openwrt/target/linux/ramips/mt7621/base-files/etc/board.d/02_network

180 lines
4.3 KiB
Plaintext
Raw Normal View History

#!/bin/sh
. /lib/functions.sh
. /lib/functions/uci-defaults.sh
. /lib/functions/system.sh
ramips_setup_interfaces()
{
local board="$1"
case $board in
ramips: add support for Amped Wireless ALLY router and extender Amped Wireless ALLY is a whole-home WiFi kit, with a router (model ALLY-R1900K) and an Extender (model ALLY-00X19K). Both are devices are 11ac and based on MediaTek MT7621AT and MT7615N chips. The units are nearly identical, except the Extender lacks a USB port and has a single Ethernet port. Specification: - SoC: MediaTek MT7621AT (2C/4T) @ 880MHz - RAM: 128MB DDR3 (Nanya NT5CC64M16GP-DI) - FLASH: 128MB NAND (Winbond W29N01GVSIAA) - WiFi: 2.4/5 GHz 4T4R - 2.4GHz MediaTek MT7615N bgn - 5GHz MediaTek MT7615N nac - Switch: SoC integrated Gigabit Switch - USB: 1x USB3 (Router only) - BTN: Reset, WPS - LED: single RGB - UART: through-hole on PCB. J1: pin1 (square pad, towards rear)=3.3V, pin2=RX, pin3=GND, pin4=TX. Settings: 57600/8N1. Note regarding dual system partitions ------------------------------------- The vendor firmware and boot loader use a dual partition scheme. The boot partition is decided by the bootImage U-boot environment variable: 0 for the 1st partition, 1 for the 2nd. OpenWrt does not support this scheme and will always use the first OS partition. It will set bootImage to 0 during installation, making sure the first partition is selected by the boot loader. Also, because we can't be sure which partition is active to begin with, a 2-step flash process is used. We first flash an initramfs image, then follow with a regular sysupgrade. Installation: Router (ALLY-R1900K) 1) Install the flashable initramfs image via the OEM web-interface. (Alternatively, you can use the TFTP recovery method below.) You can use WiFi or Ethernet. The direct URL is: http://192.168.3.1/07_06_00_firmware.html a. No login is needed, and you'll be in their setup wizard. b. You might get a warning about not being connected to the Internet. c. Towards the bottom of the page will be a section entitled "Or Manually Upgrade Firmware from a File:" where you can manually choose and upload a firmware file. d: Click "Choose File", select the OpenWRT "initramfs" image and click "Upload." 2) The Router will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 3) Log into LuCI as root; there is no password. 4) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 5) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Extender (ALLY-00X19K) 1) This device requires a TFTP recovery procedure to do an initial load of OpenWRT. Start by configuring a computer as a TFTP client: a. Install a TFTP client (server not necessary) b. Configure an Ethernet interface to 192.168.1.x/24; don't use .1 or .6 c. Connect the Ethernet to the sole Ethernet port on the X19K. 2) Put the ALLY Extender in TFTP recovery mode. a. Do this by pressing and holding the reset button on the bottom while connecting the power. b. As soon as the LED lights up green (roughly 2-3 seconds), release the button. 3) Start the TFTP transfer of the Initramfs image from your setup machine. For example, from Linux: tftp -v -m binary 192.168.1.6 69 -c put initramfs.bin 4) The Extender will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 5) Log into LuCI as root; there is no password. 6) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 7) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Backup the OEM Firmware: ----------------------- There isn't any downloadable firmware for the ALLY devices on the Amped Wireless web site. Reverting back to the OEM firmware is not possible unless we have a backup of the original OEM firmware. The OEM firmware may be stored on either /dev/mtd3 ("firmware") or /dev/mtd6 ("oem"). We can't be sure which was overwritten with the initramfs image, so backup both partitions to be safe. 1) Once logged into LuCI, navigate to System -> Backup/Flash Firmware. 2) Under "Save mtdblock contents," first select "firmware" and click "Save mtdblock" to download the image. 3) Repeat the process, but select "oem" from the pull-down menu. Revert to the OEM Firmware: -------------------------- * U-boot TFTP: Follow the TFTP recovery steps for the Extender, and use the backup image. * OpenWrt "Flash Firmware" interface: Upload the backup image and select "Force update" before continuing. Signed-off-by: Jonathan Sturges <jsturges@redhat.com> (cherry picked from commit 6d23e474ad9d0eba935696c66db4fb6e2037bb72)
2021-06-05 14:17:42 +02:00
ampedwireless,ally-00x19k|\
ramips: add support for Edimax Gemini RE23S Hardware -------- SoC: Mediatek MT7621AT (880 MHz, 2 cores 4 threads) RAM: 128MB FLASH: 16MB NOR (Macronix MX25L12805D) ETH: 1x 10/100/1000 Mbps Ethernet (MT7530) WIFI: - 2.4GHz: 1x MT7615 (4x4:4) - 5GHz: 1x MT7615 (4x4:4) - 4 antennas: 2 external detachable and 2 internal BTN: - 1x Reset button - 1x WPS button LEDS: - 1x Green led (Power) - 1x Green-Amber-Red led (Wifi) UART: - 57600-8-N-1 Everything works correctly. Installation ------------ Flash the factory image directly from OEM web interface. (You can login using these credentials: admin/1234) Restore OEM Firmware -------------------- Flash the OEM "bin" firmware directly from LUCI. The firmware is downloadable from the OEM web page. Warning: Remember to not keep settings! Warning2: Remember to force the flash. Restoring procedure tested with RE23_1.08.bin MAC addresses ------------- factory 0x4 *:24 factory 0x8004 *:25 Cimage 0x07 *:24 Cimage 0x0D *:24 Cimage 0x13 *:24 Cimage 0x19 *:25 No other addresses were found in factory partition. Since the label contains both the 2.4GHz and 5GHz mac address I decided to set the 5GHz one as label-mac-device. Moreover it also corresponds to the lan mac address. Notes ----- The wifi led in the OEM firmware changes colour depending on the signal strength. This can be done in OpenWrt but just for one interface. So for now will not be any default action for this led. If you want to open the case, pay attention to the antenna placed on the bottom part of the front cover. The wire is a bit short and it breaks easily. (I broke it) Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> [fix two typos and add extended MAC address section to commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-05-20 01:27:56 +02:00
edimax,re23s|\
mikrotik,routerboard-m11g|\
netgear,ex6150|\
sercomm,na502|\
ramips: add support for Edimax Gemini RE23S Hardware -------- SoC: Mediatek MT7621AT (880 MHz, 2 cores 4 threads) RAM: 128MB FLASH: 16MB NOR (Macronix MX25L12805D) ETH: 1x 10/100/1000 Mbps Ethernet (MT7530) WIFI: - 2.4GHz: 1x MT7615 (4x4:4) - 5GHz: 1x MT7615 (4x4:4) - 4 antennas: 2 external detachable and 2 internal BTN: - 1x Reset button - 1x WPS button LEDS: - 1x Green led (Power) - 1x Green-Amber-Red led (Wifi) UART: - 57600-8-N-1 Everything works correctly. Installation ------------ Flash the factory image directly from OEM web interface. (You can login using these credentials: admin/1234) Restore OEM Firmware -------------------- Flash the OEM "bin" firmware directly from LUCI. The firmware is downloadable from the OEM web page. Warning: Remember to not keep settings! Warning2: Remember to force the flash. Restoring procedure tested with RE23_1.08.bin MAC addresses ------------- factory 0x4 *:24 factory 0x8004 *:25 Cimage 0x07 *:24 Cimage 0x0D *:24 Cimage 0x13 *:24 Cimage 0x19 *:25 No other addresses were found in factory partition. Since the label contains both the 2.4GHz and 5GHz mac address I decided to set the 5GHz one as label-mac-device. Moreover it also corresponds to the lan mac address. Notes ----- The wifi led in the OEM firmware changes colour depending on the signal strength. This can be done in OpenWrt but just for one interface. So for now will not be any default action for this led. If you want to open the case, pay attention to the antenna placed on the bottom part of the front cover. The wire is a bit short and it breaks easily. (I broke it) Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> [fix two typos and add extended MAC address section to commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-05-20 01:27:56 +02:00
thunder,timecloud|\
tplink,re350-v1|\
tplink,re500-v1|\
tplink,re650-v1|\
ramips: add support for Ubiquiti UniFi 6 Lite Hardware -------- MediaTek MT7621AT 256M DDR3 32M SPI-NOR MediaTek MT7603 2T2R 802.11n 2.4GHz MediaTek MT7915 2T2R 802.11ax 5GHz Not Working ----------- - Bluetooth (connected to UART3) UART ---- UART is located in the lower left corner of the board. Pinout is 0 - 3V3 (don't connect) 1 - RX 2 - TX 3 - GND Console is 115200 8N1. Boot ---- 1. Connect to the serial console and connect power. 2. Double-press ESC when prompted 3. Set the fdt address $ fdt addr $(fdtcontroladdr) 4. Remove the signature node from the control FDT $ fdt rm /signature 5. Transfer and boot the OpenWrt initramfs image to the device. Make sure to name the file C0A80114.img and have it reachable at 192.168.1.1/24 $ tftpboot; bootm Installation ------------ 1. Connect to the booted device at 192.168.1.20 using username/password "ubnt". 2. Update the bootloader environment. $ fw_setenv devmode TRUE $ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr); fdt rm /signature; bootubnt" $ fw_setenv bootcmd "run boot_openwrt" 3. Transfer the OpenWrt sysupgrade image to the device using SCP. 4. Check the mtd partition number for bs / kernel0 / kernel1 $ cat /proc/mtd 5. Set the bootselect flag to boot from kernel0 $ dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock4 6. Write the OpenWrt sysupgrade image to both kernel0 as well as kernel1 $ dd if=openwrt.bin of=/dev/mtdblock6 $ dd if=openwrt.bin of=/dev/mtdblock7 7. Reboot the device. It should boot into OpenWrt. Below are the original installation instructions prior to the discovery of "devmode=TRUE". They are not required for installation and are documentation only. The bootloader employs signature verification on the FIT image configurations. This way, booting unauthorized image without patching the bootloader is not possible. Manually configuring the bootcmd in the U-Boot envronment won't work, as this is restored to the default value if modified. The bootloader is made up of three different parts. 1. The SPL performing early board initialization and providing a XModem recovery in case the PBL is missing 2. The PBL being the primary U-Boot application and containing the control FDT. It is LZMA packed with a uImage header. 3. A Ubiquiti standalone U-Boot application providing the main boot routine as well as their recovery mechanism. In a perfect world, we would only replace the PBL, as the SPL does not perform checks on the PBLs integrity. However, as the PBL is in the same eraseblock as the SPL, we need to at least rewrite both. The bootloader will only verify integrity in case it has a "signature" node in it's control device-tree. Renaming the signature node to something else will prevent this from happening. Warning: These instructions are based on the firmware intially shipped with the device and potentially brick your device in a way it can only be recovered using a SPI flasher. Only (!) proceed if you understand this! 1. Extract the bootloader from the U-Boot partition using the OpenWrt initramfs image. 2. Split the bootloader into it's 3 components: $ dd if=bootloader.bin of=spl.bin bs=1 skip=0 count=45056 $ dd if=bootloader.bin of=pbl.uimage bs=1 skip=45056 count=143360 $ dd if=bootloader.bin of=ubnt.uimage bs=1 skip=188416 3. Strip the uImage header from the PBL $ dd if=pbl.uimage of=pbl.lzma bs=64 skip=1 4. Decompress the PBL $ lzma -d pbl.lzma --single-stream The decompressed PBL sha256sum should be d8b406c65240d260cf15be5f97f40c1d6d1b6e61ec3abed37bb841c90fcc1235 5. Open the decompressed PBL using your favorite hexeditor. Locate the control FDT at offset 0x4CED0 (0xD00DFEED). At offset 0x4D5BC, the label for the signature node is located. Rename the "signature" string at this offset to "signaturr". The patched PBL sha256sum should be d028e374cdb40ba44b6e3cef2e4e8a8c16a3b85eb15d9544d24fdd10eed64c97 6. Compress the patched PBL $ lzma -z pbl --lzma1=dict=67108864 The resulting pbl.lzma file should have the sha256sum 7ae6118928fa0d0b3fe4ff81abd80ecfd9ba2944cb0f0a462b6ae65913088b42 7. Create the PBL uimage $ SOURCE_DATE_EPOCH=1607909492 mkimage -A mips -O u-boot -C lzma -n "U-Boot 2018.03 [UniFi,v1.1.40.71]" -a 84000000 -e 84000000 -T firmware -d pbl.lzma patched_pbl.uimage The resulting patched_pbl.uimage should have the sha256sum b90d7fa2dcc6814180d3943530d8d6b0d6a03636113c94e99af34f196d3cf2ce 8. Reassemble the complete bootloader $ dd if=patched_pbl.uimage of=aligned_pbl.uimage bs=143360 count=1 conv=sync $ cat spl.bin > patched_uboot.bin $ cat aligned_pbl.uimage >> patched_uboot.bin $ cat ubnt.uimage >> patched_uboot.bin The resulting patched_uboot.bin should have the sha256sum 3e1186f33b88a525687285c2a8b22e8786787b31d4648b8eee66c672222aa76b 9. Transfer your patched bootloader to the device. Also install the kmod-mtd-rw package using opkg and load it. $ insmod mtd-rw.ko i_want_a_brick=1 Write the patched bootloader to mtd0 $ mtd write patched_uboot.bin u-boot 10. Erase the kernel1 partition, as the bootloader might otherwise decide to boot from there. $ mtd erase kernel1 11. Transfer the OpenWrt sysupgrade image to the device and install using sysupgrade. FIT configurations ------------------ In the future, the MT7621 UniFi6 family can be supported by a single OpenWrt image. config@1: U6 Lite config@2: U6 IW config@3: U6 Mesh config@4: U6 Extender config@5: U6 LR-EA (Early Access - GA is MT7622) Signed-off-by: David Bauer <mail@david-bauer.net>
2020-12-12 14:34:00 +01:00
ubnt,unifi-6-lite|\
ramips: add support for Edimax Gemini RE23S Hardware -------- SoC: Mediatek MT7621AT (880 MHz, 2 cores 4 threads) RAM: 128MB FLASH: 16MB NOR (Macronix MX25L12805D) ETH: 1x 10/100/1000 Mbps Ethernet (MT7530) WIFI: - 2.4GHz: 1x MT7615 (4x4:4) - 5GHz: 1x MT7615 (4x4:4) - 4 antennas: 2 external detachable and 2 internal BTN: - 1x Reset button - 1x WPS button LEDS: - 1x Green led (Power) - 1x Green-Amber-Red led (Wifi) UART: - 57600-8-N-1 Everything works correctly. Installation ------------ Flash the factory image directly from OEM web interface. (You can login using these credentials: admin/1234) Restore OEM Firmware -------------------- Flash the OEM "bin" firmware directly from LUCI. The firmware is downloadable from the OEM web page. Warning: Remember to not keep settings! Warning2: Remember to force the flash. Restoring procedure tested with RE23_1.08.bin MAC addresses ------------- factory 0x4 *:24 factory 0x8004 *:25 Cimage 0x07 *:24 Cimage 0x0D *:24 Cimage 0x13 *:24 Cimage 0x19 *:25 No other addresses were found in factory partition. Since the label contains both the 2.4GHz and 5GHz mac address I decided to set the 5GHz one as label-mac-device. Moreover it also corresponds to the lan mac address. Notes ----- The wifi led in the OEM firmware changes colour depending on the signal strength. This can be done in OpenWrt but just for one interface. So for now will not be any default action for this led. If you want to open the case, pay attention to the antenna placed on the bottom part of the front cover. The wire is a bit short and it breaks easily. (I broke it) Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> [fix two typos and add extended MAC address section to commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-05-20 01:27:56 +02:00
ubnt,unifi-nanohd)
ucidef_set_interface_lan "lan"
;;
ramips: add support for Amped Wireless ALLY router and extender Amped Wireless ALLY is a whole-home WiFi kit, with a router (model ALLY-R1900K) and an Extender (model ALLY-00X19K). Both are devices are 11ac and based on MediaTek MT7621AT and MT7615N chips. The units are nearly identical, except the Extender lacks a USB port and has a single Ethernet port. Specification: - SoC: MediaTek MT7621AT (2C/4T) @ 880MHz - RAM: 128MB DDR3 (Nanya NT5CC64M16GP-DI) - FLASH: 128MB NAND (Winbond W29N01GVSIAA) - WiFi: 2.4/5 GHz 4T4R - 2.4GHz MediaTek MT7615N bgn - 5GHz MediaTek MT7615N nac - Switch: SoC integrated Gigabit Switch - USB: 1x USB3 (Router only) - BTN: Reset, WPS - LED: single RGB - UART: through-hole on PCB. J1: pin1 (square pad, towards rear)=3.3V, pin2=RX, pin3=GND, pin4=TX. Settings: 57600/8N1. Note regarding dual system partitions ------------------------------------- The vendor firmware and boot loader use a dual partition scheme. The boot partition is decided by the bootImage U-boot environment variable: 0 for the 1st partition, 1 for the 2nd. OpenWrt does not support this scheme and will always use the first OS partition. It will set bootImage to 0 during installation, making sure the first partition is selected by the boot loader. Also, because we can't be sure which partition is active to begin with, a 2-step flash process is used. We first flash an initramfs image, then follow with a regular sysupgrade. Installation: Router (ALLY-R1900K) 1) Install the flashable initramfs image via the OEM web-interface. (Alternatively, you can use the TFTP recovery method below.) You can use WiFi or Ethernet. The direct URL is: http://192.168.3.1/07_06_00_firmware.html a. No login is needed, and you'll be in their setup wizard. b. You might get a warning about not being connected to the Internet. c. Towards the bottom of the page will be a section entitled "Or Manually Upgrade Firmware from a File:" where you can manually choose and upload a firmware file. d: Click "Choose File", select the OpenWRT "initramfs" image and click "Upload." 2) The Router will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 3) Log into LuCI as root; there is no password. 4) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 5) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Extender (ALLY-00X19K) 1) This device requires a TFTP recovery procedure to do an initial load of OpenWRT. Start by configuring a computer as a TFTP client: a. Install a TFTP client (server not necessary) b. Configure an Ethernet interface to 192.168.1.x/24; don't use .1 or .6 c. Connect the Ethernet to the sole Ethernet port on the X19K. 2) Put the ALLY Extender in TFTP recovery mode. a. Do this by pressing and holding the reset button on the bottom while connecting the power. b. As soon as the LED lights up green (roughly 2-3 seconds), release the button. 3) Start the TFTP transfer of the Initramfs image from your setup machine. For example, from Linux: tftp -v -m binary 192.168.1.6 69 -c put initramfs.bin 4) The Extender will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 5) Log into LuCI as root; there is no password. 6) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 7) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Backup the OEM Firmware: ----------------------- There isn't any downloadable firmware for the ALLY devices on the Amped Wireless web site. Reverting back to the OEM firmware is not possible unless we have a backup of the original OEM firmware. The OEM firmware may be stored on either /dev/mtd3 ("firmware") or /dev/mtd6 ("oem"). We can't be sure which was overwritten with the initramfs image, so backup both partitions to be safe. 1) Once logged into LuCI, navigate to System -> Backup/Flash Firmware. 2) Under "Save mtdblock contents," first select "firmware" and click "Save mtdblock" to download the image. 3) Repeat the process, but select "oem" from the pull-down menu. Revert to the OEM Firmware: -------------------------- * U-boot TFTP: Follow the TFTP recovery steps for the Extender, and use the backup image. * OpenWrt "Flash Firmware" interface: Upload the backup image and select "Force update" before continuing. Signed-off-by: Jonathan Sturges <jsturges@redhat.com> (cherry picked from commit 6d23e474ad9d0eba935696c66db4fb6e2037bb72)
2021-06-05 14:17:42 +02:00
ampedwireless,ally-r1900k|\
gehua,ghl-r-001|\
hiwifi,hc5962|\
xiaomi,mi-router-3-pro|\
ramips: Add support for Xiaomi Mi Router(Black,R2100) The Xiaomi Mi Router AC2100 is a *black* cylindrical router that shares many characteristics (apart from its looks and the GPIO ports) with the 6-antenna *white* "Xiaomi Redmi Router AC2100" See the visual comparison of the two routers here: https://github.com/emirefek/openwrt-R2100/raw/imgcdn/rm2100-r2100.jpg Specification of R2100: - CPU: MediaTek MT7621A - RAM: 128 MB DDR3 - FLASH: 128 MB ESMT NAND - WIFI: 2x2 802.11bgn (MT7603) - WIFI: 4x4 802.11ac (MT7615) - ETH: 3xLAN+1xWAN 1000base-T - LED: Power, WAN in Yellow and Blue - UART: On board (Don't know where is should be confirmed by anybody else) - Modified u-boot Hacking of official firmware process is same at both RM2100 and R2100. Thanks to @namidairo Here is the detailed guide Hack: https://github.com/impulse/ac2100-openwrt-guide Guide is written for MacOS but it will work at linux. needed packages: python3(with scapy), netcat, http server, telnet client 1. Run PPPoE&exploit to get nc and wget busybox, get telnet and wget firmware 2. mtd write openwrt-ramips-mt7621-xiaomi_mi-router-ac2100-kernel1.bin kernel1 3. nvram set uart_en=1 4. nvram set bootdelay=5 5. nvram set flag_try_sys1_failed=1 6. nvram commit 7. mtd -r write openwrt-ramips-mt7621-xiaomi_mi-router-ac2100-rootfs0.bin rootfs0 other than these I specified in here. Everything is same with: https://github.com/openwrt/openwrt/commit/f3792690c4f0567a8965d82898295b9d50c3bb7e Thanks for all community and especially for this device: @Ilyas @scp07 @namidairo @Percy @thorsten97 @impulse (names@forum.openwrt.com) MAC Locations: WAN *:b5 = factory 0xe006 LAN *:b6 = factory 0xe000 WIFI 5ghz *:b8 = factory 0x8004 WIFI 2.4ghz *:b7 = factory 0x0004 Signed-off-by: Emir Efe Kucuk <emirefek@gmail.com> [refactored common image bits into Device/xiaomi-ac2100, fixed From:] Signed-off-by: Petr Štetiar <ynezz@true.cz>
2020-05-30 11:18:50 +02:00
xiaomi,mi-router-ac2100|\
ramips: Add support for Xiaomi Redmi Router AC2100 (RM2100) Specification: - CPU: MediaTek MT7621A - RAM: 128 MB DDR3 - FLASH: 128 MB ESMT NAND - WIFI: 2x2 802.11bgn (MT7603) - WIFI: 4x4 802.11ac (MT7615) - ETH: 3xLAN+1xWAN 1000base-T - LED: Power, WAN, in Amber and White - UART: On board near ethernet, opposite side from power - Modified u-boot Installation: 1. Run linked exploit to get shell, startup telnet and wget the files over 2. mtd write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-kernel1.bin kernel1 3. nvram set uart_en=1 4. nvram set bootdelay=5 5. nvram set flag_try_sys1_failed=1 6. nvram commit 7. mtd -r write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-rootfs0.bin rootfs0 Restore to stock: 1. Setup PXE and TFTP server serving stock firmware image (See dhcp-boot option of dnsmasq) 2. Hold reset button down before powering on and wait for flashing amber led 3. Release reset button 4. Wait until status led changes from flashing amber to white Notes: This device has dual kernel and rootfs slots like other Xiaomi devices currently supported (mir3g, etc.) thus, we use the second slot and overwrite the first rootfs onwards in order to get more space. Exploit and detailed instructions: https://openwrt.org/toh/xiaomi/xiaomi_redmi_router_ac2100 An implementation of CVE-2020-8597 against stock firmware version 1.0.14 This requires a computer with ethernet plugged into the wan port and an active PPPoE session, and if successful will open a reverse shell to 192.168.31.177 on port 31337. As this shell is somewhat unreliable and likely to be killed in a random amount of time, it is recommended to wget a static compiled busybox binary onto the device and start telnetd with it. The stock telnetd and dropbear unfortunately appear inoperable. (Disabled on release versions of stock firmware likely) Ie. wget https://yourip/busybox-mipsel -O /tmp/busybox chmod a+x /tmp/busybox /tmp/busybox telnetd -l /bin/sh Tested-by: David Martinez <bonkilla@gmail.com> Signed-off-by: Richard Huynh <voxlympha@gmail.com>
2020-04-23 04:50:21 +02:00
xiaomi,redmi-router-ac2100)
ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" "wan"
;;
ramips: add support for Amped Wireless ALLY router and extender Amped Wireless ALLY is a whole-home WiFi kit, with a router (model ALLY-R1900K) and an Extender (model ALLY-00X19K). Both are devices are 11ac and based on MediaTek MT7621AT and MT7615N chips. The units are nearly identical, except the Extender lacks a USB port and has a single Ethernet port. Specification: - SoC: MediaTek MT7621AT (2C/4T) @ 880MHz - RAM: 128MB DDR3 (Nanya NT5CC64M16GP-DI) - FLASH: 128MB NAND (Winbond W29N01GVSIAA) - WiFi: 2.4/5 GHz 4T4R - 2.4GHz MediaTek MT7615N bgn - 5GHz MediaTek MT7615N nac - Switch: SoC integrated Gigabit Switch - USB: 1x USB3 (Router only) - BTN: Reset, WPS - LED: single RGB - UART: through-hole on PCB. J1: pin1 (square pad, towards rear)=3.3V, pin2=RX, pin3=GND, pin4=TX. Settings: 57600/8N1. Note regarding dual system partitions ------------------------------------- The vendor firmware and boot loader use a dual partition scheme. The boot partition is decided by the bootImage U-boot environment variable: 0 for the 1st partition, 1 for the 2nd. OpenWrt does not support this scheme and will always use the first OS partition. It will set bootImage to 0 during installation, making sure the first partition is selected by the boot loader. Also, because we can't be sure which partition is active to begin with, a 2-step flash process is used. We first flash an initramfs image, then follow with a regular sysupgrade. Installation: Router (ALLY-R1900K) 1) Install the flashable initramfs image via the OEM web-interface. (Alternatively, you can use the TFTP recovery method below.) You can use WiFi or Ethernet. The direct URL is: http://192.168.3.1/07_06_00_firmware.html a. No login is needed, and you'll be in their setup wizard. b. You might get a warning about not being connected to the Internet. c. Towards the bottom of the page will be a section entitled "Or Manually Upgrade Firmware from a File:" where you can manually choose and upload a firmware file. d: Click "Choose File", select the OpenWRT "initramfs" image and click "Upload." 2) The Router will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 3) Log into LuCI as root; there is no password. 4) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 5) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Extender (ALLY-00X19K) 1) This device requires a TFTP recovery procedure to do an initial load of OpenWRT. Start by configuring a computer as a TFTP client: a. Install a TFTP client (server not necessary) b. Configure an Ethernet interface to 192.168.1.x/24; don't use .1 or .6 c. Connect the Ethernet to the sole Ethernet port on the X19K. 2) Put the ALLY Extender in TFTP recovery mode. a. Do this by pressing and holding the reset button on the bottom while connecting the power. b. As soon as the LED lights up green (roughly 2-3 seconds), release the button. 3) Start the TFTP transfer of the Initramfs image from your setup machine. For example, from Linux: tftp -v -m binary 192.168.1.6 69 -c put initramfs.bin 4) The Extender will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 5) Log into LuCI as root; there is no password. 6) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 7) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Backup the OEM Firmware: ----------------------- There isn't any downloadable firmware for the ALLY devices on the Amped Wireless web site. Reverting back to the OEM firmware is not possible unless we have a backup of the original OEM firmware. The OEM firmware may be stored on either /dev/mtd3 ("firmware") or /dev/mtd6 ("oem"). We can't be sure which was overwritten with the initramfs image, so backup both partitions to be safe. 1) Once logged into LuCI, navigate to System -> Backup/Flash Firmware. 2) Under "Save mtdblock contents," first select "firmware" and click "Save mtdblock" to download the image. 3) Repeat the process, but select "oem" from the pull-down menu. Revert to the OEM Firmware: -------------------------- * U-boot TFTP: Follow the TFTP recovery steps for the Extender, and use the backup image. * OpenWrt "Flash Firmware" interface: Upload the backup image and select "Force update" before continuing. Signed-off-by: Jonathan Sturges <jsturges@redhat.com> (cherry picked from commit 6d23e474ad9d0eba935696c66db4fb6e2037bb72)
2021-06-05 14:17:42 +02:00
asiarf,ap7621-001|\
winstars,ws-wn583a6)
ucidef_set_interfaces_lan_wan "lan" "wan"
;;
asiarf,ap7621-nv1|\
glinet,gl-mt1300|\
jcg,q20|\
lenovo,newifi-d1|\
mikrotik,routerboard-m33g|\
xiaomi,mi-router-3g|\
xiaomi,mi-router-3g-v2|\
xiaomi,mi-router-4|\
xiaomi,mi-router-4a-gigabit)
ucidef_set_interfaces_lan_wan "lan1 lan2" "wan"
;;
gnubee,gb-pc1)
ucidef_set_interface_lan "ethblack ethblue"
;;
gnubee,gb-pc2)
ucidef_set_interface_lan "ethblack ethblue ethyellow"
;;
linksys,re6500|\
netgear,wac104)
ucidef_set_interface_lan "lan1 lan2 lan3 lan4"
;;
mikrotik,routerboard-750gr3)
ucidef_set_interfaces_lan_wan "lan2 lan3 lan4 lan5" "wan"
;;
ramips: add support for MikroTik RouterBOARD 760iGS (hEX S) This patch adds support for the MikroTik RouterBOARD 760iGS router. It is similar to the already supported RouterBOARD 750Gr3. The 760iGS device features an added SFP cage, and passive PoE out on port 5 compared to the RB750Gr3. https://mikrotik.com/product/hex_s Specifications: - SoC: MediaTek MT7621A - CPU: 880MHz - Flash: 16 MB - RAM: 256 MB - Ethernet: 5x 10/100/1000 Mbps - SFP cage - USB port - microSD slot Unsupported: - Beeper (requires PWM driver) - ZT2046Q (ADS7846 compatible) on SPI as slave 1 (CS1) The linux driver requires an interrupt, and pendown GPIO These are unknown, and not needed with the touchscreen only used for temperature and voltage monitoring. ads7846 hwmon: temp0 is degrees Celsius temp1 is voltage * 32 GPIOs: - 07: input passive PoE out (lan5) compatible (Mikrotik) device connected - 17: output passive PoE out (lan5) switch Installation through RouterBoot follows the usual MikroTik method https://openwrt.org/toh/mikrotik/common To boot to intramfs image in RAM: 1. Setup TFTP server to serve intramfs image. 2. Plug Ethernet cable into WAN port. 3. Unplug power, hold reset button and plug power in. Wait (~25 seconds) for beep and then release reset button. The SFP LED will be lit in RouterBoot, but will not be lit in OpenWRT. 4. Wait for a minute. Router should be running OpenWrt, check by plugging in to port 2-5 and going to 192.168.1.1. To install OpenWrt to flash: 1. Follow steps above to boot intramfs image in RAM. 2. Flash the sysupgrade.bin image with web interface or sysupgrade. 3. Once the router reboots you will be running OpenWrt from flash. OEM firmware differences: - RouterOS assigns a different MAC address for each port - The first address (E01 on the sticker) is used for wan (ether1 in OEM). - The next address is used for lan2. - The last address (E06 on the sticker) is used for sfp. [Initial port work, shared dtsi] Signed-off-by: Vince Grassia <vincenzo.grassia@zionark.com> [SFP support and GPIO identification] Signed-off-by: Luka Logar <luka.logar@iname.com> [Misc. fixes and submission] Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au> [rebase, drop uart3 from state_default on 750gr3, minor commit title/message facelift] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-06-11 00:15:40 +02:00
mikrotik,routerboard-760igs)
ucidef_set_interfaces_lan_wan "lan2 lan3 lan4 lan5" "wan sfp"
;;
ramips: mt7621: add TP-Link EAP235-Wall support The TP-Link EAP235-Wall is a wall-mounted, PoE-powered AC1200 access point with four gigabit ethernet ports. When connecting to the device's serial port, it is strongly advised to use an isolated UART adapter. This prevents linking different power domains created by the PoE power supply, which may damage your devices. The device's U-Boot supports saving modified environments with `saveenv`. However, there is no u-boot-env partition, and saving modifications will cause the partition table to be overwritten. This is not an issue for running OpenWrt, but will prevent the vendor FW from functioning properly. Device specifications: * SoC: MT7621DAT * RAM: 128MiB * Flash: 16MiB SPI-NOR * Wireless 2.4GHz (MT7603EN): b/g/n, 2x2 * Wireless 5GHz (MT7613BEN): a/n/ac, 2x2 * Ethernet: 4× GbE * Back side: ETH0, PoE PD port * Bottom side: ETH1, ETH2, ETH3 * Single white device LED * LED button, reset button (available for failsafe) * PoE pass-through on port ETH3 (enabled with GPIO) Datasheet of the flash chip specifies a maximum frequency of 33MHz, but that didn't work. 20MHz gives no errors with reading (flash dump) or writing (sysupgrade). Device mac addresses: Stock firmware uses the same MAC address for ethernet (on device label) and 2.4GHz wireless. The 5GHz wireless address is incremented by one. This address is stored in the 'info' ('default-mac') partition at an offset of 8 bytes. From OEM ifconfig: eth a4:2b:b0:...:88 ra0 a4:2b:b0:...:88 rai0 a4:2b:b0:...:89 Flashing instructions: * Enable SSH in the web interface, and SSH into the target device * run `cliclientd stopcs`, this should return "success" * upload the factory image via the web interface Debricking: U-boot can be interrupted during boot, serial console is 57600 baud, 8n1 This allows installing a sysupgrade image, or fixing the device in another way. * Access serial header from the side of the board, close to ETH3, pin-out is (1:TX, 2:RX, 3:GND, 4:3.3V), with pin 1 closest to ETH3. * Interrupt bootloader by holding '4' during boot, which drops the bootloader into its shell * Change default 'serverip' and 'ipaddr' variables (optional) * Download initramfs with `tftpboot`, and boot image with `bootm` # tftpboot 84000000 openwrt-initramfs.bin # bootm Revert to stock: Using the tplink-safeloader utility from the firmware-utils package, TP-Link's firmware image can be converted to an OpenWrt-compatible sysupgrade image: $ ./staging_dir/host/bin/tplink-safeloader -B EAP235-WALL-V1 \ -z EAP235-WALLv1_XXX_up_signed.bin -o eap235-sysupgrade.bin This can then be flashed using the OpenWrt sysupgrade interface. The image will appear to be incompatible and must be force flashed, without keeping the current configuration. Known issues: - DFS support is incomplete (known issue with MT7613) - MT7613 radio may stop responding when idling, reboot required. This was an issue with the ddc75ff704 version of mt76, but appears to have improved/disappeared with bc3963764d. Error notice example: [ 7099.554067] mt7615e 0000:02:00.0: Message 73 (seq 1) timeout Hardware was kindly provided for porting by Stijn Segers. Tested-by: Stijn Segers <foss@volatilesystems.org> Signed-off-by: Sander Vanheule <sander@svanheule.net> (cherry picked from commit 1e75909a35a2b361cdfdfcf18a26ad61271b174e)
2021-02-18 20:52:53 +01:00
tplink,eap235-wall-v1)
ucidef_set_interface_lan "lan0 lan1 lan2 lan3"
;;
ubnt,edgerouter-x)
ucidef_set_interfaces_lan_wan "eth1 eth2 eth3 eth4" "eth0"
;;
ubnt,edgerouter-x-sfp)
ucidef_set_interfaces_lan_wan "eth1 eth2 eth3 eth4 eth5" "eth0"
;;
ramips: add support for YunCore AX820/HWAP-AX820 There are two versions which are identical apart from the enclosure: YunCore AX820: indoor ceiling mount AP with integrated antennas YunCore HWAP-AX820: outdoor enclosure with external (N) connectors Hardware specs: SoC: MediaTek MT7621DAT Flash: 16 MiB SPI NOR RAM: 128MiB (DDR3, integrated) WiFi: MT7905DAN+MT7975DN 2.4/5GHz 2T2R 802.11ax Ethernet: 10/100/1000 Mbps x2 (WAN/PoE+LAN) LED: Status (green) Button: Reset Power: 802.11af/at PoE; DC 12V,1A Antennas: AX820(indoor): 4dBi internal; HWAP-AX820(outdoor): external Flash instructions: The "OpenWRT support" version of the AX820 comes with a LEDE-based firmware with proprietary MTK drivers and a luci webinterface and ssh accessible under 192.168.1.1 on LAN; user root, no password. The sysupgrade.bin can be flashed using luci or sysupgrade via ssh, you will have to force the upgrade due to a different factory name. Remember: Do *not* preserve factory configuration! MAC addresses as used by OEM firmware: use address source 2g 44:D1:FA:*:0b Factory 0x0004 (label) 5g 46:D1:FA:*:0b LAA of 2g lan 44:D1:FA:*:0c Factory 0xe000 wan 44:D1:FA:*:0d Factory 0xe000 + 1 The wan MAC can also be found in 0xe006 but is not used by OEM dtb. Due to different MAC handling in mt76 the LAA derived from lan is used for 2g to prevent duplicate MACs when creating multiple interfaces. Signed-off-by: Clemens Hopfer <openwrt@wireloss.net> (cherry picked from commit 4891b865380e2b7f32acf0893df9c1ca9db8d4ea) [switch to mtd-mac-address instead of nvmem-cells]
2021-07-22 17:54:15 +02:00
yuncore,ax820|\
ramips: mt7621: Add support for ZyXEL NR7101 The ZyXEL NR7101 is an 802.3at PoE powered 5G outdoor (IP68) CPE with integrated directional 5G/LTE antennas. Specifications: - SoC: MediaTek MT7621AT - RAM: 256 MB - Flash: 128 MB MB NAND (MX30LF1G18AC) - WiFi: MediaTek MT7603E - Switch: 1 LAN port (Gigabiti) - 5G/LTE: Quectel RG502Q-EA connected by USB3 to SoC - SIM: 2 micro-SIM slots under transparent cover - Buttons: Reset, WLAN under same cover - LEDs: Multicolour green/red/yellow under same cover (visible) - Power: 802.3at PoE via LAN port The device is built as an outdoor ethernet to 5G/LTE bridge or router. The Wifi interface is intended for installation and/or temporary management purposes only. UART Serial: 57600N1 Located on populated 5 pin header J5: [o] GND [ ] key - no pin [o] RX [o] TX [o] 3.3V Vcc Remove the SIM/button/LED cover, the WLAN button and 12 screws holding the back plate and antenna cover together. The GPS antenna is fixed to the cover, so be careful with the cable. Remove 4 screws fixing the antenna board to the main board, again being careful with the cables. A bluetooth TTL adapter is recommended for permanent console access, to keep the router water and dustproof. The 3.3V pin is able to power such an adapter. MAC addresses: OpenWrt OEM Address Found as lan eth2 08:26:97:*:*:BC Factory 0xe000 (hex), label wlan0 ra0 08:26:97:*:*:BD Factory 0x4 (hex) wwan0 usb0 random WARNING!! ISP managed firmware might at any time update itself to a version where all known workarounds have been disabled. Never boot an ISP managed firmware with a SIM in any of the slots if you intend to use the router with OpenWrt. The bootloader lock can only be disabled with root access to running firmware. The flash chip is physically inaccessible without soldering. Installation from OEM web GUI: - Log in as "supervisor" on https://172.17.1.1/ - Upload OpenWrt initramfs-recovery.bin image on the Maintenance -> Firmware page - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - (optional) Copy OpenWrt to the recovery partition. See below - Sysupgrade to the OpenWrt sysupgrade image and reboot Installation from OEM ssh: - Log in as "root" on 172.17.1.1 port 22022 - scp OpenWrt initramfs-recovery.bin image to 172.17.1.1:/tmp - Prepare bootloader config by running: nvram setro uboot DebugFlag 0x1 nvram setro uboot CheckBypass 0 nvram commit - Run "mtd_write -w write initramfs-recovery.bin Kernel" and reboot - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - (optional) Copy OpenWrt to the recovery partition. See below - Sysupgrade to the OpenWrt sysupgrade image and reboot Copying OpenWrt to the recovery partition: - Verify that you are running a working OpenWrt recovery image from flash - ssh to root@192.168.1.1 and run: fw_setenv CheckBypass 0 mtd -r erase Kernel2 - Wait while the bootloader mirrors Image1 to Image2 NOTE: This should only be done after successfully booting the OpenWrt recovery image from the primary partition during installation. Do not do this after having sysupgraded OpenWrt! Reinstalling the recovery image on normal upgrades is not required or recommended. Installation from Z-Loader: - Halt boot by pressing Escape on console - Set up a tftp server to serve the OpenWrt initramfs-recovery.bin image at 10.10.10.3 - Type "ATNR 1,initramfs-recovery.bin" at the "ZLB>" prompt - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - Sysupgrade to the OpenWrt sysupgrade image NOTE: ATNR will write the recovery image to both primary and recovery partitions in one go. Booting from RAM: - Halt boot by pressing Escape on console - Type "ATGU" at the "ZLB>" prompt to enter the U-Boot menu - Press "4" to select "4: Entr boot command line interface." - Set up a tftp server to serve the OpenWrt initramfs-recovery.bin image at 10.10.10.3 - Load it using "tftpboot 0x88000000 initramfs-recovery.bin" - Boot with "bootm 0x8800017C" to skip the 380 (0x17C) bytes ZyXEL header This method can also be used to RAM boot OEM firmware. The warning regarding OEM applies! Never boot an unknown OEM firmware, or any OEM firmware with a SIM in any slot. NOTE: U-Boot configuration is incomplete (on some devices?). You may have to configure a working mac address before running tftp using "setenv eth0addr <mac>" Unlocking the bootloader: If you are unebale to halt boot, then the bootloader is locked. The OEM firmware locks the bootloader on every boot by setting DebugFlag to 0. Setting it to 1 is therefore only temporary when OEM firmware is installed. - Run "nvram setro uboot DebugFlag 0x1; nvram commit" in OEM firmware - Run "fw_setenv DebugFlag 0x1" in OpenWrt NOTE: OpenWrt does this automatically on first boot if necessary NOTE2: Setting the flag to 0x1 avoids the reset to 0 in known OEM versions, but this might change. WARNING: Writing anything to flash while the bootloader is locked is considered extremely risky. Errors might cause a permanent brick! Enabling management access from LAN: Temporary workaround to allow installing OpenWrt if OEM firmware has disabled LAN management: - Connect to console - Log in as "root" - Run "iptables -I INPUT -i br0 -j ACCEPT" Notes on the OEM/bootloader dual partition scheme The dual partition scheme on this device uses Image2 as a recovery image only. The device will always boot from Image1, but the bootloader might copy Image2 to Image1 under specific conditions. This scheme prevents repurposing of the space occupied by Image2 in any useful way. Validation of primary and recovery images is controlled by the variables CheckBypass, Image1Stable, and Image1Try. The bootloader sets CheckBypass to 0 and reboots if Image1 fails validation. If CheckBypass is 0 and Image1 is invalid then Image2 is copied to Image1. If CheckBypass is 0 and Image2 is invalid, then Image1 is copied to Image2. If CheckBypass is 1 then all tests are skipped and Image1 is booted unconditionally. CheckBypass is set to 1 after each successful validation of Image1. Image1Try is incremented if Image1Stable is 0, and Image2 is copied to Image1 if Image1Try is 3 or larger. But the bootloader only tests Image1Try if CheckBypass is 0, which is impossible unless the booted image sets it to 0 before failing. The system is therefore not resilient against runtime errors like failure to mount the rootfs, unless the kernel image sets CheckBypass to 0 before failing. This is not yet implemented in OpenWrt. Setting Image1Stable to 1 prevents the bootloader from updating Image1Try on every boot, saving unnecessary writes to the environment partition. Keeping an OpenWrt initramfs recovery as Image2 is recommended primarily to avoid unwanted OEM firmware boots on failure. Ref the warning above. It enables console-less recovery in case of some failures to boot from Image1. Signed-off-by: Bjørn Mork <bjorn@mork.no> Tested-by: Bjørn Mork <bjorn@mork.no> (cherry picked from commit 2449a632084b29632605e5a79ce5d73028eb15dd)
2021-04-19 13:00:56 +02:00
zyxel,nr7101)
ucidef_set_interfaces_lan_wan "lan" "wan"
;;
ramips: add support for ZyXEL WAP6805 (Altibox WiFi+) Hardware -------- SoC: MediaTek MT7621ST WiFi: MediaTek MT7603 Quantenna QT3840BC Flash: 128M NAND RAM: 64M LED: Dual colour red and green BTN: Reset WPS Eth: 4 x 10/100/1000 connected to MT7621 internal switch MT7621 RGMII port connected to Quantenna module GPIO: Power/reset of Quantenna module Quantenna module ---------------- The Quantenna QT3840BC (or QV840) is a separate SoC running another Linux installation. It is mounted on a wide mini-PCIe form factor module, but is connected to the RGMII port of the MT7621. It loads both a second uboot stage and an os image from the MT7621 using tftp. The module is configured using Quantenna specific RPC calls over IP, using 802.1q over the RGMII link to support multiple SSIDs. There is no support for using this module as a WiFi device in OpenWrt. A package with basic firmware and management tools is being prepared. Serial ports ------------ Two serial ports with headers: RRJ1 - 115200 8N1 - Connected to the Quantenna console J1 - 57600 8N1 - Connected to the MT7621 console Both share pinout with many other Zyxel/Mitrastar devices: 1 - NC (VDD) 2 - TX 3 - RX 4 - NC (no pin) 5 - GND Dual system partitions ---------------------- The vendor firmware and boot loader use a dual partition scheme storing a counter in the header of each partition. The partition with the highest number will be selected for boot. OpenWrt does not support this scheme and will always use the first OS partition. It will reset both counters to zero the first time sysupgrade is run, making sure the first partition is selected by the boot loader. Installation from vendor firmware --------------------------------- 1. Run a DHCP server. The WAP6805 is configured as a client device and does not have a default static IP address. Make a note of which address it is assigned 2. tftp the OpenWrt initramfs-kernel.bin image to this address. Wait for the WAP6805 to reboot. 3. ssh to the OpenWrt initramfs system on 192.168.1.1. Make a backup of all mtd partitions now. The last used OEM image is still present in either "Kernel" or "Kernel2" at this point, and can be restored later if you save a copy. 4. sysupgrade to the OpenWrt sysupgrade.bin image. Installation from U-Boot ------------------------ This requires serial console access 1. Copy the OpenWrt initramfs-kernel.bin image as "ras.bin" to your tftp server directory. Configure the server address as 192.168.0.33/24 2. Hit ESC when the message "Hit ESC key to stop autoboot" appears 3. Type "ATGU" + Enter, and then "2" immediately after pressing enter. 4. Answer Y to the question "Erase Linux in Flash then burn new one. Are you sure?", and answer the address/filename questions. Defaults: Input device IP (192.168.0.2) Input server IP (192.168.0.33) Input Linux Kernel filename ("ras.bin") 5. Wait until after you see the message "Done!" and power cycle the device. It will hang after flashing. 6. Continue with step 3 and 4 from the vendor firmware procedure. Notes on the WAP6805 U-Boot --------------------------- The bootloader has been modified with both ZyXELs zyloader and the device specific dual partition scheme. These changes appear to have broken a few things. The zyloader shell claims to support a number of ZyXEL AT commands, but not all of them work. The image selection scheme is unreliable and inconsistent. A limited U-Boot menu is available - and used by the above U-Boot install procedure. But direct booting into an uploaded image does not work, neither with ram nor with flash. Flashing works, but requires a hard reset after it is finished. Reverting to OEM firmware ------------------------- The OEM firmware can be restored by using mtd write from OpenWrt, flashing it to the "Kernel" partition. E.g. ssh root@192.168.1.1 "mtd -r -e Kernel write - Kernel" < oem.bin OEM firmwares for the WAP6805 are not avaible for public download, so a backup of the original installation is required. See above. Alternatively, firmware for the WAP6806 (Armor X1) may be used. This is exactly the same hardware. But the branding features do obviously differ. LED controller -------------- Hardware implementation is unknown. The dual-color LED is controlled by 3 GPIOs: 4: red 7: blinking green 13: green Enabling both red and green makes the LED appear yellow. The boot loader enables hardware blinking, causing the green LED to blink slowly on power-on, until the OpenWrt boot mode starts a faster software blink. Signed-off-by: Bjørn Mork <bjorn@mork.no> [fix alphabetic sorting for image build statement] Signed-off-by: Petr Štetiar <ynezz@true.cz>
2018-04-18 21:57:52 +02:00
zyxel,wap6805)
ucidef_set_interface_lan "lan1 lan2 lan3 lan4"
ucidef_set_interface "qtn" ifname "eth1" protocol "static" ipaddr "1.1.1.1" netmask "255.255.255.0"
;;
*)
ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
;;
esac
}
ramips_setup_macs()
{
local board="$1"
local lan_mac=""
local wan_mac=""
local label_mac=""
case $board in
ramips: add support for Amped Wireless ALLY router and extender Amped Wireless ALLY is a whole-home WiFi kit, with a router (model ALLY-R1900K) and an Extender (model ALLY-00X19K). Both are devices are 11ac and based on MediaTek MT7621AT and MT7615N chips. The units are nearly identical, except the Extender lacks a USB port and has a single Ethernet port. Specification: - SoC: MediaTek MT7621AT (2C/4T) @ 880MHz - RAM: 128MB DDR3 (Nanya NT5CC64M16GP-DI) - FLASH: 128MB NAND (Winbond W29N01GVSIAA) - WiFi: 2.4/5 GHz 4T4R - 2.4GHz MediaTek MT7615N bgn - 5GHz MediaTek MT7615N nac - Switch: SoC integrated Gigabit Switch - USB: 1x USB3 (Router only) - BTN: Reset, WPS - LED: single RGB - UART: through-hole on PCB. J1: pin1 (square pad, towards rear)=3.3V, pin2=RX, pin3=GND, pin4=TX. Settings: 57600/8N1. Note regarding dual system partitions ------------------------------------- The vendor firmware and boot loader use a dual partition scheme. The boot partition is decided by the bootImage U-boot environment variable: 0 for the 1st partition, 1 for the 2nd. OpenWrt does not support this scheme and will always use the first OS partition. It will set bootImage to 0 during installation, making sure the first partition is selected by the boot loader. Also, because we can't be sure which partition is active to begin with, a 2-step flash process is used. We first flash an initramfs image, then follow with a regular sysupgrade. Installation: Router (ALLY-R1900K) 1) Install the flashable initramfs image via the OEM web-interface. (Alternatively, you can use the TFTP recovery method below.) You can use WiFi or Ethernet. The direct URL is: http://192.168.3.1/07_06_00_firmware.html a. No login is needed, and you'll be in their setup wizard. b. You might get a warning about not being connected to the Internet. c. Towards the bottom of the page will be a section entitled "Or Manually Upgrade Firmware from a File:" where you can manually choose and upload a firmware file. d: Click "Choose File", select the OpenWRT "initramfs" image and click "Upload." 2) The Router will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 3) Log into LuCI as root; there is no password. 4) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 5) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Extender (ALLY-00X19K) 1) This device requires a TFTP recovery procedure to do an initial load of OpenWRT. Start by configuring a computer as a TFTP client: a. Install a TFTP client (server not necessary) b. Configure an Ethernet interface to 192.168.1.x/24; don't use .1 or .6 c. Connect the Ethernet to the sole Ethernet port on the X19K. 2) Put the ALLY Extender in TFTP recovery mode. a. Do this by pressing and holding the reset button on the bottom while connecting the power. b. As soon as the LED lights up green (roughly 2-3 seconds), release the button. 3) Start the TFTP transfer of the Initramfs image from your setup machine. For example, from Linux: tftp -v -m binary 192.168.1.6 69 -c put initramfs.bin 4) The Extender will flash the OpenWrt initramfs image and reboot. After booting, LuCI will be available on 192.168.1.1. 5) Log into LuCI as root; there is no password. 6) Optional (but recommended) is to backup the OEM firmware before continuing; see process below. 7) Complete the Installation by flashing a full OpenWRT image. Note: you may use the sysupgrade command line tool in lieu of the UI if you prefer. a. Choose System -> Backup/Flash Firmware. b. Click "Flash Image..." under "Flash new firmware image" c. Click "Browse..." and then select the sysupgrade file. d. Click Upload to upload the sysupgrade file. e. Important: uncheck "Keep settings and retain the current configuration" for this initial installation. f. Click "Continue" to flash the firmware. g. The device will reboot and OpenWRT is installed. Backup the OEM Firmware: ----------------------- There isn't any downloadable firmware for the ALLY devices on the Amped Wireless web site. Reverting back to the OEM firmware is not possible unless we have a backup of the original OEM firmware. The OEM firmware may be stored on either /dev/mtd3 ("firmware") or /dev/mtd6 ("oem"). We can't be sure which was overwritten with the initramfs image, so backup both partitions to be safe. 1) Once logged into LuCI, navigate to System -> Backup/Flash Firmware. 2) Under "Save mtdblock contents," first select "firmware" and click "Save mtdblock" to download the image. 3) Repeat the process, but select "oem" from the pull-down menu. Revert to the OEM Firmware: -------------------------- * U-boot TFTP: Follow the TFTP recovery steps for the Extender, and use the backup image. * OpenWrt "Flash Firmware" interface: Upload the backup image and select "Force update" before continuing. Signed-off-by: Jonathan Sturges <jsturges@redhat.com> (cherry picked from commit 6d23e474ad9d0eba935696c66db4fb6e2037bb72)
2021-06-05 14:17:42 +02:00
ampedwireless,ally-00x19k)
lan_mac=$(mtd_get_mac_ascii hwconfig HW.LAN.MAC.Address)
label_mac=$lan_mac
;;
ampedwireless,ally-r1900k)
lan_mac=$(mtd_get_mac_ascii hwconfig HW.LAN.MAC.Address)
wan_mac=$(mtd_get_mac_ascii hwconfig HW.WAN.MAC.Address)
label_mac=$lan_mac
;;
asus,rt-ac65p|\
asus,rt-ac85p)
wan_mac=$(mtd_get_mac_ascii u-boot-env et1macaddr)
label_mac=$(mtd_get_mac_binary factory 0x4)
;;
buffalo,wsr-1166dhp)
local index="$(find_mtd_index "board_data")"
wan_mac="$(grep -m1 mac= "/dev/mtd${index}" | cut -d= -f2)"
lan_mac=$wan_mac
;;
dlink,dir-860l-b1)
lan_mac=$(mtd_get_mac_ascii factory lanmac)
wan_mac=$(mtd_get_mac_ascii factory wanmac)
;;
edimax,ra21s|\
edimax,rg21s)
lan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
wan_mac=$(mtd_get_mac_ascii u-boot-env wanaddr)
;;
elecom,wrc-2533ghbk-i)
lan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
wan_mac=$(mtd_get_mac_ascii u-boot-env wanaddr)
label_mac=$wan_mac
;;
hiwifi,hc5962)
lan_mac=$(mtd_get_mac_ascii bdinfo "Vfac_mac ")
label_mac=$lan_mac
[ -n "$lan_mac" ] || lan_mac=$(cat /sys/class/net/eth0/address)
wan_mac=$(macaddr_add "$lan_mac" 1)
;;
iodata,wnpr2600g)
wan_mac=$(mtd_get_mac_ascii u-boot-env wanaddr)
label_mac=$wan_mac
;;
jcg,y2|\
wavlink,wl-wn531a6|\
winstars,ws-wn583a6|\
zbtlink,zbt-we1326|\
zbtlink,zbt-wg3526-16m|\
zbtlink,zbt-wg3526-32m)
label_mac=$(mtd_get_mac_binary factory 0x4)
;;
ramips: add support for Linksys E5600 This submission relied heavily on the work of Linksys EA7300 v1/ v2. Specifications: * SoC: MediaTek MT7621A (880 MHz 2c/4t) * RAM: 128M DDR3-1600 * Flash: 128M NAND * Eth: MediaTek MT7621A (10/100/1000 Mbps x5) * Radio: MT7603E/MT7613BE (2.4 GHz & 5 GHz) * Antennae: 2 internal fixed in the casing and 2 on the PCB * LEDs: Blue (x4 Ethernet) Blue+Orange (x2 Power + WPS and Internet) * Buttons: Reset (x1) WPS (x1) Installation: Flash factory image through GUI. This device has 2 partitions for the firmware called firmware and alt_firmware. To successfully flash and boot the device, the device should have been running from alt_firmware partition. To get the device booted through alt_firmware partition, download the OEM firmware from Linksys website and upgrade the firmware from web GUI. Once this is done, flash the OpenWrt Factory firmware from web GUI. Reverting to factory firmware: 1. Boot to 'alt_firmware'(where stock firmware resides) by doing one of the following: Press the "wps" button as soon as power LED turns on when booting. (OR) Hard-reset the router consecutively three times to force it to boot from 'alt_firmware'. 2. To remove any traces of OpenWRT from your router simply flash the OEM image at this point. Signed-off-by: Aashish Kulkarni <aashishkul@gmail.com> [fix hanging indents and wrap to 74 characters per line, add kmod-mt7663-firmware-sta package for 5GHz STA mode to work, remove sysupgrade.bin and concatenate IMAGES instead in mt7621.mk, set default-state "on" for power LED] Signed-off-by: Sannihith Kinnera <digislayer@protonmail.com> [move check-size before append-metadata, remove trailing whitespace] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> Tested-by: Sannihith Kinnera <digislayer@protonmail.com> (cherry picked from commit 251c995cbb1ea5ad1de14775312c2bd19ed10439)
2021-03-02 06:10:14 +01:00
linksys,e5600|\
linksys,ea7300-v1|\
linksys,ea7300-v2|\
linksys,ea7500-v2|\
linksys,ea8100-v1)
ramips: add support for Linksys EA7500 v2 The Linksys EA7500 v2 is advertised as AC1900, but its internal hardware is AC2600 capable. Hardware -------- SoC: Mediatek MT7621AT (880 MHz, 2 cores 4 threads) RAM: 256M (Nanya NT5CC128M16IP-DI) FLASH: 128MB NAND (Macronix MX30LF1G18AC-TI) ETH: 5x 10/100/1000 Mbps Ethernet (MT7530) WIFI: - 2.4GHz: 1x MT7615N (4x4:4) - 5GHz: 1x MT7615N (4x4:4) - 4 antennas: 3 external detachable antennas and 1 internal USB: - 1x USB 3.0 - 1x USB 2.0 BTN: - 1x Reset button - 1x WPS button LEDS: - 1x White led (Power) - 6x Green leds (link lan1-lan4, link wan, wps) - 5x Orange leds (act lan1-lan4, act wan) (working but unmodifiable) Everything works correctly. Installation ------------ The “factory” openwrt image can be flashed directly from OEM stock firmware. After the flash the router will reboot automatically. However, due to the dual boot system, the first installation could fail (if you want to know why, read the footnotes). If the flash succeed and you can reach OpenWrt through the web interface or ssh, you are done. Otherwise the router will try to boot 3 times and then will automatically boot the OEM firmware (don’t turn off the router. Simply wait and try to reach the router through the web interface every now and then, it will take few minutes). After this, you should be back in the OEM firmware. Now you have to flash the OEM Firmware over itself using the OEM web interface (I tested it using the FW_EA7500v2_2.0.8.194281_prod.img downloaded from the Linksys website). When the router reboots flash the “factory” OpenWrt image and this time it should work. After the OpenWrt installation you have to use the sysupgrade image for future updates. Restore OEM Firmware -------------------- After the OpenWrt flash, the OEM firmware is still stored in the second partition thanks to the dual boot system. You can switch from OpenWrt to OEM firmware and vice-versa failing the boot 3 times in a row: 1) power on the router 2) wait 15 seconds 3) power off the router 4) repeat steps 1-2-3 twice more. 5) power on the router and you should be in the “other” firmware If you want to completely remove OpenWrt from your router, switch to the OEM firmware and then flash OEM firmware from the web interface as a normal update. This procedure will overwrite the OpenWrt partition. Footnotes --------- The Linksys EA7500-v2 has a dual boot system to avoid bricks. This system works using 2 pair of partitions: 1) "kernel" and "rootfs" 2) "alt_kernel" and "alt_rootfs". After 3 failed boot attempts, the bootloader tries to boot the other pair of partitions and so on. This system is managed by the bootloader, which writes a bootcount in the s_env partition, and if successfully booted, the system add a "zero-bootcount" after the previous value. A system update performed from OEM firmware, writes the firmware on the other pair of partitions and sets the bootloader to boot the new pair of partitions editing the “boot_part” variable in the bootloader vars. Effectively it's a quick and safe system to switch the selected boot partition. Another way to switch the boot partition is: 1) power on the router 2) wait 15 seconds 3) power off the router 4) repeat steps 1-2-3 twice more. 5) power on the router and you should be in the “other” firmware In this OpenWrt port, this dual boot system is partially working because the bootloader sets the right rootfs partition in the cmdline but unfortunately OpenWrt for ramips platform overwrites the cmdline so is not possible to detect the right rootfs partition. Because all of this, I preferred to simply use the first pair of partitions and set read-only the other pair. However this solution is not optimal because is not possible to know without opening the case which is the current booted partition. Let’s take for example a router booting the OEM firmware from the first pair of partitions. If we flash the OpenWrt image, it will be written on the second pair. In this situation the router will bootloop 3 times and then will automatically come back to the first pair of partitions containg the OEM firmware. In this situation, to flash OpenWrt correctly is necessary to switch the booting partition, flashing again the OEM firmware over itself. At this point the OEM firmware is on both pair of partitions but the current booted pair is the second one. Now, flashing the OpenWrt factory image will write the firmware on the first pair and then will boot correctly. If this limitation in the ramips platform about the cmdline will be fixed, the dual boot system can also be implemented in OpenWrt with almost no effort. Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> Co-Developed-by: Jackson Lim <jackcolentern@gmail.com> Signed-off-by: Jackson Lim <jackcolentern@gmail.com>
2020-05-12 01:27:50 +02:00
lan_mac=$(mtd_get_mac_ascii devinfo hw_mac_addr)
wan_mac=$lan_mac
label_mac=$lan_mac
;;
mikrotik,routerboard-750gr3|\
ramips: add support for MikroTik RouterBOARD 760iGS (hEX S) This patch adds support for the MikroTik RouterBOARD 760iGS router. It is similar to the already supported RouterBOARD 750Gr3. The 760iGS device features an added SFP cage, and passive PoE out on port 5 compared to the RB750Gr3. https://mikrotik.com/product/hex_s Specifications: - SoC: MediaTek MT7621A - CPU: 880MHz - Flash: 16 MB - RAM: 256 MB - Ethernet: 5x 10/100/1000 Mbps - SFP cage - USB port - microSD slot Unsupported: - Beeper (requires PWM driver) - ZT2046Q (ADS7846 compatible) on SPI as slave 1 (CS1) The linux driver requires an interrupt, and pendown GPIO These are unknown, and not needed with the touchscreen only used for temperature and voltage monitoring. ads7846 hwmon: temp0 is degrees Celsius temp1 is voltage * 32 GPIOs: - 07: input passive PoE out (lan5) compatible (Mikrotik) device connected - 17: output passive PoE out (lan5) switch Installation through RouterBoot follows the usual MikroTik method https://openwrt.org/toh/mikrotik/common To boot to intramfs image in RAM: 1. Setup TFTP server to serve intramfs image. 2. Plug Ethernet cable into WAN port. 3. Unplug power, hold reset button and plug power in. Wait (~25 seconds) for beep and then release reset button. The SFP LED will be lit in RouterBoot, but will not be lit in OpenWRT. 4. Wait for a minute. Router should be running OpenWrt, check by plugging in to port 2-5 and going to 192.168.1.1. To install OpenWrt to flash: 1. Follow steps above to boot intramfs image in RAM. 2. Flash the sysupgrade.bin image with web interface or sysupgrade. 3. Once the router reboots you will be running OpenWrt from flash. OEM firmware differences: - RouterOS assigns a different MAC address for each port - The first address (E01 on the sticker) is used for wan (ether1 in OEM). - The next address is used for lan2. - The last address (E06 on the sticker) is used for sfp. [Initial port work, shared dtsi] Signed-off-by: Vince Grassia <vincenzo.grassia@zionark.com> [SFP support and GPIO identification] Signed-off-by: Luka Logar <luka.logar@iname.com> [Misc. fixes and submission] Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au> [rebase, drop uart3 from state_default on 750gr3, minor commit title/message facelift] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-06-11 00:15:40 +02:00
mikrotik,routerboard-760igs|\
mikrotik,routerboard-m11g|\
mikrotik,routerboard-m33g)
label_mac=$(cat "/sys/firmware/mikrotik/hard_config/mac_base")
wan_mac=$label_mac
lan_mac=$(macaddr_add $label_mac 1)
;;
ramips: add support for YunCore AX820/HWAP-AX820 There are two versions which are identical apart from the enclosure: YunCore AX820: indoor ceiling mount AP with integrated antennas YunCore HWAP-AX820: outdoor enclosure with external (N) connectors Hardware specs: SoC: MediaTek MT7621DAT Flash: 16 MiB SPI NOR RAM: 128MiB (DDR3, integrated) WiFi: MT7905DAN+MT7975DN 2.4/5GHz 2T2R 802.11ax Ethernet: 10/100/1000 Mbps x2 (WAN/PoE+LAN) LED: Status (green) Button: Reset Power: 802.11af/at PoE; DC 12V,1A Antennas: AX820(indoor): 4dBi internal; HWAP-AX820(outdoor): external Flash instructions: The "OpenWRT support" version of the AX820 comes with a LEDE-based firmware with proprietary MTK drivers and a luci webinterface and ssh accessible under 192.168.1.1 on LAN; user root, no password. The sysupgrade.bin can be flashed using luci or sysupgrade via ssh, you will have to force the upgrade due to a different factory name. Remember: Do *not* preserve factory configuration! MAC addresses as used by OEM firmware: use address source 2g 44:D1:FA:*:0b Factory 0x0004 (label) 5g 46:D1:FA:*:0b LAA of 2g lan 44:D1:FA:*:0c Factory 0xe000 wan 44:D1:FA:*:0d Factory 0xe000 + 1 The wan MAC can also be found in 0xe006 but is not used by OEM dtb. Due to different MAC handling in mt76 the LAA derived from lan is used for 2g to prevent duplicate MACs when creating multiple interfaces. Signed-off-by: Clemens Hopfer <openwrt@wireloss.net> (cherry picked from commit 4891b865380e2b7f32acf0893df9c1ca9db8d4ea) [switch to mtd-mac-address instead of nvmem-cells]
2021-07-22 17:54:15 +02:00
yuncore,ax820)
label_mac=$(mtd_get_mac_binary Factory 0x4)
;;
esac
[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
[ -n "$wan_mac" ] && ucidef_set_interface_macaddr "wan" $wan_mac
[ -n "$label_mac" ] && ucidef_set_label_macaddr $label_mac
}
board_config_update
board=$(board_name)
ramips_setup_interfaces $board
ramips_setup_macs $board
board_config_flush
exit 0