Specification:
* CPU: MediaTek MT7628AN (580 MHz)
* Flash: GigaDevice GD25Q128CSIG (16 MiB)
* RAM: Winbond W9751G6KB-25 (64 MiB)
WikiDevi page: <https://wikidevi.wi-cat.ru/Keenetic_City_(KN-1510)>
How to flash:
* Configure TFTP server with IP address 192.168.1.2/24
* Serve OpenWrt factory image as "KN-1510_recovery.bin"
* Connect the PC to router's LAN port, hold the reset button and power
the router up. When the power LED starts blinking release the
button.
The same instructions apply to OEM firmware, except one can take it
from osvault.keenetic.net
Signed-off-by: Ivan Davydov <lotigara@lotigara.ru>
Link: https://github.com/openwrt/openwrt/pull/22404
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
EDUP EP-RT2983 comes with a factory installed version of OpenWrt 23.05
with device name "netis,n6".
Specification
--------------
- SoC : MediaTek MT7621AT, MIPS, 880 MHz
- RAM : 256 MiB
- Flash : NAND 128 MiB (Toshiba)
- WLAN : MT7905DAN + MT7975DN
- 2.4 GHz : b/g/n/ax, 574 Mbps, MIMO 2x2
- 5 GHz : a/n/ac/ax, 1201 Mbps, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x4 (1x WAN, 3x LAN)
- UART : 3.3V, 115200n8
- Buttons : 1x Reset
1x WPS
- LEDs : 1x Power (green)
1x WiFi (green)
1x Mesh/WPS (green); flashing green during boot
3x LAN (green)
1x WAN (green); flashing red during upgrade and failsafe
- Power : 12 VDC 1A
Installation
-------------
1. Log in to LuCI
2. Go to System, Backup / Flash Firmware
3. If desired, backup the current system by saving (all) the mtdblock
contents.
4. Flash new firmware image, select Flash image.
5. Browse and select the sysupgrade file
"openwrt-*-ramips-mt7621-edup_ep-rt2983-squashfs-sysupgrade.bin"
and then Upload.
6. Unselect "Keep settings and retain the current configuration"
Note: All settings will be reset to default. WiFi is not enabled by
default so a connection via Ethernet is necessary to log in and set up.
7. Allow "Force upgrade" (tick the box if there is one), or press Continue
if there is no box to tick. This is because the name is now
"edup,ep-rt2983" as it should have been from the start.
8. Proceed to flash. Wait for reboot and keep power connected.
9. After reboot, default address to access LuCI is 192.168.1.1 with
no password
Recovery (UART)
----------------
1. Remove the 4 screws on the bottom and pry open the cover.
2. Connect serial adapter to the unpopulated serial header pins
TX, RX, GND near the WPS button. Do not connect VCC.
3. Start serial terminal (e.g. minicom, screen, etc) on the computer and
turn on the router.
4. As prompted, hit any key to stop autoboot.
5. Enter 2 to select "2. Upgrade firmware"
6. Enter 0 to select "0 - TFTP client (Default)"
7. Accept the defaults by pressing Enter for
"Input U-Boot's IP address: 192.168.1.1",
"TFTP server's IP address: 192.168.1.2",
"Input IP netmask: 255.255.255.0"
8. Assign your PC's Ethernet port a static IP 192.168.1.2 with netmask
255.255.255.0 and connect to a LAN port on the router using the
Ethernet cable. Disconnect all other network connections (e.g. WiFi) on
the computer.
9. Serve the factory image
"openwrt-*-ramips-mt7621-edup_ep-rt2983-squashfs-factory.bin" using
a TFTP server, e.g. tftpd64. For convenience, the filename can be renamed
to something shorter.
10. In the serial terminal, when prompted "Input file name:", enter the
filename from the previous step and press Enter.
11. The factory image will be flashed as indicated. Wait for reboot.
MAC addresses prototype
------------------------
+---------+---------------------+
| | MAC example |
+---------+---------------------+
| LAN | CC:D8:1F:47:xx:yy |
| WAN | CC:D8:1F:47:xx:yy+1 |
| WLAN 2G | CC:D8:1F:17:xx:yy+2 |
| WLAN 5G | CC:D8:1F:77:xx:yy+2 |
+---------+---------------------+
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/22197
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This adds support for the Wavlink "Halo Base Pro".
SOC: MT7621DAT
RAM: 128MiB
Flash: 16MiB NOR
WiFi: MT7603EN + MT7613BEN
Buttons:
- The touch sensor was originally for WPS, but this has been moved to the
pair button which is no longer used to prevent accidental touches
LEDs:
- On original firmware, the status LEDs light up as follows:
- Purple = booting, Blue = working, Red = error
Partitions:
- factory contains unique WiFi EEPROM and default MAC addresses
- vendor partition has an unknown purpose
Stock MAC address allocation:
- LAN1: xx:xx:xx:xx:xx:80
- LAN2/WAN: xx:xx:xx:xx:xx:81
- WiFi 2.4G: xx:xx:xx:xx:xx:82
- WiFi 5G: xx:xx:xx:xx:xx:83
LAN Ports:
- lan1 is the normal white LAN port
- lan2 is labelled "LAN/Backhaul", which can either be LAN or WAN.
- Since this device is intended to be part of a mesh, this will usually
be a LAN port, hence why it's assigned to lan2 here
Notes:
- I've chosen "Halo Base Pro" as the device model, despite the website URL
showing WL-WN535M3, as the label only states "Halo Base Pro".
- Only the 5GHz WiFi address is labelled on the device
Signed-off-by: William Latter <williamlatter77@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22400
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for Z-ROUTER ZR-2662 (also known as Routerich
AX1800 V2) wireless WiFi 6 router.
Hardware specification
---------------------
- SoC : MediaTek MT7621AT, MIPS, 880 MHz
- RAM : 256 MiB
- Flash : NAND 128 MiB (AMD/Spansion S34ML01G2)
- WLAN :
- 2.4 GHz : MediaTek MT7905D/MT7975 (14c3:7916), b/g/n/ax, MIMO 2x2
- 5 GHz : MediaTek MT7915E (14c3:7915), a/n/ac/ax, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x4 (1x WAN, 3x LAN)
- USB : 1x 2.0
- UART : 3.3V, 115200n8, pins are silkscreened on the pcb
- Buttons : 1x Reset
- LEDs : 1x WiFi 2.4 GHz (green)
1x WiFi 5 GHz (green)
1x LAN (green)
1x WAN (green)
1x WAN no-internet (red)
- Power : 12 VDC, 1 A
Installation
------------
1. Run tftp server on your PC (IP: 192.168.2.2) and put OpenWrt initramfs
image (initramfs.bin) to the tftp root dir
2. Open the following link in the browser to enable telnet:
http://192.168.2.1/cgi-bin/telnet_ssh
3. Connect to the router (default IP: 192.168.2.1) using telnet shell
(credentials - user:admin)
4. Run the following commands in the telnet shell (this will install
OpenWrt initramfs image on nand flash):
cd /tmp
tftp -g -r initramfs.bin 192.168.2.2
mtd write initramfs.bin firmware
mtd erase firmware_backup
reboot
5. Copy OpenWrt sysupgrade image (sysupgrade.bin) to the /tmp dir of the
router
6. Connect to the router (IP: 192.168.1.1) using ssh shell and run
sysupgrade command:
sysupgrade -n /tmp/sysupgrade.bin
Return to stock
---------------
1. Copy stock firmware (stock.bin) to the /tmp dir of the router using scp
2. Run following command in the router shell:
cd /tmp
mtd write stock.bin firmware
reboot
Recovery
--------
Connect uart (pins are silkscreened on the pcb), interrupt boot process by
pressing any key, use u-boot menu to flash stock firmware image or OpenWrt
initramfs image.
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 24:0f:5e:xx:xx:4c | label |
| WAN | 24:0f:5e:xx:xx:4d | label+1 |
| WLAN 2g | 24:0f:5e:xx:xx:4e | label+2 |
| WLAN 5g | 24:0f:5e:xx:xx:4f | label+3 |
+---------+-------------------+-----------+
The WLAN 2.4 MAC was found in 'factory', 0x4
The LAN MAC was found in 'factory', 0xfff4
The WAN MAC was found in 'factory', 0xfffa
Note: This device is similar to Z-ROUTER ZR-2660, but with minor hardware
revisions. The firmware and configuration are compatible.
Signed-off-by: xingchi <juncaixingchi2026@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21524
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware:
- SoC: MediaTek MT7628AN (MIPS 580MHz)
- Flash: 16 MiB NOR
- RAM: 64 MiB DDR2
- WLAN: 2.4 GHz (MT7628)
- Ethernet: 1x 10/100 Mbps WAN/LAN, 1x 10/100 LAN (MT7628)
- Build-in LTE Modem: MeigLink SLM770A
4G Cat. 4 (150/50 Mbps)
- Buttons: 1x Reset, 1x wps
- LEDs: Front: 1x Red, 1x White,
Back: 3x White 4G signal strengh
- Serial console: unpopulated header, 115200 8n1
- Power: USB-C
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| WAN | 80:af:ca:xx:xx:x1 | label+1 |
| LAN | 80:af:ca:xx:xx:x0 | label |
| WLAN 2g | 80:af:ca:xx:xx:x2 | label+2 |
+---------+-------------------+-----------+
Migration to OpenWrt:
- Download the RSA signed intermediate firmware from the Cudy website:
`openwrt-ramips-mt76x8-cudy_lt300-v3-squashfs-flash.bin`
- Connect computer to LAN and flash the intermediate firmware via OEM web interface
- OpenWrt is now accessible via 192.168.1.1
Revert back to OEM firmware:
- Set up a TFTP server on IP 192.168.1.88 and connect to the WAN port (upper port)
- Provide the Cudy firmware as recovery.bin in the TFTP server
- Press the reset button while powering on the device
- Recovery process is started now
- When recovery process is done, OEM firmware is accessible via 192.168.10.1 again
General information:
- No possibility to load a initramfs image via U-Boot because there is no option to interrupt U-Boot
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21982
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The kernel load address was changed in commit e2d823d06830 ("ramips:
fix LZMA decompression error for TP-Link EAP615-Wall"). We also need
to relocate the load address for initramfs image so that it can be
booted correctly.
Fixes: e2d823d06830 ("ramips: fix LZMA decompression error for TP-Link EAP615-Wall")
Fixes: https://github.com/openwrt/openwrt/issues/22505
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/22562
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Mikrotik RBM33G has got a USB-A port and mPCIe slots with USB 3.0 and USB
2.0 interfaces in use. The MediaTek MT7621 SoC has got an xHCI to provide
these interfaces. Therefore, enable kmod-usb3 to support them.
Fixes: 5684d087418d ("ramips: Add support for Mikrotik RouterBOARD RBM33g")
Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
The D-Link DIR-1360 A1 is an AC1300 router based on the MT7621AT SoC.
Specifications :-
* SoC: MediaTek MT7621AT
* RAM: 256 MB DDR3
* Flash: 128 MB SPI NAND (Winbond W29N01HV)
* WiFi: MT7615D (2.4 GHz + 5 GHz DBDC)
* Ethernet: 5x 10/100/1000 Mbps (1x WAN, 4x LAN)
* USB: 1x USB 3.0
* Buttons: Reset, WPS
* LEDs: Power (White/Orange), Internet (White/Orange), USB, 2.4G/5G WLAN
MAC addresses are retrieved from the 'factory' partition via NVMEM.
LAN: 0xe000 (gmac0)
WAN: 0xe006 (gmac1)
WLAN: 0xe00c (pcie0)
Flash Instruction :-
1-Set a static IP on your PC (e.g., 192.168.0.10, Gateway 192.168.0.1).
2- Power off the router and connect your PC to a LAN port.
3- Hold the Reset button and power on the router; continue holding for 5 seconds.
4- Access the Recovery UI at http://192.168.0.1 in your browser.
5- Upload the OpenWrt factory.bin image and wait for the reboot.
With these definitions in place, the DIR-1360 A1 boots reliably, exposes all hardware features correctly, and can be flashed via both the OEM recovery interface and standard OpenWrt upgrade paths.
Signed-off-by: Aryaman Srivastava <aryamansrivastava895@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21616
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for the Cudy LT400E v1,
an indoor 4G/LTE WiFi router.
It has 4x10/100 Mbps Ethernet ports, a 2.4 GHz radio,
and a Quectel 4G/LTE EC200A modem.
Hardware:
SoC: MediaTek MT7628NN
Flash: 8 MiB SPI
RAM: 64 MiB
Ethernet: 4x10/100 Mbps
WiFi: 2.4 GHz (embedded MT7628, 802.11n)
WWAN: Quectel EC200A-EL 4G/LTE Cat 4 modem
SIM: nano-SIM slot
Buttons: 1 Reset button, 1 WPS button
LEDs: 10x (blue)
Power: 12 V DC barrel jack
Installation:
The stock firmware is a customized variant of OpenWrt, which implements
a signature check that only allows flashing official firmware. Cudy
offers, on their website [1][6], intermediate OpenWrt firmware images
which do not implement the signature check. After flashing the
intermediate image, the upstream (i.e., official) OpenWrt image can be
installed. See the device's entry in OpenWrt's Wiki for more details [2].
Cellular network:
The Quectel EC200A modem is internally connected to the SoC via USB, and
operates in ECM mode, supported by the CDC Ether driver [3]. When
inserting a SIM card in the slot, if no PIN is needed, the network
interface "usb0" is brought up and the cellular connection works out of
the box. To interact with the modem directly (unlock the PIN, change APN
and PDP settings, etc.), AT commands can be sent with picocom to serial
port /dev/ttyUSB2 [4].
Recovery:
The stock firmware can be recovered via TFTP, as the bootloader (based
on U-Boot) implements a recovery client. Set up a TFTP server on your
computer with IP 192.168.88.1/24 serving the stock firmware from Cudy's
website renamed to "recovery.bin". Press the Reset button (keep it
pressed), power on the device, wait for the TFTP server to send the
recovery.bin file, then release the Reset button. The router will take a
couple of minutes to reboot and set up the stock firmware. See the
device's entry in OpenWrt's Wiki for more details [2].
Discussion:
Use the dedicated thread in OpenWrt's forum to discuss any aspects [5].
Acknowledgments:
The code to support this device is largely based on the sources kindly
provided by Cudy in compliance with the GPL license. Thanks for
supporting the OpenWrt community.
Links:
[1] https://www.cudy.com/blogs/faq/openwrt-software-download
[2] https://openwrt.org/toh/cudy/lt400e_v1
[3] https://openwrt.org/docs/guide-user/network/wan/wwan/ethernetoverusb_cdc
[4] https://openwrt.org/docs/guide-user/network/wan/wwan/at_commands
[5] https://forum.openwrt.org/t/242466
[6] https://drive.google.com/drive/folders/1BKVarlwlNxf7uJUtRhuMGUqeCa5KpMnj
Co-authored-by: rogerpueyo <roger.pueyo@guifi.net>
Signed-off-by: Kamil Jońca <kjonca@onet.pl>
Link: https://github.com/openwrt/openwrt/pull/21246
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This PR doesn't change anything other than fixing the alphabetical order of some Cudy devices
(R700 and c200p)
Signed-off-by: Marcin Leksmark <lexmark3200@wp.pl>
Link: https://github.com/openwrt/openwrt/pull/21044
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for the Teltonika RUT976, part
of the RUTE series, which is very similar to the RUT956.
The RUT976 now has a 5G modem and the flash size has doubled.
Specification:
- MediaTek MT7628AN SoC
- 128 MB RAM
- 32MB Flash
- 4x 10/100 Mbps Ethernet, with passive PoE support on LAN1
- MediaTek MT7628AN 2.4 GHz 802.11n WiFi
- Quectel RG255C 5G modem
- GNSS
- RS232, DB9 connector, Cypress ACM via USB, /dev/ttyACM0
- RS485 /dev/ttyS1
- microSD card slot
- 2.0 USB Type-A HOST port
- analog 0-24V input (MCP3221)
- Relay
- 2x Digital input
- 2x Digital output
- 2x SIM slot (can be swapped via GPIO)
- eSIM (depends on hardware configuration, can be swapped via GPIO)
GPIO:
- 1 button (Reset)
- 7 LEDs (power, status green/red, RSSI 1,2,3,4,5)
- 5 Modem control (power button, reset, status, SIM select, eSIM select)
- 2 Digital input
- 2 Digital output
- 1 Isolated input
- 1 RS485 tx enable
- 1 RS485 rx enable
- 1 Relay
- 1 Data Carrier Detect (DCD)
Flashing via OEM WebUI:
1. Download the firmware image *-squashfs-factory.bin
2. Upload firmware image via OEM WebUI firmware update, do not keep settings
To revert back to OEM firmware:
https://wiki.teltonika-networks.com/view/Bootloader_menu
Mobile data connection:
Create proto qmi interface.
Signed-off-by: Til Kaiser <mail@tk154.de>
Link: https://github.com/openwrt/openwrt/pull/20933
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is an industrial 4G router equipped with OpenWrt SNAPSHOT OEM
customized version
WARNING: The original firmware device tree is modified from evb
boards, and the device tree name is evb board. This submitted device
tree is a modified version, which deletes the non-this-device parts
and adds GPIO watchdog.
Specification:
- SoC: MediaTek MT7628DAN
- Flash: 16 MB
- RAM: 64 MB
- Power: DC 5V-36V 1.5A
- Ethernet: 1x WAN/LAN, 3x LAN (10/100 Mbps)
- Wireless radio: 802.11n 2.4g-only
- LED:
System/Power (PWR): Always Off
Modem (NET): GPIO/3 active-low
LAN: Always On
RF (Modem Signal): GPIO/2 active-low
WIFI: GPIO/44 active-low
- Button:
WPS / RESET: GPIO/11 active-low
- UART: 1x UART on PCB - 115200 8N1
- GPIO Watchdog: GPIO/0 mode=toggle timeout=1s
- Modem: 1x Built-in modem on board (Power: GPIO/4 active-high)
- SIM Slots: 1x SIM Slots
Issue:
- Factory partition not store mac address on original firmware
Flash instruction:
Using TTL:
1. Connect the board to the computer via TTL.
2. Enter original firmware failsafe mode.
3. Use wget download firmware to board /tmp
4. Use command "mtd -r write openwrt-ramips-mt76x8-hongdian_h8850-v20-squashfs-sysupgrade.bin firmware"
to flash
Original Firmware Dump / More details:
https://blog.gov.cooking/archives/research-hongdian-h8850-v20-and-flash.html
Signed-off-by: Coia Prant <coiaprant@gmail.com>
Tested-by: Coia Prant <coiaprant@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20259
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This patch adds support for D-Link DIR-2660 A2.
Based on the commit: https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=b5dd746cbb1aaf91f4b68e9f3eda97413550d904,
Both devices look identical, except for the A1/A2 designation.
You can safely install the A1 firmware for the A2 – I've been testing it for several months as a DUMB AP – without any problems.
Specifications:
* SoC: MediaTek MT7621AT
* RAM: 256 MB (DDR3)
* Flash: 128 MB (NAND)
* WiFi: MediaTek MT7615N (x2)
* Switch: 1 WAN, 4 LAN (Gigabit)
* Ports: 1 USB 2.0, 1 USB 3.0
* Buttons: Reset, WPS
* LEDs: Power (white/orange), Internet (white/orange), WiFi 2.4G (white),
WiFi 5G (white), USB 3.0 (white), USB 2.0 (white)
Notes:
* WiFi 2.4G and WiFi 5G LEDs are wired directly to the wireless chips
Installation:
* D-Link Recovery GUI: power down the router, press and hold the reset
button, then re-plug it. Keep the reset button pressed until the power
LED starts flashing orange, manually assign a static IP address under
the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1
* Some modern browsers may have problems flashing via the Recovery GUI,
if that occurs consider uploading the firmware through cURL:
curl -v -i -F "firmware=@file.bin" 192.168.0.1
Signed-off-by: Marcin Leksmark <lexmark3200@wp.pl>
Link: https://github.com/openwrt/openwrt/pull/20020
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
According to the TP-Link websites the Archer C50 v6 EU is the same model
as the Archer A5 v6 EU. Installation method is the same as the C50 v6, as
they are basically the same hardware.
The commit is based on e9ac1b1.
Signed-off-by: David Senoner <seda18@rolmail.net>
After investigating the EAP235-Wall u-boot GPL code, it was found that
the u-boot of this device directly loads the kernel from the SPI NOR
Flash direct access address. However, due to hardware limitation, MT7621
can only remap the first 4MiB Flash. Excluding some partitions before
the kernel, this device can only boot kernels smaller than 0x360000.
This means that unless you install a modified bootloader, the mainline
OpenWrt will no longer work on this model.
Closes: https://github.com/openwrt/openwrt/issues/20500
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/20509
Signed-off-by: Robert Marko <robimarko@gmail.com>
EDUP EP-RT2960S has the similar hardware design as the SIMAX1800T.
The main difference is the arrangement of the GPIO pins
and the location of the MAC address.
Specification
-------------
- SoC : Mediatek MT7621
- RAM : 256 MiB DDR3
- Flash : 128 MiB NAND Flash
- WLAN : Mediatek MT7905 DBDC
- 2.4 GHz : 2x2 MIMO WiFi6
- 5 GHz : 2x2 MIMO WiFi6
- Ethernet : MT7621 built-in 10/100/1000 Mbps 1x WAN; 3x LAN
- UART : 3.3V, 115200n8
- Buttons : 1x RESET; 1x WPS/MESH
- LEDs : 1x Multi-Color(Blue;Green;Red)
- Power : DC 12V1A
- CMIIT ID : 2022AP7163
- TFTP IP :
- server : 192.168.1.254
- router : 192.168.1.28
TFTP Installation(recommend)
------------
1. Set local tftp server IP "192.168.1.254" and NetMask "255.255.255.0".
2. Rename initramfs-kernel.bin to "factory.bin" and put it in the root
directory of the tftp server. tftpd64 is a good choice for Windows.
3. Remove all Ethernet cables and WiFi connections from the PC, except
for the one connected to the EDUP EP-RT2960S. Start the TFTP server, plug
in the power adapter and wait for the OpenWrt system to boot.
4. Backup "firmware" partition and rename it to "firmware.bin". We need
it to back to the stock firmware.
5. Use "fw_printenv" command to list envs. If "firmware_select=2" is
observed then set u-boot env variable via command:
`fw_setenv firmware_select 1`
6. Apply sysupgrade.bin in OpenWrt LuCI.
Web UI Installation
------------
1. Apply update by uploading initramfs-factory.bin to the web UI.
2. Use "fw_printenv" command to list envs. If "firmware_select=2" is
observed then set u-boot env variable via command:
`fw_setenv firmware_select 1`
3. Apply squashfs-sysupgrade.bin in OpenWrt LuCI.
Return to Stock Firmware
----------------------------
Restore the backup firmware partition in the installation step 4.
MAC addresses
-------------
+---------+-------------------+
| | MAC example |
+---------+-------------------+
| LABEL | 24:D5:1C:xx:xx:xx |
| LAN | 24:D5:1C:xx:xx:xx |
| WAN | 24:D5:1C:xx:xx:xx |
| WLAN2G | 24:D5:1C:xx:xx:xx |
| WLAN5G | 26:D5:1C:xx:xx:xx |
+---------+-------------------+
Tips:
-----------
User can use `TFTP Installation` method to recover a brick device.
Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20600
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This PR fixes support for Cudy r700.
Original PR: https://github.com/openwrt/openwrt/pull/18532
Fixed:
- WAN port functionality;
- RESET button;
- Status LED;
- LAN port names consistent with the chassis;
- Merged partitions "debug", "backup" & "firmware" to one partition "firmware" ("debug" & "backup" contained unimportant data);
- Removed redundant DTS elements.
Installation:
To install OpenWRT, you need the intermediate firmware from Cudy. (U-boot is locked). After installing the intermediate firmware, you can install OpenWRT via sysupgrade.
Recovery:
TFTP available.
1. Place the recovery.bin in the serving directory of your TFTP server.
2. Set your IP to 192.168.1.88/24.
3. Press the “Reset” button of Cudy router and hold it. Before the Cudy router is powered on and before TFTP start to download the firmware, don't release the “Reset” button.
4. Power on the Cudy router.
5. You can release the reset button only when TFTP starts downloading firmware.
6. When the SYSTEM LED turns solid green, the upgrade is complete.
Fixes: 75403dd1d05b ("ramips: add support for Cudy R700")
Signed-off-by: Marcin Leksmark <lexmark3200@wp.pl>
Link: https://github.com/openwrt/openwrt/pull/20756
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware:
- SoC: MediaTek MT7621DAT
- Flash: 16 MiB XM25QH128C
- RAM: 128 MiB
- WLAN: 2.4 GHz (MT7603E, 11n), 5 GHz (MediaTek MT7613BEN, 11ac)
- Ethernet: 1x10/100/1000 Mbps LAN
- Buttons: 1 Reset button, 1 WPS button
- LEDs: 5x Green
- Serial Console: unpopulated header 115200 8n1 (silkscreen on PCB)
- Power: POE 802.3af (37-57V DC)
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 80:af:ca:xx:xx:x0 | label |
| WLAN 2g | 80:af:ca:xx:xx:x0 | label |
| WLAN 5g | 82:af:ca:xx:xx:x1 | +1 |
+---------+-------------------+-----------+
Installation:
The factory firmware is locked: you can only work with Cudy signed firmware.
Download a intermediate firmware signed by Cudy here:
https://www.cudy.com/blogs/faq/openwrt-software-download
After that, login to the router (192.168.10.254, password "admin") and install the intermediate firmware.
If you can reach LuCI or SSH now on the intermediate firmware, just use the sysupgrade image with the 'Keep settings' option turned off.
Special thanks to Daniel de Kock for starting the porting work at #16265.
Signed-off-by: Luis Mita <luis@luismita.com>
Co-Authored-By: Daniel de Kock <daniel@riot.network>
Co-Authored-By: Hauke Mehrtens <hauke@hauke-m.de>
Link: https://github.com/openwrt/openwrt/pull/20268
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Both devices seem to be completely identical and D-Link doesnt even
mention the DIR-X1550 A1 in the GPL source. Furthermore the supported
devices header also just contains DIR-X1860 B1. The cherry on top is the
FCC filing, which features the manual for DIR-X1550 A1 but the label
info for DIR-X1860 B1. I guess someone at D-Link was just as confused as
me.
Hardware
--------
SOC: MediaTek MT7621AT
FLASH: 128MB (Spansion S34ML01G200TF100)
RAM: 256MB (Winbond W632GU6NB-12)
WIFI: MediaTek MT7915DAN + MT7975DN DBDC 2x2 802.11ax
ETH: 1x WAN, 3x LAN
LED: 6 (4 GPIO controllable, 2 WIFI hardwired)
BTN: WPS, Reset
UART: 115200 8N1 (Pinout silkscreened) - ignore VCC
MAC addresses
-------------
LAN Label MAC (stored in config2 partition as ASCII (entry
factory_mac=xx:xx:xx:xx:xx:xx))
WAN LAN + 3
2.4G LAN + 1
5G LAN + 2
Installation
------------
Vendor UI
---------
1. Browse to http://192.168.0.1 and login.
2. Navigate to "Management" -> "Upgrade".
3. Press the "Select File" button and upload
openwrt-ramips-mt7621-dlink_dir-x1860-b1-squashfs-factory.bin
4. Confirm the security questions, wait for a reboot and enjoy OpenWrt.
Recovery UI
-----------
1. Set your IP address to 192.168.0.101, subnet 255.255.255.0.
2. Power on the device while holding reset.
3. Release reset once the status led starts to blink orange.
4. Open a chrome- or firefox based browser and browse to
https://192.168.0.1
5. Upload openwrt-ramips-mt7621-dlink_dir-x1860-b1-squashfs-recovery.bin
wait for a reboot and enjoy OpenWrt.
Back to stock
-------------
1. Set your IP address to 192.168.0.101, subnet 255.255.255.0.
2. Power on the device while holding reset.
3. Release reset once the status led starts to blink orange.
4. Open a chrome- or firefox based browser and browse to
https://192.168.0.1
5. Upload a decrypted vendor image, wait for a reboot and regret your
decision.
Decrypt vendor image
--------------------
1. Download dlink-sge-image.c and dlink-sge-image.h from the
firmware-utils openwrt repository.
2. Compile a binary from the downloaded file
e.g. gcc dlink-sge-image.c -lcrypto -o dlink-sge-image
3. Run
./dlink-sge-image DIR-X1860-B1 <vendor_image> <decrypted_image> -d
Signed-off-by: Christoph Krapp <achterin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20410
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This option will only take effect when the "separate_ramdisk"
feature was enabled. However, this target does not support
this feature. It is an obvious copy and paste issue.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/17832
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The imagebuilder is not intended to build initramfs images. Some
profiles attempt to do this and succeed, due to buildroot leaking
the initramfs-kernel into staging_dir; others attempt it, but fail
due to not having initramfs binaries present in the imagebuilder.
Fix this by adding an explict guard around the unsupported generation
of the initramfs images. This saves space and time during imagebuilder
runs, fixes those that are currently broken and protects against future
breakage for profiles that inadvertently work now.
Fixes: https://github.com/openwrt/openwrt/issues/20151
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20347
Signed-off-by: Robert Marko <robimarko@gmail.com>
This patch adds support for Cudy C200P.
Specifications:
SoC: MediaTek MT7621AT
RAM: 256 MB (DDR3)
Flash: 16 MB (NOR)
POE Chip: IP804AR
Interfaces:
Switch: 1 WAN, 4 LAN (Gigabit)
Gigabit RJ45 PoE Ports on 2~5
Max Power on a Single PoE Ports 30W
PoE Ports : The PoE ports comply with IEEE 802.3at/af standards.
Ports: 1 USB-A 3.0 Ports
LED:
System
PoE Max Status
Link/ACT/PoE Status of Each PoE Port
Physical Buttons:
Reset Button
Power Input:
DC Jack
Power Methods:
DC: 54V 1.11A
802.3at/af PoE
Passive PoE: 24/48V
Max Power Consumption (W):
Total: 60W
PoE: 55W
PoE (when USB Device is plugged in): 50W
No PoE: 5W
Installation:
To install OpenWRT, you need the intermediate firmware from Cudy. (U-boot is locked). After installing the intermediate firmware, you can install OpenWRT via sysupgrade.
Recovery:
TFTP available.
1. Place the recovery.bin in the serving directory of your TFTP server.
2. Set your IP to 192.168.1.88/24.
3. Press the “Reset” button of Cudy router and hold it. Before the Cudy router is powered on and before TFTP start to download the firmware, don't release the “Reset” button.
4. Power on the Cudy router.
5. You can release the reset button only when TFTP starts downloading firmware.
6. When the SYSTEM LED turns solid green, the upgrade is complete.
Serial:
1. Serial connection parameters: 115200 / 8N1
2. Serial connection voltage: 3.3V
PoE is not supported at the time of PR. The IP804R chip is not yet supported by OpenWRT.
Signed-off-by: Marcin Leksmark <lexmark3200@wp.pl>
Link: https://github.com/openwrt/openwrt/pull/20165
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Plasma Cloud PAX1800-Lite is a dual-band Wi-Fi 6 router, based on MediaTek
MT7621A + MT79x5D platform.
Specifications:
- SOC: MT7621AT (880 MHz)
- DRAM: DDR3 448 MiB (Nanya NT5CC256M16DP-DI)
- Flash: 2 MiB SPI NOR (S25FL016K) + 128 MB SPI NAND (W25N02KVZEIR)
- Ethernet: 1x 10/100/1000 Mbps (SOC's built-in switch, with PoE+)
- Wi-Fi: 2x2:2 2.4/5 GHz (MT7905DAN + MT7975DN)
(MT7905DAN doesn't support background DFS scan/BT)
- LED: tri-color LED for status (red, blue, green)
- Buttons: 1x (reset)
- Antenna: 4x internal, non-detachable omnidirectional
- UART: 1x 4-pin (2.54 mm pitch, marked as "3V3 G/RX GND W/TX")
- Power: 12 V DC/2 A (DC jack)
MAC addresses:
WAN: 54:9C:27:xx:xx:00 (factory 0x3fff4, device label)
2.4 GHz: 54:9C:27:xx:xx:02 (factory 0x4, device label +2)
5 GHz: 54:9C:27:xx:xx:08 (factory 0xa, device label +8)
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console (115200 8N1) must be used to access the u-boot shell
during bootup. It can then be used to first boot up the initramfs image
from a TFTP server (here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0x83001000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann (Plasma Cloud) <se@simonwunderlich.de>
Link: https://github.com/openwrt/openwrt/pull/20152
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
RouterBOOT v7 for NOR devices does not support the historic yaffs
"kernel" ELF boot method.
Generate a compatible kernel
Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au>
This is a smart door lock device equipped with OpenWrt 14.07 OEM
modified version Qdwrt
The OEM has closed down, This commit is intended to maximize the
remaining value of these devices. It can flash OpenWrt to become
an AP
Specification:
- SoC: MediaTek MT7628NN
- Flash: 8 MB
- RAM: 64 MB
- Power: DC 5V - 25V
- Ethernet: 1 x RJ45 (10/100 Mbps)
- Wireless radio: 802.11n 2.4g-only
- On-Board LED:
Status 1: GPIO/43 active-low
Status 2: GPIO/44 active-low
Power: AlwaysOn
- Button:
WPS / RESET: GPIO/14 active-low
- Bluetooth: CC2541 via UART1 (ttyS1) and GPIO/26-29
- RFID: MF RC522 on I2C@28
- RTC: DS1339 on I2C@68
- Shell (via CON1 cable)
- LED (Swipe card area):
- Green GPIO/3 active-high
- Red GPIO/11 active-high
- Matrix keypad: (active-low)
GPIO/20 GPIO/21 GPIO/19 (Rows)
GPIO/24 1 2 3
GPIO/25 4 5 6
GPIO/22 7 8 9
GPIO/23 BACK 0 ENTER
(Cols)
- UART: 1 x UART on PCB - 57600 8N1
- GPIO Relay: GPIO/42 active-high
- GPIO Buzzer: GPIO/15 active-high
Warning:
The original firmware does not use the device tree.
This device tree is written based on the content of /sys/devices/platform
and has been tested
Note:
- On the device, matrix keypad rows actually are columns, and the columns actually are rows
- The key code of the CLEAR key of the matrix keypad is BACK in the original firmware.
Issue:
- No drivers in mainline kernel for RFID and Bluetooth.
Flash Instruction:
Using SSH/Telnet:
1. Connect the board to the computer via RJ45 Ethernet
2. Login 10.10.10.1 with root password "szqdingnet123" (SSH Port 22, Telnet Port 9900)
3. Download openwrt firmware on the computer.
4. Setup a http server on computer. And use wget download openwrt firmware from computer
5. Use command "mtd -r write openwrt-ramips-mt76x8-qding_qc202-squashfs-sysupgrade.bin firmware"
to flash
Using U-Boot WebUI:
1. Configure PC with a static IP address 10.10.10.2/24.
2. Open http://10.10.10.1
3. Use "mkqdimg -B qc202 -f openwrt-ramips-mt76x8-qding_qc202-squashfs-sysupgrade.bin" to
make image.
4. Upload factory.bin via U-Boot WebUI.
Original Firmware Dump / More details:
https://blog.gov.cooking/archives/research-qianding-smart-locker-and-flash.html
Original U-Boot firmware image tools:
https://gitlab.com/CoiaPrant/mkqdimg
Signed-off-by: Coia Prant <coiaprant@gmail.com>
Tested-by: Coia Prant <coiaprant@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17471
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
After trying to implement the gluon support for this device I ended up in a boot loop due to the usable amount of flash left. With this patch layout it uses the unused and empty flash space in the original partiton layout.
The version 3 of this device the RE365 share the same approach to have more usable space.
Signed-off-by: Steffen Förster <nemesis@chemnitz.freifunk.net>
Link: https://github.com/openwrt/openwrt/pull/18639
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Move append-teltonika-metadata to image-commands.mk and unify over different targets.
This method can be used to create valid "factory" images for most of Teltonika devices.
Signed-off-by: Simonas Tamošaitis <simsasss@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19401
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
CREALITY BOX WB01 is small footprint router based on MediaTek MT7688,
is a device intended to interface Creality brand 3D printers to a cloud service.
Specifications:
- SoC: MediaTek MT7688AN @ 580MHz
- RAM: DDR2 128M (Winbond W971GG6SB-25)
- Flash: BoyaMicro BY25Q128AS (16 MiB, SPI NOR) handled by BoHong bh25q128as driver
- WiFi: 2.4GHz 1T1R internal panel antenna
- Ethernet: 1x LAN (10/100)
- USB: 2x USB2.0 port (Genesys Logic GL850G 2 port USB 2.0 hub)
- UART: 3.3V, TX, RX, GND / 56700 8N1 / only pads on PCB
- microSD SD-XC Class 10 slot
- micro USB input (for power only)
- reset button
- FCC ID: 2AXH6CREALITY-BOX
MAC addresses as verified by OEM firmware:
vendor OpenWrt source
LAN eth0 factory 0x2e
2.4GHz phy0-ap0 factory 0x04 (label)
LEDs
color vendor OpenWRT configurable
red SD card activity - yes
green Cloud connectivity status yes
blue LAN activity eth0 yes
yellow WIFI activity phy0tpt yes
Return to OEM & debrick
- download "cxsw_update.tar.bz2" from manufacturer site
- extract archive to FAT32 USB stick root
- put USB stick in USB2 port
- press & hold reset button
- power on device while holding reset
- wait approx 10 sec
- release reset button
Installation with SD Card
- power on device
- wait for device to finish starting
- copy "openwrt-ramips-mt76x8-creality_wb-01-squashfs-cxsw_update.tar.bz2"
to root of FAT32 SD card
- rename openwrt-ramips-mt76x8-creality_wb-01-squashfs-cxsw_update.tar.bz2
to "cxsw_update.tar.bz2"
- put SD card in device
- device will install OpenWRT on internal flash
Installation via telnet:
- extract the "factory.bin" and "install.sh" from newly created
openwrt-ramips-mt76x8-creality_wb-01-squashfs-cxsw_update.tar.bz2
to FAT32 USB stick root
- telnet to 10.10.10.254, user: root, password: cxswprin
- plug the USB in USB1 port
- cd /media/usbdisk/
- sh install.sh
- device will write "factory.bin" to internal flash
Co-authored-by: George Brooke <figgyc@figgyc.uk>
Co-authored-by: Peca Nesovanovic <peca.nesovanovic@sattrakt.com>
Co-authored-by: shivajiva101 <github.com/shivajiva101>
Co-authored-by: Axel Sepulveda <ansepulveda@uc.cl>
Signed-off-by: Axel Sepulveda <ansepulveda@uc.cl>
Link: https://github.com/openwrt/openwrt/pull/19686
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is an industrial 4G router equipped with OpenWrt SNAPSHOT OEM
customized version
WARNING: The original firmware device tree is modified from evb
boards, and the device tree name is evb board. This submitted device
tree is a modified version, which deletes the non-this-device parts
and adds GPIO watchdog.
Specification:
- SoC: MediaTek MT7628NN
- Flash: 16 MB
- RAM: 128 MB
- Power: DC 5V-36V 1.5A
- Ethernet: 1x WAN [slot not install], 1x LAN (10/100 Mbps)
- Wireless radio: 802.11n 2.4g-only [antenna not install]
- LED:
System/Power (RUN): GPIO/37 active-low
Modem: GPIO/3 active-low
RF (Modem Signal): GPIO/2 active-low
- Button:
WPS / RESET: GPIO/11 active-low
- UART: 1x UART on PCB - 115200 8N1
- Serial / COM: 1X RS232/RS485 on board (GPIO/6 hi:RS485 lo:RS232)
- GPIO Watchdog: GPIO/0 mode=toggle timeout=1s
- Modem: 1x Built-in modem on board (Power: GPIO/4 active-high)
- PCIe: 1x miniPCIe for modem [slot not install]
- SIM Slots: 1x SIM Slots
Issue:
- Factory partition not store mac address on original firmware
Flash instruction:
Using SSH/Telnet:
1. Connect the board to the computer via RJ45 Ethernet
2. Login 192.168.8.1 with root password "superzxmn" (SSH Port 22, Telnet Port 5188)
3. Download openwrt firmware on the computer.
4. Use scp or sftp put firmware to board /tmp
5. Use command "mtd -r write openwrt-ramips-mt76x8-hongdian_h7920-v40-squashfs-sysupgrade.bin firmware"
to flash
Original Firmware Dump / More details:
https://blog.gov.cooking/archives/research-hongdian-h7920-v40-and-flash.html
Signed-off-by: Coia Prant <coiaprant@gmail.com>
Tested-by: Coia Prant <coiaprant@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17726
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for a dual-band AC1200 wall plug
manufactured by Shenzhen Century Xinyang Tech Co., Ltd.
SoC: Mediatek MT7628AN (MIPS 24KEc single core, 580 MHz)
RAM: 128 MiB DDR2 (Hynix HY5PS1G1631C)
ROM: 8 MiB SPI NOR (Zbit ZB25VQ64ASIG)
Wired: one FE RJ45 port (+ an unpopulated footprint for a 2nd)
WiFi: Mediatek MT7612E
Ant.: four 2 dBi external antennas (two 2.4GHz, two 5 GHz)
LEDs: - Power (green, always on)
- 2.4G (green, controlled by MT7628)
- 5G (green, controlled by MT7612)
- Extender (green, GPIO 37, used as status LED)
- LAN (green/yellow, controlled by RT3050 ESW)
Buttons: WPS and reset (both connected to GPIO 38)
Power: 5V 2-pin JST-XH on main PCB
110/220V AC to 5V 1.5A DC on auxiliary PCB
UART: 57600 8n1 3.3v, holes available on the PCB as J5
pinout is (Gnd) (Tx) (Rx)
MAC: 1C:BF:CE:xx:xx:xx (2.4 GHz, label)
1C:BF:CE:xx:xx:xx + 1 (LAN)
1C:BF:CE:xx:xx:xx + 2 (WAN, not in use)
1C:BF:CE:xx:xx:xx + 3 (5 GHz)
Original firmware is Chaos Calmer 15.05.01 (kernel 3.10.108)
with a few custom packages and a non-LuCI web interface.
Telnet is enabled, requiring an unknown root password [1].
Root password is also needed to access the router via UART console,
but passwordless telnet can be enabled via a trivial web exploit [2]
and then the root password can be removed by editing `/etc/shadow`.
Installation: Upload `sysupgrade` binary via web interface at
`http://192.168.188.1/settings.shtml`. Alternatively, remove
root password and use u-boot menu to flash image via TFTP.
Notes:
- Device model in Chaos Calmer is "mtk-apsoc-demo".
- It is sold under several brands, e.g., Fenvi and Linkavenir.
It is available in two colors: white and black.
- PCB is marked "WD206AD v1.0".
- Instead of a standard ethernet transformer, the PCB has a few tiny
SMD coils.
- The housing is identical to the one used by a 2020 model,
WD-R1203U, which is RTL8812-based. The older model has an FCC
listing with external and internal images: ZNPWD-R1203U.
The FCC listing contains a letter [3] claiming WD-R1203U and
WD-R1208U are internally identical, but evidently they are not.
[1] root:$1$7rmMiPJj$91iv9LWhfkZE/t7aCBdo.0:18388:0:99999:7:::
This is the same hash as in Wodesys WD-R1802U.
There are other root password hashes in `/etc/shadow_sf` and
`/etc/shadow_yn`.
[2] curl -X POST http://192.168.188.1/cgi-bin/adm.cgi \
-d page=Lang -d langType="en;killall telnetd;telnetd -l /bin/sh"
[3] https://fcc.report/FCC-ID/ZNPWD-R1203U/4767033
Signed-off-by: Rani Hod <rani.hod@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19535
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SIM SIMAX1800U has the similar hardware design as the SIMAX1800T. The
only difference is the Ethernet portmap.
Specification
-------------
- SoC : Mediatek MT7621
- RAM : 256 MiB DDR3
- Flash : 128 MiB NAND Flash
- WLAN : Mediatek MT7905 DBDC
- 2.4 GHz : 2x2 MIMO WiFi6
- 5 GHz : 2x2 MIMO WiFi6
- Ethernet : MT7621 built-in 10/100/1000 Mbps 1x WAN; 3x LAN
- UART : 3.3V, 115200n8
- Buttons : 1x RESET; 1x WPS/MESH
- LEDs : 1x Multi-Color(Blue;Green;Red)
- Power : DC 12V1A
- CMIIT ID : 2022AP7163
- TFTP IP :
- server : 192.168.1.254
- router : 192.168.1.28
TFTP Installation(recommend)
------------
1. Set local tftp server IP "192.168.1.254" and NetMask "255.255.255.0".
2. Rename initramfs-kernel.bin to "factory.bin" and put it in the root
directory of the tftp server. tftpd64 is a good choice for Windows.
3. Remove all Ethernet cables and WiFi connections from the PC, except
for the one connected to the SIMAX1800U. Start the TFTP server, plug
in the power adapter and wait for the OpenWrt system to boot.
4. Backup "firmware" partition and rename it to "firmware.bin". We need
it to back to the stock firmware.
5. Use "fw_printenv" command to list envs. If "firmware_select=2" is
observed then set u-boot env variable via command:
`fw_setenv firmware_select 1`
6. Apply sysupgrade.bin in OpenWrt LuCI.
Web UI Installation
------------
1. Apply update by uploading initramfs-factory.bin to the web UI.
2. Use "fw_printenv" command to list envs. If "firmware_select=2" is
observed then set u-boot env variable via command:
`fw_setenv firmware_select 1`
3. Apply squashfs-sysupgrade.bin in OpenWrt LuCI.
Return to Stock Firmware
----------------------------
Restore the backup firmware partition in the installation step 4.
MAC addresses
-------------
+---------+-------------------+
| | MAC example |
+---------+-------------------+
| LABEL | 98:xx:xx:xx:xx:b2 |
| LAN | 98:xx:xx:xx:xx:b5 |
| WAN | 98:xx:xx:xx:xx:b2 |
| WLAN2G | 98:xx:xx:xx:xx:b4 |
| WLAN5G | 9a:xx:xx:xx:xx:b4 |
+---------+-------------------+
Tips:
-----------
User can use `TFTP Installation` method to recover a brick device.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/19455
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Fix bootloop on TP-Link EAP615-Wall v1 by reducing LZMA dictionary
size. Before this patch and after an upgrade to kernel 6.12 this
device couldn't boot a kernel because of an error: "lzma compressed:
uncompress error 1".
I have chosen -d22 as dictionary size as suggested by @namiltd.
The usual sizes for problematic devices are -d16, -d20, -d22. I
have confirmed with my tests that this device can boot with a value
up to -d27, but there is no size benefit from values above -d21,
therefore -d22 is good enough.
See also: https://github.com/openwrt/openwrt/issues/19403
Signed-off-by: Marcin FM <marcin@ipv8.pl>
Link: https://github.com/openwrt/openwrt/pull/19433
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The Wavlink Aerial HD3 (WL-WN570HA2) is an AC1200 dual-band outdoor
access point. It supports 802.3AT/AF PoE and is IP67 waterproof.
It is based on the MediaTek MT7628DAN SoC and MT7613BEN WiFi 5 chip.
This model uses the 100Mbit LAN and 2.4Ghz WiFi elements of the
MT7628 and the 5Ghz WiFi of the MT7613.
Specification:
- SoC: MediaTek MT7628DAN (1C/1T) @ 580MHz
- RAM: 64MB DDR2 (integrated in SoC)
- FLASH: 16MB SPI NOR (Fudan FM25Q128A)
- Ethernet: 1x 10/100Mbps
- WiFi: 2.4/5 GHz 2T2R
- 2.4GHz MediaTek MT7628DAN bgn
- 5GHz MediaTek MT7613BEN nac
- Antennas: 2x detachable, dual-band 7dBi with RP-SMA connectors.
- USB: none
- BTN: Reset
- LED: 6 total: power; WAN/LAN; WiFi; WiFi low; WiFi med; Wifi high
- UART: surface-mount on PCB. Pins are marked via silkscreen.
pin1 (square pad, towards Ethernet)=Vcc, pin2=RX,
pin3=TX, pin4=GND. Settings: 57600/8N1.
NOTE: The TX & RX silkscreens were reversed on my test unit.
Installation:
1) This device requires a HTTP recovery procedure to do an initial load
of OpenWRT. You will need:
a. A web browser (private window recommended)
b. Configure an Ethernet interface to 192.168.1.x/24; don't use .1
c. Connect a cable between the computer and the Wavlink's PoE injector.
2) Put the Wavlink in HTTP recovery mode.
a. Do this by pressing and holding the reset button on the bottom while
powering the unit on.
b. As soon as all 6 LEDs light up blue (roughly 2-3 seconds), release
the button.
c. The LEDs should all remain lit, indicating it's in HTTP recovery.
3) Point the browser at http://192.168.1.1/index.html
4) Click "Choose File" and select the OpenWRT sysupgrade image.
5) Click the "Update Firmware" button and wait while the unit flashes
the image and reboots.
6) When the system comes back up fully, only the power LED will be lit.
Wait an extra minute then you should be able to reach OpenWRT on
http://192.168.1.1
5) Log into LuCI as root; there is no password.
Revert to the OEM Firmware:
--------------------------
* U-boot HTTP:
Follow the HTTP recovery steps, and use a firmware image downloaded
from Wavlink.
Signed-off-by: Jonathan Sturges <jsturges@redhat.com>
Link: https://github.com/openwrt/openwrt/pull/18856
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This device is similar to the TP-Link EX220 v1.
The differences are the number of ports (3 LANs
and 1 WAN) and the number of LEDs (1 LED RGB)
Hardware
--------
CPU: MediaTek MT7621 DAT
RAM: 128MB DDR3 (integrated)
FLASH: 16MB SPI-NOR
WiFi: MediaTek MT7905 + MT7975 (2.4 / 5 DBDC) 802.11ax
SERIAL: 115200 8N1
LED - (TX - RX - GND - 3V3 ) - ETH ports
Installation
------------
Flashing is only possible via a serial connection using the sysupgrade
image; the factory image must be signed. You can flash the sysupgrade
image directly through the U-Boot console, or preferably, by booting the
initramfs image and flashing with the sysupgrade command. Follow these
steps for sysupgrade flashing:
1. Establish a UART serial connection.
2. Set up a TFTP server at 192.168.0.2 and copy the initramfs image
there.
3. Power on the device and press any key to interrupt normal boot.
4. Load the initramfs image using tftpboot.
5. Boot with bootm.
6. If you haven't done so already, back up all stock mtd partitions.
7. Copy the sysupgrade image to the router.
8. Flash OpenWrt through either LuCI or the sysupgrade command. Remember
not to attempt saving settings.
Revert to stock firmware
------------------------
Flash stock firmware via OEM web-recovery mode. If you don't have access
to the stock firmware image, you will need to restore the firmware
partition backed up earlier.
Web-Recovery
------------
The router supports an HTTP recovery mode:
1. Turn off the router.
2. Press the reset button and power on the device.
3. When the LED start flashing, release reset and quickly press it
again.
The interface is reachable at 192.168.0.1 and supports installation of
the OEM factory image. Note that flashing OpenWrt this way is not
possible, as mentioned above.
Signed-off-by: Gustavo Curi <gpcuri@land.ufrj.br>
Link: https://github.com/openwrt/openwrt/pull/19104
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
SoC: MediaTek MT7628NN
RAM: 128 MB, EtronTech EM68C16CWQG-25H (DDR2)
Flash: 32MB, Winbond 25Q256JVFQ (Dual Boot, SPI)
Switch: MediaTek MT7628AN, 4 ports 100 Mbps
WiFi: MediaTek MT7603 2T2R/2.4GHz 802.11n
GPIO: 3 buttons (Wi-Fi, Reset, FN), 3 LEDs (Power, Internet, Wi-Fi), 1 port USB 2.0
Disassembly:
At the bottom, under the LEDs, there are 2 screws hidden by rubber feet. After removing the screws, pry the gray plastic part around (it is secured with latches) and remove it.
Serial Interface:
The serial interface can be connected to the 5 pin dots located on the right between the operating mode switch and the antenna.
Pins (from antenna to operating mode switch):
VCC
TX
RX
NC
GND
Settings: 115200, 8N1
Flashing via OEM recovery software:
1. Download the OEM recovery software from the manufacturer's website
2. Download the firmware image (for OpenWRT it is *-squashfs-factory.bin), rename it to KN-1212_recovery.bin
3. Replace the file in the fw folder OEM recovery software with the file from step 2.
4. Run the OEM recovery software and follow the instructions.
Flashing via TFTP:
1. Connect your PC and router to port 1-3, configure PC interface using IP 192.168.1.2, mask 255.255.255.252
2. Serve the firmware image (for OpenWRT it is *-squashfs-factory.bin) renamed to KN-1212_recovery.bin via TFTP
3. Power up the router while pressing Reset button on the back
4. Release Restart button when Power LED starts blinking
To revert back to OEM firmware:
The return to the OEM firmware is carried out by using the methods described above with the help of the appropriate firmware image.
When using OEM bootloader, the firmware image size cannot exceed the size of one OEM «Firmware_x» partition or Kernel + rootFS size.
Signed-off-by: Anton Yu. Ivanusev <ivanusevanton@yandex.ru>
Link: https://github.com/openwrt/openwrt/pull/19157
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
JDCloud RE-SP-01B is a dual-band WiFi 5 router based on the MT7621AT.
Specifications:
- SoC: MediaTek MT7621AT
- RAM: 512MB DDR3
- Flash: 32MB SPI NOR
- WiFi: MediaTek MT7603EN (2.4GHz), MediaTek MT7615N (5GHz)
- Ethernet: 1x WAN, 2x LAN (Gigabit Ethernet)
- LEDs: red, blue, green (GPIO controlled)
- Button: Reset (GPIO controlled)
- eMMC: Single onboard (32GB/64GB/128GB)
- USB: 1x USB 2.0 port
MAC Address Structure:
The MAC addresses share the structure DC:D8:7C:XX:XX:XX, where:
- WAN, LAN, and 2.4GHz WiFi: same as the label MAC address.
- 5GHz WiFi: label MAC address + 0x800000.
The manufacturer writes the label MAC address at different
offsets depending on the storage version of the device:
e.g.
128GB version: &config + 0x442a
64GB version: &config + 0x4429
So `get_mac_ascii()` is used here to search for the
base label MAC address of the device.
Ref:
https://github.com/openwrt/openwrt/pull/17409#discussion_r1899674262https://github.com/immortalwrt/immortalwrt/commit/c0c480d
Flash Instruction:
A 3rd party bootloader is required to boot the image. You can
use a SOP16 test clip to burn the image/bootloader to the flash.
The official bootloader does provide a web recovery interface
which only accepts an official image. To access it, you will
need to hold the reset button and power on the device, set your
IP address to 192.168.68.2 and visit http://192.168.68.1.
Co-authored-by: Chukun Pan <amadeus@jmu.edu.cn>
Signed-off-by: Yijie Jin <jinyijie@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/17409
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
SoC: MediaTek MT7628NN
RAM: 128 MB, EtronTech EM68C16CWQG-25H (DDR2)
Flash: 32MB, Winbond 25Q256JVFQ (Dual Boot, SPI)
Switch: MediaTek MT7628AN, 4 ports 100 Mbps
WiFi: MediaTek MT7603 2T2R/2.4GHz 802.11n
GPIO: 2 buttons (Wi-Fi, Reset), 3 LEDs (Power, Internet, Wi-Fi), 1 mode switch
Disassembly:
At the bottom, under the LEDs, there are 2 screws hidden by rubber feet. After removing the screws, pry the gray plastic part around (it is secured with latches) and remove it.
Serial Interface:
The serial interface can be connected to the 5 pin dots located on the right between the operating mode switch and the antenna.
Pins (from antenna to operating mode switch):
VCC
TX
RX
NC
GND
Settings: 115200, 8N1
Flashing via OEM recovery software:
1. Download the OEM recovery software from the manufacturer's website
2. Download the firmware image (for OpenWRT it is *-squashfs-factory.bin), rename it to KN-1112_recovery.bin
3. Replace the file in the fw folder OEM recovery software with the file from step 2.
4. Run the OEM recovery software and follow the instructions.
Flashing via TFTP:
1. Connect your PC and router to port 1-3, configure PC interface using IP 192.168.1.2, mask 255.255.255.252
2. Serve the firmware image (for OpenWRT it is *-squashfs-factory.bin) renamed to KN-1112_recovery.bin via TFTP
3. Power up the router while pressing Reset button on the back
4. Release Restart button when Power LED starts blinking
To revert back to OEM firmware:
The return to the OEM firmware is carried out by using the methods described above with the help of the appropriate firmware image.
When using OEM bootloader, the firmware image size cannot exceed the size of one OEM «Firmware_x» partition or Kernel + rootFS size.
Signed-off-by: Anton Yu. Ivanusev <ivanusevanton@yandex.ru>
Link: https://github.com/openwrt/openwrt/pull/19091
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
