This commit adds support for netis N6 WiFi 6 router.
Specification
-------------
- SoC : MediaTek MT7621AT, MIPS, 880 MHz
- RAM : 256 MiB
- Flash : NAND 128 MiB (ESMT PSU1GA30DT)
- WLAN : MT7905DAN + MT7975DN
- 2.4 GHz : b/g/n/ax, 574 Mbps, MIMO 2x2
- 5 GHz : a/n/ac/ax, 1201 Mbps, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x5 (1x WAN, 4x LAN)
- USB : 1x 3.0
- UART : 3.3V, 115200n8
- Buttons : 1x Reset
1x WPS
- LEDs : 1x Power (green)
1x System (green)
1x WAN (green)
1x WiFi 2.4 GHz (green), controlled by phy
1x WiFi 5 GHz (green), controlled by phy
1x WPS (green)
1x USB (green)
5x ethernet leds (green), controlled by switch
- Power : 12 VDC, 1.5 A
Installation
------------
1. Update the router using stock firmware web interface and OpenWrt
factory.bin image.
Recovery and return to stock
----------------------------
1. Assign your PC a static IP 192.168.1.2 and connect to the router using
the ethernet cable;
2. Power off the router;
3. Press Reset button, power on the router and wait until ethernet led
start blinking;
4. Release the button;
5. Open http://192.168.1.1/ (N6 System Recovery Mode) in your browser;
6. Upload OpenWrt factory.bin (or stock firmware *.bin) image and proceed
with upgrade.
MAC addresses
-------------
+---------+-------------------+
| | MAC example |
+---------+-------------------+
| LAN | dc:xx:xx:49:xx:04 |
| WAN | dc:xx:xx:49:xx:05 |
| WLAN 2g | dc:xx:xx:19:xx:06 |
| WLAN 5g | dc:xx:xx:79:xx:06 |
+---------+-------------------+
The WLAN MAC prototype was found in 'Factory', 0x4
The LAN MAC was found in 'Factory', 0x7ef20
The WAN MAC was found in 'Factory', 0x7ef26
Known issue
-----------
2.4 GHz WLAN doesn't start with mt76 driver.
Probable reason:
Original Netis N6 EEPROM contains wrong MT_EE_WIFI_CONF value (0xd2).
Other routers with the same WLAN hardware (e.g., Routerich AX1800)
have MT_EE_WIFI_CONF = 0x92.
Workaround (already included in this commit):
Extract EEPROM to a file at the first time boot and change
MT_EE_WIFI_CONF (offset 0x190) value from 0xd2 to 0x92. See
/etc/hotplug.d/firmware/11-mt76-caldata for details.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16322
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This files are executable:
target/linux/ramips/dts/mt7621_openfi_5pro.dts
target/linux/ramips/dts/mt7621_winstars_ws-wn536p3.dts
Has to be fixed.
Fixes: 5560791 ("ramips: add support for OpenFi 5Pro Travel Router")
Fixes: 2da2705 ("ramips: add support for WINSTARS WS-WN536P3")
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16322
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This fixes a well-known "LZMA ERROR 1" error on Sercomm NA502s, reported
on the OpneWrt forum [0].
[0] https://forum.openwrt.org/t/206640
Signed-off-by: Andreas Böhler <dev@aboehler.at>
Specifications:
- Device: DNA Valokuitu Plus EX400
- SoC: MT7621A
- Flash: 256MB NAND
- RAM: 256MB
- Ethernet: Built-in, 2 x 1GbE
- Wifi: MT7603 2.4 GHz, MT7615 5 GHz (4x internal antennas)
- USB: 1x 3.0
- LED: 1x green/red, 1x green
- Buttons: Reset
MAC addresses:
- LAN: u-boot 'ethaddr' (label)
- WAN: label + 1
- 2.4 GHz: label + 6
- 5 GHz: label + 7
Serial:
There is a black block connector next to the red ethernet connector. It
is accessible also through holes in the casing.
Pinout (TTL 3.3V)
+---+---+
|Tx |Rx |
+---+---+
|Vcc|Gnd|
+---+---+
Firmware:
The vendor firmware is a fork of OpenWrt (Reboot) with a kernel version
4.4.93. The flash is arranged as below and there is a dual boot
mechanism alternating between rootfs_0 and rootfs_1.
+-------+------+------+-----------+-----------+
| | env1 | env2 | rootfs_0 | rootfs_1 |
| +------+------+-----------+-----------+
| | UBI volumes |
+-------+-------------------------------------+
|U-Boot | UBI |
+-------+-------------------------------------+
|mtd0 | mtd1 |
+-------+-------------------------------------+
| NAND |
+---------------------------------------------+
In OpenWrt rootfs_0 will be used as a boot partition that will contain the
kernel and the dtb. The squashfs rootfs and overlay are standard OpenWrt
behaviour.
+-------+------+------+-----------+--------+------------+
| | env1 | env2 | rootfs_0 | rootfs | rootfs_data|
| +------+------+-----------+--------+------------+
| | UBI volumes |
+-------+-----------------------------------------------+
|U-Boot | UBI |
+-------+-----------------------------------------------+
|mtd0 | mtd1 |
+-------+-----------------------------------------------+
| NAND |
+-------------------------------------------------------+
U-boot:
With proper serial access booting can be halted to U-boot by pressing any
key. TFTP and flash writes are available, but only the first one has been
tested.
NOTE: Recovery mode can be accessed by holding down the reset button while
powering on the device. The led 'Update' will show a solid green light
once ready. A web server will be running at 192.168.1.1:80 and it will
allow flashing a firmware package. You can cycle between rootfs_0 and
rootfs_1 by pressing the reset button once.
Root password:
With the vendor web UI create a backup of your settings and download the
archive to your computer. Within the archive in the file
/etc/shadow replace the password hash for root with that of a password you
know. Restore the configuration with the vendor web UI and you will have
changed the root password.
SSH access:
You might need to enable the SSH service for LAN interface as by default
it's enabled for WAN only.
Installing OpenWrt:
With the vendor web UI install the OpenWrt factory image. Alternatively,
ssh to the device and use sysupgrade -n from cli.
Finalize by installing the OpenWrt sysupgrade image to get a fully
functioning system.
Reverting to the vendor firmware:
Boot with OpenWrt initramfs image
- Remove volumes rootfs_0, rootfs and rootfs_data and create vendor
volumes.
ubirmvol /dev/ubi0 -n 2
ubirmvol /dev/ubi0 -n 3
ubirmvol /dev/ubi0 -n 4
ubimkvol /dev/ubi0 -N rootfs_0 -S 990
ubimkvol /dev/ubi0 -N rootfs_1 -S 990
Power off and enter to the U-boot recovery to install the vendor
firmware.
Known issues:
- MACs for wifi are stored in currently unknown place but it seems
to persist over power-off. They might be stored on the chip.
Signed-off-by: Mauri Sandberg <maukka@ext.kapsi.fi>
[rmilecki: try NVMEM for MACs]
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Add missing 'model' string to DT, so /tmp/sysinfo/model gets populated.
Fixes: e497c975d3 ("ramips: mt76x8: add support for Yuncore M300")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Add missing 'model' string to DT, so /tmp/sysinfo/model gets populated.
Fixes: 64dae1052b ("ramips: mt76x8: add support for Yuncore CPE200")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Various cleanups and bugfixes were applied.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16215
Signed-off-by: Robert Marko <robimarko@gmail.com>
Yuncore CPE200 is an outdoor unit with IEEE 802.11ac radio.
Hardware:
- SoC: MediaTek MT7628DAN (MIPS 580MHz)
- Flash: 8 MiB Spansion S25FL064K
- RAM: 64 MiB (built-into SoC)
- WLAN: 5 GHz (MT7613AE)
- Ethernet: 1x 10/100 Mbps WAN, 1x 10/100 LAN (MT7628)
- Buttons: 1 Reset button, 2 buttons for display UI (unsupported)
- LEDs: 4x Green (Power, LAN, WAN, WiFi)
- Display: 4 digit 7-segment display driven by an additional
microcontroller (unsupported)
- Serial console: unpopulated header, 57600 8n1 (RX only)
- Power: 12 VDC, 1 A
Installation:
The installation can be done via the recovery HTTP server which is built
into the bootloader. Hold down the reset button while connecting the
device to power and keep holding a bit more than 3 seconds. Connect to
http://192.168.0.100/ and upload sysupgrade.bin file.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The company Zyxel rebranded some years ago.
Currently the casing is according to the old branding even
for newer devices which already use the new branding.
This commit aligns the casing of Zyxel everywhere.
Signed-off-by: Goetz Goerisch <ggoerisch@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15652
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Found with coccinelle:
No need to set .owner here. The core will do it.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16217
Signed-off-by: Robert Marko <robimarko@gmail.com>
Allows removing free_irq. Simpler.
Oddly enough the other switch code already does this.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16050
Signed-off-by: Robert Marko <robimarko@gmail.com>
Hardware:
- SoC: MediaTek MT7628DAN (MIPS 580MHz)
- Flash: 8 MiB Spansion S25FL064K
- RAM: 64 MiB (built-into SoC)
- WLAN: 2.4 GHz (MT7628)
- Ethernet: 1x 10/100 Mbps WAN, 1x 10/100 LAN (MT7628)
- Buttons: 1 Reset button
- LEDs: 1x Red, 1x Green
- Serial console: unpopulated header, 57600 8n1 (RX only)
- Power: 12 VDC, 1 A
There are unpopulated areas on the board for 5 GHz WiFi via PCIe as well
as (most likely) Quectel EG25-G 4G module. As both are not populated on
my board support for both is missing for now.
Installation:
The installation can be done via the recovery HTTP server which is built
into the bootloader. Hold down the reset button while connecting the
device to power and keep holding a bit more than 3 seconds. Connect to
http://192.168.188.253/ and upload sysupgrade.bin file.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The second edition of international version of Mi Router 4A 100M is
very similar to the non-international one, but has another wireless chip.
Installation
--------------
1. Initialize build-in firmware (use webgui for 192.168.31.1)
You should install root password
2. Run OpenWRTInvasion for the first time (probably it will fail)
Version 0.0.10 is working as well as 0.0.1.
3. Run OpenWRTInvasion for the second time
It will create an access to your router
4. Upload sysupgrade image to router (/tmp/fw.bin)
pc# nc -l 8080 < …/ramips/mt76x8/…-100m-intl-v2-squashfs-sysupgrade.bin
router# nc 192.168.31.175 8080 > /tmp/fw.bin
5. Flash new firmware
router# run mtd -r write /tmp/fw.bin OS1
6. Check result
Wait about 5-10 minutes after flash. Router should reboot itself and
turn left led from orange to blue.
In case of failure one can use Xiaomi 4a 100m debrick tool
(it uploads special image via tftpd in recovery mode)
After that you can start again from step 1.
Another actions are very similar to original Mi Router 4A 100M
Original mtd paritions:
-------------------------
```
Creating 9 MTD partitions on "raspi":
0x000000000000-0x000001000000 : "ALL"
0x000000000000-0x000000020000 : "Bootloader"
0x000000020000-0x000000030000 : "Config"
0x000000030000-0x000000040000 : "Factory"
0x000000040000-0x000000050000 : "crash"
0x000000050000-0x000000060000 : "cfg_bak"
0x000000060000-0x000000160000 : "overlay"
0x000000160000-0x000000dc0000 : "OS1"
0x000000dc0000-0x000001000000 : "disk"
with special sub-partition
0x0000002c0000-0x000000dc0000 : "rootfs"
```
We will use OS1+disk space:
```
0x000000160000-0x000001000000 : "firmware"
```
Co-authored-by: Nita Vesa <nita.vesa@elektrik.link>
Signed-off-by: Anton Stratonnikov <billic@yandex.ru>
Link: https://github.com/openwrt/openwrt/pull/14304
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Simplifies the code by removing clk_disable_unprepare.
Also removed gotos and used dev_err_probe.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16133
Signed-off-by: Robert Marko <robimarko@gmail.com>
Use realtek,extif property instead of realtek,extif0 to extif2
by extending it with the cpu_port parameter.
The extif number is automatically calculated based on cpu_port.
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/15749
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Use realtek,extif property instead of realtek,extif0 and realtek,extif1
by extending it with the cpu_port parameter.
The extif number is automatically calculated based on cpu_port.
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/15749
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The hardware of these two models looks the same. This patch also
disabled unused i2c bus for WE3526.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/16009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
From the kernel log, we are using PCIe port 1 and 2.
dmesg:
```
[ 0.963526] mt7621-pci 1e140000.pcie: pcie0 no card, disable it (RST & CLK)
[ 0.970432] mt7621-pci 1e140000.pcie: PCIE1 enabled
[ 0.975312] mt7621-pci 1e140000.pcie: PCIE2 enabled
[ 1.071442] pci 0000:01:00.0: [14c3:7662] type 00 class 0x028000
[ 1.130382] pci 0000:02:00.0: [14c3:7603] type 00 class 0x028000
```
Fixes: https://github.com/openwrt/openwrt/issues/16000
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/16009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for a dual-band AX1800 wall plug manufactured
by Shenzhen Century Xinyang Tech Co., Ltd.
CPU: Mediatek MT7621A (2 cores, 4 threads)
RAM: 256i MiB DDR3 (Samsung K4B2G1646F-BCNB)
ROM: 16 MiB SPI NOR (Winbond W25Q128JVPQ)
Wired: one gigabit RJ45 port (with green/yellow non-GPIO LEDs)
WiFi: Mediatek MT7905DAN + MT7975DN (DBDC 2x 2T2R)
Ant.: four 2 dBi external antennas (two 2.4GHz, two 5 GHz)
GPIO: tri-color status LED (GPIO 13, 14, 16);
reset button (GPIO 18)
Power: 12V 2-pin JST-XH on main PCB
110/220V AC to 12V1A DC on auxiliary PCB
UART: 115200 8n1, SMD pads available on the PCB as J4
pinout is [3v3] (Rx) (Tx) (Gnd)
MAC: 1C:BF:CE:xx:xx:xx (2.4 GHz, label)
1C:BF:CE:xx:xx:xx + 1 (ethernet [1])
1C:BF:CE:xx:xx:xx + 2 (5 GHz)
Original firmware is LEDE Reboot 17.01-SNAPSHOT (kernel 4.4.198)
with a few custom packages and a non-LuCI web interface.
Telnet and SSH are enabled, requiring an unknown root password [2].
Root password is also needed to access the router via UART console,
but passwordless telnet can be enabled via a trivial web exploit [3]
and then the root password can be removed by editing `/etc/shadow`.
Installation: First upload `sysupgrade` binary via web interface at
`http://192.168.188.1/settings.shtml` and wait until getting back to
the home screen (select network to extend). The installation fails
since the original firmware uses `swconfig` and recent versions of
OpenWrt use DSA. However, the sysupgrade file is uploaded correctly
and stored at `/tmp/upgrade.bin`, so it can be written to flash via
the web exploit [4] (both `mtd -r write` and `sysupgrade -Fn` work
fine). Passwordless telnet/ssh is not needed for installation.
Alternatively, use u-boot menu to load image via TFTP.
Notes:
- Device model in LEDE is "MediaTek MT7621 RFB (802.11ax,SNOR)".
- It is sold under several names, among them are Wodesys WD-R1802U,
Fenvi F-AX1802U, and EDUP EP-2971; the Wodesys brand was selected
since it is referenced in `/etc/banner` and `/etc/hosts`, and the
PCB is marked "WD518A V1.0".
- Instead of a standard ethernet transformer, the PCB has a few tiny
SMD coils.
[1] Original firmware sets ethernet MAC to 1C:BF:CE:E7:62:1D based on
offset `0x3fff4` in the Factory partition; since this is the same
MAC for all units, whereas WiFi MACs stored at offsets 0x6 and 0xc
are unique, it was decided to use <label MAC + 1> for ethernet.
[2] root:$1$7rmMiPJj$91iv9LWhfkZE/t7aCBdo.0:18388:0:99999:7:::
[3] curl -X POST http://192.168.188.1/cgi-bin/adm.cgi \
-d page=Lang -d langType="en;killall telnetd;telnetd -l /bin/sh"
[4] curl -X POST http://192.168.188.1/cgi-bin/adm.cgi \
-d page=Lang -d langType="en;mtd -r write /tmp/upgrade.bin firmware"
Signed-off-by: Rani Hod <rani.hod@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15777
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Ubiquiti has a set of UniFi 802.11ax (Wi-Fi 6) AP devices. All models
include "U6" in their names and also have code names with no special
characters (including spaces).
Examples:
1. U6 Lite (codename U6-Lite)
2. U6 Long-Range (codename U6-LR)
3. U6+ (codename U6-PLUS)
4. U6 Pro (codename U6-Pro)
5. U6 Mesh (codename U6-Mesh)
6. U6 Mesh Pro (codename U6-Mesh-Pro)
7. U6 Enterprise (codename U6-Enterprise)
Use proper full names for those devices. Names in OpenWrt/DTS code may
need updating too but it can be handled later.
Cc: Elbert Mai <code@elbertmai.com>
Cc: Daniel Golle <daniel@makrotopia.org>
Cc: Henrik Riomar <henrik.riomar@gmail.com>
Cc: David Bauer <mail@david-bauer.net>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Keenetic KN-3510 is a 2.4/5 Ghz band 11ax access point
Specification:
- System-On-Chip: MT7621AT
- CPU/Speed: 880 MHz
- Flash-Chip: Macronix MX30LF1G28AD-TI
- Flash size: 128 MiB
- RAM: 256 MiB
- 2x 10/100/1000 Mbps Ethernet
- PoE, 802.3af/at
- 4x internal antennas
- UART (J1) header on PCB (115200 8n1)
- WiFi: MT7915 2x2 2.4G 573.5Mbps + 2x2 5G 1201Mbps
- 2x LED, 2x button, 1x mode switch
Notes:
- The device supports dual boot mode
- The firmware partitions were concatinated into one
Flash instruction:
The only way to flash OpenWrt image is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24 and tftp server.
2. Rename "openwrt-ramips-mt7621-keenetic_kn-3510-squashfs-factory.bin"
to "KN-3510_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed until power led start blinking.
4. Router will download file from server, write it to flash and reboot
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15744
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
