The Xiaomi MiWiFi 3A wireless router has a similar system architecture as the Xiaomi Mi 4A router, which is already officially supported by OpenWrt.
Product website: https://www.mi.com/miwifi3a
Device specification
--------------------
SoC: MT7628AN MIPS_24KEc @ 580 MHz 2.4G-bgn 2x2
WiFi: MT7612EN 5G-an, ac 80 MHz 2T2R
Flash: 16 MB
DRAM: 64 MB
Switch: MT7628AN (integrated in SoC)
Ethernet: 1 x 10 /100 Mbps
USB: None
Antennas: 2 x 2,4 GHz and 2 x 5 GHz (all are external and non-detachable)
LEDs: blue/red/amber
Buttons: Reset
Serial: 115200,8n1
MAC addresses as verified by OEM firmware:
------------------------------------------
use address source
LAN *:DD factory 0x28
WAN *:DD factory 0x28
2g *:DE factory 0x4
5g *:DF factory 0x8004
OEM firmware uses VLAN's to create the network interface for WAN and LAN.
Bootloader info:
----------------
The stock bootloader uses a "Dual ROM Partition System".
OS1 is a deep copy of OS2.
The bootloader starts OS2 by default.
To force start OS1 it is needed to set "flag_try_sys2_failed=1".
How to install:
---------------
1- Use OpenWRTInvasion to gain Telnet, SSH and FTP access: https://github.com/acecilia/OpenWRTInvasion
[IP: 192.168.31.1 | Username: root | Password: root | FTP-Port: 21]
2- Connect to router using telnet or ssh.
3- Backup all partitions. Use command "dd if=/dev/mtd0 of=/tmp/mtd0". Copy /tmp/mtd0 to computer using ftp.
4- Copy openwrt-ramips-mt76x8-xiaomi_miwifi-3a-squashfs-sysupgrade.bin to /tmp in router using ftp.
5- Enable UART access and change start image to OS1.
nvram set uart_en=1
nvram set flag_last_success=1
nvram set boot_wait=on
nvram set flag_try_sys2_failed=1
nvram commit
6- Erase OS1 & OS2 and install OpenWrt
mtd erase OS1
mtd erase OS2
mtd -r write /tmp/openwrt-ramips-mt76x8-xiaomi_miwifi-3a-squashfs-sysupgrade.bin OS1
Credits:
--------
This PR is based on the work of Zehao Zhang (Github: @ZZH-Finalize) that he had published in the PR: #15698
Signed-off-by: Olgun Demir <olgun.demir@mail.com.tr>
Link: https://github.com/openwrt/openwrt/pull/18427
(cherry picked from commit c3b8108a2b)
Link: https://github.com/openwrt/openwrt/pull/18550
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for Mercusys MR80X(EU) v3 router.
Device specification:
- SoC: Mediatek MT7981b, Cortex-A53, 64-bit
- RAM: 512MB
- Flash: SPI NAND GigaDevice GD5F1GQ5UEYIGY (128 MB)
- Ethernet: 4x 100/1000 Mbps LAN1,LAN2,LAN3 & WAN
- Wireless: 2.4GHz (802.11 b/g/n/ax)
- Wireless: 5GHz (802.11 a/n/ac/ax)
- LEDs: 1 orange and 1 green status LEDs, 4 green gpio-controlled LEDs
on ethernet ports
- Buttons: 1 (Reset)
- Bootloader: Main U-Boot - U-Boot 2022.01-rc4. Additionally, both UBI
slots contain "seconduboot" (also U-Boot 2022.01-rc4)
Installation (UART):
- Place OpenWrt initramfs-kernel image on tftp server with IP 192.168.1.2
- Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'.
- Set the uboot environment for startup.
setenv tp_boot_idx 0; setenv bootcmd bootm 0x46000000; saveenv
If the bootarg is set to boot from ubi1, also change it to ubi0.
- Load and run OpenWrt initramfs image.
setenv serverip 192.168.1.2; setenv ipaddr 192.168.1.1; tftpboot initramfs-kernel.bin; bootm
- Login as root via SSH (IP 192.168.1.1, port 22)
- Upload OpenWrt sysupgrade.bin image to the /tmp dir of the router
- Run sysupgrade:
sysupgrade -n /tmp/sysupgrade.bin
Recovery:
- Press Reset button and power on the router.
- Navigate to U-Boot recovery web server (http://192.168.1.1/) and
upload the OEM firmware.
Stock layout:
0x000000000000-0x000000200000 : "boot"
0x000000200000-0x000000300000 : "u-boot-env"
0x000000300000-0x000003500000 : "ubi0"
0x000003500000-0x000006700000 : "ubi1"
0x000006700000-0x000006f00000 : "userconfig"
0x000006f00000-0x000007300000 : "tp_data"
ubi0/ubi1 format:
U-Boot at boot checks that all volumes are in place:
+-------------------------------+
| Volume Name: uboot Vol ID: 0|
| Volume Name: kernel Vol ID: 1|
| Volume Name: rootfs Vol ID: 2|
+-------------------------------+
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| label | 94:0C:xx:xx:xx:12 | label |
| WAN | 94:0C:xx:xx:xx:13 | label+1 |
| LAN | 94:0C:xx:xx:xx:12 | label |
| WLAN 2g | 94:0C:xx:xx:xx:11 | label-1 |
| WLAN 5g | 94:0C:xx:xx:xx:10 | label-2 |
+---------+-------------------+-----------+
label MAC address was found in UBI partition "tp_data", file
"default-mac".
Signed-off-by: Schneider Azima <Schneider-Azima12@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/18181
(cherry picked from commit 7921e48d43)
Signed-off-by: Schneider Azima <Schneider-Azima12@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/18522
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
**Huasifei WH3000 eMMC / Fudy MT3000**
Portable Wi-Fi 6 travel router based on MediaTek MT7981A SoC.
MT7981B+MT7976CN+RTL8221B Dual Core 1.3GHZ
**Specifications**
SoC: Filogic 820 MT7981A (1.3GHz)
RAM: DDR4 1GB
Flash: eMMC 8GB
WiFi: 2.4GHz and 5GHz with 3 antennas
Ethernet:
1x WAN (10/100/1000M)
1x LAN (10/100/1000/2500M)
USB: 1x USB 3.0 port
Two buttons: power/reset and mode (BTN_0)
LEDS: blue, red, blue+red=pink
UART: 3.3V, TX, RX, GND / 115200 8N1
**Installation via U-Boot rescue**
1. Set static IP 192.168.1.2 on your computer and default route as 192.168.1.1
2. Connect to the WAN port and hold the reset button while booting the device.
3. Wait for the LED to blink 5 times, and release the reset button.
4. Open U-boot web page on your browser at http://192.168.1.1
5. Select the OpenWRT sysupgrade image, upload it, and start the upgrade.
6. Wait for the router to flash the new firmware.
7. Wait for the router to reboot itself.
**Installation via sysupgrade**
Just flash sysupgrade file via [LuCI upgrade page](http://192.168.1.1/cgi-bin/luci/admin/system/flash) without saving the settings.
**Installation via SSH**
Upload the file to the router `/tmp` directory, `ssh root@192.168.1.1` and issue a command:
```
sysupgrade -n /tmp/openwrt-mediatek-filogic-huasifei_wh3000-emmc-squashfs-sysupgrade.bin
```
**Factory MAC**
You can find your Factory MAC which is mentioned on the box at `/dev/mmcblck0p2` partition `factory` starting from `0x4`
```
dd if=/dev/mmcblk0p2 bs=1 skip=4 count=6 | hexdump -C
```
**Enlarging a partition**
Though device has 8GB eMMC, it uses only 2GB `/dev/mmcblck0p6` as `rootfs` for `/rom` and `/overlay` leaving `/dev/mmcblck0p7` as empty unused space.
```
sgdisk -p /dev/mmcblk0
```
```
Disk /dev/mmcblk0: 15269888 sectors, 7.3 GiB
Sector size (logical/physical): 512/512 bytes
Disk identifier (GUID): 2BD17853-102B-4500-AA1A-8A21D4D7984D
Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 33
First usable sector is 34, last usable sector is 14942174
Partitions will be aligned on 1024-sector boundaries
Total free space is 11197 sectors (5.5 MiB)
Number Start (sector) End (sector) Size Code Name
1 8192 9215 512.0 KiB 8300 u-boot-env
2 9216 13311 2.0 MiB 8300 factory
3 13312 21503 4.0 MiB 8300 fip
4 21504 29695 4.0 MiB 8300 config
5 29696 62463 16.0 MiB 8300 kernel
6 62464 4256767 2.0 GiB 8300 rootfs
7 4257792 14940159 5.1 GiB 8300
```
You can fix that by loading into `initramfs-kernel`, deleting empty `mmcblck0p7` partition and resizing `mmcblck0p6`
```
sysupgrade -F /tmp/openwrt-initramfs-kernel.bin
```
Install and run cfdisk
```
opkg update && opkg install cfdisk
cfdisk /dev/mmcblck0
```
- Select `mmcblck0p7` -> Delete
- Select `mmcblck0p6` -> Resize -> Write -> yes -> Quit
You will not see any difference in `cat /proc/partitions` after that but just flash a `sysupgrade` and you'll get the whole 7.3GB space for the `/overlay`.
Co-developed-by: hecatae <horus.ra@gmail.com>
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18220
(cherry picked from commit 99ea96c297)
Link: https://github.com/openwrt/openwrt/pull/18434
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This PR adds support for netis NX31 router.
Specification
-------------
- SoC : MediaTek MT7981BA dual-core ARM Cortex-A53 1.3 GHz
- RAM : 256 MiB DDR3
- Flash : SPI-NAND 128 MiB (ESMT)
- WLAN : MediaTek MT7976CN dual-band WiFi 6
- 2.4 GHz : b/g/n/ax, MIMO 2x2
- 5 GHz : a/n/ac/ax, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x3 (LAN, MediaTek MT7531AE)
10/100/1000 Mbps x1 (WAN, SoC internal phy)
- USB : No
- Buttons : Mesh, Reset
- LEDs : 1x Power (blue), unmanaged
1x Status (blue), gpio-controlled
1x WiFi 2.4 GHz (blue), gpio-controlled
1x WiFi 5 GHz (blue), gpio-controlled
3x LAN activity (blue), switch-controlled
1x WAN activity (blue), gpio-controlled
- Power : 12 VDC, 1 A
Installation
------------
1. Connect to the router using ssh (user: admin, pass: web interface
password)
2. Make mtd backup:
cat /dev/mtd0 | gzip -1 -c > /tmp/mtd0_spi0.0.bin.gz
cat /dev/mtd1 | gzip -1 -c > /tmp/mtd1_BL2.bin.gz
cat /dev/mtd2 | gzip -1 -c > /tmp/mtd2_u-boot-env.bin.gz
cat /dev/mtd3 | gzip -1 -c > /tmp/mtd3_Factory.bin.gz
cat /dev/mtd4 | gzip -1 -c > /tmp/mtd4_FIP.bin.gz
cat /dev/mtd5 | gzip -1 -c > /tmp/mtd5_ubi.bin.gz
3. Download mtd backup from the /tmp dir of the router to your PC using
scp protocol
4. Upload OpenWrt 'bl31-uboot.fip', 'preloader.bin' images to the /tmp
dir of the router using scp protocol
5. Write FIP and BL2 (replace bootloader):
mtd write /tmp/openwrt-mediatek-filogic-netis_nx31-bl31-uboot.fip FIP
mtd write /tmp/openwrt-mediatek-filogic-netis_nx31-preloader.bin BL2
6. Place OpenWrt
'openwrt-mediatek-filogic-netis_nx31-initramfs-recovery.itb' image on
the tftp server (IP: 192.168.1.254)
7. Erase 'ubi' partition and reboot the router:
mtd erase ubi
reboot
8. U-Boot automatically boot OpenWrt recovery image from tftp server to
the RAM
9. Upload OpenWrt 'sysupgrade.itb' image to the /tmp dir of the router
(IP: 192.168.1.1) using scp protocol
10. Connect to the router using ssh and run:
sysupgrade -n openwrt-mediatek-filogic-netis_nx31-squashfs-sysupgrade.itb
Return to stock
---------------
1. Unpack stock BL2 and FIP partitions backup
2. Upload stock BL2 and FIP partitions backup to the /tmp dir of the
router using scp protocol
3. Connect to the router using ssh and run:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd unlock BL2
mtd unlock FIP
4. Restore backup:
mtd write /tmp/mtd4_FIP.bin FIP
mtd write /tmp/mtd1_BL2.bin BL2
5. Erase ubi and reboot:
mtd erase ubi
reboot
6. Power off the router
7. Press Reset button and power on the router. Release the button after
~10 sec
8. Navigate to U-Boot recovery web server (http://192.168.1.1/) and
upload the OEM firmware
Recovery
--------
1. Place OpenWrt
'openwrt-mediatek-filogic-netis_nx31-initramfs-recovery.itb' image on
the tftp server (IP: 192.168.1.254)
2. Press “Reset” button and power on the router. After ~10 sec release
the button.
3. Use OpenWrt initramfs system for recovery
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | dc:xx:xx:d1:xx:18 | label |
| WAN | dc:xx:xx:d1:xx:1a | label+2 |
| WLAN 2g | de:xx:xx:11:xx:19 | |
| WLAN 5g | de:xx:xx:71:xx:19 | |
+---------+-------------------+-----------+
The LAN MAC was found in 'Factory', 0x1fef20
The WAN MAC was found in 'Factory', 0x1fef26
The WLAN 2g/5g MAC prototype was found in 'Factory', 0x4
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18324
(cherry picked from commit d8002cb627)
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18438
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add support for Genexis Pulse EX400 / Inteno Pulse EX400. A branded
variant for the Finnish ISP DNA has already been added in fea2264d9f
(ramips: mt7621: Add DNA Valokuitu Plus EX400, 2023-07-31). This commit
adds support for the generic variants with Inteno and Genexis branding.
Inteno changed its name to Genexis and both brandings exist.
In terms of electronics, there is no difference between the DNA-branded
version and other brandings. LED markings on the case are different,
though. While the DNA-version has a "software-update" LED, the other
versions have a WPS LED. To reduce user confusion, create a separate
image.
Add the different device-tree with the different LED and rename things
to work the same way for both variants.
Specifications:
- Device: Genexis Pulse EX400 / Inteno Pulse EX400
- SoC: MT7621A
- Flash: 256 MB NAND
- RAM: 256 MB
- Ethernet: Built-in, 2 x 1 GbE
- Wifi: MT7603 2.4 GHz 2x2 MIMO, MT7615 5 GHz 4x4 MU-MIMO
- USB: 1x 2.0
- LEDs (GPIO): green/red status, green WPS
- LEDs (SX9512, unsupported): Broadband, Wi-Fi 2.4G, Wi-Fi 5G
- Buttons (GPIO): Reset
- Buttons (SX9512, unsupported): Wi-Fi 2.4G, Wi-Fi 5G, WPS
MAC addresses:
- LAN: U-Boot 'ethaddr' (label)
- WAN: label + 1
- 2.4 GHz: label + 6
- 5 GHz: label + 7
Serial:
There is a black block connector next to the red ethernet connector. It
is accessible also through holes in the casing.
Pinout (TTL 3.3V)
+---+---+
|Tx |Rx |
+---+---+
|Vcc|Gnd|
+---+---+
Firmware:
The vendor firmware is a fork of OpenWrt (Reboot) with a kernel version
4.4.93. The flash is arranged as below and there is a dual boot
mechanism alternating between rootfs_0 and rootfs_1.
+-------+------+------+-----------+-----------+
| | env1 | env2 | rootfs_0 | rootfs_1 |
| +------+------+-----------+-----------+
| | UBI volumes |
+-------+-------------------------------------+
|U-Boot | UBI |
+-------+-------------------------------------+
|mtd0 | mtd1 |
+-------+-------------------------------------+
| NAND |
+---------------------------------------------+
In OpenWrt rootfs_0 will be used as a boot partition that will contain the
kernel and the dtb. The squashfs rootfs and overlay are standard OpenWrt
behaviour.
+-------+------+------+-----------+--------+------------+
| | env1 | env2 | rootfs_0 | rootfs | rootfs_data|
| +------+------+-----------+--------+------------+
| | UBI volumes |
+-------+-----------------------------------------------+
|U-Boot | UBI |
+-------+-----------------------------------------------+
|mtd0 | mtd1 |
+-------+-----------------------------------------------+
| NAND |
+-------------------------------------------------------+
U-boot:
With proper serial access, booting can be halted to U-boot by pressing
any key. TFTP and flash writes are available, but only the first one has
been tested.
NOTE: Recovery mode can be accessed by holding down the reset button while
powering on the device. The led 'Update' will show a solid green light
once ready. A web server will be running at 192.168.1.1:80 and it will
allow flashing a firmware package. You can cycle between rootfs_0 and
rootfs_1 by pressing the reset button once.
Root password:
With the vendor web UI create a backup of your settings and download the
archive to your computer. Within the archive in the file
/etc/shadow replace the password hash for root with that of a password you
know. Restore the configuration with the vendor web UI and you will have
changed the root password.
SSH access:
You might need to enable the SSH service for LAN interface as by default
it's enabled for WAN only.
Installing OpenWrt:
With the vendor web UI, or from the U-Boot recovery UI, install the
OpenWrt factory image. Alternatively, ssh to the device and use
sysupgrade -n from cli.
Finalize by installing the OpenWrt sysupgrade image to get a fully
functioning system.
Reverting to the vendor firmware:
Boot with OpenWrt initramfs image
- Remove volumes rootfs_0, rootfs and rootfs_data and create vendor
volumes.
ubirmvol /dev/ubi0 -n 2
ubirmvol /dev/ubi0 -n 3
ubirmvol /dev/ubi0 -n 4
ubimkvol /dev/ubi0 -N rootfs_0 -S 990
ubimkvol /dev/ubi0 -N rootfs_1 -S 990
Power off and enter to the U-boot recovery to install the vendor
firmware.
Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>
Link: https://github.com/openwrt/openwrt/pull/17551
(cherry picked from commit 3e7337feea)
Link: https://github.com/openwrt/openwrt/pull/18238
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is an industrial 4G router equipped with OpenWrt 14.07 OEM
customized version
WARNING: The original firmware device tree is common to multiple
boards, and the device tree name is H9350. This submitted device
tree is a modified version, which deletes the non-this-device parts
and adds GPIO watchdog.
Specification:
- SoC: MediaTek MT7620A
- Flash: 16 MB
- RAM: 128 MB
- Power: DC 5V-36V 1.5A
- Ethernet: 1x WAN, 4x LAN (10/100 Mbps)
- Wireless radio: 802.11n 2.4g-only
- LED:
System/Power (RUN): GPIO/26 active-low
Ethernet: 1x WAN, 4x LAN
Modem 1: GPIO/66 active-low
RF 1 (Modem 1 Signal): GPIO/67 active-low
Modem 2: GPIO 71 active-low
RF 2 (Modem 2 Signal): GPIO/24 active-low
WLAN: GPIO/72 active-low
WPS: GPIO/12 active-low
- Button:
WPS / RESET: GPIO/34 active-low
- UART: 1x UART on PCB - 115200 8N1
- GPIO Watchdog: GPIO/62 mode=toggle timeout=1s
- PCIe: 2x miniPCIe for modem
- SIM Slots: 2x SIM Slots
Issue:
- No factory partition, eeprom is located
at /lib/firmware/mt7620a.eeprom
Flash instruction:
Using UART:
1. Configure PC with a static IP address and setup an TFTP server.
2. Put rootfs into the tftp directory.
3. Connect the UART line as described on the PCB.
4. Power up the device and press Ctrl+C to break auto boot.
5. Use `system 6` command and follow the instruction to set device
and tftp server IP address and input the rootfs file name.
U-boot will then load the rootfs and write it into
the flash.
6. Use `system 1` command and follow the instruction to set device
and tftp server IP address and input the firmware file name.
U-boot will then load the firmware once.
7. Login to LuCI and use LuCI upgrade firmware.
Original Firmware Dump / More details:
https://blog.gov.cooking/archives/research-hongdian-h8922-and-flash.html
Signed-off-by: Coia Prant <coiaprant@gmail.com>
Tested-by: Coia Prant <coiaprant@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17472
Link: https://github.com/openwrt/openwrt/pull/18221
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 6a1bdcf545)
This board is also as known as SuperElectron ZN-M5 and ZN-M8. However,
for ZN-M5 and ZN-M8, there's another version uses ZX279128 as CPU
chip, which is unsupported.
You can check it in "高级设置" > "系统日志" > "内核日志" page from webUI.
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 128 MB SPI-NAND
RAM: 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, WPS
Power: DC 12V 1A
Stock layout flash instructions:
Login into webUI and upload sysupgrade firmware in "系统管理" > "升级固件" page.
Remember to unselect "保留配置" ("Keep configurations") first before doing that.
OpenWrt U-Boot layout flash instructions:
1. Flash stock layout firmware first.
2. Connect to the device via SSH, and backup everything,
especially 'Factory' partition.
3. Unlock MTD partitions:
opkg update && opkg install kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
4. Write new BL2 and FIP:
mtd write openwrt-mediatek-filogic-cmcc_a10-ubootmod-preloader.bin BL2
mtd write openwrt-mediatek-filogic-cmcc_a10-ubootmod-bl31-uboot.fip FIP
5. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
6. Serve OpenWrt initramfs image using TFTP server.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt has booted, perform sysupgrade.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Link: https://github.com/openwrt/openwrt/pull/18121
(cherry picked from commit 96c6608346)
[sync uboot defconfigs with 24.10 branch, change apk to opkg]
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Link: https://github.com/openwrt/openwrt/pull/18218
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
It seems the that this was forgotten during initial adding of the
device in 0688cf5aeb
Thanks to
https://forum.openwrt.org/t/zyxel-gs1900-10hp-revision-b1-support-openwrt-firmware/131841/32
for putting me on the right track for this problem
Error that is being fixed - running fw_printenv results in:
"Warning: Bad CRC, using default environment"
and not showing boardmodel
Workaround, manually changing /etc/fw_env.config to
"/dev/mtd1 0x0 0x400 0x10000"
Signed-off-by: Klaas Demter <psychic-stool-cozy@duck.com>
Link: https://github.com/openwrt/openwrt/pull/17920
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 71a966c480)
Referencing commit a1837135e0
Hardware
--------
SoC: Qualcomm Atheros QCA9558
RAM: 128M DDR2 (Nanya NT5TU64M16HG-AC)
FLASH: 128M SPI-NAND (Spansion S34ML01G100TFI00)
WLAN: QCA9558 3T3R 802.11 bgn
ETH: Qualcomm Atheros QCA8337
UART: 115200 8n1
BUTTON: Reset - WPS - "Router" switch
LED: 2x system-LED, 2x wlan-LED, 1x internet-LED,
2x routing-LED
LEDs besides the ethernet ports are controlled
by the ethernet switch
MAC Address:
use address(sample 1) source
label cc:e1:d5:xx:xx:ed art@macaddr_wan
lan cc:e1:d5:xx:xx:ec art@macaddr_lan
wan cc:e1:d5:xx:xx:ed $label
WiFi4_2G cc:e1:d5:xx:xx:ec art@cal_ath9k
Installation from Serial Console
------------
1. Connect to the serial console. Power up the device and interrupt
autoboot when prompted
2. Connect a TFTP server reachable at 192.168.11.10/24
to the ethernet port. Serve the OpenWrt initramfs image as
"openwrt.bin"
3. Boot the initramfs image using U-Boot
ath> tftpboot 0x84000000 openwrt.bin
ath> bootm 0x84000000
4. Copy the OpenWrt sysupgrade image to the device using scp and
install it like a normal upgrade (with no need to keeping config
since no config from "previous OpenWRT installation" could be kept
at all)
# sysupgrade -n /path/to/openwrt/sysupgrade.bin
Installation from Web Interface
------------
To flash just do a firmware upgrade from the stock firmware (Buffalo
branded dd-wrt) with squashfs-factory.bin
Signed-off-by: Edward Chow <equu@openmail.cc>
Link: https://github.com/openwrt/openwrt/pull/17227
(cherry picked from commit 42254d3f5f)
Link: https://github.com/openwrt/openwrt/pull/17359
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
- MT7986 CPU using 2.4GHz and 5GHz WiFi (both AX)
- MT7531 switch
- 512MB RAM
- 128MB NAND flash (MX35LF1GE4AB-Z4I) with two UBI partitions with identical size
- 1 multi color LED (red, green, blue, white) connected via GCA230718 (Same as D-Link M30 A1)
- 3 buttons (WPS, reset, LED on/off)
- 1x 2.5 Gbit WAN port with Maxlinear GPY211C
- 4x 1 Gbit LAN ports
Disassembly:
- There are five screws at the bottom: 2 under the rubber feet, 3 under the label.
- After removing the screws, the white plastic part can be shifted out of the blue part.
- Be careful because the antennas are mounted on the side and the top of the white part.
Serial Interface
- The serial interface can be connected to the 4 pin holes next to/under the antenna cables.
- Note that there is another set of 4 pin holes on the side of the board, it's not used.
- Pins (from front to rear):
- 3.3V (do not connect)
- TX
- RX
- GND
- Settings: 115200, 8N1
MAC addresses:
- MAC address is stored in partition "Odm" at offset 0x81 (for example XX:XX:XX:XX:XX:52)
- MAC address on the device label is ODM + 1 (for example XX:XX:XX:XX:XX:53)
- WAN MAC is the one from the ODM partition (for example XX:XX:XX:XX:XX:52)
- LAN MAC is the one from the ODM partition + 1 (for example XX:XX:XX:XX:XX:53)
- WLAN MAC (2.4 GHz) is the one from the ODM partition + 2 (for example (XX:XX:XX:XX:XX:54)
- WLAN MAC (5 GHz) is the one from the ODM partition + 5 (for example (XX:XX:XX:XX:XX:57)
Flashing via OEM web interface:
- Currently not supported because image crypto is not known
Flashing via recovery web interface:
- This is only working if the first partition is active because recovery images are always flashed to the active partition and OpenWrt can only be executed from the first partition
- Use a Chromium based browser, otherwise firmware upgrade might not work
- Recovery web interface is accessible via 192.168.200.1 after keeping the reset button pressed during start of the device until the LED blinks red
- Upload the recovery image, this will take some time. LED will continue flashing red during the update process
- The after flashing, the recovery web interface redirects to http://192.168.0.1. This can be ignored. OpenWrt is accessible via 192.168.1.1 after flashing
- If the first partition isn't the active partition, OpenWrt will hang during the boot process. In this case:
- Download the recovery image from https://github.com/RolandoMagico/openwrt/releases/tag/M60-Recovery-UBI-Switch (UBI switch image)
- Enable recovery web interface again and load the UBI switch image. This image works on the second partition of the M60
- OpenWrt should boot now as expected. After booting, flash the normal OpenWrt sysupgrade image (for example in the OpenWrt web interface)
- Flashing a sysupgrade image from the UBI switch image will make the first partition the active partition and from now on, default OpenWrt images can be used
Flashing via Initramfs:
- Before switching to OpenWrt, ensure that both partitions contain OEM firmware.
- This can be achieved by re-flashing the same OEM firmware version again via the OEM web interface.
- Flashing via OEM web interface will automatically flash the currently not active partition.
- Open router, connect serial interface
- Start a TFTP server at 192.168.200.2 and provide the initramfs image there
- When starting the router, select "7. Load Image" in U-Boot
- Settings for load address, load method can be kept as they are
- Specify host and router IP address if you use different ones than the default (Router 192.168.200.1, TFTP server 192.168.200.2)
- Enter the file name of the initramfs image
- Confirm "Run loaded data now?" question after loading the image with "Y"
- OpenWrt initramfs will start now
- Before flashing OpenWrt, create a backup of the "ubi" partition. It is required when reverting back to OEM
- Flash sysupgrade image to flash, during flashing the U-Boot variable sw_tryactive will be set to 0
- During next boot, U-Boot tries to boot from the ubi partition. If it fails, it will switch to the ubi1 partition
Reverting back to OEM:
- Boot the initramfs image as described in "Flashing via Initramfs" above
- Copy the backed up ubi partition to /tmp (e.g. by using SCP)
- Write the backup to the UBI partition: mtd write /tmp/OpenWrt.mtd4.ubi.bin /dev/mtd4
- Reboot the device, OEM firmware will start now
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17296
(cherry picked from commit b3ce08e0b6)
Link: https://github.com/openwrt/openwrt/pull/17363
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds OpenWrt U-Boot layout support for Routerich AX3000. The
aims:
1. Get open-source U-Boot;
2. Get maximum available free space in OpenWrt.
Install
-------
1. Copy OpenWrt ubootmod-bl31-uboot.fip, ubootmod-preloader.bin, to the
/tmp folder of the router using scp.
2. Make mtd partitions backups:
http://192.168.1.1/cgi-bin/luci/admin/system/flash -> Save mtdblock
contents
3. Install kmod-mtd-rw:
```
opkg update && opkg install kmod-mtd-rw
```
4. Write FIP and preloader:
```
insmod mtd-rw i_want_a_brick=1
mtd unlock BL2
mtd erase BL2
mtd write /tmp/ubootmod-preloader.bin BL2
mtd unlock FIP
mtd erase FIP
mtd write /tmp/ubootmod-bl31-uboot.fip FIP
```
5. Copy OpenWrt ubootmod-initramfs-recovery.itb to the tftp server root
with IP 192.168.1.254.
6. Reboot router:
```
reboot
```
U-Boot will automatically download from the tftp server and boot OpenWrt
initramfs system.
7. Copy OpenWrt ubootmod-squashfs-sysupgrade.itb to the /tmp dir of the
router using scp.
8. Run sysupgrade:
```
sysupgrade -n /tmp/squashfs-sysupgrade.itb
```
Recovery
--------
1. Place OpenWrt initramfs-recovery.itb image (with original name) on the
tftp server (IP: 192.168.1.254).
2. Press "reset" button and power on the router. After ~10 sec release the
button.
3. Use OpenWrt initramfs system for recovery.
BL2 and FIP recovery
--------------------
Use mtk_uartboot and UART connection if BL2 or FIP in UBI is destroyed:
Link: https://github.com/981213/mtk_uartboot
Return to stock:
----------------
1. Copy partition backups (BL2.bin and FIP.bin) to the /tmp dir of the
router using scp.
2. Install kmod-mtd-rw:
```
opkg update && opkg install kmod-mtd-rw
```
3. Restore stock U-Boot and reboot:
```
insmod mtd-rw i_want_a_brick=1
mtd unlock BL2
mtd erase BL2
mtd write /tmp/BL2.bin BL2
mtd unlock FIP
mtd erase FIP
mtd write /tmp/FIP.bin FIP
reboot
```
4. Open U-Boot web recovery, upload stock firmware image and start
upgrade.
Link: http://192.168.1.1
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16791
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit d413163832)
Link: https://github.com/openwrt/openwrt/pull/17097
Signed-off-by: Petr Štetiar <ynezz@true.cz>
This commit adds support for two variants of the already supported router
Acer Predator Connect W6: The Acer Predator Connect W6d (W6 without 6 GHz
wifi) and the Acer Connect Vero W6m (W6 without 2.5G eth1 port, usb3 port,
and the 6 on-board gpio RGB LEDs, and with a KTD2026 RGB LED controller
instead of the KTD2061 LED controller of the W6/W6d).
The device tree for the W6m refers to the KTD202x driver suggested in
PR #16860.
Patching target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
removes the code repetition in (old) lines 121 to 124 on the occasion.
This is the last of four commits into which the original commit was split
to make reviews easier and more targeted.
Signed-off-by: George Oldfort <openwrt@10099.de>
Link: https://github.com/openwrt/openwrt/pull/16861
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 2898d1d126)
Link: https://github.com/openwrt/openwrt/pull/17097
Signed-off-by: Petr Štetiar <ynezz@true.cz>
In order to prepare OpenWrt support for other Acer W6 devices and to adapt
the procedure to read and set mac addresses which other devices of the same
target are using (instead of needing an additional script and creating an
additional structure in the file system), this commit
- reads device mac addresses from u-boot environment
- avoids the detour via the file system to set the mac addresses
- drops redundant file /lib/preinit/05_extract_factory_data.sh
The idea and the implementation were thankfully taken from PR #16410.
This is the second of four commits into which the original commit was split
to make reviews easier and more targeted.
Signed-off-by: George Oldfort <openwrt@10099.de>
Link: https://github.com/openwrt/openwrt/pull/16861
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit e7aaba2587)
Link: https://github.com/openwrt/openwrt/pull/17097
Signed-off-by: Petr Štetiar <ynezz@true.cz>
This configuration should work with both stock and OpenWrt-based U-Boot.
Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com>
(cherry picked from commit 785ebf2baf)
Link: https://github.com/openwrt/openwrt/pull/17097
Signed-off-by: Petr Štetiar <ynezz@true.cz>
The Sophos AP15C uses the same hardware as the AP15, but has a reset button.
Based on:
commit 6f1efb2898 ("ath79: add support for Sophos AP100/AP55 family")
author Andrew Powers-Holmes <andrew@omnom.net>
Fri, 3 Sep 2021 15:53:57 +0200 (23:53 +1000)
committer Hauke Mehrtens <hauke@hauke-m.de>
Sat, 16 Apr 2022 16:59:29 +0200 (16:59 +0200)
Unique to AP15C:
- Reset button
- External RJ45 serial console port
Flashing instructions:
This firmware can be flashed either via a compatible Sophos SG or XG
firewall appliance, which does not require disassembling the device, or via
the U-Boot console available on the internal UART header.
To flash via XG appliance:
- Register on Sophos' website for a no-cost Home Use XG firewall license
- Download and install the XG software on a compatible PC or virtual
machine, complete initial appliance setup, and enable SSH console access
- Connect the target AP device to the XG appliance's LAN interface
- Approve the AP from the XG Web UI and wait until it shows as Active
(this can take 3-5 minutes)
- Connect to the XG appliance over SSH and access the Advanced Console
(Menu option 5, then menu option 3)
- Run `sudo awetool` and select the menu option to connect to an AP via
SSH. When prompted to enable SSH on the target AP, select Yes.
- Wait 2-3 minutes, then select the AP from the awetool menu again. This
will connect you to a root shell on the target AP.
- Copy the firmware to /tmp/openwrt.bin on the target AP via SCP/TFTP/etc
- Run `mtd -r write /tmp/openwrt.bin astaro_image`
- When complete, the access point will reboot to OpenWRT.
To flash via U-Boot serial console:
- Configure a TFTP server on your PC, and set IP address 192.168.99.8 with
netmask 255.255.255.0
- Copy the firmware .bin to the TFTP server and rename to 'uImage_AP15C'
- Open the target AP's enclosure and locate the 4-pin 3.3V UART header [4]
- Connect the AP ethernet to your PC's ethernet port
- Connect a terminal to the UART at 115200 8/N/1 as usual
- Power on the AP and press a key to cancel autoboot when prompted
- Run the following commands at the U-Boot console:
- `tftpboot`
- `cp.b $fileaddr 0x9f070000 $filesize`
- `boot`
- The access point will boot to OpenWRT.
Signed-off-by: David Lutz <kpanic@hirnduenger.de>
(cherry picked from commit a7abc7ec3b)
This tool will load the uboot environment to /var/run/uboot-env/. This allows
more efficient use when accessing multiple variables.
Signed-off-by: John Crispin <john@phrozen.org>
Add u-boot support based on the kernel dts introduced in d1016446 and
the GL-MT6000 u-boot support in fe10f974.
The pcie-mediatek-gen3 kernel driver doesn't like hotplug, so to work in
PCIe mode, the 5G modem on this device needs to be switched on by u-boot
before starting the kernel. Include an init_modem step in the boot_system
action to set the relevant gpios. (The factory bootloader does the same,
using Mediatek SDK-specific gpio_power_clr and gpio_pull_up.)
Ideally the modem would be started using gpio-hog in the device tree, but
this will need to wait until mediatek gpio-hog support is fixed upstream:
https://lore.kernel.org/u-boot/6ef2583e85eea60560d7776377d662779e7c44e5.1722419839.git.chris@arachsys.com/
The bootloader can be replaced using the built-in web interface of the
factory bootloader. Hold the reset button for five seconds while powering
on the device and it will boot into a recovery http server.
http://192.168.1.1/uboot.html and http://192.168.1.1/bl2.html can then
be used to upload openwrt-mediatek-filogic-glinet_gl-x3000-bl31-uboot.fip
and openwrt-mediatek-filogic-glinet_gl-x3000-preloader.bin respectively.
Alternatively, from a root shell on the running system, unlock the boot
partition with
echo 0 >/sys/block/mmcblk0boot0/force_ro
then write openwrt-mediatek-filogic-glinet_gl-x3000-bl31-uboot.fip to
/dev/mmcblk0p4 and openwrt-mediatek-filogic-glinet_gl-x3000-preloader.bin
to /dev/mmcblk0boot0.
Signed-off-by: Chris Webb <chris@arachsys.com>
Link: https://github.com/openwrt/openwrt/pull/15645
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification is similar to other devices of the MT Stuart series:
* Mediatek MT7988D (3x Cortex-A73, up to 1.8 GHz clock speed)
* 8 GiB eMMC
* 2 GiB DDR4 RAM
* 2500M/1000M/100M LAN port
* 10000M/5000M/2500M/1000M/100M/10M WAN port
* MT7992 Tri-band (2.4G, 5G, 6G) 2T2R+3T3R+3T3R 802.11be Wi-Fi
* Renesas DA14531MOD Bluetooth
* 2 buttons (Reset, Mesh/WPS)
* uC-controlled RGB LED via I2C
* 2x LED for the 2.5G port, 3x LED for the 10G port
* 3.3V-level 115200 baud UART console via 4-pin Dupont connector
exposed at the bottom of the device
* USB-C PD power input
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This commit adds support for netis N6 WiFi 6 router.
Specification
-------------
- SoC : MediaTek MT7621AT, MIPS, 880 MHz
- RAM : 256 MiB
- Flash : NAND 128 MiB (ESMT PSU1GA30DT)
- WLAN : MT7905DAN + MT7975DN
- 2.4 GHz : b/g/n/ax, 574 Mbps, MIMO 2x2
- 5 GHz : a/n/ac/ax, 1201 Mbps, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x5 (1x WAN, 4x LAN)
- USB : 1x 3.0
- UART : 3.3V, 115200n8
- Buttons : 1x Reset
1x WPS
- LEDs : 1x Power (green)
1x System (green)
1x WAN (green)
1x WiFi 2.4 GHz (green), controlled by phy
1x WiFi 5 GHz (green), controlled by phy
1x WPS (green)
1x USB (green)
5x ethernet leds (green), controlled by switch
- Power : 12 VDC, 1.5 A
Installation
------------
1. Update the router using stock firmware web interface and OpenWrt
factory.bin image.
Recovery and return to stock
----------------------------
1. Assign your PC a static IP 192.168.1.2 and connect to the router using
the ethernet cable;
2. Power off the router;
3. Press Reset button, power on the router and wait until ethernet led
start blinking;
4. Release the button;
5. Open http://192.168.1.1/ (N6 System Recovery Mode) in your browser;
6. Upload OpenWrt factory.bin (or stock firmware *.bin) image and proceed
with upgrade.
MAC addresses
-------------
+---------+-------------------+
| | MAC example |
+---------+-------------------+
| LAN | dc:xx:xx:49:xx:04 |
| WAN | dc:xx:xx:49:xx:05 |
| WLAN 2g | dc:xx:xx:19:xx:06 |
| WLAN 5g | dc:xx:xx:79:xx:06 |
+---------+-------------------+
The WLAN MAC prototype was found in 'Factory', 0x4
The LAN MAC was found in 'Factory', 0x7ef20
The WAN MAC was found in 'Factory', 0x7ef26
Known issue
-----------
2.4 GHz WLAN doesn't start with mt76 driver.
Probable reason:
Original Netis N6 EEPROM contains wrong MT_EE_WIFI_CONF value (0xd2).
Other routers with the same WLAN hardware (e.g., Routerich AX1800)
have MT_EE_WIFI_CONF = 0x92.
Workaround (already included in this commit):
Extract EEPROM to a file at the first time boot and change
MT_EE_WIFI_CONF (offset 0x190) value from 0xd2 to 0x92. See
/etc/hotplug.d/firmware/11-mt76-caldata for details.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16322
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specifications:
- Device: DNA Valokuitu Plus EX400
- SoC: MT7621A
- Flash: 256MB NAND
- RAM: 256MB
- Ethernet: Built-in, 2 x 1GbE
- Wifi: MT7603 2.4 GHz, MT7615 5 GHz (4x internal antennas)
- USB: 1x 3.0
- LED: 1x green/red, 1x green
- Buttons: Reset
MAC addresses:
- LAN: u-boot 'ethaddr' (label)
- WAN: label + 1
- 2.4 GHz: label + 6
- 5 GHz: label + 7
Serial:
There is a black block connector next to the red ethernet connector. It
is accessible also through holes in the casing.
Pinout (TTL 3.3V)
+---+---+
|Tx |Rx |
+---+---+
|Vcc|Gnd|
+---+---+
Firmware:
The vendor firmware is a fork of OpenWrt (Reboot) with a kernel version
4.4.93. The flash is arranged as below and there is a dual boot
mechanism alternating between rootfs_0 and rootfs_1.
+-------+------+------+-----------+-----------+
| | env1 | env2 | rootfs_0 | rootfs_1 |
| +------+------+-----------+-----------+
| | UBI volumes |
+-------+-------------------------------------+
|U-Boot | UBI |
+-------+-------------------------------------+
|mtd0 | mtd1 |
+-------+-------------------------------------+
| NAND |
+---------------------------------------------+
In OpenWrt rootfs_0 will be used as a boot partition that will contain the
kernel and the dtb. The squashfs rootfs and overlay are standard OpenWrt
behaviour.
+-------+------+------+-----------+--------+------------+
| | env1 | env2 | rootfs_0 | rootfs | rootfs_data|
| +------+------+-----------+--------+------------+
| | UBI volumes |
+-------+-----------------------------------------------+
|U-Boot | UBI |
+-------+-----------------------------------------------+
|mtd0 | mtd1 |
+-------+-----------------------------------------------+
| NAND |
+-------------------------------------------------------+
U-boot:
With proper serial access booting can be halted to U-boot by pressing any
key. TFTP and flash writes are available, but only the first one has been
tested.
NOTE: Recovery mode can be accessed by holding down the reset button while
powering on the device. The led 'Update' will show a solid green light
once ready. A web server will be running at 192.168.1.1:80 and it will
allow flashing a firmware package. You can cycle between rootfs_0 and
rootfs_1 by pressing the reset button once.
Root password:
With the vendor web UI create a backup of your settings and download the
archive to your computer. Within the archive in the file
/etc/shadow replace the password hash for root with that of a password you
know. Restore the configuration with the vendor web UI and you will have
changed the root password.
SSH access:
You might need to enable the SSH service for LAN interface as by default
it's enabled for WAN only.
Installing OpenWrt:
With the vendor web UI install the OpenWrt factory image. Alternatively,
ssh to the device and use sysupgrade -n from cli.
Finalize by installing the OpenWrt sysupgrade image to get a fully
functioning system.
Reverting to the vendor firmware:
Boot with OpenWrt initramfs image
- Remove volumes rootfs_0, rootfs and rootfs_data and create vendor
volumes.
ubirmvol /dev/ubi0 -n 2
ubirmvol /dev/ubi0 -n 3
ubirmvol /dev/ubi0 -n 4
ubimkvol /dev/ubi0 -N rootfs_0 -S 990
ubimkvol /dev/ubi0 -N rootfs_1 -S 990
Power off and enter to the U-boot recovery to install the vendor
firmware.
Known issues:
- MACs for wifi are stored in currently unknown place but it seems
to persist over power-off. They might be stored on the chip.
Signed-off-by: Mauri Sandberg <maukka@ext.kapsi.fi>
[rmilecki: try NVMEM for MACs]
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Specifications:
* SoC: Qualcomm IPQ8072A (64-bit Quad-core Arm Cortex-A53 @ 2200MHz)
* Memory: 2x ESMT M15T4G16256A-DEBG2G (1 GiB DDR3-1866 13-13-13)
* Serial Port: 3v3 TTL 115200n8
* Wi-Fi: QCN5054 (4x4 5 GHz 802.11ax)
* Wi-Fi: QCN5024 (4x4 2.4 GHz 802.11b/g/n/ax)
* Ethernet: QCA8081 (10/100/1000/2.5GBASE-T)
* Flash: Winbond W29N01HZSINF (128 MiB)
* LEDs: 1x Blue Status (GPIO 42 Active High)
* Buttons: 1x Reset (GPIO 50 Active Low)
Installation Instructions (Serial+TFTP):
1. Solder 4 pin header to JP1 and bridge pads of R58 and R62.
2. Connect 3V3 TTL port to TX, RX, and GND, which are positions 1, 2,
and 3 respectively. Be sure to crossover TX and RX.
3. Copy RAM firmware image
openwrt-qualcommax-ipq807x-tplink_eap660hd-v1-initramfs-uImage.itb
to TFTP server root, available at 192.168.10.1.
4. Connect PoE ethernet cable to the RJ45 port and hold Ctrl+B in the
serial console (115200 baud) until autoboot is halted.
5. Run the following commands in the U-boot prompt:
# tftpboot 0x44000000 openwrt-qualcommax-ipq807x-tplink_eap660hd-v1-initramfs-uImage.itb
# bootm
You may need to type Ctrl+C and Enter before running these commands
to clear invisible characters from the buffer.
6. Run the following command in a terminal to copy the sysupgrade image
to be installed (check IP address):
$ scp openwrt-qualcommax-ipq807x-tplink_eap660hd-v1-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
7. Activate the OpenWrt serial console and run the following commands:
# cd /tmp
# sysupgrade -n openwrt-qualcommax-ipq807x-tplink_eap660hd-v1-squashfs-sysupgrade.bin
8. The AP will reboot and OpenWrt will be successfully installed.
Signed-off-by: George Witt <george.witt@nltsproject.org>
Link: https://github.com/openwrt/openwrt/pull/15832
Signed-off-by: Robert Marko <robimarko@gmail.com>
Adds u-boot config for access to system env variables on this board
Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16312
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
- MT7629 CPU
- MT7531 switch
- MT7761N and MT7762N wifi
- 256 MB RAM
- 128 MB NAND flash with dual-boot partitions
- 2 buttons: WPS and reset
- 1 WAN port (1G)
- 4 LAN ports (1G)
- 1 USB port
Limitations (same as other MT7629/MT7761N/MT7762N devices):
- Wifi is not working
- Second core is not working (kernel error message "CPU1: failed to come online")
Disassembly:
- There are two screws under the front rubber feet and two under the label on the bottom (in the corners towards the back, you should be able to feel them).
Serial Interface:
- UART pin header is already soldered on the board. Pinning from front to back:
1 - VCC
2 - TX
3 - RX
4 - n/a
5 - GND
GPIO:
- 1 white LED, connected to GPIO 52
- 1 reset button, connected to GPIO 60
- 1 WPS button, connected to GPIO 58
MAC Adresses:
- The MAC address printed on the device label is used for LAN and WAN
- The MAC address is stored in the devinfo partition in ASCII format (hw_mac_addr=aa:bb:cc:dd:ee)
- 2.4 GHz wifi uses MAC of the device label + 1
- 5 GHz wifi uses MAC of the device label + 2
Flashing:
- OpenWrt is only runnig in the first partition of dual boot
- To ensure to be able to go back to the factory image, flash the last OEM firmware via OEM web interface. This will ensure that the OEM firmware is present on both partitions
- Because of dual boot partitions, flashing via OEM interface is not supported
- Start a TFTP server and provide the initramfs image. Default settings:
- Router IP: 192.168.1.1
- TFTP server IP: 192.168.1.100
- TFTP file name: 7531.bin
- Open the device, connect UART and select " 1. System Load Linux to SDRAM via TFTP." during startup
- Adapt the settings to your environment, if required
- After initramfs is booted, flash the sysupgrade image
Return to OEM firmware:
- Run the following commands in OpenWrt to switch to the second partition
fw_setenv boot_part 2
fw_setenv bootimage 2
- Reboot the device. OEM firmware will start up again
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16067
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add support this boards to envtools config
This commit integrates the latest changes from new U-Boot, which includes important updates to the DTSI files for the Orange Pi R1 Plus and Orange Pi R1 Plus LTS boards.
Signed-off-by: Vyacheslav Ivanov <islavaivanov76@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16090
Signed-off-by: Robert Marko <robimarko@gmail.com>
Cambium Networks XE3-4 is a tri-radio Wi-Fi 6/6E 4×4/2×2 AP.
Hardware:
Model: Cambium Networks XE3-4
CPU: IPQ6010/AP-CP01-C3, SoC Version: 1.0 @ 800 MHz
Memory: 1 GiB
Flash: 512 MiB Macronix MX30UF2G18AC + W25Q128FW
Ethernet: 1x 1 GbE (QCA8072)
1x 2.5 GbE (QCA8081)
Buttons: 1x Reset
Serial: TX, RX, GND
Baudrate: 115200
Radios: Qualcomm Atheros IPQ6018 802.11ax - 2x2 - 2GHz
Qualcomm Atheros IPQ6018 802.11ax - 2x2 - 5GHz
Qualcomm Atheros QCN9074 802.11ax - 4x4 - 5GHz or 6GHz
BLE 4.1
Power: 32.0W 802.3bt5 PoE++
25.5W 802.3at with USB, BT disabled
Size: 215mm x 215mm
Ports: 1x USB 2.0
Antenna: 6 GHz: 6.29 dBi, Omni 30 dBm
5 GHz: 6.12 dBi, Omni 31 dBm
2.4 GHz: 4.85 dBi, Omni 29 dBm
LEDs: Multi-color status LEDs
Mounting: Wall, ceiling or T-bar
Installation: Serial connection
1. Open the AP to get access to the board. Connect RX, TX and GND.
2. Power on the AP, and short the CS pin of the SPI flash with
one of the APs GND pins.
3. Transfer the initramfs image with TFTP
(Default server IP is 192.168.0.120)
# tftpboot factory.ubi
4. Flash the rootfs partition
# flash rootfs
5. Reboot the AP
# reset
Signed-off-by: Kristian Skramstad <kristian+github@83.no>
Link: https://github.com/openwrt/openwrt/pull/15633
Signed-off-by: Robert Marko <robimarko@gmail.com>
Same as TP-Link TL-XDR608x, this router comes with locked vendor
loader. Add U-Boot build for replacement loader for this device.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/15930
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Huawei AP6010DN is a dual-band, dual-radio 802.11a/b/g/n 2x2 MIMO
enterprise access point with one Gigabit Ethernet port and PoE
support.
Hardware highlights:
- CPU: AR9344 SoC at 480MHz
- RAM: 128MB DDR2
- Flash: 32MB SPI-NOR
- Wi-Fi 2.4GHz: AR9344-internal radio
- Wi-Fi 5GHz: AR9580 PCIe WLAN SoC
- Ethernet: 10/100/1000 Mbps Ethernet through Atheros AR8035 PHY
- PoE: yes
- Standalone 12V/2A power input
- Serial console externally available through RJ45 port
- External watchdog: CAT706SVI (1.6s timeout)
Serial console:
9600n8 (9600 baud, no stop bits, no parity, 8 data bits)
MAC addresses:
Each device has 32 consecutive MAC addresses allocated by
the vendor, which don't overlap between devices.
This was confirmed with multiple devices with consecutive
serial numbers.
The MAC address range starts with the address on the label.
To be able to distinguish between the interfaces,
the following MAC address scheme is used:
- eth0 = label MAC
- radio0 (Wi-Fi 2.4GHz) = label MAC + 1
- radio1 (Wi-Fi 5GHz) = label MAC + 2
Installation:
0. Connect some sort of RJ45-to-USB adapter to "Console" port of the AP
1. Power up the AP
2. At prompt "Press f or F to stop Auto-Boot in 3 seconds",
do what they say.
Log in with default admin password "admin@huawei.com".
3. Boot the OpenWrt initramfs from TFTP using the hidden script "run ramboot".
Replace IP address as needed:
> setenv serverip 192.168.1.10
> setenv ipaddr 192.168.1.1
> setenv rambootfile openwrt-ath79-generic-huawei_ap6010dn-initramfs-kernel.bin
> saveenv
> run ramboot
4. Optional but recommended as the factory firmware cannot be downloaded publicly:
Back up contents of "firmware" partition using the web interface or ssh:
$ ssh root@192.168.1.1 cat /dev/mtd11 > huawei_ap6010dn_fw_backup.bin
5. Run sysupgrade using sysupgrade image. OpenWrt
shall boot from flash afterwards.
Return to factory firmware (using firmware upgrade package downloaded from non-public Huawei website):
1. Start a TFTP server in the directory where
the firmware upgrade package is located
2. Boot to u-boot as described above
3. Install firmware upgrade package and format the config partitions:
> update system FatAP6X10XN_SOMEVERSION.bin
> format_fs
Return to factory firmware (from previously created backup):
1. Copy over the firmware partition backup to /tmp,
for example using scp
2. Use sysupgrade with force to restore the backup:
sysupgrade -F huawei_ap6010dn_fw_backup.bin
3. Boot AP to U-Boot as described above
Quirks and known issues:
- The stock firmware has a semi dual boot concept where the primary
kernel uses a squashfs as root partition and the secondary kernel uses
an initramfs. This dual boot concept is circumvented on purpose to gain
more flash space and since the stock firmware's flash layout isn't
compatible with mtdsplit.
- The external watchdog's timeout of 1.6s is very hard to satisfy
during bootup. This is why the GPIO15 pin connected to the watchdog input
is configured directly in the LZMA loader to output the AHB_CLK/2 signal
which keeps the watchdog happy until the wdt-gpio kernel driver takes
over. Because it would also take too long to read the whole kernel image
from flash, the uImage header only includes the loader which then reads
the kernel image from flash after GPIO15 is configured.
Signed-off-by: Marco von Rosenberg <marcovr@selfnet.de>
Link: https://github.com/openwrt/openwrt/pull/15941
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 128 MB SPI-NAND
RAM: 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, Mesh
Power: DC 12V 1A
Gain telnet access:
1. Login into web interface, and download the configuration.
2. Decode and uncompress the configuration:
* Enter fakeroot if you are not login as root.
base64 -d e-xxxxxxxxxxxx-cfg.tar.gz | tar -zx
3. Edit 'etc/passwd', remove root password: 'root::1:0:99999:7:::'.
4. Edit 'etc/rc.local', insert telnetd command before 'exit 0':
( sleep 3s; /usr/sbin/telnetd; ) &
5. Repack the configuration:
tar -zc etc/ | base64 > e-xxxxxxxxxxxx-cfg.tar.gz
6. Upload new configuration via web interface, now you can connect to
ASR3000 via telnet.
Flash instructions:
1. Connect to ASR3000, backup everything, especially 'Factory' part.
2. Write new BL2:
mtd write openwrt-mediatek-filogic-abt_asr3000-preloader.bin BL2
3. Write new FIP:
mtd write openwrt-mediatek-filogic-abt_asr3000-bl31-uboot.fip FIP
4. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
5. Serve OpenWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After OpenWrt has booted, perform sysupgrade.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Link: https://github.com/openwrt/openwrt/pull/15887
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Use export_fitblk_bootdev() in /lib/upgrade/fit.sh instead of now
deprecated fitblk_get_bootdev() function. Include /lib/upgrade/fit.sh
instead of /lib/upgrade/common.sh to allow removing the function there.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This commit adds support for Asus RT-AX89X BX revision.
WARNING: Only the BX revision boards (So B1, B2 etc) are supported because
AX revision boards use IPQ8074 v1 SoC which is unsupported.
Specifications:
---------------
* CPU: Qualcomm IPQ8074A Quad core Cortex-A53 @ 2.2GHz
* RAM: 1024MB
* Storage: 256MB SLC NAND (Macronix MX30UF2G18AC)
* Ethernet:
* 5x 1G RJ45 ports via QCA8337 switch
* 3x 1G RJ45 ports via internal switch (QCA8075 PHY)
* 1x 10G RJ45 via internal switch (AQR113C PHY)
* 1x 10G SFP+ slot via internal switch
* WLAN:
* 2.4GHz 4x4
* 5GHz 8x8
* 8 external antennas
* USB: 2x USB 3.0 Type-A
* Buttons:
* Power switch
* WPS
* Reset
* Wireless ON/OFF
* LED ON/OFF
LED-s:
* Power
* Wi-Fi
* WAN
* 10G
* SFP+
Power:
* 19.5V via DC jack
Installation instructions:
--------------------------
1. Flash temporary OpenWrt initramfs:
* Flash openwrt-qualcommax-ipq807x-asus_rt-ax89x-initramfs-factory.trx
via the stock firmware.
Administration -> Firmware Upgrade -> Manual Firmware update (Upload)
After flashing the device will reboot with OpenWrt initramfs and it can
be accesed via any of the LAN ports via SSH with the usual OpenWrt
default credentials.
2. Sysupgrade from OpenWrt initramfs:
* Copy openwrt-qualcommax-ipq807x-asus_rt-ax89x-squashfs-sysupgrade.bin to
/tmp/openwrt-qualcommax-ipq807x-asus_rt-ax89x-squashfs-sysupgrade.bin of
the running initramfs image.
* Simply sysupgrade -n /tmp/openwrt-qualcommax-ipq807x-asus_rt-ax89x-squashfs-sysupgrade.bin
After flashing the device will reboot with OpenWrt initramfs and it can
be accesed via any of the LAN ports via SSH with the usual OpenWrt
default credentials.
Link: https://github.com/openwrt/openwrt/pull/15840
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit adds support for TP-LINK RE6000XD.
The device is quite similar to the Mercusys MR90X V1,
except only 3 LAN ports and more LEDs.
So thanks to csharper2005 for doing all the groundwork.
Device specification
--------------------
SoC Type: MediaTek MT7986BLA, Cortex-A53, 64-bit
RAM: MediaTek MT7986BLA (512MB)
Flash: SPI NAND GigaDevice (128 MB)
Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8)
Ethernet: 1x2.5Gbe (LAN3 2.5Gbps), 2xGbE (LAN 1Gbps, LAN1,
LAN2)
WLAN 2g: MediaTek MT7975N, b/g/n/ax, MIMO 4x4
WLAN 5g: MediaTek MT7975P(N), a/n/ac/ax, MIMO 4x4
LEDs: 8 LEDs, 1 status blue, 2x WIFI blue, 2x signal
blue/red, 3 LAN blue gpio-controlled
Button: 2 (Reset, WPS)
USB ports: No
Power: 12 VDC, 2 A
Connector: Barrel
Bootloader: Main U-Boot - U-Boot 2022.01-rc4. Additionally, ubi0
partition contain "seconduboot" (also U-Boot 2022.01-rc4)
Serial console (UART), unpopulated
---------------------
V
+-------+-------+-------+-------+
| +3.3V | GND | TX | RX |
+---+---+-------+-------+-------+
|
+--- Don't connect
Disassemble: rm the 2 screws at the bottom and the one at the backside.
un-clip the case starting at the edge above the LEDs.
Installation (UART)
-------------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
tftpboot openwrt-mediatek-filogic-tplink_re6000xd-initramfs-kernel.bin bootm
4. Run 'sysupgrade -n' with the sysupgrade OpenWrt image
Notice: while I was successfull at activating ssh (as described
here:
https://www.lisenet.com/2023/gaining-ssh-access-to-tp-link-re200-wi-fi-range-extender/)
Unfortunately I haven't found the correct root password.
Looks like they are using a static password
(md5crypt, salt + 21 characters) that is not the web
interface admin password.
The TP-LINK RE900XD looks like the very same device,
according to the pictures and the firmware.
But I haven't checked if the OpenWrt firmware works as well
on that device.
The second ubi partition (ubi1) is empty and there is no known
dual-partition mechanism, neither in u-boot nor in the stock firmware.
Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 128 MB SPI-NAND
RAM: 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, WPS/Mesh
Power: DC 12V 1A
Gain SSH access:
1. Login into web interface, and download the configuration.
2. Download the configration utilities:
https://firmware.download.immortalwrt.eu.org/cnsztl/mediatek/filogic/openwrt-mediatek-mt7981-nokia-ea0326gmp-config-utils.tar.gz
These binaries are extraced from the factory firmware, which are
dynamically linked with aarch64 musl 1.1.24. To use them, you
must run them under the same runtime environment, otherwise the
binaries will not work properly!
3. Upload the configuration and utilities to a suitable environment.
4. Uncompress the utilities, move them to '/bin' and give them executable permisison:
tar -zxf openwrt-mediatek-mt7981-nokia-ea0326gmp-config-utils.tar.gz
mv mkconfig seama /bin
chmod +x /bin/mkconfig
chmod +x /bin/seama
5. Decrypt and uncompress the configuration:
Enter fakeroot if you are not login as root.
mkconfig -a de-enca -m EA0326GMP_3FE79221BAAA -i EA0326GMP_3FE79221BAAA-xxxxxxxx-backup.tar.gz -o backup.tar.gz
tar -zxf backup.tar.gz
6. Edit 'etc/config/dropbear', set 'enable' to '1'.
7. Edit 'etc/passwd', remove root password: 'root::1:0:99999:7:::'.
8. Repack the configuration:
tar -zcf backup.tar.gz etc/
mkconfig -a enca -m EA0326GMP_3FE79221BAAA -i backup.tar.gz -o EA0326GMP_3FE79221BAAA-xxxxxxxx-backup.tar.gz
9. Upload new configuration via web interface, now you can SSH to EA0326GMP.
A minimum configuration which enabled SSH access is also provided
to simplify the process:
https://firmware.download.immortalwrt.eu.org/cnsztl/mediatek/filogic/openwrt-mediatek-mt7981-nokia-ea0326gmp-enable-ssh.tar.gz
Flash instructions:
1. SSH to EA0326GMP, backup everything, especially 'Factory' part.
2. Write new BL2:
mtd write openwrt-mediatek-filogic-nokia_ea0326gmp-preloader.bin BL2
3. Write new FIP:
mtd write openwrt-mediatek-filogic-nokia_ea0326gmp-bl31-uboot.fip FIP
4. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
5. Serve OpenWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After OpenWrt has booted, perform sysupgrade.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Dual-slot NAS based on Marvell Kirkwood.
Specifications:
- Marvell 88F6702 @1GHz
- 256Mb RAM
- 128Mb NAND
- 1x GbE LAN (Marvell 88E1318R)
- 1x USB 2.0
- 2x SATA
- Weltrend WT69P3 ("supervisor" MCU chip)
- Serial on J2 (115200,8n1)
- Newer bootROM so kwboot-ing via serial is possible
Notes:
- The Weltrend MCU is controlled by the package added in utils/dns320l-mcu.
- The original MAC address is stored in the "mini firmware" image's first
17 bytes.
- Compared to the original MTD layout, the uImage+rootfs are now stored in
a common ubi partition.
Installation:
1. Serial console
- Connect your levelshifter to the serial console
on J2 (refer to the wiki page for pinout)
2. Update u-boot
- Download the u-boot.kwb image for the device
- Powercycle the NAS
- Run "kwboot -b u-boot-dns320l/u-boot.kwb /dev/ttyUSB0 -p"
- Connect to the serial console with minicom
- tftp 0x0800000 u-boot-dns320l/u-boot.kwb
(Please note that "PHY reset timed out" seems to be customary
on kirkwood devices, the egiga0 interface works regardless.)
- nand erase 0x0 100000
- nand write 0x0800000 0x0 0x100000
- reset
3. Install OpenWrt
- Boot up the initramfs image
- tftpboot 0x800000 openwrt-kirkwood-generic-dlink_dns320l-initramfs-uImage; bootm 0x800000
- Download the sysupgrade image and perform sysupgrade
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
Reviewed-by: Pawel Dembicki <paweldembicki@gmail.com>
Dell/SonicWall APL26-0AE (marketed as SonicPoint ACe) is a dual band
wireless access point. End of life as of 2022-07-31.
Specification
SoC: QualcommAtheros QCA9550
RAM: 256 MB DDR2
Flash: 32 MB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
5 GHz 3T3R QCA9890 oversized Mini PCIe card
Ethernet: 2x 10/100/1000 Mbps QCA8334
port labeled lan1 is PoE capable (802.3at)
USB: 1x 2.0
LEDs: LEDs: 6x which 5 are GPIO controlled and two of them are dual color
Buttons: 2x GPIO controlled
Serial: RJ-45 port, SonicWall pinout
baud: 115200, parity: none, flow control: none
Before flashing, be sure to have a copy of factory firmware, in case You
wish to revert to original firmware.
All described procedures were done in following environment:
ROM Version: SonicROM (U-Boot) 8.0.0.0-11o
SafeMode Firmware Version: SonicOS 8.0.0.0-14o
Firmware Version: SonicOS 9.0.1.0
In case of other versions, following installation instructions might be
ineffective.
Installation
1. Prepare TFTP server with OpenWrt sysupgrade image and rename that
image to "sp_fw.bin".
2. Connect to one of LAN ports.
3. Connect to serial port.
4. Hold the reset button (small through hole on side of the unit),
power on the device and when prompted to stop autoboot, hit any key.
The held button can now be released.
5. Alter U-Boot environment with following commands:
setenv bootcmd bootm 0x9F110000
saveenv
6. Adjust "ipaddr" (access point, default is 192.168.1.1) and "serverip"
(TFTP server, default is 192.168.1.10) addresses in U-Boot
environment, then run following commands:
tftp 0x80060000 sp_fw.bin
erase 0x9F110000 +0x1EF0000
cp.b 0x80060000 0x9F110000 $filesize
7. After successful flashing, execute:
boot
8. The access point will boot to OpenWrt. Wait few minutes, until the
wrench LED will stop blinking, then it's ready for configuration.
Known issues
Initramfs image can't be bigger than specified kernel size, otherwise
bootloader will throw LZMA decompressing error. Switching to lzma-loader
should workaround that.
This device has Winbond 25Q256FVFG and doesn't have reliable reset, which
causes hang on reboot, thus broken-flash-reset needs to be added. This
property addition causes dispaly of "scary" warning on each boot, take
this warnig into consideration.
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
Add support for ELECOM WRC-X1800GS on uboot-envtools, to update
bootmenu_delay variable on sysupgrade.
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Common specifications:
* Mediatek MT7988A (4x Cortex-A73, up to 1.8 GHz clock speed)
* 8 GiB eMMC
* 2 GiB DDR4 RAM
* 1x 10000M/1000M/100M + 3x 1000M/100M/10M LAN ports
* MT7996 Tri-band (2.4G, 5G, 6G) 4T4R 802.11be Wi-Fi
* Airoha AG3352 GPS
* Renesas DA14531MOD Bluetooth
* 2 buttons (Reset, Mesh/WPS)
* uC-controlled RGB LED via I2C
* 2x LED for each 1G port, 3x LED for each 10G port
* USB 3.0 type A port
* 3.3V-level 115200 baud UART console via 4-pin Dupont connector
exposed at the bottom of the device
* USB-C PD power input
SDG-8733: 1x 10000M/1000M/100M WAN port
SDG-8734: 1x USXGMII/10GBase-R/5GBase-R/2500Base-X/1000Base-X/SGMII SFP+
Both models are also available in versions including 2x FXS POTS interfaces
for analog phones. Those interfaces are not supported by OpenWrt.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This commit adds support for Netgear Orbi Pro SXR80 and SXS80 (collectively known as SXK80)
Specifications:
---------------
* CPU: Qualcomm IPQ8074A Quad core Cortex-A53
* RAM: 1024MB
* Storage: SPI-NAND 512 MiB (Winbond W29N04GZ)
* Ethernet: 4x 1G RJ45 ports (QCA8075) 1x 2.5G RJ45 LAN/WAN (QCA8081)
* WLAN:
- 2.4 GHz: Qualcomm QCN5024 4x4
- 2x 5 GHz: Qualcomm QCN5054 4x4 (second radio high channels only)
* LEDs:
- Power: (Green and red)
- Front: (Blue, green, red and white)
* Buttons:
- 1x Soft reset
- 1x Sync/WPS
* Power: 12V DC Jack
Installation instructions (Telnet):
-----------------------------------
*Note, this guide assumes SXR80, for SXS80 change the firmware file name as appropriate
1. Put firmware file openwrt-qualcommax-ipq807x-netgear_sxr80-initramfs-uImage.itb in root of TFTP server available at 192.168.1.10.
2. Enable telnet by going to http://[ip of device]/debug.htm and clicking on the tickbox 'Enable telnet'
3. Telnet into the device and login using the same username and password as the web interface:
4. Run the following command:
`fw_setenv bootcmd 'env default -a; saveenv; reset'`
5. Reboot the router, once the web interface is available again re-enable telnet via http://[ip of device]/debug.htm and telnet into the device.
6. Run the following command:
`fw_printenv`
It should look similar to the below:
```
baudrate=115200
bootargs=console=ttyMSM0,115200n8
bootcmd=mii write 0x0 0x0 0x800; sleep 1; nmrp; bootdni; boot_DNI_secureboot
bootdelay=2
ipaddr=192.168.1.1
netmask=255.255.255.0
serverip=192.168.1.10
soc_version_major=2
soc_version_minor=0
```
**If you see the message:**
`Warning: Bad CRC, using default environment`
**DO NOT CONTINUE, YOU WILL BRICK YOUR DEVICE**
7. Run the following command:
`fw_setenv originalboot 'mii write 0x0 0x0 0x800; sleep 1; nmrp; bootdni; boot_DNI_secureboot'`
(This should match what's in the bootcmd variable displayed in step 6)
8. Run the following commands:
```
fw_setenv wrttftp 'mii write 0x0 0x0 0x800; sleep 1; nmrp; if tftpboot openwrt-qualcommax-ipq807x-netgear_sxr80-initramfs-uImage.itb; then bootm; fi; bootdni; boot_DNI_secureboot'
fw_setenv wrtboot 'mii write 0x0 0x0 0x800; sleep 1; nmrp; nand read 0x40000000 0x1980000 0x06d00000; bootm 0x40000000'
fw_setenv bootcmd 'run wrttftp'
```
9. Ensure SXR/S device is attached via ethernet (LAN port) to the same ethernet segment as the TFTP server.
10. Reboot the device, it should reboot into OpenWrt and be available on 192.168.1.1
11. Once OpenWrt has booted, update the bootcmd using the following command:
`fw_setenv bootcmd 'run wrtboot'`
12. Flash the sysupgrade image
13. It should boot into OpenWrt
References to SXK80 GPL source:
https://www.downloads.netgear.com/files/GPL/SXK80-V3.2.0.108_gpl_src.tar.bz2.zip
Signed-off-by: Flole Systems <flole@flole.de>
Signed-off-by: Andrew Smith <gul.code@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/14939
Signed-off-by: Robert Marko <robimarko@gmail.com>
Hardware specification:
========
SoC: Qualcomm IPQ8072A
Flash: 512MB (Fidelix FMND4G08S3J-ID)
RAM: 1GB (2x Kingston DDR3L D2516ECMDXGJD)
Ethernet: 1x 10/100/1000/2500/5000Mbps (Marvell AQR114C)
Ethernet: 4x 10/100/1000Mbps (Qualcomm QCA8075)
WiFi1: 6GHz ax 4x4 (Qualcomm QCN9024 + Skyworks SKY85784-11) - channels 33-229
WiFi2: 5GHz ax 4x4 (Qualcomm QCN5054 + Skyworks SKY85755-11) - channels 36-177
WiFi3: 2.4GHz ax 4x4 (Qualcomm QCN5024 + Skyworks SKY8340-11)
IoT: Bluetooth 5, Zigbee and Thread (NXP K32W041)
LED: 1x RGB status (NXP PCA9633)
USB: 1x USB 3.0
Button: WPS, Reset
Flash instructions:
========
1. Manually upgrade firmware using openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin image.
More details can be found here: https://www.linksys.com/support-article?articleNum=47547
After first boot check actual partition:
- fw_printenv -n boot_part
and install firmware on second partition using command in case of 2:
- mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin kernel
and in case of 1:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin alt_kernel
2. Installation using serial connection from OEM firmware (default login: root, password: admin):
- fw_printenv -n boot_part
In case of 2:
- flash_erase /dev/mtd21 0 0
- nandwrite -p /dev/mtd21 openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin
or in case of 1:
- flash_erase /dev/mtd23 0 0
- nandwrite -p /dev/mtd23 openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin
After first boot install firmware on second partition:
- mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin kernel
or:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin alt_kernel
3. Installation from initramfs image using USB drive:
Put the initramfs image on the USB drive:
- dd bs=1M if=openwrt-qualcommax-ipq807x-linksys_mx8500-initramfs-uImage.itb of=/dev/sda
Stop u-boot and run:
- usb start && usbboot $loadaddr 0 && bootm $loadaddr
Write firmware to the flash from initramfs:
- mtd -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin kernel
and:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin alt_kernel
4. Back to the OEM firmware:
- mtd -e kernel -n write FW_MX8500_1.0.11.208937_prod.img kernel
and:
- mtd -r -e alt_kernel -n write FW_MX8500_1.0.11.208937_prod.img alt_kernel
5. USB recovery:
Put the initramfs image on the USB:
- dd bs=1M if=openwrt-qualcommax-ipq807x-linksys_mx8500-initramfs-uImage.itb of=/dev/sda
Set u-boot env:
- fw_setenv bootusb 'usb start && usbboot $loadaddr 0 && bootm $loadaddr'
- fw_setenv bootcmd 'run bootusb; if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'
AQR firmware:
========
1. Firmware loading:
To properly load the firmware and initialize AQR PHY, we must use the u-boot aq_load_fw function.
To do this, you need to modify u-boot env:
With USB recovery:
- fw_setenv bootcmd 'aq_load_fw; run bootusb; if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'
and without:
- fw_setenv bootcmd 'aq_load_fw; if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'
2. Firmware updating:
Newer firmware (AQR-G4_v5.6.5-AQR_WNC_SAQA-L2_GT_ID45287_VER24005.cld) is available in the latest OEM firmware.
To load this firmware via u-boot, we need to add the MBN header and update 0:ethphyfw partition.
For MBN header we can use script from this repository: https://github.com/testuser7/aqr_mbn_tool
- python aqr_mbn_tool.py AQR-G4_v5.6.5-AQR_WNC_SAQA-L2_GT_ID45287_VER24005.cld
To update partition we need to install kmod-mtd-rw package first:
- insmod mtd-rw.ko i_want_a_brick=1
- mtd -e /dev/mtd26 -n write aqr_fw.mbn /dev/mtd26
Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/14883
Signed-off-by: Robert Marko <robimarko@gmail.com>
