TP-Link EX220 v1 as distributed by the Russian ISP MTS, labelled
"EX220(RU)MTS) Ver:1.30". It carries the same model name as the already
supported tplink,ex220-v1, but it is a different board: 128 MB of
parallel NAND managed by NMBM instead of 16 MB of SPI-NOR, and an entirely
different flash layout. The bootloader tells the two apart - on this
revision U-Boot prints "NAND: 128 MiB" followed by "NMBM has been
successfully attached".
Hardware specification:
- SoC: MediaTek MT7621AT (MIPS 1004Kc, ver 1 eco 3)
- RAM: 128 MB DDR3 (chip hidden under the shielding can)
- Flash: 128 MB parallel NAND, ESMT F59L1G81MB, NMBM managed
(the driver identifies the chip as "ESMT PSU1GA30DT")
- WiFi: MediaTek MT7915E, DBDC, 2x2 2.4 GHz + 2x2 5 GHz (AX1800)
- Ethernet: MediaTek MT7530, 5x 10/100/1000 Mbps (4x LAN + 1x WAN)
- LEDs: 7x GPIO - power, LAN, WAN green, WAN amber, WLAN 2.4 GHz,
WLAN 5 GHz, WPS
- Buttons: 2x tactile - reset, WPS
- UART: 4 unpopulated through holes on the solder side of the board,
beside the silver factory sticker, with no silkscreen designator.
Counting from the hole furthest from the ethernet ports: pin 1 TX,
pin 2 RX, pin 3 GND, pin 4 unused - leave it unconnected.
115200 8N1, 3.3 V.
- Power: 12 VDC, 1 A
MAC addresses:
LAN f0:a7:31:xx:xx:xx misc_ro @ 0x5c50bc, matches the label
WAN f0:a7:31:xx:xx:xx same as LAN
2.4G label MAC + 2
5G label MAC + 3
The radio calibration lives in the misc_ro partition, which holds a
JFFS2 filesystem with five files named after their original flash
offsets. The largest one carries the MT7915 EEPROM at offset 0x90000,
so 11-mt76-caldata mounts the partition read-only and copies it out.
Reading it needs CONFIG_JFFS2_ZLIB - the vendor compressed those nodes
with zlib, which OpenWrt does not build in by default.
It is worth the kernel option. With the factory calibration the client
reports -44 dBm at half a metre and negotiates HE-MCS 11; with the
generic default EEPROM the very same link reports -82 dBm and settles
at HE-MCS 3, and a local transfer peaks at 541 instead of 692 Mbit/s.
The vendor bootloader loads a FIT image from the fixed address
0xd00000 and does not evaluate partition names, so the vendor firmware
slot is split into a raw kernel partition and a UBI partition holding
rootfs and rootfs_data.
Flash instructions:
The vendor web interface offers no way in, so the first installation is
done over the serial console.
1. Open the case and attach a 3.3 V USB-to-serial adapter to the 4-pin
header described above.
2. Power the board up and interrupt the bootloader by pressing any key
when it prints "Hit any key to stop autoboot".
3. Load the initramfs image into RAM over YMODEM:
loady 0x84000000
Send openwrt-ramips-mt7621-tplink_ex220-v1-nand-initramfs-kernel.bin
using the YMODEM transfer of your terminal program - this takes
about 11 minutes at 115200 baud - and boot it:
bootm 0x84000000
Do not raise the bootloader console speed to shorten the transfer:
with the console set to 921600 baud the kernel hangs while taking
the UART over from the bootloader, leaving nothing after the 16550A
line, and the watchdog resets the board.
4. The running system serves 192.168.1.1/24 on the LAN ports. Transfer
openwrt-ramips-mt7621-tplink_ex220-v1-nand-squashfs-sysupgrade.bin
to /tmp and install it:
sysupgrade -n /tmp/openwrt-*-ex220-v1-nand-squashfs-sysupgrade.bin
The board reboots into OpenWrt on its own; later updates use
sysupgrade as usual.
Reverting to stock:
The second firmware slot ships empty, so there is nothing to fall back
to - take a backup while the initramfs image of step 3 is running, ie
before step 4:
cat /dev/mtd4 /dev/mtd5 > /tmp/stock.bin
and copy it off the device. To restore it, boot the initramfs image
again and write it back:
dd if=stock.bin bs=1M count=4 | mtd write - kernel
dd if=stock.bin bs=1M skip=4 | mtd write - ubi
Signed-off-by: Denis Faizullin <triplexit.help@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24831
Signed-off-by: Robert Marko <robimarko@gmail.com>
Cudy LT700 Outdoor v1 is an outdoor 4G LTE Wi-Fi 5 router (Cudy board
ID R43).
Hardware:
- SoC: MediaTek MT7621AT
- Flash: 16 MiB SPI NOR (XM25QH128C)
- RAM: 128 MiB DDR3
- WLAN: 2.4 GHz (MediaTek MT7603E, 11n), 5 GHz (MediaTek MT7663, 11ac)
- Ethernet: 1x 10/100/1000 Mbps LAN
- Power: 48-57 V passive PoE
- Buttons: 1x Reset button
- LEDs: 8x Green
- LTE: internal USB modem Quectel EG060W (Cat 6)
- Serial console: 3.3V, 115200 8N1, unpopulated 4-pin header left of the
SoC; pinout from top: VCC, GND, TX, RX
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | d4:0d:ab:xx:xx:xx | label |
| WLAN 2g | d4:0d:ab:xx:xx:xx | label |
| WLAN 5g | d4:0d:ab:xx:xx:xx | label +1 |
+---------+-------------------+-----------+
The internal LTE modem is a Quectel EG060W and needs the option driver
IDs added in a separate commit. gpio-export applies the initial output
value raw, ignoring the active-low flag, so output = <0> is what pulls
the modem power enable low and powers it at boot.
Migration to OpenWrt:
- Obtain the RSA signed intermediate firmware from Cudy:
openwrt-ramips-mt7621-cudy_lt700-outdoor-v1-squashfs-flash.bin
- Connect a computer to the LAN port and flash the intermediate firmware
via the OEM web interface
- OpenWrt is now accessible via 192.168.1.1
- Install the regular OpenWrt sysupgrade image from LuCI or over SSH
Revert back to OEM firmware:
- Configure a computer with IP 192.168.1.88 and run a TFTP server that
serves the OEM recovery image as recovery.bin
- Hold the reset button while powering on the device; the bootloader
fetches recovery.bin and restores the OEM firmware
Signed-off-by: Carlo Szelinsky <github@szelinsky.de>
Tested-by: achim <achim@cloudystars.net>
Link: https://github.com/openwrt/openwrt/pull/24689
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
Frequency scaling lets MT7620 reduce the CPU clock after a MIPS
SI_Sleep signal. The clock framework does not observe that change and
continues reporting the boot frequency. This breaks timekeeping, delay
calibration, and timing-sensitive users such as the Jitter RNG.
Remove the MT7620 autosleep callback and its elevated systick rating
from the local timer patch. Clear SLEEP_EN during early MT7620
initialization so the result does not depend on reset state or on what a
bootloader left behind. Use the generic systick compatible in the
MT7620A and MT7620N DTS files.
With CPU frequency scaling removed, the MIPS Count Register is again a
reliable clock source. Systick drops to rating 200 for both the
clocksource and the clockevent, so cevt-r4k (rating 300) takes the
clockevent and the now-reliable MIPS count register (rating ~229 here)
takes the clocksource.
Hardware testing used OpenWrt 25.12.5 with Linux 6.12.94 on an MT7620A
WE826. Before the change, urngd occupied 92 to 100 percent of otherwise
idle CPU for several minutes after each boot. After the change, urngd
initialized without the prolonged load. Ethernet, WireGuard, warm boot,
mixed-load stability, and 30-minute clock drift tests showed no
regression.
The change was rebased onto main with Linux 6.18.44. The complete ramips
patch stack applies cleanly, checkpatch reports no issues, and the
modified timer-ralink and mt7620 objects compile with the OpenWrt MIPS
toolchain.
This revives Shiji Yang's original 2023 patch with current hardware
results and makes the disabled state independent of the bootloader.
Link: https://lists.openwrt.org/pipermail/openwrt-devel/2023-July/041232.html
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Tested-by: Gleb Pesin <dormancygrace@gmail.com>
Signed-off-by: Gleb Pesin <dormancygrace@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24734
Signed-off-by: Robert Marko <robimarko@gmail.com>
The ipTIME A8004T requires GPIO19 and GPIO8 for PCIe reset control.
GPIO8 is assigned to UART3 by default, so configure the pin state
to make it available as a GPIO and add both GPIOs to the PCIe
reset-gpios property.
This fixes PCIe initialization after warm reboot.
Signed-off-by: Myeongjae SONG <devparlair@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/24534
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
ASUS RT-N65U is a 2.4/5 GHz band 11n (Wi-Fi 4) router, based on RT3883.
Specification:
- CPU1: Ralink RT3883 @ 500MHz, WiSoC 5GHz
- CPU2: Ralink RT3352 @ 400MHz, WiSoC 2.4GHz
- RAM1: 128MB
- RAM2: 16MB
- Flash: Macronix MX25L12805D (16MB)
- WLAN: Ralink RT3883 (5GHz 3T3R), Ralink RT3352 (2.4GHz 2T2R)
- Switch: Realtek RTL8367RB
- 4x 10/100/1000 Mbps Ethernet
- 1x 10/100/1000 Mbps WAN
- USB: ASMedia ASM1042 USB 3.0 Controller
- PMU: UTC UZ1086L-ADJ
- 6x LED, 2x button
Installation (TFTP):
1. Power off the router.
2. Press and hold the Reset button.
3. Power on the router.
4. Wait 5 seconds, then release the Reset button.
5. Connect your PC to the router with Ethernet cable.
6. Configure a static IP address in the `192.168.1.0/24` subnet (except `192.168.1.1`).
7. Configure your TFTP client to use binary (octet) transfer mode.
8. Upload the firmware image (OpenWrt, stock, or Padavan) to `192.168.1.1`.
The TFTP server accepts any filename.
9. Wait for the firmware flashing process to complete.
WARNING: Flashing the stock firmware after using Padavan may brick
your router due to configuration partition incompatibility.
MAC address layout:
- Wi-Fi 2.4GHz & WAN: label MAC
- Wi-Fi 5GHz & LAN: label MAC + 4
MTD layout:
```
mtd0: 00030000 00010000 "u-boot"
mtd1: 00010000 00010000 "config"
mtd2: 00010000 00010000 "factory"
mtd3: 00fb0000 00010000 "firmware"
mtd4: 001ee3b3 00010000 "kernel"
mtd5: 00dc1c4d 00010000 "rootfs"
mtd6: 00960000 00010000 "rootfs_data"
```
Known issues:
- The RT3352 2.4 GHz iNIC is unsupported because it requires a
proprietary firmware blob and kernel support
- The Wi-Fi LEDs cannot be disabled independently because they share
the LED power rail controlled by GPIO10
This work is based on the earlier draft support by Andrej Valek.
Tested by 4PDA users
Signed-off-by: Andrej Valek <andy@skyrain.eu>
Signed-off-by: Andrey Trishin <zatrit@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24343
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The U-Boot environment data on the ipTIME T5004 occupies one
128 KiB NAND erase block.
The nvmem layout specified an environment size of 0x1000.
This caused CRC32 validation to fail and prevented the MAC
address cells from being created.
Set env-size to 0x20000 to match the U-Boot environment data
size used for CRC validation.
Fixes: 8dd95cc6b5 ("ramips: iptime,t5004: use nvmem for ubootenv")
Signed-off-by: Myeongjae SONG <devparlair@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/24530
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The nvmem cell for the MT7663 (5 GHz) radio was too small. The MT7663 EEPROM at
offset 0x8000 requires the full MT7615_EEPROM_FULL_SIZE (0x4da8), but the cell
only declared 0x200 bytes.
The driver always requests the full buffer, also for the MT7663, so the undersized
cell makes the nvmem read fail with -EINVAL. The driver then falls back to default
values, which limits TX power to 3 dBm.
Fix this by enlarging the cell to 0x4da8. The offset 0x8000 was already correct —
offset 0x0 holds the MT7628 (2.4 GHz) calibration data.
Fixes: #23632
Signed-off-by: Frank Lang <Frank_Lang@outlook.de>
Link: https://github.com/openwrt/openwrt/pull/24284
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add support for the Comfast CF-EW84 based on the MediaTek MT7621
SoC.
Hardware:
CPU/SoC: MediaTek MT7621DA
RAM: 128 MB DDR3
Flash: Macronix MX25L12805D 16 MB
Switch: MediaTek MT7530
WiFi 2.4 GHz: MediaTek MT7603E
WiFi 5 GHz: MediaTek MT7613B
Ports: 1x WAN, 2x LAN (10/100/1000 Mbps)
LEDs: Power, WAN, LAN1, LAN2, WLAN
Buttons: Reset
UART: through-hole on PCB
pinout: RX, TX, GND, 3.3V
settings: 115200n8
Flash instructions:
1. Connect the bundled PoE injector to power.
2. Connect the PC to the LAN1 or LAN2 port of the device.
3. Configure a static IP on the computer's Ethernet adapter:
IP: 192.168.1.x (x = 2 to 254)
Mask: 255.255.255.0
Gateway: empty
DNS: empty
4. Connect a second Ethernet cable to the PoE port of the
bundled injector.
5. Press and hold the reset button on the device.
6. While holding the reset button, plug the other end of the
second Ethernet cable into the WAN port.
7. Wait at least 3 seconds, then release the reset button.
8. Browse to http://192.168.1.1: the MediaTek U-Boot System
Recovery page should appear.
9. Click Upload and select the *-sysupgrade.bin firmware file.
10. After flashing completes, browse to http://192.168.1.1
again: the LuCI login page should appear.
Factory data:
2.4 GHz EEPROM: factory offset 0x0000
5 GHz EEPROM: factory offset 0x8000
LAN MAC address: factory offset 0xe000
WAN MAC address: factory offset 0xe000 (+1)
LED layout:
The Comfast CF-EW84 has five physical LEDs, but only the WLAN
LED is software-controllable through the Linux GPIO-LEDs
subsystem.
Signed-off-by: Vincenzo Suraci <vincenzo.suraci@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24112
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware:
- SoC: MediaTek MT7628AN
- Flash: 16 MiB SPI NOR
- RAM: 128 MiB DDR2
- WLAN: 2.4 GHz (MT7628AN, 11n), 5 GHz (MediaTek MT7615E, 11ac)
- Ethernet: 1x10/100 Mbps LAN
- Buttons: 1 Reset button
- LEDs: 8x Green
- LTE: internal USB-connected modem Quectel EC200A
- Serial Console: unpopulated header 115200 8n1
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 80:af:ca:xx:xx:x0 | label |
| WLAN 2g | 80:af:ca:xx:xx:x0 | label |
| WLAN 5g | 80:af:ca:xx:xx:x2 | +2 |
+---------+-------------------+-----------+
Migration to OpenWrt:
- Download the RSA signed intermediate firmware:
`openwrt-ramips-mt76x8-cudy_lt500-outdoor-v1-squashfs-flash.bin`
- Connect computer to LAN and flash the intermediate firmware via OEM web interface
- OpenWrt is now accessible via 192.168.1.1
Revert back to OEM firmware:
- Press the reset button while powering on the device
- Connect the LAN port to the PC
- Open 192.168.1.1 in a browser and use the wizard to upload and flash OEM firmware image
- When recovery process is done, OEM firmware is accessible via 192.168.10.1 again
Signed-off-by: rodriguezst <git@rodriguezst.es>
Link: https://github.com/openwrt/openwrt/pull/23752
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
For the most part, factory: remains as a hold over from nvmem-layout
conversion and no longer serves any purpose.
In the case of &factory sections, reduce identation slightly by
referencing the nvmem-layout node instead.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24008
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The LED(s) does not have a label for status, ethernet, or whatsoever.
These two LEDs, are used to form one dual-color indicator. On vendor
firmware, the light is turned from orange to white, when external
storage is detected and ready to use. However, if we use white for any
other triggers (USB / SD card / ethernet), it is difficult to see while
the orange is on. Thus, we change led-running to white to indicate a
successful startup.
Also add the missing pinmux config for uart3 since LEDs take GPIO 7 and
8.
Signed-off-by: David Yang <mmyangfl@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23182
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This patch adds support for the ASUS RT-AC85U wireless router.
It is a dual-band gigabit router based on the MediaTek MT7621AT SoC.
MAC Address Layout:
- LAN/WAN/2.4G/5G MAC addresses are derived from the
factory partition at offset 0xe000.
Hardware Specifications:
- SoC: MediaTek MT7621AT (880 MHz, 2C/4T)
- RAM: 128 MB DDR3
- Flash: 128 MB Winbond W29N01HV NAND
- WI1: MediaTek MT7615E (2.4 GHz, 4x4)
- WI2: MediaTek MT7615E (5 GHz, 4x4)
- Switch: MediaTek MT7530 (Embedded Gigabit Switch)
- Ports: 1x WAN, 4x LAN (10/100/1000 Mbps), 1x USB 3.0
- LEDs: Power, LAN, WAN, 2.4G, 5G, USB, WPS
- Buttons: WPS, Reset
Installation / Flashing guide:
1. Power off the device.
2. Hold Reset button and power on to enter ASUS Restoration mode (slow flash LED).
3. Set your computer's static IP to 192.168.1.x (e.g., 192.168.1.10).
4. Upload the OpenWrt initramfs image via ASUS Restoration tool to 192.168.1.1.
5. Wait for the device to boot into the temporary OpenWrt environment.
6. Access LuCI (192.168.1.1) and flash sysupgrade image to make it permanent.
Signed-off-by: YAJIMA Hideyuki <ursmtr@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23747
Signed-off-by: Robert Marko <robimarko@gmail.com>
The dual-boot mechanism depends on the fact that the bootloader specifies
the ubi.mtd= of the currently active slot. And the Linux is expected to
only attach the specified ubi-partition. Otherwise the kernel will use the
"rootfs" partition of the initially attached ubi partition as its root
partition. Which is of course wrong when the kernel parameter specified
ubi.mtd=firmware2.
Fixes: c7c54f3134 ("ramips: add support for Plasma Cloud PAX1800-Lite")
Signed-off-by: Sven Eckelmann (Plasma Cloud) <se@simonwunderlich.de>
Link: https://github.com/openwrt/openwrt/pull/23857
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
While still sufficient for the base image, space runs out quickly with
the ~15MiB available in kernel0. The identical space in kernel1 is
unused, and standard installation instructions flash to both areas so it
isn't an easy fallback to stock either.
Merge the regions for kernel0 and kernel1 so there's more space
available to the user to install packages and some data.
Signed-off-by: Fabian Groffen <grobian@bitzolder.nl>
Link: https://github.com/openwrt/openwrt/pull/22316
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The Yuncore 1200F is an outdoor 802.11ac access point based on the
MediaTek MT7628AN SoC with an MT7663E PCIe 5 GHz radio. The device is
also sold under the KuWFi AP1200F name.
Hardware:
- SoC: MediaTek MT7628AN
- CPU: MIPS 24KEc
- RAM: 64 MiB
- Flash: 8 MiB SPI NOR
- Ethernet: 2x 10/100 Mbps
- WiFi 2.4 GHz: MT7628AN WMAC
- WiFi 5 GHz: MT7663E PCIe
- LEDs: status, LAN, WAN
- Button: reset
- Watchdog: GPIO watchdog
MAC addresses:
- Ethernet: factory 0x0004
- 2.4 GHz WiFi: factory 0x0028
- 5 GHz WiFi: factory 0x8004
Network:
- LAN: eth0.1, switch port 4
- WAN: eth0.2, switch port 3
Installation:
- Build the sysupgrade image:
openwrt-ramips-mt76x8-yuncore_1200f-squashfs-sysupgrade.bin
- The stock firmware provides a U-Boot recovery web interface. It can be
entered by holding the reset button while powering on the device. Connect to
http://192.168.0.100/ and upload openwrt-sysupgrade.bin file.
Recovery:
- Reverting to stock firmware has not been tested.
The 5 GHz radio is detected as PCI ID 14c3:7663 and uses mt7615e
together with the MT7663 AP firmware. kmod-mt76x2 is explicitly
excluded because this board uses MT7663E, not MT76x2.
Tested:
- Build succeeds for ramips/mt76x8
- Sysupgrade image boots
- Ethernet LAN/WAN work
- 2.4 GHz AP starts on phy0
- 5 GHz AP starts on phy1
- Stable MAC addresses are assigned to Ethernet, phy0 and phy1
Signed-off-by: Gunther Stammwitz <gstammw@gmx.net>
Link: https://github.com/openwrt/openwrt/pull/23613
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The K2G's WAN port is an external RTL8211F gigabit PHY on switch
port 5, reached over the SoC's rgmii1 pins. The device tree only
requests rgmii2_pins though, so nothing ever claims rgmii1 and the
pins keep whatever the bootloader left them as.
When rgmii1 is muxed to GPIO the WAN port comes up but receives
nothing: port 5 RxGPC stays at 0 and wan never gets a DHCP lease.
rgmii1 vs GPIO is GPIOMODE (SYSC + 0x60) bit 9. Requesting
rgmii1_pins makes the pinmux driver clear it, which is enough to
get the WAN RX path working again. The rgmii1 pads (GPIO 24-35)
aren't used for anything else on this board.
Tested on a K2G: WAN gets a DHCP lease and passes traffic.
Signed-off-by: Dixiao-L <stgowl@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23629
Signed-off-by: Robert Marko <robimarko@gmail.com>
Fix typo in backup partition offset: `0xfe000` should be `0xfe0000`.
The incorrect offset caused the partition to be mapped at `0x0fe000`
instead of `0xfe0000`, placing it inside the firmware partition range.
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23511
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware:
- SoC: MediaTek MT7628AN (MIPS 580MHz)
- Flash: 8 MiB NOR
- RAM: 64 MiB DDR2
- WLAN: 2.4 GHz (MT7628)
- Ethernet: 1x 10/100 Mbps WAN, 3x 10/100 LAN (MT7628)
- Buttons: 1x Reset, 1x wps
- LEDs: Front: 1x Red, 1x White
- Serial console: unpopulated header, 115200 8n1
- Power: 12v barrel
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN/WAN | d4:0d:ab:xx:xx:x0 | label |
| WLAN 2g | d4:0d:ab:xx:xx:x1 | label+1 |
+---------+-------------------+-----------+
Migration to OpenWrt:
- Download the RSA-signed intermediate firmware from the Cudy website: `openwrt-ramips-mt76x8-cudy_wr300-squashfs-flash.bin`
- Connect the computer to the LAN and flash the intermediate firmware via the OEM web interface
- OpenWrt is now accessible via 192.168.1.1
Revert to OEM firmware:
- Set up a TFTP server on IP 192.168.1.88 and connect to the WAN port (upper port)
- Provide the Cudy firmware as `recovery.bin` in the TFTP server
- Power on the device and hold the reset button immediately after the first LED blink
- The recovery process will start
- When the recovery process is done, OEM firmware is accessible via 192.168.10.1 again
General information:
- No possibility to load an initramfs image via U-Boot because there is no option to interrupt U-Boot
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23426
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The gmac1 is not used and doesn't have any mac address configured. The
gmac0 has the nvmem-cells set and can actually be used to retrieve the
correct mac address.
Fixes: c7c54f3134 ("ramips: add support for Plasma Cloud PAX1800-Lite")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Link: https://github.com/openwrt/openwrt/pull/23441
Signed-off-by: Robert Marko <robimarko@gmail.com>
Specificaitons:
- MediaTek MT7621AT SoC
- 256 MB RAM
- 16MB SPI NOR Flash
- 256MB NAND (split in half for firmware fallback)
- 4x 10/100/1000 Mbps Ethernet, with passive PoE support on LAN1
- WLAN : MediaTek dual-band WiFi 5
- 2.4 GHz : b/g/n, MIMO 2x2
- 5 GHz : n/ac, MIMO 2x2
- Quectel EG060K-EA 4G CAT6 modem
- 2.0 USB Type-A HOST port
- 1x Digital input
- 1x Digital output
- 2x SIM slot (can be swapped via GPIO)
GPIO:
- 1 button (Reset)
- 14 LEDs (power, 4x WAN status, Wifi 2G, Wifi 5G, 3G, 4G, 5x RSSI)
- 3 Modem control (power button, reset, sim select)
- 1 Digital input
- 1 Digital output
Installation
------------
Notice: update OEM firmware to 7.19 or later, earlier versions will
fail to flash openwrt factory firmware.
1. Check from which partition the device is currently running from
$ cat /proc/bootconfig/chosen
In case this output reads rutos-b, install a software update from
Teltonika first. After upgrade completion, check this file now reads
rutos-a before continuing.
2. Download the *-squashfs-factory.bin firmware image
3. Flash firmware image via WEB interface
To revert back to OEM firmware:
https://wiki.teltonika-networks.com/view/Bootloader_menu
Mobile connection:
- EG060K-EA:
Execute AT commands:
echo -ne 'AT+QCFG="usbnet",2\r\n' > /dev/ttyUSB2
echo -ne 'AT+CFUN=1,1\r\n' > /dev/ttyUSB2
Use ModemManager to establish mobile connection.
Signed-off-by: Simonas Tamošaitis <simsasss@gmail.com>
Specifications:
- MediaTek MT7621AT SoC
- 256 MB RAM
- 16MB SPI NOR Flash
- 256MB NAND (split in half for firmware fallback)
- 2x 10/100/1000 Mbps Ethernet, with passive PoE support on LAN
- WLAN : MediaTek dual-band WiFi 5
- 2.4 GHz : b/g/n, MIMO 2x2
- 5 GHz : n/ac, MIMO 2x2
- Quectel RG520N-EB 5G R16 modem (RUTM30) or RG500U-EB 5G (RUTM31)
- 1x Digital input
- 1x Digital output
- 2x SIM slot (can be swapped via AT commands)
- eSIM
- TPM
GPIO:
- 1 button (Reset)
- 3 LEDs (power, 2 RGB)
- 3 Modem control (power button, reset, eSIM switch)
- 1 Digital input
- 1 Digital output
- 1 TPM enable
Installation
------------
Notice: update OEM firmware to 7.19 or later, earlier versions will
fail to flash openwrt factory firmware.
1. Check from which partition the device is currently running from
$ cat /proc/bootconfig/chosen
In case this output reads rutos-b, install a software update from
Teltonika first. After upgrade completion, check this file now reads
rutos-a before continuing.
2. Download the *-squashfs-factory.bin firmware image
3. Flash firmware image via WEB interface
To revert back to OEM firmware:
https://wiki.teltonika-networks.com/view/Bootloader_menu
Mobile connection:
- RG520N-EB:
Use "ModemManager" to establish mobile data connection.
- RG500U-EB:
echo -ne 'AT+QNETDEVCTL=1,3,1\r\n' > /dev/ttyUSB2
Create DHCP interface with usb0 device.
Signed-off-by: Simonas Tamošaitis <simsasss@gmail.com>
Specifications:
- MediaTek MT7621AT SoC
- 256 MB RAM
- 16MB SPI NOR Flash
- 256MB NAND (split in half for firmware fallback)
- 5x 10/100/1000 Mbps Ethernet, with passive PoE support on LAN1
- WLAN : MediaTek dual-band WiFi 5
- 2.4 GHz : b/g/n, MIMO 2x2
- 5 GHz : n/ac, MIMO 2x2
- Quectel RG520N-NA 5G R16 modem (RUTM50) or RG500U-EB 5G (RUTM51)
- 2.0 USB Type-A HOST port
- 1x Digital input
- 1x Digital output
- 2x SIM slot (can be swapped via AT commands)
GPIO:
- 1 button (Reset)
- 13 LEDs (power, 4x WAN status, Wifi 2G, Wifi 5G, 3G, 4G, 5G, RSSI
1,2,3)
- 2 Modem control (power button, reset)
- 1 Digital input
- 1 Digital output
Installation
------------
Notice: update OEM firmware to 7.19 or later, earlier versions will
fail to flash openwrt factory firmware.
1. Check from which partition the device is currently running from
$ cat /proc/bootconfig/chosen
In case this output reads rutos-b, install a software update from
Teltonika first. After upgrade completion, check this file now reads
rutos-a before continuing.
2. Download the *-squashfs-factory.bin firmware image
3. Flash firmware image via WEB interface
To revert back to OEM firmware:
https://wiki.teltonika-networks.com/view/Bootloader_menu
Mobile connection:
- RG520N-NA:
Use "ModemManager" to establish mobile data connection.
- RG500U-EB:
echo -ne 'AT+QNETDEVCTL=1,3,1\r\n' > /dev/ttyUSB2
Create DHCP interface with usb0 device.
Signed-off-by: Simonas Tamošaitis <simsasss@gmail.com>
The RG-EW1300G is a router with 1 x WAN and 3 x LAN gigabit ports.
The router runs on Ruijie OS by default.
- Specifications:
* SoC: MT7621A
* RAM: 128MB DDR3
* Flash: 16MB SPI NOR flash (GD25Q128C)
* WiFi0: Mediatek MT7615 2.4GHz 802.11b/g/n
* WiFi1: Mediatek MT7615 5GHz 802.11ac
* Ethernet: MT7530, 4x 1000Base-T.
* UART: Serial console - As marked on PCB, baudrate is 57600. DO NOT CONNECT 3.3V.
* Buttons: Reset, WPS.
* LED: Programmable LEDs via GPIO working for Red+Green status, and Mesh/WPS at the rear of the chassis.
- Default Flash:
```
GD25Q128C(c8 40180000) (16384 Kbytes)
mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
6 cmdlinepart partitions found on MTD device raspi
Creating 6 MTD partitions on "raspi":
0x000000000000-0x000000050000 : "u-boot"
0x000000050000-0x000000060000 : "u-boot-env"
0x000000060000-0x000000070000 : "Factory"
0x000000070000-0x000000080000 : "product_info"
0x000000080000-0x000000090000 : "kdump"
0x000000090000-0x000001000000 : "firmware"
0x00000031a847-0x000001000000 : "rootfs"
mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
mtd: partition "rootfs_data" created automatically, ofs=0xae0000, len=0x520000
0x000000ae0000-0x000001000000 : "rootfs_data"
register mt_drv
```
```
cat /proc/mtd
dev: size erasesize name
mtd0: 00050000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "factory"
mtd3: 00010000 00010000 "product_info"
mtd4: 00010000 00010000 "kdump"
mtd5: 00f70000 00010000 "firmware"
mtd6: 0028a847 00010000 "kernel"
mtd7: 00ce57b9 00010000 "rootfs"
mtd8: 00520000 00010000 "rootfs_data"
```
- Installation:
1. Open the case, solder to the marked 4 pin header
2. Connect it to a USB-UART TTL (do not connect to 3.3v)
3. Open a terminal with baud 57600.
4. Power on device, and repeatedly press "2" key to catch bootloader option
5. Set IP, TFTP server IP, and image file to load (eg, openwrt-ramips-mt7621-ruijie_rg-ew1300g-v1-squashfs-sysupgrade.bin)
6. System will reboot into OpenWRT.
Signed-off-by: Matt Brent <git@mattzfiber.co.za>
Link: https://github.com/openwrt/openwrt/pull/21864
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
* CPU: MediaTek MT7628AN (580 MHz)
* Flash: GigaDevice GD25Q128CSIG (16 MiB)
* RAM: Winbond W9751G6KB-25 (64 MiB)
WikiDevi page: <https://wikidevi.wi-cat.ru/Keenetic_City_(KN-1510)>
How to flash:
* Configure TFTP server with IP address 192.168.1.2/24
* Serve OpenWrt factory image as "KN-1510_recovery.bin"
* Connect the PC to router's LAN port, hold the reset button and power
the router up. When the power LED starts blinking release the
button.
The same instructions apply to OEM firmware, except one can take it
from osvault.keenetic.net
Signed-off-by: Ivan Davydov <lotigara@lotigara.ru>
Link: https://github.com/openwrt/openwrt/pull/22404
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
EDUP EP-RT2983 comes with a factory installed version of OpenWrt 23.05
with device name "netis,n6".
Specification
--------------
- SoC : MediaTek MT7621AT, MIPS, 880 MHz
- RAM : 256 MiB
- Flash : NAND 128 MiB (Toshiba)
- WLAN : MT7905DAN + MT7975DN
- 2.4 GHz : b/g/n/ax, 574 Mbps, MIMO 2x2
- 5 GHz : a/n/ac/ax, 1201 Mbps, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x4 (1x WAN, 3x LAN)
- UART : 3.3V, 115200n8
- Buttons : 1x Reset
1x WPS
- LEDs : 1x Power (green)
1x WiFi (green)
1x Mesh/WPS (green); flashing green during boot
3x LAN (green)
1x WAN (green); flashing red during upgrade and failsafe
- Power : 12 VDC 1A
Installation
-------------
1. Log in to LuCI
2. Go to System, Backup / Flash Firmware
3. If desired, backup the current system by saving (all) the mtdblock
contents.
4. Flash new firmware image, select Flash image.
5. Browse and select the sysupgrade file
"openwrt-*-ramips-mt7621-edup_ep-rt2983-squashfs-sysupgrade.bin"
and then Upload.
6. Unselect "Keep settings and retain the current configuration"
Note: All settings will be reset to default. WiFi is not enabled by
default so a connection via Ethernet is necessary to log in and set up.
7. Allow "Force upgrade" (tick the box if there is one), or press Continue
if there is no box to tick. This is because the name is now
"edup,ep-rt2983" as it should have been from the start.
8. Proceed to flash. Wait for reboot and keep power connected.
9. After reboot, default address to access LuCI is 192.168.1.1 with
no password
Recovery (UART)
----------------
1. Remove the 4 screws on the bottom and pry open the cover.
2. Connect serial adapter to the unpopulated serial header pins
TX, RX, GND near the WPS button. Do not connect VCC.
3. Start serial terminal (e.g. minicom, screen, etc) on the computer and
turn on the router.
4. As prompted, hit any key to stop autoboot.
5. Enter 2 to select "2. Upgrade firmware"
6. Enter 0 to select "0 - TFTP client (Default)"
7. Accept the defaults by pressing Enter for
"Input U-Boot's IP address: 192.168.1.1",
"TFTP server's IP address: 192.168.1.2",
"Input IP netmask: 255.255.255.0"
8. Assign your PC's Ethernet port a static IP 192.168.1.2 with netmask
255.255.255.0 and connect to a LAN port on the router using the
Ethernet cable. Disconnect all other network connections (e.g. WiFi) on
the computer.
9. Serve the factory image
"openwrt-*-ramips-mt7621-edup_ep-rt2983-squashfs-factory.bin" using
a TFTP server, e.g. tftpd64. For convenience, the filename can be renamed
to something shorter.
10. In the serial terminal, when prompted "Input file name:", enter the
filename from the previous step and press Enter.
11. The factory image will be flashed as indicated. Wait for reboot.
MAC addresses prototype
------------------------
+---------+---------------------+
| | MAC example |
+---------+---------------------+
| LAN | CC:D8:1F:47:xx:yy |
| WAN | CC:D8:1F:47:xx:yy+1 |
| WLAN 2G | CC:D8:1F:17:xx:yy+2 |
| WLAN 5G | CC:D8:1F:77:xx:yy+2 |
+---------+---------------------+
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/22197
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This adds support for the Wavlink "Halo Base Pro".
SOC: MT7621DAT
RAM: 128MiB
Flash: 16MiB NOR
WiFi: MT7603EN + MT7613BEN
Buttons:
- The touch sensor was originally for WPS, but this has been moved to the
pair button which is no longer used to prevent accidental touches
LEDs:
- On original firmware, the status LEDs light up as follows:
- Purple = booting, Blue = working, Red = error
Partitions:
- factory contains unique WiFi EEPROM and default MAC addresses
- vendor partition has an unknown purpose
Stock MAC address allocation:
- LAN1: xx:xx:xx:xx:xx:80
- LAN2/WAN: xx:xx:xx:xx:xx:81
- WiFi 2.4G: xx:xx:xx:xx:xx:82
- WiFi 5G: xx:xx:xx:xx:xx:83
LAN Ports:
- lan1 is the normal white LAN port
- lan2 is labelled "LAN/Backhaul", which can either be LAN or WAN.
- Since this device is intended to be part of a mesh, this will usually
be a LAN port, hence why it's assigned to lan2 here
Notes:
- I've chosen "Halo Base Pro" as the device model, despite the website URL
showing WL-WN535M3, as the label only states "Halo Base Pro".
- Only the 5GHz WiFi address is labelled on the device
Signed-off-by: William Latter <williamlatter77@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22400
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for Z-ROUTER ZR-2662 (also known as Routerich
AX1800 V2) wireless WiFi 6 router.
Hardware specification
---------------------
- SoC : MediaTek MT7621AT, MIPS, 880 MHz
- RAM : 256 MiB
- Flash : NAND 128 MiB (AMD/Spansion S34ML01G2)
- WLAN :
- 2.4 GHz : MediaTek MT7905D/MT7975 (14c3:7916), b/g/n/ax, MIMO 2x2
- 5 GHz : MediaTek MT7915E (14c3:7915), a/n/ac/ax, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x4 (1x WAN, 3x LAN)
- USB : 1x 2.0
- UART : 3.3V, 115200n8, pins are silkscreened on the pcb
- Buttons : 1x Reset
- LEDs : 1x WiFi 2.4 GHz (green)
1x WiFi 5 GHz (green)
1x LAN (green)
1x WAN (green)
1x WAN no-internet (red)
- Power : 12 VDC, 1 A
Installation
------------
1. Run tftp server on your PC (IP: 192.168.2.2) and put OpenWrt initramfs
image (initramfs.bin) to the tftp root dir
2. Open the following link in the browser to enable telnet:
http://192.168.2.1/cgi-bin/telnet_ssh
3. Connect to the router (default IP: 192.168.2.1) using telnet shell
(credentials - user:admin)
4. Run the following commands in the telnet shell (this will install
OpenWrt initramfs image on nand flash):
cd /tmp
tftp -g -r initramfs.bin 192.168.2.2
mtd write initramfs.bin firmware
mtd erase firmware_backup
reboot
5. Copy OpenWrt sysupgrade image (sysupgrade.bin) to the /tmp dir of the
router
6. Connect to the router (IP: 192.168.1.1) using ssh shell and run
sysupgrade command:
sysupgrade -n /tmp/sysupgrade.bin
Return to stock
---------------
1. Copy stock firmware (stock.bin) to the /tmp dir of the router using scp
2. Run following command in the router shell:
cd /tmp
mtd write stock.bin firmware
reboot
Recovery
--------
Connect uart (pins are silkscreened on the pcb), interrupt boot process by
pressing any key, use u-boot menu to flash stock firmware image or OpenWrt
initramfs image.
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 24:0f:5e:xx:xx:4c | label |
| WAN | 24:0f:5e:xx:xx:4d | label+1 |
| WLAN 2g | 24:0f:5e:xx:xx:4e | label+2 |
| WLAN 5g | 24:0f:5e:xx:xx:4f | label+3 |
+---------+-------------------+-----------+
The WLAN 2.4 MAC was found in 'factory', 0x4
The LAN MAC was found in 'factory', 0xfff4
The WAN MAC was found in 'factory', 0xfffa
Note: This device is similar to Z-ROUTER ZR-2660, but with minor hardware
revisions. The firmware and configuration are compatible.
Signed-off-by: xingchi <juncaixingchi2026@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21524
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware:
- SoC: MediaTek MT7628AN (MIPS 580MHz)
- Flash: 16 MiB NOR
- RAM: 64 MiB DDR2
- WLAN: 2.4 GHz (MT7628)
- Ethernet: 1x 10/100 Mbps WAN/LAN, 1x 10/100 LAN (MT7628)
- Build-in LTE Modem: MeigLink SLM770A
4G Cat. 4 (150/50 Mbps)
- Buttons: 1x Reset, 1x wps
- LEDs: Front: 1x Red, 1x White,
Back: 3x White 4G signal strengh
- Serial console: unpopulated header, 115200 8n1
- Power: USB-C
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| WAN | 80:af:ca:xx:xx:x1 | label+1 |
| LAN | 80:af:ca:xx:xx:x0 | label |
| WLAN 2g | 80:af:ca:xx:xx:x2 | label+2 |
+---------+-------------------+-----------+
Migration to OpenWrt:
- Download the RSA signed intermediate firmware from the Cudy website:
`openwrt-ramips-mt76x8-cudy_lt300-v3-squashfs-flash.bin`
- Connect computer to LAN and flash the intermediate firmware via OEM web interface
- OpenWrt is now accessible via 192.168.1.1
Revert back to OEM firmware:
- Set up a TFTP server on IP 192.168.1.88 and connect to the WAN port (upper port)
- Provide the Cudy firmware as recovery.bin in the TFTP server
- Press the reset button while powering on the device
- Recovery process is started now
- When recovery process is done, OEM firmware is accessible via 192.168.10.1 again
General information:
- No possibility to load a initramfs image via U-Boot because there is no option to interrupt U-Boot
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21982
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Denis Faizullin
Carlo Szelinsky
Shiji Yang
Myeongjae SONG
Andrej Valek
Charles Joynson
Frank Lang
Vincenzo Suraci
rodriguezst
Rosen Penev
David Yang
YAJIMA Hideyuki
Sven Eckelmann (Plasma Cloud)
Fabian Groffen
Ryan Leung
Gunther Stammwitz
Dixiao-L
Taiga Ogawa
Fil Dunsky
Sven Eckelmann
Simonas Tamošaitis
librarat876
Matt Brent
Mieczyslaw Nalewaj
Hiroki Utsunomiya
Ivan Davydov
William Latter
Shiji Yang
xingchi