The squashfs images of the TP-Link RE200 v1 and RE210 v1 differ between
builds; the uncompressed kernel of the RE200 one was 271 bytes larger,
from its device tree on:
-00001040: 6d00 0080 00cb 1a9e 0000 0000 0000 006f
+00001040: 6d00 0080 00da 1b9e 0000 0000 0000 006f
The RE210 device tree is exactly 271 bytes larger than the RE200 one, so
the RE200 image carried the kernel of the RE210.
tplink-v1-okli-image puts kernel and rootfs together in
$(IMAGE_ROOTFS).factory or .sysupgrade, a name shared by all devices with
the same rootfs. Both devices are built at the same time, so one can
overwrite the file of the other between cp, cat and mktplinkfw, and an
image can end up with the kernel and device tree of the other device.
Link: https://github.com/openwrt/openwrt/pull/25816
Signed-off-by: Paul Spooren <mail@aparcar.org>
The Build/haier-sim_wr1800k-factory recipe produced non-reproducible images for two reasons:
* openssl aes-256-cbc -salt generates a random salt on every run, which is embedded in the Salted__
header and feeds key derivation, so identical input yields different ciphertext each build.
* tar -czf embeds the current time in both the gzip header and records member mtimes, uid/gid and
permission bits taken from the build environment (umask-dependent).
Fix by encrypting with a fixed salt instead of a random one, and by creating the archive with
deterministic tar options (sorted member order, zeroed uid/gid, normalized permissions via
--mode=go-w and mtime pinned to SOURCE_DATE_EPOCH when set (guarded by $(if ...)), piped through
`gzip -n`. The salt "4f70656e57727421" was obtained from `echo -n 'OpenWrt!' | xxd -p`.
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/25605
Signed-off-by: Paul Spooren <mail@aparcar.org>
Build/elx-header and Build/znet-header convert a hex string into \xHH
escape sequences using `fold -s2`. This relies on the obsolete -WIDTH
option syntax of GNU fold, which parses "-s2" as "-s -2". uutils
coreutils does not support this syntax and fails with:
error: unexpected argument '-2' found
tip: to pass '-2' as a value, use '-- -2'
Since fold writes nothing to stdout in this case, the command
substitution expands to an empty string. The following
`dd bs=N count=1 conv=sync` then writes zero bytes, because conv=sync
only pads partial input blocks and never pads empty input. The header
field is dropped entirely, and all subsequent fields move to lower
offsets.
The build still succeeds, because the failure happens inside the
subshell which is then handed to echo.
The malformed images are only rejected when a device tries to
boot them.
For example, on the Zyxel WSM20, the missing payload size field in the
znet-header moves the 0x12345678 magic and the payload to unexpected
offsets. The bootloader then rejects the image, even though sysupgrade
accepted it.
This affects all builds on Ubuntu 25.10 and later, because these
releases use uutils coreutils by default.
Replace `fold -s2` with `fold -w2`, which is the documented way to set
the line width and produces identical output with GNU fold.
Affected devices:
- Build/znet-header is used in all images of the Zyxel WSM20 and the
ELECOM WRC-X1800GS
- Build/elx-header is used in the factory images of the ELECOM
WAB-I1750-PS, WAB-S1167-PS, WAB-S600-PS, WRC-2533GHBK-I and
WRC-2533GHBK2-T, the I-O DATA WN-AC1167GR, WN-AC733GR3 and WNPR2600G,
the Edimax RA21S and RG21S, and the D-Link DAP-X1860 A1
Signed-off-by: Grische <github@grische.xyz>
Assisted-by: Claude:claude-opus-5
Link: https://github.com/openwrt/openwrt/pull/25410
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
TP-Link EX220 v1 as distributed by the Russian ISP MTS, labelled
"EX220(RU)MTS) Ver:1.30". It carries the same model name as the already
supported tplink,ex220-v1, but it is a different board: 128 MB of
parallel NAND managed by NMBM instead of 16 MB of SPI-NOR, and an entirely
different flash layout. The bootloader tells the two apart - on this
revision U-Boot prints "NAND: 128 MiB" followed by "NMBM has been
successfully attached".
Hardware specification:
- SoC: MediaTek MT7621AT (MIPS 1004Kc, ver 1 eco 3)
- RAM: 128 MB DDR3 (chip hidden under the shielding can)
- Flash: 128 MB parallel NAND, ESMT F59L1G81MB, NMBM managed
(the driver identifies the chip as "ESMT PSU1GA30DT")
- WiFi: MediaTek MT7915E, DBDC, 2x2 2.4 GHz + 2x2 5 GHz (AX1800)
- Ethernet: MediaTek MT7530, 5x 10/100/1000 Mbps (4x LAN + 1x WAN)
- LEDs: 7x GPIO - power, LAN, WAN green, WAN amber, WLAN 2.4 GHz,
WLAN 5 GHz, WPS
- Buttons: 2x tactile - reset, WPS
- UART: 4 unpopulated through holes on the solder side of the board,
beside the silver factory sticker, with no silkscreen designator.
Counting from the hole furthest from the ethernet ports: pin 1 TX,
pin 2 RX, pin 3 GND, pin 4 unused - leave it unconnected.
115200 8N1, 3.3 V.
- Power: 12 VDC, 1 A
MAC addresses:
LAN f0:a7:31:xx:xx:xx misc_ro @ 0x5c50bc, matches the label
WAN f0:a7:31:xx:xx:xx same as LAN
2.4G label MAC + 2
5G label MAC + 3
The radio calibration lives in the misc_ro partition, which holds a
JFFS2 filesystem with five files named after their original flash
offsets. The largest one carries the MT7915 EEPROM at offset 0x90000,
so 11-mt76-caldata mounts the partition read-only and copies it out.
Reading it needs CONFIG_JFFS2_ZLIB - the vendor compressed those nodes
with zlib, which OpenWrt does not build in by default.
It is worth the kernel option. With the factory calibration the client
reports -44 dBm at half a metre and negotiates HE-MCS 11; with the
generic default EEPROM the very same link reports -82 dBm and settles
at HE-MCS 3, and a local transfer peaks at 541 instead of 692 Mbit/s.
The vendor bootloader loads a FIT image from the fixed address
0xd00000 and does not evaluate partition names, so the vendor firmware
slot is split into a raw kernel partition and a UBI partition holding
rootfs and rootfs_data.
Flash instructions:
The vendor web interface offers no way in, so the first installation is
done over the serial console.
1. Open the case and attach a 3.3 V USB-to-serial adapter to the 4-pin
header described above.
2. Power the board up and interrupt the bootloader by pressing any key
when it prints "Hit any key to stop autoboot".
3. Load the initramfs image into RAM over YMODEM:
loady 0x84000000
Send openwrt-ramips-mt7621-tplink_ex220-v1-nand-initramfs-kernel.bin
using the YMODEM transfer of your terminal program - this takes
about 11 minutes at 115200 baud - and boot it:
bootm 0x84000000
Do not raise the bootloader console speed to shorten the transfer:
with the console set to 921600 baud the kernel hangs while taking
the UART over from the bootloader, leaving nothing after the 16550A
line, and the watchdog resets the board.
4. The running system serves 192.168.1.1/24 on the LAN ports. Transfer
openwrt-ramips-mt7621-tplink_ex220-v1-nand-squashfs-sysupgrade.bin
to /tmp and install it:
sysupgrade -n /tmp/openwrt-*-ex220-v1-nand-squashfs-sysupgrade.bin
The board reboots into OpenWrt on its own; later updates use
sysupgrade as usual.
Reverting to stock:
The second firmware slot ships empty, so there is nothing to fall back
to - take a backup while the initramfs image of step 3 is running, ie
before step 4:
cat /dev/mtd4 /dev/mtd5 > /tmp/stock.bin
and copy it off the device. To restore it, boot the initramfs image
again and write it back:
dd if=stock.bin bs=1M count=4 | mtd write - kernel
dd if=stock.bin bs=1M skip=4 | mtd write - ubi
Signed-off-by: Denis Faizullin <triplexit.help@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24831
Signed-off-by: Robert Marko <robimarko@gmail.com>
The evdev character devices come out 0600 root:root, so a display server
or any other process reading keyboards and pointers runs as root.
Add an input-support package which allocates the input group and puts the
input nodes into it, and make the evdev and joydev modules depend on it.
The one device profile that ships evdev lists the package directly.
kmod-input-core stays ungated: it carries no device node of its own, and
most drivers built on it deliver their events to in-kernel consumers such
as the keyboard and button handlers.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The audio group and the rule that puts the ALSA character devices in it
are part of procd and base-files, so every image carries them whether or
not it has a sound card, and a package wanting the group has nothing to
depend on. Playback, capture and MIDI all land in one group as well, so a
process allowed to play is also allowed to record.
Move the lot into a new audio-support package with three groups, audio,
audio-capture and midi, and a hotplug fragment that sorts the sound nodes
between them. kmod-sound-core depends on the package, and so do the image
profiles that ship a sound driver. The dependency is a plain one, not a
select, so sound support is offered once the feature is chosen; userspace
that needs one of the groups depends on the same package. Images without
it fall back to the generic rule and get /dev/snd/* as 0600 root:root.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Several image recipes call tar without the options that pin the member
order, the owner, the mode and the modification time. The archive then
holds the build time, the umask of the build user and the readdir order of
the build directory, so two builds of the same source produce different
images.
Pass the same options that Image/mkfs/targz and sysupgrade-tar.sh already
use. The recipes define no member order, so sorting the members takes
nothing away. The diffoscope of the published WAX610 archive shows the
order differing between the build machines, which is what a readdir order
produces.
--mode=go-w clears the write bit of the group and of the others. tar keeps
the mode of the file on disk, which follows the umask of the build user,
so without it the archive differs between a host with umask 022 and one
with umask 002.
Covers the Netgear factory archives of ipq40xx, ipq60xx and ipq807x, the
Creality factory archive of mt76x8, the D-Link DWL8610AP archive of
bcm53xx, the Freecom archive of ixp4xx and the Linksys switch archive of
realtek.
Signed-off-by: John Crispin <john@phrozen.org>
Cudy LT700 Outdoor v1 is an outdoor 4G LTE Wi-Fi 5 router (Cudy board
ID R43).
Hardware:
- SoC: MediaTek MT7621AT
- Flash: 16 MiB SPI NOR (XM25QH128C)
- RAM: 128 MiB DDR3
- WLAN: 2.4 GHz (MediaTek MT7603E, 11n), 5 GHz (MediaTek MT7663, 11ac)
- Ethernet: 1x 10/100/1000 Mbps LAN
- Power: 48-57 V passive PoE
- Buttons: 1x Reset button
- LEDs: 8x Green
- LTE: internal USB modem Quectel EG060W (Cat 6)
- Serial console: 3.3V, 115200 8N1, unpopulated 4-pin header left of the
SoC; pinout from top: VCC, GND, TX, RX
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | d4:0d:ab:xx:xx:xx | label |
| WLAN 2g | d4:0d:ab:xx:xx:xx | label |
| WLAN 5g | d4:0d:ab:xx:xx:xx | label +1 |
+---------+-------------------+-----------+
The internal LTE modem is a Quectel EG060W and needs the option driver
IDs added in a separate commit. gpio-export applies the initial output
value raw, ignoring the active-low flag, so output = <0> is what pulls
the modem power enable low and powers it at boot.
Migration to OpenWrt:
- Obtain the RSA signed intermediate firmware from Cudy:
openwrt-ramips-mt7621-cudy_lt700-outdoor-v1-squashfs-flash.bin
- Connect a computer to the LAN port and flash the intermediate firmware
via the OEM web interface
- OpenWrt is now accessible via 192.168.1.1
- Install the regular OpenWrt sysupgrade image from LuCI or over SSH
Revert back to OEM firmware:
- Configure a computer with IP 192.168.1.88 and run a TFTP server that
serves the OEM recovery image as recovery.bin
- Hold the reset button while powering on the device; the bootloader
fetches recovery.bin and restores the OEM firmware
Signed-off-by: Carlo Szelinsky <github@szelinsky.de>
Tested-by: achim <achim@cloudystars.net>
Link: https://github.com/openwrt/openwrt/pull/24689
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
ASUS RT-N65U is a 2.4/5 GHz band 11n (Wi-Fi 4) router, based on RT3883.
Specification:
- CPU1: Ralink RT3883 @ 500MHz, WiSoC 5GHz
- CPU2: Ralink RT3352 @ 400MHz, WiSoC 2.4GHz
- RAM1: 128MB
- RAM2: 16MB
- Flash: Macronix MX25L12805D (16MB)
- WLAN: Ralink RT3883 (5GHz 3T3R), Ralink RT3352 (2.4GHz 2T2R)
- Switch: Realtek RTL8367RB
- 4x 10/100/1000 Mbps Ethernet
- 1x 10/100/1000 Mbps WAN
- USB: ASMedia ASM1042 USB 3.0 Controller
- PMU: UTC UZ1086L-ADJ
- 6x LED, 2x button
Installation (TFTP):
1. Power off the router.
2. Press and hold the Reset button.
3. Power on the router.
4. Wait 5 seconds, then release the Reset button.
5. Connect your PC to the router with Ethernet cable.
6. Configure a static IP address in the `192.168.1.0/24` subnet (except `192.168.1.1`).
7. Configure your TFTP client to use binary (octet) transfer mode.
8. Upload the firmware image (OpenWrt, stock, or Padavan) to `192.168.1.1`.
The TFTP server accepts any filename.
9. Wait for the firmware flashing process to complete.
WARNING: Flashing the stock firmware after using Padavan may brick
your router due to configuration partition incompatibility.
MAC address layout:
- Wi-Fi 2.4GHz & WAN: label MAC
- Wi-Fi 5GHz & LAN: label MAC + 4
MTD layout:
```
mtd0: 00030000 00010000 "u-boot"
mtd1: 00010000 00010000 "config"
mtd2: 00010000 00010000 "factory"
mtd3: 00fb0000 00010000 "firmware"
mtd4: 001ee3b3 00010000 "kernel"
mtd5: 00dc1c4d 00010000 "rootfs"
mtd6: 00960000 00010000 "rootfs_data"
```
Known issues:
- The RT3352 2.4 GHz iNIC is unsupported because it requires a
proprietary firmware blob and kernel support
- The Wi-Fi LEDs cannot be disabled independently because they share
the LED power rail controlled by GPIO10
This work is based on the earlier draft support by Andrej Valek.
Tested by 4PDA users
Signed-off-by: Andrej Valek <andy@skyrain.eu>
Signed-off-by: Andrey Trishin <zatrit@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24343
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add support for the Comfast CF-EW84 based on the MediaTek MT7621
SoC.
Hardware:
CPU/SoC: MediaTek MT7621DA
RAM: 128 MB DDR3
Flash: Macronix MX25L12805D 16 MB
Switch: MediaTek MT7530
WiFi 2.4 GHz: MediaTek MT7603E
WiFi 5 GHz: MediaTek MT7613B
Ports: 1x WAN, 2x LAN (10/100/1000 Mbps)
LEDs: Power, WAN, LAN1, LAN2, WLAN
Buttons: Reset
UART: through-hole on PCB
pinout: RX, TX, GND, 3.3V
settings: 115200n8
Flash instructions:
1. Connect the bundled PoE injector to power.
2. Connect the PC to the LAN1 or LAN2 port of the device.
3. Configure a static IP on the computer's Ethernet adapter:
IP: 192.168.1.x (x = 2 to 254)
Mask: 255.255.255.0
Gateway: empty
DNS: empty
4. Connect a second Ethernet cable to the PoE port of the
bundled injector.
5. Press and hold the reset button on the device.
6. While holding the reset button, plug the other end of the
second Ethernet cable into the WAN port.
7. Wait at least 3 seconds, then release the reset button.
8. Browse to http://192.168.1.1: the MediaTek U-Boot System
Recovery page should appear.
9. Click Upload and select the *-sysupgrade.bin firmware file.
10. After flashing completes, browse to http://192.168.1.1
again: the LuCI login page should appear.
Factory data:
2.4 GHz EEPROM: factory offset 0x0000
5 GHz EEPROM: factory offset 0x8000
LAN MAC address: factory offset 0xe000
WAN MAC address: factory offset 0xe000 (+1)
LED layout:
The Comfast CF-EW84 has five physical LEDs, but only the WLAN
LED is software-controllable through the Linux GPIO-LEDs
subsystem.
Signed-off-by: Vincenzo Suraci <vincenzo.suraci@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24112
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware:
- SoC: MediaTek MT7628AN
- Flash: 16 MiB SPI NOR
- RAM: 128 MiB DDR2
- WLAN: 2.4 GHz (MT7628AN, 11n), 5 GHz (MediaTek MT7615E, 11ac)
- Ethernet: 1x10/100 Mbps LAN
- Buttons: 1 Reset button
- LEDs: 8x Green
- LTE: internal USB-connected modem Quectel EC200A
- Serial Console: unpopulated header 115200 8n1
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 80:af:ca:xx:xx:x0 | label |
| WLAN 2g | 80:af:ca:xx:xx:x0 | label |
| WLAN 5g | 80:af:ca:xx:xx:x2 | +2 |
+---------+-------------------+-----------+
Migration to OpenWrt:
- Download the RSA signed intermediate firmware:
`openwrt-ramips-mt76x8-cudy_lt500-outdoor-v1-squashfs-flash.bin`
- Connect computer to LAN and flash the intermediate firmware via OEM web interface
- OpenWrt is now accessible via 192.168.1.1
Revert back to OEM firmware:
- Press the reset button while powering on the device
- Connect the LAN port to the PC
- Open 192.168.1.1 in a browser and use the wizard to upload and flash OEM firmware image
- When recovery process is done, OEM firmware is accessible via 192.168.10.1 again
Signed-off-by: rodriguezst <git@rodriguezst.es>
Link: https://github.com/openwrt/openwrt/pull/23752
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This patch adds support for the ASUS RT-AC85U wireless router.
It is a dual-band gigabit router based on the MediaTek MT7621AT SoC.
MAC Address Layout:
- LAN/WAN/2.4G/5G MAC addresses are derived from the
factory partition at offset 0xe000.
Hardware Specifications:
- SoC: MediaTek MT7621AT (880 MHz, 2C/4T)
- RAM: 128 MB DDR3
- Flash: 128 MB Winbond W29N01HV NAND
- WI1: MediaTek MT7615E (2.4 GHz, 4x4)
- WI2: MediaTek MT7615E (5 GHz, 4x4)
- Switch: MediaTek MT7530 (Embedded Gigabit Switch)
- Ports: 1x WAN, 4x LAN (10/100/1000 Mbps), 1x USB 3.0
- LEDs: Power, LAN, WAN, 2.4G, 5G, USB, WPS
- Buttons: WPS, Reset
Installation / Flashing guide:
1. Power off the device.
2. Hold Reset button and power on to enter ASUS Restoration mode (slow flash LED).
3. Set your computer's static IP to 192.168.1.x (e.g., 192.168.1.10).
4. Upload the OpenWrt initramfs image via ASUS Restoration tool to 192.168.1.1.
5. Wait for the device to boot into the temporary OpenWrt environment.
6. Access LuCI (192.168.1.1) and flash sysupgrade image to make it permanent.
Signed-off-by: YAJIMA Hideyuki <ursmtr@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23747
Signed-off-by: Robert Marko <robimarko@gmail.com>
While still sufficient for the base image, space runs out quickly with
the ~15MiB available in kernel0. The identical space in kernel1 is
unused, and standard installation instructions flash to both areas so it
isn't an easy fallback to stock either.
Merge the regions for kernel0 and kernel1 so there's more space
available to the user to install packages and some data.
Signed-off-by: Fabian Groffen <grobian@bitzolder.nl>
Link: https://github.com/openwrt/openwrt/pull/22316
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The Yuncore 1200F is an outdoor 802.11ac access point based on the
MediaTek MT7628AN SoC with an MT7663E PCIe 5 GHz radio. The device is
also sold under the KuWFi AP1200F name.
Hardware:
- SoC: MediaTek MT7628AN
- CPU: MIPS 24KEc
- RAM: 64 MiB
- Flash: 8 MiB SPI NOR
- Ethernet: 2x 10/100 Mbps
- WiFi 2.4 GHz: MT7628AN WMAC
- WiFi 5 GHz: MT7663E PCIe
- LEDs: status, LAN, WAN
- Button: reset
- Watchdog: GPIO watchdog
MAC addresses:
- Ethernet: factory 0x0004
- 2.4 GHz WiFi: factory 0x0028
- 5 GHz WiFi: factory 0x8004
Network:
- LAN: eth0.1, switch port 4
- WAN: eth0.2, switch port 3
Installation:
- Build the sysupgrade image:
openwrt-ramips-mt76x8-yuncore_1200f-squashfs-sysupgrade.bin
- The stock firmware provides a U-Boot recovery web interface. It can be
entered by holding the reset button while powering on the device. Connect to
http://192.168.0.100/ and upload openwrt-sysupgrade.bin file.
Recovery:
- Reverting to stock firmware has not been tested.
The 5 GHz radio is detected as PCI ID 14c3:7663 and uses mt7615e
together with the MT7663 AP firmware. kmod-mt76x2 is explicitly
excluded because this board uses MT7663E, not MT76x2.
Tested:
- Build succeeds for ramips/mt76x8
- Sysupgrade image boots
- Ethernet LAN/WAN work
- 2.4 GHz AP starts on phy0
- 5 GHz AP starts on phy1
- Stable MAC addresses are assigned to Ethernet, phy0 and phy1
Signed-off-by: Gunther Stammwitz <gstammw@gmx.net>
Link: https://github.com/openwrt/openwrt/pull/23613
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Build an initramfs-factory.trx image suitable for flashing directly via
the vendor firmware WebGUI, without using TFTP or SSH.
To use:
1. Flash the initramfs-factory.trx file with the vendor firmware
administrative interface.
2. Wait until the router restarts, login to OpenWRT via LuCI (or SSH)
and upgrade firmware using the sysupgrade-squashfs.bin image file.
It is necessary to use TRX version 2, which has a kernel size limit of
16MB (TRX version 3 is rejected by vendor firmware). To avoid stopping
the whole build when the input file turns out larger, check in the
Build/asus-trx macro if check-size removed the input file and don't
error out in this case.
Note: It should be possible to prepare an image to flash the router in
one step, but this will be more complicated, because vendor firmware and
OpenWRT use a slightly different partition layout.
Signed-off-by: Mateusz Jończyk <mat.jonczyk@o2.pl>
Link: https://github.com/openwrt/openwrt/pull/23647
Signed-off-by: Robert Marko <robimarko@gmail.com>
Hardware:
- SoC: MediaTek MT7628AN (MIPS 580MHz)
- Flash: 8 MiB NOR
- RAM: 64 MiB DDR2
- WLAN: 2.4 GHz (MT7628)
- Ethernet: 1x 10/100 Mbps WAN, 3x 10/100 LAN (MT7628)
- Buttons: 1x Reset, 1x wps
- LEDs: Front: 1x Red, 1x White
- Serial console: unpopulated header, 115200 8n1
- Power: 12v barrel
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN/WAN | d4:0d:ab:xx:xx:x0 | label |
| WLAN 2g | d4:0d:ab:xx:xx:x1 | label+1 |
+---------+-------------------+-----------+
Migration to OpenWrt:
- Download the RSA-signed intermediate firmware from the Cudy website: `openwrt-ramips-mt76x8-cudy_wr300-squashfs-flash.bin`
- Connect the computer to the LAN and flash the intermediate firmware via the OEM web interface
- OpenWrt is now accessible via 192.168.1.1
Revert to OEM firmware:
- Set up a TFTP server on IP 192.168.1.88 and connect to the WAN port (upper port)
- Provide the Cudy firmware as `recovery.bin` in the TFTP server
- Power on the device and hold the reset button immediately after the first LED blink
- The recovery process will start
- When the recovery process is done, OEM firmware is accessible via 192.168.10.1 again
General information:
- No possibility to load an initramfs image via U-Boot because there is no option to interrupt U-Boot
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23426
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specificaitons:
- MediaTek MT7621AT SoC
- 256 MB RAM
- 16MB SPI NOR Flash
- 256MB NAND (split in half for firmware fallback)
- 4x 10/100/1000 Mbps Ethernet, with passive PoE support on LAN1
- WLAN : MediaTek dual-band WiFi 5
- 2.4 GHz : b/g/n, MIMO 2x2
- 5 GHz : n/ac, MIMO 2x2
- Quectel EG060K-EA 4G CAT6 modem
- 2.0 USB Type-A HOST port
- 1x Digital input
- 1x Digital output
- 2x SIM slot (can be swapped via GPIO)
GPIO:
- 1 button (Reset)
- 14 LEDs (power, 4x WAN status, Wifi 2G, Wifi 5G, 3G, 4G, 5x RSSI)
- 3 Modem control (power button, reset, sim select)
- 1 Digital input
- 1 Digital output
Installation
------------
Notice: update OEM firmware to 7.19 or later, earlier versions will
fail to flash openwrt factory firmware.
1. Check from which partition the device is currently running from
$ cat /proc/bootconfig/chosen
In case this output reads rutos-b, install a software update from
Teltonika first. After upgrade completion, check this file now reads
rutos-a before continuing.
2. Download the *-squashfs-factory.bin firmware image
3. Flash firmware image via WEB interface
To revert back to OEM firmware:
https://wiki.teltonika-networks.com/view/Bootloader_menu
Mobile connection:
- EG060K-EA:
Execute AT commands:
echo -ne 'AT+QCFG="usbnet",2\r\n' > /dev/ttyUSB2
echo -ne 'AT+CFUN=1,1\r\n' > /dev/ttyUSB2
Use ModemManager to establish mobile connection.
Signed-off-by: Simonas Tamošaitis <simsasss@gmail.com>
Specifications:
- MediaTek MT7621AT SoC
- 256 MB RAM
- 16MB SPI NOR Flash
- 256MB NAND (split in half for firmware fallback)
- 2x 10/100/1000 Mbps Ethernet, with passive PoE support on LAN
- WLAN : MediaTek dual-band WiFi 5
- 2.4 GHz : b/g/n, MIMO 2x2
- 5 GHz : n/ac, MIMO 2x2
- Quectel RG520N-EB 5G R16 modem (RUTM30) or RG500U-EB 5G (RUTM31)
- 1x Digital input
- 1x Digital output
- 2x SIM slot (can be swapped via AT commands)
- eSIM
- TPM
GPIO:
- 1 button (Reset)
- 3 LEDs (power, 2 RGB)
- 3 Modem control (power button, reset, eSIM switch)
- 1 Digital input
- 1 Digital output
- 1 TPM enable
Installation
------------
Notice: update OEM firmware to 7.19 or later, earlier versions will
fail to flash openwrt factory firmware.
1. Check from which partition the device is currently running from
$ cat /proc/bootconfig/chosen
In case this output reads rutos-b, install a software update from
Teltonika first. After upgrade completion, check this file now reads
rutos-a before continuing.
2. Download the *-squashfs-factory.bin firmware image
3. Flash firmware image via WEB interface
To revert back to OEM firmware:
https://wiki.teltonika-networks.com/view/Bootloader_menu
Mobile connection:
- RG520N-EB:
Use "ModemManager" to establish mobile data connection.
- RG500U-EB:
echo -ne 'AT+QNETDEVCTL=1,3,1\r\n' > /dev/ttyUSB2
Create DHCP interface with usb0 device.
Signed-off-by: Simonas Tamošaitis <simsasss@gmail.com>
Specifications:
- MediaTek MT7621AT SoC
- 256 MB RAM
- 16MB SPI NOR Flash
- 256MB NAND (split in half for firmware fallback)
- 5x 10/100/1000 Mbps Ethernet, with passive PoE support on LAN1
- WLAN : MediaTek dual-band WiFi 5
- 2.4 GHz : b/g/n, MIMO 2x2
- 5 GHz : n/ac, MIMO 2x2
- Quectel RG520N-NA 5G R16 modem (RUTM50) or RG500U-EB 5G (RUTM51)
- 2.0 USB Type-A HOST port
- 1x Digital input
- 1x Digital output
- 2x SIM slot (can be swapped via AT commands)
GPIO:
- 1 button (Reset)
- 13 LEDs (power, 4x WAN status, Wifi 2G, Wifi 5G, 3G, 4G, 5G, RSSI
1,2,3)
- 2 Modem control (power button, reset)
- 1 Digital input
- 1 Digital output
Installation
------------
Notice: update OEM firmware to 7.19 or later, earlier versions will
fail to flash openwrt factory firmware.
1. Check from which partition the device is currently running from
$ cat /proc/bootconfig/chosen
In case this output reads rutos-b, install a software update from
Teltonika first. After upgrade completion, check this file now reads
rutos-a before continuing.
2. Download the *-squashfs-factory.bin firmware image
3. Flash firmware image via WEB interface
To revert back to OEM firmware:
https://wiki.teltonika-networks.com/view/Bootloader_menu
Mobile connection:
- RG520N-NA:
Use "ModemManager" to establish mobile data connection.
- RG500U-EB:
echo -ne 'AT+QNETDEVCTL=1,3,1\r\n' > /dev/ttyUSB2
Create DHCP interface with usb0 device.
Signed-off-by: Simonas Tamošaitis <simsasss@gmail.com>
The RG-EW1300G is a router with 1 x WAN and 3 x LAN gigabit ports.
The router runs on Ruijie OS by default.
- Specifications:
* SoC: MT7621A
* RAM: 128MB DDR3
* Flash: 16MB SPI NOR flash (GD25Q128C)
* WiFi0: Mediatek MT7615 2.4GHz 802.11b/g/n
* WiFi1: Mediatek MT7615 5GHz 802.11ac
* Ethernet: MT7530, 4x 1000Base-T.
* UART: Serial console - As marked on PCB, baudrate is 57600. DO NOT CONNECT 3.3V.
* Buttons: Reset, WPS.
* LED: Programmable LEDs via GPIO working for Red+Green status, and Mesh/WPS at the rear of the chassis.
- Default Flash:
```
GD25Q128C(c8 40180000) (16384 Kbytes)
mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
6 cmdlinepart partitions found on MTD device raspi
Creating 6 MTD partitions on "raspi":
0x000000000000-0x000000050000 : "u-boot"
0x000000050000-0x000000060000 : "u-boot-env"
0x000000060000-0x000000070000 : "Factory"
0x000000070000-0x000000080000 : "product_info"
0x000000080000-0x000000090000 : "kdump"
0x000000090000-0x000001000000 : "firmware"
0x00000031a847-0x000001000000 : "rootfs"
mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
mtd: partition "rootfs_data" created automatically, ofs=0xae0000, len=0x520000
0x000000ae0000-0x000001000000 : "rootfs_data"
register mt_drv
```
```
cat /proc/mtd
dev: size erasesize name
mtd0: 00050000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "factory"
mtd3: 00010000 00010000 "product_info"
mtd4: 00010000 00010000 "kdump"
mtd5: 00f70000 00010000 "firmware"
mtd6: 0028a847 00010000 "kernel"
mtd7: 00ce57b9 00010000 "rootfs"
mtd8: 00520000 00010000 "rootfs_data"
```
- Installation:
1. Open the case, solder to the marked 4 pin header
2. Connect it to a USB-UART TTL (do not connect to 3.3v)
3. Open a terminal with baud 57600.
4. Power on device, and repeatedly press "2" key to catch bootloader option
5. Set IP, TFTP server IP, and image file to load (eg, openwrt-ramips-mt7621-ruijie_rg-ew1300g-v1-squashfs-sysupgrade.bin)
6. System will reboot into OpenWRT.
Signed-off-by: Matt Brent <git@mattzfiber.co.za>
Link: https://github.com/openwrt/openwrt/pull/21864
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
* CPU: MediaTek MT7628AN (580 MHz)
* Flash: GigaDevice GD25Q128CSIG (16 MiB)
* RAM: Winbond W9751G6KB-25 (64 MiB)
WikiDevi page: <https://wikidevi.wi-cat.ru/Keenetic_City_(KN-1510)>
How to flash:
* Configure TFTP server with IP address 192.168.1.2/24
* Serve OpenWrt factory image as "KN-1510_recovery.bin"
* Connect the PC to router's LAN port, hold the reset button and power
the router up. When the power LED starts blinking release the
button.
The same instructions apply to OEM firmware, except one can take it
from osvault.keenetic.net
Signed-off-by: Ivan Davydov <lotigara@lotigara.ru>
Link: https://github.com/openwrt/openwrt/pull/22404
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
EDUP EP-RT2983 comes with a factory installed version of OpenWrt 23.05
with device name "netis,n6".
Specification
--------------
- SoC : MediaTek MT7621AT, MIPS, 880 MHz
- RAM : 256 MiB
- Flash : NAND 128 MiB (Toshiba)
- WLAN : MT7905DAN + MT7975DN
- 2.4 GHz : b/g/n/ax, 574 Mbps, MIMO 2x2
- 5 GHz : a/n/ac/ax, 1201 Mbps, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x4 (1x WAN, 3x LAN)
- UART : 3.3V, 115200n8
- Buttons : 1x Reset
1x WPS
- LEDs : 1x Power (green)
1x WiFi (green)
1x Mesh/WPS (green); flashing green during boot
3x LAN (green)
1x WAN (green); flashing red during upgrade and failsafe
- Power : 12 VDC 1A
Installation
-------------
1. Log in to LuCI
2. Go to System, Backup / Flash Firmware
3. If desired, backup the current system by saving (all) the mtdblock
contents.
4. Flash new firmware image, select Flash image.
5. Browse and select the sysupgrade file
"openwrt-*-ramips-mt7621-edup_ep-rt2983-squashfs-sysupgrade.bin"
and then Upload.
6. Unselect "Keep settings and retain the current configuration"
Note: All settings will be reset to default. WiFi is not enabled by
default so a connection via Ethernet is necessary to log in and set up.
7. Allow "Force upgrade" (tick the box if there is one), or press Continue
if there is no box to tick. This is because the name is now
"edup,ep-rt2983" as it should have been from the start.
8. Proceed to flash. Wait for reboot and keep power connected.
9. After reboot, default address to access LuCI is 192.168.1.1 with
no password
Recovery (UART)
----------------
1. Remove the 4 screws on the bottom and pry open the cover.
2. Connect serial adapter to the unpopulated serial header pins
TX, RX, GND near the WPS button. Do not connect VCC.
3. Start serial terminal (e.g. minicom, screen, etc) on the computer and
turn on the router.
4. As prompted, hit any key to stop autoboot.
5. Enter 2 to select "2. Upgrade firmware"
6. Enter 0 to select "0 - TFTP client (Default)"
7. Accept the defaults by pressing Enter for
"Input U-Boot's IP address: 192.168.1.1",
"TFTP server's IP address: 192.168.1.2",
"Input IP netmask: 255.255.255.0"
8. Assign your PC's Ethernet port a static IP 192.168.1.2 with netmask
255.255.255.0 and connect to a LAN port on the router using the
Ethernet cable. Disconnect all other network connections (e.g. WiFi) on
the computer.
9. Serve the factory image
"openwrt-*-ramips-mt7621-edup_ep-rt2983-squashfs-factory.bin" using
a TFTP server, e.g. tftpd64. For convenience, the filename can be renamed
to something shorter.
10. In the serial terminal, when prompted "Input file name:", enter the
filename from the previous step and press Enter.
11. The factory image will be flashed as indicated. Wait for reboot.
MAC addresses prototype
------------------------
+---------+---------------------+
| | MAC example |
+---------+---------------------+
| LAN | CC:D8:1F:47:xx:yy |
| WAN | CC:D8:1F:47:xx:yy+1 |
| WLAN 2G | CC:D8:1F:17:xx:yy+2 |
| WLAN 5G | CC:D8:1F:77:xx:yy+2 |
+---------+---------------------+
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/22197
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This adds support for the Wavlink "Halo Base Pro".
SOC: MT7621DAT
RAM: 128MiB
Flash: 16MiB NOR
WiFi: MT7603EN + MT7613BEN
Buttons:
- The touch sensor was originally for WPS, but this has been moved to the
pair button which is no longer used to prevent accidental touches
LEDs:
- On original firmware, the status LEDs light up as follows:
- Purple = booting, Blue = working, Red = error
Partitions:
- factory contains unique WiFi EEPROM and default MAC addresses
- vendor partition has an unknown purpose
Stock MAC address allocation:
- LAN1: xx:xx:xx:xx:xx:80
- LAN2/WAN: xx:xx:xx:xx:xx:81
- WiFi 2.4G: xx:xx:xx:xx:xx:82
- WiFi 5G: xx:xx:xx:xx:xx:83
LAN Ports:
- lan1 is the normal white LAN port
- lan2 is labelled "LAN/Backhaul", which can either be LAN or WAN.
- Since this device is intended to be part of a mesh, this will usually
be a LAN port, hence why it's assigned to lan2 here
Notes:
- I've chosen "Halo Base Pro" as the device model, despite the website URL
showing WL-WN535M3, as the label only states "Halo Base Pro".
- Only the 5GHz WiFi address is labelled on the device
Signed-off-by: William Latter <williamlatter77@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22400
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for Z-ROUTER ZR-2662 (also known as Routerich
AX1800 V2) wireless WiFi 6 router.
Hardware specification
---------------------
- SoC : MediaTek MT7621AT, MIPS, 880 MHz
- RAM : 256 MiB
- Flash : NAND 128 MiB (AMD/Spansion S34ML01G2)
- WLAN :
- 2.4 GHz : MediaTek MT7905D/MT7975 (14c3:7916), b/g/n/ax, MIMO 2x2
- 5 GHz : MediaTek MT7915E (14c3:7915), a/n/ac/ax, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x4 (1x WAN, 3x LAN)
- USB : 1x 2.0
- UART : 3.3V, 115200n8, pins are silkscreened on the pcb
- Buttons : 1x Reset
- LEDs : 1x WiFi 2.4 GHz (green)
1x WiFi 5 GHz (green)
1x LAN (green)
1x WAN (green)
1x WAN no-internet (red)
- Power : 12 VDC, 1 A
Installation
------------
1. Run tftp server on your PC (IP: 192.168.2.2) and put OpenWrt initramfs
image (initramfs.bin) to the tftp root dir
2. Open the following link in the browser to enable telnet:
http://192.168.2.1/cgi-bin/telnet_ssh
3. Connect to the router (default IP: 192.168.2.1) using telnet shell
(credentials - user:admin)
4. Run the following commands in the telnet shell (this will install
OpenWrt initramfs image on nand flash):
cd /tmp
tftp -g -r initramfs.bin 192.168.2.2
mtd write initramfs.bin firmware
mtd erase firmware_backup
reboot
5. Copy OpenWrt sysupgrade image (sysupgrade.bin) to the /tmp dir of the
router
6. Connect to the router (IP: 192.168.1.1) using ssh shell and run
sysupgrade command:
sysupgrade -n /tmp/sysupgrade.bin
Return to stock
---------------
1. Copy stock firmware (stock.bin) to the /tmp dir of the router using scp
2. Run following command in the router shell:
cd /tmp
mtd write stock.bin firmware
reboot
Recovery
--------
Connect uart (pins are silkscreened on the pcb), interrupt boot process by
pressing any key, use u-boot menu to flash stock firmware image or OpenWrt
initramfs image.
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 24:0f:5e:xx:xx:4c | label |
| WAN | 24:0f:5e:xx:xx:4d | label+1 |
| WLAN 2g | 24:0f:5e:xx:xx:4e | label+2 |
| WLAN 5g | 24:0f:5e:xx:xx:4f | label+3 |
+---------+-------------------+-----------+
The WLAN 2.4 MAC was found in 'factory', 0x4
The LAN MAC was found in 'factory', 0xfff4
The WAN MAC was found in 'factory', 0xfffa
Note: This device is similar to Z-ROUTER ZR-2660, but with minor hardware
revisions. The firmware and configuration are compatible.
Signed-off-by: xingchi <juncaixingchi2026@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21524
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware:
- SoC: MediaTek MT7628AN (MIPS 580MHz)
- Flash: 16 MiB NOR
- RAM: 64 MiB DDR2
- WLAN: 2.4 GHz (MT7628)
- Ethernet: 1x 10/100 Mbps WAN/LAN, 1x 10/100 LAN (MT7628)
- Build-in LTE Modem: MeigLink SLM770A
4G Cat. 4 (150/50 Mbps)
- Buttons: 1x Reset, 1x wps
- LEDs: Front: 1x Red, 1x White,
Back: 3x White 4G signal strengh
- Serial console: unpopulated header, 115200 8n1
- Power: USB-C
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| WAN | 80:af:ca:xx:xx:x1 | label+1 |
| LAN | 80:af:ca:xx:xx:x0 | label |
| WLAN 2g | 80:af:ca:xx:xx:x2 | label+2 |
+---------+-------------------+-----------+
Migration to OpenWrt:
- Download the RSA signed intermediate firmware from the Cudy website:
`openwrt-ramips-mt76x8-cudy_lt300-v3-squashfs-flash.bin`
- Connect computer to LAN and flash the intermediate firmware via OEM web interface
- OpenWrt is now accessible via 192.168.1.1
Revert back to OEM firmware:
- Set up a TFTP server on IP 192.168.1.88 and connect to the WAN port (upper port)
- Provide the Cudy firmware as recovery.bin in the TFTP server
- Press the reset button while powering on the device
- Recovery process is started now
- When recovery process is done, OEM firmware is accessible via 192.168.10.1 again
General information:
- No possibility to load a initramfs image via U-Boot because there is no option to interrupt U-Boot
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21982
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Mikrotik RBM33G has got a USB-A port and mPCIe slots with USB 3.0 and USB
2.0 interfaces in use. The MediaTek MT7621 SoC has got an xHCI to provide
these interfaces. Therefore, enable kmod-usb3 to support them.
Fixes: 5684d08741 ("ramips: Add support for Mikrotik RouterBOARD RBM33g")
Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
The D-Link DIR-1360 A1 is an AC1300 router based on the MT7621AT SoC.
Specifications :-
* SoC: MediaTek MT7621AT
* RAM: 256 MB DDR3
* Flash: 128 MB SPI NAND (Winbond W29N01HV)
* WiFi: MT7615D (2.4 GHz + 5 GHz DBDC)
* Ethernet: 5x 10/100/1000 Mbps (1x WAN, 4x LAN)
* USB: 1x USB 3.0
* Buttons: Reset, WPS
* LEDs: Power (White/Orange), Internet (White/Orange), USB, 2.4G/5G WLAN
MAC addresses are retrieved from the 'factory' partition via NVMEM.
LAN: 0xe000 (gmac0)
WAN: 0xe006 (gmac1)
WLAN: 0xe00c (pcie0)
Flash Instruction :-
1-Set a static IP on your PC (e.g., 192.168.0.10, Gateway 192.168.0.1).
2- Power off the router and connect your PC to a LAN port.
3- Hold the Reset button and power on the router; continue holding for 5 seconds.
4- Access the Recovery UI at http://192.168.0.1 in your browser.
5- Upload the OpenWrt factory.bin image and wait for the reboot.
With these definitions in place, the DIR-1360 A1 boots reliably, exposes all hardware features correctly, and can be flashed via both the OEM recovery interface and standard OpenWrt upgrade paths.
Signed-off-by: Aryaman Srivastava <aryamansrivastava895@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21616
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for the Cudy LT400E v1,
an indoor 4G/LTE WiFi router.
It has 4x10/100 Mbps Ethernet ports, a 2.4 GHz radio,
and a Quectel 4G/LTE EC200A modem.
Hardware:
SoC: MediaTek MT7628NN
Flash: 8 MiB SPI
RAM: 64 MiB
Ethernet: 4x10/100 Mbps
WiFi: 2.4 GHz (embedded MT7628, 802.11n)
WWAN: Quectel EC200A-EL 4G/LTE Cat 4 modem
SIM: nano-SIM slot
Buttons: 1 Reset button, 1 WPS button
LEDs: 10x (blue)
Power: 12 V DC barrel jack
Installation:
The stock firmware is a customized variant of OpenWrt, which implements
a signature check that only allows flashing official firmware. Cudy
offers, on their website [1][6], intermediate OpenWrt firmware images
which do not implement the signature check. After flashing the
intermediate image, the upstream (i.e., official) OpenWrt image can be
installed. See the device's entry in OpenWrt's Wiki for more details [2].
Cellular network:
The Quectel EC200A modem is internally connected to the SoC via USB, and
operates in ECM mode, supported by the CDC Ether driver [3]. When
inserting a SIM card in the slot, if no PIN is needed, the network
interface "usb0" is brought up and the cellular connection works out of
the box. To interact with the modem directly (unlock the PIN, change APN
and PDP settings, etc.), AT commands can be sent with picocom to serial
port /dev/ttyUSB2 [4].
Recovery:
The stock firmware can be recovered via TFTP, as the bootloader (based
on U-Boot) implements a recovery client. Set up a TFTP server on your
computer with IP 192.168.88.1/24 serving the stock firmware from Cudy's
website renamed to "recovery.bin". Press the Reset button (keep it
pressed), power on the device, wait for the TFTP server to send the
recovery.bin file, then release the Reset button. The router will take a
couple of minutes to reboot and set up the stock firmware. See the
device's entry in OpenWrt's Wiki for more details [2].
Discussion:
Use the dedicated thread in OpenWrt's forum to discuss any aspects [5].
Acknowledgments:
The code to support this device is largely based on the sources kindly
provided by Cudy in compliance with the GPL license. Thanks for
supporting the OpenWrt community.
Links:
[1] https://www.cudy.com/blogs/faq/openwrt-software-download
[2] https://openwrt.org/toh/cudy/lt400e_v1
[3] https://openwrt.org/docs/guide-user/network/wan/wwan/ethernetoverusb_cdc
[4] https://openwrt.org/docs/guide-user/network/wan/wwan/at_commands
[5] https://forum.openwrt.org/t/242466
[6] https://drive.google.com/drive/folders/1BKVarlwlNxf7uJUtRhuMGUqeCa5KpMnj
Co-authored-by: rogerpueyo <roger.pueyo@guifi.net>
Signed-off-by: Kamil Jońca <kjonca@onet.pl>
Link: https://github.com/openwrt/openwrt/pull/21246
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for the Teltonika RUT976, part
of the RUTE series, which is very similar to the RUT956.
The RUT976 now has a 5G modem and the flash size has doubled.
Specification:
- MediaTek MT7628AN SoC
- 128 MB RAM
- 32MB Flash
- 4x 10/100 Mbps Ethernet, with passive PoE support on LAN1
- MediaTek MT7628AN 2.4 GHz 802.11n WiFi
- Quectel RG255C 5G modem
- GNSS
- RS232, DB9 connector, Cypress ACM via USB, /dev/ttyACM0
- RS485 /dev/ttyS1
- microSD card slot
- 2.0 USB Type-A HOST port
- analog 0-24V input (MCP3221)
- Relay
- 2x Digital input
- 2x Digital output
- 2x SIM slot (can be swapped via GPIO)
- eSIM (depends on hardware configuration, can be swapped via GPIO)
GPIO:
- 1 button (Reset)
- 7 LEDs (power, status green/red, RSSI 1,2,3,4,5)
- 5 Modem control (power button, reset, status, SIM select, eSIM select)
- 2 Digital input
- 2 Digital output
- 1 Isolated input
- 1 RS485 tx enable
- 1 RS485 rx enable
- 1 Relay
- 1 Data Carrier Detect (DCD)
Flashing via OEM WebUI:
1. Download the firmware image *-squashfs-factory.bin
2. Upload firmware image via OEM WebUI firmware update, do not keep settings
To revert back to OEM firmware:
https://wiki.teltonika-networks.com/view/Bootloader_menu
Mobile data connection:
Create proto qmi interface.
Signed-off-by: Til Kaiser <mail@tk154.de>
Link: https://github.com/openwrt/openwrt/pull/20933
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is an industrial 4G router equipped with OpenWrt SNAPSHOT OEM
customized version
WARNING: The original firmware device tree is modified from evb
boards, and the device tree name is evb board. This submitted device
tree is a modified version, which deletes the non-this-device parts
and adds GPIO watchdog.
Specification:
- SoC: MediaTek MT7628DAN
- Flash: 16 MB
- RAM: 64 MB
- Power: DC 5V-36V 1.5A
- Ethernet: 1x WAN/LAN, 3x LAN (10/100 Mbps)
- Wireless radio: 802.11n 2.4g-only
- LED:
System/Power (PWR): Always Off
Modem (NET): GPIO/3 active-low
LAN: Always On
RF (Modem Signal): GPIO/2 active-low
WIFI: GPIO/44 active-low
- Button:
WPS / RESET: GPIO/11 active-low
- UART: 1x UART on PCB - 115200 8N1
- GPIO Watchdog: GPIO/0 mode=toggle timeout=1s
- Modem: 1x Built-in modem on board (Power: GPIO/4 active-high)
- SIM Slots: 1x SIM Slots
Issue:
- Factory partition not store mac address on original firmware
Flash instruction:
Using TTL:
1. Connect the board to the computer via TTL.
2. Enter original firmware failsafe mode.
3. Use wget download firmware to board /tmp
4. Use command "mtd -r write openwrt-ramips-mt76x8-hongdian_h8850-v20-squashfs-sysupgrade.bin firmware"
to flash
Original Firmware Dump / More details:
https://blog.gov.cooking/archives/research-hongdian-h8850-v20-and-flash.html
Signed-off-by: Coia Prant <coiaprant@gmail.com>
Tested-by: Coia Prant <coiaprant@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20259
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This patch adds support for D-Link DIR-2660 A2.
Based on the commit: https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=b5dd746cbb1aaf91f4b68e9f3eda97413550d904,
Both devices look identical, except for the A1/A2 designation.
You can safely install the A1 firmware for the A2 – I've been testing it for several months as a DUMB AP – without any problems.
Specifications:
* SoC: MediaTek MT7621AT
* RAM: 256 MB (DDR3)
* Flash: 128 MB (NAND)
* WiFi: MediaTek MT7615N (x2)
* Switch: 1 WAN, 4 LAN (Gigabit)
* Ports: 1 USB 2.0, 1 USB 3.0
* Buttons: Reset, WPS
* LEDs: Power (white/orange), Internet (white/orange), WiFi 2.4G (white),
WiFi 5G (white), USB 3.0 (white), USB 2.0 (white)
Notes:
* WiFi 2.4G and WiFi 5G LEDs are wired directly to the wireless chips
Installation:
* D-Link Recovery GUI: power down the router, press and hold the reset
button, then re-plug it. Keep the reset button pressed until the power
LED starts flashing orange, manually assign a static IP address under
the 192.168.0.xxx subnet (e.g. 192.168.0.2) and go to http://192.168.0.1
* Some modern browsers may have problems flashing via the Recovery GUI,
if that occurs consider uploading the firmware through cURL:
curl -v -i -F "firmware=@file.bin" 192.168.0.1
Signed-off-by: Marcin Leksmark <lexmark3200@wp.pl>
Link: https://github.com/openwrt/openwrt/pull/20020
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
According to the TP-Link websites the Archer C50 v6 EU is the same model
as the Archer A5 v6 EU. Installation method is the same as the C50 v6, as
they are basically the same hardware.
The commit is based on e9ac1b1.
Signed-off-by: David Senoner <seda18@rolmail.net>
After investigating the EAP235-Wall u-boot GPL code, it was found that
the u-boot of this device directly loads the kernel from the SPI NOR
Flash direct access address. However, due to hardware limitation, MT7621
can only remap the first 4MiB Flash. Excluding some partitions before
the kernel, this device can only boot kernels smaller than 0x360000.
This means that unless you install a modified bootloader, the mainline
OpenWrt will no longer work on this model.
Closes: https://github.com/openwrt/openwrt/issues/20500
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/20509
Signed-off-by: Robert Marko <robimarko@gmail.com>
EDUP EP-RT2960S has the similar hardware design as the SIMAX1800T.
The main difference is the arrangement of the GPIO pins
and the location of the MAC address.
Specification
-------------
- SoC : Mediatek MT7621
- RAM : 256 MiB DDR3
- Flash : 128 MiB NAND Flash
- WLAN : Mediatek MT7905 DBDC
- 2.4 GHz : 2x2 MIMO WiFi6
- 5 GHz : 2x2 MIMO WiFi6
- Ethernet : MT7621 built-in 10/100/1000 Mbps 1x WAN; 3x LAN
- UART : 3.3V, 115200n8
- Buttons : 1x RESET; 1x WPS/MESH
- LEDs : 1x Multi-Color(Blue;Green;Red)
- Power : DC 12V1A
- CMIIT ID : 2022AP7163
- TFTP IP :
- server : 192.168.1.254
- router : 192.168.1.28
TFTP Installation(recommend)
------------
1. Set local tftp server IP "192.168.1.254" and NetMask "255.255.255.0".
2. Rename initramfs-kernel.bin to "factory.bin" and put it in the root
directory of the tftp server. tftpd64 is a good choice for Windows.
3. Remove all Ethernet cables and WiFi connections from the PC, except
for the one connected to the EDUP EP-RT2960S. Start the TFTP server, plug
in the power adapter and wait for the OpenWrt system to boot.
4. Backup "firmware" partition and rename it to "firmware.bin". We need
it to back to the stock firmware.
5. Use "fw_printenv" command to list envs. If "firmware_select=2" is
observed then set u-boot env variable via command:
`fw_setenv firmware_select 1`
6. Apply sysupgrade.bin in OpenWrt LuCI.
Web UI Installation
------------
1. Apply update by uploading initramfs-factory.bin to the web UI.
2. Use "fw_printenv" command to list envs. If "firmware_select=2" is
observed then set u-boot env variable via command:
`fw_setenv firmware_select 1`
3. Apply squashfs-sysupgrade.bin in OpenWrt LuCI.
Return to Stock Firmware
----------------------------
Restore the backup firmware partition in the installation step 4.
MAC addresses
-------------
+---------+-------------------+
| | MAC example |
+---------+-------------------+
| LABEL | 24:D5:1C:xx:xx:xx |
| LAN | 24:D5:1C:xx:xx:xx |
| WAN | 24:D5:1C:xx:xx:xx |
| WLAN2G | 24:D5:1C:xx:xx:xx |
| WLAN5G | 26:D5:1C:xx:xx:xx |
+---------+-------------------+
Tips:
-----------
User can use `TFTP Installation` method to recover a brick device.
Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20600
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This PR fixes support for Cudy r700.
Original PR: https://github.com/openwrt/openwrt/pull/18532
Fixed:
- WAN port functionality;
- RESET button;
- Status LED;
- LAN port names consistent with the chassis;
- Merged partitions "debug", "backup" & "firmware" to one partition "firmware" ("debug" & "backup" contained unimportant data);
- Removed redundant DTS elements.
Installation:
To install OpenWRT, you need the intermediate firmware from Cudy. (U-boot is locked). After installing the intermediate firmware, you can install OpenWRT via sysupgrade.
Recovery:
TFTP available.
1. Place the recovery.bin in the serving directory of your TFTP server.
2. Set your IP to 192.168.1.88/24.
3. Press the “Reset” button of Cudy router and hold it. Before the Cudy router is powered on and before TFTP start to download the firmware, don't release the “Reset” button.
4. Power on the Cudy router.
5. You can release the reset button only when TFTP starts downloading firmware.
6. When the SYSTEM LED turns solid green, the upgrade is complete.
Fixes: 75403dd1d0 ("ramips: add support for Cudy R700")
Signed-off-by: Marcin Leksmark <lexmark3200@wp.pl>
Link: https://github.com/openwrt/openwrt/pull/20756
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware:
- SoC: MediaTek MT7621DAT
- Flash: 16 MiB XM25QH128C
- RAM: 128 MiB
- WLAN: 2.4 GHz (MT7603E, 11n), 5 GHz (MediaTek MT7613BEN, 11ac)
- Ethernet: 1x10/100/1000 Mbps LAN
- Buttons: 1 Reset button, 1 WPS button
- LEDs: 5x Green
- Serial Console: unpopulated header 115200 8n1 (silkscreen on PCB)
- Power: POE 802.3af (37-57V DC)
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 80:af:ca:xx:xx:x0 | label |
| WLAN 2g | 80:af:ca:xx:xx:x0 | label |
| WLAN 5g | 82:af:ca:xx:xx:x1 | +1 |
+---------+-------------------+-----------+
Installation:
The factory firmware is locked: you can only work with Cudy signed firmware.
Download a intermediate firmware signed by Cudy here:
https://www.cudy.com/blogs/faq/openwrt-software-download
After that, login to the router (192.168.10.254, password "admin") and install the intermediate firmware.
If you can reach LuCI or SSH now on the intermediate firmware, just use the sysupgrade image with the 'Keep settings' option turned off.
Special thanks to Daniel de Kock for starting the porting work at #16265.
Signed-off-by: Luis Mita <luis@luismita.com>
Co-Authored-By: Daniel de Kock <daniel@riot.network>
Co-Authored-By: Hauke Mehrtens <hauke@hauke-m.de>
Link: https://github.com/openwrt/openwrt/pull/20268
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Paul Spooren
Ryan Leung
Grische
Denis Faizullin
Daniel Golle
Shiji Yang
John Crispin
Carlo Szelinsky
Charles Joynson
Andrej Valek
Vincenzo Suraci
rodriguezst
YAJIMA Hideyuki
Fabian Groffen
Gunther Stammwitz
Mateusz Jończyk
Taiga Ogawa
Fil Dunsky
Simonas Tamošaitis
librarat876
Matt Brent
Hiroki Utsunomiya
Ivan Davydov
William Latter
xingchi
Chester A. Unal
Aryaman Srivastava
Miguel Fuertes
Kamil Jońcaandrogerpueyo
Marcin Leksmark
Andrew LaMarche
Til Kaiser
Coia Prant
Myoung Ha, Ji
David Senoner
Andrii Kuiukoff
