing recipe mistakes.

In a forum topic [0] I was under the impression that the good old
uimage-lzma-loader didn't fix the LZMA ERROR 1 for a device.

It was found out, that the uimage-lzma-loader never worked because the
KERNEL variable was overriden earlier (also an LZMA ERROR 1 related
commit, 6fba88de19), and the "use lzma-loader" fix (commit
09faa73c53) didn't catch that to include the "loader-kernel" part.

I contributed an LZMA ERROR 1 fix (commit ce19571004) for the SEAMA
device D-Link DIR-860L B1, where I had to duplicate the whole
uimage-lzma-loader recipe because of the special needs of the vendor
bootloader.

This new recipe reuse most of uimage-lzma-loader's KERNEL definiton to
avoid duplication.

It uses "relocate-kernel" as it needed for D-Link DIR-860L B1 to
boot from flash, and it's compatible with D-Link DIR-645 too.

It repacks lzma-loader with lzma for kernel (without uImage), because
these weird hacked vendor bootloaders accepts only LZMA compressed
kernels from flash:

    We have SEAMA, Image Size = 4759794
    Verifying Checksum ...
    Uncompressing SEAMA linux.lzma ... OK

It uses uImage header for initramfs kernel to be little bit verbose.

0: https://forum.openwrt.org/t/136435/10

Signed-off-by: Szabolcs Hubai <szab.hu@gmail.com>
2022-11-12 18:15:55 +01:00
Arne Zachlod
ffa4b5283b ramips: add support for Mikrotik LtAP-2HnD
Mikrotik LtAP-2HnD is a outdoor/automotive WLAN 4 router with integrated GPS
receiver and two mPCIe slots.

Specifications:
* SoC: MT7621A
* RAM: 128 MiB Nanya NT5CC64M16GP-DI
* Flash: 16 MiB winbond W25Q128JV
* WLAN:
  * Atheros AR9382 with power amplifier SKY 85330 (2x2 internal antennas,
    with RF switches for external connectors)
* Ethernet: 1 Gbps, single port
* USB Host: USB 2.0 Speeds
* Serial: 115200 baud
* LEDs: Power, System, GPS, 5* RSSI
*  mPCIe:
   * miniPCIe slot 1: PCIe and USB 2.0 Host (via switch shared with USB Host)
   * miniPCIe slot 2: USB 2.0 and 3.0
* SIM Cards:
  * Slot 1 Connected to mPCIe slot 1
  * Slot 2 and 3 connected to mPCIe slot 2 via switch
* GPS: MTK 3333 on serial port 2 (/dev/ttyS1), 115200 baud and PPS on gpio 14

gpios are exposed to /sys/class/gpio:

* usb-select: swithes USB 2.0 interface between external port and internal
mPCIe slot 1 default is the external USB interface
* gps-reset: resets the GPS interface chip
* sim-select: switches between sim slot 2 and 3 connected to mPCIe slot 2
* gps-ant-select: switches GPS antenna between internal antenna and SMA
connected antenna
* lte-reset: resets mPCIe slot 2

Flashing:
 TFTP boot initramfs image and then perform sysupgrade. Follow common
 MikroTik procedure as in https://openwrt.org/toh/mikrotik/common.

Signed-off-by: Arne Zachlod <arne@nerdkeller.org>
2022-11-12 18:15:55 +01:00