b00a02aaa0
998 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
David Yang
|
b00a02aaa0 |
ramips: add support for Netgear PR2000
This patch adds support for Netgear PR2000, sold as "Travel Router and Range Extender". Specifications: -------------- * SoC: Mediatek MT7620N * RAM: 64MB DDR2 * Flash: 16MB SPI NOR flash (Macronix MX25L12805D) * WiFi 2.4GHz: builtin * Ethernet: builtin * LED: Power, Internet, WiFi, USB * Buttons: Reset (GPIO 1/2) * UART: Serial console (57600 8n1) * USB: 1 x USB2 SPECIAL NOTES: ------------- Problem: WiFi is super weak, but SSID beacons seems to be right. Solve: Change 36h in factory partition (namely 0xf60036) to be 0x0. Explain: Clearly Netgear have different ideas on how EEPROM is used. Bit 2 of 36h indicates the presence of External LNA for 11g (2.4 GHz) band, which seems to be incorrectly set by Netgear (originally 0x04). Lifting it solves the problem of weak RX signal. Installation: ------------ There are two possible ways to install the firmware. Flashing via web interface of original firmware is not tested due to a broken firmware. 1) Open the shell and use a UART2USB convert to gain TTY access (TP7: RXD, TP9: TXD, TP10: GND). Please notice you have to remove resistance R54 next to TP7 otherwise you won't be able to input anything. 2) Use well-known Netgear debug switch. Access http://192.168.168.1/setup.cgi?todo=debug to start telnet service (username: root, password: <none>). Please back up firmware if you want to go back to the original. After you can control the device, flash the firmware as usual. Here are some hints for that. Option 1 (via nmrpflash): 1) Download nmrpflash from https://github.com/jclehner/nmrpflash 2) Use *-factory.img and flash: nmrpflash -L nmrpflash -i net* -f <your-firmware-name> 3) Turn off then turn on the device, wait it finishing flash. Option 2 (replacing u-boot via breed): 1) Download breed-mt7620-reset1.bin from https://breed.hackpascal.net/ 2) Setup HTTP server on your computer, for example: python3 -m http.server You can skip this step if your breed is already accessible from HTTP, since the original wget does not support HTTPS. 3) Connect to the route and flash breed: cd /tmp wget http://<your-computer-host>/breed-mt7620-reset1.bin dd if=breed-mt7620-reset1.bin of=/dev/mtdblock0 bs=64k 4) Reboot. Hold reset key or press any key in TTY to enter breed. 5) Access breed web interface (http://192.168.1.1/). Choose memory layout to be 0x40000 and flash new firmware. Remark: ------ As a "Range Extender", it has a switch to switch between Wired mode (GPIO 21 low) and Wireless mode (GPIO 20 low), which is not implemented in this patch. However, the router will be turned off when it switches to the middle, which makes this switch much less useful. MAC addresses: ------------- The OEM firmware uses one single MAC for all interfaces, located at 0xf700b0. Signed-off-by: David Yang <mmyangfl@gmail.com> |
||
|
Lea Teuberth
|
45255aa0e8 |
ramips: adding support for Asus RP-AC56
Specifications: CPU: MT7621A dual-core 880MHz RAM: 64MB DDR2 FLASH: 16MB MX25L12805D NOR SPI WIFI: 2.4GHz 2x2 MT7603 b/g/n PCI WIFI: 5GHz 2x2 MT7662 a/b/ac PCI ETH: 1xLAN 1000base-T integrated SWITCH: MT7530 Port 0: LAN, Port 6: CPU LED: Power, 2.4GHz WiFi, 5GHz WiFi BTN: WPS, Reset UART: Near ETH port, from ETH: 3V3-TxD-GND-RxD 57600 8n1 MISC: Audio support Installation: 1. Update using recovery mode - while holdig "reset" button, power on the device - keep holding "reset" until power led is flashing yellow - set own IP to 192.168.1.75, subnet mask: 255.255.255.0 - push firmware image (can be factory.bin or sysupgrade.bin) using tftp client in binary mode to 192.168.1.1 Notes: This board has only two MAC addresses programmed in the "factory" partition: - MAC for wlan0 (2.4GHz) at offset 0x0004 - MAC for wlan1 (5GHz) at offset 0x8004 - stock firmware re-uses wlan0 MAC for ethernet - no valid addresses found in 0x28, 0x2e, 0xe000 and 0xe006 Signed-off-by: Lea Teuberth <lea.teuberth@outlook.com> |
||
|
Shiji Yang
|
1330816178 |
ramips: add support for H3C TX1800 Plus / TX1801 Plus / TX1806
H3C TX180x series WiFi6 routers are customized by different carrier.
While these three devices look different, they use the same motherboard
inside. Another minor difference comes from the model name definition
in the u-boot environment variable.
Specifications:
SOC: MT7621 + MT7915
ROM: 128 MiB
RAM: 256 MiB
LED: status *2
Button: reset *1 + wps/mesh *1
Ethernet: lan *3 + wan *1 (10/100/1000Mbps)
TTL Baudrate: 115200
TFTP server IP: 192.168.124.99
MAC Address:
use address(sample 1) address(sample 2) source
label 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 u-boot-env@ethaddr
lan 88:xx:xx:98:xx:13 88:xx:xx:a2:xx:a6 $label +1
wan 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 $label
WiFi4_2G 8a:xx:xx:58:xx:14 8a:xx:xx:52:xx:a7 (Compatibility mode)
WiFi5_5G 8a:xx:xx:b8:xx:14 8a:xx:xx:b2:xx:a7 (Compatibility mode)
WiFi6_2G 8a:xx:xx:18:xx:14 8a:xx:xx:12:xx:a7
WiFi6_5G 8a:xx:xx:78:xx:14 8a:xx:xx:72:xx:a7
Compatibility mode is used to guarantee the connection of old devices
that only support WiFi4 or WiFi5.
TFTP + TTL Installation:
Although a TTL connection is required for installation, we do not need
to tear down it. We can find the TTL port from the cooling hole at the
bottom. It is located below LAN3 and the pins are defined as follows:
|LAN1|LAN2|LAN3|----|WAN|
--------------------
|GND|TX|RX|VCC|
1. Set tftp server IP to 192.168.124.99 and put initramfs firmware in
server's root directory, rename it to a simple name "initramfs.bin".
2. Plug in the power supply and wait for power on, connect the TTL cable
and open a TTL session, enter "reboot", then enter "Y" to confirm.
Finally push "0" to interruput boot while booting.
3. Execute command to install a initramfs system:
# tftp 0x80010000 192.168.124.99:initramfs.bin
# bootm 0x80010000
4. Backup nand flash by OpenWrt LuCI or dd instruction. We need those
partitions if we want to back to stock firmwre due to official
website does not provide download link.
# dd if=/dev/mtd1 of=/tmp/u-boot-env.bin
# dd if=/dev/mtd4 of=/tmp/firmware.bin
5. Edit u-boot env to ensure use default bootargs and first image slot:
# fw_setenv bootargs
# fw_setenv bootflag 0
6. Upgrade sysupgrade firmware.
7. About restore stock firmware: flash the "firmware" and "u-boot-env"
partitions that we backed up in step 4.
# mtd write /tmp/u-boot-env.bin u-boot-env
# mtd write /tmp/firmware.bin firmware
Additional Info:
The H3C stock firmware has a 160-byte firmware header that appears to
use a non-standard CRC32 verification algorithm. For this part of the
data, the u-boot does not check it so we can just directly replace it
with a placeholder.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
|
||
|
David Bauer
|
a0b7fef0ff |
ramips: add support for ZyXEL NWA50AX / NWA55AXE
Hardware -------- CPU: Mediatek MT7621 RAM: 256M DDR3 FLASH: 128M NAND ETH: 1x Gigabit Ethernet WiFi: Mediatek MT7915 (2.4/5GHz 802.11ax 2x2 DBDC) BTN: 1x Reset (NWA50AX only) LED: 1x Multi-Color (NWA50AX only) UART Console ------------ NWA50AX: Available below the rubber cover next to the ethernet port. NWA55AXE: Available on the board when disassembling the device. Settings: 115200 8N1 Layout: <12V> <LAN> GND-RX-TX-VCC Logic-Level is 3V3. Don't connect VCC to your UART adapter! Installation Web-UI ------------------- Upload the Factory image using the devices Web-Interface. As the device uses a dual-image partition layout, OpenWrt can only installed on Slot A. This requires the current active image prior flashing the device to be on Slot B. If the currently installed image is started from Slot A, the device will flash OpenWrt to Slot B. OpenWrt will panic upon first boot in this case and the device will return to the ZyXEL firmware upon next boot. If this happens, first install a ZyXEL firmware upgrade of any version and install OpenWrt after that. Installation TFTP ----------------- This installation routine is especially useful in case * unknown device password (NWA55AXE lacks reset button) * bricked device Attach to the UART console header of the device. Interrupt the boot procedure by pressing Enter. The bootloader has a reduced command-set available from CLI, but more commands can be executed by abusing the atns command. Boot a OpenWrt initramfs image available on a TFTP server at 192.168.1.66. Rename the image to owrt.bin $ atnf owrt.bin $ atna 192.168.1.88 $ atns "192.168.1.66; tftpboot; bootm" Upon booting, set the booted image to the correct slot: $ zyxel-bootconfig /dev/mtd10 get-status $ zyxel-bootconfig /dev/mtd10 set-image-status 0 valid $ zyxel-bootconfig /dev/mtd10 set-active-image 0 Copy the OpenWrt ramboot-factory image to the device using scp. Write the factory image to NAND and reboot the device. $ mtd write ramboot-factory.bin firmware $ reboot Signed-off-by: David Bauer <mail@david-bauer.net> |
||
|
Wenli Looi
|
0f068e7c4a
|
ramips: add support for Netgear WAX202
Netgear WAX202 is an 802.11ax (Wi-Fi 6) router. Specifications: * SoC: MT7621A * RAM: 512 MiB NT5CC256M16ER-EK * Flash: NAND 128 MiB F59L1G81MB-25T * Wi-Fi: * MT7915D: 2.4/5 GHz (DBDC) * Ethernet: 4x 1GbE * Switch: SoC built-in * USB: None * UART: 115200 baud (labeled on board) Load addresses (same as ipTIME AX2004M): * stock * 0x80010000: FIT image * 0x81001000: kernel image -> entry * OpenWrt * 0x80010000: FIT image * 0x82000000: uncompressed kernel+relocate image * 0x80001000: relocated kernel image -> entry Installation: * Flash the factory image through the stock web interface, or TFTP to the bootloader. NMRP can be used to TFTP without opening the case. * Note that the bootloader accepts both encrypted and unencrypted images, while the stock web interface only accepts encrypted ones. Revert to stock firmware: * Flash the stock firmware to the bootloader using TFTP/NMRP. References in WAX202 GPL source: https://www.downloads.netgear.com/files/GPL/WAX202_V1.0.5.1_Source.rar * openwrt/target/linux/ramips/dts/mt7621-ax-nand-wax202.dts DTS file for this device. Signed-off-by: Wenli Looi <wlooi@ucalgary.ca> |
||
|
Nita Vesa
|
1a8c74da70 |
ramips: Add Xiaomi Mi Router 4A 100M International
The international version of Mi Router 4A 100M is physically identical to the non-international one, but appears to be using a different partitioning scheme with the "overlay" partition being 2MiB in size instead of 1MiB. This means the following "firmware" partition starts at a different address and the DTS needs to be adjusted for the firmware to work. Signed-off-by: Nita Vesa <werecatf@outlook.com> |
||
|
Sergei Iudin
|
4b0c433c39 |
ramips: Add suport for COMFAST CF-WR617AC
Specifications: Chipset:MT7628DA+MT7612E Antenna : 2.4Ghz:2x5dbi Antenna + 5.8Ghz:2x5dbi Antenna Wireless Rate:2.4Ghz 300Mbps , 5.8Ghz 867Mbps Output Power :100mW(20dbm) Physical port:110/100Mbps RJ45 WAN Port , 310/100Mbps RJ45 LAN Port Flash: 8Mb DRam: 64Mb Flashing: default bootloader attempts to boot from tftp://192.168.1.10/firmware_auto.bin using 192.168.1.1 Known issues: mac-address-increment for 5GHZ doesnt work, i failed to figure out why. Original firmware using +1 from original value in factory partition. Signed-off-by: Sergei Iudin <tsipa740@gmail.com> |
||
|
Mikhail Zhilkin
|
bd783fd60a |
ramips: add support for Beeline SmartBox GIGA
Beeline SmartBox GIGA is a wireless WiFi 5 router manufactured by
Sercomm company.
Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 256 MiB, Nanya NT5CC128M16JR-EK
Flash: 128 MiB, Macronix MX30LF1G18AC
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7613BE): a/n/ac, 2x2
Ethernet: 3 ports - 2xGbE (WAN, LAN1), 1xFE (LAN2)
USB ports: 1xUSB3.0
Button: 1 button (Reset/WPS)
PCB ID: DBE00B-1.6MM
LEDs: 1 RGB LED
Power: 12 VDC, 1.5 A
Connector type: barrel
Bootloader: U-Boot
Installation
-----------------
1. Downgrade stock (Beeline) firmware to v.1.0.02;
2. Give factory OpenWrt image a shorter name, e.g. 1001.img;
3. Upload and update the firmware via the original web interface.
Remark: You might need make the 3rd step twice if your running firmware
is booted from the Slot 1 (Sercomm0 bootflag). The stock firmware
reverses the bootflag (Sercomm0 / Sercomm1) on each firmware update.
Revert to stock
---------------
1. Change the bootflag to Sercomm1 in OpenWrt CLI and then reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
2. Optional: Update with any stock (Beeline) firmware if you want to
overwrite OpenWrt in Slot 0 completely.
MAC Addresses
-------------
+-----+-----------+---------+
| use | address | example |
+-----+-----------+---------+
| LAN | label | *:16 |
| WAN | label + 1 | *:17 |
| 2g | label + 4 | *:1a |
| 5g | label + 5 | *:1b |
+-----+-----------+---------+
The label MAC address was found in Factory 0x21000
Notes
-----
1. The following scripts are required for the build:
sercomm-crypto.py - already exists in OpenWrt
sercomm-partition-tag.py - already exists in OpenWrt
sercomm-payload.py - already exists in OpenWrt
sercomm-pid.py - new, the part of this pull request
sercomm-kernel-header.py - new, the part of this pull request
2. This device (same as other Sercomm S2,S3-based devices) requires
special LZMA and LOADADDR settings for successful boot:
LZMA_TEXT_START=0x82800000
KERNEL_LOADADDR=0x81001000
LOADADDR=0x80001000
3. This device (same as several other Sercomm-based devices - Beeline,
Netgear, Etisalat, Rostelecom) has partition map (mtd1) containing
real partition offsets, which may differ from device to device
depending on the number and location of bad blocks on NAND.
"fixed-partitions" is used if the partition map is not found or
corrupted. This behavour (it's the same as on stock firmware) is
provided by MTD_SERCOMM_PARTS module.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
|
||
|
Tamas Balogh
|
74dd7f9c36 |
ramips: add support for ASUS RP-AC87
Asus RP-AC87 ac2600 Repeater 2.4GHz 800Mbps 5GHz 1733Mbps Hardware specifications: SoC: MT7621A 2 cores 4 threads @880MHz WiFi2G: MT7615E 2G 4x4 b/g/n Wifi5G: MT7615E 5G 4x4 n/ac DRAM: 128MB DDR3 @1200mhz Flash: 16MB MX25L12805D SPI-NOR LAN/WAN: MT7530 1x1000M MAC addresses as verified by OEM firmware: use address source Lan/W5G *:B0 factory 0x8004 (label) W2G *:B4 factory 0x0 Installation: Asus windows recovery tool: install the Asus firmware restoration utility unplug the router, hold the reset button while powering it on release when the power LED flashes slowly specify a static IP on your computer: IP address: 192.168.1.75 Subnet mask 255.255.255.0 Start the Asus firmware restoration utility, specify the factory image and press upload Do not power off the device after OpenWrt has booted until the LED flashing. TFTP Recovery method: set computer to a static ip, 192.168.1.2 connect computer to the LAN 1 port of the router hold the reset button while powering on the router for a few seconds send firmware image using a tftp client; i.e from linux: $ tftp tftp> binary tftp> connect 192.168.1.1 tftp> put factory.bin tftp> quit Signed-off-by: Tamas Balogh <tamasbalogh@hotmail.com> |
||
|
Semih Baskan
|
530c0a2068 |
ramips: add support for Asus RT-N12+ B1 and RT-N300 B1
Asus RT-N12+ B1 and Asus RT-N300 B1 are the same device
with a different name.
The OEM firmwares have the same MD5 with Asus RT-N11P B1.
Same instructions for Asus RT-N11P B1 see:
commit
|
||
|
Chuncheng Chen
|
8c00fd9b45 |
ramips: add support for ASUS RT-AX53U
Specifications:
- Device: ASUS RT-AX53U
- SoC: MT7621AT
- Flash: 128MB
- RAM: 256MB
- Switch: 1 WAN, 3 LAN (10/100/1000 Mbps)
- WiFi: MT7905 2x2 2.4G + MT7975 2x2 5G
- Ports: USB 3.0
- LEDs: 1x POWER (blue, configurable)
3x LAN (blue, configurable)
1x WAN (blue, configurable)
1x USB (blue, not configurable)
1x 2.4G (blue, not configurable)
1x 5G (blue, not configurable)
Flash by U-Boot TFTP method:
- Configure your PC with IP 192.168.1.2
- Set up TFTP server and put the factory.bin image on your PC
- Connect serial port(rate:115200) and turn on AP, then interrupt "U-Boot Boot Menu" by hitting any key
Select "2. Upgrade firmware"
Press enter when show "Run firmware after upgrading? (Y/n):"
Select 0 for TFTP method
Input U-Boot's IP address: 192.168.1.1
Input TFTP server's IP address: 192.168.1.2
Input IP netmask: 255.255.255.0
Input file name: openwrt-ramips-mt7621-asus_rt-ax53u-squashfs-factory.bin
- Restart AP aftre see the log "Firmware upgrade completed!"
Signed-off-by: Chuncheng Chen <ccchen1984@gmail.com>
(replaced led label, added key-* prefix to buttons, added note about
BBT)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
|
||
|
Piotr Dymacz
|
fd72e595c2 |
ramips: fix booting on ZyXEL NBG-419N v2
This fixes a well known "LZMA ERROR 1" error, reported previously on numerous of other devices from 'ramips' target. Fixes: #9842 Fixes: #8964 Reported-by: Juergen Hench <jurgen.hench@gmail.com> Tested-by: Juergen Hench <jurgen.hench@gmail.com> Signed-off-by: Demetris Ierokipides <ierokipides.dem@gmail.com> Signed-off-by: Piotr Dymacz <pepe2k@gmail.com> |
||
|
Mikhail Zhilkin
|
498c15376b |
ramips: add support for MTS WG430223
MTS WG430223 is a wireless AC1300 (WiFi 5) router manufactured by
Arcadyan company. It's very similar to Beeline Smartbox Flash (Arcadyan
WG443223).
Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 128 MiB
Flash: 128 MiB (Winbond W29N01HV)
Wireless 2.4 GHz (MT7615DN): b/g/n, 2x2
Wireless 5 GHz (MT7615DN): a/n/ac, 2x2
Ethernet: 3xGbE (WAN, LAN1, LAN2)
USB ports: No
Button: 1 (Reset/WPS)
LEDs: 2 (Red, Green)
Power: 12 VDC, 1 A
Connector type: Barrel
Bootloader: U-Boot (Ralink UBoot Version: 5.0.0.2)
OEM: Arcadyan WG430223
Installation
------------
1. Login to the router web interface (superadmin:serial number)
2. Navigate to Administration -> Miscellaneous -> Access control lists &
enable telnet & enable "Remote control from any IP address"
3. Connect to the router using telnet (default admin:admin)
4. Place *factory.trx on any web server (192.168.1.2 in this example)
5. Connect to the router using telnet shell (no password required)
6. Save MAC adresses to U-Boot environment:
uboot_env --set --name eth2macaddr --value $(ifconfig | grep eth2 | \
awk '{print $5}')
uboot_env --set --name eth3macaddr --value $(ifconfig | grep eth3 | \
awk '{print $5}')
uboot_env --set --name ra0macaddr --value $(ifconfig | grep ra0 | \
awk '{print $5}')
uboot_env --set --name rax0macaddr --value $(ifconfig | grep rax0 | \
awk '{print $5}')
7. Ensure that MACs were saved correctly:
uboot_env --get --name eth2macaddr
uboot_env --get --name eth3macaddr
uboot_env --get --name ra0macaddr
uboot_env --get --name rax0macaddr
8. Download and write the OpenWrt images:
cd /tmp
wget http://192.168.1.2/factory.trx
mtd_write erase /dev/mtd4
mtd_write write factory.trx /dev/mtd4
9. Set 1st boot partition and reboot:
uboot_env --set --name bootpartition --value 0
Back to Stock
-------------
1. Run in the OpenWrt shell:
fw_setenv bootpartition 1
reboot
2. Optional step. Upgrade the stock firmware with any version to
overwrite the OpenWrt in Slot 1.
MAC addresses
-------------
+-----------+-------------------+----------------+
| Interface | MAC | Source |
+-----------+-------------------+----------------+
| label | A4:xx:xx:51:xx:F4 | No MACs was |
| LAN | A4:xx:xx:51:xx:F6 | found on Flash |
| WAN | A4:xx:xx:51:xx:F4 | [1] |
| WLAN_2g | A4:xx:xx:51:xx:F5 | |
| WLAN_5g | A6:xx:xx:21:xx:F5 | |
+-----------+-------------------+----------------+
[1]:
a. Label wasb't found neither in factory nor in other places.
b. MAC addresses are stored in encrypted partition "glbcfg". Encryption
key hasn't known yet. To ensure the correct MACs in OpenWrt, a hack
with saving of the MACs to u-boot-env during the installation was
applied.
c. Default Ralink ethernet MAC address (00:0C:43:28:80:A0) was found in
"Factory" 0xfff0. It's the same for all MTS WG430223 devices. OEM
firmware also uses this MAC when initialazes ethernet driver. In
OpenWrt we use it only as internal GMAC (eth0), all other MACs are
unique. Therefore, there is no any barriers to the operation of several
MTS WG430223 devices even within the same broadcast domain.
Stock firmware image format
---------------------------
The same as Beeline Smartbox Flash but with another trx magic
+--------------+---------------+----------------------------------------+
| Offset | | Description |
+==============+===============+========================================+
| 0x0 | 31 52 48 53 | TRX magic "1RHS" |
+--------------+---------------+----------------------------------------+
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
|
||
|
Mikhail Zhilkin
|
109c503bee |
ramips: allow custom trx magic for Arcadyan
This commit: 1. Renames beeline-trx recipe in mt7621.mk to arcadyan-trx. The recipe is necessary for: - MTS WG430223 (Arcadyan WG430223) - Beeline Smartbox Flash (Arcadyan WG443223) 2. Allows specify custom trx magic which is different for the routers mentined above. Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com> |
||
|
Andreas Böhler
|
9ee6ac00c4 |
ramips: Add support for SERCOMM NA502S
The SERCOMM NA502s is a smart home gateway manufactured by SERCOMM and sold under different brands (among others, A1 Telekom Austria SmartHome Premium Gateway). It has multi-protocol radio support in addition to LAN and WiFi. Note: BLE and audio are currently unsupported. Specifications -------------- - MT7621ST 880MHz, Single-Core, Dual-Thread - MT7603EN 2.4GHz WiFi - MT7662EN 5GHz WiFi + BLE - 128MiB NAND - 256MiB DDR3 RAM - SD3503 ZWave Controller - EM357 Zigbee Coordinator - Telit UMTS module - Rechargeable battery - speaker and microphone MAC address assignment ---------------------- LAN MAC is read from the config partition, WiFi 2.4GHz is LAN+2 and matches the OEM firmware. WiFi 5GHz with LAN+1 is an educated guess since the OEM firmware does not enable 5GHz WiFi. Installation ------------ Attach serial console, then boot the initramfs image via TFTP. Once inside OpenWrt, run sysupgrade -n with the sysupgrade file. Attention: The device has a dual-firmware design. We overwrite kernel2, since kernel1 contains an automatic recovery image. If you get NAND ECC errors and are stuck with bad eraseblocks, try to erase the mtd partition first with mtd unlock ubi mtd erase ubi This should only be needed once. Signed-off-by: Andreas Böhler <dev@aboehler.at> |
||
|
Piotr Dymacz
|
064e7e57b4 |
ramips: fix booting on Samknows SK-WB8
This fixes a well known "LZMA ERROR 1" error, reported previously on numerous of similar devices. Fixes: #9824 Signed-off-by: Piotr Dymacz <pepe2k@gmail.com> |
||
|
Alessio Prescenzo
|
4a8eaa5c7c |
ramips: add support for Cudy X6
Specifications: SoC: MediaTek MT7621 RAM: 256 MB Flash: 32 MB WiFi: MediaTek MT7915E Switch: 1 WAN, 4 LAN (Gigabit) Ports: 1 USB 3.0 Buttons: Reset, WPS LEDs: Power, System, Wan, Lan 1-4, WiFi 2.4G, WiFi 5G, WPS, USB Power: DC 12V 1A tip positive Installation: Download and flash the manufacturer's built OpenWRT image available at http://www.cudytech.com/openwrt_software_download Install the new OpenWRT image via luci (System -> Backup/Flash firmware) Be sure to NOT keep settings. The force upgrade may need to be checked due to differences in router naming conventions. Recovery: Loads only signed manufacture firmware due to bootloader RSA verification serve tftp-recovery image as /recovery.bin on 192.168.1.88/24 connect to any lan ethernet port power on the device while holding the reset button wait at least 8 seconds before releasing reset button for image to download Signed-off-by: Alessio Prescenzo <alessioprescenzo@gmail.com> [ensure unique wireless MAC, fix GPIO pingroup] Signed-off-by: David Bauer <mail@david-bauer.net> |
||
|
Davide Fioravanti
|
32e6942d72 |
ramips: add support for Wavlink WL-WN533A8
The Wavlink WL-WN533A8 is an AC3000 router with 5 gigabit ethernet ports
and one USB 3.0 port.
It's also known as Wavlink QUANTUM T8.
Hardware
--------
SoC: Mediatek MT7621A
RAM: 128MB (Nanya NT5CB64M16GP-EK)
FLASH: 16MB NOR (GigaDevice GD25Q127CSIG3)
ETH:
- 5x 10/100/1000 Mbps Ethernet (4x LAN + 1x WAN)
WIFI:
- 1x MT7615DN (2x 2x2:2) 2.4GHz and 5GHz DBDC
- 1x MT7615NE (4x4:4) 5GHz
- 8 external antennas
BTN:
- 1x Reset button
- 1x WPS button
- 1x Turbo button
- 1x Touchlink button
- 1x ON/OFF switch
LEDS:
- 1x Red led (system status)
- 1x Blue led (system status)
- 7x Blue leds (wifi led + 5 ethernet ports + power)
USB:
- 1x USB 3.0 port
UART:
- 57600-8-N-1
J4
Everything works correctly.
Installation
------------
Flash the initramfs image in the OEM firmware interface
(http://192.168.10.1/update.shtml).
When Openwrt boots, flash the sysupgrade image otherwise you won't be
able to keep configuration between reboots.
(Procedure tested on fw M33A8.V5030.190716 and M33A8.V5030.201204)
Restore OEM Firmware
--------------------
Flash the firmware update available online directly from LUCI.
You can download it from:
https://www.wavlink.com/en_us/firmware/details/f2d247ecba.html
Warning: Remember to not keep settings!
Warning2: Remember to force the flash.
Notes
-----
1) Router mac addresses:
LAN XX:XX:XX:XX:XX:63 (factory @ 0xe006)
WAN XX:XX:XX:XX:XX:64 (factory @ 0xe000)
WIFI 2G/5G XX:XX:XX:XX:XX:65 (factory @ 0x04)
WIFI 5G XX:XX:XX:XX:XX:66 (factory @ 0x8004)
LABEL XX:XX:XX:XX:XX:65
In OEM firmware the DBDC wifi interfaces have these mac addresses:
2G) 82:XX:XX:XX:XX:65
5G) 80:XX:XX:XX:XX:65
While in OpenWrt the addresses are:
2G) 80:XX:XX:XX:XX:65
5G) 02:XX:XX:XX:XX:65
2) radio0 will show as 2G/5G interface but only 2G is really usable.
3) There is just one wifi led for all wifi interfaces.
It currently shows only the radio0 GHz wifi activity.
4) My unit was shipped with M33A8.V5030.190716 firmware which contains
the http://192.168.10.1/webcmd.shtml page. Entering "telnetd" in
the input box it will start the telnet daemon. Now you can access
the telnet console on port 2323 with these credentials:
username: admin2860
password: admin
5) The M33A8.V5030.201204 firmware version, doesn't contain anymore the
webcmd.shtml page. If your router is shipped with a previous firmware
version and you want to back it up, you can follow the back up
procedure of the WS-WN583A6.
Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
|
||
|
Marcin Gordziejewski
|
39799974a3 |
ramips: add support for TP-Link RE650 v2
TP-Link RE650 v2 is largely similar to v1 that is already supported by OpenWrt. Notable differences is differnt SPI Flash - 8 MB instead of 16 MB (from cFeon instead of Winbond) and a different configuration of PCIE connections to wifi chips. Otherwise it's largely the same product as v1 Hardware specification: - SoC 880 MHz - MediaTek MT7621AT - 128 MB of DDR3 RAM - 8 MB - cFeon QH64A-104HIP - 4T4R 2.4 GHz - MediaTek MT7615E - 4T4R 5 GHz - MediaTek MT7615E - 1x 1 Gbps Ethernet - MT7621AT integrated - 7x LEDs (Power, 2G, 5G, WPS(x2), Lan(x2)) - 4x buttons (Reset, Power, WPS, LED) - UART pinout - GND, RX, TX, labeled in the middle of the PCB, requires soldering because they're not through holes. Serial console @ 57600,8n1 Flash instructions: Upload openwrt-ramips-mt7621-tplink_re650-v2-squashfs-factory.bin from the RE650 web interface. TFTP recovery to stock firmware: I didn't try recovering back to the stock firmware, however, if there is such process for other RExxx devices, it seems like it could be similar here. Signed-off-by: Marcin Gordziejewski <openwrt@flicksfix.com> |
||
|
Clemens Hopfer
|
4891b86538 |
ramips: add support for YunCore AX820/HWAP-AX820
There are two versions which are identical apart from the enclosure: YunCore AX820: indoor ceiling mount AP with integrated antennas YunCore HWAP-AX820: outdoor enclosure with external (N) connectors Hardware specs: SoC: MediaTek MT7621DAT Flash: 16 MiB SPI NOR RAM: 128MiB (DDR3, integrated) WiFi: MT7905DAN+MT7975DN 2.4/5GHz 2T2R 802.11ax Ethernet: 10/100/1000 Mbps x2 (WAN/PoE+LAN) LED: Status (green) Button: Reset Power: 802.11af/at PoE; DC 12V,1A Antennas: AX820(indoor): 4dBi internal; HWAP-AX820(outdoor): external Flash instructions: The "OpenWRT support" version of the AX820 comes with a LEDE-based firmware with proprietary MTK drivers and a luci webinterface and ssh accessible under 192.168.1.1 on LAN; user root, no password. The sysupgrade.bin can be flashed using luci or sysupgrade via ssh, you will have to force the upgrade due to a different factory name. Remember: Do *not* preserve factory configuration! MAC addresses as used by OEM firmware: use address source 2g 44:D1:FA:*:0b Factory 0x0004 (label) 5g 46:D1:FA:*:0b LAA of 2g lan 44:D1:FA:*:0c Factory 0xe000 wan 44:D1:FA:*:0d Factory 0xe000 + 1 The wan MAC can also be found in 0xe006 but is not used by OEM dtb. Due to different MAC handling in mt76 the LAA derived from lan is used for 2g to prevent duplicate MACs when creating multiple interfaces. Signed-off-by: Clemens Hopfer <openwrt@wireloss.net> |
||
|
Ray Wang
|
9a750aae62 |
ramips: add support for OrayBox X3A
OrayBox X3A is a 2.4/5GHz dual band AC router, based on MediaTek MT7621.
Specification:
* SoC: MT7621
* RAM: DDR3 128 MiB
* Flash: 16 MiB NOR (XM25Q128)
* Wi-Fi: (single chip hosting both 2.4G and 5G)
* 2.4GHz: MT7615
* 5GHz: MT7615
* Ethernet: 3x 1000Mbps
* Switch: MT7530
* LED:
* Ethernet LEDs: On the back of the router, hardware-controlled.
* Status LEDs: One "pixel-like" RGB LED in the front of the router,
which is actually made up of 3 individual LEDs (with
dedicated GPIO pins) with the color of Red, Green,
and Blue.
The OEM firmware only lights up one color at a time to
indicate status, but that's very boring, and the colors
actually look great when combined, so I've improvised a
little and made them indicate netdev activities.
My test results:
GPIO 13/14/15
000 white (actually more like bright green or cyan
because the brightness of the green LED is
higher than red and blue)
001 bright purple
010 bright green
011 red
100 bright cyan
101 blue
110 green
111 off
Flash Layout:
0x0000000-0x0030000 : "u-boot"
0x0030000-0x0040000 : "u-boot-env"
0x0040000-0x0050000 : "factory"
0x0050000-0x0f50000 : "firmware"
/*0x0f50000 to 0x0fe0000 is undefined, same as OEM firmware*/
0x0fe0000-0x0ff0000 : "bdinfo"
0x0ff0000-0x1000000 : "reserve"
MAC address:
MAC Source Description Fix
A0:CX:XX:BX:XX:0D BDINFO_9 LAN(LABEL) DTS
A0:CX:XX:BX:XX:0E BDINFO_9 + 1 WAN DTS
A2:CX:XX:BX:XX:0F FACTORY_4 WIFI2G DTS
A2:CX:XX:CX:XX:0F SETBIT 7 (FACTORY_4 + 0x100000) WIFI5G HOTPLUG
A6:CX:XX:BX:XX:0F N/A WIFI2G_CLIENT N/A
A6:DX:XX:BX:XX:0F N/A WIFI5G_CLIENT N/A
Stock dmesg:
https://pastebin.com/2t2jwLdf
Stock Dumps:
https://pastebin.com/LDLxSWX3
Installation via SSH (does not void your warranty):
1. -----UNLOCK SSH-----
1.1 Set computer IP to DHCP mode, load 'http://10.168.1.1/cgi-bin/luci' in
your browser. Password is 'admin'.
1.2 Click the "备份且导出" (backup and export) button, and download the
config file.
1.3 Open the downloaded file with 7zip, navigate to '/etc/config/'.
1.4 Edit the file './system'. Change the '0' into '1' under
"config sys 'ssh'".
1.5 Save the file.
1.6 Upload the file by clicking the "导入且恢复" (import and recover)
button. The router will automatically reboot.
2. -----FLASH THE OPENWRT FIRMWARE-----
2.1 Use any scp tool to upload the 'sysupgrade' firmware to the '/tmp/'
folder to your router. It should be root@10.168.1.1 and the password
is 'admin'.
2.2 SSH into the router, also root@10.168.1.1 and the password is 'admin'.
2.3 **IMPORTANT** Type command 'dd if=/dev/mtd3 of=/tmp/firmware.bin', to
backup the stock firmware. Since the OEM does not provide firmware
download on their website, this is the only way to get it.
2.3 **ALSO IMPORTANT** Use any scp tool to download your backed-up stock
firmware from '/tmp/' to your local drive. Then you'd better use a hex
reading tool to have a rough look at it to make sure nothing is
corrupt. Or u can just back up again and cross check the MD5.
2.4 Type command 'mtd write /tmp/XXX.bin firmware', and it should flash
the firmware.
2.5 Verify that nothing went wrong. If you're confident, type 'reboot' and
reboot the router.
Revert to stock firmware:
1. load stock firmware using mtd (make sure u have a backup).
Signed-off-by: Ray Wang <raywang777@foxmail.com>
|
||
|
Tamas Balogh
|
a4bf562aa7 |
ramips: add support for ASUS RT-AC1200-V2
Hardware specifications: SoC: MT7628DAN MIPS_24KEc@580MHz 2.4G-n 2x2 WiFi: MT7613BEN 5G-ac 160MHz 2x2 Switch: 4x100M built-in SoC Flash: 16MB W25Q128JVSQ SPI-NOR DRAM: 64MB built-in SoC MAC addresses as verified by OEM firmware: use address source Lan/Wan/2G *:60 factory 0x4 (label) 5G *:64 factory 0x8000 Serial console: 57600,8n1 Installation: Asus windows recovery tool: install the Asus firmware restoration utility unplug the router, hold the reset button while powering it on release when the power LED flashes slowly specify a static IP on your computer: IP address: 192.168.1.75 Subnet mask 255.255.255.0 start the Asus firmware restoration utility, specify the factory image and press upload do NOT power off the device after OpenWrt has booted until the LED flashing after flashing OpenWrt, there will be first no 5GHz Wifi available probably, wait until blinking finishes and do a reboot TFTP Recovery method: set computer to a static ip, 192.168.1.75 connect computer to the LAN 1 port of the router hold the reset button while powering on the router for a few seconds send firmware image using a tftp client; i.e from linux: $ tftp tftp> binary tftp> connect 192.168.1.1 tftp> put factory.bin tftp> quit do NOT power off the device after OpenWrt has booted until the LED flashing after flashing OpenWrt, there will be first no 5GHz Wifi available probably, wait until blinking finishes and do a reboot Signed-off-by: Tamas Balogh <tamasbalogh@hotmail.com> |
||
|
Abdul Aziz Amar
|
78c3534645 |
ramips: add support for BOLT! Arion
This device is from now-defunct BOLT! ISP in Indonesia.
The original firmware is based on mediatek SDK running linux 2.6 or 3.x in later revision.
Specifications:
- SoC: MediaTek MT7621
- Flash: 32 MiB NOR SPI
- RAM: 128 MiB DDR3
- Ethernet: 2x 10/100/1000 Mbps (switched, LAN + WAN)
- WIFI0: MT7603E 2.4GHz 802.11b/g/n
- WIFI1: MT7612E 5GHz 802.11ac
- Antennas: 2x internal, non-detachable
- LEDs: Programmable LEDs: 5 blue LEDs (wlan, tel, sig1-3) and 2 red LEDs (wlan and sig1)
Non-programmable "Power" LED
- Buttons: Reset and WPS
Instalation:
Install from TFTP
Set your PC IP to 10.10.10.3 and gateway to 10.10.10.123
Press "1" when turning on the router, and type the initramfs file name
You also need to solder pin header or cable to J4 or neighboring test points (T19-T21)
Pinouts from top to bottom: GND, TX, RX, VCC (3.3v)
Baudrate: 57600n8
There's also an additional gigabit transformer and RTL8211FD managed by the LTE module on the backside of the PCB.
Signed-off-by: Abdul Aziz Amar <abdulaziz.amar@gmail.com>
|
||
|
Davide Fioravanti
|
bb505d82ad |
ramips: add support for Wavlink WL-WN531A3
The Wavlink WL-WN531A3 is an AC1200 router with 5 fast ethernet ports
and one USB 2.0 port.
It's also known as Wavlink QUANTUM D4.
Hardware
--------
SoC: Mediatek MT7628AN
RAM: 64MB
FLASH: 8MB NOR (GigaDevice GD25Q64CSIG3)
ETH:
- 5x 10/100 Mbps Ethernet (4x LAN + 1x WAN)
WIFI:
- 2.4GHz: 1x (integrated in SOC) (2x2:2)
- 5GHz: 1x MT7612E (2x2:2)
- 4 external antennas
BTN:
- 1x Reset button
- 1x WPS button
- 1x Turbo button
- 1x Touchlink button
- 1x ON/OFF switch
LEDS:
- 1x Red led (system status)
- 1x Blue led (system status)
- 7x Blue leds (wifi led + 5 ethernet ports + power)
USB:
- 1x USB 2.0 port
UART:
- 57600-8-N-1
J1
O VCC +3,3V (near lan ports)
o RX
o TX
o GND
Everything works correctly.
Currently there is no firmware update available. Because of this, in
order to restore the OEM firmware, you must firstly dump the OEM
firmware from your router before you flash the OpenWrt image.
Backup the OEM Firmware
-----------------------
The following steps are to be intended for users having little to none
experience in linux. Obviously there are many ways to backup the OEM
firmware, but probably this is the easiest way for this router.
Procedure tested on M31A3.V4300.200420 firmware version.
1) Go to http://192.168.10.1/webcmd.shtml
2) Type the following line in the "Command" input box and then press enter:
mkdir /etc_ro/lighttpd/www/dev; cp /dev/mtd0ro /etc_ro/lighttpd/www/dev/mtd0ro; ls -la /etc_ro/lighttpd/www/dev/mtd0ro
3) After few seconds in the textarea should appear this output:
-rw-r--r-- 1 0 0 8388608 /etc_ro/lighttpd/www/dev/mtd0ro
If your output doesn't match mine, stop reading and ask for
help in the forum.
4) Open in another tab http://192.168.10.1/dev/mtd0ro to download the
content of the whole NOR. If the file size is 0 byte, stop reading
and ask for help in the forum.
5) Come back to the http://192.168.10.1/webcmd.shtml webpage and type:
rm /etc_ro/lighttpd/www/dev/mtd0ro; for i in 1 2 3 4 ; do cp /dev/mtd${i}ro /etc_ro/lighttpd/www/dev/mtd${i}ro; done; ls -la /etc_ro/lighttpd/www/dev/
6) After few seconds, in the textarea should appear this output:
-rw-r--r-- 1 0 0 196608 mtd1ro
-rw-r--r-- 1 0 0 65536 mtd2ro
-rw-r--r-- 1 0 0 65536 mtd3ro
-rw-r--r-- 1 0 0 8060928 mtd4ro
drwxr-xr-x 7 0 0 0 ..
drwxr-xr-x 2 0 0 0 .
If your output doesn't match mine, stop reading and ask for
help in the forum.
7) Open the following links to download the partitions of the OEM FW:
http://192.168.10.1/dev/mtd1ro
http://192.168.10.1/dev/mtd2ro
http://192.168.10.1/dev/mtd3ro
http://192.168.10.1/dev/mtd4ro
If one (or more) of these files are 0 byte, stop reading and ask
for help in the forum.
8) Store these downloaded files in a safe place.
9) Reboot your router to remove any temporary file in ram.
Installation
------------
Flash the initramfs image in the OEM firmware interface
(http://192.168.10.1/update.shtml).
When Openwrt boots, flash the sysupgrade image otherwise you won't be
able to keep configuration between reboots.
Restore OEM Firmware
--------------------
Flash the "mtd4ro" file you previously backed-up directly from LUCI.
Warning: Remember to not keep settings!
Warning2: Remember to force the flash.
Notes
-----
1) Router mac addresses:
LAN XX:XX:XX:XX:XX:9B (factory @ 0x28)
WAN XX:XX:XX:XX:XX:9C (factory @ 0x2e)
WIFI 2G XX:XX:XX:XX:XX:9D (factory @ 0x04)
WIFI 5G XX:XX:XX:XX:XX:9E (factory @ 0x8004)
LABEL XX:XX:XX:XX:XX:9D
2) There is just one wifi led for both wifi interfaces.
It currently shows only the 2.4 GHz wifi activity.
Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
|
||
|
Felix Fietkau
|
a3764ee29d |
ramips: add linux 5.15 support for mt7621
Signed-off-by: Felix Fietkau <nbd@nbd.name> |
||
|
Igor Nazarov
|
42626aef67 |
ramips: add support for D-Link DIR-878 R1
Specifications: - SoC: MediaTek MT7621AT - RAM: 128 MB (DDR3) - Flash: 16 MB (SPI NOR) - WiFi: MT7615N (2.4GHz) and MT7615N (5Ghz) - Switch: 1 WAN, 4 LAN (Gigabit) - Buttons: Reset, WiFi Toggle, WPS - LEDs: Power, Internet, WiFi 2.4G WiFi 5G The R1 revision is identical to the A1 revision except - No Config2 Parition, therefore - factory partition resized to 64k from 128K - Firmware partition offset is 0x50000 not 0x60000 - Firmware partitions size increased by 64K - Firmware partition type is "denx,uimage", not "sge,uimage" - Padding of image creation "uimage-padhdr 96" removed Installation: Update to the last D-Link firmware through web-ui before OpenWRT installation then follow the instructions to patch your device using D-Link FailsafeUI. - D-Link FailsafeUI: Power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the internet LED stops flashing, then jack into any lan port and manually assign a static IP address in 192.168.0.0/24 other than 192.168.0.1 (e.g. 192.168.0.2) and go to http://192.168.0.1 Flash with the factory image. Signed-off-by: Igor Nazarov <tigron.dev@gmail.com> |
||
|
Mikhail Zhilkin
|
f8b02130d2 |
ramips: add support for Beeline SmartBox Flash
Beeline SmartBox Flash is a wireless AC1300 (WiFi 5) router manufactured
by Arcadyan company.
Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 256 MiB, Winbond W632GU6NB
Flash: 128 MiB (NAND), Winbond W29N01HVSINF
Wireless 2.4 GHz (MT7615DN): b/g/n, 2x2
Wireless 5 GHz (MT7615DN): a/n/ac, 2x2
Ethernet: 3xGbE (WAN, LAN1, LAN2)
USB ports: 1xUSB3.0
Button: 1 (Reset/WPS)
LEDs: 1 RGB LED
Power: 12 VDC, 1.5 A
Connector type: Barrel
Bootloader: U-Boot (Ralink UBoot Version: 5.0.0.2)
OEM: Arcadyan WE42022
Installation
------------
1. Place *factory.trx on any web server (192.168.1.2 in this example)
2. Connect to the router using telnet shell (no password required)
3. Save MAC adresses to U-Boot environment:
uboot_env --set --name eth2macaddr --value $(ifconfig | grep eth2 | \
awk '{print $5}')
uboot_env --set --name eth3macaddr --value $(ifconfig | grep eth3 | \
awk '{print $5}')
uboot_env --set --name ra0macaddr --value $(ifconfig | grep ra0 | \
awk '{print $5}')
uboot_env --set --name rax0macaddr --value $(ifconfig | grep rax0 | \
awk '{print $5}')
4. Ensure that MACs were saved correctly:
uboot_env --get --name eth2macaddr
uboot_env --get --name eth3macaddr
uboot_env --get --name ra0macaddr
uboot_env --get --name rax0macaddr
5. Download and write the OpenWrt images:
cd /tmp
wget http://192.168.1.2/factory.trx
mtd_write erase /dev/mtd4
mtd_write write factory.trx /dev/mtd4
6. Set 1st boot partition and reboot:
uboot_env --set --name bootpartition --value 0
reboot
Back to Stock
-------------
1. Run in the OpenWrt shell:
fw_setenv bootpartition 1
reboot
2. Optional step. Upgrade the stock firmware with any version to
overwrite the OpenWrt in Slot 1.
MAC addresses
-------------
+-----------+-------------------+----------------+
| Interface | MAC | Source |
+-----------+-------------------+----------------+
| label | 30:xx:xx:51:xx:09 | No MACs was |
| LAN | 30:xx:xx:51:xx:09 | found on Flash |
| WAN | 30:xx:xx:51:xx:06 | [1] |
| WLAN_2g | 30:xx:xx:51:xx:07 | |
| WLAN_5g | 32:xx:xx:41:xx:07 | |
+-----------+-------------------+----------------+
[1]:
a. Label wasb't found neither in factory nor in other places.
b. MAC addresses are stored in encrypted partition "glbcfg". Encryption
key hasn't known yet. To ensure the correct MACs in OpenWrt, a hack
with saving of the MACs to u-boot-env during the installation was
applied.
c. Default Ralink ethernet MAC address (00:0C:43:28:80:36) was found in
"Factory" 0xfff0. It's the same for all Smartbox Flash devices. OEM
firmware also uses this MAC when initialazes ethernet driver. In
OpenWrt we use it only as internal GMAC (eth0), all other MACs are
unique. Therefore, there is no any barriers to the operation of several
Smartbox Flash devices even within the same broadcast domain.
Stock firmware image format
---------------------------
+--------------+---------------+----------------------------------------+
| Offset | 1.0.15 | Description |
+==============+===============+========================================+
| 0x0 | 5d 43 6f 74 | TRX magic "]Cot" |
+--------------+---------------+----------------------------------------+
| 0x4 | 00 70 ff 00 | Length (reverse) |
+--------------+---------------+----------------------------------------+
| | | htonl(~crc) from 0xc ("flag_version") |
| 0x8 | 72 b3 93 16 | to "Length" |
+--------------+---------------+----------------------------------------+
| 0xc | 00 00 01 00 | Flags |
+--------------+---------------+----------------------------------------+
| | | Offset (reverse) of Kernel partition |
| 0x10 | 1c 00 00 00 | from the start of the header |
+--------------+---------------+----------------------------------------+
| | | Offset (reverse) of RootFS partition |
| 0x14 | 00 00 42 00 | from the start of the header |
+--------------+---------------+----------------------------------------+
| 0x18 | 00 00 00 00 | Zeroes |
+--------------+---------------+----------------------------------------+
| 0x1c | 27 05 19 56 … | Kernel data + zero padding |
+--------------+---------------+----------------------------------------+
| | | RootFS data (starting with "hsqs") + |
| 0x420000 | 68 73 71 73 … | zero padding to "Length" |
+--------------+---------------+----------------------------------------+
| | | Some signature data (format is |
| | | unknown). Necessary for the fw |
| "Lenght" | 00 00 00 00 … | update via oem fw web interface. |
+--------------+---------------+----------------------------------------+
| "Lenght" + | | TRX magic "HDR0". U-Boot is |
| 0x10c | 48 44 52 30 | checking it at every boot. |
+--------------+---------------+----------------------------------------+
| | | 1.00: |
| | | Zero padding to ("Lenght" + 0x23000) |
| | | 1.0.12: |
| | | Zero padding to ("Lenght" + 0x2a000) |
| "Lenght" + | | 1.0.13, 1.0.15, 1.0.16: |
| 0x110 | 00 00 00 00 | Zero padding to ("Lenght" + 0x10000) |
+--------------+---------------+----------------------------------------+
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
|
||
|
Rodolphe de Saint Léger
|
46c5de5385 |
ramips: add support for Netgear WN3100RPv2
This patch adds support for the Netgear WN3100RPv2 http://www.netgear.com/support/product/wn3100rpv2.aspx Specifications: - SoC: MediaTek MT7620A (580MHz, ramips) - RAM: 32MB DDR - Storage: 8MB NOR SPI flash - Wireless: builtin MT7620A, 2x2:2 with u.FL connectors - Ethernet: 1x100M - Stock firmware based on OpenWRT Kamikaze Like the EX2700, the bootloader expects a secondary image signature, see https://forum.openwrt.org/viewtopic.php?pid=312577#p312577 This device seems to be same hardware as a WN3000RPv3 Flash instructions: - Use the Netgear WebUI to upgrade to OpenWRT using the factory image (see note below), - Use the sysupgrade image for upgrading versions from OpenWRT, - TFTP recovery procedure can be used to flash the factory image (preferred method). Note: - The WebUI may not reboot automatically, wait at least 5 minutes before powercycling the device Flashing using TFTP: - Set you IP address to 192.168.1.10/24 (no gateway) - Connect your machine to the Ethernet port - Power off the device and wait for 10 seconds, - Hold the reset button and power on the device (do not release reset), - Hold the reset button until the green light is flashing (Approx. 15s) - launch tftp, set mode to binary and connect to 192.168.1.1 - put the factory firmware image - All leds will switch off (like a power off), this is normal - Wait for the device to reboot in the new OpenWRT image (max 5 mins) - The first boot will take longer than usual. - After boot, the Device IP on the ethernet port is 192.168.1.1 Signed-off-by: Rodolphe de Saint Léger <rdesaintleger@gmail.com> [drop unneeded includes in dts, wrap commit message] Signed-off-by: Sungbo Eo <mans0n@gorani.run> |
||
|
Sungbo Eo
|
fe34001ee5 |
Revert "ramips: add support for Netgear WN3000RPv3"
This reverts commit
|
||
|
Rodolphe de Saint Léger
|
7bc20cb614 |
ramips: add support for Netgear WN3000RPv3
This patch adds support for the Netgear WN3100RPv2 http://www.netgear.com/support/product/wn3100rpv2.aspx Specifications: - SoC: MediaTek MT7620A (580MHz, ramips) - RAM: 32MB DDR - Storage: 8MB NOR SPI flash - Wireless: builtin MT7620A, 2x2:2 with u.FL connectors - Ethernet: 1x100M - Stock firmware based on OpenWRT Kamikaze Like the EX2700, the bootloader expects a secondary image signature, see https://forum.openwrt.org/viewtopic.php?pid=312577#p312577 This device seems to be same hardware as a WN3000RPv3 Flash instructions: - Use the Netgear WebUI to upgrade to OpenWRT using the factory image (see note below), - Use the sysupgrade image for upgrading versions from OpenWRT, - TFTP recovery procedure can be used to flash the factory image (preferred method). Note: - The WebUI may not reboot automatically, wait at least 5 minutes before powercycling the device Flashing using TFTP: - Set you IP address to 192.168.1.10/24 (no gateway) - Connect your machine to the Ethernet port - Power off the device and wait for 10 seconds, - Hold the reset button and power on the device (do not release reset), - Hold the reset button until the green light is flashing (Approx. 15s) - launch tftp, set mode to binary and connect to 192.168.1.1 - put the factory firmware image - All leds will switch off (like a power off), this is normal - Wait for the device to reboot in the new OpenWRT image (max 5 mins) - The first boot will take longer than usual. - After boot, the Device IP on the ethernet port is 192.168.1.1 Signed-off-by: Rodolphe de Saint Léger <rdesaintleger@gmail.com> [drop unneeded includes in dts, wrap commit message] Signed-off-by: Sungbo Eo <mans0n@gorani.run> |
||
|
Pawel Dembicki
|
be89c9eec4 |
ramips: mt7620: Add support for D-Link DWR-961 A1
The DWR-961 A1 Wireless Router is based on the MT7620A SoC. It's a merge of two Amit boards: DWR-960 with ethernet part of Lava LR-25G001. ROMID it's taken from Telenor branded version and it works with tested device. Images from D-Link site for this router are from DWR-953 and it have ROMID DLK6E2424001. I don't know if it's mistake on web-site or if it's will require different image. Specification: - MediaTek MT7620A (580 Mhz) - 128 MB of RAM - 16 MB of FLASH - 1x 802.11bgn radio - 1x 802.11ac radio (MT7612 mpcie card) - 5x 10/100/1000 Mbps Ethernet: 4xLAN and 1xWAN (QCA8337) - 2x internal, non-detachable antennas (Wifi 2.4G) - 3x external, detachable antennas (2x LTE, 1x Wifi 5G) - 1x LTE modem cat 6 - UART (J5) header on PCB (57600 8n1) - 13x LED, 2x button - JBOOT bootloader Installation: Apply factory image via http web-gui or JBOOT recovery page How to revert to OEM firmware: - push the reset button and turn on the power. Wait until LED start blinking (~10sec.) - upload original factory image via JBOOT http (IP: 192.168.123.254) Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com> |
||
|
Dawsen Gao
|
b3da44b647 |
ramips: Add support for Dual-Q H721
Dual-Q H721 is a router platform board, it is the smaller model of the U7621-06. The device has the following specifications: MT7621AT (880 MHz) 256 of RAM (DDR3) 16 MB of FLASH (MX25l12805d SPI) 5x 1 Gbps Ethernet (MT7621 built-in switch) 1x M.2 (NGFF) 3.7V 3A max for 5G M.2 Modem work at USB3.0 mode 1x Minipcie 3.7V 3A max for LTE Modem work at USB2.0 Mode 2x Minipcie for WIFI card 4x Lan+1x Wan 10/100M/1000M RJ45 port 14x LEDs (1x GPIO-controlled) 1x reset button 1x UART header (4-pins) 1x mico SD-card reader 1x DC jack for main power (5~27 V) The following has been tested and is working: Ethernet switch miniPCIe slots (tested with Wi-Fi cards and LTE modem cards) miniSIM slot (works with normal size simcard) sysupgrade reset button micro SD-card reader Installation: This board has no locked down bootloader. The seller can be asked to install openwrt, so upgrades are standard sysupgrade method. Recovery: This board contains a Chinese, closed-source bootloader called Breed (Boot and Recovery Environment for Embedded Devices). Breed supports web recovery and to enter it, you keep the reset button pressed for around 5 seconds during boot. Your machine will be assigned an IP through DHCP and the router will use IP address 192.168.1.1. The recovery website is in Chinese, but is easy to use. Click on the second item in the list to access the recovery page, then the second item on the next page is where you select the firmware. In order to start the recovery, you click the button at the bottom. Signed-off-by: Dawsen Gao <dawsen_gao@163.com> [change author name (used SoB one), add ethernet pinctrl, apply sorting to device recipe] Signed-off-by: Sungbo Eo <mans0n@gorani.run> |
||
|
Sungbo Eo
|
94d4269ec7 |
ramips: fix DEVICE_VENDOR for unbranded devices
In commit |
||
|
Kim Namu
|
2876f7534f |
ramips: mt7621: add support for Zbtlink ZBT-WG1608
Zbtlink ZBT-WG1608 is a Wi-Fi router intendent to use with WWAN (4G/5G) modems. Specifications: * SoC: MediaTek MT7621A * RAM: 256/512 MiB * Flash: 16/32 MiB (SPI NOR) * Wi-Fi: * MediaTek MT7603E : 2.4Ghz * MediaTek MT7613BE : 5Ghz * Ethernet: 10/100/1000 Mbps Ethernet x5 ports (4xLAN + WAN) * M.2: 1x slot with USB&SIM * EM7455/EM12-G/EM160R/RM500Q-AE * USB: 1x 3.0 Type-A port * External storage: 1x microSD (SDXC) slot * UART: console (115200 baud) * LED: * 1 power indicator * 1 WLAN 2.4G controlled (wlan 2G) * 3 SoC controlled (wlan 5G, wwan, internet) * 5 per Eth phy (4xLAN + WAN) MAC Addresses: * LAN : f8:5e:3c:xx:xx:e0 (Factory, 0xe000 (hex)) * WAN : f8:5e:3c:xx:xx:e1 (Factory, 0xe006 (hex)) * 2.4 GHz: f8:5e:3c:xx:xx:de (Factory, 0x0004 (hex)) * 5 GHz : f8:5e:3c:xx:xx:df (Factory, 0x8004 (hex)) Installation: * Vendor's firmware is OpenWrt (LEDE) based, so the sysupgrade image can be directly used to install OpenWrt. Firmware must be upgraded using the 'force' and 'do not save configuration' command line options (or correspondig web interface checkboxes) since the vendor firmware is from the pre-DSA era. Recovery Mode: * Press reset button, power up the device, wait for about 10sec. * Upload sysupgrade image through the firmware recovery mode web page at 192.168.1.1. Signed-off-by: Kim Namu <namu@theseed.io> |
||
|
Ray Wang
|
3c4810fecc |
ramips: add support for Asus RT-AC1200
Asus RT-AC1200 is a 2.4/5GHz dual band AC router, based on MediaTek MT7628AN. Specification: * SoC: MT7628AN * RAM: DDR2 64 MiB * Flash: 16 MiB NOR (W25Q128BV) * Wi-Fi: * 2.4GHz: SoC Built-in * 5GHz: MT7612EN * Ethernet: 5x 100Mbps * Switch: SoC built-in * USB: 1x 2.0 Flash Layout: 0x0000000-0x0030000 : "bootloader" 0x0030000-0x0040000 : "nvram" 0x0040000-0x0050000 : "factory" 0x0050000-0x1000000 : "firmware" MAC address: LAN: factory 0x28 WAN: factory 0x22 2.4G: factory 0x4 5G: factory 0x8004 Installation via **recovery** mode: 1. Download the Asus recovery firmware (windows) tool from http://dlcdnet.asus.com/pub/ASUS/LiveUpdate/Release/Wireless/Rescue.zip 2. Set your ethernet IP manually 192.168.1.5 / 255.255.255.0 with NO gateway. 3. Plug in your ethernet to LAN port 1 on the router. 4. Load up the recovery software with the firmware file, but don't press "Upload" yet. 5. Plug in the router to power WHILE HOLDING the reset button in. While CONTINUING to hold the button, select "Upload" Continue to hold the reset button in until it finishes and verifies! 6. If that doesn't work try pressing "Upload" first just before you do step 5. At some point while holding reset the rescue tool will finally detect and upload the firmware. That's when you can let go of the reset button. 7. The router will reboot and not much will happen. Wait a minute or 2. 8. Power off and on the router again. Voila. Set everything your Ethernet IP back to DHCP (automatically) and you're good to go. Revert to stock firmware: 1. Install stock image via recovery mode. Tested-by: Ivan Pavlov <AuthorReflex@gmail.com> Signed-off-by: Ray Wang <raywang777@foxmail.com> |
||
|
Birger Koblitz
|
ed364cd4b0 |
ramips: add support for Renkforce WS-WN530HP3-A
This adds support for the Renkforce WS-WN530HP3-A ceiling- mountable Wireless Access Point, which is powered over PoE. Hardware: - SoC: Mediatek MT7621DAT - RAM: 128MiB on SoC - Flash: 16MiB GigaDevice GD25Q128C - 2.4Ghz Wifi: Mediatek MT603EN - 5GHz Wifi: MT613BEN - Ethernet: - 1x 1GBit WAN port, passive PoE capable - 2x 1GBit LAN ports LEDs: 1x Bi-Color LED (red/blue) Buttons: 1x Reset Button, 1x Power Button Installation: Power on the access point and immedately press the reset button for 10 seconds. Connect web-browser to 192.168.10.1 and upload sysupgrade image. Flash uploaded image and wait about 2 minutes for reboot. Signed-off-by: Birger Koblitz <mail@birger-koblitz.de> Signed-off-by: Petr Štetiar <ynezz@true.cz> [fixed SoB] |
||
|
INAGAKI Hiroshi
|
f7f9e6bd20 |
ramips: use parser_trx for Buffalo WCR-1166DS
Buffalo WCR-1166DS uses trx-fomatted firmware and the custom magic number (0x5C436F74, "\Cot") is required for OpenWrt installation from OEM WebUI. But the current mtdsplit_trx doesn't support the custom magic number and fail to parse and split to kernel and rootfs when the factory image is flashed. Then, the kernel fails to mount rootfs automatically and panics. Before the commit |
||
|
Joe Mullally
|
6c743c3006 |
ramips: Add support for TP-Link TL-WPA8631P v3
AV1300 Gigabit Passthrough Powerline ac Wi-Fi Extender Specifications -------------- * SoC: MediaTek MT7621AT * CPU: 880 MHz MIPS 1004KEc dual-core CPU * RAM: 64 MiB DDR2 (Zentel A3R12E40DBF-8E) * Flash: 8 MiB SPI NOR (GigaDevice GD25Q64CSIG) * Ethernet: SoC built-in Switch 5x 1GbE * Port 0: PLC (connected through AR8035-A) * Port 1-3: LAN * WLAN: 2x2 2.4GHz 300 Mbps + 2x2 5GHz 867 Mbps (MT7603EN + MT7613BEN) * PLC: HomePlug AV2 (Qualcomm QCA7500) * PLC Flash: 2MiB SPI NOR (GigaDevice GD25Q16CSIG) * Buttons: Reset, LED, Pair, Wi-Fi * LEDs: Power (green), PLC (green/amber), LAN (green), 2.4G (green), 5G (green) * UART: J1 (57600 baud) * Pinout: (3V3) (GND) (RX) (TX) * Visually identify GND from connection to PCB ground plane Installation ------------ Installation is possible from the OEM web interface. Make sure to install the latest OEM firmware first, so that the PLC firmware is at the latest version. However, please first check the OpenWRT Wiki page for confirmation that your OEM firmware version is supported. Signed-off-by: Joe Mullally <jwmullally@gmail.com> |
||
|
Stijn Tintel
|
a1b8a4d7b3 |
ramips: support TP-Link EAP615-Wall
Add support for the TP-Link EAP615-Wall, an AX1800 Wall Plate WiFi 6 AP. The device is very similar to the TP-Link EAP235-Wall. Hardware: * SoC: MediaTek MT7621AT * RAM: 128MiB * Flash: 16MiB SPI-NOR * Ethernet: 4x GbE * Back: ETH0 (PoE-PD) * Bottom: ETH1, ETH2, ETH3 (PoE passthrough) * WiFi: MT7905DAN/MT7975DN 2.4/5 GHz 2T2R * LEDS: 1x white * Buttons: 1x LED, 1x reset Stock firmware uses a random MAC address for ethernet. OpenWrt uses the MAC address that is on the device label for ethernet and the wireless interfaces. MAC address must not be incremented, as this will cause MAC address conflicts in case you have two devices with consecutive MAC addresses. Instead, different locally administered addresses will be generated automatically, based on the MAC on the label. Installation via stock firmware: * Enable SSH in the TP-Link web interface * SSH to the device * Run `cliclientd stopcs` * Upload the OpenWrt factory image via the TP-Link web interface Installation via bootloader: * Solder TTL header. Pinout: 1: TX, 2: RX, 3: GND, 4: VCC, with pin 1 closest to ETH1. Baud rate 115200 * Interrupt boot process by holding a key during boot * Boot the OpenWrt initramfs: # tftpboot 0x84000000 openwrt-ramips-mt7621-tplink_eap615-wall-v1-initramfs-kernel.bin # bootm * Copy openwrt-ramips-mt7621-tplink_eap615-wall-v1-squashfs-sysupgrade.bin to /tmp and use sysupgrade to install it Thanks to Sander Vanheule for his work on the EAP235-Wall, which made adding support for the EAP615-Wall very easy. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Reviewed-by: Sander Vanheule <sander@svanheule.net> Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com> |
||
|
Nick McKinney
|
61d97bf377 |
ramips: clean up Makefile formatting
Use correct indent in target/linux/ramips/image/mt7621.mk to be consistent with the rest of the file. Signed-off-by: Nick McKinney <nick@ndmckinney.net> [rephrase commit message as Adrian suggested, fix a6004ns-m indent] Signed-off-by: Sungbo Eo <mans0n@gorani.run> |
||
|
Sven Roederer
|
65df862b50 |
ramips: mt7621: print size of factory initramfs-image if it's too big
It's helpful to know the current and maximal size of the imagefiles if the creation fails. Signed-off-by: Sven Roederer <devel-sven@geroedel.de> |
||
|
Yoonji Park
|
125b9aec29 |
ramips: add support for ipTIME A3002MESH
Add support for ipTIME A3002MESH. Hardware: - SoC: MediaTek MT7621AT (880MHz, Duel-Core) - RAM: DDR3 128MB - Flash: XMC XM25QH128AHIG (SPI-NOR 16MB) - WiFi: MediaTek MT7615D (2.4GHz, 5GHz, DBDC) - Ethernet: MediaTek MT7530 (WAN x1, LAN x2, SoC built-in) - UART: [GND, RX, TX, 3.3V] (57600 8N1, J4) MAC addresses: | interface | MAC | source | comment |-----------|-------------------|----------------|---------- | LAN | 70:XX:XX:5X:XX:X3 | | | WAN | 70:XX:XX:5X:XX:X1 | u-boot 0x1fc40 | | WLAN 2G | 72:XX:XX:4X:XX:X0 | | | WLAN 5G | 70:XX:XX:5X:XX:X0 | factory 0x4 | | | 70:XX:XX:5X:XX:X0 | u-boot 0x1fc20 | unknown | | 70:XX:XX:5X:XX:X2 | factory 0x8004 | unknown - WLAN 2G MAC address is not the same as stock firmware since OpenWrt uses LAN MAC address with local bit sets. Installation: 1. Flash initramfs image. This can be done using stock web ui or TFTP 2. Connect to OpenWrt with an SSH connection to 192.168.1.1 3. Perform sysupgrade with sysupgrade image Revert to stock firmware: - Flash stock firmware via OEM TFTP Recovery mode - Perform sysupgrade with stock image TFTP Recovery method: 1. Unplug the router 2. Hold the reset button and plug in 3. Release when the power LED stops flashing and go off 4. Set your computer IP address manually to 192.168.0.x / 255.255.255.0 5. Flash image with TFTP client to 192.168.0.1 Signed-off-by: Yoonji Park <koreapyj@dcmys.kr> [wrap/rephrase commit message] Signed-off-by: Sungbo Eo <mans0n@gorani.run> |
||
|
Nick Hainke
|
2fd049f5cd |
ramips: add Ubiquiti EdgePoint R6 as alt name
The Ubiquiti EdgePoint R6 is identical to the EdgeRouter X SFP.
However, it fits well into outdoor environments due to its water-proven
case.
More specifications:
|
||
|
INAGAKI Hiroshi
|
337e942290 |
ramips: add support for ELECOM WRC-2533GS2
ELECOM WRC-2533GS2 is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on MT7621A. Specification: - SoC : MediaTek MT7621A - RAM : DDR3 128 MiB (NT5CC64M16GP-DI) - Flash : SPI-NOR 16 MiB (MX25L12835FM2I-10G) - WLAN : 2.4/5GHz 4T4R (2x MediaTek MT7615) - Ethernet : 10/100/1000 Mbps x5 - Switch : MediaTek MT7530 (SoC) - LEDs/Keys : 4x/6x (2x buttons, 1x slide-switch) - UART : through-hole on PCB - J4: 3.3V, GND, TX, RX from ethernet port side - 57600n8 - Power : 12 VDC, 1.5 A Flash instruction using factory image: 1. Boot WRC-2533GS2 normally with "Router" mode 2. Access to "http://192.168.2.1/" and open firmware update page ("ファームウェア更新") 3. Select the OpenWrt factory image and click apply ("適用") button 4. Wait ~120 seconds to complete flashing MAC Addresses: LAN : 04:AB:18:xx:xx:FB (Factory, 0xFFF4 (hex)) WAN : 04:AB:18:xx:xx:FC (Factory, 0xFFFA (hex)) 2.4 GHz : 04:AB:18:xx:xx:FD (Factory, 0x4 (hex)) 5 GHz : 04:AB:18:xx:xx:FE (Factory, 0x8004 (hex)) Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com> |
||
|
Sungbo Eo
|
37753f34ac |
ramips: add support for ipTIME AX2004M
ipTIME AX2004M is an 802.11ax (Wi-Fi 6) router, based on MediaTek
MT7621A.
Specifications:
* SoC: MT7621A
* RAM: 256 MiB
* Flash: NAND 128 MiB
* Wi-Fi:
* MT7915D: 2.4/5 GHz (DBDC)
* Ethernet: 5x 1GbE
* Switch: SoC built-in
* USB: 1x 3.0
* UART: J4 (115200 baud)
* Pinout: [3V3] (TXD) (RXD) (GND)
MAC addresses:
| interface | MAC address | source | comment
|-----------|-------------------|----------------|---------
| LAN | 58:xx:xx:00:xx:9B | | [1]
| WAN | 58:xx:xx:00:xx:99 | |
| WLAN 2G | 58:xx:xx:00:xx:98 | factory 0x4 |
| WLAN 5G | 5A:xx:xx:40:xx:98 | |
| | 58:xx:xx:00:xx:98 | config ethaddr |
[1] Used in this patch as WLAN 5G MAC address with the local bit set
Load addresses:
* stock
* 0x80010000: FIT image
* 0x81001000: kernel image -> entry
* OpenWrt
* 0x80010000: FIT image
* 0x82000000: uncompressed kernel+relocate image
* 0x80001000: relocated kernel image -> entry
Notes:
* This device has a dual-boot partition scheme, but this firmware works
only on boot partition 1. The stock web interface will flash only on the
inactive boot partition, but the recovery web page will always flash on
boot partition 1.
Installation via recovery mode:
1. Press reset button, power up the device, wait >10s for CPU LED
to stop blinking.
2. Upload recovery image through the recovery web page at 192.168.0.1.
Revert to stock firmware:
1. Install stock image via recovery mode.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
|
||
|
Sungbo Eo
|
09f383465e |
ramips: move KERNEL_LOADADDR into Device/Default
Commit |
||
|
Raymond Wang
|
3343ca7e68 |
ramips: add support for Xiaomi Mi Router CR660x series
Xiaomi Mi Router CR6606 is a Wi-Fi6 AX1800 Router with 4 GbE Ports.
Alongside the general model, it has three carrier customized models:
CR6606 (China Unicom), CR6608 (China Mobile), CR6609 (China Telecom)
Specifications:
- SoC: MediaTek MT7621AT
- RAM: 256MB DDR3 (ESMT M15T2G16128A)
- Flash: 128MB NAND (ESMT F59L1G81MB)
- Ethernet: 1000Base-T x4 (MT7530 SoC)
- WLAN: 2x2 2.4GHz 574Mbps + 2x2 5GHz 1201Mbps (MT7905DAN + MT7975DN)
- LEDs: System (Blue, Yellow), Internet (Blue, Yellow)
- Buttons: Reset, WPS
- UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1)
- Power: 12VDC, 1A
Jailbreak Notes:
1. Get shell access.
1.1. Get yourself a wireless router that runs OpenWrt already.
1.2. On the OpenWrt router:
1.2.1. Access its console.
1.2.2. Create and edit
/usr/lib/lua/luci/controller/admin/xqsystem.lua
with the following code (exclude backquotes and line no.):
```
1 module("luci.controller.admin.xqsystem", package.seeall)
2
3 function index()
4 local page = node("api")
5 page.target = firstchild()
6 page.title = ("")
7 page.order = 100
8 page.index = true
9 page = node("api","xqsystem")
10 page.target = firstchild()
11 page.title = ("")
12 page.order = 100
13 page.index = true
14 entry({"api", "xqsystem", "token"}, call("getToken"), (""),
103, 0x08)
15 end
16
17 local LuciHttp = require("luci.http")
18
19 function getToken()
20 local result = {}
21 result["code"] = 0
22 result["token"] = "; nvram set ssh_en=1; nvram commit; sed -i
's/channel=.*/channel=\"debug\"/g' /etc/init.d/dropbear; /etc/init.d/drop
bear start;"
23 LuciHttp.write_json(result)
24 end
```
1.2.3. Browse http://{OWRT_ADDR}/cgi-bin/luci/api/xqsystem/token
It should give you a respond like this:
{"code":0,"token":"; nvram set ssh_en=1; nvram commit; ..."}
If so, continue; Otherwise, check the file, reboot the rout-
er, try again.
1.2.4. Set wireless network interface's IP to 169.254.31.1, turn
off DHCP of wireless interface's zone.
1.2.5. Connect to the router wirelessly, manually set your access
device's IP to 169.254.31.3, make sure
http://169.254.31.1/cgi-bin/luci/api/xqsystem/token
still have a similar result as 1.2.3 shows.
1.3. On the Xiaomi CR660x:
1.3.1. Login to the web interface. Your would be directed to a
page with URL like this:
http://{ROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/web/home#r-
outer
1.3.2. Browse this URL with {STOK} from 1.3.1, {WIFI_NAME}
{PASSWORD} be your OpenWrt router's SSID and password:
http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/misy-
stem/extendwifi_connect?ssid={WIFI_NAME}&password={PASSWO-
RD}
It should return 0.
1.3.3. Browse this URL with {STOK} from 1.3.1:
http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/xqsy-
stem/oneclick_get_remote_token?username=xxx&password=xxx&-
nonce=xxx
1.4. Before rebooting, you can now access your CR660x via SSH.
For CR6606, you can calculate your root password by this project:
https://github.com/wfjsw/xiaoqiang-root-password, or at
https://www.oxygen7.cn/miwifi.
The root password for carrier-specific models should be the admi-
nistration password or the default login password on the label.
It is also feasible to change the root password at the same time
by modifying the script from step 1.2.2.
You can treat OpenWrt Router however you like from this point as
long as you don't mind go through this again if you have to expl-
oit it again. If you do have to and left your OpenWrt router unt-
ouched, start from 1.3.
2. There's no official binary firmware available, and if you lose the
content of your flash, no one except Xiaomi can help you.
Dump these partitions in case you need them:
"Bootloader" "Nvram" "Bdata" "crash" "crash_log"
"firmware" "firmware1" "overlay" "obr"
Find the corespond block device from /proc/mtd
Read from read-only block device to avoid misoperation.
It's recommended to use /tmp/syslogbackup/ as destination, since files
would be available at http://{ROUTER_ADDR}/backup/log/YOUR_DUMP
Keep an eye on memory usage though.
3. Since UART access is locked ootb, you should get UART access by modify
uboot env. Otherwise, your router may become bricked.
Excute these in stock firmware shell:
a. nvram set boot_wait=on
b. nvram set bootdelay=3
c. nvram commit
Or in OpenWrt:
a. opkg update && opkg install kmod-mtd-rw
b. insmod mtd-rw i_want_a_brick=1
c. fw_setenv boot_wait on
d. fw_setenv bootdelay 3
e. rmmod mtd-rw
Migrate to OpenWrt:
1. Transfer squashfs-firmware.bin to the router.
2. nvram set flag_try_sys1_failed=0
3. nvram set flag_try_sys2_failed=1
4. nvram commit
5. mtd -r write /path/to/image/squashfs-firmware.bin firmware
Additional Info:
1. CR660x series routers has a different nand layout compared to other
Xiaomi nand devices.
2. This router has a relatively fresh uboot (2018.09) compared to other
Xiaomi devices, and it is capable of booting fit image firmware.
Unfortunately, no successful attempt of booting OpenWrt fit image
were made so far. The cause is still yet to be known. For now, we use
legacy image instead.
Signed-off-by: Raymond Wang <infiwang@pm.me>
|
||
|
Sven Eckelmann
|
7c3efd5273 |
ramips: Switch Teltonika RUT5xx to kernel GPIO-line watchdog driver
The commit |
||
|
Stijn Tintel
|
cd6a6e3030 |
Revert "ramips: add support for ipTIME AX2004M"
Commit |
||
|
Davide Fioravanti
|
8fde82095b |
ramips: add support for Wavlink WL-WN535K1
The Wavlink WL-WN535K1 is a "mesh" router with 2 gigabit ethernet ports
and one fast ethernet port. Mine is branded as Talius TAL-WMESH1.
It can be found in kits of 2 or 3 (WL-WN535K2 or WL-WN535K3).
The motherboard is labelled as WS-WN535G3-B-V1.2 so this image could
potentially work for WL-WN535G3R and WS-WN535G3R with little to none
effort, but it's untested.
Hardware
--------
SoC: Mediatek MT7620A
RAM: 64MB
FLASH: 8MB NOR (GigaDevice GD25Q64CS)
ETH:
- 2x 10/100/1000 Mbps Ethernet (RTL8211F)
- 1x 10/100 Mbps Ethernet (integrated in SOC)
WIFI:
- 2.4GHz: 1x (integrated in SOC) (2x2:2)
- 5GHz: 1x MT7612E (2x2:2)
- 4 internal antennas
BTN:
- 1x Reset button
- 1x Touchlink button (set to WPS)
- 1x ON/OFF switch
LEDS:
- 1x Red led (system status)
- 1x Blue led (system status)
- 3x Green leds (ethernet port status/act)
UART:
- 57600-8-N-1
Everything works correctly.
Currently there is no firmware update available. Because of this, in
order to restore the OEM firmware, you must firstly dump the OEM
firmware from your router before you flash the OpenWrt image.
Backup the OEM Firmware
-----------------------
The following steps are to be intended for users having little to none
experience in linux. Obviously there are many ways to backup the OEM
firmware, but probably this is the easiest way for this router.
Procedure tested on WN535K1_V1510_200916 firmware version.
1) Go to http://192.168.10.1/webcmd.shtml
2) Type the following line in the "Command" input box and then press enter:
mkdir /etc_ro/lighttpd/www/dev; dd if=/dev/mtd0ro of=/etc_ro/lighttpd/www/dev/mtd0ro
3) After few seconds in the textarea should appear this output:
16384+0 records in
16384+0 records out
If your output doesn't match mine, stop reading and ask for
help in the forum.
4) Open in another tab http://192.168.10.1/dev/mtd0ro to download the
content of the whole NOR. If the file size is 0 byte, stop reading
and ask for help in the forum.
5) Come back to the http://192.168.10.1/webcmd.shtml webpage and type:
rm /etc_ro/lighttpd/www/dev/mtd0ro;for i in 1 2 3 4 5; do dd if=/dev/mtd${i}ro of=/etc_ro/lighttpd/www/dev/mtd${i}ro; done
6) After few seconds, in the textarea should appear this output:
384+0 records in
384+0 records out
128+0 records in
128+0 records out
128+0 records in
128+0 records out
14720+0 records in
14720+0 records out
1024+0 records in
1024+0 records out
If your output doesn't match mine, stop reading and ask for
help in the forum.
7) Open the following links to download the partitions of the OEM FW:
http://192.168.10.1/dev/mtd1ro
http://192.168.10.1/dev/mtd2ro
http://192.168.10.1/dev/mtd3ro
http://192.168.10.1/dev/mtd4ro
http://192.168.10.1/dev/mtd5ro
If one (or more) of these files are 0 byte, stop reading and ask
for help in the forum.
8) Store these downloaded files in a safe place.
9) Reboot your router to remove any temporary file in ram.
Installation
------------
Flash the initramfs image in the OEM firmware interface
(http://192.168.10.1/update_mesh.shtml).
When Openwrt boots, flash the sysupgrade image otherwise you won't be
able to keep configuration between reboots.
Restore OEM Firmware
--------------------
Flash the "mtd4ro" file you previously backed-up directly from LUCI.
Warning: Remember to not keep settings!
Warning2: Remember to force the flash.
Notes
-----
1) Router mac addresses:
LAN XX:XX:XX:XX:XX:E2 (factory @ 0x28)
WAN XX:XX:XX:XX:XX:E3 (factory @ 0x2e)
WIFI 2G XX:XX:XX:XX:XX:E4 (factory @ 0x04)
WIFI 5G XX:XX:XX:XX:XX:E5 (factory @ 0x8004)
LABEL XX:XX:XX:XX:XX:E5
2) The OEM firmware upgrade page accepts only files containing the
string "WN535K1" in the filename.
3) Additional notes 1,2,3 in the WS-WN583A6 commit are still valid
(
|