Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 64GB eMMC or 128 MB SPI-NAND
RAM: 512MB DDR3 or DDR4
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, Mesh
Power: DC 12V 1A
Gain SSH access:
1. Login into web interface, and download the configuration.
2. Get the SN of the device from web interface or the label on the back of the device.
3. Calculate configuration decryption password:
Command "eval" is necessary here as the encryption implentation treats '$...' as (empty) variables.
decpwd="$(eval echo $(openssl passwd -1 -salt aV6dW8bD "your_device_sn"))"
4. Decrypt the configuration:
openssl aes-256-cbc -d -pbkdf2 -k "$decpwd" -in cfg_export_config_file.conf -out cfg_export_config_file.conf.dec
5. Enter fakeroot, decompress the configuration:
tar -zxf cfg_export_config_file.conf.dec
6. Edit 'etc/shadow', update (remove) root password: 'root::19179:0:99999:7:::'
7. Edit 'etc/rc.local', insert telnetd command before 'exit 0':
( sleep 3s; telnetd; ) &
8. Repack the configuration:
tar -zc etc/ | openssl aes-256-cbc -pbkdf2 -k "$decpwd" -out cfg_export_config_file.conf
* If you find an error about 'etc/wireless/mediatek/DBDC_card0.dat',
just ignore it.
9. Upload new configuration via web interface, now you can connect to
CMCC RAX3000Me via telnet.
(Big thanks to https://github.com/lyq1996 who reverse engineered the encryption method)
Check flash type:
If '/dev/mmcblk0' exists on the device, it's eMMC version.
If '/dev/mtd0' exists on the device, it's NAND version.
eMMC Flash instructions:
1. Connect to RAX3000Me, and backup everything, especially 'factory' part.
('data' partition can be ignored, it's useless.)
2. Write new GPT table:
dd if=immortalwrt-mediatek-filogic-cmcc_rax3000me-emmc-gpt.bin of=/dev/mmcblk0 bs=512 seek=0 count=34 conv=fsync
3. Write new BL2:
echo 0 > /sys/block/mmcblk0boot0/force_ro
dd if=immortalwrt-mediatek-filogic-cmcc_rax3000me-emmc-preloader.bin of=/dev/mmcblk0boot0 bs=512 conv=fsync
4. Write new FIP:
dd if=immortalwrt-mediatek-filogic-cmcc_rax3000me-emmc-bl31-uboot.fip of=/dev/mmcblk0 bs=512 seek=13312 conv=fsync
5. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
6. Serve ImmortalWrt initramfs image using TFTP server.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After ImmortalWrt has booted, perform sysupgrade.
NAND Flash instructions:
1. Connect to RAX3000Me, and backup everything, especially 'Factory' part.
2. Write new BL2 and FIP:
If your device HAS USB port, run:
mtd write immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr3-preloader.bin BL2
mtd write immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr3-bl31-uboot.fip FIP
If your device DOES NOT have USB port, run:
mtd write immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr4-preloader.bin BL2
mtd write immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr4-bl31-uboot.fip FIP
4. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
5. Serve ImmortalWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After ImmortalWrt has booted, perform sysupgrade.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 57f31cd5b11cb7e590c330845ec74ffa2d6eb13e)
I selected one subtarget after the other and refreshed their
configuration using this command:
make kernel_oldconfig CONFIG_TARGET=subtarget
For MT7629 I had to re-add CONFIG_LEDS_SMARTRG_LED manually.
Otherwise, building MT7629 with ALL_KMODS we get prompted for
LEDS_SMARTRG_LED and this will break CI and in future buildbot
compilation. See commit 6bdea8c7bd ("mediatek: mt7629: 6.6: disable
LEDS_SMARTRG_LED by default") for more details.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Link: https://github.com/openwrt/openwrt/pull/18182
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 5013efc4f907550fadbf15e2fb1bdb2ead3325db)
Specification:
* Mediatek MT7981BA
* 256 MB SPI-NAND
* 512 MB DDR4 RAM
* MT7976CN DBDC AX Wi-Fi
* MediaTek MT7531AE (3x LAN Gigabit ports) + Internal Gbe Phy (1x WAN Gigabit port)
* 4x LED (power, internet, fn, wifi)
* 3x buttons (wps, fn, reset)
* 1x USB 3.0 port
Serial Interface:
* 3 Pins GND, RX, TX
* Settings: 115200, 8N1
Notes:
* The device supports dual boot mode
* Fn led reassigned to wlan 2.4
Flash instruction:
The only way to flash OpenWrt image is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24 and tftp server.
2. Rename "openwrt-mediatek-filogic-keenetic_kn-3811-squashfs-factory.bin"
to "KN-3811_recovery.bin" and place it in tftp server directory.
3. Connect PC with ethernet port, press the reset button, power up
the device and keep button pressed until status led start blinking.
4. Device will download file from server, write it to flash and reboot.
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17135
(cherry picked from commit d087a79b7b)
Link: https://github.com/openwrt/openwrt/pull/18055
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
- MT7981 CPU using 2.4GHz and 5GHz WiFi (both AX)
- 512MB RAM
- 128MB SPI NAND
- 2 LEDs (green, orange)
- 3 buttons (fn, reset, wps)
- 2 2.5Gbit ethernet ports based on Airoha EN8811H phy
Serial Interface:
- 3 Pins GND, RX, TX
- Settings: 115200, 8N1
Notes:
- The device supports dual boot mode
Flash instruction:
The only way to flash OpenWrt image is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24 and tftp server.
2. Rename "openwrt-mediatek-filogic-keenetic_kn-3911-squashfs-factory.bin"
to "KN-3911_recovery.bin" and place it in tftp server directory.
3. Connect PC with ethernet port, press the reset button, power up
the device and keep button pressed until status led start blinking.
4. Device will download file from server, write it to flash and reboot.
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16830
(cherry picked from commit 5a4eb56a7b)
Link: https://github.com/openwrt/openwrt/pull/18055
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
cmcc_a10-ubootmod stands for custom U-Boot layout in ImmortalWrt 23.05,
add compat version to avoid bricking devices. For 24.10+ users you can
just ignore the compat warning.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 4b000293b2)
This board is also as known as SuperElectron ZN-M5 and ZN-M8. However,
for ZN-M5 and ZN-M8, there's another version uses ZX279128 as CPU
chip, which is unsupported.
You can check it in "高级设置" > "系统日志" > "内核日志" page from webUI.
Stock layout flash instructions:
Login into webUI and upload sysupgrade firmware in "系统管理" > "升级固件" page.
Remember to unselect "保留配置" ("Keep configurations") first before doing that.
OpenWrt U-Boot layout flash instructions:
1. Flash stock layout firmware first.
2. Connect to the device via SSH, and backup everything,
especially 'Factory' partition.
3. Unlock MTD partitions:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
4. Write new BL2 and FIP:
mtd write immortalwrt-mediatek-filogic-cmcc_a10-ubootmod-preloader.bin BL2
mtd write immortalwrt-mediatek-filogic-cmcc_a10-ubootmod-bl31-uboot.fip FIP
5. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
6. Serve ImmortalWrt initramfs image using TFTP server.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After ImmortalWrt has booted, perform sysupgrade.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 4e9240e733)
Apply "u-boot-dont-touch-spi-nand" to ASUS RT-AX59U, ASUS TUF-AX4200 as
well as ASUS TUF-AX6000 routers to prevent U-Boot from wiping MTD
child nodes from DT.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 4387de9445)
ASUS makes use of U-Boot's fdt_fixup_mtdparts() function which applies
the partitions defined in U-Boot's mtdparts and mtdids environment
variables to the devicetree passed over to Linux.
The undesired side-effect is that in this way also all additional
properties and child nodes get wiped, preventing NVMEM cells to be
defined for MTD partitions or UBI volumes.
To work-around this issue, add an additional compatible string
'u-boot-dont-touch-spi-nand' which can be used instead of 'spi-nand' in
case the replacement of the MTD partitions by U-Boot should be skipped
alltogether.
In practise this is mostly relevant for SPI-NAND which anyway comes only
with two partitions nowadays: 'Bootloader' and 'UBI_DEV'. Hence this
work-around is applicable for SPI-NAND only. Similar work-arounds for
other MTD devices can be created as well should they actually be needed.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit c48afca32c)
This commit fixes nmbm configuration mismatch error on Xiaomi AX3000t
with Winbond W25N01KVZEIR spi-nand:
'''
[ 0.786783] NMBM configuration mismatch
'''
Root cause:
1. U-Boot W25N01KV spi-nand driver ia compiled with 64B OOB size for the
chip and store this size in the nmbm signature;
2. Linux W25N01KV driver use 96B OOB.
The change doesn't affect AX3000t variants with other spi-nand chips
(ESMT, Foresee) because their Linux drivers use 64B OOB.
Fixes: openwrt#16972
Tested-by: Aleksandr Danilov <sc16me@gmail.com>
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17549
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 3299d19c01)
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17898
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Two commits which made their way into Linux stable broke the SATA
support on the BPi-R64.
Fix this by reverting a node rename which broke DT-overlay application
and import a (still pending) patch re-adding the 'syscon' compatible to
the pciesys clock-controller which also contains phy-mode bits
referenced by the ahci_mtk driver expecting to access them using
syscon_regmap_lookup_by_phandle().
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 69890e16b3)
Fixed interrupt support for 2.5G PHY.
Removed useless phy-mode on phy node.
Tested on Cudy TR3000.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
(cherry picked from commit 82b69dfaf6)
Same as commit 3674689, correct 'buswidth' to 'bus-width'.
Move the nmbm properties outside the partition definition.
Change uppercase to lowercase, add missing read-only flag.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
(cherry picked from commit ab375a3484)
the wifi leds of the wax206 were not reacting.
This patch enables the green leds to show activity, as the blue ones are very bright.
Also set the label-mac to the gmac0
Signed-off-by: Florian Maurer <f.maurer@outlook.de>
Link: https://github.com/openwrt/openwrt/pull/17694
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 9ada8578fd)
This commit fixes Xiaomi AX3000t soft bricks. Issue affects at least rd23
model (Global version) users:
Link: https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000t/180490/452
I also found that these nvram settings are wrong for the rd23 model and
U-Boot erase them:
'''
flag_try_sys1_failed 8
flag_try_sys2_failed 8
'''
As a result, platform.sh -> xiaomi_initial_setup() function sometimes ends
early without applying settings for the rd23 model.
RD03 model strategy:
1. Don't touch values those were set up by platform.sh ->
xiaomi_initial_setup() function
RD23 model strategy:
1. Apply correct nvram settings at every boot
2. Use bulk fw_setenv call
I didn't find opened issue for AX3000t. Similar AX3200 issue:
Link: https://github.com/openwrt/openwrt/issues/16347
So, other Xiaomi devices (e.g. Xiaomi WR30U) may also require fix.
Fixes: 7dbcc1215a ("mediatek: filogic: add support for Xiaomi AX3000T")
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17580
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 42a253c7e8)
Define EX5601-T1 and T-56 as alternative name, to explicitly show
the device is supported using existing image. EX5601-T1 does not
have the option to switch between WAN/SFP port. The switch port
is hardwired to the WAN port. The Zyxel T-56 is the odido-branded
version of the EX5601-T1.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Link: https://github.com/openwrt/openwrt/pull/17615
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 3d63a41ffa)
This allows us to use the full size of nand, which increases ubi size
from 64M to 122.25M.
If you are at factory firmware, please refer commit 63b8d98dd0 ("mediatek: add support for Cudy TR3000 v1")
to boot into OpenWrt initramfs (stock layout version).
Flash instructions:
1. Login into the device and backup everything, especially 'Factory' part.
1. Unlock mtd partitions:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
3. Write new BL2 and FIP
mtd write openwrt-mediatek-filogic-cudy_tr3000-v1-ubootmod-preloader.bin BL2
mtd write openwrt-mediatek-filogic-cudy_tr3000-v1-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
5. Serve OpenWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After OpenWrt has booted, perform sysupgrade.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 51272fcd00)
The Huasifei WH3000 eMMC model (aka Fudy MT3000) is a Wi-Fi 6 5G
cellular router based on MediaTek MT7981A SoC.
Specifications:
SoC: Filogic 820 MT7981A (1.3GHz)
RAM: DDR4 1GB
Flash: eMMC 8G
WiFi: 2.4GHz and 5GHz with 3 antennas
Ethernet:
1x WAN (10/100/1000M)
1x LAN (10/100/1000/2500M)
USB: 1x USB 3.0 port
UART: 3.3V, TX, RX, GND / 115200 8N1
Installation via U-Boot rescue:
Connect to the GbE eth port, then press and hold reset button while
booting the device. Wait for the Internet led to blink 5 times,
release reset button. The rescue page is accessible via http://192.168.1.1
Select the OpenWrt sysupgrade image and start upgrade.
Wait for the router to flash new firmware and reboot.
(cherry picked from commit f310b8c74e)
Hardware:
SoC: MT7981b
RAM: 512 MB
Flash: 256 MB SPI NAND
Ethernet:
1x2.5Gbps (rtl8221b)
WiFi: 2x2 MT7981
Button: Reset
LED: 1x multicolor
Installation
------------
At the moment, firmware installation is only possible via a transition firmware.
It's can be requested from the manufacturer by email to support@cudy.com
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17225
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 6992d6e51a)
I think I implemented the U-Boot handling incorrectly on M30 (saw the issue while porting M60 to OpenWrt). Maybe someone with more U-Boot experience can have a look at it.
What I understood until now:
Before flashing, `sw_tryactive` must be set to 0 because OpenWrt runs on partition 0
During reset after flashing, U-Boot executes the following line:
`boot_rd_auto_sw_img=if itest.s ${sw_tryactive} == 2; then run boot_by_part; else run boot_by_tryactive; fi`
As `sw_tryactive` was set to 0 before flashing, `boot_by_tryactive` will be executed:
`boot_by_tryactive=if itest.s ${sw_tryactive} == 0; then setenv sw_tryactive 2; setenv sw_active 1; saveenv; run ub0; else setenv sw_tryactive 2; setenv sw_active 2; saveenv; run ub1; fi`
As `sw_tryactive` was set to 0 before flashing, `sw_active` will be set to 1 and `ub0` will be executed:
`ub0=setenv bootpart 0; mtkboardboot; run ub0to1; uip main; reset`
If the OpenWrt boot is successful, `ub0to1` and `uip` main will never be executed. Only in case OpenWrt cannot be loaded, `mtkboardboot` will return and the fallback `ub0to1` is executed.
Conclusion: It's sufficient to set `sw_tryacitve` to 0 before flashing, the added code in `target/linux/mediatek/filogic/base-files/etc/init.d/bootcount` is useless.
In the worst case (/proc/cmdline doesn't contain `bootpart=ubi0` as expected), the bootpart variable would be set to 1 and causes starting the firmware from the second partition instead of the one on the first partition.
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17298
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 70610a5240)
