Xiaomi Mi Router CR6606 is a Wi-Fi6 AX1800 Router with 4 GbE Ports.
Alongside the general model, it has three carrier customized models:
CR6606 (China Unicom), CR6608 (China Mobile), CR6609 (China Telecom)
Specifications:
- SoC: MediaTek MT7621AT
- RAM: 256MB DDR3 (ESMT M15T2G16128A)
- Flash: 128MB NAND (ESMT F59L1G81MB)
- Ethernet: 1000Base-T x4 (MT7530 SoC)
- WLAN: 2x2 2.4GHz 574Mbps + 2x2 5GHz 1201Mbps (MT7905DAN + MT7975DN)
- LEDs: System (Blue, Yellow), Internet (Blue, Yellow)
- Buttons: Reset, WPS
- UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1)
- Power: 12VDC, 1A
Jailbreak Notes:
1. Get shell access.
1.1. Get yourself a wireless router that runs OpenWrt already.
1.2. On the OpenWrt router:
1.2.1. Access its console.
1.2.2. Create and edit
/usr/lib/lua/luci/controller/admin/xqsystem.lua
with the following code (exclude backquotes and line no.):
```
1 module("luci.controller.admin.xqsystem", package.seeall)
2
3 function index()
4 local page = node("api")
5 page.target = firstchild()
6 page.title = ("")
7 page.order = 100
8 page.index = true
9 page = node("api","xqsystem")
10 page.target = firstchild()
11 page.title = ("")
12 page.order = 100
13 page.index = true
14 entry({"api", "xqsystem", "token"}, call("getToken"), (""),
103, 0x08)
15 end
16
17 local LuciHttp = require("luci.http")
18
19 function getToken()
20 local result = {}
21 result["code"] = 0
22 result["token"] = "; nvram set ssh_en=1; nvram commit; sed -i
's/channel=.*/channel=\"debug\"/g' /etc/init.d/dropbear; /etc/init.d/drop
bear start;"
23 LuciHttp.write_json(result)
24 end
```
1.2.3. Browse http://{OWRT_ADDR}/cgi-bin/luci/api/xqsystem/token
It should give you a respond like this:
{"code":0,"token":"; nvram set ssh_en=1; nvram commit; ..."}
If so, continue; Otherwise, check the file, reboot the rout-
er, try again.
1.2.4. Set wireless network interface's IP to 169.254.31.1, turn
off DHCP of wireless interface's zone.
1.2.5. Connect to the router wirelessly, manually set your access
device's IP to 169.254.31.3, make sure
http://169.254.31.1/cgi-bin/luci/api/xqsystem/token
still have a similar result as 1.2.3 shows.
1.3. On the Xiaomi CR660x:
1.3.1. Login to the web interface. Your would be directed to a
page with URL like this:
http://{ROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/web/home#r-
outer
1.3.2. Browse this URL with {STOK} from 1.3.1, {WIFI_NAME}
{PASSWORD} be your OpenWrt router's SSID and password:
http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/misy-
stem/extendwifi_connect?ssid={WIFI_NAME}&password={PASSWO-
RD}
It should return 0.
1.3.3. Browse this URL with {STOK} from 1.3.1:
http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/xqsy-
stem/oneclick_get_remote_token?username=xxx&password=xxx&-
nonce=xxx
1.4. Before rebooting, you can now access your CR660x via SSH.
For CR6606, you can calculate your root password by this project:
https://github.com/wfjsw/xiaoqiang-root-password, or at
https://www.oxygen7.cn/miwifi.
The root password for carrier-specific models should be the admi-
nistration password or the default login password on the label.
It is also feasible to change the root password at the same time
by modifying the script from step 1.2.2.
You can treat OpenWrt Router however you like from this point as
long as you don't mind go through this again if you have to expl-
oit it again. If you do have to and left your OpenWrt router unt-
ouched, start from 1.3.
2. There's no official binary firmware available, and if you lose the
content of your flash, no one except Xiaomi can help you.
Dump these partitions in case you need them:
"Bootloader" "Nvram" "Bdata" "crash" "crash_log"
"firmware" "firmware1" "overlay" "obr"
Find the corespond block device from /proc/mtd
Read from read-only block device to avoid misoperation.
It's recommended to use /tmp/syslogbackup/ as destination, since files
would be available at http://{ROUTER_ADDR}/backup/log/YOUR_DUMP
Keep an eye on memory usage though.
3. Since UART access is locked ootb, you should get UART access by modify
uboot env. Otherwise, your router may become bricked.
Excute these in stock firmware shell:
a. nvram set boot_wait=on
b. nvram set bootdelay=3
c. nvram commit
Or in OpenWrt:
a. opkg update && opkg install kmod-mtd-rw
b. insmod mtd-rw i_want_a_brick=1
c. fw_setenv boot_wait on
d. fw_setenv bootdelay 3
e. rmmod mtd-rw
Migrate to OpenWrt:
1. Transfer squashfs-firmware.bin to the router.
2. nvram set flag_try_sys1_failed=0
3. nvram set flag_try_sys2_failed=1
4. nvram commit
5. mtd -r write /path/to/image/squashfs-firmware.bin firmware
Additional Info:
1. CR660x series routers has a different nand layout compared to other
Xiaomi nand devices.
2. This router has a relatively fresh uboot (2018.09) compared to other
Xiaomi devices, and it is capable of booting fit image firmware.
Unfortunately, no successful attempt of booting OpenWrt fit image
were made so far. The cause is still yet to be known. For now, we use
legacy image instead.
Signed-off-by: Raymond Wang <infiwang@pm.me>
The commit 04e91631e0 ("om-watchdog: add support for Teltonika RUT5xx
(ramips)") used the deprecated om-watchdog daemon to handle the GPIO-line
connected watchdog on the Teltonika RUT5xx.
But this daemon has massive problems since commit 30f61a34b4
("base-files: always use staged sysupgrade"). The process will always be
stopped on sysupgrades. If the sysupgrade takes slightly longer, the
watchdog is not triggered at the correct time and thus the sysupgrade will
interrupted hard by the watchdog sysupgrade. And this hard interrupt can
easily brick the device when there is no fallback (dual-boot, ...).
Signed-off-by: Sven Eckelmann <sven@narfation.org>
The Wavlink WL-WN535K1 is a "mesh" router with 2 gigabit ethernet ports
and one fast ethernet port. Mine is branded as Talius TAL-WMESH1.
It can be found in kits of 2 or 3 (WL-WN535K2 or WL-WN535K3).
The motherboard is labelled as WS-WN535G3-B-V1.2 so this image could
potentially work for WL-WN535G3R and WS-WN535G3R with little to none
effort, but it's untested.
Hardware
--------
SoC: Mediatek MT7620A
RAM: 64MB
FLASH: 8MB NOR (GigaDevice GD25Q64CS)
ETH:
- 2x 10/100/1000 Mbps Ethernet (RTL8211F)
- 1x 10/100 Mbps Ethernet (integrated in SOC)
WIFI:
- 2.4GHz: 1x (integrated in SOC) (2x2:2)
- 5GHz: 1x MT7612E (2x2:2)
- 4 internal antennas
BTN:
- 1x Reset button
- 1x Touchlink button (set to WPS)
- 1x ON/OFF switch
LEDS:
- 1x Red led (system status)
- 1x Blue led (system status)
- 3x Green leds (ethernet port status/act)
UART:
- 57600-8-N-1
Everything works correctly.
Currently there is no firmware update available. Because of this, in
order to restore the OEM firmware, you must firstly dump the OEM
firmware from your router before you flash the OpenWrt image.
Backup the OEM Firmware
-----------------------
The following steps are to be intended for users having little to none
experience in linux. Obviously there are many ways to backup the OEM
firmware, but probably this is the easiest way for this router.
Procedure tested on WN535K1_V1510_200916 firmware version.
1) Go to http://192.168.10.1/webcmd.shtml
2) Type the following line in the "Command" input box and then press enter:
mkdir /etc_ro/lighttpd/www/dev; dd if=/dev/mtd0ro of=/etc_ro/lighttpd/www/dev/mtd0ro
3) After few seconds in the textarea should appear this output:
16384+0 records in
16384+0 records out
If your output doesn't match mine, stop reading and ask for
help in the forum.
4) Open in another tab http://192.168.10.1/dev/mtd0ro to download the
content of the whole NOR. If the file size is 0 byte, stop reading
and ask for help in the forum.
5) Come back to the http://192.168.10.1/webcmd.shtml webpage and type:
rm /etc_ro/lighttpd/www/dev/mtd0ro;for i in 1 2 3 4 5; do dd if=/dev/mtd${i}ro of=/etc_ro/lighttpd/www/dev/mtd${i}ro; done
6) After few seconds, in the textarea should appear this output:
384+0 records in
384+0 records out
128+0 records in
128+0 records out
128+0 records in
128+0 records out
14720+0 records in
14720+0 records out
1024+0 records in
1024+0 records out
If your output doesn't match mine, stop reading and ask for
help in the forum.
7) Open the following links to download the partitions of the OEM FW:
http://192.168.10.1/dev/mtd1rohttp://192.168.10.1/dev/mtd2rohttp://192.168.10.1/dev/mtd3rohttp://192.168.10.1/dev/mtd4rohttp://192.168.10.1/dev/mtd5ro
If one (or more) of these files are 0 byte, stop reading and ask
for help in the forum.
8) Store these downloaded files in a safe place.
9) Reboot your router to remove any temporary file in ram.
Installation
------------
Flash the initramfs image in the OEM firmware interface
(http://192.168.10.1/update_mesh.shtml).
When Openwrt boots, flash the sysupgrade image otherwise you won't be
able to keep configuration between reboots.
Restore OEM Firmware
--------------------
Flash the "mtd4ro" file you previously backed-up directly from LUCI.
Warning: Remember to not keep settings!
Warning2: Remember to force the flash.
Notes
-----
1) Router mac addresses:
LAN XX:XX:XX:XX:XX:E2 (factory @ 0x28)
WAN XX:XX:XX:XX:XX:E3 (factory @ 0x2e)
WIFI 2G XX:XX:XX:XX:XX:E4 (factory @ 0x04)
WIFI 5G XX:XX:XX:XX:XX:E5 (factory @ 0x8004)
LABEL XX:XX:XX:XX:XX:E5
2) The OEM firmware upgrade page accepts only files containing the
string "WN535K1" in the filename.
3) Additional notes 1,2,3 in the WS-WN583A6 commit are still valid
(92780d80ab)
Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
[remove trailing whitespace]
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Flash accessing instruction templates are determined during probe since
v5.6 for spimem-dirmap support in spi-nor driver in upstream commit:
df5c21002cf4 ("mtd: spi-nor: use spi-mem dirmap API")
As a result, changing bus_width on the fly doesn't work anymore and this
patch will cause executing spi-mem ops with 3-byte address on 16-32M
flash area.
We can't easily revert that behavioral change upstream so drop the patch
to prevent u-boot and eeprom from being erased.
Fixes: b10d604459("kernel: add linux 5.10 support")
Reported-by: Frank Di Matteo <dimatto@foxmail.com>
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
I2C_CHARDEV used to be enabled in mt7621/config-5.4. Enable it in the
5.10 config, as it's required for PoE control on Unifi Switch Flex.
Fixes: b4aad29a1d ("ramips: add support for kernel 5.10")
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Currently the WAN MAC address is read from a different offset contrary
to all other addresses.
There's conflicting information whether offset 0x28 on the factory
partition contains the valid WAN mac for all devices while 0x4 seems to
be uniform.
Read the WAN mac from this location and calculate it.
Signed-off-by: David Bauer <mail@david-bauer.net>
The current MAC address assignment is still incorrect.
Use the same MAC address as seen on the stock firmware
for both wireless interfaces.
The 5GHz MAC address OUI is +2 in the first EUI octet. We currently
don't do this in OpenWrt. Ignore this offset for now. With the current
assignment, recurring MAC addresses between radios is already taken care
of.
Signed-off-by: David Bauer <mail@david-bauer.net>
It was reported, that Tenbay T-MB5EU v1 do have incorrect Wireless MAC
address set on 2.4 and 5 GHz.
Some boards do not seem to have the correct MAC address set for the
external PHY of the MT7915 radio at caldata offset 0xa.
As the external PHY does not expose a DT binding (yet), fix up the mac
address in userspace.
Signed-off-by: David Bauer <mail@david-bauer.net>
When Joowin WR758AC V1 and V2 devices were added, they should have been
added with the primary manufacturer name which is COMFAST, since Joowin
is just an alternate vendor name on some coutries or stores.
Fix this by changing the the vendor name on the respective files and set
Joowin as ALT0 variants while ensuring compatibility for early users.
Also adjust the model names to better follow the naming rules.
As a side effect, fix mt76x8 network script which was left incorrectly
unsorted on the case block conditions.
Fixes: 766733e172 ("ramips: add support for Joowin WR758AC V1 and V2")
Signed-off-by: Rodrigo Araujo <araujo.rm@gmail.com>
The following devices have a Winbond W25Q256FV flash chip,
which does not have the RESET pin enabled by default,
and otherwise would require setting a bit in a status register.
Before moving to Linux 5.4, we had the patch:
0053-mtd-spi-nor-add-w25q256-3b-mode-switch.patch
which kept specific flash chips with explicit 3-byte and 4-byte address modes
to stay in 3-byte address mode while idle (after an erase or write)
by using a custom flag SPI_NOR_4B_READ_OP that was part of the patch.
this was obsoleted by the patch:
481-mtd-spi-nor-rework-broken-flash-reset-support.patch
which uses the newer upstream flag SNOR_F_BROKEN_RESET
for devices with a flash chip that cannot be hardware reset with RESET pin
and therefore must be left in 3-byte address mode when idle.
The new patch requires that the DTS of affected devices
have the property "broken-flash-reset", which was not yet added for most of them.
This commit adds the property for remaining affected devices in ramips target,
specifically because of the flash chip model.
However, it is possible that there are other devices
where the flash chip uses an explicit 4-byte address mode
and the RESET pin is not connected to the SOC on the board,
and those DTS would also need this property.
Ref: 22d982ea00 ("ramips: add support for switching between 3-byte and 4-byte addressing")
Ref: dfa521f129 ("generic: spi-nor: rework broken-flash-reset")
Signed-off-by: Michael Pratt <mcpratt@pm.me>
ipTIME A6004NS-M is a 2.4/5GHz band AC1900 router, based on MediaTek MT7621A.
Specifications:
- SoC: MediaTek MT7621A (880MHz, Duel-Core)
- RAM: DDR3 256MB
- Flash: SPI NOR 16MB (Winbond W25Q128BV)
- WiFi: MediaTek MT7615E (2.4GHz, 5GHz)
- Ethernet: MediaTek MT7530 (WAN x1, LAN x4, SoC built-in Estimated)
- USB: USB 3.0 x1
- UART: [3.3V, TX, RX, GND] (57600 8N1)
Installation via web interface:
1. Flash initramfs image using OEM's Firmware Update page.
2. Connect to OpenWrt with an SSH connection to `192.168.1.1`.
3. Perform sysupgrade with sysupgrade image.
Revert to stock firmware:
1. Flash stock firmware via OEM's Recovery mode
How to use OEM's Recovery mode:
1. Power on the device and connect the shell through UART.
2. Connect to the shell and press the `t` key on the keyboard.
3. Set fixed IP with `192.168.0.2` with subnet mask `255.255.255.0`
4. Flash image via TFTP to `192.168.0.1`
Additional Notes:
1. The higher the 5Ghz Frequency, the lower the stability. It is recommended to use less than 5.775Ghz.
2. If the 5Ghz frequency is too high, 5Ghz may not work.
3. A6ns-M use shared dtsi file of A6004NS-M. (reference: /mt7621_iptime_a6004ns-m.dtsi).
Signed-off-by: SeongUk Moon <antegral@antegral.net>
[convert CRLF to LF]
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
HUMAX E2 (also known as HUMAX QUANTUM E2) is a 2.4/5GHz band AC router,
based on MediaTek MT7620A.
Specifications:
- SoC: MT7620A
- RAM: DDR2 64MB
- Flash: SPI NOR 8MB (MXIC MX25L6405D)
- WiFi:
- 2.4GHz: SoC internal
- 5GHz: MT7610E
- Ethernet: 1x 10/100Mbps
- Switch: SoC internal
- UART: J2 (57600 8N1)
- pinout: [3V3] (RXD) (GND) (TXD)
Installation and Recovery via TFTP:
1. Connect ethernet cable between Router port and PC Ethernet port.
2. Set your computer to a static IP **192.168.1.1**
3. Turn the device off and wait a few seconds. Hold the WPS button on front
of device and insert power.
4. Send a firmware image to **192.168.1.6** using TFTP.
You can use any TFTP client. (tftp, curl, Tftpd64...)
5. Wait until Power LED stop flashing. **DO NOT TURN OFF DEVICE!**
The device will be automatically rebooted.
Signed-off-by: Kyoungkyu Park <choryu.park@choryu.space>
Specifications:
- SoC: MT7621DAT (880MHz, 2 Cores)
- RAM: 128 MB
- Flash: 128 MB NAND
- Ethernet: 5x 1GiE MT7530
- WiFi: MT7603/MT7613
- USB: 1x USB 3.0
This is another MT7621 device, very similar to other Linksys EA7300
series devices.
Installation:
Upload the generated factory.bin image via the stock web firmware
updater.
Reverting to factory firmware:
Like other EA7300 devices, this device has an A/B router configuration
to prevent bricking. Hard-resetting this device three (3) times will
put the device in failsafe (default) mode. At this point, flash the
OEM image to itself and reboot. This puts the router back into the 'B'
image and allows for a firmware upgrade.
Troubleshooting:
If the firmware will not boot, first restore the factory as described
above. This will then allow the factory.bin update to be applied
properly.
Signed-off-by: Nick McKinney <nick@ndmckinney.net>
RAISECOM MSG1500 X.00 is a 2.4/5 GHz band 11ac (Wi-Fi 5) router.
Apart from the general model, there are two ISP customized models:
China Mobile and China Telecom.
Specifications:
- SoC: Mediatek MT7621AT
- RAM: 256MiB DDR3
- Flash: 128MiB NAND
- Ethernet: 5 * 10/100/1000Mbps: 4 * LAN + 1 * WAN
- Switch: MediaTek MT7530 (SoC)
- WLAN: 1 * MT7615DN Dual-Band 2.4GHz 2T2R (400Mbps) 5GHz 2T2R (867Mbps)
- USB: 1 * USB 2.0 port
- Button: 1 * RESET button, 1 * WPS button, 1 * WIFI button
- LED: blue color: POWER, WAN, WPS, 2.4G, 5G, LAN1, LAN2, LAN3, LAN4, USB
- UART: 1 * serial port header (4-pin)
- Power: DC 12V, 1A
- Switch: 1 * POWER switch
MAC addresses as verified by vendor firmware:
use address source
LAN C8:XX:XX:3A:XX:E7 Config "protest_lan_mac" ascii (label)
WAN C8:XX:XX:3A:XX:EA Config "protest_wan_mac" ascii
5G C8:XX:XX:3A:XX:E8 Factory "0x4" hex
2.4G CA:XX:XX:4A:XX:E8 [not on flash]
The increment of the 4th byte for the 2.4g address appears to vary.
Reported cases:
5g 2.4g increment
C8:XX:XX:90:XX:C3 CA:XX:XX:C0:XX:C3 0x30
C8:XX:XX:3A:XX:08 CA:XX:XX:4A:XX:08 0x10
C8:XX:XX:3A:XX:E8 CA:XX:XX:4A:XX:E8 0x10
Since increment is inconsistent and there is no obvious pattern
in swapping bytes, and the 2.4g address has local bit set anyway,
it seems safer to use the LAN address with flipped byte here in
order to prevent collisions between OpenWrt devices and OEM devices
for this interface. This way we at least use an address as base
that is definitely owned by the device at hand.
Notes:
1. The vendor firmware allows you to connect to the router by telnet.
(known version 1.0.0 can open telnet.)
There is no official binary firmware available.
Backup the important partitions data:
"Bootloader", "Config", "Factory", and "firmware".
Note that with the vendor firmware the memory is detected only 128MiB
and the last 512KiB in NAND flash is not used.
2. The POWER LED is default on after press POWER switch.
The WAN and LAN1 - 4 LEDs are wired to ethernet switch.
The WPS LED is controlled by MT7615DN's GPIO.
Currently there is no proper way to configure it.
3. At the time of adding support the wireless config needs to be set up
by editing the wireless config file:
* Setting the country code is mandatory, otherwise the router loses
connectivity at the next reboot. This is mandatory and can be done
from luci. After setting the country code the router boots correctly.
A reset with the reset button will fix the issue and the user has to
reconfigure.
* This is minor since the 5g interface does not come up online although
it is not set as disabled. 2 options here:
1- Either run the "wifi" command. Can be added from LuCI in system -
startup - local startup and just add wifi above "exit 0".
2- Or add the serialize option in the wireless config file as shown
below. This one would work and bring both interfaces automatically
at every boot:
config wifi-device 'radio0'
option serialize '1'
config wifi-device 'radio1'
option serialize '1'
Flash instructions using initramfs image:
1. Press POWER switch to power down if the router is running.
2. Connect PC to one of LAN ports, and set
static IP address to "10.10.10.2", netmask to "255.255.255.0",
and gateway to "10.10.10.1" manually on the PC.
3. Push and hold the WIFI button, and then power up the router.
After about 10s (or you can call the recovery page, see "4" below)
you can release the WIFI button.
There is no clear indication when the router
is entering or has entered into "RAISECOM Router Recovery Mode".
4. Call the recovery page for the router at "http://10.10.10.1".
Keep an eye on the "WARNING!! tip" of the recovery page.
Click "Choose File" to select initramfs image, then click "Upload".
5. If image is uploaded successfully, you will see the page display
"Device is upgrading the firmware... %".
Keep an eye on the "WARNING!! tip" of the recovery page.
When the page display "Upgrade Successfully",
you can set IP address as "automatically obtain".
6. After the rebooting (PC should automatically obtain an IP address),
open the SSH connection, then download the sysupgrade image
to the router and perform sysupgrade with it.
Flash back to vendor firmware:
See "Flash instructions 1 - 5" above.
The only difference is that in step 4
you should select the vendor firmware which you backup.
Signed-off-by: Liangkuan Yang <ylk951207@gmail.com>
This commit adds support for Joowin (aka Comfast) WR758AC V1 and V2
devices.
Both have the same wall AP/repeater form factor and differ only
in the 5Ghz chipset (V1 has MT7662, V2 has MT7663).
OpenWrt developers forum page:
https://forum.openwrt.org/t/87355
Specifications:
- CPU: MediaTek MT7628AN (580MHz)
- Flash: 8MB
- RAM: 64MB DDR2
- 2.4 GHz: 802.11b/g/n (MT7603)
- 5 GHz: 802.11ac (V1 has MT7662, V2 has MT7663)
- Antennas: 4x external single band antennas
- LAN: 1x 10/100M
- LED: Wifi 3x blue. Programmable
- Button: WPS
MAC addresses as verified by OEM firmware:
use address source
LAN *:83 factory 0xe000
2g *:85 factory 0x4
5g *:86 factory 0x8004
How to install:
1- Setup a TFTP server on a machine with IP address 192.168.1.10/24
2- Name the image as `firmware_auto.bin` and place it on the root of the
TFTP server
3- Connect the device via Ethernet, it should pick and flash the image
Signed-off-by: Rodrigo Araujo <araujo.rm@gmail.com>
Jboot devices have problem with >2MB kernelsize. The only way to avoid
this problem is use small loader.
This patch switch all mt7620 Jboot devices to lzma OKLI loader.
Suggested-by: Szabolcs Hubai <szab.hu@gmail.com>
Co-authored-by: Michael Pratt <mcpratt@pm.me>
Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
HUMAX E10 (also known as HUMAX QUANTUM E10) is a 2.4/5GHz band AC router,
based on MediaTek MT7621A.
Specifications:
- SoC: MT7621A
- RAM: DDR3 128MB
- Flash: SPI NOR 16MB (MXIC MX25L12805D)
- WiFi:
- 2.4GHz: MT7615
- 5GHz: MT7615
- Ethernet: 2x 10/100/1000Mbps
- Switch: SoC internal
- USB: 1x USB 2.0 Type-A
- UART: J1 (57600 8N1)
- pinout: [3V3] (RXD) (GND) (TXD)
Installation via web interface:
- Flash **factory** image through the stock web interface.
Recovery procedure:
1. Connect ethernet cable between Router **LAN** port and PC Ethernet port.
2. Set your computer to a static IP **192.168.1.1**
3. Turn the device off and wait a few seconds. Hold the WPS button on front
of device and insert power.
4. Send a firmware image to **192.168.1.6** using TFTP.
You can use any TFTP client. (tftp, curl, Tftpd64...)
- It can accept both images which is
HUMAX stock firmware dump (0x70000-0x1000000) image
and OpenWRT **sysupgrade** image.
Signed-off-by: Kyoungkyu Park <choryu.park@choryu.space>
[remove trailing whitespace]
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
All patches automatically rebased.
Build system: x86_64
Build-tested: ramips/mt7621*
*I am hit with the binutils 2.37 bug so I had to revert 7f1edbd412
in order to downgrade to 2.35.1
Signed-off-by: John Audia <graysky@archlinux.us>
Zbtlink ZBT-WG1602 is a Wi-Fi router intendent to use with WWAN
(UMTS/LTE/3G/4G) modems. The router board offsers a couple of miniPCIe
slots with USB and SIM only and another one pure miniPCIe slot as well
as five Gigabit Ethernet ports (4xLAN + WAN).
Specification:
* SoC: MT7621A
* RAM: 256/512 MiB
* Flash: 16/32 MiB (SPI NOR)
* external watchdog (looks like Torexsemi XC6131B)
* Eth: 10/100/1000 Mbps Ethernet x5 ports (4xLAN + WAN)
* WLAN 2GHz: MT7603EN (.11n, MIMO 2x2)
* WLAN 5GHz: MT7612EN (.11ac, MIMO 2x2)
* WLAN Ants: detachable x2, shared by 2GHz & 5GHz radios
* miniPCIe: 2x slots with USB&SIM + 1x slot with regular PCIe bus
* WWAN Ants: detachable x4
* External storage: microSD (SDXC) slot
* USB: 2.0 Type-A port
* LED: 11 (5 per Eth phy, 3 SoC controlled, 2 WLAN 2/5 controlled, 1
power indicator)
* Button: 1 (reset)
* UART: console (115200 baud)
* Power: DC jack (12 V / 2.5 A)
Additional HW information:
* SoC USB port #1 is shared by internal miniPCIe slot and external
Type-A USB port, USB D+/D- lines are toggled between ports using a
GPIO controlled DPDT switch.
* Power of the USB enabled miniPCIe slots can be individually controlled
using dedicated GPIO lines.
* Vendor firmware feeds the external watchdog with 1s pulses. GPIO
watchdog driver is able to either generate a 1us pulses or toggle the
output line. 1us is not enough for the external watchod timer, so
the line toggling driver mode is utilized.
Installation:
Vendor's firmware is OpenWrt (LEDE) based, so the sysupgrade image can
be directly used to install OpenWrt. Firmware must be upgraded using the
'force' and 'do not save configuration' command line options (or
correspondig web interface checkboxes) since the vendor firmware is from
the pre-DSA era.
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
ipTIME A3004NS-dual is a 2.4/5GHz band router, based on Mediatek MT7621.
Specifications:
- SoC: MT7621 (880MHz)
- RAM: DDR3 256M
- Flash: SPI NOR 16MB
- WiFi:
- 2.4GHz: MT7602E
- 5GHz : MT7612E
- Ethernet:
- 4x LAN
- 1x WAN
- USB: 1 * USB3.0 port
- UART:
- 3.3V, TX, RX, GND / 57600 8N1
Installation via web interface:
- 1. Flash Initramfs image using OEM Firmware's web GUI
- 2. Boot into OpenWrt and perform Sysupgrade with sysupgrade image.
Revert to stock firmware:
- 1. Boot into OpenWrt and perform Sysupgrade with OEM Stock Firmware image.
Signed-off-by: Yuchan Seo <hexagonwin@disroot.org>
Reviewed-by: Sungbo Eo <mans0n@gorani.run>
Currently it is not possible to configure VLANs via LUCI on
tplink tl-mr3020-v3. This patch fixes switch topology for the
LUCI interface.
Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
[copied commit message from github PR]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
In 20b09a2125 Lava LR-25G001 router have problem with two inactive
ethernet ports. JBOOT bootloader didn't configure ethernet devices by default.
The same situation was there. It is required to enable all phy ports.
This is fragment of stock bootlog:
switch reg write_athr offset=90, value=2b0
switch reg write_athr offset=8c, value=2b0
switch reg write_athr offset=88, value=2b0
switch reg write_athr offset=84, value=2b0
switch reg write_athr offset=80, value=2b0
This patch adds proper registers configuration ar8337 initvals.
0x2b0 value causes force flow control configuration, 0x1200 was used
instead (flow control config auto-neg with phy). [1]
When switch is now ok, let's fix port numeration too.
Fixes: 20b09a2125 ("ramips: add support for Lava LR-25G001")
[1] https://github.com/openwrt/openwrt/pull/4806#issuecomment-982019858
Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
Correct ralink_i2s_debugfs_remove declaration in ralink patches when
CONFIG_DEBUG_FS is not selected.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
This commit adds support for the Wavlink WL-WN576A2 wall-plug wireles
repeater / router. It is also sold under the name SilverCrest SWV 733 B1.
Device specs:
- CPU: MediaTek MT7628AN
- Flash: 8MB
- RAM: 64MB
- Bootloader: U-Boot
- Ethernet: 1x 10/100 Mbps
- 2.4 GHz: b/g/n SoC
- 5 GHz: a/n/ac MT7610EN
- Buttons: WPS, reset, sliding switch (ap/repeater)
- LEDs: 5x wifi status, 1x LAN/WAN, 1x WPS
Flashing:
U-Boot launches a TFTP client if WPS button is held during boot.
- Server IP: 192.168.10.100
- Firmware file name: firmware.bin
Device will reboot automatically. First boot takes about 90s.
Coelner (waenger@gmail.com) is the original author, but I have made some
fixes. He does not wish to sign off using his real name.
Signed-off-by: Thomas Aldrian <dev.aldrian@gmail.com>
This is needed because the HLK-7621 EvB has 32MB of flash,
so it will have to use 4B addressing and the
broken-flash-reset hack has to be used to be able to reboot.
Signed-off-by: Wout Bertrums <wout@wbnet.eu>
[copied github message into commit message]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
LED labels for this device are different in 01_leds file and in device
DTS. Switch to DT triggers, which works on Telewell TW-4 (LTE) clone
device.
This has not been tested on the LR-25G001 itself, just on the clone
mentioned above.
Fixes: 20b09a2125 ("ramips: add support for Lava LR-25G001")
Signed-off-by: Jani Partanen <rtfm@iki.fi>
[rephrase commit title/message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Specs (same as in v1):
- MT7628AN (575 MHz)
- 64MB RAM
- 8MB of flash (SPI NOR)
- 1x 10/100Mbps Ethernet (MT7628AN built-in switch with vlan)
- 1x 2.4GHz wifi (MT7628AN)
- 1x 5Ghz wifi (MT7612E)
- 4x LEDs (5 GPIO-controlled)
- 1x reset button
- 1x WPS button
The only and important difference between v1 & v3 is in flash memory
layout, so pls don't interchange these 2 builds!
Installation through web-ui (on OEM factory firmware):
1. Visit http://tplinkrepeater.net or the configured IP address of
your RE305 v3 (default 192.168.0.254).
2. Log in with the password you've set during initial setup of the
RE305 (there is no default password).
3. Go to Settings -> System Tools -> Firmware upgrade
4. Click Browse and select the OpenWRT image with factory.bin suffix
(not sysupgrade.bin)
5. A window with a progress bar will appear. Wait until it completes.
6. The RE305 will reboot into OpenWRT and serve DHCP requests on the
ethernet port.
7. Connect an RJ45 cable from the RE305 to your computer and access
LuCI at http://192.168.1.1/ to configure (or use ssh).
Disassembly:
Just unscrew 4 screws in the corners & take off the back cover.
Serial is exposed to the right side of the main board (in the middle)
and marked with TX/RX/3V3/GND, but the holes are filled with solder.
Installation through serial:
1. connect trough serial (1n8, baudrate=57600)
2. setup the TFTP server and connect it via ethernet
(ipaddr=192.168.0.254 of device, serverip=192.168.0.184 - your pc)
3. boot from a initramfs image first (choose 1 in the bootloader
options)
4. test it a bit with that, then proceed to run sysupgrade build
MAC addresses as verified by OEM firmware:
use OpenWrt address reference
LAN eth0 *:d2 label
2g wlan0 *:d1 label - 1
5g wlan1 *:d0 label - 2
The label MAC address can be found in config 0x2008.
Signed-off-by: Michal Kozuch <servitkar@gmail.com>
[redistribute WLAN node properties between DTS/DTSI, remove
compatible on DTSI, fix indent/wrapping, split out firmware-utils
change]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Specifications:
- SoC: MediaTek MT7621AT
- RAM: 256 MB (DDR3)
- Flash: 32 MB SPI NOR 44MHz
- Switch: 1 WAN, 4 LAN (Gigabit)
- LEDs: 1 WAN, 4 LAN (controlled by PHY)
- USB Ports: 1 x USB2, 1 x USB3
- WLAN: 1 x 2.4, 5 GHz 866Mbps (MT7612E)
- Button: 1 button (reset)
- UART Serial: UART1 as console : 57600 baud
- Power: 12VDC, 1A
Installation:
Update openWRT firmware using internal GNUBEE uboot:
https://github.com/gnubee-git/GnuBee-MT7621-uboot
By HTTP: Initial uboot address is http://10.10.10.123, your address
needs to be 10.10.10.x, and mask 255.255.255.0.
By TFTP: Uboot is in client mode, the address of the firmware must
be tftp://10.10.10.3/uboot.bin
Recovery:
Manufacturer provides MTK OpenWrt 14.07 source code, compile then
flash it by uboot.
HLK-7621A is a stamp hole package module for embedded development,
users have to design IO boards to use it.
MAC addresses:
- u-boot-env contains a placeholder address:
> mtd_get_mac_ascii u-boot-env ethaddr
03:17:73🆎cd:ef
- phy0 gets a valid-looking address:
> cat /sys/class/ieee80211/phy0/macaddress
f8:62:aa:**:**:a8
- Calibration data for &pcie2 contains a valid address, however the
zeros in the right half look like it's not real:
8c:88:2b:00:00:1b
- Since it's an evaluation board and there is no solid information
about the MAC address assignment, the ethernet MAC address is left random.
Signed-off-by: Chen Yijun <cyjason@bupt.edu.cn>
[add keys and pcie nodes to properly support evaluation board]
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
[remove ethernet address, wrap lines properly]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This commit adds support for Xiaomi MiWiFi 3C device.
Xiaomi MiWifi 3C has almost the same system architecture
as the Xiaomi Mi WiFi Nano, which is already officially
supported by OpenWrt.
The differences are:
- Numbers of antennas (4 instead of 2). The antenna management
is done via the µC. There is no configuration needed in the
software code.
- LAN port assignments are different. LAN1 and WAN are
interchanged.
OpenWrt Wiki: https://openwrt.org/toh/xiaomi/mir3c
OpenWrt developers forum page:
https://forum.openwrt.org/t/support-for-xiaomi-mi-3c
Specifications:
- CPU: MediaTek MT7628AN (575MHz)
- Flash: 16MB
- RAM: 64MB DDR2
- 2.4 GHz: IEEE 802.11b/g/n with Integrated LNA and PA
- Antennas: 4x external single band antennas
- WAN: 1x 10/100M
- LAN: 2x 10/100M
- LED: 1x amber/blue/red. Programmable
- Button: Reset
MAC addresses as verified by OEM firmware:
use address source
LAN *:92 factory 0x28
WAN *:92 factory 0x28
2g *:93 factory 0x4
OEM firmware uses VLAN's to create the network interface for WAN and LAN.
Bootloader info:
The stock bootloader uses a "Dual ROM Partition System".
OS1 is a deep copy of OS2.
The bootloader start OS2 by default.
To force start OS1 it is needed to set "flag_try_sys2_failed=1".
How to install:
1- Use OpenWRTInvasion to gain telnet, ssh and ftp access.
https://github.com/acecilia/OpenWRTInvasion
(IP: 192.168.31.1 - Username: root - Password: root)
2- Connect to router using telnet or ssh.
3- Backup all partitions. Use command "dd if=/dev/mtd0 of=/tmp/mtd0".
Copy /tmp/mtd0 to computer using ftp.
4- Copy openwrt-ramips-mt76x8-xiaomi_miwifi-3c-squashfs-sysupgrade.bin
to /tmp in router using ftp.
5- Enable UART access and change start image for OS1.
```
nvram set uart_en=1
nvram set flag_last_success=1
nvram set boot_wait=on
nvram set flag_try_sys2_failed=1
nvram commit
```
6- Installing Openwrt on OS1 and free OS2.
```
mtd erase OS1
mtd erase OS2
mtd -r write /tmp/openwrt-ramips-mt76x8-xiaomi_miwifi-3c-squashfs-sysupgrade.bin OS1
```
Limitations: For the first install the image size needs to be less
than 7733248 bits.
Thanks for all community and especially for this device:
minax007, earth08, S.Farid
Signed-off-by: Eduardo Santos <edu.2000.kill@gmail.com>
[wrap lines, remove whitespace errors, add mediatek,mtd-eeprom to
&wmac, convert to nvmem]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Deleted (upstreamed):
bcm27xx/patches-5.10/950-0145-xhci-add-quirk-for-host-controllers-that-don-t-updat.patch [1]
Manually rebased:
bcm27xx/patches-5.10/950-0355-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
bcm53xx/patches-5.10/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
Note: although automatically rebaseable, the last patch has been edited to avoid
conflicting bit definitions.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=b6f32897af190d4716412e156ee0abcc16e4f1e5
Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
Allow RAM size to be passed thru U-Boot. There are 128MB and 64MB
versions of Minew G1-C. This is also in line with the behaviour of
most other RAMIPS boards.
Signed-off-by: Bruno Randolf <br1@einfach.org>
This firmware should only be used for mobile devices (e.g. laptops), where
AP mode functionality is typically not used. This firmware supports a lot
of power saving offload functionality at the expense of AP mode support.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
