The High-Speed SD mode stability issue should have been fixed.
Increase the MMC max-frequency to improve the IO speed. We can
still use the sysfs to limit the clock frequency, e.g.
root@OpenWrt:~# echo 25000000 > /sys/kernel/debug/mmc0/clock
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/18896
(cherry picked from commit 143cfd6113)
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Link: https://github.com/openwrt/openwrt/pull/20258
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
- Fix MMC bus IO voltage. The GPIO voltage of mt762x series SoCs
is fixed 3.3V. There are no visible registers that can control
the voltage level. Also add "no-1-8-v" property to indicate that
MMC controller doesn't support 1.8V IO.
- Drop useless property "enable-active-high". These dummy fixed
voltage regulators are not controlled by the GPIO. We don't need
to set the GPIO polarity.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/18886
(cherry picked from commit afdf88b9a1)
[rebased upon 24.10 branch]
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Link: https://github.com/openwrt/openwrt/pull/20258
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is a smart door lock device equipped with OpenWrt 14.07 OEM
modified version Qdwrt
The OEM has closed down, This commit is intended to maximize the
remaining value of these devices. It can flash OpenWrt to become
an AP
Specification:
- SoC: MediaTek MT7628NN
- Flash: 8 MB
- RAM: 64 MB
- Power: DC 5V - 25V
- Ethernet: 1 x RJ45 (10/100 Mbps)
- Wireless radio: 802.11n 2.4g-only
- On-Board LED:
Status 1: GPIO/43 active-low
Status 2: GPIO/44 active-low
Power: AlwaysOn
- Button:
WPS / RESET: GPIO/14 active-low
- Bluetooth: CC2541 via UART1 (ttyS1) and GPIO/26-29
- RFID: MF RC522 on I2C@28
- RTC: DS1339 on I2C@68
- Shell (via CON1 cable)
- LED (Swipe card area):
- Green GPIO/3 active-high
- Red GPIO/11 active-high
- Matrix keypad: (active-low)
GPIO/20 GPIO/21 GPIO/19 (Rows)
GPIO/24 1 2 3
GPIO/25 4 5 6
GPIO/22 7 8 9
GPIO/23 BACK 0 ENTER
(Cols)
- UART: 1 x UART on PCB - 57600 8N1
- GPIO Relay: GPIO/42 active-high
- GPIO Buzzer: GPIO/15 active-high
Warning:
The original firmware does not use the device tree.
This device tree is written based on the content of /sys/devices/platform
and has been tested
Note:
- On the device, matrix keypad rows actually are columns, and the columns actually are rows
- The key code of the CLEAR key of the matrix keypad is BACK in the original firmware.
Issue:
- No drivers in mainline kernel for RFID and Bluetooth.
Flash Instruction:
Using SSH/Telnet:
1. Connect the board to the computer via RJ45 Ethernet
2. Login 10.10.10.1 with root password "szqdingnet123" (SSH Port 22, Telnet Port 9900)
3. Download openwrt firmware on the computer.
4. Setup a http server on computer. And use wget download openwrt firmware from computer
5. Use command "mtd -r write openwrt-ramips-mt76x8-qding_qc202-squashfs-sysupgrade.bin firmware"
to flash
Using U-Boot WebUI:
1. Configure PC with a static IP address 10.10.10.2/24.
2. Open http://10.10.10.1
3. Use "mkqdimg -B qc202 -f openwrt-ramips-mt76x8-qding_qc202-squashfs-sysupgrade.bin" to
make image.
4. Upload factory.bin via U-Boot WebUI.
Original Firmware Dump / More details:
https://blog.gov.cooking/archives/research-qianding-smart-locker-and-flash.html
Original U-Boot firmware image tools:
https://gitlab.com/CoiaPrant/mkqdimg
Signed-off-by: Coia Prant <coiaprant@gmail.com>
Tested-by: Coia Prant <coiaprant@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17471
(cherry picked from commit b2f814fed4)
Link: https://github.com/openwrt/openwrt/pull/20159
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
After extracting the EEPROMs of different devices, only the 0x4 address is unique.
Use the 0x4 address as the LAN address, and the LAN+1 address as the WAN address.
Signed-off-by: Coia Prant <coiaprant@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20256
(cherry picked from commit c907c7c9b3)
Link: https://github.com/openwrt/openwrt/pull/20257
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
According to the MT7628 hardware datasheet:
- GPIO/4 was originally used for I2C, but is now used as the Modem Power.
- GPIO/5 was originally used for I2C, but is now used as the SIM card select. (n/a for this device)
- GPIO/6 was originally used for SPI CS1, but is now used as the Serial mode switch.
- GPIO/36 was originally used for PERST, but is now used as the GPS OE. (n/a for this device)
- GPIO/38 was originally used for WDT, but is now used as the Modem2 Power. (n/a for this device)
- GPIO/44 was used for WLED_AN, but is now controlled by `gpio-leds`.
Corrected pinctrl to ensure it works properly in the future.
Signed-off-by: Coia Prant <coiaprant@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20256
(cherry picked from commit 44c79d094f)
Link: https://github.com/openwrt/openwrt/pull/20257
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is an industrial 4G router equipped with OpenWrt SNAPSHOT OEM
customized version
WARNING: The original firmware device tree is modified from evb
boards, and the device tree name is evb board. This submitted device
tree is a modified version, which deletes the non-this-device parts
and adds GPIO watchdog.
Specification:
- SoC: MediaTek MT7628NN
- Flash: 16 MB
- RAM: 128 MB
- Power: DC 5V-36V 1.5A
- Ethernet: 1x WAN [slot not install], 1x LAN (10/100 Mbps)
- Wireless radio: 802.11n 2.4g-only [antenna not install]
- LED:
System/Power (RUN): GPIO/37 active-low
Modem: GPIO/3 active-low
RF (Modem Signal): GPIO/2 active-low
- Button:
WPS / RESET: GPIO/11 active-low
- UART: 1x UART on PCB - 115200 8N1
- Serial / COM: 1X RS232/RS485 on board (GPIO/6 hi:RS485 lo:RS232)
- GPIO Watchdog: GPIO/0 mode=toggle timeout=1s
- Modem: 1x Built-in modem on board (Power: GPIO/4 active-high)
- PCIe: 1x miniPCIe for modem [slot not install]
- SIM Slots: 1x SIM Slots
Issue:
- Factory partition not store mac address on original firmware
Flash instruction:
Using SSH/Telnet:
1. Connect the board to the computer via RJ45 Ethernet
2. Login 192.168.8.1 with root password "superzxmn" (SSH Port 22, Telnet Port 5188)
3. Download openwrt firmware on the computer.
4. Use scp or sftp put firmware to board /tmp
5. Use command "mtd -r write openwrt-ramips-mt76x8-hongdian_h7920-v40-squashfs-sysupgrade.bin firmware"
to flash
Original Firmware Dump / More details:
https://blog.gov.cooking/archives/research-hongdian-h7920-v40-and-flash.html
Signed-off-by: Coia Prant <coiaprant@gmail.com>
Tested-by: Coia Prant <coiaprant@gmail.com>
(cherry picked from commit ebee946227)
Link: https://github.com/openwrt/openwrt/pull/19716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Multiple users have reported a regression [1] in OpenWRT 24.10 with the
ramips/mt7621 target, which has the MT7530 PHYs: the Ethernet link is
periodically going down for a brief period of time:
mt7530-mdio mdio-bus:1f lan1: Link is Down
br-lan: port 1(lan1) entered disabled state
mt7530-mdio mdio-bus:1f lan1: Link is Up - 1Gbps/Full - flow control rx/tx
The symptoms stop after disabling EEE and it was reported by Mediatek in
2021 that EEE is unstable for the MT7530 PHYs [2]:
> EEE of the 10-year-old MT7530 internal gephy has many IOT problems, so
> it is recommended to disable its EEE.
EEE is enabled by default for these devices in OpenWRT 24.10 whereas in the
previous version (OpenWRT 23.05, Linux 5.15) it was not. It was determined
that in Linux 6.6, the PHY driver tries to disable EEE in
mtk_gephy_config_init() in drivers/net/phy/mediatek-ge.c, but this is later
overridden by a subsequent execution of the genphy_c45_write_eee_adv()
function, which enables every EEE mode supported.
The best way forward for now seems to be to mark EEE as broken directly in
the devicetree, which affects the genphy_c45_write_eee_adv() function.
There are some devices, like GnuBee GB-PC2, that define additional PHYs,
for example ethernet-phy@5 or ethernet-phy@7. As reported by Chester A.
Unal, these are not MT7530 PHYs and they are not affected.
This would need to be cherrypicked for the OpenWRT 24.10 branch.
[1] https://github.com/openwrt/openwrt/issues/17351
[2] https://lore.kernel.org/all/0adde34f936a2dafca40b06b408d82afe0852327.camel@mediatek.com/
Tested-by: Darren Tucker
Signed-off-by: Mateusz Jończyk <mat.jonczyk@o2.pl>
Closes: https://github.com/openwrt/openwrt/issues/17351
Link: https://github.com/openwrt/openwrt/pull/18585
(cherry picked from commit b7fa9d92ae)
Signed-off-by: Mateusz Jończyk <mat.jonczyk@o2.pl>
Tested-by: Mateusz Jończyk <mat.jonczyk@o2.pl>
Link: https://github.com/openwrt/openwrt/pull/19150
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The Arcadyan WE410443 is a WiFi AC access point distributed by various ISPs
under various names, including KPN SuperWifi and BT Whole Home Wi-Fi. It
features one ethernet port, dual MT7615N radios and four internal antennas.
Hardware:
- SoC: Mediatek MT7621AT
- Flash: 32 MB
- RAM: 128 MB
- Ethernet: 1x 10/100/1000 Mbps, built into the SoC
- WLAN: 2x MediaTek MT7615N
- Buttons: 1 Reset button, 1 WPS button
- LEDs: 1x Green, 1x Blue, 1x Red, all unmarked
- Power: 12 VDC, 1.5A barrel plug
Installation:
The bootloader is locked with a password, so the image needs to be written
directly to the SPI flash chip. To do this, you need to open up the case,
remove the heatsink and connect the flash chip to a Raspberry Pi. Use the
following connections:
Flash chip --> Raspberry Pi
VCC --> 3v3
RESET --> 3v3
/CS --> GPIO 8
DO --> GPIO 9
CLK --> GPIO 11
DI --> GPIO 10
GND --> Ground
You can solder wires to the flash chip, or use a SOIC16 clip. More details on
the Raspberry Pi and SPI chip pinouts are available on the wiki [1]
When you have the Raspberry Pi connected to the flash chip, boot your Pi and
follow the instructions:
1) Make sure your Pi has SPI enabled with sudo raspi-config
2) Install necessary tools: sudo apt install xxd libubootenv-tool mtd-utils
3) Upload overlay and execute:
sudo dtc -@ -I dts -O dtb -o
/boot/overlays/we410443.dtbo we410443-overlay.dts
4) Enable in /boot/firmware/config.txt by adding a new line containing
dtoverlay=we410443
5) Reboot your Pi and verify the mtd partitions with
cat /proc/mtd, you should see:
dev: size erasesize name
mtd0: 02000000 00001000 "all"
mtd1: 00030000 00001000 "u-boot"
mtd2: 00010000 00001000 "u-boot-env"
mtd3: 00010000 00001000 "factory"
mtd4: 01f60000 00001000 "firmware"
mtd5: 00010000 00001000 "glbcfg"
mtd6: 00010000 00001000 "config"
mtd7: 00010000 00001000 "glbcfg2"
mtd8: 00010000 00001000 "config2"
6) Optionally (but recommended), make a backup:
sudo dd if=/dev/mtd0 of=backup.bin
It can be restored with: sudo flashcp backup.bin /dev/mtd0
7) Set the variables for the bootloader:
echo '/dev/mtd2 0x0 0x1000 0x1000' > fw_env.config
sudo fw_setenv -c fw_env.config bootpartition 0
8) Finally, flash the image:
sudo flashcp openwrt-ramips-mt7621-arcadyan_we410443-
squashfs-sysupgrade.bin /dev/mtd4
MAC addresses
The label address is stored in ASCII in the config partition
Use --> Address
Device --> label
Ethernet --> label
WLAN 2g --> + 1
WLAN 5g --> + 2
References:
[1] https://openwrt.org/toh/arcadyan/astoria/we410443
Signed-off-by: Sander van Deijck <sander@vandeijck.com>
Link: https://github.com/openwrt/openwrt/pull/17981
(cherry picked from commit b6a07dd091)
Link: https://github.com/openwrt/openwrt/pull/19068
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Configure the i2c pins as GPIO outputs and use the i2c-gpio driver to
control the Semtech SX9512 touch controller.
This fixes spurious errors in i2c transactions even at 1kHz with the
native i2c driver.
leds green:wan: Setting an LED's brightness failed (-6)
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit f828be4d10)
Add the necessary package dependencies as well as device-tree properties
to support the touch-inputs as well as missing LEDs on the Genexis Pulse
EX400 range extender.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 49a1781d74)
The alternative model name does not need to be represented in the DTS.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit ff55daf1eb)
The Xiaomi MiWiFi 3A wireless router has a similar system architecture as the Xiaomi Mi 4A router, which is already officially supported by OpenWrt.
Product website: https://www.mi.com/miwifi3a
Device specification
--------------------
SoC: MT7628AN MIPS_24KEc @ 580 MHz 2.4G-bgn 2x2
WiFi: MT7612EN 5G-an, ac 80 MHz 2T2R
Flash: 16 MB
DRAM: 64 MB
Switch: MT7628AN (integrated in SoC)
Ethernet: 1 x 10 /100 Mbps
USB: None
Antennas: 2 x 2,4 GHz and 2 x 5 GHz (all are external and non-detachable)
LEDs: blue/red/amber
Buttons: Reset
Serial: 115200,8n1
MAC addresses as verified by OEM firmware:
------------------------------------------
use address source
LAN *:DD factory 0x28
WAN *:DD factory 0x28
2g *:DE factory 0x4
5g *:DF factory 0x8004
OEM firmware uses VLAN's to create the network interface for WAN and LAN.
Bootloader info:
----------------
The stock bootloader uses a "Dual ROM Partition System".
OS1 is a deep copy of OS2.
The bootloader starts OS2 by default.
To force start OS1 it is needed to set "flag_try_sys2_failed=1".
How to install:
---------------
1- Use OpenWRTInvasion to gain Telnet, SSH and FTP access: https://github.com/acecilia/OpenWRTInvasion
[IP: 192.168.31.1 | Username: root | Password: root | FTP-Port: 21]
2- Connect to router using telnet or ssh.
3- Backup all partitions. Use command "dd if=/dev/mtd0 of=/tmp/mtd0". Copy /tmp/mtd0 to computer using ftp.
4- Copy openwrt-ramips-mt76x8-xiaomi_miwifi-3a-squashfs-sysupgrade.bin to /tmp in router using ftp.
5- Enable UART access and change start image to OS1.
nvram set uart_en=1
nvram set flag_last_success=1
nvram set boot_wait=on
nvram set flag_try_sys2_failed=1
nvram commit
6- Erase OS1 & OS2 and install OpenWrt
mtd erase OS1
mtd erase OS2
mtd -r write /tmp/openwrt-ramips-mt76x8-xiaomi_miwifi-3a-squashfs-sysupgrade.bin OS1
Credits:
--------
This PR is based on the work of Zehao Zhang (Github: @ZZH-Finalize) that he had published in the PR: #15698
Signed-off-by: Olgun Demir <olgun.demir@mail.com.tr>
Link: https://github.com/openwrt/openwrt/pull/18427
(cherry picked from commit c3b8108a2b)
Link: https://github.com/openwrt/openwrt/pull/18550
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
According to the MT7620A hardware datasheet, GPIO/14 was originally used for RIN of UARTF, but is now used as the WPS LED.
Corrected pinctrl to ensure it works properly in the future.
Signed-off-by: Coia Prant <coiaprant@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18278
Link: https://github.com/openwrt/openwrt/pull/18279
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 612bedaf5b)
Since 24.10.0, eth0, used for the WAN interface, does not work. From dmesg:
...
[ 1.831126] mt7530-mdio mdio-bus:1f: MT7530 adapts as multi-chip module
[ 1.846204] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 19
...
[ 1.933969] mt7530-mdio mdio-bus:1f: MT7530 adapts as multi-chip module
[ 1.967668] mt7530-mdio mdio-bus:1f: configuring for fixed/rgmii link mode
[ 1.975999] mt7530-mdio mdio-bus:1f eth0 (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7530 PHY] (irq=21)
[ 1.986907] mt7530-mdio mdio-bus:1f: Link is Up - 1Gbps/Full - flow control rx/tx
[ 1.987149] mtk_soc_eth 1e100000.ethernet eth0: error -17 registering interface eth0
[ 2.004157] mt7530-mdio mdio-bus:1f eth1 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7530 PHY] (irq=22)
[ 2.017698] mtk_soc_eth 1e100000.ethernet eth0: entered promiscuous mode
[ 2.024849] DSA: tree 0 setup
...
[ 4.249680] mtk_soc_eth 1e100000.ethernet dsa: renamed from eth0
...
Like #15865, it seems that gmac0 does not rename eth0 to dsa until after the
switch ports are initialized, leading to a name collision (error -17 = EEXIST).
This patch follows #17062 by using openwrt,netdev-name to fix the collision.
Signed-off-by: J. S. Seldenthuis <jseldenthuis@lely.com>
Link: https://github.com/openwrt/openwrt/pull/18082
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 4fed462454)
The M1200 v1 is similar to the TR1200 series from Cudy. Differences:
- Only 1 LAN port
- No USB
Specifications:
- MT7628
- MT7628AN (2.4G b/g/n) and MT7613BE (5G ac/n) wifi
- 128 MB RAM
- 16 MB flash
MAC Addresses:
- There is one on the label, e.g. xx:xx:xx:xx:xx:A4
- LAN (bottom connector) is the same as the label, e.g. xx:xx:xx:xx:xx:A4
- WAN (top connector) is label + 1, e.g. xx:xx:xx:xx:xx:A5
- WLAN (2.4G) is the same as the label, e.g. xx:xx:xx:xx:xx:A4
- WLAN (5G) is label + 2, e.g. xx:xx:xx:xx:xx:A6
UART:
- is available via the pin holes on the board
- The pinout is printed to the board: P: VCC, G: GND, R: RX, T:TX
- RX and TX require solder bridges to be installed
- Do NOT connect VCC
- Settings: 3.3V, 115200, 8N1
GPIO:
- There are two LEDs: Red (GPIO 4) and White (GPIO 0)
- There are two buttons: Reset (GPIO 11) and WPS (GPIO 5)
Migration to OpenWrt:
- Download the migration image from the Cudy website (it should be available as soon as OpenWrt officially supports the device)
- Connect computer to LAN (bottom connector) and flash the migration image via OEM web interface
- OpenWrt is now accessible via 192.168.1.1
Revert back to OEM firmware:
- Set up a TFTP server on IP 192.168.1.88 and connect to the WAN port (upper port)
- Provide the Cudy firmware as recovery.bin in the TFTP server
- Press the reset button while powering on the device
- Recovery process is started now
- When recovery process is done, OEM firmware is accessible via 192.168.10.1 again
General information:
- No possibility to load a initramfs image via U-Boot because there is no option to interrupt U-Boot
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18233
(cherry picked from commit c13a050d5a)
Link: https://github.com/openwrt/openwrt/pull/18252
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The M1300 v2 is similar to the WR1300 series from Cudy. Differences:
- Only 1 LAN port
- No USB
Specifications:
- MT7621
- MT7603E (2.4G b/g/n) and MT7613BE (5G ac/n) wifi
- 128 MB RAM
- 16 MB flash
MAC Addresses:
- There is one on the label, e.g. xx:xx:xx:xx:xx:1C
- LAN (bottom connector) is the same as the label, e.g. xx:xx:xx:xx:xx:1C
- WAN (top connector) is label +2, e.g. xx:xx:xx:xx:xx:1E
- WLAN (2.4G) is the same as the label, e.g. xx:xx:xx:xx:xx:1C
- WLAN (5G) is the same as WAN, e.g. xx:xx:xx:xx:xx:1E
UART:
- is available via the pin holes on the board
- From inner to outer pin: TX, RX, GND, VCC
- Do NOT connect VCC
- Settings: 3.3V, 115200, 8N1
GPIO:
- There are two LEDs: Red (GPIO 3) and White (GPIO 4)
- There are two buttons: Reset (GPIO 8) and WPS (GPIO 10)
Migration to OpenWrt:
- Download the migration image from the Cudy website (it should be available as soon as OpenWrt officially supports the device)
- The migration image is also available here until a image is provided by Cudy: https://github.com/RolandoMagico/openwrt-build/releases/tag/M1300_Build_20240222
- File: openwrt-ramips-mt7621-cudy_m1300-v2-squashfs-flash-signed.bin
- Connect computer to LAN (bottom connector) and flash the migration image via OEM web interface
- In the migration image, LAN and WAN are swapped. Computer must be connected to the other port after flashing
- OpenWrt is now accessible via 192.168.1.1
- After flashing an up to date OpenWrt image, LAN and WAN settings are again the same as in the OEM firmware
- So use the other connector again
Revert back to OEM firmware:
- Set up a TFTP server on IP 192.168.1.88 and connect to the LAN port (lower port)
- Provide the Cudy firmware as recovery.bin in the TFTP server
- Press the reset button while powering on the device
- Recovery process is started now
- When recovery process is done, OEM firmware is accessible via 192.168.10.1 again
General information:
- No possibility to load a initramfs image via U-Boot because there is no option to interrupt U-Boot
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18139
(cherry picked from commit 8a78637670)
Link: https://github.com/openwrt/openwrt/pull/18204
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add support for Genexis Pulse EX400 / Inteno Pulse EX400. A branded
variant for the Finnish ISP DNA has already been added in fea2264d9f
(ramips: mt7621: Add DNA Valokuitu Plus EX400, 2023-07-31). This commit
adds support for the generic variants with Inteno and Genexis branding.
Inteno changed its name to Genexis and both brandings exist.
In terms of electronics, there is no difference between the DNA-branded
version and other brandings. LED markings on the case are different,
though. While the DNA-version has a "software-update" LED, the other
versions have a WPS LED. To reduce user confusion, create a separate
image.
Add the different device-tree with the different LED and rename things
to work the same way for both variants.
Specifications:
- Device: Genexis Pulse EX400 / Inteno Pulse EX400
- SoC: MT7621A
- Flash: 256 MB NAND
- RAM: 256 MB
- Ethernet: Built-in, 2 x 1 GbE
- Wifi: MT7603 2.4 GHz 2x2 MIMO, MT7615 5 GHz 4x4 MU-MIMO
- USB: 1x 2.0
- LEDs (GPIO): green/red status, green WPS
- LEDs (SX9512, unsupported): Broadband, Wi-Fi 2.4G, Wi-Fi 5G
- Buttons (GPIO): Reset
- Buttons (SX9512, unsupported): Wi-Fi 2.4G, Wi-Fi 5G, WPS
MAC addresses:
- LAN: U-Boot 'ethaddr' (label)
- WAN: label + 1
- 2.4 GHz: label + 6
- 5 GHz: label + 7
Serial:
There is a black block connector next to the red ethernet connector. It
is accessible also through holes in the casing.
Pinout (TTL 3.3V)
+---+---+
|Tx |Rx |
+---+---+
|Vcc|Gnd|
+---+---+
Firmware:
The vendor firmware is a fork of OpenWrt (Reboot) with a kernel version
4.4.93. The flash is arranged as below and there is a dual boot
mechanism alternating between rootfs_0 and rootfs_1.
+-------+------+------+-----------+-----------+
| | env1 | env2 | rootfs_0 | rootfs_1 |
| +------+------+-----------+-----------+
| | UBI volumes |
+-------+-------------------------------------+
|U-Boot | UBI |
+-------+-------------------------------------+
|mtd0 | mtd1 |
+-------+-------------------------------------+
| NAND |
+---------------------------------------------+
In OpenWrt rootfs_0 will be used as a boot partition that will contain the
kernel and the dtb. The squashfs rootfs and overlay are standard OpenWrt
behaviour.
+-------+------+------+-----------+--------+------------+
| | env1 | env2 | rootfs_0 | rootfs | rootfs_data|
| +------+------+-----------+--------+------------+
| | UBI volumes |
+-------+-----------------------------------------------+
|U-Boot | UBI |
+-------+-----------------------------------------------+
|mtd0 | mtd1 |
+-------+-----------------------------------------------+
| NAND |
+-------------------------------------------------------+
U-boot:
With proper serial access, booting can be halted to U-boot by pressing
any key. TFTP and flash writes are available, but only the first one has
been tested.
NOTE: Recovery mode can be accessed by holding down the reset button while
powering on the device. The led 'Update' will show a solid green light
once ready. A web server will be running at 192.168.1.1:80 and it will
allow flashing a firmware package. You can cycle between rootfs_0 and
rootfs_1 by pressing the reset button once.
Root password:
With the vendor web UI create a backup of your settings and download the
archive to your computer. Within the archive in the file
/etc/shadow replace the password hash for root with that of a password you
know. Restore the configuration with the vendor web UI and you will have
changed the root password.
SSH access:
You might need to enable the SSH service for LAN interface as by default
it's enabled for WAN only.
Installing OpenWrt:
With the vendor web UI, or from the U-Boot recovery UI, install the
OpenWrt factory image. Alternatively, ssh to the device and use
sysupgrade -n from cli.
Finalize by installing the OpenWrt sysupgrade image to get a fully
functioning system.
Reverting to the vendor firmware:
Boot with OpenWrt initramfs image
- Remove volumes rootfs_0, rootfs and rootfs_data and create vendor
volumes.
ubirmvol /dev/ubi0 -n 2
ubirmvol /dev/ubi0 -n 3
ubirmvol /dev/ubi0 -n 4
ubimkvol /dev/ubi0 -N rootfs_0 -S 990
ubimkvol /dev/ubi0 -N rootfs_1 -S 990
Power off and enter to the U-boot recovery to install the vendor
firmware.
Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>
Link: https://github.com/openwrt/openwrt/pull/17551
(cherry picked from commit 3e7337feea)
Link: https://github.com/openwrt/openwrt/pull/18238
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Move common definitions for DNA Valokuitu Plus EX400 to a dtsi include.
This is in preparation of adding the non-branded variant of the device
produced by Genexis / Inteno in the next commit. The device with DNA
branding differs in the LED labling on the device.
Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>
Link: https://github.com/openwrt/openwrt/pull/17551
(cherry picked from commit e8603f3b5a)
Link: https://github.com/openwrt/openwrt/pull/18238
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is an industrial 4G router equipped with OpenWrt 14.07 OEM
customized version
WARNING: The original firmware device tree is common to multiple
boards, and the device tree name is H9350. This submitted device
tree is a modified version, which deletes the non-this-device parts
and adds GPIO watchdog.
Specification:
- SoC: MediaTek MT7620A
- Flash: 16 MB
- RAM: 128 MB
- Power: DC 5V-36V 1.5A
- Ethernet: 1x WAN, 4x LAN (10/100 Mbps)
- Wireless radio: 802.11n 2.4g-only
- LED:
System/Power (RUN): GPIO/26 active-low
Ethernet: 1x WAN, 4x LAN
Modem 1: GPIO/66 active-low
RF 1 (Modem 1 Signal): GPIO/67 active-low
Modem 2: GPIO 71 active-low
RF 2 (Modem 2 Signal): GPIO/24 active-low
WLAN: GPIO/72 active-low
WPS: GPIO/12 active-low
- Button:
WPS / RESET: GPIO/34 active-low
- UART: 1x UART on PCB - 115200 8N1
- GPIO Watchdog: GPIO/62 mode=toggle timeout=1s
- PCIe: 2x miniPCIe for modem
- SIM Slots: 2x SIM Slots
Issue:
- No factory partition, eeprom is located
at /lib/firmware/mt7620a.eeprom
Flash instruction:
Using UART:
1. Configure PC with a static IP address and setup an TFTP server.
2. Put rootfs into the tftp directory.
3. Connect the UART line as described on the PCB.
4. Power up the device and press Ctrl+C to break auto boot.
5. Use `system 6` command and follow the instruction to set device
and tftp server IP address and input the rootfs file name.
U-boot will then load the rootfs and write it into
the flash.
6. Use `system 1` command and follow the instruction to set device
and tftp server IP address and input the firmware file name.
U-boot will then load the firmware once.
7. Login to LuCI and use LuCI upgrade firmware.
Original Firmware Dump / More details:
https://blog.gov.cooking/archives/research-hongdian-h8922-and-flash.html
Signed-off-by: Coia Prant <coiaprant@gmail.com>
Tested-by: Coia Prant <coiaprant@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17472
Link: https://github.com/openwrt/openwrt/pull/18221
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 6a1bdcf545)
Since commit f1c9afd801 ("ramips: mt7621-dts: mux phy0/4 to gmac1") the
USW-Flex lan1 port has been attached directly to the CPU. This improves
routing performance but hinders switching.
This is a generally accepted trade-off in that commit but for USW-Flex it
is a questionable choice. This switch is designed to deliver PoE to remote
places and using it as a router is unlikely. Meanwhile, the lan1 port is
also PoE-in and will often be the uplink, carrying most of the traffic.
Reverting f1c9afd801 for USW-Flex restores full 1 Gbps switching
performance on all ports.
Signed-off-by: Anders Melchiorsen <amelchio@nogoto.net>
Link: https://github.com/openwrt/openwrt/pull/17703
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 62872f8bfd)
There are only 5 devices in mt76x8 sub-target selected the MTK SDXC
driver package. And they are all single ethernet port routers or dev
boards:
* LinkIt Smart 7688
* Onion Omega2+
* RAVPower RP-WD009
* VoCore VoCore2
* VoCore VoCore2-Lite
For these devices, they are using the ephy p1 - p4 as the SDXC IO
pins. Therefore, these GPIO pads must be configured in "digital"
IO mode.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/17446
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit f5996ae947)
After adding the correct package and pin group configurations,
the SDXC card slot can now function properly.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/17446
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit cea4aae0a9)
The upstream mtk-sd driver did not perform specific timing
optimization for MT762x series SoC, hence the SDHC peripheral
of some boards cannot run at too high frequency. Reduce the
maximum clock frequency to fix the mmc read/write error.
Closes: https://github.com/openwrt/openwrt/issues/17364
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/17375
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit de0c143742)
The Zbtlink ZBT-WE2426-B is an indoor dual band WiFi router
with 4 external non detachable antennas and 5 Fast Ethernet ports.
Hardware of ZBT-WE2426-B:
- SoC: MT7628AN
- RAM: 64 MB (Winbond W9751G6K8-25)
- Storage: 8 MB SPI flash (S25FL064K)
- Ethernet: 5x 10/100 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
- Wireless: 2.4GHz: on SoC (802.11b/g/n)
- Wireless: 5GHz: Mediatek MT7612EN (802.11n/ac)
- LEDs: 8x
- Buttons: 1x reset
- USB: 1x 2.0
- MicroSD slot: 1x
- Power: 9 VDC, 1 A
- Uart: GND TX RX PWR - J1 on the PCB
- Board silkscreen: "ZBT-WE2426-C V04" "2018-02-28" "CTT" "13 18"
Backup the stock firmware, settings and calibration data:
This router comes with PandoraBox OpenWrt firmware, so it is
possible to get all MTD partitions using scp.
Installation:
- Using the bootloader web server. Hold the reset button while turning
the power on. Upload the sysupgrade image on http://192.168.1.1.
- Using the sysupgrade command in PandoraBox OpenWrt.
LEDs:
- LAN1,LAN2,LAN3,LAN4,WAN,WLAN2G use GPIO pins of the MT7628AN SoC
(GPIOs 43,42,41,40,39,44)
- WLAN5G uses pin of MT7612EN.
- The POWER LED is directly connected to the VCC. It can be reconnected to
the GPIO 37 of the MT7628AN SoC by resoldering SMD resistor on the PCB.
Buttons:
- The RESET button is connected to the GPIO 38 of the MT7628AN SoC.
MAC addresses as verified by OEM firmware:
use address source
2g *:b0 factory 0x4 (label)
5g *:b1 factory 0x8004
LAN *:b2 factory 0x28
WAN *:b3 factory 0x2e
Signed-off-by: Vaclav Svoboda <svoboda@neng.cz>
Link: https://github.com/openwrt/openwrt/pull/16927
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 3a9752ea02)
Link: https://github.com/openwrt/openwrt/pull/17097
Signed-off-by: Petr Štetiar <ynezz@true.cz>
What seems to be happening is that the kernel requests an ACTIVE_LOW
gpio initially and sets it to high later based on gpios in dts.
This seems to break some devices where the bootloader sets it to high.
Fixes: e612900ae0 ("ramips: mt7621: convert usb power to regulators")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16877
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit a7bc6bf7db)
Link: https://github.com/openwrt/openwrt/pull/17097
Signed-off-by: Petr Štetiar <ynezz@true.cz>
The OEM layout for Edgerouter X provides for two 3MB kernel slots.
As of linux 6.1 the kernel images no longer fit and as such
Edgerouter X builds have been disabled in Main.
Revise the layout to make kernel1 slot 6MB and drop kernel2 slot.
This patch applies the required changes to the dts file.
Signed-off-by: Tim Lunn <tim@feathertop.org>
Tested-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Link: https://github.com/openwrt/openwrt/pull/15194
(cherry picked from commit dc51c4355d)
Link: https://github.com/openwrt/openwrt/pull/17097
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Edgerouter X currently has its eth1 port on the switch missing since there
is a naming conflict currently.
So, as the root cause is mixing kernel support for DSA interfaces having
predictable names set via "label" property vs others having it assigned
dynamically lets avoid the conflict by using our own custom property as
suggested upstream [1].
So, add support via "openwrt,netdev-name" property and use it on ERX.
Fixes: 2a25c6ace8 ("ramips: get rid of downstream network device label patch")
Fixes: #15643
Link: https://github.com/openwrt/openwrt/pull/17062
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 5695267847)
It should be debounce-interval, as with the others.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16802
Signed-off-by: Robert Marko <robimarko@gmail.com>
It does the same thing minus a few dmesg prints.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16788
Signed-off-by: Robert Marko <robimarko@gmail.com>
The WiFi chips are actually on PCIe1 and PCIe2, PCIe0 is empty. Fix the
assignment so that WiFi works properly again.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
Link: https://github.com/openwrt/openwrt/pull/16807
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This converts all RT3662 and RT3883 devices to use interrupt based
gpio-keys instead of gpio-keys-polled. The poll-interval will be
removed.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/16764
Signed-off-by: Robert Marko <robimarko@gmail.com>
This converts all RT305x and RT5350 devices to use interrupt based
gpio-keys instead of gpio-keys-polled. The poll-interval will be
removed.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/16764
Signed-off-by: Robert Marko <robimarko@gmail.com>
This converts all RT2880 devices to use interrupt based gpio-keys
instead of gpio-keys-polled. The poll-interval will be removed.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/16764
Signed-off-by: Robert Marko <robimarko@gmail.com>
All other MT76x8 devices have already been migrated to gpio-keys.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/16764
Signed-off-by: Robert Marko <robimarko@gmail.com>
The Ralink GPIO driver supports irqchip function. Hence we need to
add "interrupt-parent" and "interrupt-controller" properties to make
sure it works properly. It is worth noting that all GPIO devices
share the same interrupt line.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/16764
Signed-off-by: Robert Marko <robimarko@gmail.com>
Mikrotik seems to prefer "hEX S" as general name for this model,
therefore include this in devicetree model name as well.
Signed-off-by: Priit Laes <plaes@plaes.org>
Link: https://github.com/openwrt/openwrt/pull/16658
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The Gemtek WVRTM-127ACN is an indoor dual band wifi router
with internal antennas and 3 Gigabit Ethernet ports.
The Gemtek WVRTM-130ACN is an indoor dual band wifi router
with external antennas and 5 Gigabit Ethernet ports.
Hardware of WVRTM-127ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB
- Storage: 128 MB NAND SLC flash
- Ethernet: 3x 10/100/1000 Mbps LAN1,LAN2 & WAN
- Wireless: 2.4GHz: Mediatek MT7603EN (802.11b/g/n)
- Wireless: 5GHz: Mediatek MT7612EN (802.11n/ac)
- LEDs: 11x
- Buttons: 2x WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ IN (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-127ACN_V02" "19K-513-8500R" "RoHS" "1717"
Hardware of WVRTM-130ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB (Kioxia TC58BVG0S3HTA00)
- Storage: 128 MB NAND SLC (Winbond W971GG6SB-25)
- Ethernet: 5x 10/100/1000 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
- Wireless: 2.4GHz and 5GHz Mediatek MT7615DN (802.11ac/b/g/n) (DBDC)
- LEDs: 10x
- Buttons: 3x Power, WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-130ACN_V01" "19K-515-4500R" "RoHS" "2112"
Enable access to uboot menu (needed in wvrtm-130acn):
- The access to uboot menu is blocked by `bootdelay = 0` set in ubootenv.
With stock firmware version 01.01.02.163 and previous, you can use CVE 2020-24365
command injection https://nvd.nist.gov/vuln/detail/CVE-2020-24365
python3 exploit.py -t 192.168.1.1 -c "fw_setenv bootdelay 3; fw_saveenv"
Backup the stock firmware:
- Connect via uart
- Connect via ethernet and assign your pc the address 192.168.15.x/24
- Power on the device; and start typing '4' to enter uboot menu
- Set factory mode and boot
MT7621 # setenv factory 2; saveenv
MT7621 # nand read 2800000 2000000 81000000; bootm
- Telnet and copy all mtd blocks
telnet 192.168.15.1
- Copy all mtd blocks and start webserver
for N in $(seq 0 6); do dd if=/dev/mtd$N of=/tmp/eeprom_mtd$N.bin; done
mount -o bind /tmp /www
lighttpd -f /etc/lighttpd.conf
- Backup stock rootfs_data (optional)
dd if=/dev/mtd7 of=/tmp/eeprom_mtd7.bin
dd if=/dev/mtd8 of=/tmp/eeprom_mtd8.bin
- Download to your pc from http://192.168.15.1/eeprom_mtd$N.bin
Installation:
- Connect via uart
- Connect via ethernet and assign your pc the address 10.10.10.3/24
- Start a tftp server and serve the image initramfs-kernel.bin
mkdir /tmp/ftpd;
cp initramfs-kernel.bin /tmp/ftpd/kernel.bin
dnsmasq --enable-tftp --tftp-root=/tmp/ftpd
- Power on the device; and start typing '4' to halt the bootloader
- Change the active mtd partition from mtd6 to mtd5 (needed by uboot)
MT7621 # setenv mtddevnum 5; saveenv
- Write the openwrt initramfs in ram via tftp and boot it
MT7621 # tftpboot 81000000 kernel.bin; bootm
- From the initramfs create the ubi device and install openwrt via sysupgrade
ubiformat /dev/mtd11 -y
sysupgrade -n -v /tmp/sysupgrade.bin
Recovery:
Restore the stock firmware from the backup of the mtd blocks
mtd write eeprom_mtd5.bin firmware
mtd write eeprom_mtd6.bin Kernel2
mtd write eeprom_mtd7.bin Storage1
mtd write eeprom_mtd8.bin Storage2
ubiformat /dev/mtd8 -y
reboot
Links to previous works on wvrtm-127acn:
https://github.com/digiampietro/hacking-gemtekhttps://forum.openwrt.org/t/add-support-for-gemtek-wvrtm-127acn-linkem-provider/168757
Signed-off-by: Samuele Longhi <agave@dracaena.it>
Link: https://github.com/openwrt/openwrt/pull/16685
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
73a9f9f857 added support. Let's use it.
Calibration data is not yet supported.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16256
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
