openwrt/target/linux/ramips/dts/mt7621_gemtek_wvrtm-130acn.dts
Samuele Longhi e80b596c58 ramips: mt7621: add support for Gemtek WVRTM-127ACN and WVRTM-130ACN
The Gemtek WVRTM-127ACN is an indoor dual band wifi router
with internal antennas and 3 Gigabit Ethernet ports.

The Gemtek WVRTM-130ACN is an indoor dual band wifi router
with external antennas and 5 Gigabit Ethernet ports.

Hardware of WVRTM-127ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB
- Storage: 128 MB NAND SLC flash
- Ethernet: 3x 10/100/1000 Mbps LAN1,LAN2 & WAN
- Wireless: 2.4GHz: Mediatek MT7603EN (802.11b/g/n)
- Wireless: 5GHz: Mediatek MT7612EN (802.11n/ac)
- LEDs: 11x
- Buttons: 2x WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ IN (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-127ACN_V02" "19K-513-8500R" "RoHS" "1717"

Hardware of WVRTM-130ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB (Kioxia TC58BVG0S3HTA00)
- Storage: 128 MB NAND SLC (Winbond W971GG6SB-25)
- Ethernet: 5x 10/100/1000 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
- Wireless: 2.4GHz and 5GHz Mediatek MT7615DN (802.11ac/b/g/n) (DBDC)
- LEDs: 10x
- Buttons: 3x Power, WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-130ACN_V01" "19K-515-4500R" "RoHS" "2112"

Enable access to uboot menu (needed in wvrtm-130acn):
- The access to uboot menu is blocked by `bootdelay = 0` set in ubootenv.
With stock firmware version 01.01.02.163 and previous, you can use CVE 2020-24365
command injection https://nvd.nist.gov/vuln/detail/CVE-2020-24365
    python3 exploit.py -t 192.168.1.1 -c "fw_setenv bootdelay 3; fw_saveenv"

Backup the stock firmware:
- Connect via uart
- Connect via ethernet and assign your pc the address 192.168.15.x/24
- Power on the device; and start typing '4' to enter uboot menu
- Set factory mode and boot
    MT7621 # setenv factory 2; saveenv
    MT7621 # nand read 2800000 2000000 81000000; bootm
- Telnet and copy all mtd blocks
    telnet 192.168.15.1
- Copy all mtd blocks and start webserver
    for N in $(seq 0 6); do dd if=/dev/mtd$N of=/tmp/eeprom_mtd$N.bin; done
    mount -o bind /tmp /www
    lighttpd -f /etc/lighttpd.conf
- Backup stock rootfs_data (optional)
    dd if=/dev/mtd7 of=/tmp/eeprom_mtd7.bin
    dd if=/dev/mtd8 of=/tmp/eeprom_mtd8.bin
- Download to your pc from http://192.168.15.1/eeprom_mtd$N.bin

Installation:
- Connect via uart
- Connect via ethernet and assign your pc the address 10.10.10.3/24
- Start a tftp server and serve the image initramfs-kernel.bin
    mkdir /tmp/ftpd;
    cp initramfs-kernel.bin /tmp/ftpd/kernel.bin
    dnsmasq --enable-tftp --tftp-root=/tmp/ftpd
- Power on the device; and start typing '4' to halt the bootloader
- Change the active mtd partition from mtd6 to mtd5 (needed by uboot)
    MT7621 # setenv mtddevnum 5; saveenv
- Write the openwrt initramfs in ram via tftp and boot it
    MT7621 # tftpboot 81000000 kernel.bin; bootm
- From the initramfs create the ubi device and install openwrt via sysupgrade
    ubiformat /dev/mtd11 -y
    sysupgrade -n -v /tmp/sysupgrade.bin

Recovery:
Restore the stock firmware from the backup of the mtd blocks
    mtd write eeprom_mtd5.bin firmware
    mtd write eeprom_mtd6.bin Kernel2
    mtd write eeprom_mtd7.bin Storage1
    mtd write eeprom_mtd8.bin Storage2
    ubiformat /dev/mtd8 -y
    reboot

Links to previous works on wvrtm-127acn:
https://github.com/digiampietro/hacking-gemtek
https://forum.openwrt.org/t/add-support-for-gemtek-wvrtm-127acn-linkem-provider/168757

Signed-off-by: Samuele Longhi <agave@dracaena.it>
Link: https://github.com/openwrt/openwrt/pull/16685
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2024-10-19 17:23:36 +02:00

88 lines
1.3 KiB
Plaintext

// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
#include "mt7621_gemtek_wvrtm-1xxacn.dtsi"
/ {
compatible = "gemtek,wvrtm-130acn", "mediatek,mt7621-soc";
model = "Gemtek WVRTM-130ACN";
};
&eeprom_factory_0 {
reg = <0x0 0x4da8>;
};
&macaddr_factory_4 {
compatible = "mac-base";
#nvmem-cell-cells = <1>;
};
&keys {
button-2 {
label = "power";
gpios = <&gpio 27 GPIO_ACTIVE_LOW>;
linux,code = <KEY_POWER>;
};
};
&leds {
led-7 {
gpios = <&gpio_hc595 7 GPIO_ACTIVE_HIGH>;
function = LED_FUNCTION_WPS;
color = <LED_COLOR_ID_GREEN>;
};
};
&pcie0 {
wifi@0,0 {
compatible = "mediatek,mt76";
reg = <0x0000 0 0 0 0>;
nvmem-cells = <&eeprom_factory_0>;
nvmem-cell-names = "eeprom";
#address-cells = <2>;
#size-cells = <0>;
band@0 {
/* 2.4 GHz */
reg = <0>;
nvmem-cells = <&macaddr_factory_4 (-1)>;
nvmem-cell-names = "mac-address";
/* led_pin 0 */
};
band@1 {
/* 5 GHz */
reg = <1>;
nvmem-cells = <&macaddr_factory_4 0>;
nvmem-cell-names = "mac-address";
/* led_pin 2 */
};
led {
led-sources = <2>;
led-active-low;
};
};
};
&ports {
port@0 {
status = "okay";
label = "lan1";
};
port@1 {
status = "okay";
label = "lan2";
};
port@2 {
status = "okay";
label = "lan3";
};
port@3 {
status = "okay";
label = "lan4";
};
};