2022-07-16 21:07:20 +01:00
|
|
|
#
|
|
|
|
|
# Copyright (C) 2021 OpenWrt.org
|
|
|
|
|
#
|
|
|
|
|
|
|
|
|
|
[ -e /etc/config/ubootenv ] && exit 0
|
|
|
|
|
|
|
|
|
|
touch /etc/config/ubootenv
|
|
|
|
|
|
|
|
|
|
. /lib/uboot-envtools.sh
|
|
|
|
|
. /lib/functions.sh
|
|
|
|
|
|
|
|
|
|
board=$(board_name)
|
|
|
|
|
|
2023-11-27 03:59:32 +00:00
|
|
|
ubootenv_add_mmc_default() {
|
|
|
|
|
local envdev="$(find_mmc_part "ubootenv" "${1:-mmcblk0}")"
|
|
|
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x40000" "0x40000" "1"
|
|
|
|
|
ubootenv_add_uci_config "$envdev" "0x40000" "0x40000" "0x40000" "1"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
ubootenv_add_nor_default() {
|
|
|
|
|
local envdev="/dev/mtd$(find_mtd_index "u-boot-env")"
|
|
|
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x20000" "0x20000" "1"
|
|
|
|
|
ubootenv_add_uci_config "$envdev" "0x20000" "0x20000" "0x20000" "1"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
ubootenv_add_ubi_default() {
|
|
|
|
|
. /lib/upgrade/nand.sh
|
|
|
|
|
local envubi=$(nand_find_ubi ubi)
|
|
|
|
|
local envdev=/dev/$(nand_find_volume $envubi ubootenv)
|
|
|
|
|
local envdev2=/dev/$(nand_find_volume $envubi ubootenv2)
|
|
|
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x1f000" "0x1f000" "1"
|
|
|
|
|
ubootenv_add_uci_config "$envdev2" "0x0" "0x1f000" "0x1f000" "1"
|
|
|
|
|
}
|
|
|
|
|
|
2022-07-16 21:07:20 +01:00
|
|
|
case "$board" in
|
2024-07-06 15:30:31 +08:00
|
|
|
abt,asr3000|\
|
2025-02-20 02:40:56 +00:00
|
|
|
asus,zenwifi-bt8-ubootmod|\
|
2024-09-11 13:48:28 +08:00
|
|
|
cetron,ct3003-ubootmod|\
|
2025-02-26 21:52:53 +08:00
|
|
|
cmcc,a10-ubootmod|\
|
2025-01-13 21:52:19 +08:00
|
|
|
cudy,tr3000-v1-ubootmod|\
|
2024-07-06 15:30:31 +08:00
|
|
|
h3c,magic-nx30-pro|\
|
2024-09-16 19:33:27 +08:00
|
|
|
imou,lc-hx3001|\
|
2024-07-06 15:30:31 +08:00
|
|
|
jcg,q30-pro|\
|
2024-09-16 19:10:26 +08:00
|
|
|
livinet,zr-3020-ubootmod|\
|
2024-10-20 12:21:33 +00:00
|
|
|
mercusys,mr90x-v1-ubi|\
|
2024-07-06 15:30:31 +08:00
|
|
|
netcore,n60|\
|
2025-03-24 04:54:20 +08:00
|
|
|
netcore,n60-pro|\
|
mediatek: add support for netis NX31
This PR adds support for netis NX31 router.
Specification
-------------
- SoC : MediaTek MT7981BA dual-core ARM Cortex-A53 1.3 GHz
- RAM : 256 MiB DDR3
- Flash : SPI-NAND 128 MiB (ESMT)
- WLAN : MediaTek MT7976CN dual-band WiFi 6
- 2.4 GHz : b/g/n/ax, MIMO 2x2
- 5 GHz : a/n/ac/ax, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x3 (LAN, MediaTek MT7531AE)
10/100/1000 Mbps x1 (WAN, SoC internal phy)
- USB : No
- Buttons : Mesh, Reset
- LEDs : 1x Power (blue), unmanaged
1x Status (blue), gpio-controlled
1x WiFi 2.4 GHz (blue), gpio-controlled
1x WiFi 5 GHz (blue), gpio-controlled
3x LAN activity (blue), switch-controlled
1x WAN activity (blue), gpio-controlled
- Power : 12 VDC, 1 A
Installation
------------
1. Connect to the router using ssh (user: admin, pass: web interface
password)
2. Make mtd backup:
cat /dev/mtd0 | gzip -1 -c > /tmp/mtd0_spi0.0.bin.gz
cat /dev/mtd1 | gzip -1 -c > /tmp/mtd1_BL2.bin.gz
cat /dev/mtd2 | gzip -1 -c > /tmp/mtd2_u-boot-env.bin.gz
cat /dev/mtd3 | gzip -1 -c > /tmp/mtd3_Factory.bin.gz
cat /dev/mtd4 | gzip -1 -c > /tmp/mtd4_FIP.bin.gz
cat /dev/mtd5 | gzip -1 -c > /tmp/mtd5_ubi.bin.gz
3. Download mtd backup from the /tmp dir of the router to your PC using
scp protocol
4. Upload OpenWrt 'bl31-uboot.fip', 'preloader.bin' images to the /tmp
dir of the router using scp protocol
5. Write FIP and BL2 (replace bootloader):
mtd write /tmp/openwrt-mediatek-filogic-netis_nx31-bl31-uboot.fip FIP
mtd write /tmp/openwrt-mediatek-filogic-netis_nx31-preloader.bin BL2
6. Place OpenWrt
'openwrt-mediatek-filogic-netis_nx31-initramfs-recovery.itb' image on
the tftp server (IP: 192.168.1.254)
7. Erase 'ubi' partition and reboot the router:
mtd erase ubi
reboot
8. U-Boot automatically boot OpenWrt recovery image from tftp server to
the RAM
9. Upload OpenWrt 'sysupgrade.itb' image to the /tmp dir of the router
(IP: 192.168.1.1) using scp protocol
10. Connect to the router using ssh and run:
sysupgrade -n openwrt-mediatek-filogic-netis_nx31-squashfs-sysupgrade.itb
Return to stock
---------------
1. Unpack stock BL2 and FIP partitions backup
2. Upload stock BL2 and FIP partitions backup to the /tmp dir of the
router using scp protocol
3. Connect to the router using ssh and run:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd unlock BL2
mtd unlock FIP
4. Restore backup:
mtd write /tmp/mtd4_FIP.bin FIP
mtd write /tmp/mtd1_BL2.bin BL2
5. Erase ubi and reboot:
mtd erase ubi
reboot
6. Power off the router
7. Press Reset button and power on the router. Release the button after
~10 sec
8. Navigate to U-Boot recovery web server (http://192.168.1.1/) and
upload the OEM firmware
Recovery
--------
1. Place OpenWrt
'openwrt-mediatek-filogic-netis_nx31-initramfs-recovery.itb' image on
the tftp server (IP: 192.168.1.254)
2. Press “Reset” button and power on the router. After ~10 sec release
the button.
3. Use OpenWrt initramfs system for recovery
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | dc:xx:xx:d1:xx:18 | label |
| WAN | dc:xx:xx:d1:xx:1a | label+2 |
| WLAN 2g | de:xx:xx:11:xx:19 | |
| WLAN 5g | de:xx:xx:71:xx:19 | |
+---------+-------------------+-----------+
The LAN MAC was found in 'Factory', 0x1fef20
The WAN MAC was found in 'Factory', 0x1fef26
The WLAN 2g/5g MAC prototype was found in 'Factory', 0x4
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18324
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2025-03-22 17:33:39 +00:00
|
|
|
netis,nx31|\
|
2024-07-06 15:30:31 +08:00
|
|
|
nokia,ea0326gmp|\
|
|
|
|
|
qihoo,360t7|\
|
2024-10-26 09:37:14 +00:00
|
|
|
routerich,ax3000-ubootmod|\
|
2024-07-06 15:30:31 +08:00
|
|
|
tplink,tl-xdr4288|\
|
|
|
|
|
tplink,tl-xdr6086|\
|
|
|
|
|
tplink,tl-xdr6088|\
|
|
|
|
|
tplink,tl-xtr8488|\
|
|
|
|
|
xiaomi,mi-router-ax3000t-ubootmod|\
|
|
|
|
|
xiaomi,mi-router-wr30u-ubootmod|\
|
|
|
|
|
xiaomi,redmi-router-ax6000-ubootmod|\
|
|
|
|
|
zyxel,ex5601-t0-ubootmod)
|
|
|
|
|
ubootenv_add_ubi_default
|
|
|
|
|
;;
|
2024-11-11 10:14:55 +01:00
|
|
|
acer,predator-w6|\
|
2024-11-11 11:18:19 +01:00
|
|
|
acer,predator-w6d|\
|
|
|
|
|
acer,vero-w6m|\
|
2024-11-11 10:14:55 +01:00
|
|
|
glinet,gl-mt2500|\
|
|
|
|
|
glinet,gl-mt6000|\
|
|
|
|
|
glinet,gl-x3000|\
|
mediatek: filogic: add support for NRadio C8-668GL
NRadio C8-668GL is a Wi-Fi 6 5G cellular router based on MediaTek MT7981B SoC.
- **SoC**: MediaTek MT7981B (2x Cortex-A53, 1.3GHz)
- **RAM**: Nanya NT5AD512M16C4-JR 1GB DDR4
- **Flash**: ESMT FC51L08SFY3A 8GB eMMC
- **Ethernet**:
- 1x 2.5GbE (via GMAC0 and GPY211 PHY, shared with MT7531AE)
- 3x 10/100/1000 Mbps (via MT7531AE, connected to GMAC0)
- 5G Modem: GMAC1 (via GPY211 PHY - RTL8125BG - RM520N-GL)
- **Wi-Fi**: MediaTek MT7976CN (2.4GHz/5GHz, 802.11ax, 2x2 MIMO, AX3000)
- **Buttons**: Reset, WPS
- **LEDs**: Power, 5G, 4G, WiFi
- **SIM Slot**: 1x Nano SIM
- **5G Modem**: Quectel RM520N-GL (Snapdragon™ X62)
- **Power**: 12V/2A DC, 5.5×2.1 connector
The MAC addresses are derived from the `fac_mac` field in the `bdinfo` partition, formatted as `fac_mac = HWMAC`. The allocation is as follows:
| Vendor | OpenWrt Interface | Address | Notes |
|---------|-------------------|---------------|------------------------------------------------|
| LAN | br-lan | Label MAC | Default |
| WAN | lan4 | Label MAC+1 | Only when lan4 is switched to WAN |
| 2.4GHz | phy0-ap0 | Label MAC | |
| 5GHz | phy1-ap0 | Label MAC | (Local Admin bit set) |
| Modem | eth1 | Label MAC+2 | |
1. Log in to the router via `http://192.168.66.1`/.
2. Upgrade the official firmware to dual-system mode.
3. Select **Burn second system** and upload the `sysupgrade.bin` image.
- Download the image from the OpenWrt build system or build it yourself using the OpenWrt buildroot.
4. Wait for 30 seconds and click **Switch system**.
5. The device will reboot and switch to OpenWrt.
Set the U-Boot environment variable `boot_system=0` and reboot:
```bash
fw_setenv boot_system 0
```
Power off the router, hold the **WPS button**, and power it back on.
1. Rename the stock firmware file to **`recovery.bin`**.
2. Set your PC's Ethernet IP to **192.168.1.88** and connect it to the lan1 port on the router.
3. Run a TFTP server and place the `recovery.bin` file in its root directory.
4. Power off the router, press and hold the **Reset button**, and power it back on.
5. Release the Reset button when the TFTP server shows activity.
6. Wait for the router to flash the firmware and reboot automatically.
- By default, `lan4` is part of `br-lan` and uses the label MAC address.
- To query the RM520N-GL module, use the following command:
```bash
cat /dev/ttyUSB2 & printf 'ATI\r\n' > /dev/ttyUSB2
```
Signed-off-by: Yaoguang Bai <0xdeadc0de@badguys.club>
Link: https://github.com/openwrt/openwrt/pull/17093
Signed-off-by: John Crispin <john@phrozen.org>
2024-11-26 17:18:28 +08:00
|
|
|
glinet,gl-xe3000|\
|
2025-01-13 16:00:05 +08:00
|
|
|
huasifei,wh3000-emmc|\
|
mediatek: filogic: add support for NRadio C8-668GL
NRadio C8-668GL is a Wi-Fi 6 5G cellular router based on MediaTek MT7981B SoC.
- **SoC**: MediaTek MT7981B (2x Cortex-A53, 1.3GHz)
- **RAM**: Nanya NT5AD512M16C4-JR 1GB DDR4
- **Flash**: ESMT FC51L08SFY3A 8GB eMMC
- **Ethernet**:
- 1x 2.5GbE (via GMAC0 and GPY211 PHY, shared with MT7531AE)
- 3x 10/100/1000 Mbps (via MT7531AE, connected to GMAC0)
- 5G Modem: GMAC1 (via GPY211 PHY - RTL8125BG - RM520N-GL)
- **Wi-Fi**: MediaTek MT7976CN (2.4GHz/5GHz, 802.11ax, 2x2 MIMO, AX3000)
- **Buttons**: Reset, WPS
- **LEDs**: Power, 5G, 4G, WiFi
- **SIM Slot**: 1x Nano SIM
- **5G Modem**: Quectel RM520N-GL (Snapdragon™ X62)
- **Power**: 12V/2A DC, 5.5×2.1 connector
The MAC addresses are derived from the `fac_mac` field in the `bdinfo` partition, formatted as `fac_mac = HWMAC`. The allocation is as follows:
| Vendor | OpenWrt Interface | Address | Notes |
|---------|-------------------|---------------|------------------------------------------------|
| LAN | br-lan | Label MAC | Default |
| WAN | lan4 | Label MAC+1 | Only when lan4 is switched to WAN |
| 2.4GHz | phy0-ap0 | Label MAC | |
| 5GHz | phy1-ap0 | Label MAC | (Local Admin bit set) |
| Modem | eth1 | Label MAC+2 | |
1. Log in to the router via `http://192.168.66.1`/.
2. Upgrade the official firmware to dual-system mode.
3. Select **Burn second system** and upload the `sysupgrade.bin` image.
- Download the image from the OpenWrt build system or build it yourself using the OpenWrt buildroot.
4. Wait for 30 seconds and click **Switch system**.
5. The device will reboot and switch to OpenWrt.
Set the U-Boot environment variable `boot_system=0` and reboot:
```bash
fw_setenv boot_system 0
```
Power off the router, hold the **WPS button**, and power it back on.
1. Rename the stock firmware file to **`recovery.bin`**.
2. Set your PC's Ethernet IP to **192.168.1.88** and connect it to the lan1 port on the router.
3. Run a TFTP server and place the `recovery.bin` file in its root directory.
4. Power off the router, press and hold the **Reset button**, and power it back on.
5. Release the Reset button when the TFTP server shows activity.
6. Wait for the router to flash the firmware and reboot automatically.
- By default, `lan4` is part of `br-lan` and uses the label MAC address.
- To query the RM520N-GL module, use the following command:
```bash
cat /dev/ttyUSB2 & printf 'ATI\r\n' > /dev/ttyUSB2
```
Signed-off-by: Yaoguang Bai <0xdeadc0de@badguys.club>
Link: https://github.com/openwrt/openwrt/pull/17093
Signed-off-by: John Crispin <john@phrozen.org>
2024-11-26 17:18:28 +08:00
|
|
|
nradio,c8-668gl)
|
2024-11-11 10:14:55 +01:00
|
|
|
local envdev=$(find_mmc_part "u-boot-env")
|
|
|
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x80000"
|
|
|
|
|
;;
|
2023-11-20 08:18:00 +01:00
|
|
|
asus,rt-ax59u)
|
|
|
|
|
ubootenv_add_uci_config "/dev/mtd0" "0x100000" "0x20000" "0x20000"
|
|
|
|
|
;;
|
mediatek: add support for Bananapi BPi-R3 Mini support
Hardware specification:
SoC: MediaTek MT7986A 4x A53
Flash: 128MB SPI-NAND, 8GB eMMC
RAM: 2GB DDR4
Ethernet: 2x 2.5GbE
WiFi: MediaTek MT7976C 2x2 2.4G + 3x3 5G
Interface: M.2 B-Key, M.2 M-Key, USB 2.0
LED: Power, Status, WLAN2G, WLAN5G, LTE, SSD
Button: Reset, Boot switch
Power: 12V Type-C PD
eMMC Flash instructions:
1. SSH to BPi-R3 Mini, and upload all necessary firmware.
2. Write new GPT table:
dd if=immortalwrt-mediatek-filogic-bananapi_bpi-r3-mini-emmc-gpt.bin of=/dev/mmcblk0 bs=512 seek=0 count=34 conv=fsync
3. Erase and write new BL2:
echo 0 > /sys/block/mmcblk0boot0/force_ro
dd if=/dev/zero of=/dev/mmcblk0boot0 bs=512 count=8192 conv=fsync
dd if=immortalwrt-mediatek-filogic-bananapi_bpi-r3-mini-emmc-preloader.bin of=/dev/mmcblk0boot0 bs=512 conv=fsync
4. Erase and write new FIP:
dd if=/dev/zero of=/dev/mmcblk0 bs=512 seek=13312 count=8192 conv=fsync
dd if=immortalwrt-mediatek-filogic-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip of=/dev/mmcblk0 bs=512 seek=13312 conv=fsync
5. Set static IP on your PC:
IP 192.168.1.254, GW 192.168.1.1
6. Serve ImmortalWrt initramfs image using TFTP server.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After ImmortalWrt has booted, perform sysupgrade.
9. Additionally, if you want to have eMMC recovery boot feature:
(Don't worry! You will always have TFTP recovery boot feature.)
dd if=immortalwrt-mediatek-filogic-bananapi_bpi-r3-mini-initramfs-recovery.itb of=/dev/mmcblk0p4 bs=512 conv=fsync
NAND Flash instructions:
1. SSH to BPi-R3 Mini, and upload all necessary firmware.
2. Erase and write new BL2:
opkg install kmod-mtd-rw
mtd erase BL2
mtd write immortalwrt-mediatek-filogic-bananapi_bpi-r3-mini-snand-preloader.bin BL2
3. Erase and write new FIP:
mtd erase FIP
mtd write immortalwrt-mediatek-filogic-bananapi_bpi-r3-mini-snand-bl31-uboot.fip FIP
4. Set static IP on your PC:
IP 192.168.1.254, GW 192.168.1.1
5. Serve ImmortalWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After ImmortalWrt has booted, erase UBI volumes:
umount /mnt/ubi0*
ubidetach -p /dev/mtd4
ubiformat -y /dev/mtd4
ubiattach -p /dev/mtd4
8. Create new ubootenv volumes:
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Additionally, if you want to have NAND recovery boot feature:
(Don't worry! You will always have TFTP recovery boot feature.)
ubimkvol /dev/ubi0 -n 2 -N recovery -s 20MiB
ubiupdatevol /dev/ubi0_2 immortalwrt-mediatek-filogic-bananapi_bpi-r3-mini-initramfs-recovery.itb
10. Perform sysupgrade.
Thank you Banana Pi for providing this board.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-10-26 17:40:19 +08:00
|
|
|
bananapi,bpi-r3|\
|
mediatek: filogic: add BananaPi BPi-R3 mini
Hardware specification
----------------------
SoC: MediaTek MT7986A 4x A53
Flash: 128MB SPI-NAND, 8GB eMMC
RAM: 2GB DDR4
Ethernet: 2x 2.5GbE (Airoha EN8811H)
WiFi: MediaTek MT7976C 2x2 2.4G + 3x3 5G
Interfaces:
* M.2 Key-M: PCIe 2.0 x2 for NVMe SSD
* M.2 Key-B: USB 3.0 with SIM slot
* front USB 2.0 port
LED: Power, Status, WLAN2G, WLAN5G, LTE, SSD
Button: Reset, internal boot switch
Fan: PWM-controlled 5V fan
Power: 12V Type-C PD
Installation instructions for eMMC
----------------------------------
0. Set boot switch to boot from SPI-NAND (assuming stock rom or immortalwrt
running there).
1. Write GPT partition table to eMMC
Move openwrt-mediatek-filogic-bananapi_bpi-r3-mini-emmc-gpt.bin to
the device /tmp using scp and write it to /dev/mmcblk0:
dd if=/tmp/openwrt-*-r3-mini-emmc-gpt.bin of=/dev/mmcblk0
2. Reboot (to reload partition table)
3. Write bootloader and OpenWrt images
Move files to the device /tmp using scp:
- openwrt-*-bananapi_bpi-r3-mini-emmc-preloader.bin
- openwrt-*-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip
- openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb
- openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb
Write them to the appropriate partitions:
echo 0 > /sys/block/mmcblk0boot0/force_ro
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-preloader.bin of=/dev/mmcblk0boot0
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip of=/dev/mmcblk0p3
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb of=/dev/mmcblk0p4
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb of=/dev/mmcblk0p5
sync
4. Remove the device from power, set boot switch to eMMC and boot into
OpenWrt. The device will come up with IP 192.168.1.1 and assume the
Ethernet port closer to the USB-C power connector as LAN port.
5. If you like to have Ethernet support inside U-Boot (eg. to boot via
TFTP) you also need to write the PHY firmware to /dev/mmcblk0boot1:
echo 0 > /sys/block/mmcblk0boot1/force_ro
dd if=/lib/firmware/airoha/EthMD32.dm.bin of=/dev/mmcblk0boot1
dd if=/lib/firmware/airoha/EthMD32.DSP.bin bs=16384 seek=1 of=/dev/mmcblk0boot1
Installation instructions for NAND
----------------------------------
0. Set boot switch to boot from eMMC (assuming OpenWrt is installed there
by instructions above. Using stock rom or immortalwrt does NOT work!)
1. Write things to NAND
Move files to the device /tmp using scp:
- openwrt-*-bananapi_bpi-r3-mini-snand-preloader.bin
- openwrt-*-bananapi_bpi-r3-mini-snand-bl31-uboot.fip
- openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb
- openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb
Write them to the appropriate locations:
mtd write /tmp/openwrt-*-bananapi_bpi-r3-mini-snand-preloader.bin /dev/mtd0
ubidetach -m 1
ubiformat /dev/mtd1
ubiattach -m 1
volsize=$(wc -c < /tmp/openwrt-*-bananapi_bpi-r3-mini-snand-bl31-uboot.fip)
ubimkvol /dev/ubi0 -N fip -n 0 -s $volsize -t static
ubiupdatevol /dev/ubi0_0 /tmp/openwrt-*-bananapi_bpi-r3-mini-snand-bl31-uboot.fip
cd /lib/firmware/airoha
cat EthMD32.dm.bin EthMD32.DSP.bin > /tmp/en8811h-fw.bin
ubimkvol /dev/ubi0 -N en8811h-firmware -n 1 -s 147456 -t static
ubiupdatevol /dev/ubi0_1 /tmp/en8811h-fw.bin
ubimkvol /dev/ubi0 -n 2 -N ubootenv -s 126976
ubimkvol /dev/ubi0 -n 3 -N ubootenv2 -s 126976
volsize=$(wc -c < /tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb)
ubimkvol /dev/ubi0 -n 4 -N recovery -s $volsize
ubiupdatevol /dev/ubi0_4 /tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb
volsize=$(wc -c < /tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb)
ubimkvol /dev/ubi0 -n 4 -N recovery -s $volsize
ubiupdatevol /dev/ubi0_4 /tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb
3. Remove the device from power, set boot switch to NAND, power up and
boot into OpenWrt.
Partially based on immortalwrt support for the R3 mini, big thanks for
doing the ground work!
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2024-01-26 17:28:01 +00:00
|
|
|
bananapi,bpi-r3-mini|\
|
2024-04-02 18:53:29 +08:00
|
|
|
bananapi,bpi-r4|\
|
2024-05-02 09:00:58 +02:00
|
|
|
bananapi,bpi-r4-poe|\
|
2024-04-02 20:26:45 +08:00
|
|
|
cmcc,rax3000m|\
|
mediatek: add CMCC RAX3000Me support
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 64GB eMMC or 128 MB SPI-NAND
RAM: 512MB DDR3 or DDR4
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, Mesh
Power: DC 12V 1A
Gain SSH access:
1. Login into web interface, and download the configuration.
2. Get the SN of the device from web interface or the label on the back of the device.
3. Calculate configuration decryption password:
Command "eval" is necessary here as the encryption implentation treats '$...' as (empty) variables.
decpwd="$(eval echo $(openssl passwd -1 -salt aV6dW8bD "your_device_sn"))"
4. Decrypt the configuration:
openssl aes-256-cbc -d -pbkdf2 -k "$decpwd" -in cfg_export_config_file.conf -out cfg_export_config_file.conf.dec
5. Enter fakeroot, decompress the configuration:
tar -zxf cfg_export_config_file.conf.dec
6. Edit 'etc/shadow', update (remove) root password: 'root::19179:0:99999:7:::'
7. Edit 'etc/rc.local', insert telnetd command before 'exit 0':
( sleep 3s; telnetd; ) &
8. Repack the configuration:
tar -zc etc/ | openssl aes-256-cbc -pbkdf2 -k "$decpwd" -out cfg_export_config_file.conf
* If you find an error about 'etc/wireless/mediatek/DBDC_card0.dat',
just ignore it.
9. Upload new configuration via web interface, now you can connect to
CMCC RAX3000Me via telnet.
(Big thanks to https://github.com/lyq1996 who reverse engineered the encryption method)
Check flash type:
If '/dev/mmcblk0' exists on the device, it's eMMC version.
If '/dev/mtd0' exists on the device, it's NAND version.
eMMC Flash instructions:
1. Connect to RAX3000Me, and backup everything, especially 'factory' part.
('data' partition can be ignored, it's useless.)
2. Write new GPT table:
dd if=immortalwrt-mediatek-filogic-cmcc_rax3000me-emmc-gpt.bin of=/dev/mmcblk0 bs=512 seek=0 count=34 conv=fsync
3. Write new BL2:
echo 0 > /sys/block/mmcblk0boot0/force_ro
dd if=immortalwrt-mediatek-filogic-cmcc_rax3000me-emmc-preloader.bin of=/dev/mmcblk0boot0 bs=512 conv=fsync
4. Write new FIP:
dd if=immortalwrt-mediatek-filogic-cmcc_rax3000me-emmc-bl31-uboot.fip of=/dev/mmcblk0 bs=512 seek=13312 conv=fsync
5. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
6. Serve ImmortalWrt initramfs image using TFTP server.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After ImmortalWrt has booted, perform sysupgrade.
NAND Flash instructions:
1. Connect to RAX3000Me, and backup everything, especially 'Factory' part.
2. Write new BL2 and FIP:
If your device HAS USB port, run:
mtd write immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr3-preloader.bin BL2
mtd write immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr3-bl31-uboot.fip FIP
If your device DOES NOT have USB port, run:
mtd write immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr4-preloader.bin BL2
mtd write immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr4-bl31-uboot.fip FIP
4. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
5. Serve ImmortalWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After ImmortalWrt has booted, perform sysupgrade.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2025-03-09 02:13:33 +08:00
|
|
|
cmcc,rax3000me|\
|
2024-10-05 15:24:18 +08:00
|
|
|
jdcloud,re-cp-03|\
|
|
|
|
|
konka,komi-a31)
|
2024-07-17 16:25:05 +01:00
|
|
|
. /lib/upgrade/fit.sh
|
|
|
|
|
export_fitblk_bootdev
|
|
|
|
|
case "$CI_METHOD" in
|
|
|
|
|
ubi)
|
2023-11-27 04:01:33 +00:00
|
|
|
ubootenv_add_ubi_default
|
|
|
|
|
;;
|
2024-07-17 16:25:05 +01:00
|
|
|
emmc)
|
|
|
|
|
bootdev=${EMMC_KERN_DEV%%p[0-9]*}
|
|
|
|
|
ubootenv_add_mmc_default "${bootdev#/dev/}"
|
2022-07-16 21:07:20 +01:00
|
|
|
;;
|
2024-07-17 16:25:05 +01:00
|
|
|
default)
|
2024-01-18 22:18:14 +00:00
|
|
|
ubootenv_add_nor_default
|
2022-07-16 21:07:20 +01:00
|
|
|
;;
|
|
|
|
|
esac
|
|
|
|
|
;;
|
2024-09-11 13:13:10 +08:00
|
|
|
cetron,ct3003|\
|
2024-04-12 11:43:38 +08:00
|
|
|
edgecore,eap111|\
|
2023-12-29 11:03:29 +08:00
|
|
|
h3c,magic-nx30-pro-nmbm|\
|
2025-01-13 16:00:05 +08:00
|
|
|
livinet,zr-3020|\
|
2023-11-26 15:04:27 +08:00
|
|
|
netgear,wax220|\
|
2023-12-26 09:57:58 +08:00
|
|
|
zbtlink,zbt-z8102ax|\
|
|
|
|
|
zbtlink,zbt-z8103ax)
|
2023-11-26 15:04:27 +08:00
|
|
|
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000"
|
|
|
|
|
;;
|
2023-11-10 18:50:38 +00:00
|
|
|
comfast,cf-e393ax)
|
|
|
|
|
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x80000"
|
|
|
|
|
;;
|
mediatek: filogic: Add support for D-Link AQUILA PRO AI M60
Specification:
- MT7986 CPU using 2.4GHz and 5GHz WiFi (both AX)
- MT7531 switch
- 512MB RAM
- 128MB NAND flash (MX35LF1GE4AB-Z4I) with two UBI partitions with identical size
- 1 multi color LED (red, green, blue, white) connected via GCA230718 (Same as D-Link M30 A1)
- 3 buttons (WPS, reset, LED on/off)
- 1x 2.5 Gbit WAN port with Maxlinear GPY211C
- 4x 1 Gbit LAN ports
Disassembly:
- There are five screws at the bottom: 2 under the rubber feet, 3 under the label.
- After removing the screws, the white plastic part can be shifted out of the blue part.
- Be careful because the antennas are mounted on the side and the top of the white part.
Serial Interface
- The serial interface can be connected to the 4 pin holes next to/under the antenna cables.
- Note that there is another set of 4 pin holes on the side of the board, it's not used.
- Pins (from front to rear):
- 3.3V (do not connect)
- TX
- RX
- GND
- Settings: 115200, 8N1
MAC addresses:
- MAC address is stored in partition "Odm" at offset 0x81 (for example XX:XX:XX:XX:XX:52)
- MAC address on the device label is ODM + 1 (for example XX:XX:XX:XX:XX:53)
- WAN MAC is the one from the ODM partition (for example XX:XX:XX:XX:XX:52)
- LAN MAC is the one from the ODM partition + 1 (for example XX:XX:XX:XX:XX:53)
- WLAN MAC (2.4 GHz) is the one from the ODM partition + 2 (for example (XX:XX:XX:XX:XX:54)
- WLAN MAC (5 GHz) is the one from the ODM partition + 5 (for example (XX:XX:XX:XX:XX:57)
Flashing via OEM web interface:
- Currently not supported because image crypto is not known
Flashing via recovery web interface:
- This is only working if the first partition is active because recovery images are always flashed to the active partition and OpenWrt can only be executed from the first partition
- Use a Chromium based browser, otherwise firmware upgrade might not work
- Recovery web interface is accessible via 192.168.200.1 after keeping the reset button pressed during start of the device until the LED blinks red
- Upload the recovery image, this will take some time. LED will continue flashing red during the update process
- The after flashing, the recovery web interface redirects to http://192.168.0.1. This can be ignored. OpenWrt is accessible via 192.168.1.1 after flashing
- If the first partition isn't the active partition, OpenWrt will hang during the boot process. In this case:
- Download the recovery image from https://github.com/RolandoMagico/openwrt/releases/tag/M60-Recovery-UBI-Switch (UBI switch image)
- Enable recovery web interface again and load the UBI switch image. This image works on the second partition of the M60
- OpenWrt should boot now as expected. After booting, flash the normal OpenWrt sysupgrade image (for example in the OpenWrt web interface)
- Flashing a sysupgrade image from the UBI switch image will make the first partition the active partition and from now on, default OpenWrt images can be used
Flashing via Initramfs:
- Before switching to OpenWrt, ensure that both partitions contain OEM firmware.
- This can be achieved by re-flashing the same OEM firmware version again via the OEM web interface.
- Flashing via OEM web interface will automatically flash the currently not active partition.
- Open router, connect serial interface
- Start a TFTP server at 192.168.200.2 and provide the initramfs image there
- When starting the router, select "7. Load Image" in U-Boot
- Settings for load address, load method can be kept as they are
- Specify host and router IP address if you use different ones than the default (Router 192.168.200.1, TFTP server 192.168.200.2)
- Enter the file name of the initramfs image
- Confirm "Run loaded data now?" question after loading the image with "Y"
- OpenWrt initramfs will start now
- Before flashing OpenWrt, create a backup of the "ubi" partition. It is required when reverting back to OEM
- Flash sysupgrade image to flash, during flashing the U-Boot variable sw_tryactive will be set to 0
- During next boot, U-Boot tries to boot from the ubi partition. If it fails, it will switch to the ubi1 partition
Reverting back to OEM:
- Boot the initramfs image as described in "Flashing via Initramfs" above
- Copy the backed up ubi partition to /tmp (e.g. by using SCP)
- Write the backup to the UBI partition: mtd write /tmp/OpenWrt.mtd4.ubi.bin /dev/mtd4
- Reboot the device, OEM firmware will start now
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17296
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2024-12-13 18:58:26 +01:00
|
|
|
dlink,aquila-pro-ai-m30-a1|\
|
|
|
|
|
dlink,aquila-pro-ai-m60-a1)
|
filogic: Add support for D-Link AQUILA PRO AI M30
Specification:
- MT7981 CPU using 2.4GHz and 5GHz WiFi (both AX)
- MT7531 switch
- 512MB RAM
- 128MB NAND flash with two UBI partitions with identical size
- 1 multi color LED (red, green, blue, white) connected via GCA230718
- 3 buttons (WPS, reset, LED on/off)
- 1 1Gbit WAN port
- 4 1Gbit LAN ports
Disassembly:
- There are four screws at the bottom: 2 under the rubber feets, 2 under the label.
- After removing the screws, the white plastic part can be shifted out of the blue part.
- Be careful because the antennas are mounted on the side and the top of the white part.
Serial Interface
- The serial interface can be connected to the 4 pin holes on the side of the board.
- Pins (from front to rear):
- 3.3V
- RX
- TX
- GND
- Settings: 115200, 8N1
MAC addresses:
- WAN MAC is stored in partition "Odm" at offset 0x81
- LAN (as printed on the device) is WAN MAC + 1
- WLAN MAC (2.4 GHz) is WAN MAC + 2
- WLAN MAC (5GHz) is WAN MAC + 3
Flashing via Recovery Web Interface:
- The recovery web interface always flashes to the currently active partition.
- If OpenWrt is flahsed to the second partition, it will not boot.
- Ensure that you have an OEM image available (encrypted and decrypted version). Decryption is described in the end.
- Set your IP address to 192.168.200.10, subnetmask 255.255.255.0
- Press the reset button while powering on the device
- Keep the reset button pressed until the LED blinks red
- Open a Chromium based and goto http://192.168.200.1 (recovery web interface)
- Download openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-recovery.bin
- The recovery web interface always reports successful flashing, even if it fails
- After flashing, the recovery web interface will try to forward the browser to 192.168.0.1 (can be ignored)
- If OpenWrt was flashed to the first partition, OpenWrt will boot (The status LED will start blinking white and stay white in the end). In this case you're done and can use OpenWrt.
- If OpenWrt was flashed to the second partition, OpenWrt won't boot (The status LED will stay red forever). In this case, the following steps are reuqired:
- Start the web recovery interface again and flash the **decrypted OEM image**. This will be flashed to the second partition as well. The OEM firmware web interface is afterwards accessible via http://192.168.200.1.
- Now flash the **encrypted OEM image** via OEM firmware web interface. In this case, the new firmware is flashed to the first partition. After flashing and the following reboot, the OEM firmware web interface should still be accessible via http://192.168.200.1.
- Start the web recovery interface again and flash the OpenWrt recovery image. Now it will be flashed to the first partition, OpenWrt will boot correctly afterwards and is accessible via 192.168.1.1.
Flashing via U-Boot:
- Open the case, connect to the UART console
- Set your IP address to 192.168.200.2, subnet mask 255.255.255.0. Connect to one of the LAN interfaces of the router
- Run a tftp server which provides openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-initramfs-kernel.bin.
- Power on the device and select "7. Load image" in the U-Boot menu
- Enter image file, tftp server IP and device IP (if they differ from the default).
- TFTP download to RAM will start. After a few seconds OpenWrt initramfs should start
- The initramfs is accessible via 192.168.1.1, change your IP address accordingly (or use multiple IP addresses on your interface)
- Perform a sysupgrade using openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-sysupgrade.bin
- Reboot the device. OpenWrt should start from flash now
Revert back to stock using the Recovery Web Interface:
- Set your IP address to 192.168.200.2, subnetmask 255.255.255.0
- Press the reset button while powering on the device
- Keep the reset button pressed until the LED blinks red
- Open a Chromium based and goto http://192.168.200.1 (recovery web interface)
- Flash a decrypted firmware image from D-Link. Decrypting an firmware image is described below.
Decrypting a D-Link firmware image:
- Download https://github.com/RolandoMagico/firmware-utils/blob/M32/src/m32-firmware-util.c
- Compile a binary from the downloaded file, e.g. gcc m32-firmware-util.c -lcrypto -o m32-firmware-util
- Run ./m32-firmware-util M30 --DecryptFactoryImage <OriginalFirmware> <OutputFile>
- Example for firmware M30A1_FW101B05: ./m32-firmware-util M30 --DecryptFactoryImage M30A1_FW101B05\(0725091522\).bin M30A1_FW101B05\(0725091522\)_decrypted.bin
Flashing via OEM web interface is not possible, as it will change the active partition and OpenWrt is only running on the first UBI partition.
Controlling the LEDs:
- The LEDs are controlled by a chip called "GCA230718" which is connected to the main CPU via I2C (address 0x40)
- I didn't find any documentation or driver for it, so the information below is purely based on my investigations
- If there is already I driver for it, please tell me. Maybe I didn't search enough
- I implemented a kernel module (leds-gca230718) to access the LEDs via DTS
- The LED controller supports PWM for brightness control and ramp control for smooth blinking. This is not implemented in the driver
- The LED controller supports toggling (on -> off -> on -> off) where the brightness of the LEDs can be set individually for each on cycle
- Until now, only simple active/inactive control is implemented (like when the LEDs would have been connected via GPIO)
- Controlling the LEDs requires three sequences sent to the chip. Each sequence consists of
- A reset command (0x81 0xE4) written to register 0x00
- A control command (for example 0x0C 0x02 0x01 0x00 0x00 0x00 0xFF 0x01 0x00 0x00 0x00 0xFF 0x87 written to register 0x03)
- The reset command is always the same
- In the control command
- byte 0 is always the same
- byte 1 (0x02 in the example above) must be changed in every sequence: 0x02 -> 0x01 -> 0x03)
- byte 2 is set to 0x01 which disables toggling. 0x02 would be LED toggling without ramp control, 0x03 would be toggling with ramp control
- byte 3 to 6 define the brightness values for the LEDs (R,G,B,W) for the first on cycle when toggling
- byte 7 defines the toggling frequency (if toggling enabled)
- byte 8 to 11 define the brightness values for the LEDs (R,G,B,W) for the second on cycle when toggling
- byte 12 is constant 0x87
Comparison to M32/R32:
- The algorithms for decrypting the OEM firmware are the same for M30/M32/R32, only the keys differ
- The keys are available in the GPL sources for the M32
- The M32/R32 contained raw data in the firmware images (kernel, rootfs), the R30 uses a sysupgrade tar instead
- Creation of the recovery image is quite similar, only the header start string changes. So mostly takeover from M32/R32 for that.
- Turned out that the bytes at offset 0x0E and 0x0F in the recovery image header are the checksum over the data area
- This checksum was not checked in the recovery web interface of M32/R32 devices, but is now active in R30
- I adapted the recovery image creation to also calculate the checksum over the data area
- The recovery image header for M30 contains addresses which don't match the memory layout in the DTS. The same addresses are also present in the OEM images
- The recovery web interface either calculates the correct addresses from it or has it's own logic to determine where which information must be written
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
2023-12-24 14:42:23 +01:00
|
|
|
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x40000" "0x40000"
|
|
|
|
|
;;
|
2024-11-09 22:14:32 +01:00
|
|
|
gatonetworks,gdsp)
|
|
|
|
|
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x10000"
|
|
|
|
|
;;
|
2023-06-05 03:02:07 +00:00
|
|
|
glinet,gl-mt3000)
|
|
|
|
|
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x80000" "0x20000"
|
|
|
|
|
;;
|
2023-12-09 17:17:02 +00:00
|
|
|
mercusys,mr90x-v1|\
|
mediatek: filogic: add support for TP-LINK RE6000XD
This commit adds support for TP-LINK RE6000XD.
The device is quite similar to the Mercusys MR90X V1,
except only 3 LAN ports and more LEDs.
So thanks to csharper2005 for doing all the groundwork.
Device specification
--------------------
SoC Type: MediaTek MT7986BLA, Cortex-A53, 64-bit
RAM: MediaTek MT7986BLA (512MB)
Flash: SPI NAND GigaDevice (128 MB)
Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8)
Ethernet: 1x2.5Gbe (LAN3 2.5Gbps), 2xGbE (LAN 1Gbps, LAN1,
LAN2)
WLAN 2g: MediaTek MT7975N, b/g/n/ax, MIMO 4x4
WLAN 5g: MediaTek MT7975P(N), a/n/ac/ax, MIMO 4x4
LEDs: 8 LEDs, 1 status blue, 2x WIFI blue, 2x signal
blue/red, 3 LAN blue gpio-controlled
Button: 2 (Reset, WPS)
USB ports: No
Power: 12 VDC, 2 A
Connector: Barrel
Bootloader: Main U-Boot - U-Boot 2022.01-rc4. Additionally, ubi0
partition contain "seconduboot" (also U-Boot 2022.01-rc4)
Serial console (UART), unpopulated
---------------------
V
+-------+-------+-------+-------+
| +3.3V | GND | TX | RX |
+---+---+-------+-------+-------+
|
+--- Don't connect
Disassemble: rm the 2 screws at the bottom and the one at the backside.
un-clip the case starting at the edge above the LEDs.
Installation (UART)
-------------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
tftpboot openwrt-mediatek-filogic-tplink_re6000xd-initramfs-kernel.bin bootm
4. Run 'sysupgrade -n' with the sysupgrade OpenWrt image
Notice: while I was successfull at activating ssh (as described
here:
https://www.lisenet.com/2023/gaining-ssh-access-to-tp-link-re200-wi-fi-range-extender/)
Unfortunately I haven't found the correct root password.
Looks like they are using a static password
(md5crypt, salt + 21 characters) that is not the web
interface admin password.
The TP-LINK RE900XD looks like the very same device,
according to the pictures and the firmware.
But I haven't checked if the OpenWrt firmware works as well
on that device.
The second ubi partition (ubi1) is empty and there is no known
dual-partition mechanism, neither in u-boot nor in the stock firmware.
Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
2024-05-17 17:33:00 +02:00
|
|
|
routerich,ax3000|\
|
mediatek: filogic: add support for Tenbay WR3000K
Tenbay WR3000K is an 802.11ax (Wi-Fi 6) router, based on MediaTek MT7981B.
- SoC: MetiaTek MT7981B
- RAM: Hynex H5TQ2G863GFR 512MiB
- Flash: Winbond W25N01GVZEIG 128MiB
- Wi-Fi: MediaTek MT7976C (2.4GHz/5GHz, 802.11ax, 2x2 MIMO, AX3000)
- MediaTek MT7915E: 2.4GHz and 5GHz
- Ethernet: 1x 10/100/1000 Mbps WAN + 3x 10/100/1000 Mbps LAN
- Switch: MediaTek MT7531AE
- UART: J4 (115200 baud)
- LEDs: Power
- Buttons: Reset, WPS
- PWR: 12V/1A DC, 5.5×2.1 connector
| Vendor | OpenWrt Interface | Address | Notes |
|---------|-------------------|---------------|------------------------------------------------|
| WAN | wan | Label MAC | Stored MAC in factory + offset 4, label MAC is Stored MAC - 2 |
| LAN | br-lan | Label MAC+1 | |
| 2.4GHz | phy0-ap0 | Label MAC + 2 | |
| 5GHz | phy1-ap0 | Label MAC + 3 | |
- 0x000000000000-0x000000100000 : "BL2"
- 0x000000100000-0x000000180000 : "u-boot-env"
- 0x000000180000-0x000000380000 : "Factory"
- 0x000000380000-0x000000580000 : "FIP"
- 0x000000580000-0x000003580000 : "ubi"
- 0x000003580000-0x000006580000 : "ubi1"
- 0x000006580000-0x0000065a0000 : "Product"
- 0x0000065a0000-0x000007580000 : "Custom"
- The original partition-Ubi partition-Ubi1 is an AB dual system, and Openwrt only uses Ubi. So flash requires modifying the uboot variable `boot_from=ubi` to ensure that it only starts from Ubi.
- The Product and Custom partitions are original and only exist to align with the original layout; they are not used by OpenWrt.
- id: 0, kernel
- id: 1, rootfs
- id: 2, rootfs_data
- **USB-to-TTL Serial Adapter** (e.g., CH340 or CP2102).
- **Dupont Wires** (male-to-male, 3 wires).
- **PC/Laptop** with a serial communication tool.
- Screwdriver (to open the router case).
1. **OpenWrt Firmware**:
- Download the appropriate `wr3000k-<build_time>-mediatek-filogic-tenbay_wr3000k-squashfs-sysupgrade.bin` firmware file for your router from the [OpenWrt website](https://openwrt.org/).
2. **Serial Communication Tool**:
- Windows: PuTTY, Tera Term.
- Linux/Mac: Minicom, screen.
3. (Optional) **TFTP Server**:
- Install a TFTP server like Tftpd64 or tftp-hpa.
---
1. Open the router casing and locate the **TX, RX, and GND** pins.
2. Connect the router pins to the USB-to-TTL adapter as follows:
- **TX (router)** → **RX (adapter)**
- **RX (router)** → **TX (adapter)**
- **GND (router)** → **GND (adapter)**
3. Do **not** connect the VCC pin to avoid damage.
- **Baud rate**: 115200
- **Data bits**: 8
- **Stop bits**: 1
- **Parity**: None
- **Flow control**: None
---
1. Power on the router and observe the serial terminal output.
2. When prompted (e.g., `Hit any key to stop autoboot: 3`), press the '/' key quickly to interrupt the boot process.
3. You will see the U-Boot Boot Menu:
```plaintext
*** U-Boot Boot Menu ***
1. Factory mode
2. Startup system (Default)
3. Upgrade firmware
4. Upgrade ATF BL2
5. Upgrade ATF FIP
6. Upgrade single image
7. Load image
0. U-Boot console
Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit
```
4. Select Option 0 by typing 0 and pressing Enter.
5. Input into
```plaintext
MT7981> setenv boot_from ubi
MT7981> saveenv
Saving Environment to MTD... Erasing on MTD device 'nmbm0'... OK
Writing to MTD device 'nmbm0'... OK
OK
MT7981> printenv
baudrate=115200
boot_from=ubi
...
```
the above indicates system will start from *ubi*.
and then type
```plaintext
MT7981> reset
```
will boot from *ubi*
1. Power on the router and observe the serial terminal output.
2. When prompted (e.g., `Hit any key to stop autoboot: 3`), press the '/' key quickly to interrupt the boot process.
3. You will see the U-Boot Boot Menu:
```plaintext
*** U-Boot Boot Menu ***
1. Factory mode
2. Startup system (Default)
3. Upgrade firmware
4. Upgrade ATF BL2
5. Upgrade ATF FIP
6. Upgrade single image
7. Load image
0. U-Boot console
Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit
```
4. Choose Option 3: Upgrade Firmware
Enter Upgrade Mode
Select Option 3 by typing 3 and pressing Enter.
Upgrade Methods
You will be prompted to choose between:
```plaintext
*** Upgrading Firmware ***
Run image after upgrading? (Y/n): y
Available load methods:
0 - TFTP client (Default)
1 - Xmodem
2 - Ymodem
3 - Kermit
4 - S-Record
5 - RAM
Select (enter for default): 0
Input U-Boot's IP address: 192.168.1.1
Input TFTP server's IP address: 192.168.1.10
Input IP netmask: 255.255.255.0
Input file name: wr3000k-<build_time>-mediatek-filogic-tenbay_wr3000k-squashfs-sysupgrade.bin
```
Type Enter to proceed. The router will erase the old firmware and write the new one.
Signed-off-by: Jianyu Zhuang <xzjianyu@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17172
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2024-12-10 15:38:20 +08:00
|
|
|
tenbay,wr3000k|\
|
mediatek: filogic: add support for TP-LINK RE6000XD
This commit adds support for TP-LINK RE6000XD.
The device is quite similar to the Mercusys MR90X V1,
except only 3 LAN ports and more LEDs.
So thanks to csharper2005 for doing all the groundwork.
Device specification
--------------------
SoC Type: MediaTek MT7986BLA, Cortex-A53, 64-bit
RAM: MediaTek MT7986BLA (512MB)
Flash: SPI NAND GigaDevice (128 MB)
Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8)
Ethernet: 1x2.5Gbe (LAN3 2.5Gbps), 2xGbE (LAN 1Gbps, LAN1,
LAN2)
WLAN 2g: MediaTek MT7975N, b/g/n/ax, MIMO 4x4
WLAN 5g: MediaTek MT7975P(N), a/n/ac/ax, MIMO 4x4
LEDs: 8 LEDs, 1 status blue, 2x WIFI blue, 2x signal
blue/red, 3 LAN blue gpio-controlled
Button: 2 (Reset, WPS)
USB ports: No
Power: 12 VDC, 2 A
Connector: Barrel
Bootloader: Main U-Boot - U-Boot 2022.01-rc4. Additionally, ubi0
partition contain "seconduboot" (also U-Boot 2022.01-rc4)
Serial console (UART), unpopulated
---------------------
V
+-------+-------+-------+-------+
| +3.3V | GND | TX | RX |
+---+---+-------+-------+-------+
|
+--- Don't connect
Disassemble: rm the 2 screws at the bottom and the one at the backside.
un-clip the case starting at the edge above the LEDs.
Installation (UART)
-------------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
tftpboot openwrt-mediatek-filogic-tplink_re6000xd-initramfs-kernel.bin bootm
4. Run 'sysupgrade -n' with the sysupgrade OpenWrt image
Notice: while I was successfull at activating ssh (as described
here:
https://www.lisenet.com/2023/gaining-ssh-access-to-tp-link-re200-wi-fi-range-extender/)
Unfortunately I haven't found the correct root password.
Looks like they are using a static password
(md5crypt, salt + 21 characters) that is not the web
interface admin password.
The TP-LINK RE900XD looks like the very same device,
according to the pictures and the firmware.
But I haven't checked if the OpenWrt firmware works as well
on that device.
The second ubi partition (ubi1) is empty and there is no known
dual-partition mechanism, neither in u-boot nor in the stock firmware.
Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
2024-05-17 17:33:00 +02:00
|
|
|
tplink,re6000xd)
|
mediatek: add support for Mercusys MR90X v1
This commit adds support for Mercusys MR90X(EU) v1 router.
Device specification
--------------------
SoC Type: MediaTek MT7986BLA, Cortex-A53, 64-bit
RAM: MediaTek MT7986BLA (512MB)
Flash: SPI NAND GigaDevice GD5F1GQ5UEYIGY (128 MB)
Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8)
Ethernet: 1x2.5Gbe (WAN/LAN 2.5Gbps), 3xGbE (WAN/LAN 1Gbps, LAN1, LAN2)
WLAN 2g: MediaTek MT7975N, b/g/n/ax, MIMO 4x4
WLAN 5g: MediaTek MT7975P(N), a/n/ac/ax, MIMO 4x4
LEDs: 1 orange and 1 green status LEDs, 4 green gpio-controlled
LEDs on ethernet ports
Button: 1 (Reset)
USB ports: No
Power: 12 VDC, 2 A
Connector: Barrel
Bootloader: Main U-Boot - U-Boot 2022.01-rc4. Additionally, both UBI
slots contain "seconduboot" (also U-Boot 2022.01-rc4)
Serial console (UART)
---------------------
V
+-------+-------+-------+-------+
| +3.3V | GND | TX | RX |
+---+---+-------+-------+-------+
|
+--- Don't connect
The R3 (TX line) and R6 (RX line) are absent on the PCB. You should
solder them or solder the jumpers.
Installation (UART)
-------------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
tftpboot initramfs-kernel.bin
bootm
4. Once inside OpenWrt, set / update env variables:
fw_setenv baudrate 115200
fw_setenv bootargs "ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit"
fw_setenv fdtcontroladdr 5ffc0e70
fw_setenv ipaddr 192.168.1.1
fw_setenv loadaddr 0x46000000
fw_setenv mtdids "spi-nand0=spi-nand0"
fw_setenv mtdparts "spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)"
fw_setenv netmask 255.255.255.0
fw_setenv serverip 192.168.1.2
fw_setenv stderr serial@11002000
fw_setenv stdin serial@11002000
fw_setenv stdout serial@11002000
fw_setenv tp_boot_idx 0
5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image
Installation (without UART)
---------------------------
1. Login as root via SSH (router IP, port 20001, password - your web
interface password)
2. Open for editing /etc/hotplug.d/iface/65-iptv (e.g., using WinSCP and
SSH settings from the p.1)
3. Add a newline after "#!/bin/sh":
telnetd -l /bin/login.sh
4. Save "65-iptv" file
5. Toggle "IPTV/VLAN Enable" checkbox in the router web interface and
save
6. Make sure that telnetd is running:
netstat -ltunp | grep 23
7. Login via telnet to router IP, port 23 (no username and password are
required)
8 Upload OpenWrt "initramfs-kernel.bin" to the "/tmp" folder of the
router (e.g., using WinSCP and SSH settings from the p.1)
9. Stock busybox doesn't contain ubiupdatevol command. Hence, we need to
download and upload the full version of busybox to the router. For
example, from here:
https://github.com/xerta555/Busybox-Binaries/raw/master/busybox-arm64
Upload busybox-arm64 to the /tmp dir of the router and run:
in the telnet shell:
cd /tmp
chmod a+x busybox-arm64
10. Check "initramfs-kernel.bin" size:
du -h initramfs-kernel.bin
11. Delete old and create new "kernel" volume with appropriate size
(greater than "initramfs-kernel.bin" size):
ubirmvol /dev/ubi0 -N kernel
ubimkvol /dev/ubi0 -n 1 -N kernel -s 9MiB
12. Write OpenWrt "initramfs-kernel.bin" to the flash:
./busybox-arm64 ubiupdatevol /dev/ubi0_1 /tmp/initramfs-kernel.bin
13. u-boot-env can be empty so lets create it (or overwrite it if it
already exists) with the necessary values:
fw_setenv baudrate 115200
fw_setenv bootargs "ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit"
fw_setenv fdtcontroladdr 5ffc0e70
fw_setenv ipaddr 192.168.1.1
fw_setenv loadaddr 0x46000000
fw_setenv mtdids "spi-nand0=spi-nand0"
fw_setenv mtdparts "spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)"
fw_setenv netmask 255.255.255.0
fw_setenv serverip 192.168.1.2
fw_setenv stderr serial@11002000
fw_setenv stdin serial@11002000
fw_setenv stdout serial@11002000
fw_setenv tp_boot_idx 0
14. Reboot to OpenWrt initramfs:
reboot
15. Login as root via SSH (IP 192.168.1.1, port 22)
16. Upload OpenWrt sysupgrade.bin image to the /tmp dir of the router
17. Run sysupgrade:
sysupgrade -n /tmp/sysupgrade.bin
Recovery
--------
1. Press Reset button and power on the router
2. Navigate to U-Boot recovery web server (http://192.168.1.1/) and
upload the OEM firmware
Recovery (UART)
---------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
tftpboot initramfs-kernel.bin
bootm
4. Do what you need (restore partitions from a backup, install OpenWrt
etc.)
Stock layout
------------
0x000000000000-0x000000200000 : "boot"
0x000000200000-0x000000300000 : "u-boot-env"
0x000000300000-0x000003500000 : "ubi0"
0x000003500000-0x000006700000 : "ubi1"
0x000006700000-0x000006f00000 : "userconfig"
0x000006f00000-0x000007300000 : "tp_data"
ubi0/ubi1 format
----------------
U-Boot at boot checks that all volumes are in place:
+-------------------------------+
| Volume Name: uboot Vol ID: 0|
| Volume Name: kernel Vol ID: 1|
| Volume Name: rootfs Vol ID: 2|
+-------------------------------+
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| label | 00:eb:xx:xx:xx:be | label |
| LAN | 00:eb:xx:xx:xx:be | label |
| WAN | 00:eb:xx:xx:xx:bf | label+1 |
| WLAN 2g | 00:eb:xx:xx:xx:be | label |
| WLAN 5g | 00:eb:xx:xx:xx:bd | label-1 |
+---------+-------------------+-----------+
label MAC address was found in UBI partition "tp_data", file
"default-mac". OEM wireless eeprom is also there (file
"MT7986_EEPROM.bin").
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2023-05-13 13:51:45 +00:00
|
|
|
local envdev=/dev/mtd$(find_mtd_index "u-boot-env")
|
|
|
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x20000" "0x20000" "1"
|
|
|
|
|
;;
|
2024-03-07 14:19:08 +08:00
|
|
|
openembed,som7981)
|
|
|
|
|
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x80000" "0x80000"
|
|
|
|
|
ubootenv_add_uci_sys_config "/dev/mtd3" "0x0" "0x100000" "0x100000"
|
|
|
|
|
;;
|
2024-08-31 18:59:35 +02:00
|
|
|
openwrt,one)
|
|
|
|
|
ubootenv_add_ubi_default
|
|
|
|
|
;;
|
2024-04-19 17:51:51 +01:00
|
|
|
smartrg,sdg-8733|\
|
2024-08-20 23:14:30 +01:00
|
|
|
smartrg,sdg-8733a|\
|
2024-04-19 17:51:51 +01:00
|
|
|
smartrg,sdg-8734)
|
|
|
|
|
local envdev=$(find_mmc_part "u-boot-env" "mmcblk0")
|
|
|
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x8000" "0x8000"
|
|
|
|
|
;;
|
2023-09-17 07:59:48 -07:00
|
|
|
ubnt,unifi-6-plus)
|
|
|
|
|
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x80000" "0x10000"
|
2023-04-10 23:36:59 +02:00
|
|
|
;;
|
2023-11-27 12:01:34 +03:00
|
|
|
xiaomi,mi-router-ax3000t|\
|
2023-07-20 17:42:58 +00:00
|
|
|
xiaomi,mi-router-wr30u-stock|\
|
mediatek: add alternative stock layout for Xiaomi Redmi Router AX6000
In this implementation, the flash partition layout is adjusted to avoid
modifying the uboot environment of mtdparts. This ensures that the 30M
ubi_kernel partition remains aligned with the stock ubi partition, and
the kernel volume is placed in it. This allows the stock uboot to boot
from it without changing the mtdparts, which is useful for reverting back
to the stock firmware using Xiaomi Firmware Tools. In actual testing,
modifying mtdparts has been found to break Xiaomi Firmware Tools.
1. use ARTIFACTS to generate initramfs-factory.ubi for easy installation.
2. The NAND flash layout is changed to allow for reverting back to the
stock firmware.
3. Before performing sysupgrade, do some cleanup in platform_pre_upgrade
to ensure a clean installation of OpenWRT.
4. Setup the uboot env to ensure that the system always boot, which can
be helpful for users who may forget to do this before sysupgrade in
the initramfs.
New flash instructions:
1. Gain ssh access. Please refer to:
https://openwrt.org/toh/xiaomi/redmi_ax6000#installation)
2. Check which system current u-boot is loading from:
COMMAND: `cat /proc/cmdline`
sample OUTPUT: `console=ttyS0,115200n1 loglevel=8 firmware=1 uart_en=1`
if firmware=1, current system is ubi1
if firmware=0, current system is ubi0
3. Setup nvram and write the firmware:
If the current system is ubi1, please set it up so that the next time
it will boot from ubi, and write the firmware to ubi:
```
nvram set boot_wait=on
nvram set uart_en=1
nvram set flag_boot_rootfs=0
nvram set flag_last_success=0
nvram set flag_boot_success=1
nvram set flag_try_sys1_failed=0
nvram set flag_try_sys2_failed=0
nvram commit
ubiformat /dev/mtd8 -y -f /tmp/initramfs-factory.ubi
```
If the current system is ubi, please set it up so that the next time
it will boot from ubi1, and write the firmware to ubi1:
```
nvram set boot_wait=on
nvram set uart_en=1
nvram set flag_boot_rootfs=1
nvram set flag_last_success=1
nvram set flag_boot_success=1
nvram set flag_try_sys1_failed=0
nvram set flag_try_sys2_failed=0
nvram commit
ubiformat /dev/mtd9 -y -f /tmp/initramfs-factory.ubi
```
4. After rebooting, the system should now boot into the openwrt initramfs.
Flash the squashfs-sysupgrade.bin via using ssh or luci.
```
sysupgrade -n /tmp/squashfs-sysupgrade.bin
```
Done.
For existing users of the Redmi AX6000 running OpenWrt, here are the steps to
switch to this new layout:
1. Flash initramfs-factory.ubi
```
mtd -r -e ubi write /tmp/initramfs-factory.ubi ubi
```
2. After rebooting, the system will boot into the new openwrt-initramfs.
Log in and perform a sysupgrade to complete the process.
```
sysupgrade -n /tmp/squashfs-sysupgrade.bin
```
Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
2022-09-13 13:46:20 +08:00
|
|
|
xiaomi,redmi-router-ax6000-stock)
|
mediatek: add Xiaomi Redmi Router AX6000 support
Hardware specification:
SoC: MediaTek MT7986A 4x A53
Flash: ESMT F50L1G41LB 128 MB
RAM: K4A4G165WF-BCWE 512 MB
Ethernet: 4x 10/100/1000 Mbps
WiFi1: MT7976GN 2.4GHz ax 4x4
WiFi2: MT7976AN 5GHz ax 4x4
Button: Mesh, Reset
Flash instructions:
1. Gain ssh and serial port access, see the link below:
https://openwrt.org/toh/xiaomi/redmi_ax6000#installation
2. Use ssh or serial port to log in to the router, and
execute the following command:
nvram set boot_wait=on
nvram set flag_boot_rootfs=0
nvram set flag_boot_success=1
nvram set flag_last_success=1
nvram set flag_try_sys1_failed=8
nvram set flag_try_sys2_failed=8
nvram commit
3. Set a static ip on the ethernet interface of your computer
(e.g. default: ip 192.168.31.100, gateway 192.168.31.1)
4. Download the initramfs image, rename it to initramfs.bin,
and host it with the tftp server.
5. Interrupt U-Boot and run these commands:
setenv mtdparts nmbm0:1024k(bl2),256k(Nvram),256k(Bdata),2048k(factory),2048k(fip),256k(crash),256k(crash_log),112640k(ubi)
saveenv
tftpboot initramfs.bin
bootm
6. After openwrt boots up, use scp or luci web
to upload sysupgrade.bin to upgrade.
Revert to stock firmware:
Restore mtdparts back to default, then use the
vendor's recovery tool (Windows only).
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
2022-09-18 23:16:18 +08:00
|
|
|
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x20000"
|
|
|
|
|
ubootenv_add_uci_sys_config "/dev/mtd2" "0x0" "0x10000" "0x20000"
|
|
|
|
|
;;
|
mediatek: add support for Zyxel EX5601-T0 router
Zyxel EX5601-T0 specifics
--------------
The operator specific firmware running on the Zyxel branded
EX5601-T0 includes U-Boot modifications affecting the OpenWrt
installation.
Partition Table
| dev | size | erasesize | name |
| ---- | -------- | --------- | ------------- |
| mtd0 | 20000000 | 00040000 | "spi0.1" |
| mtd1 | 00100000 | 00040000 | "BL2" |
| mtd2 | 00080000 | 00040000 | "u-boot-env" |
| mtd3 | 00200000 | 00040000 | "Factory" |
| mtd4 | 001c0000 | 00040000 | "FIP" |
| mtd5 | 00040000 | 00040000 | "zloader" |
| mtd6 | 04000000 | 00040000 | "ubi" |
| mtd7 | 04000000 | 00040000 | "ubi2" |
| mtd8 | 15a80000 | 00040000 | "zyubi" |
The router boots BL2 which than loads FIP (u-boot).
U-boot has hardcoded a command to always launch Zloader "mtd read zloader 0x46000000" and than "bootm". Bootargs are deactivated.
Zloader is the zyxel booloader which allow to dual-boot ubi or ubi2, by default access to zloader is blocked.
Too zloader checks that the firmware contains a particolar file called zyfwinfo.
Additional details regarding Zloader can be found here:
https://hack-gpon.github.io/zyxel/
https://forum.openwrt.org/t/adding-openwrt-support-for-zyxel-ex5601-t0/155914
Hardware
--------
SOC: MediaTek MT7986a
CPU: 4 core cortex-a53 (2000MHz)
RAM: 1GB DDR4
FLASH: 512MB SPI-NAND (Micron xxx)
WIFI: Wifi6 Mediatek MT7976 802.11ax 5 GHz 4x4 + 2.4GHZ 4x4
ETH: MediaTek MT7531 Switch + SoC
3 x builtin 1G phy (lan1, lan2, lan3)
1 x MaxLinear GPY211B 2.5 N-Base-T phy5 (lan4)
1 x MaxLinear GPY211B 2.5Gbit xor SFP/N-Base-T phy6 (wan)
USB: 1 x USB 3.2 Enhanced SuperSpeed port
UART: 3V3 115200 8N1 (Pinout: GND KEY RX TX VCC)
VOIP: 2 FXS ports for analog phones
MAC Address Table
-----------------
eth0/lan Factory 0x002a
eth1/wan Factory 0x0024
wifi 2.4Ghz Factory 0x0004
wifi 5Ghz Factory 0x0004 + 1
Serial console (UART)
---------------------
+-------+-------+-------+-------+-------+
| +3.3V | RX | TX | KEY | GND |
+---+---+-------+-------+-------+-------+
|
+--- Don't connect
Installation
------------
Keep in mind that openwrt can only run on the UBI partition, the openwrt firmware is not able to understand the zloader bootargs.
The procedure allows restoring the UBI partition with the Zyxel firmware and retains all the OEM functionalities.
1. Unlock Zloader (this will allow to swap manually between partitions UBI and UBI2):
- Attach a usb-ttl adapter to your computer and boot the router.
- While the router is booting at some point you will read the following: `Please press Enter to activate this console.`
- As soon as you read that press enter, type root and than press enter again (just do it, don't care about the logs scrolling).
- Most likely the router is still printing the boot log, leave it boot until it stops.
- If everything went ok you should have full root access "root@EX5601-T0:/#".
- Type the following command and press enter: "fw_setenv EngDebugFlag 0x1".
- Reboot the router.
- As soon as you read `Hit any key to stop autoboot:` press Enter.
- If everything went ok you should have the following prompt: "ZHAL>".
- You have successfully unlocked zloader access, this procedure must be done only once.
2. Check the current active partition:
- Boot the router and repeat the steps above to gain root access.
- Type the following command to check the current active image: "cat /proc/cmdline".
- If `rootubi=ubi` it means that the active partition is `mtd6`
- If `rootubi=ubi2` it means that the active partition is `mtd7`
- As mentioned earlier we need to flash openwrt into ubi/mtd6 and never overwrite ubi2/mtd7 to be able to fully roll-back.
- To activate and boot from mtd7 (ubi2) enter into ZHAL> command prompt and type the following commands:
atbt 1 # unlock write
atsw # swap boot partition
atsr # reboot the router
- After rebooting check again with "cat /proc/cmdline" that you are correctly booting from mtd7/ubi2
- If yes proceed with the installation guide. If not probably you don't have a firmware into ubi2 or you did something wrong.
3. Flashing:
- Download the sysupgrade file for the router from openwrt, than we need to add the zyfwinfo file into the sysupgrade tar.
Zloader only checks for the magic (which is a fixed value 'EXYZ') and the crc of the file itself (256bytes).
I created a script to create a valid zyfwinfo file but you can use anything that does exactly the same:
https://raw.githubusercontent.com/pameruoso/OpenWRT-Zyxel-EX5601-T0/main/gen_zyfwinfo.sh
- Add the zyfwinfo file into the sysupgrade tar.
- Enter via telnet or ssh into the router with admin credentials
- Enter the following commands to disable the firmware and model checks
"zycli fwidcheck off" and "zycli modelcheck off"
- Open the router web interface and in the update firmware page select the "restore default settings option"
- Select the sysupgrade file and click on upload.
- The router will flash and reboot itself into openwrt from UBI
4. Restoring and going back to Zyxel firmware.
- Use the ZHAL> command line to manually swap the boot parition to UBI2 with the following:
atbt 1 # unlock write
atsw # swap boot partition
atsr # reboot the router
- You will boot again the Zyxel firmware you have into UBI2 and you can flash the zyxel firmware to overwrite the UBI partition and openwrt.
Working features
----------------
3 gbit lan ports
Wifi
Zyxel partitioning for coexistance with Zloader and dual boot.
WAN SFP port (only after exporting pins 57 and 10. gpiobase411)
leds
reset button
serial interface
usb port
lan ethernet 2.5 gbit port (autosense)
wan ethernet 2.5 gbit port (autosense)
Not working
----------------
voip (missing drivers or proper zyxel platform software)
Swapping the wan ethernet/sfp xor port
----------------
The way to swap the wan port between sfp and ethernet is the following:
export the pins 57 and 10.
Pin 57 is used to probe if an sfp is present.
If pin 57 value is 0 it means that an sfp is present into the cage (cat /sys/class/gpio/gpio468/value).
If pin 57 value is 1 it means that no sfp is inserted into the cage.
In conclusion by default both 57 an 10 pins are by default 1, which means that the active port is the ethernet one.
After inserting an SFP pin 57 will become 0 and you have to manually change the value of pin 10 to 0 too.
This is totally scriptable of course.
Leds description
------------
All the leds are working out of the box but the leds managed by the 2 maxlinear phy (phy 5 lan, phy6 wan).
To activate the phy5 led (rj45 ethernet port led on the back of the router) you have to use mdio-tools.
To activate the phy6 led (led on the front of the router for 2.5gbit link) you have to use mdio-tools.
Example:
Set lan5 led to fast blink on 2500/1000, slow blink on 10/100:
mdio mdio-bus mmd 5:30 raw 0x0001 0x33FC
Set wan 2.5gbit led to constant on when wan is 2.5gbit:
mdio mdio-bus mmd 6:30 raw 0x0001 0x0080
Signed-off-by: Pietro Ameruoso <p.ameruoso@live.it>
2023-05-22 09:52:47 +02:00
|
|
|
zyxel,ex5601-t0)
|
|
|
|
|
local envdev=/dev/mtd$(find_mtd_index "u-boot-env")
|
|
|
|
|
ubootenv_add_uci_config "$envdev" "0x0" "0x20000" "0x40000" "2"
|
|
|
|
|
;;
|
filogic: support Telenor branded ZyXEL EX5700
Telenor quirks
--------------
The operator specific firmware running on the Telenor branded
ZyXEL EX5700 includes U-Boot modifications affecting the OpenWrt
installation.
Notable changes to U-Boot include
- environment is stored in RAM and reset to defaults when power
cycled
- dual partition scheme with "nomimal" or "rescue" systems, falling
back to "rescue" unless the OS signals success in 3 attempts
- several runtime additions to the device-tree
Some of these modifications have side effects requiring workarounds
- U-Boot modifies /chosen/bootargs in an unsafe manner, and will crash
unless this node exists
- U-Boot verifies that the selected rootfs UBI volume exists, and
refuses to boot if it doesn't. The chosen "rootfs" volume must contain
a squashfs signature even for tftp or initramfs booting.
- U-Boot parses the "factoryparams" UBI volume, setting the "ethaddr"
variable to the label mac. But "factoryparams" does not always
exist. Instead there is a "RIP" volume containing all the factory
data. Copying the "RIP" volume to "factoryparams" will fix this
Hardware
--------
SOC: MediaTek MT7986
RAM: 1GB DDR4
FLASH: 512MB SPI-NAND (Mikron xxx)
WIFI: Mediatek MT7986 802.11ax 5 GHz
Mediatek MT7916 DBDC 802.11ax 2.4 + 6 GHz
ETH: MediaTek MT7531 Switch + SoC
3 x builtin 1G phy (lan1, lan2, lan3)
2 x MaxLinear GPY211C 2.5 N-Base-T phy (lan4, wan)
USB: 1 x USB 3.2 Enhanced SuperSpeed port
UART: 3V3 115200 8N1 (Pinout: GND KEY RX TX VCC)
Installation
------------
1. Download the OpenWrt initramfs image. Copy the image to a TFTP server
reachable at 192.168.1.2/24. Rename the image to C0A80101.img.
2. Connect the TFTP server to lan1, lan2 or lan3. Connect to the serial
console, Interrupt the autoboot process by pressing ESC when prompted.
3. Download and boot the OpenWrt initramfs image.
$ env set uboot_bootcount 0
$ env set firmware nominal
$ tftpboot
$ bootm
4. Wait for OpenWrt to boot. Transfer the sysupgrade image to the device
using scp and install using sysupgrade.
$ sysupgrade -n <path-to-sysupgrade.bin>
Missing features
----------------
- The "lan1", "lan2" and "lan3" port LEDs are driven by the switch but
OpenWrt does not correctly configure the output.
- The "lan4" and "wan" port LEDs are driven by the GPH211C phys and
not configured by OpenWrt.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
2023-03-28 15:04:21 +02:00
|
|
|
zyxel,ex5700-telenor)
|
|
|
|
|
ubootenv_add_uci_config "/dev/ubootenv" "0x0" "0x4000" "0x4000" "1"
|
|
|
|
|
;;
|
2022-07-16 21:07:20 +01:00
|
|
|
esac
|
|
|
|
|
|
|
|
|
|
config_load ubootenv
|
mediatek: add Xiaomi Redmi Router AX6000 support
Hardware specification:
SoC: MediaTek MT7986A 4x A53
Flash: ESMT F50L1G41LB 128 MB
RAM: K4A4G165WF-BCWE 512 MB
Ethernet: 4x 10/100/1000 Mbps
WiFi1: MT7976GN 2.4GHz ax 4x4
WiFi2: MT7976AN 5GHz ax 4x4
Button: Mesh, Reset
Flash instructions:
1. Gain ssh and serial port access, see the link below:
https://openwrt.org/toh/xiaomi/redmi_ax6000#installation
2. Use ssh or serial port to log in to the router, and
execute the following command:
nvram set boot_wait=on
nvram set flag_boot_rootfs=0
nvram set flag_boot_success=1
nvram set flag_last_success=1
nvram set flag_try_sys1_failed=8
nvram set flag_try_sys2_failed=8
nvram commit
3. Set a static ip on the ethernet interface of your computer
(e.g. default: ip 192.168.31.100, gateway 192.168.31.1)
4. Download the initramfs image, rename it to initramfs.bin,
and host it with the tftp server.
5. Interrupt U-Boot and run these commands:
setenv mtdparts nmbm0:1024k(bl2),256k(Nvram),256k(Bdata),2048k(factory),2048k(fip),256k(crash),256k(crash_log),112640k(ubi)
saveenv
tftpboot initramfs.bin
bootm
6. After openwrt boots up, use scp or luci web
to upload sysupgrade.bin to upgrade.
Revert to stock firmware:
Restore mtdparts back to default, then use the
vendor's recovery tool (Windows only).
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
2022-09-18 23:16:18 +08:00
|
|
|
config_foreach ubootenv_add_app_config
|
2022-07-16 21:07:20 +01:00
|
|
|
|
|
|
|
|
exit 0
|