aboutsummaryrefslogtreecommitdiffstats
path: root/target/linux/ramips/mt7621
Commit message (Collapse)AuthorAgeFilesLines
* ramips: add support for Renkforce WS-WN530HP3-ABirger Koblitz2022-03-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | This adds support for the Renkforce WS-WN530HP3-A ceiling- mountable Wireless Access Point, which is powered over PoE. Hardware: - SoC: Mediatek MT7621DAT - RAM: 128MiB on SoC - Flash: 16MiB GigaDevice GD25Q128C - 2.4Ghz Wifi: Mediatek MT603EN - 5GHz Wifi: MT613BEN - Ethernet: - 1x 1GBit WAN port, passive PoE capable - 2x 1GBit LAN ports LEDs: 1x Bi-Color LED (red/blue) Buttons: 1x Reset Button, 1x Power Button Installation: Power on the access point and immedately press the reset button for 10 seconds. Connect web-browser to 192.168.10.1 and upload sysupgrade image. Flash uploaded image and wait about 2 minutes for reboot. Signed-off-by: Birger Koblitz <mail@birger-koblitz.de> Signed-off-by: Petr Štetiar <ynezz@true.cz> [fixed SoB]
* ramips: Add support for TP-Link TL-WPA8631P v3Joe Mullally2022-03-062-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | AV1300 Gigabit Passthrough Powerline ac Wi-Fi Extender Specifications -------------- * SoC: MediaTek MT7621AT * CPU: 880 MHz MIPS 1004KEc dual-core CPU * RAM: 64 MiB DDR2 (Zentel A3R12E40DBF-8E) * Flash: 8 MiB SPI NOR (GigaDevice GD25Q64CSIG) * Ethernet: SoC built-in Switch 5x 1GbE * Port 0: PLC (connected through AR8035-A) * Port 1-3: LAN * WLAN: 2x2 2.4GHz 300 Mbps + 2x2 5GHz 867 Mbps (MT7603EN + MT7613BEN) * PLC: HomePlug AV2 (Qualcomm QCA7500) * PLC Flash: 2MiB SPI NOR (GigaDevice GD25Q16CSIG) * Buttons: Reset, LED, Pair, Wi-Fi * LEDs: Power (green), PLC (green/amber), LAN (green), 2.4G (green), 5G (green) * UART: J1 (57600 baud) * Pinout: (3V3) (GND) (RX) (TX) * Visually identify GND from connection to PCB ground plane Installation ------------ Installation is possible from the OEM web interface. Make sure to install the latest OEM firmware first, so that the PLC firmware is at the latest version. However, please first check the OpenWRT Wiki page for confirmation that your OEM firmware version is supported. Signed-off-by: Joe Mullally <jwmullally@gmail.com>
* ramips: support TP-Link EAP615-WallStijn Tintel2022-02-271-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for the TP-Link EAP615-Wall, an AX1800 Wall Plate WiFi 6 AP. The device is very similar to the TP-Link EAP235-Wall. Hardware: * SoC: MediaTek MT7621AT * RAM: 128MiB * Flash: 16MiB SPI-NOR * Ethernet: 4x GbE * Back: ETH0 (PoE-PD) * Bottom: ETH1, ETH2, ETH3 (PoE passthrough) * WiFi: MT7905DAN/MT7975DN 2.4/5 GHz 2T2R * LEDS: 1x white * Buttons: 1x LED, 1x reset Stock firmware uses a random MAC address for ethernet. OpenWrt uses the MAC address that is on the device label for ethernet and the wireless interfaces. MAC address must not be incremented, as this will cause MAC address conflicts in case you have two devices with consecutive MAC addresses. Instead, different locally administered addresses will be generated automatically, based on the MAC on the label. Installation via stock firmware: * Enable SSH in the TP-Link web interface * SSH to the device * Run `cliclientd stopcs` * Upload the OpenWrt factory image via the TP-Link web interface Installation via bootloader: * Solder TTL header. Pinout: 1: TX, 2: RX, 3: GND, 4: VCC, with pin 1 closest to ETH1. Baud rate 115200 * Interrupt boot process by holding a key during boot * Boot the OpenWrt initramfs: # tftpboot 0x84000000 openwrt-ramips-mt7621-tplink_eap615-wall-v1-initramfs-kernel.bin # bootm * Copy openwrt-ramips-mt7621-tplink_eap615-wall-v1-squashfs-sysupgrade.bin to /tmp and use sysupgrade to install it Thanks to Sander Vanheule for his work on the EAP235-Wall, which made adding support for the EAP615-Wall very easy. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Reviewed-by: Sander Vanheule <sander@svanheule.net> Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com>
* ramips: add support for ipTIME A3002MESHYoonji Park2022-02-202-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for ipTIME A3002MESH. Hardware: - SoC: MediaTek MT7621AT (880MHz, Duel-Core) - RAM: DDR3 128MB - Flash: XMC XM25QH128AHIG (SPI-NOR 16MB) - WiFi: MediaTek MT7615D (2.4GHz, 5GHz, DBDC) - Ethernet: MediaTek MT7530 (WAN x1, LAN x2, SoC built-in) - UART: [GND, RX, TX, 3.3V] (57600 8N1, J4) MAC addresses: | interface | MAC | source | comment |-----------|-------------------|----------------|---------- | LAN | 70:XX:XX:5X:XX:X3 | | | WAN | 70:XX:XX:5X:XX:X1 | u-boot 0x1fc40 | | WLAN 2G | 72:XX:XX:4X:XX:X0 | | | WLAN 5G | 70:XX:XX:5X:XX:X0 | factory 0x4 | | | 70:XX:XX:5X:XX:X0 | u-boot 0x1fc20 | unknown | | 70:XX:XX:5X:XX:X2 | factory 0x8004 | unknown - WLAN 2G MAC address is not the same as stock firmware since OpenWrt uses LAN MAC address with local bit sets. Installation: 1. Flash initramfs image. This can be done using stock web ui or TFTP 2. Connect to OpenWrt with an SSH connection to 192.168.1.1 3. Perform sysupgrade with sysupgrade image Revert to stock firmware: - Flash stock firmware via OEM TFTP Recovery mode - Perform sysupgrade with stock image TFTP Recovery method: 1. Unplug the router 2. Hold the reset button and plug in 3. Release when the power LED stops flashing and go off 4. Set your computer IP address manually to 192.168.0.x / 255.255.255.0 5. Flash image with TFTP client to 192.168.0.1 Signed-off-by: Yoonji Park <koreapyj@dcmys.kr> [wrap/rephrase commit message] Signed-off-by: Sungbo Eo <mans0n@gorani.run>
* ramips: update WLAN MAC address of ipTIME A3004TSungbo Eo2022-02-111-0/+6
| | | | | | | | | | | | | | | | Reported MAC addresses: | interface | MAC address | source | comment |-----------|-------------------|----------------|--------- | LAN | 90:xx:xx:18:xx:1F | | [1] | WAN | 90:xx:xx:18:xx:1D | | | WLAN 2G | 92:xx:xx:48:xx:1C | | | WLAN 5G | 90:xx:xx:18:xx:1C | factory 0x4 | | | 90:xx:xx:18:xx:1C | config ethaddr | [1] Used in this patch as WLAN 2G MAC address with the local bit set Signed-off-by: Sungbo Eo <mans0n@gorani.run>
* ramips: add support for ipTIME AX2004MSungbo Eo2022-02-112-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ipTIME AX2004M is an 802.11ax (Wi-Fi 6) router, based on MediaTek MT7621A. Specifications: * SoC: MT7621A * RAM: 256 MiB * Flash: NAND 128 MiB * Wi-Fi: * MT7915D: 2.4/5 GHz (DBDC) * Ethernet: 5x 1GbE * Switch: SoC built-in * USB: 1x 3.0 * UART: J4 (115200 baud) * Pinout: [3V3] (TXD) (RXD) (GND) MAC addresses: | interface | MAC address | source | comment |-----------|-------------------|----------------|--------- | LAN | 58:xx:xx:00:xx:9B | | [1] | WAN | 58:xx:xx:00:xx:99 | | | WLAN 2G | 58:xx:xx:00:xx:98 | factory 0x4 | | WLAN 5G | 5A:xx:xx:40:xx:98 | | | | 58:xx:xx:00:xx:98 | config ethaddr | [1] Used in this patch as WLAN 5G MAC address with the local bit set Load addresses: * stock * 0x80010000: FIT image * 0x81001000: kernel image -> entry * OpenWrt * 0x80010000: FIT image * 0x82000000: uncompressed kernel+relocate image * 0x80001000: relocated kernel image -> entry Notes: * This device has a dual-boot partition scheme, but this firmware works only on boot partition 1. The stock web interface will flash only on the inactive boot partition, but the recovery web page will always flash on boot partition 1. Installation via recovery mode: 1. Press reset button, power up the device, wait >10s for CPU LED to stop blinking. 2. Upload recovery image through the recovery web page at 192.168.0.1. Revert to stock firmware: 1. Install stock image via recovery mode. Signed-off-by: Sungbo Eo <mans0n@gorani.run>
* kernel: backport MediaTek Ethernet PHY driverDENG Qingfang2022-02-091-0/+1
| | | | | | | | | | | | | | Add support for MediaTek Gigabit Ethernet PHYs found in MT7530 and MT7531. Fix some link up/down issues. The errornous check for the PHY mode which broke things with MT7531 has been removed as suggested by patch net: phy: mediatek: remove PHY mode check on MT7531 As a result, things are working fine now on MT7622+MT7531 as well. Signed-off-by: DENG Qingfang <dqfext@gmail.com> Tested-by: Daniel Golle <daniel@makrotopia.org> Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com> Tested-by: Stijn Tintel <stijn@linux-ipv6.be>
* ramips: add support for Xiaomi Mi Router CR660x seriesRaymond Wang2022-02-073-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Xiaomi Mi Router CR6606 is a Wi-Fi6 AX1800 Router with 4 GbE Ports. Alongside the general model, it has three carrier customized models: CR6606 (China Unicom), CR6608 (China Mobile), CR6609 (China Telecom) Specifications: - SoC: MediaTek MT7621AT - RAM: 256MB DDR3 (ESMT M15T2G16128A) - Flash: 128MB NAND (ESMT F59L1G81MB) - Ethernet: 1000Base-T x4 (MT7530 SoC) - WLAN: 2x2 2.4GHz 574Mbps + 2x2 5GHz 1201Mbps (MT7905DAN + MT7975DN) - LEDs: System (Blue, Yellow), Internet (Blue, Yellow) - Buttons: Reset, WPS - UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1) - Power: 12VDC, 1A Jailbreak Notes: 1. Get shell access. 1.1. Get yourself a wireless router that runs OpenWrt already. 1.2. On the OpenWrt router: 1.2.1. Access its console. 1.2.2. Create and edit /usr/lib/lua/luci/controller/admin/xqsystem.lua with the following code (exclude backquotes and line no.): ``` 1 module("luci.controller.admin.xqsystem", package.seeall) 2 3 function index() 4 local page = node("api") 5 page.target = firstchild() 6 page.title = ("") 7 page.order = 100 8 page.index = true 9 page = node("api","xqsystem") 10 page.target = firstchild() 11 page.title = ("") 12 page.order = 100 13 page.index = true 14 entry({"api", "xqsystem", "token"}, call("getToken"), (""), 103, 0x08) 15 end 16 17 local LuciHttp = require("luci.http") 18 19 function getToken() 20 local result = {} 21 result["code"] = 0 22 result["token"] = "; nvram set ssh_en=1; nvram commit; sed -i 's/channel=.*/channel=\"debug\"/g' /etc/init.d/dropbear; /etc/init.d/drop bear start;" 23 LuciHttp.write_json(result) 24 end ``` 1.2.3. Browse http://{OWRT_ADDR}/cgi-bin/luci/api/xqsystem/token It should give you a respond like this: {"code":0,"token":"; nvram set ssh_en=1; nvram commit; ..."} If so, continue; Otherwise, check the file, reboot the rout- er, try again. 1.2.4. Set wireless network interface's IP to 169.254.31.1, turn off DHCP of wireless interface's zone. 1.2.5. Connect to the router wirelessly, manually set your access device's IP to 169.254.31.3, make sure http://169.254.31.1/cgi-bin/luci/api/xqsystem/token still have a similar result as 1.2.3 shows. 1.3. On the Xiaomi CR660x: 1.3.1. Login to the web interface. Your would be directed to a page with URL like this: http://{ROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/web/home#r- outer 1.3.2. Browse this URL with {STOK} from 1.3.1, {WIFI_NAME} {PASSWORD} be your OpenWrt router's SSID and password: http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/misy- stem/extendwifi_connect?ssid={WIFI_NAME}&password={PASSWO- RD} It should return 0. 1.3.3. Browse this URL with {STOK} from 1.3.1: http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/xqsy- stem/oneclick_get_remote_token?username=xxx&password=xxx&- nonce=xxx 1.4. Before rebooting, you can now access your CR660x via SSH. For CR6606, you can calculate your root password by this project: https://github.com/wfjsw/xiaoqiang-root-password, or at https://www.oxygen7.cn/miwifi. The root password for carrier-specific models should be the admi- nistration password or the default login password on the label. It is also feasible to change the root password at the same time by modifying the script from step 1.2.2. You can treat OpenWrt Router however you like from this point as long as you don't mind go through this again if you have to expl- oit it again. If you do have to and left your OpenWrt router unt- ouched, start from 1.3. 2. There's no official binary firmware available, and if you lose the content of your flash, no one except Xiaomi can help you. Dump these partitions in case you need them: "Bootloader" "Nvram" "Bdata" "crash" "crash_log" "firmware" "firmware1" "overlay" "obr" Find the corespond block device from /proc/mtd Read from read-only block device to avoid misoperation. It's recommended to use /tmp/syslogbackup/ as destination, since files would be available at http://{ROUTER_ADDR}/backup/log/YOUR_DUMP Keep an eye on memory usage though. 3. Since UART access is locked ootb, you should get UART access by modify uboot env. Otherwise, your router may become bricked. Excute these in stock firmware shell: a. nvram set boot_wait=on b. nvram set bootdelay=3 c. nvram commit Or in OpenWrt: a. opkg update && opkg install kmod-mtd-rw b. insmod mtd-rw i_want_a_brick=1 c. fw_setenv boot_wait on d. fw_setenv bootdelay 3 e. rmmod mtd-rw Migrate to OpenWrt: 1. Transfer squashfs-firmware.bin to the router. 2. nvram set flag_try_sys1_failed=0 3. nvram set flag_try_sys2_failed=1 4. nvram commit 5. mtd -r write /path/to/image/squashfs-firmware.bin firmware Additional Info: 1. CR660x series routers has a different nand layout compared to other Xiaomi nand devices. 2. This router has a relatively fresh uboot (2018.09) compared to other Xiaomi devices, and it is capable of booting fit image firmware. Unfortunately, no successful attempt of booting OpenWrt fit image were made so far. The cause is still yet to be known. For now, we use legacy image instead. Signed-off-by: Raymond Wang <infiwang@pm.me>
* Revert "kernel: backport MediaTek Ethernet PHY driver"Hauke Mehrtens2022-02-051-1/+0
| | | | | | | | | | | | | | | | | | This reverts commit 8b4cba53a9402f44da2dced4a78ca065b15dca94. This broke the mt7530 on Linksys e8450 (mt7622) for me. [ 1.312943] mt7530 mdio-bus:00 lan1 (uninitialized): failed to connect to PHY: -EINVAL [ 1.320890] mt7530 mdio-bus:00 lan1 (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 0 [ 1.331163] mt7530 mdio-bus:00 lan2 (uninitialized): failed to connect to PHY: -EINVAL [ 1.339085] mt7530 mdio-bus:00 lan2 (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 1 [ 1.349321] mt7530 mdio-bus:00 lan3 (uninitialized): failed to connect to PHY: -EINVAL [ 1.357241] mt7530 mdio-bus:00 lan3 (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 2 [ 1.367452] mt7530 mdio-bus:00 lan4 (uninitialized): failed to connect to PHY: -EINVAL [ 1.375367] mt7530 mdio-bus:00 lan4 (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 3 [ 1.385750] mt7530 mdio-bus:00 wan (uninitialized): failed to connect to PHY: -EINVAL [ 1.393575] mt7530 mdio-bus:00 wan (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 4 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: backport MediaTek Ethernet PHY driverDENG Qingfang2022-02-051-0/+1
| | | | | | | | | Add support for MediaTek Gigabit Ethernet PHYs found in MT7530. Fix some link up/down issues. Signed-off-by: DENG Qingfang <dqfext@gmail.com> Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com> Tested-by: Stijn Tintel <stijn@linux-ipv6.be>
* Revert "ramips: add support for ipTIME AX2004M"Stijn Tintel2022-02-012-7/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit f4a79148f8cb ("ramips: add support for ipTIME AX2004M") seems to leak KERNEL_LOADADDR 0x82000000 to other devices, causing the to no longer boot. The leak is visible in u-boot: Using 'config-1' configuration Trying 'kernel-1' kernel subimage Description: MIPS OpenWrt Linux-5.10.92 Type: Kernel Image Compression: lzma compressed Data Start: 0x840000e4 Data Size: 10750165 Bytes = 10.3 MiB Architecture: MIPS OS: Linux Load Address: 0x82000000 Entry Point: 0x82000000 Normally, it should look like this: Using 'config-1' configuration Trying 'kernel-1' kernel subimage Description: MIPS OpenWrt Linux-5.10.92 Type: Kernel Image Compression: lzma compressed Data Start: 0xbfca00e4 Data Size: 2652547 Bytes = 2.5 MiB Architecture: MIPS OS: Linux Load Address: 0x80001000 Entry Point: 0x80001000 Revert the commit to avoid more people soft-bricking their devices. This reverts commit f4a79148f8cbb7dfbcddfb0c1128caec45a01596. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* ramips: add support for ipTIME AX2004MSungbo Eo2022-01-292-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ipTIME AX2004M is an 802.11ax (Wi-Fi 6) router, based on MediaTek MT7621A. Specification: * SoC: MT7621A * RAM: 256 MiB * Flash: NAND 128 MiB * Wi-Fi: * MT7915D: 2.4/5 GHz (DBDC) * Ethernet: 5x 1GbE * Switch: SoC built-in * USB: 1x 3.0 * UART: J4 (115200 baud) * Pinout: [3V3] (TXD) (RXD) (GND) MAC address: | interface | MAC | source | comment |-----------|-------------------|----------------|--------- | LAN | 58:XX:XX:00:XX:9B | | [1] | WAN | 58:XX:XX:00:XX:99 | | | WLAN 2G | 58:XX:XX:00:XX:98 | factory 0x4 | | WLAN 5G | 5A:XX:XX:40:XX:98 | | | | | | | | 58:XX:XX:00:XX:98 | config ethaddr | [1] Used in this patch as WLAN 5G MAC address with the local bit set Load address: * stock * 0x80010000: FIT image * 0x81001000: kernel image -> entry * OpenWrt * 0x80010000: FIT image * 0x82000000: uncompressed kernel+relocate image * 0x80001000: relocated kernel image -> entry Installation via **recovery** mode: 1. Press reset button, power up the device, wait >10s for CPU LED to stop blinking. 2. Upload recovery image through the recovery web page at 192.168.0.1. Revert to stock firmware: 1. Install stock image via recovery mode. Signed-off-by: Sungbo Eo <mans0n@gorani.run>
* ramips: enable I2C_CHARDEV in mt7621/config-5.10Stijn Tintel2022-01-281-0/+1
| | | | | | | | I2C_CHARDEV used to be enabled in mt7621/config-5.4. Enable it in the 5.10 config, as it's required for PoE control on Unifi Switch Flex. Fixes: b4aad29a1d7a ("ramips: add support for kernel 5.10") Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* ramips: update Tenbay T-MB5EU wireless MAC addressDavid Bauer2022-01-221-2/+1
| | | | | | | | | | | | | | The current MAC address assignment is still incorrect. Use the same MAC address as seen on the stock firmware for both wireless interfaces. The 5GHz MAC address OUI is +2 in the first EUI octet. We currently don't do this in OpenWrt. Ignore this offset for now. With the current assignment, recurring MAC addresses between radios is already taken care of. Signed-off-by: David Bauer <mail@david-bauer.net>
* ramips: enable badblock table support on linksys ea7xxx devicesFelix Fietkau2022-01-131-0/+1
| | | | | | Use remapping only on the kernel partitions. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* mikrotik: enable variable size eraseOskari Lemmela2022-01-131-0/+1
| | | | | | | Add support for variable size erase blocks. Enable it to all targets which has mikrotik targets. Signed-off-by: Oskari Lemmela <oskari@lemmela.net>
* ramips: add support for Linksys EA6350 v4Nick McKinney2022-01-085-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifications: - SoC: MT7621DAT (880MHz, 2 Cores) - RAM: 128 MB - Flash: 128 MB NAND - Ethernet: 5x 1GiE MT7530 - WiFi: MT7603/MT7613 - USB: 1x USB 3.0 This is another MT7621 device, very similar to other Linksys EA7300 series devices. Installation: Upload the generated factory.bin image via the stock web firmware updater. Reverting to factory firmware: Like other EA7300 devices, this device has an A/B router configuration to prevent bricking. Hard-resetting this device three (3) times will put the device in failsafe (default) mode. At this point, flash the OEM image to itself and reboot. This puts the router back into the 'B' image and allows for a firmware upgrade. Troubleshooting: If the firmware will not boot, first restore the factory as described above. This will then allow the factory.bin update to be applied properly. Signed-off-by: Nick McKinney <nick@ndmckinney.net>
* ramips: add support for RAISECOM MSG1500 X.00Liangkuan Yang2022-01-083-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RAISECOM MSG1500 X.00 is a 2.4/5 GHz band 11ac (Wi-Fi 5) router. Apart from the general model, there are two ISP customized models: China Mobile and China Telecom. Specifications: - SoC: Mediatek MT7621AT - RAM: 256MiB DDR3 - Flash: 128MiB NAND - Ethernet: 5 * 10/100/1000Mbps: 4 * LAN + 1 * WAN - Switch: MediaTek MT7530 (SoC) - WLAN: 1 * MT7615DN Dual-Band 2.4GHz 2T2R (400Mbps) 5GHz 2T2R (867Mbps) - USB: 1 * USB 2.0 port - Button: 1 * RESET button, 1 * WPS button, 1 * WIFI button - LED: blue color: POWER, WAN, WPS, 2.4G, 5G, LAN1, LAN2, LAN3, LAN4, USB - UART: 1 * serial port header (4-pin) - Power: DC 12V, 1A - Switch: 1 * POWER switch MAC addresses as verified by vendor firmware: use address source LAN C8:XX:XX:3A:XX:E7 Config "protest_lan_mac" ascii (label) WAN C8:XX:XX:3A:XX:EA Config "protest_wan_mac" ascii 5G C8:XX:XX:3A:XX:E8 Factory "0x4" hex 2.4G CA:XX:XX:4A:XX:E8 [not on flash] The increment of the 4th byte for the 2.4g address appears to vary. Reported cases: 5g 2.4g increment C8:XX:XX:90:XX:C3 CA:XX:XX:C0:XX:C3 0x30 C8:XX:XX:3A:XX:08 CA:XX:XX:4A:XX:08 0x10 C8:XX:XX:3A:XX:E8 CA:XX:XX:4A:XX:E8 0x10 Since increment is inconsistent and there is no obvious pattern in swapping bytes, and the 2.4g address has local bit set anyway, it seems safer to use the LAN address with flipped byte here in order to prevent collisions between OpenWrt devices and OEM devices for this interface. This way we at least use an address as base that is definitely owned by the device at hand. Notes: 1. The vendor firmware allows you to connect to the router by telnet. (known version 1.0.0 can open telnet.) There is no official binary firmware available. Backup the important partitions data: "Bootloader", "Config", "Factory", and "firmware". Note that with the vendor firmware the memory is detected only 128MiB and the last 512KiB in NAND flash is not used. 2. The POWER LED is default on after press POWER switch. The WAN and LAN1 - 4 LEDs are wired to ethernet switch. The WPS LED is controlled by MT7615DN's GPIO. Currently there is no proper way to configure it. 3. At the time of adding support the wireless config needs to be set up by editing the wireless config file: * Setting the country code is mandatory, otherwise the router loses connectivity at the next reboot. This is mandatory and can be done from luci. After setting the country code the router boots correctly. A reset with the reset button will fix the issue and the user has to reconfigure. * This is minor since the 5g interface does not come up online although it is not set as disabled. 2 options here: 1- Either run the "wifi" command. Can be added from LuCI in system - startup - local startup and just add wifi above "exit 0". 2- Or add the serialize option in the wireless config file as shown below. This one would work and bring both interfaces automatically at every boot: config wifi-device 'radio0' option serialize '1' config wifi-device 'radio1' option serialize '1' Flash instructions using initramfs image: 1. Press POWER switch to power down if the router is running. 2. Connect PC to one of LAN ports, and set static IP address to "10.10.10.2", netmask to "255.255.255.0", and gateway to "10.10.10.1" manually on the PC. 3. Push and hold the WIFI button, and then power up the router. After about 10s (or you can call the recovery page, see "4" below) you can release the WIFI button. There is no clear indication when the router is entering or has entered into "RAISECOM Router Recovery Mode". 4. Call the recovery page for the router at "http://10.10.10.1". Keep an eye on the "WARNING!! tip" of the recovery page. Click "Choose File" to select initramfs image, then click "Upload". 5. If image is uploaded successfully, you will see the page display "Device is upgrading the firmware... %". Keep an eye on the "WARNING!! tip" of the recovery page. When the page display "Upgrade Successfully", you can set IP address as "automatically obtain". 6. After the rebooting (PC should automatically obtain an IP address), open the SSH connection, then download the sysupgrade image to the router and perform sysupgrade with it. Flash back to vendor firmware: See "Flash instructions 1 - 5" above. The only difference is that in step 4 you should select the vendor firmware which you backup. Signed-off-by: Liangkuan Yang <ylk951207@gmail.com>
* ramips: add support for ipTIME T5004Sungbo Eo2022-01-022-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | ipTIME T5004 is a 5-port Gigabit Ethernet router, based on MediaTek MT7621A. Specifications: * SoC: MT7621AT * RAM: 128 MiB * Flash: NAND 128 MiB * Ethernet: 5x 1GbE * Switch: SoC built-in * UART: J4 (57600 baud) * Pinout: [3V3] (TXD) (RXD) (GND) Installation via web interface: 1. Flash **initramfs** image through the stock web interface. 2. Boot into OpenWrt and perform sysupgrade with sysupgrade image. Revert to stock firmware via recovery mode: 1. Press reset button, power up the device, wait >15s for CPU LED to stop blinking. 2. Upload stock image to TFTP server at 192.168.0.1. Signed-off-by: Sungbo Eo <mans0n@gorani.run>
* ramips: add support for ipTIME A3004TWonJung Kim2021-12-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ipTIME A3004T is a 2.4/5GHz band router, based on Mediatek MT7621. Specifications: - SoC: MT7621 (880MHz) - RAM: DDR3 256M - Flash: NAND 128MB (Macronix NAND 128MiB 3,3V 8-bit) - WiFi: - 2.4GHz: MT7615E - 5GHz : MT7615E - Ethernet: - 4x LAN - 1x WAN - USB: 1 * USB3.0 port - UART: - 3.3V, TX, RX, GND / 57600 8N1 Installation via web interface: 1. Flash initramfs image using OEM's Recovery mode 2. Boot into OpenWrt and perform sysupgrade with sysupgrade image. Revert to stock firmware: - Flash stock firmware via OEM's Recovery mode How to use OEM's Recovery mode: 1. Power up with holding down the reset key until CPU LED stop blinking. 2. Set fixed ip with `192.168.0.2` with subnet mask `255.255.255.0` 3. Flash image via tftp to `192.168.0.1` Additional Notes: This router shares one MT7915E chip for both 2.4Ghz/5Ghz. radio0 will not working on 5Ghz as it's not connected to the antenna. Signed-off-by: WonJung Kim <git@won-jung.kim> (added led dt-bindings) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* kernel: 5.10: consolidate mac80211 crypto optionsSergey Ryazanov2021-12-171-6/+0
| | | | | | | | | | | | | | | | | | | | | | Each of - CRYPTO_AEAD2 - CRYPTO_AEAD - CRYPTO_GF128MUL - CRYPTO_GHASH - CRYPTO_HASH2 - CRYPTO_HASH - CRYPTO_MANAGER2 - CRYPTO_MANAGER - CRYPTO_NULL2 either directly required for mac80211 crypto support, or directly selected by such options. Support for the mac80211 crypto was enabled in the generic config since c7182123b9 ("kernel: make cryptoapi support needed by mac80211 built-in"). So move the above options from the target configs to the generic config to make it clear why do we need them. CC: Felix Fietkau <nbd@nbd.name> Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
* kernel: filter out both Clang and LLD versionsSergey Ryazanov2021-12-171-1/+0
| | | | | | | | Both CLANG_VERSION and LLD_VERISON are autogenerated runtime configuration options, so add them to the kernel configuration filter and remove from generic and per-target configs to keep configs clean. Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
* ramips: remove Linux 5.4 supportRui Salvaterra2021-12-151-282/+0
| | | | | | We're at 5.10 stable, this can finally go. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* ramips: fix Tenbay T-MB5EU v1 Wireless MACDavid Bauer2021-12-151-0/+5
| | | | | | | | | | | | | It was reported, that Tenbay T-MB5EU v1 do have incorrect Wireless MAC address set on 2.4 and 5 GHz. Some boards do not seem to have the correct MAC address set for the external PHY of the MT7915 radio at caldata offset 0xa. As the external PHY does not expose a DT binding (yet), fix up the mac address in userspace. Signed-off-by: David Bauer <mail@david-bauer.net>
* ramips: add support for HUMAX E10Kyoungkyu Park2021-12-121-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | HUMAX E10 (also known as HUMAX QUANTUM E10) is a 2.4/5GHz band AC router, based on MediaTek MT7621A. Specifications: - SoC: MT7621A - RAM: DDR3 128MB - Flash: SPI NOR 16MB (MXIC MX25L12805D) - WiFi: - 2.4GHz: MT7615 - 5GHz: MT7615 - Ethernet: 2x 10/100/1000Mbps - Switch: SoC internal - USB: 1x USB 2.0 Type-A - UART: J1 (57600 8N1) - pinout: [3V3] (RXD) (GND) (TXD) Installation via web interface: - Flash **factory** image through the stock web interface. Recovery procedure: 1. Connect ethernet cable between Router **LAN** port and PC Ethernet port. 2. Set your computer to a static IP **192.168.1.1** 3. Turn the device off and wait a few seconds. Hold the WPS button on front of device and insert power. 4. Send a firmware image to **192.168.1.6** using TFTP. You can use any TFTP client. (tftp, curl, Tftpd64...) - It can accept both images which is HUMAX stock firmware dump (0x70000-0x1000000) image and OpenWRT **sysupgrade** image. Signed-off-by: Kyoungkyu Park <choryu.park@choryu.space> [remove trailing whitespace] Signed-off-by: Sungbo Eo <mans0n@gorani.run>
* ramips: add support for Netgear R7450Dale Hui2021-09-262-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | Netgear R7450 is a clone of Netgear R6700v2 Specifications ============== SoC: MediaTek MT7621AT RAM: 256M DDR3 FLASH: 128M NAND WiFi: MediaTek MT7615N an+ac MediaTek MT7615N bgn ETH: MediaTek MT7621AT BTN: 1x Connect (WPS), 1x WLAN, 1x Reset LED: Power (white/amber), WAN(white/amber), 2.4G(white), 5G(white), USB(white) , GuestWifi(white) 4x LAN(white/amber), Wifi Button(white), WPS Button(white) Flash Instructions ================== Login to netgear webinterface and flash factory.img Signed-off-by: Dale Hui <strokes-races0b@icloud.com> [fix model/compatible in DTS] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ramips: add support for Netgear R6900v2Dale Hui2021-09-262-0/+2
| | | | | | | | | | | | | | | | | | | | | | | Netgear R6900v2 is a clone of Netgear R6700v2 Specifications ============== SoC: MediaTek MT7621AT RAM: 256M DDR3 FLASH: 128M NAND WiFi: MediaTek MT7615N an+ac MediaTek MT7615N bgn ETH: MediaTek MT7621AT BTN: 1x Connect (WPS), 1x WLAN, 1x Reset LED: Power (white/amber), WAN(white/amber), 2.4G(white), 5G(white), USB(white) , GuestWifi(white) 4x LAN(white/amber), Wifi Button(white), WPS Button(white) Flash Instructions ================== Login to netgear webinterface and flash factory.img Signed-off-by: Dale Hui <strokes-races0b@icloud.com>
* ramips: make Netgear R7200 a separate device from R6700v2Dale Hui2021-09-262-1/+3
| | | | | | | | | With the various variants of Netgear R**** devices, make it more obvious which image should be used for the R7200. Signed-off-by: Dale Hui <strokes-races0b@icloud.com> [provide proper commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ramips: enable I2C_CHARDEVDavid Bauer2021-09-251-0/+1
| | | | | | | Expose I2C busses with a chardev device. This is required to control the PSE controller on the Ubiquiti UniFi Flex Switch. Signed-off-by: David Bauer <mail@david-bauer.net>
* ramips: add support for Ubiquiti USW-FlexDavid Bauer2021-09-251-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware -------- MediaTek MT7621AT 16M SPI-NOR Macronix MX25L12835FMI Microchip PD69104B1 4-Channel PoE-PSE controller TI TPS2373 PoE-PD controller PoE-Controller -------------- By default, the PoE outputs do not work with OpenWrt. To make them output power, install the "poemgr" package from the packages feed. This package can control the PD69104B1 PSE controller. Installation ------------ 1. Connect to the booted device at 192.168.1.20 using username/password "ubnt" via SSH. 2. Add the uboot-envtools configuration file /etc/fw_env.config with the following content $ echo "/dev/mtd1 0x0 0x1000 0x10000 1" > /etc/fw_env.config 3. Update the bootloader environment. $ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr); fdt rm /signature; bootubnt" $ fw_setenv bootcmd "run boot_openwrt" 4. Transfer the OpenWrt sysupgrade image to the device using SCP. 5. Check the mtd partition number for bs / kernel0 / kernel1 $ cat /proc/mtd 6. Set the bootselect flag to boot from kernel0 $ dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock4 7. Write the OpenWrt sysupgrade image to both kernel0 as well as kernel1 $ dd if=openwrt.bin of=/dev/mtdblock6 $ dd if=openwrt.bin of=/dev/mtdblock7 8. Reboot the device. It should boot into OpenWrt. Restore to UniFi ---------------- To restore the vendor firmware, follow the Ubiquiti UniFi TFTP recovery guide for access points. The process is the same for the Flex switch. Signed-off-by: David Bauer <mail@david-bauer.net>
* ramips: add support for I-O DATA WN-DX2033GRINAGAKI Hiroshi2021-09-251-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I-O DATA WN-DX2033GR is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on MT7621A. Specification: - SoC : MediaTek MT7621A - RAM : DDR3 128 MiB - Flash : Raw NAND 128 MiB (Macronix MX30LF1G18AC-TI) - WLAN : 2.4/5 GHz - 2.4 GHz : 2T2R, MediaTek MT7603E - 5 GHz : 4T4R, MediaTek MT7615 - Ethernet : 5x 10/100/1000 Mbps - Switch : MediaTek MT7530 (SoC) - LEDs/Keys : 2x/3x (2x buttons, 1x slide-switch) - UART : through-hole on PCB - J5: 3.3V, TX, RX, NC, GND from triangle mark - 57600n8 - Power : 12 VDC, 1 A Flash instruction using initramfs image: 1. Boot WN-DX2033GR normally 2. Access to "http://192.168.0.1/" and open firmware update page ("ファームウェア") 3. Select the OpenWrt initramfs image and click update ("更新") button to perform firmware update 4. On the initramfs image, download the sysupgrade.bin image to the device and perform sysupgrade with it 5. Wait ~120 seconds to complete flashing Notes: - The hardware of WN-DX2033GR and WN-AX2033GR are almost the same, and it is certified under the same radio-wave related regulations in Japan - The last 0x80000 (512 KiB) in NAND flash is not used on stock firmware - stock firmware requires "customized uImage header" (called as "combo image") by MSTC (MitraStar Technology Corp.), but U-Boot doesn't - uImage magic ( 0x0 - 0x3 ) : 0x434F4D42 ("COMB") - header crc32 ( 0x4 - 0x7 ) : with "data length" and "data crc32" - image name (0x20 - 0x37) : model ID and firmware versions - data length (0x38 - 0x3b) : kernel + rootfs - data crc32 (0x3c - 0x3f) : kernel + rootfs - There are 2x important flags in the flash: - bootnum : select os partition for booting (persist, 0x4) - 0x01: firmware - 0x02: firmware_2 - debugflag : allow interrupt kernel loader, it's named as "Z-LOADER" (Factory, 0xFE75) - 0x00: disable debug - 0x01: enable debug MAC addresses: LAN : 50:41:B9:xx:xx:90 (Factory, 0xE000 (hex) / Ubootenv, ethaddr (text)) WAN : 50:41:B9:xx:xx:92 (Factory, 0xE006 (hex)) 2.4 GHz : 50:41:B9:xx:xx:90 (Factory, 0x4 (hex)) 5 GHz : 50:41:B9:xx:xx:91 (Factory, 0x8004 (hex)) Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
* kernel: move two symbols to the generic kconfigsRui Salvaterra2021-08-292-4/+0
| | | | | | | CONFIG_RCU_{NEED_SEGCBLIST,STALL_COMMON} are set basically everywhere. Move them to the generic kconfigs. And resort the generic kconfigs while at it. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* ramips: mt7621: remove bring up DSA master init scriptDENG Qingfang2021-07-231-20/+0
| | | | | | | With commit 2e17c710954b, there is no need to bring up DSA master port manually. Signed-off-by: DENG Qingfang <dqfext@gmail.com>
* ramips: fix missing NVMEM subsystemDavid Bauer2021-07-212-0/+2
| | | | | | | | | | | | MAC address retrieval was switched to more generic upstream (5.13) NVMEM based solution in commit 06bb4a5018cd ("ramips: convert mtd-mac-address to nvmem implementation") , but NVMEM subsystem wasn't enabled in the kernel, so fix it now. References: https://github.com/openwrt/openwrt/pull/4041#issuecomment-883322801 Fixes: 06bb4a5018cd ("ramips: convert mtd-mac-address to nvmem implementation") Signed-off-by: David Bauer <mail@david-bauer.net> Signed-off-by: Petr Štetiar <ynezz@true.cz> [commit message]
* ramips: fix Wifi MAC address setup for D-Link DIR-853 R1Adrian Schmutzler2021-07-121-3/+3
| | | | | | | | Commands in 10_fix_wifi_mac were not properly concatenated, so this was also triggered for the second phy without giving a MAC address as argument. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ramips: add support for D-Link DIR-853 A3Karim Dehouche2021-07-123-3/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifications: * SoC: MT7621AT * RAM: 256MB * Flash: 128MB NAND flash * WiFi: MT7615DN (2.4GHz+5Ghz) with DBDC * LAN: 5x1000M * Firmware layout is Uboot with extra 96 bytes in header * Base PCB is DIR-1360 REV1.0 * LEDs Power Blue+Orange,Wan Blue+Orange,WPS Blue,"2.4G"Blue, "5G" Blue, USB Blue * Buttons Reset,WPS, Wifi MAC addresses on OEM firmware: lan factory 0xe000 f4:*:*:a8:*:65 (label) wan factory 0xe006 f4:*:*:a8:*:68 2.4 GHz [not on flash] f6:*:*:c8:*:66 5.0 GHz factory 0x4 f4:*:*:a8:*:66 The increment of the 4th byte for the 2.4g address appears to vary. Reported cases: 5g 2.4g increment f4:XX:XX:a8:XX:66 f6:XX:XX:c8:XX:66 +0x20 x0:xx:xx:68:xx:xx x2:xx:xx:48:xx:xx -0x20 x4:xx:xx:6a:xx:xx x6:xx:xx:4a:xx:xx -0x20 Since increment is inconsistent and there is no obvious pattern in swapping bytes, and the 2.4g address has local bit set anyway, it seems safer to use the LAN address with flipped byte here in order to prevent collisions between OpenWrt devices and OEM devices for this interface. This way we at least use an address as base that is definitely owned by the device at hand. Flashing instruction: The Dlink "Emergency Room" cannot be accessed through the reset button on this device. You can either use console or use the encrypted factory image availble in the openwrt forum. Once the encrypted image is flashed throuh the stock Dlink web interface, the sysupgrade images can be used. Header pins needs to be soldered near the WPS and Wifi buttons. The layout for the pins is (VCC,RX,TX,GND). No need to connect the VCC. the settings are: Bps/Par/Bits : 57600 8N1 Hardware Flow Control : No Software Flow Control : No Connect your client computer to LAN1 of the device Set your client IP address manually to 192.168.0.101 / 255.255.255.0. Call the recovery page or tftp for the device at http://192.168.0.1 Use the provided emergency web GUI to upload and flash a new firmware to the device At the time of adding support the wireless config needs to be set up by editing the wireless config file: * Setting the country code is mandatory, otherwise the router loses connectivity at the next reboot. This is mandatory and can be done from luci. After setting the country code the router boots correctly. A reset with the reset button will fix the issue and the user has to reconfigure. * This is minor since the 5g interface does not come up online although it is not set as disabled. 2 options here: 1- Either run the "wifi" command. Can be added from LUCI in system - startup - local startup and just add wifi above "exit 0". 2- Or add the serialize option in the wireless config file as shown below. This one would work and bring both interfaces automatically at every boot: config wifi-device 'radio0' option serialize '1' config wifi-device 'radio1' option serialize '1' Signed-off-by: Karim Dehouche <karimdplay@gmail.com> [rebase, improve MAC table, update wireless config comment, fix 2.4g macaddr setup] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ramips: add support for Linksys EA8100 v2Tee Hao Wei2021-07-115-4/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifications: - SoC: MT7621AT - RAM: 256MB - Flash: 128MB NAND - Ethernet: 5 Gigabit ports - WiFi: 2.4G/5G MT7615N - USB: 1 USB 3.0, 1 USB 2.0 This device is very similar to the EA7300 v1/v2, EA7500 v2, and EA8100 v1. Installation: Upload the generated factory image through the factory web interface. (following part taken from EA7300 v2 commit message:) This might fail due to the A/B nature of this device. When flashing, OEM firmware writes over the non-booted partition. If booted from 'A', flashing over 'B' won't work. To get around this, you should flash the OEM image over itself. This will then boot the router from 'B' and allow you to flash OpenWRT without problems. Reverting to factory firmware: Hard-reset the router three times to force it to boot from 'B.' This is where the stock firmware resides. To remove any traces of OpenWRT from your router simply flash the OEM image at this point. With thanks to Tom Wizetek (@wizetek) for testing. Signed-off-by: Tee Hao Wei <angelsl@in04.sg>
* ramips: add support for D-Link DIR-853-R1Stas Fiduchi2021-07-102-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR adds support for router D-Link DIR-853-R1 Specifications: SoC: MT7621AT RAM: 128MB Flash: 16MB SPI WiFi: MT7615DN (2.4GHz+5Ghz) with DBDC (This mode allows this single chip act as an 2x2 11n radio and an 2x2 11ac radio at the same time) LAN: 5x1000M LEDs Power Blue+Orange,Wan Blue+Orange,WPS Blue,"2.4G"Blue, "5G" Blue USB Blue Buttons Reset,WPS, Wifi MAC addresses: |Interface | MAC | Factory |Comment |------------|-----------------|-------------|---------------- |WAN sticker |C4:XX:XX:6E:XX:2A| |Sticker |LAN |C4:XX:XX:6E:XX:2B| | |Wifi (5g) |C4:XX:XX:6E:XX:2C|0x4 | |Wifi (2.4g) |C6:XX:XX:7E:XX:2C| | | | | | | |C4:XX:XX:6E:XX:2E|0x8004 0xe000| | |C4:XX:XX:6E:XX:2F|0xe006 | The increment of the 4th byte for the 2.4g address appears to vary. Reported cases: 5g 2.4g increment C4:XX:XX:6E:XX:2C C6:XX:XX:7E:XX:2C 0x10 f4:XX:XX:16:XX:32 f6:XX:XX:36:XX:32 0x20 F4:XX:XX:A6:XX:E3 F6:XX:XX:B6:XX:E3 0x10 Since increment is inconsistent and there is no obvious pattern in swapping bytes, and the 2.4g address has local bit set anyway, it seems safer to use the LAN address with flipped byte here in order to prevent collisions between OpenWrt devices and OEM devices for this interface. This way we at least use an address as base that is definitely owned by the device at hand. Flashing instruction: The Dlink "Emergency Room" Connect your client computer to LAN1 of the device Set your client IP address manually to 192.168.0.101 / 255.255.255.0. Then, power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the internet LED stops flashing Call the recovery page or tftp for the device at http://192.168.0.1 Use the provided emergency web GUI to upload and flash a new firmware to the device. Signed-off-by: Stas Fiduchi <fiduchi@protonmail.com> [commit title/message improvements, use correct label MAC address, calculate MAC addresses based on 0x4, minor DTS style fixes, add uart2 to state_default, remove factory image, add 2.4g MAC address, use partition DTSI, add macaddr comment in DTS] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ramips: add support for Tenbay T-MB5EU-V01David Bauer2021-06-272-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware -------- MediaTek MT7621 SoC 256M DDR3 16MB BoHong SPI-NOR MediaTek MT7905+7975 2x2T2R DBDC bgnax / acax RGB LED WPS + RESET Button UART on compute module (silkscreened / 115200n8) The router itself is just a board with Power / USB / RJ-45 connectors and DC/DC converters. The SoC and WiFi components are on a daughterboard which connect using two M.2 connectors. The compute module has the model number "T-CB1800K-DM2 V02" printed on it. The main baord has "T-MB5EU V01" printed on it. This information might be useful, as it's highly likely either of these two will be reused in similar designs. The router itself is sold as Tenbay T-MB5EU directly from the OEM as well as "KuWFI AX1800 Smart WiFi 6 Eouter" on Amazon.de for ~50€ in a slightly different case. Installation ------------ A Tool for creating a factory image for the Vendor Web Interface can be found here: https://github.com/blocktrron/t-mb5eu-v01-factory-creator/ As the OEM Firmware is just a modified LEDE 17.01, you can also access failsafe mode via UART while the OS boots, by connecting to UART and pressing "f" when prompted. The Router is reachable at 192.168.1.1 via root without password. Transfer the OpenWrt sysupgrade image via scp and apply with sysupgrade using the -n and -F flags. Alternatively, the board can be flashed by attaching to the UART console, interrupting the boot process by keeping "0" pressed while attaching power. Serve the OpenWrt initramfs using a TFTP server with address 192.168.1.66. Rename the initramfs to ax1800.bin. Attach your TFTP server to one of the LAN ports. Execute the following commands. $ setenv ipaddr 192.168.1.67 $ setenv serverip 192.168.1.66 $ tftpboot 0x84000000 ax1800.bin $ bootm Wait for the device to boot. Then transfer the OpenWrt sysupgrade image to the device using SCP and apply sysupgrade. Signed-off-by: David Bauer <mail@david-bauer.net>
* ramips: add AW9523 I2C GPIO expander driverDavid Bauer2021-06-272-0/+2
| | | | | | | | | | | | | | This adds a driver for the AW9523 I2C GPIO expander. This driver is required to make LEDs as well as buttons on the Tenbay T-MB5EU-V01 work. This driver already had several upstream iterations. I'm working to push this driver to mainline. Ref: https://patchwork.ozlabs.org/project/linux-gpio/list/?series=226287 Signed-off-by: David Bauer <mail@david-bauer.net>
* ramips: add support for TP-Link Archer C6 v3Amish Vishwakarma2021-06-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The patch adds support for the TP-Link Archer C6 v3 (FCC ID TE7A6V3) The patch adds identification changes to the existing TP-Link Archer A6, by Vinay Patil <post2vinay@gmail.com>, which has identical hardware. Specification ------------- MediaTek MT7621 SOC RAM: 128MB DDR3 SPI Flash: W25Q128 (16MB) Ethernet: MT7530 5x 1000Base-T WiFi 5GHz: Mediatek MT7613BE WiFi 2.4GHz: Mediatek MT7603E UART/Serial: 115200 8n1 Device Configuration & Serial Port Pins --------------------------------------- ETH Ports: LAN4 LAN3 LAN2 LAN1 WAN _______________________ | | Serial Pins: | VCC GND TXD RXD | |_____________________| LEDs: Power Wifi2G Wifi5G LAN WAN Build Output ------------ The build will generate following set of files [1] openwrt-ramips-mt7621-tplink_archer-c6-v3-initramfs-kernel.bin [2] openwrt-ramips-mt7621-tplink_archer-c6-v3-squashfs-factory.bin [3] openwrt-ramips-mt7621-tplink_archer-c6-v3-squashfs-sysupgrade.bin How to Use - Flashing from TP-Link Web Interface ------------------------------------------------ * Go to "Advanced/System Tools/Firmware Update". * Click "Browse" and upload the OpenWrt factory image: factory.bin[2] * Click the "Upgrade" button, and select "Yes" when prompted. TFTP Booting ------------ Setup a TFTP boot server with address 192.168.0.5. While starting U-boot press '4' key to stop autoboot. Copy the initramfs-kernel.bin[1] to TFTP server folder, rename as test.bin From u-boot command prompt run tftpboot followed by bootm. Recovery -------- Archer A6 V3 has recovery page activated if SPI booting from flash fails. Recovery page can be activated by powercycling the router four times before the boot process is complete. Note: TFTP boot can be activated only from u-boot serial console. Device recovery address: 192.168.0.1 Signed-off-by: Amish Vishwakarma <vishwakarma.amish@gmail.com> [fix indent] Signed-off-by: David Bauer <mail@david-bauer.net>
* ramips: Add support for SERCOMM NA502Andreas Böhler2021-06-062-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The SERCOMM NA502 is a smart home gateway manufactured by SERCOMM and sold under different brands (among others, A1 Telekom Austria SmartHome Gateway). It has multi-protocol radio support in addition to LAN and WiFi. Note: BLE is currently unsupported. Specifications -------------- - MT7621ST 880MHz, Single-Core, Dual-Thread - MT7603EN 2.4GHz WiFi - MT7662EN 5GHz WiFi + BLE - 128MiB NAND - 256MiB DDR3 RAM - SD3503 ZWave Controller - EM357 Zigbee Coordinator MAC address assignment ---------------------- LAN MAC is read from the config partition, WiFi 2.4GHz is LAN+2 and matches the OEM firmware. WiFi 5GHz with LAN+1 is an educated guess since the OEM firmware does not enable 5GHz WiFi. Installation ------------ Attach serial console, then boot the initramfs image via TFTP. Once inside OpenWrt, run sysupgrade -n with the sysupgrade file. Attention: The device has a dual-firmware design. We overwrite kernel2, since kernel1 contains an automatic recovery image. If you get NAND ECC errors and are stuck with bad eraseblocks, try to erase the mtd partition first with mtd unlock ubi mtd erase ubi This should only be needed once. Signed-off-by: Andreas Böhler <dev@aboehler.at> [use kiB for IMAGE_SIZE] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ramips: add support for Linksys EA8100 v1Tee Hao Wei2021-06-055-4/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifications: - SoC: MT7621AT - RAM: 256MB - Flash: 128MB NAND - Ethernet: 5 Gigabit ports - WiFi: 2.4G/5G MT7615N - USB: 1 USB 3.0, 1 USB 2.0 This device is very similar to the EA7300 v1/v2 and EA7500 v2. Installation: Upload the generated factory image through the factory web interface. (following part taken from EA7300 v2 commit message:) This might fail due to the A/B nature of this device. When flashing, OEM firmware writes over the non-booted partition. If booted from 'A', flashing over 'B' won't work. To get around this, you should flash the OEM image over itself. This will then boot the router from 'B' and allow you to flash OpenWRT without problems. Reverting to factory firmware: Hard-reset the router three times to force it to boot from 'B.' This is where the stock firmware resides. To remove any traces of OpenWRT from your router simply flash the OEM image at this point. With thanks to Leon Poon (@LeonPoon) for the initial bringup. Signed-off-by: Tee Hao Wei <angelsl@in04.sg> [add missing entry in 10_fix_wifi_mac] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ramips: add support for Amped Wireless ALLY router and extenderJonathan Sturges2021-06-052-15/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Amped Wireless ALLY is a whole-home WiFi kit, with a router (model ALLY-R1900K) and an Extender (model ALLY-00X19K). Both are devices are 11ac and based on MediaTek MT7621AT and MT7615N chips. The units are nearly identical, except the Extender lacks a USB port and has a single Ethernet port. Specification: - SoC: MediaTek MT7621AT (2C/4T) @ 880MHz - RAM: 128MB DDR3 (Nanya NT5CC64M16GP-DI) - FLASH: 128MB NAND (Winbond W29N01GVSIAA) - WiFi: 2.4/5 GHz 4T4R - 2.4GHz MediaTek MT7615N bgn - 5GHz MediaTek MT7615N nac - Switch: SoC integrated Gigabit Switch - USB: 1x USB3 (Router only) - BTN: Reset, WPS - LED: single RGB - UART: through-hole on PCB. J1: pin1 (square pad, towards rear)=3.3V, pin2=RX, pin3=GND, pin4=TX. Settings: 57600/8N1. Note regarding dual system partitions ------------------------------------- The vendor firmware and boot loader use a dual partition scheme. The boot partition is decided by the bootImage U-boot environment variable: 0 for the 1st partition, 1 for the 2nd. OpenWrt does not support this scheme and will always use the first OS partition. It will set bootImage to 0 during installation, making sure the first partition is selected by the boot loader. Also, because we can't be sure which partition is active to begin with, a 2-step flash process is used. We first flash an initramfs image, then follow with a regular sysupgrade. Installation: Router (ALLY-R1900K) 1) Install the flashable initramfs image via the OEM web-interface. (Alternatively, you can use the TFTP recovery method below.) You can use WiFi or Ethernet. The direct URL is: http://192.168.3.1/07_06_00_firmware.html a. No login is needed, and you'll be in their setup wizard. b. You might get a warning about not being connected to the Internet. c. Towards the bottom of the page will be a section entitled "Or Manually Upgrade Firmware from a File:" where you can manually choose and upload a firmware file. d: Click "Choose File", select the OpenWRT "initramfs" image and click "Upload." 2) The Router will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 3) Log into LuCI as root; there is no password. 4) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 5) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Extender (ALLY-00X19K) 1) This device requires a TFTP recovery procedure to do an initial load of OpenWRT. Start by configuring a computer as a TFTP client: a. Install a TFTP client (server not necessary) b. Configure an Ethernet interface to 192.168.1.x/24; don't use .1 or .6 c. Connect the Ethernet to the sole Ethernet port on the X19K. 2) Put the ALLY Extender in TFTP recovery mode. a. Do this by pressing and holding the reset button on the bottom while connecting the power. b. As soon as the LED lights up green (roughly 2-3 seconds), release the button. 3) Start the TFTP transfer of the Initramfs image from your setup machine. For example, from Linux: tftp -v -m binary 192.168.1.6 69 -c put initramfs.bin 4) The Extender will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 5) Log into LuCI as root; there is no password. 6) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 7) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Backup the OEM Firmware: ----------------------- There isn't any downloadable firmware for the ALLY devices on the Amped Wireless web site. Reverting back to the OEM firmware is not possible unless we have a backup of the original OEM firmware. The OEM firmware may be stored on either /dev/mtd3 ("firmware") or /dev/mtd6 ("oem"). We can't be sure which was overwritten with the initramfs image, so backup both partitions to be safe. 1) Once logged into LuCI, navigate to System -> Backup/Flash Firmware. 2) Under "Save mtdblock contents," first select "firmware" and click "Save mtdblock" to download the image. 3) Repeat the process, but select "oem" from the pull-down menu. Revert to the OEM Firmware: -------------------------- * U-boot TFTP: Follow the TFTP recovery steps for the Extender, and use the backup image. * OpenWrt "Flash Firmware" interface: Upload the backup image and select "Force update" before continuing. Signed-off-by: Jonathan Sturges <jsturges@redhat.com>
* ramips: add support for Linksys E5600Aashish Kulkarni2021-06-055-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This submission relied heavily on the work of Linksys EA7300 v1/ v2. Specifications: * SoC: MediaTek MT7621A (880 MHz 2c/4t) * RAM: 128M DDR3-1600 * Flash: 128M NAND * Eth: MediaTek MT7621A (10/100/1000 Mbps x5) * Radio: MT7603E/MT7613BE (2.4 GHz & 5 GHz) * Antennae: 2 internal fixed in the casing and 2 on the PCB * LEDs: Blue (x4 Ethernet) Blue+Orange (x2 Power + WPS and Internet) * Buttons: Reset (x1) WPS (x1) Installation: Flash factory image through GUI. This device has 2 partitions for the firmware called firmware and alt_firmware. To successfully flash and boot the device, the device should have been running from alt_firmware partition. To get the device booted through alt_firmware partition, download the OEM firmware from Linksys website and upgrade the firmware from web GUI. Once this is done, flash the OpenWrt Factory firmware from web GUI. Reverting to factory firmware: 1. Boot to 'alt_firmware'(where stock firmware resides) by doing one of the following: Press the "wps" button as soon as power LED turns on when booting. (OR) Hard-reset the router consecutively three times to force it to boot from 'alt_firmware'. 2. To remove any traces of OpenWRT from your router simply flash the OEM image at this point. Signed-off-by: Aashish Kulkarni <aashishkul@gmail.com> [fix hanging indents and wrap to 74 characters per line, add kmod-mt7663-firmware-sta package for 5GHz STA mode to work, remove sysupgrade.bin and concatenate IMAGES instead in mt7621.mk, set default-state "on" for power LED] Signed-off-by: Sannihith Kinnera <digislayer@protonmail.com> [move check-size before append-metadata, remove trailing whitespace] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ramips: add support for JCG Q20Chukun Pan2021-05-263-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | JCG Q20 is an AX 1800M router. Hardware specs: SoC: MediaTek MT7621AT Flash: Winbond W29N01HV 128 MiB RAM: Winbond W632GU6NB-11 256 MiB WiFi: MT7915 2.4/5 GHz 2T2R Ethernet: 10/100/1000 Mbps x3 LED: Status (red / blue) Button: Reset, WPS Power: DC 12V,1A Flash instructions: Upload factory.bin in stock firmware's upgrade page, do not preserve settings. MAC addresses map: 0x00004 *:3e wlan2g/wlan5g 0x3fff4 *:3c lan/label 0x3fffa *:3c wan Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
* ramips: add support for cudy WR2100Leon M. George2021-05-261-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifications SoC: MT7621 CPU: 880 MHz Flash: 16 MiB RAM: 128 MiB WLAN: 2.4 GHz b/g/n, 5 GHz a/n/ac MT7603E / MT7615E Ethernet: 5x Gbit ports Installation There are two known options: 1) The Luci-based UI. 2) Press and hold the reset button during power up. The router will request 'recovery.bin' from a TFTP server at 192.168.1.88. Both options require a signed firmware binary. The openwrt image supplied by cudy is signed and can be used to install unsigned images. R4 & R5 need to be shorted (0-100Ω) for the UART to work. Signed-off-by: Leon M. George <leon@georgemail.eu> [remove non-required switch-port node - remove trgmii phy-mode] Signed-off-by: David Bauer <mail@david-bauer.net>
* ramips: add support for TP-Link Archer C6U v1 (EU)Georgi Vlaev2021-05-261-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for TP-Link Archer C6U v1 (EU). The device is also known in some market as Archer C6 v3. This patch supports only Archer C6U v1 (EU). Specifications: -------------- * SoC: Mediatek MT7621AT 2C2T, 880MHz * RAM: 128MB DDR3 * Flash: 16MB SPI NOR flash (Winbond 25Q128) * WiFi 5GHz: Mediatek MT7613BEN (2x2:2) * WiFi 2.4GHz: Mediatek MT7603EN (2x2:2) * Ethernet: MT7630, 5x 1000Base-T. * LED: Power, WAN, LAN, WiFi 2GHz and 5GHz, USB * Buttons: Reset, WPS. * UART: Serial console (115200 8n1), J1(GND:3) * USB: One USB2 port. Installation: ------------ Install the OpenWrt factory image for C6U is from the TP-Link web interface. 1) Go to "Advanced/System Tools/Firmware Update". 2) Click "Browse" and upload the OpenWrt factory image: openwrt-ramips-mt7621-tplink_archer-c6u-v1-squashfs-factory.bin. 3) Click the "Upgrade" button, and select "Yes" when prompted. Recovery to stock firmware: -------------------------- The C6U bootloader has a failsafe mode that provides a web interface (running at 192.168.0.1) for reverting back to the stock TP-Link firmware. The failsafe interface is triggered from the serial console or on failed kernel boot. Unfortunately, there's no key combination that enables the failsafe mode. This gives us two options for recovery: 1) Recover using the serial console (J1 header). The recovery interface can be selected by hitting 'x' when prompted on boot. 2) Trigger the bootloader failsafe mode. A more dangerous option is force the bootloader into recovery mode by erasing the OpenWrt partition from the OpenWrt's shell - e.g "mtd erase firmware". Please be careful, since erasing the wrong partition can brick your device. MAC addresses: ------------- OEM firmware configuration: D8:07:B6:xx:xx:83 : 5G D8:07:B6:xx:xx:84 : LAN (label) D8:07:B6:xx:xx:84 : 2.4G D8:07:B6:xx:xx:85 : WAN Signed-off-by: Georgi Vlaev <georgi.vlaev@konsulko.com>
* ramips: add support for TP-Link Archer A6 v3Vinay Patil2021-05-261-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The patch adds support for the TP-Link Archer A6 v3 The router is sold in US and India with FCC ID TE7A6V3 Specification ------------- MediaTek MT7621 SOC RAM: 128MB DDR3 SPI Flash: W25Q128 (16MB) Ethernet: MT7530 5x 1000Base-T WiFi 5GHz: Mediatek MT7613BE WiFi 2.4GHz: Mediatek MT7603E UART/Serial: 115200 8n1 Device Configuration & Serial Port Pins --------------------------------------- ETH Ports: LAN4 LAN3 LAN2 LAN1 WAN _______________________ | | Serial Pins: | VCC GND TXD RXD | |_____________________| LEDs: Power Wifi2G Wifi5G LAN WAN Build Output ------------ The build will generate following set of files [1] openwrt-ramips-mt7621-tplink_archer-a6-v3-initramfs-kernel.bin [2] openwrt-ramips-mt7621-tplink_archer-a6-v3-squashfs-factory.bin [3] openwrt-ramips-mt7621-tplink_archer-a6-v3-squashfs-sysupgrade.bin How to Use - Flashing from TP-Link Web Interface ------------------------------------------------ * Go to "Advanced/System Tools/Firmware Update". * Click "Browse" and upload the OpenWrt factory image: factory.bin[2] * Click the "Upgrade" button, and select "Yes" when prompted. TFTP Booting ------------ Setup a TFTP boot server with address 192.168.0.5. While starting U-boot press '4' key to stop autoboot. Copy the initramfs-kernel.bin[1] to TFTP server folder, rename as test.bin From u-boot command prompt run tftpboot followed by bootm. Recovery -------- Archer A6 V3 has recovery page activated if SPI booting from flash fails. Recovery page can be activated from serial console only. Press 'x' while u-boot is starting Note: TFTP boot can be activated only from u-boot serial console. Device recovery address: 192.168.0.1 Thanks to: Frankis for Randmon MAC address fix. Signed-off-by: Vinay Patil <post2vinay@gmail.com> [remove superfluous factory image definition, whitespacing] Signed-off-by: David Bauer <mail@david-bauer.net>
* ramips: mt7621: Add support for ZyXEL NR7101Bjørn Mork2021-05-094-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ZyXEL NR7101 is an 802.3at PoE powered 5G outdoor (IP68) CPE with integrated directional 5G/LTE antennas. Specifications: - SoC: MediaTek MT7621AT - RAM: 256 MB - Flash: 128 MB MB NAND (MX30LF1G18AC) - WiFi: MediaTek MT7603E - Switch: 1 LAN port (Gigabiti) - 5G/LTE: Quectel RG502Q-EA connected by USB3 to SoC - SIM: 2 micro-SIM slots under transparent cover - Buttons: Reset, WLAN under same cover - LEDs: Multicolour green/red/yellow under same cover (visible) - Power: 802.3at PoE via LAN port The device is built as an outdoor ethernet to 5G/LTE bridge or router. The Wifi interface is intended for installation and/or temporary management purposes only. UART Serial: 57600N1 Located on populated 5 pin header J5: [o] GND [ ] key - no pin [o] RX [o] TX [o] 3.3V Vcc Remove the SIM/button/LED cover, the WLAN button and 12 screws holding the back plate and antenna cover together. The GPS antenna is fixed to the cover, so be careful with the cable. Remove 4 screws fixing the antenna board to the main board, again being careful with the cables. A bluetooth TTL adapter is recommended for permanent console access, to keep the router water and dustproof. The 3.3V pin is able to power such an adapter. MAC addresses: OpenWrt OEM Address Found as lan eth2 08:26:97:*:*:BC Factory 0xe000 (hex), label wlan0 ra0 08:26:97:*:*:BD Factory 0x4 (hex) wwan0 usb0 random WARNING!! ISP managed firmware might at any time update itself to a version where all known workarounds have been disabled. Never boot an ISP managed firmware with a SIM in any of the slots if you intend to use the router with OpenWrt. The bootloader lock can only be disabled with root access to running firmware. The flash chip is physically inaccessible without soldering. Installation from OEM web GUI: - Log in as "supervisor" on https://172.17.1.1/ - Upload OpenWrt initramfs-recovery.bin image on the Maintenance -> Firmware page - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - (optional) Copy OpenWrt to the recovery partition. See below - Sysupgrade to the OpenWrt sysupgrade image and reboot Installation from OEM ssh: - Log in as "root" on 172.17.1.1 port 22022 - scp OpenWrt initramfs-recovery.bin image to 172.17.1.1:/tmp - Prepare bootloader config by running: nvram setro uboot DebugFlag 0x1 nvram setro uboot CheckBypass 0 nvram commit - Run "mtd_write -w write initramfs-recovery.bin Kernel" and reboot - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - (optional) Copy OpenWrt to the recovery partition. See below - Sysupgrade to the OpenWrt sysupgrade image and reboot Copying OpenWrt to the recovery partition: - Verify that you are running a working OpenWrt recovery image from flash - ssh to root@192.168.1.1 and run: fw_setenv CheckBypass 0 mtd -r erase Kernel2 - Wait while the bootloader mirrors Image1 to Image2 NOTE: This should only be done after successfully booting the OpenWrt recovery image from the primary partition during installation. Do not do this after having sysupgraded OpenWrt! Reinstalling the recovery image on normal upgrades is not required or recommended. Installation from Z-Loader: - Halt boot by pressing Escape on console - Set up a tftp server to serve the OpenWrt initramfs-recovery.bin image at 10.10.10.3 - Type "ATNR 1,initramfs-recovery.bin" at the "ZLB>" prompt - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - Sysupgrade to the OpenWrt sysupgrade image NOTE: ATNR will write the recovery image to both primary and recovery partitions in one go. Booting from RAM: - Halt boot by pressing Escape on console - Type "ATGU" at the "ZLB>" prompt to enter the U-Boot menu - Press "4" to select "4: Entr boot command line interface." - Set up a tftp server to serve the OpenWrt initramfs-recovery.bin image at 10.10.10.3 - Load it using "tftpboot 0x88000000 initramfs-recovery.bin" - Boot with "bootm 0x8800017C" to skip the 380 (0x17C) bytes ZyXEL header This method can also be used to RAM boot OEM firmware. The warning regarding OEM applies! Never boot an unknown OEM firmware, or any OEM firmware with a SIM in any slot. NOTE: U-Boot configuration is incomplete (on some devices?). You may have to configure a working mac address before running tftp using "setenv eth0addr <mac>" Unlocking the bootloader: If you are unebale to halt boot, then the bootloader is locked. The OEM firmware locks the bootloader on every boot by setting DebugFlag to 0. Setting it to 1 is therefore only temporary when OEM firmware is installed. - Run "nvram setro uboot DebugFlag 0x1; nvram commit" in OEM firmware - Run "fw_setenv DebugFlag 0x1" in OpenWrt NOTE: OpenWrt does this automatically on first boot if necessary NOTE2: Setting the flag to 0x1 avoids the reset to 0 in known OEM versions, but this might change. WARNING: Writing anything to flash while the bootloader is locked is considered extremely risky. Errors might cause a permanent brick! Enabling management access from LAN: Temporary workaround to allow installing OpenWrt if OEM firmware has disabled LAN management: - Connect to console - Log in as "root" - Run "iptables -I INPUT -i br0 -j ACCEPT" Notes on the OEM/bootloader dual partition scheme The dual partition scheme on this device uses Image2 as a recovery image only. The device will always boot from Image1, but the bootloader might copy Image2 to Image1 under specific conditions. This scheme prevents repurposing of the space occupied by Image2 in any useful way. Validation of primary and recovery images is controlled by the variables CheckBypass, Image1Stable, and Image1Try. The bootloader sets CheckBypass to 0 and reboots if Image1 fails validation. If CheckBypass is 0 and Image1 is invalid then Image2 is copied to Image1. If CheckBypass is 0 and Image2 is invalid, then Image1 is copied to Image2. If CheckBypass is 1 then all tests are skipped and Image1 is booted unconditionally. CheckBypass is set to 1 after each successful validation of Image1. Image1Try is incremented if Image1Stable is 0, and Image2 is copied to Image1 if Image1Try is 3 or larger. But the bootloader only tests Image1Try if CheckBypass is 0, which is impossible unless the booted image sets it to 0 before failing. The system is therefore not resilient against runtime errors like failure to mount the rootfs, unless the kernel image sets CheckBypass to 0 before failing. This is not yet implemented in OpenWrt. Setting Image1Stable to 1 prevents the bootloader from updating Image1Try on every boot, saving unnecessary writes to the environment partition. Keeping an OpenWrt initramfs recovery as Image2 is recommended primarily to avoid unwanted OEM firmware boots on failure. Ref the warning above. It enables console-less recovery in case of some failures to boot from Image1. Signed-off-by: Bjørn Mork <bjorn@mork.no>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-23 15:45:30 +0000