This commit adds support for netis EAP930 V1 ceiling access point.
Specification
-------------
- SoC : MediaTek MT7981BA dual-core ARM Cortex-A53 1.3 GHz
- RAM : 256 MiB DDR3 (ESMT M15T2G16128A-EFB)
- Flash : SPI-NAND 128 MiB (ESMT F50L1G41LB-104)
- WLAN : MediaTek MT7976CN dual-band WiFi 6
- 2.4 GHz : b/g/n/ax, MIMO 2x2
- 5 GHz : a/n/ac/ax, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x1 (SoC internal phy)
- USB : No
- Buttons : Reset
- LEDs : 1x Status (red), gpio-controlled
1x Status (blue), gpio-controlled
- Power : 48 VDC (PoE) or 12 VDC, 1.5 A
Installation
------------
1. Connect to the access point using ssh (user: admin, pass: web interface
password)
2. Make mtd backup:
cat /dev/mtd0 | gzip -1 -c > /tmp/mtd0_spi0.0.bin.gz
cat /dev/mtd1 | gzip -1 -c > /tmp/mtd1_BL2.bin.gz
cat /dev/mtd2 | gzip -1 -c > /tmp/mtd2_u-boot-env.bin.gz
cat /dev/mtd3 | gzip -1 -c > /tmp/mtd3_Factory.bin.gz
cat /dev/mtd4 | gzip -1 -c > /tmp/mtd4_FIP.bin.gz
cat /dev/mtd5 | gzip -1 -c > /tmp/mtd5_ubi.bin.gz
3. Download mtd backup from the /tmp dir of the router to your PC using
scp protocol
4. Upload OpenWrt 'bl31-uboot.fip', 'preloader.bin' images to the /tmp
dir of the router using scp protocol
5. Write FIP and BL2 (replace bootloader):
mtd write /tmp/bl31-uboot.fip FIP
mtd write /tmp/preloader.bin spi0.0
6. Place OpenWrt
'openwrt-mediatek-filogic-netis_eap930-v1-initramfs-recovery.itb' image
on the tftp server (IP: 192.168.1.254)
7. Erase 'ubi' partition and reboot the router:
mtd erase ubi
reboot
8. U-Boot automatically boot OpenWrt recovery image from tftp server to
the RAM (1 Gbps link is required)
9. Upload OpenWrt 'sysupgrade.itb' image to the /tmp dir of the router
(IP: 192.168.1.1) using scp protocol
10. Connect to the router using ssh and run:
sysupgrade -n squashfs-sysupgrade.itb
Recovery
--------
1. Place OpenWrt
'openwrt-mediatek-filogic-netis_eap930-v1-initramfs-recovery.itb' image
on the tftp server (IP: 192.168.1.254)
2. Press Reset button and power on the router. After ~10 sec release
the button.
3. Use OpenWrt initramfs system for recovery
Return to stock
---------------
1. Upload stock BL2, FIP, ubi partitions backup archives to the /tmp dir
of the router using scp protocol
2. Connect to the router using ssh and run:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd unlock BL2
mtd unlock FIP
4. Restore backups:
zcat /tmp/mtd1_BL2.bin.gz | mtd write - BL2
zcat /tmp/mtd4_FIP.bin.gz | mtd write - FIP
zcat /tmp/mtd5_ubi.bin.gz | mtd write - ubi
3. Reboot the router:
reboot
UART
----
Connection parameters: 115200, 8N1, 3.3V
UART pins are silkscreened on the PCB.
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 88:xx:xx:88:xx:d3 | label |
| WLAN 2g | 88:xx:xx:18:xx:d4 | |
| WLAN 5g | 88:xx:xx:78:xx:d4 | |
+---------+-------------------+-----------+
The LAN MAC (hex) was found in 'Factory', 0x1fef20
The WLAN 2g/5g MAC prototype (hex) was found in 'Factory', 0x4
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23133
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specifications:
SoC: MediaTek MT7988A (4 cores)
RAM: 1024MiB
Flash: Winbond SPI-NAND 128 MiB
Network: 1 WAN (2.5G), 3 LAN (1G), 1 SFP+ (10G)
2 SIM slots
Buttons: Reset, WPS
Power: DC 12V 3A (Recommend 19V to avoid voltage drop)
WiFi: MT7996 2.4Ghz, 5.8Ghz and 6Ghz (BE19000)
- 2.4Ghz and 5.8Ghz share same dual band antenna (4)
- 6Ghz uses dedicated 6G antenna (4)
Misc: 1 USB2.0 port, UART header
Installation:
A. Through U-Boot menu:
- Prepare your connecting computer to use a static IP in
network 192.168.1.0/24
- Power down the router and hold in the Reset button.
- While holding in the button power up the router again.
- Hold the button in for 10 seconds and then release.
- Use your browser to go to 192.168.1.1
- If you see a GUI allowing for flashing firmware then
you got the right model.
- Upload the sysupgrade file.
Note 1: Recovery GUI can be used to recover from an incorrect
firmware flash.
Note 2: There is a GPIO watchdog that expires after 2 minutes
so flashing sysupgrade via U-boot needs to be done
quickly within that timer.
B. Through OpenWrt Dashboard:
If your router comes with OpenWrt preinstalled
(modified by the seller), you can easily upgrade
by going to the dashboard (192.168.1.1) and then
navigate to System -> Backup/Flash firmware,
then flash the firmware
MAC Addresses:
LAN(printed MAC) : F8:5E:3C:xx:xx:xx (Factory, 0xffff4)
WAN : F8:5E:3C:xx:xx:xx (Factory, 0xffffa)
SFP+ : F8:5E:3C:xx:xx:xx (Factory, 0xfffee)
2.4GHz : F8:5E:3C:xx:xx:xx (Factory, 0x4)
5GHz : F8:5E:3C:xx:xx:xx (Factory, 0x4) + 0x10
6Ghz : F8:5E:3C:xx:xx:xx (Factory, 0x4) + 0x20
Signed-off-by: Tuan Phan <pttuan@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23053
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
**Huasifei WH3000R NAND**
Wi-Fi 6 router based on MediaTek MT7981B SoC.
MT7981B+MT7976CN+MT7531AE
**Specifications**
SoC: Filogic 820 MT7981B (1.3GHz)
RAM: DDR3 512MB
Flash: 256MiB Winbond SPI NAND
WiFi: MT7976C: 2.4GHz 2x2, 5GHz 2x2
Ethernet: MT7531: 3x 1GbE LAN + 1x 1GbE WAN
USB: 1x USB 3.0 port
Two buttons: reset and mesh
LEDs: RGB (red, green, blue together)
UART: 3.3V, TX, RX, GND / 115200 8N1
DC power interface
+---------+-------------------+--------------------------+
| | MAC | Algorithm |
+---------+-------------------+--------------------------+
| LAN | 58:23:BC:xx:xx:x2 | label+1 |
| WAN | 58:23:BC:xx:xx:x1 | label+0 (eeprom) |
| WLAN 2g | 58:23:BC:xx:xx:x3 | label+2 |
| WLAN 5g | 58:23:BC:xx:xx:x4 | label+3 |
+---------+-------------------+--------------------------+
Since it's convenient for the users to check and tell MAC
to their internet providers from the router label, we set
WAN as a base MAC located at 'Factory', 0x4.
Discussed this with the vendor.
**Installation via U-Boot rescue**
1. Set static IP 192.168.1.2 on your computer and default route as 192.168.1.1
2. Connect to the LAN port and hold the reset button while booting the device.
3. Wait for the LED to blink 5 times, and release the reset button.
4. Open U-boot web page on your browser at http://192.168.1.1
5. Select the OpenWrt sysupgrade image, upload it, and start the upgrade.
6. Wait for the router to flash the new firmware.
7. Wait for the router to reboot itself.
**Installation via sysupgrade**
Just flash sysupgrade file via
[LuCI upgrade page](http://192.168.1.1/cgi-bin/luci/admin/system/flash)
without saving the settings.
**Installation via SSH**
Upload the file to the router `/tmp` directory, `ssh root@192.168.1.1`
and issue a command:
```
sysupgrade -n /tmp/openwrt-mediatek-filogic-huasifei_wh3000r-nand-squashfs-sysupgrade.bin
```
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23156
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add support for the AlwayLink M01K43 5G CPE router.
Hardware specifications:
- SoC: MediaTek MT7981B (Filogic 820), dual-core Cortex-A53
- RAM: 256 MiB DDR3 (0x40000000, size 0x10000000)
- Flash: 128 MiB SPI-NAND (UBI, root) + 4 MiB SPI-NOR (bootloader)
- Ethernet: 4x 1 GbE LAN + 1x 2.5 GbE WAN
(MT7531 DSA switch; WAN via RTL8221B 2.5GbE PHY on MAC1)
- WiFi: MT7981 built-in 2x2 802.11ax (2.4 GHz + 5 GHz)
- USB: 1x xHCI (USB 2.0 only; USB 3.0 PHY pins not routed)
- Modem: M.2 B-Key slot wired for USB (tested: Quectel RM551E-GL,
Quectel RM520N-GL via QMI)
- LEDs: 10x GPIO LEDs (status, WAN, LAN, WiFi 2.4/5, signal bars)
- Buttons: WPS, Reset, RFKill
- Power: 12 V DC barrel jack
- UART: 3.3 V TTL header on PCB, 115200 8N1, no flow control
PCB silkscreen: M01K43 v5.0
Manufacturer: Shenzhen AlwayLink Wireless Technology Co., Ltd.
MAC addresses come from the 'ledeinfo' partition (mtd6) at offset 0x18
(label macaddr_ledeinfo_18); the stored value is the LAN MAC.
interface this port vendor firmware
------------------- ----------- --------------------------
eth0 / LAN bridge base + 0 base + 0
eth1 / WAN base + 1 base + 1
wifi 2.4 GHz band@0 base + 2 base (driver-derived)
wifi 5 GHz band@1 base + 3 base + LAA bit (driver)
The vendor's ethernet scheme (LAN = base, WAN = base + 1) is reproduced
exactly. For WiFi the vendor's proprietary mt_wifi driver ignores the
stored per-radio MAC and derives each BSSID from the base by setting the
locally-administered bit, so the radios are not given clean unicast
offsets. Under mainline mt76 + DSA, reusing the base (LAN) MAC on a radio
collides at L2 with the gmac0 conduit, so this port assigns the 2.4 GHz
and 5 GHz radios base + 2 and base + 3 — unique unicast addresses in the
same OUI block.
Installation
------------
Stock firmware defaults (verified on shipping units):
LAN IP: 192.168.100.1
SSH/web: user 'root', password 'admin'
Serial: 3.3 V TTL UART header on PCB, 115200 8N1, no flow control
Image artifacts produced by this device definition:
openwrt-mediatek-filogic-alwaylink_m01k43-squashfs-factory.bin
openwrt-mediatek-filogic-alwaylink_m01k43-squashfs-sysupgrade.bin
Before flashing, back up the per-unit partitions (cannot be
regenerated):
ssh root@192.168.100.1
dd if=/dev/mtd3 of=/tmp/factory.bin bs=1 count=655360
dd if=/dev/mtd6 of=/tmp/ledeinfo.bin bs=1 count=65536
exit
scp root@192.168.100.1:/tmp/factory.bin .
scp root@192.168.100.1:/tmp/ledeinfo.bin .
Method 1 - From an existing OpenWrt install (sysupgrade):
IMG=openwrt-mediatek-filogic-alwaylink_m01k43-squashfs-sysupgrade.bin
scp "$IMG" root@192.168.1.1:/tmp/sysupgrade.bin
ssh root@192.168.1.1 sysupgrade -n /tmp/sysupgrade.bin
Method 2 - U-Boot serial recovery via TFTP (requires 3.3 V USB-UART
adapter):
1. Attach 3.3 V USB-UART (TX, RX, GND) to the PCB header. Open a
terminal at 115200 8N1, no flow control.
2. Configure a TFTP server on the host PC at IP 192.168.2.88.
Place the factory image in the TFTP root, renamed if desired.
3. Power on the router. The BL2/U-Boot banner prints within ~1
second; press any key during the autoboot countdown to enter
the U-Boot menu.
4. From the menu, select 'Upgrade ubi'. U-Boot's default IP is
192.168.2.1 and it expects the TFTP server at 192.168.2.88.
Provide the factory image filename when prompted.
5. Wait for the write to complete; U-Boot reboots into OpenWrt.
Method 3 - From a NAND programmer (brick-recovery path):
1. Clip onto or desolder the SPI-NAND chip and dump the full
128 MiB with a programmer (e.g. RT809H, CH341A with NAND
adapter). Keep the dump as a recovery image.
2. Using the same programmer, write the factory.bin image to
the UBI region of the NAND. The SPI-NOR (BL2/u-boot-env/
Factory/FIP/woem/ledeinfo/nvram) must NOT be erased - those
partitions are per-unit and live on the separate 4 MiB NOR.
3. Reseat the chip and power on. The bootloader on NOR will
load the new kernel and rootfs from UBI.
Signed-off-by: Richard Jones <richard@netsolution.shop>
Link: https://github.com/openwrt/openwrt/pull/22818
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This allows us to use the full size of nand, which increases ubi size
from 90M to 122.25M.
Flashing instructions:
1. Login into the device and backup all your partitions,
especially `Factory` and 'HW' to be able to come back to stock and use all
Wavlink services.
2. Unlock mtd partitions:
```
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
```
3. Upload new `bl2` and `fip` to the router /tmp and write them:
```
mtd write /tmp/openwrt-mediatek-filogic-wavlink_wl-wnt100x3-ubootmod-preloader.bin bl2
mtd write /tmp/openwrt-mediatek-filogic-wavlink_wl-wnt100x3-ubootmod-bl31-uboot.fip fip
mtd erase ubi
```
4. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
5. Serve OpenWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After OpenWrt initramfs has booted, prepare ubi and envs:
```
ubidetach -p /dev/mtd4 && ubiformat /dev/mtd4 -y && ubiattach -p /dev/mtd4 && ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB && ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
```
8. Perform sysupgrade.
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22753
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware
--------
- SOC: MediaTek MT7981B
- RAM: 512MB DDR3
- FLASH: 128MB SPI-NAND ESMT F50L1G41LB
- NETWORK: 1 x1000M WAN, 1 x 1000M LAN
- WIFI: MediaTek MT7981B 2x2 DBDC 802.11ax 2T2R (2.4/5)
- LEDs: 1x STATUS (blue)
- USB: 1x USB 3.0 (XHCI)
- FAN: 1x 5V FAN
Installation / Upgrade Procedure
-----------------------------
1.Log in to the web management page.
2.Select the country code and time zone, set the Wi-Fi password, and
click Save.
3.Click "More", navigate to "Developer Options", and enable the SSH
function.
4.Log in to the device via an SSH client (default IP is usually
192.168.20.1).
5.Use scp to upload the OpenWrt
image(openwrt-mediatek-filogic-wavlink_wl-wnt100x3-squashfs-sysupgrade.bin)
to the /tmp directory
6.Perform the flash by running the sysupgrade command (use -n to
overwrite the existing configuration)
7.Wait for the device to reboot automatically. Once finished, access the
OpenWrt web interface (LuCI) at the default IP 192.168.1.1.
MAC Addresses
-----------------------------
2.4GHz: 80:3F:5D:xx:xx:93 (Factory 0x4)
LAN : 80:3F:5D:xx:xx:91 (Factory, 0x3fff4)
WAN : 80:3F:5D:xx:xx:92 (Factory, 0x3fffa)
5GHz : 02:3F:5D:xx:xx:93 (derived from 2.4GHz MAC, LAA))
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22753
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add support for TP-Link Festa F65, an AX3000 ceiling mount WiFi 6 AP.
Hardware
--------
SOC : MediaTek MT7981B 2x A53
RAM : ESMT M15T4G16256A 512MiB
Flash : ESMT F50L1G41LB 128 MiB
ETH : 1x 1GbE
WiFi : MT7976
Buttons : Reset
Leds : Blue status led on top
Power : DC 12V 1.2A / PoE
Installation
------------
1. Disassemble the device
2. Solder UART to pins VGRT right of the ethernet port
3. Connect UART console (3.3V)
4. Press Ctrl+b to stop in u-boot shell
5. Use `mtkload` to boot `openwrt-initramfs-kernel.bin` via tftp
6. Flash `openwrt-squashfs-sysupgrade.bin` via sysupgrade
Revert to OEM firmware
----------------------
1. Hold reset button while plugging in power
2. Configure host ethernet to 192.168.0.1/24
3. Go to http://192.168.0.254
4. Upload OEM firmware
MAC Addresses
-------------
LAN : DC:62:79:xx:xx:28 (printed on label)
2.4GHz: DC:62:79:xx:xx:28
5GHz : DC:62:79:xx:xx:29
Signed-off-by: Leonard Anderweit <leonard.anderweit@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22138
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
| Component | Details |
|------------------|-------------------------------------------------|
| **SoC** | MediaTek MT7986A (4× ARM Cortex-A53 @ 2.0 GHz) |
| **RAM** | 512 MB |
| **Flash** | 256 MB NAND |
| **Ethernet** | 5× 10/100/1000 Mbps (1 WAN + 4 LAN) |
| **WLAN 2.4 GHz** | MediaTek MT7976GN — 802.11b/g/n/ax, 4×4 MIMO |
| **WLAN 5 GHz** | MediaTek MT7976AN — 802.11n/ac/ax, 4×4 MIMO |
| **LEDs** | 1× RGB LED (GPIO-controlled) |
| **Button** | 1× Reset |
| **USB** | Yes |
**MAC Addresses:**
| Interface | Source |
|------------|-------------------------------------------------|
| WAN/Label | u-boot-env MTD partition, "mac" (text) |
| LAN | WAN + 1 |
| 2.4 GHz | WAN + 2 |
| 5 GHz | WAN + 3 |
---
**1. Prepare TFTP server**
Set a static IP on the ethernet interface of your computer (e.g. default: ip `192.168.1.2`, gateway `192.168.1.1`).
Download the initramfs image and host it with the TFTP server.
**2. Interrupt boot**
Attach UART and power on the router. When the boot menu appears, select **Failsafe Mode**,
then press `Ctrl-C` to interrupt and enter the U-Boot prompt.
**3. Load and run initramfs image**
```sh
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.2
tftpboot 0x46000000 openwrt-mediatek-filogic-jiorouter_ax6000-jidu6101-initramfs-kernel.bin
fdt addr $(fdtcontroladdr)
fdt rm /signature
bootm
```
**4. Flash sysupgrade image**
Place the sysupgrade image in `/tmp`, then run:
```sh
sysupgrade /tmp/openwrt-mediatek-filogic-jiorouter_ax6000-jidu6101-squashfs-sysupgrade.bin
```
Alternatively, use the sysupgrade option in LuCI.
Note:
- The raw MTD u-boot-env partition is only used for MAC address storage, while the active U-Boot environment is stored in the UBI volume.
- These devices ship with secure boot enabled and stock U-Boot only accepts vendor-signed FIT images.
- BL2/FIP cannot be replaced, so the stock signature verification path cannot be disabled directly.
- Setting ipaddr='' forces U-Boot to exit the web failsafe path and continue into autoboot.
- The custom bootcmd loads OpenWrt from the UBI volume and removes the /signature node before bootm, allowing unsigned OpenWrt FIT images to boot.
- Stock U-Boot expects its environment in a UBI volume named u-boot-env, so it is created during initial setup.
Signed-off-by: sh3ikh-faisal <sheikhfaisal713@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22201
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The COMFAST CF-XR186 is a WiFi repeater. The original OEM firmware is a
fork of OpenWrt 21.02.
To replace the OEM firmware with OpenWrt, flash the sysupgrade image
through the firmware upgrade option via the OEM firmware's web UI.
The OEM firmware upgrade page does not provide an option to perform a
factory reset, so after the flash completes and the device reboots,
perform a reset by holding in the WPS/Reset button until the WiFi
LED flashes red.
The led-boot, led-failsafe, led-upgrade, and led-running aliases all
point at the red WLAN GPIO LED.
The green and blue WLAN GPIO LEDs are used to indicate activity on the
2.4GHz and 5GHz radios. 01_leds assigns netdev triggers for those LEDs
to phy0-ap0 and phy1-ap0 respectively; if neither AP interface exists
(e.g. station-only repeater setups), both LEDs stay dark even when WiFi
traffic is flowing.
Specifications:
- SoC: MediaTek MT7981B
- RAM: 256MB
- Flash: SPI NAND
- WiFi: 2.4GHz + 5GHz (AX3000, 4x 3dBi antennas)
- Ethernet: 1x 10/100/1000M
- LEDs: power (not controllable), blue Ethernet, blue/green/red WiFi
- Button: WPS/Reset
- Power: 100-240V AC (wall plug)
- UART: 115200 8N1
MAC Addresses:
- LAN : 40:A5:EF:xx:xx:2D (Factory, 0xe000)
- 2.4GHz: 40:A5:EF:xx:xx:2F (Factory, 0x0004)
- 5GHz : 40:A5:EF:xx:xx:30 (Factory, 0x8000)
Signed-off-by: David Berdik <dgberdik@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22471
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for the netis MEX605, which is a variant based on the netis NX30 V2.
1. Update brand naming from Netis to netis to follow the official branding.
2. Rename NX30V2 to NX30 V2 to correctly reflect it as the second version of the NX30.
3. Update variant notation for consistency.
cherry picked from commit c982357
1. Add 'model' to the DTS for netis NX30 V2 and define WiFi LED.
4. Fix typo.
Signed-off-by: Zhiwei Cao <bfdeh@126.com>
Signed-off-by: David Han <h96643864@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22726
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This was used for non nvmem-layout ubootenv support. Since that's gone
and it's not even used anyway, remove.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22367
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for Qihoo 360T7 (UBI layout).
Aims
----
1. +20 MB additional free space for the packages
2. More reliable storage for the factory and fip partitions (in UBI)
Install (from non-UBI OpenWrt)
------------------------------
1. Navigate http://192.168.1.1/ and download mtd backups
2. Upgrade OpenWrt with installer initramfs image (force upgrade, don't
keep settings). Wait until OpenWrt reboots and until installer:
- Prepare new factory partition
- Format new ubi
- Make ubi volumes
- Write new fip and bl2
3. Navigate http://192.168.1.1/ and Upgrade with OpenWrt 'sysupgrade.bin'
image (don't keep settings)
Installer
---------
Based on OpenWrt UBI Installer Image Generator for Linksys E8450 and
Belkin RT3200
Link: https://github.com/dangowrt/owrt-ubi-installer
Ready installer image
Link: https://github.com/csharper2005/owrt-ubi-installer/tree/qihoo/bin
Installer script
Link: https://github.com/csharper2005/owrt-ubi-installer/blob/qihoo/files/
installer/install.sh
Committing to the parent Daniel's repository is not yet possible because
there are no official images and imagebuilder for Qihoo 360T7 (UBI) yet.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22797
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The mt7981b-mercusys-mr85x.dts has redundant executable bit (755 instead
of 644). Fix it.
Fixes: b2648d8 ("mediatek: add support for Mercusys MR85X")
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22797
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
ELECOM WRC-X6000GSD is a 4804Mbps 4xMIMO 2.4/5 GHz 11ax (Wi-Fi 6) router
with 2.5Gbps WAN (stock: 1Gbps max.), based on MT7986B
Specification:
- SoC : MediaTek MT7986BLA
- RAM : DDR3 512 MiB (SoC)
- Flash : Winbond 128MiB SPI NAND (W25N01GVZEIG)
- WLAN : 2.4/5 GHz 4T4R (MediaTek MT7986)
- Ethernet : 5x 10/100/1000(/2500) Mbps
- wan : Maxlinear Ethernet GPY211C (max. 2500M)
- lan : MediaTek MT7531 (max. 1000M)
- LEDs/Keys (GPIO): 11x/4x
- UART : through-hole on PCB (J1)
- assignment : 3.3V, TX, RX, NC, GND from tri-angle marking
- settings : 115200n8
- Power : 12 VDC, 2 A
Flash layout:
dev: offset size name
mtd0: 0x00000000 0x00100000 "BL2"
mtd1: 0x00100000 0x00080000 "Ubootenv"
mtd2: 0x00180000 0x00200000 "Factory"
mtd3: 0x00380000 0x00200000 "FIP"
mtd4: 0x00580000 0x00020000 "Fwheader"
mtd5: 0x005a0000 0x03200000 "ubi"
mtd6: 0x037a0000 0x00380000 "Config"
mtd7: 0x03b20000 0x00020000 "Fwheader_2"
mtd8: 0x03b40000 0x03200000 "ubi_2"
mtd9: 0x06d40000 0x00380000 "Config_2"
mtd10: 0x070c0000 0x00100000 "persist"
mtd11: 0x071c0000 0x00040000 "Mrd"
mtd12: 0x07200000 0x00380000 "Backup"
Flash instruction using factory.bin image:
1. Boot WRC-X6000GSD in router mode normally
2. Access to the WebUI ("http://192.168.2.1/") on the device
-> その他設定 (Other settings)
-> フォームウェア更新 (Update firmware)
-> ローカルファイル指定 (Specify local file)
3. Select the OpenWrt factory.bin image and click apply ("適用") button
4. Wait ~120 seconds to complete flashing
Switching to the stock firmware:
1. Load the elecom.sh script
. /lib/upgrade/elecom.sh
2. Check the current index of firmware partition
mstc_rw_bootnum
3. Set the bootnum to opposite value between 1 and 2
mstc_rw_bootnum value
example:
- step2 returned "1": mstc_rw_bootnum 2
- step2 returned "2": mstc_rw_bootnum 1
4. Reboot, to stock FW
5. Flash the stock FW to fuly revert back to original.
Notes:
- With the stock firmware, it will flash to another partition and
toggle boot to that partition when any firmware is flashed.
For example when booting on ubi, the new firmware will be flashed
to ubi_2 and the router will boot from ubi_2 afterwards.
The 5th byte of the Persist partition is the boot value (0x01 or 0x02).
- bootmenu_delay=0 is set from factory so uboot menu is hidden by
default.
- The hardware of WRC-X6000GSD is almost identical to WRC-X6000QS, but
WAN (labeled as "INTERNET") port is limited to 1000 Mbps on stock FW.
On OpenWrt FW, 2500 Mbps connection is available on that port.
MAC Addresses:
LAN : 38:97:A4:xx:xx:58 (Factory, 0x2A(hex)/Ubootenv, "ethaddr"(text))
WAN : 38:97:A4:xx:xx:5B (Factory, 0x24(hex))
2.4GHz: 38:97:A4:xx:xx:59 (Factory, 0x4(hex))
5GHz : 38:97:A4:xx:xx:5A (Factory, 0xA(hex)
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22926
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
ELECOM WRC-X6000QS is a 4804Mbps 4xMIMO 2.4/5 GHz 11ax (Wi-Fi 6) router
with 2.5Gbps WAN, based on MT7986b
Specification:
- SoC : MediaTek MT7986B
- RAM : DDR3 512 MiB
- Flash : Winbond 128MiB SPI NAND
- WLAN : 2.4/5 GHz 4T4R (MediaTek MT7986)
- Ethernet : 5x 10/100/1000 Mbps
- wan : Maxlinear Ethernet GPY211C
- lan : MediaTek MT7531
- LEDs/Keys (GPIO): 11x/4x
- UART : through-hole on PCB (J1)
- assignment : 3.3V, TX, RX, NC, GND from tri-angle marking
- settings : 115200n8
- Power : 12 VDC, 2 A
Flash layout:
dev: offset size name
mtd0: 0x00000000 0x00100000 "BL2"
mtd1: 0x00100000 0x00080000 "Ubootenv"
mtd2: 0x00180000 0x00200000 "Factory"
mtd3: 0x00380000 0x00200000 "FIP"
mtd4: 0x00580000 0x00020000 "Fwheader"
mtd5: 0x005a0000 0x03200000 "ubi"
mtd6: 0x037a0000 0x00380000 "Config"
mtd7: 0x03b20000 0x00020000 "Fwheader_2"
mtd8: 0x03b40000 0x03200000 "ubi_2"
mtd9: 0x06d40000 0x00380000 "Config_2"
mtd10: 0x070c0000 0x00100000 "persist"
mtd11: 0x071c0000 0x00040000 "Mrd"
mtd12: 0x07200000 0x00380000 "Backup"
UBI layout:
name: size:
kernel 0x00364000 dynamic
rootfs 0x00FFC000 dynamic
rootfs_data 0x01A47000 dynamic
Flash instruction using factory.bin image:
1. Boot WRC-X6000QS in router mode normally
2. Access to the WebUI ("http://192.168.2.1/") on the device
-> その他設定 (Other settings)
-> フォームウェア更新 (Update firmware)
-> ローカルファイル指定 (Specify local file)
3. Select the OpenWrt factory.bin image and click apply ("適用") button
4. Wait ~120 seconds to complete flashing
Switching to the stock firmware:
1. Load the elecom.sh script
. /lib/upgrade/elecom.sh
2. Check the current index of firmware partition
mstc_rw_bootnum
3. Set the bootnum to opposite value between 1 and 2
mstc_rw_bootnum value
example:
- step2 returned "1": mstc_rw_bootnum 2
- step2 returned "2": mstc_rw_bootnum 1
4. Reboot, to stock FW
5. Flash the stock FW to fuly revert back to original.
Note 1: With the stock firmware, it will flash to another partition and
toggle boot to that partition when any firmware is flashed.
For example when booting on ubi, the new firmware will be flashed
to ubi_2 and the router will boot from ubi_2 afterwards.
The 5th byte of the Persist partition is the boot value (0x01 or 0x02).
During my tests, it never switched to another boot partition if the
firmware failed boot. So if openwrt doesn't boot,
UART might be required to recover.
Note 2: bootmenu_delay=0 is set from factory so uboot menu is hidden.
[original work]
Signed-off-by: Yuhei Amemiya <minihui@me.com>
[fixes, improvements]
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22926
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Device support for zbt-z8103ax-d
Model D DTS is identical to Model C zbt-z8103ax-c.
Both models share same motherboard.
Difference between models is
- Model C is a cylinder shape enclosure
containing internal antennas.
- Model D is a sandwich shape enclosure
with 6 external antennas.
Specifications:
SoC: MediaTek MT7981B
RAM: 256MiB
Flash: Winbond SPI-NAND 128 MiB
Switch: 1 WAN, 3 LAN (Gigabit) MediaTek MT7531
Buttons: Reset, Mesh
Power: DC 12V 1A
WiFi: MT7981B 2.4Ghz & 5.8Ghz
Led Layout from left to right:
Power
Mesh (RGB Led, user controllable, default set to OpenWrt Status)
WLAN 2.4G (user controllable)
WAN (user controllable)
LAN3
LAN2
LAN1
WLAN 5G (user controllable)
Installation:
A. Through U-Boot menu:
- Prepare your connecting computer to use static IP
(legacy notation) 192.168.1.10 netmask 255.255.255.0
(CIDR notation) 192.168.1.10/24
- Power down the router and hold in the Reset button.
- While holding in the button power up the router again.
- Hold the button in for 10 seconds and then release.
- Use your browser to go to 192.168.1.1
- If you see a GUI allowing for flashing firmware you are at the right spot.
- Upload the **Factory** image file.
Note: U-Boot GUI it can be used to recover from an incorrect firmware flash.
B. Through OpenWrt Dashboard:
If your router comes with OpenWrt preinstalled (modified by the seller),
you can easily upgrade by going to the dashboard (192.168.1.1)
and then navigate to
System -> Backup/Flash firmware, then flash the firmware
MAC Addresses:
MAC Addresses were found in Factory partition:
offset 0x4 F8:5E:3C:xx:xx:aa --> Router Label -2
offset 0xa F8:5E:3C:xx:xx:bb --> Router Label -1
offset 0x24 F8:5E:3C:xx:xx:cc --> Router Label +1
offset 0x2a F8:5E:3C:xx:xx:yy --> printed on Router Label
Signed-off-by: Jörg Seitz <github.joeterminal@xoxy.net>
Link: https://github.com/openwrt/openwrt/pull/21626
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Nand has a valid mediatek nand badblock management (NMBM) signature.
Gets used for non-UBI partions BL2, u-boot-env, Factory and FIT.
Signed-off-by: Jörg Seitz <github.joeterminal@xoxy.net>
Link: https://github.com/openwrt/openwrt/pull/21626
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Use the upstream properties to describe the USXGMII PCS polarity as
the downstream mediatek,pnswap{,-rx,tx} was dropped.
This board was the only user.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Device support for zbt-z8106ax-s
Specifications:
SoC: MediaTek MT7981B
RAM: 256MiB
Flash: Winbond SPI-NAND 128 MiB
Switch: 1 WAN, 4 LAN (Gigabit) MediaTek MT7531
Buttons: Reset
Power: DC 12V 1A
WiFi: MT7981B 2.4Ghz & 5Ghz
USB 3
M2 slot to hold LTE modem
1 nano SIM slot (user controllable)
Hardware watchdog (confirmed to work)
Router comes in a plastic tower with all antennas internal.
- 4 antennas for LTE 4G/5G communication
- 2 antennas for Wifi 2.4 GHz
- 2 antennas for Wifi 5 GHz
Led Layout:
Power (green, user controllable, default set to OpenWrt Status)
Mobile (green, user controllable)
WLAN 2.4G (green, user controllable)
WLAN 5G (green, user controllable)
WAN (amber, user controllable, set to show eth1)
LAN1 (amber, hardware controlled)
LAN2 (amber, hardware controlled)
LAN3 (amber, hardware controlled)
LAN4 (amber, hardware controlled)
SIM Slot:
Controlled via exported GPIO named SIM.
echo "0" > /sys/class/gpio/sim/value
- turns off sim slot labelled SIM
echo "1" > /sys/class/gpio/sim/value
- turns on sim slot labelled SIM
---
Installation:
A. Through U-Boot menu:
- Prepare your connecting computer to use a static IP in
network 192.168.1.0/24 like
a) 192.168.1.10 netmask 255.255.255.0 (legacy notation)
b) 192.168.1.10/24 (CIDR notation)
- Power down the router and hold in the Reset button.
- While holding in the button power up the router again.
- Hold the button in for 10 seconds and then release.
- Use your browser to go to 192.168.1.1
- If you see a GUI allowing for flashing firmware then you got the right spot.
- Upload the **Factory** image file.
Note: U-Boot GUI it can be used to recover from an incorrect firmware flash.
B. Through OpenWrt Dashboard:
If your router comes with OpenWrt preinstalled (modified by vendor),
you can easily upgrade by going to the dashboard (192.168.1.1) and
then navigate to "System" -> "Backup/Flash firmware"
Flash OpenWRT firmware.
Important: Take care to deselect (untick) option
"keep settings". Settings done by vendor are incompatible with
versions 24.10 or 25.12.
MAC Addresses:
MAC Addresses were found in Factory partition:
offset 0x4 F8:5E:3C:xx:xx:aa --> Router Label -2
offset 0xa F8:5E:3C:xx:xx:bb --> Router Label -1
offset 0x24 F8:5E:3C:xx:xx:cc --> Router Label +1
offset 0x2a F8:5E:3C:xx:xx:yy --> printed on Router Label
Hardware Watchdog:
Device features a GPIO controlled hardware watchdog.
Verfied by removing procd controlled watchdog and
seeing device rebooting.
---
Notes:
The zbt-z8106ax-s could be ordered from vendor with a variety of modems.
Mine came with a 4G LTE modem Quectel EC200A.
Quectel firmware was at EC200AEUHAR01A30M16.
Choices for ordering with 5G LTE were available.
Modem communication is set to ethernet control mode (ECM) by vendor.
Package modemmanager works fine with Quectel EC200A.
You may also decide to use FUjR/Qmodem github repository
to have it manage LTE modem.
Please take note that internal switch port named lan5 isn't
wired to LTE modem in model S as opposed to model T.
Just removing lan5 from DTS did cause unwanted reboots whenever
a cable is plugged into LAN ports 1-4. Disabling port lan5
in DTS however works fine. No unwanted reboots due to
plug/unplug cable into any lan or wan port.
Signed-off-by: Jörg Seitz <github.joeterminal@xoxy.net>
Link: https://github.com/openwrt/openwrt/pull/22912
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Import pending series introducing support for standalone PCS drivers.
This has previously already been used by the airoha target, and is
also the base for the closer-to-upstream patches for MediaTek MT7988
10G SerDes support.
In order to not having to diverge from upstream also backport series
for standardized handling for PHY and PCS SerDes pair polarity.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
BUFFALO WSR-3000AX4P is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on
MT7981B.
Specification:
- SoC : MediaTek MT7981B
- RAM : DDR4 512 MiB (ESMT M16U4G16256A-KJBG)
- Flash : SPI-NAND 128 MiB (Winbond W25N01GVZEIG)
- WLAN : 2.4/5 GHz 2T2R (MediaTek MT7981B (SoC))
- Ethernet : 4x 10/100/1000 Mbps
- switch : MediaTek MT7531A
- LEDs/Keys (GPIO): 6x/4x
- UART : through-hole on PCB (J1)
- assignment : 3.3V, GND, TX, RX from tri-angle marking
- settings : 115200n8
- Power : 12 VDC, 1.5 A (Max. 14.4 W)
Flash instruction using initramfs image:
1. Prepare a TFTP server with 192.168.11.2
2. Rename initramfs image to "linux.ubi-recovery" and put it to the TFTP
directory
3. Hold the "AOSS" button and power on WSR-3000AX4P, release after 7~
seconds
4. The bootloader automatically downloads the initramfs image and boots
with it
5. After booting, upload a sysupgrade image to the device and perform
sysupgrade with it
6. Wait ~100 seconds to complete flashing
Reverting to stock image:
1. Download a official firmware and decrypt it by buffalo-enc
example:
buffalo-enc -i <official .bin> -o fw.dec -d -O 0xC8 -l
2. Upload the decrypted image to the device
3. Flash the image to the UBI in "ubi_kernel" partition on the device
example:
. /lib/upgrade/common.sh
. /lib/upgrade/nand.sh
CI_UBIPART="ubi_kernel" nand_do_flash_file fw.dec
4. Reboot the device
reboot
Notes:
- WSR-3000AX4P has 2x OS images ("ubi"/"Kernel2"), but the second one
is only for backup and not used for booting.
image handling on the bootloader:
- "ubi" is broken : "Kernel2" --(copy)--> "ubi"
- "Kernel2" is broken : "ubi" --(copy)--> "Kernel2"
- "ubi" != "Kernel2" :
- boot_select=0: "ubi" --(copy)--> "Kernel2"
- boot_select=1: "Kernel2" --(copy)--> "ubi", set boot_select to '0'
MAC Addresses:
LAN : EC:5A:31:xx:xx:50 (board_data, "mac" (text))
WAN : EC:5A:31:xx:xx:50
2.4GHz: EC:5A:31:xx:xx:52
5GHz : EC:5A:31:xx:xx:59
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22587
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Device support for zbt-z8106ax-t
Vendor Zbtlink advertizes this device as model Z8106AX-M2-T
on their website www.zbtlink.com. Device label sticked on
enclosure however states this is model Z8106AX version -T.
I made firmware selector to show this device as
- ZBT-Z8106AX-T to match information printed on the label and
- ZBT-Z8106AX-M2-T to match information found on vendors web pages.
Specifications:
SoC: MediaTek MT7981B
RAM: 256MiB
Flash: Winbond SPI-NAND 128 MiB
Switch: 1 WAN, 4 LAN (Gigabit) MediaTek MT7531
Buttons: Reset
Power: DC 12V-32V 1A
WiFi: MT7981B 2.4Ghz & 5Ghz
USB 3
M2 slot to hold LTE modem
2x nano SIM slots (user controllable)
Router comes in a flat metal box with all antennas detachable.
- 4 antennas for LTE 4G/5G communication
- 2 antennas for Wifi 2.4 GHz
- 2 antennas for Wifi 5 GHz
Power supply could be between 12V and 32V.
This serves both cars equipped with 12V batteries
and trucks equipped with 24V batteries.
Led Layout:
Power (green, user controllable, default set to OpenWrt Status)
Mobile (green, user controllable)
WLAN 2.4G (green, user controllable)
WLAN 5G (green, user controllable)
WAN (amber, user controllable, set to show eth1)
LAN1 (amber, hardware controlled)
LAN2 (amber, hardware controlled)
LAN3 (amber, hardware controlled)
LAN4 (amber, hardware controlled)
SIM Slots:
Controlled via exported GPIO named SIM.
echo "0" > /sys/class/gpio/sim/value
- selects upper sim slot labelled SIM1
echo "1" > /sys/class/gpio/sim/value
- selects lower sim slot labelled SIM2
Slot SIM2 is set as default and matches label on Router enclosure
---
Installation:
A. Through U-Boot menu:
- Prepare your connecting computer to use a static IP in
network 192.168.1.0/24 like
a) 192.168.1.10 netmask 255.255.255.0 (legacy notation)
b) 192.168.1.10/24 (CIDR notation)
- Power down the router and hold in the Reset button.
- While holding in the button power up the router again.
- Hold the button in for 10 seconds and then release.
- Use your browser to go to 192.168.1.1
- If you see a GUI allowing for flashing firmware then you got the right spot.
- Upload the **Factory** image file.
Note: U-Boot GUI it can be used to recover from an incorrect firmware flash.
B. Through OpenWrt Dashboard:
If your router comes with OpenWrt preinstalled (modified by vendor),
you can easily upgrade by going to the dashboard (192.168.1.1) and
then navigate to "System" -> "Backup/Flash firmware"
Flash OpenWRT firmware and take care to deselect (untick) option
"keep settings". Settings done by vendor are incompatible with
versions 24.10 or 25.12.
MAC Addresses:
MAC Addresses were found in Factory partition:
offset 0x4 F8:5E:3C:xx:xx:aa --> Router Label -2
offset 0xa F8:5E:3C:xx:xx:bb --> Router Label -1
offset 0x24 F8:5E:3C:xx:xx:cc --> Router Label +1
offset 0x2a F8:5E:3C:xx:xx:yy --> printed on Router Label
Hardware Watchdog:
Device features a GPIO controlled hardware watchdog.
Verfied by removing procd controlled watchdog and
seeing device rebooting.
---
Notes:
The zbt-z8106ax-t could be ordered from vendor with a variety of modems.
Mine came with a Quectel RM520N-GL. Quectel firmware was at RM520NGLAAR01A07M4G.
This level of firmware made some trouble connecting with some of my
SIM cardproviders.
Newer firmware level RM520NGLAAR01A08M4G_01.205.01.205 was available searching
github repositories. Upgrading my RM520-GL allowed to get successful connects
that did fail with older Quectel firmware.
Modem communication is set to ethernet control mode (ECM) by vendor.
Vendor takes advantage of ECM by wiring modem to internal switch port WWAN.
OpenWRT network configuration wants to define two network interfaces
- Network interface covering USB0 set with high metric
- Network interface covering WWAN set with low metric
Network interface covering WWAN would be preferred default route.
Please take note that internal switch port wired to LTE modem is named LAN5
in vendor provided firmwares. OpenWRT however names port as WWAN to better
describe purpose of port. WWAN is suggested to be assigned to firewall zone WAN.
Did use package qmodem from github repository FUjR/QModem to manage RM520N-GL LTE modem.
Signed-off-by: Jörg Seitz <github.joeterminal@xoxy.net>
Link: https://github.com/openwrt/openwrt/pull/21834
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
The device is similar to the M30 but has only one LAN port and no WAN port.
- MT7981 CPU using 2.4GHz and 5GHz WiFi (both AX)
- 512MB RAM
- 128MB NAND flash with two UBI partitions with identical size
- 1 multi color LED (red, green, blue, white) connected via GCA230718
- 2 buttons (WPS, reset, LED)
- 1 1Gbit LAN port
Disassembly:
- There are two screws at the power connector which must be removed. Afterwards the top case can be removed (it is clipped on, so some tools are required).
Serial Interface:
- The serial interface can be connected to the 4 pin holes on the board. Do NOT connect VCC.
- The pins are labelled on the PCB (RX, TX, GND)
- Settings: 115200, 8N1
MAC addresses:
- LAN MAC is stored in partition "Odm" at offset 0x8f
- WLAN MAC (2.4 GHz and 5GHz) is LAN MAC + 1
Reverting back to OEM firmware:
- There is currently no easy way to revert back to the OEM image
- The methods from M30 and M60 doesn't seem to work anymore
- If you plan to revert back to OEM firmware later, do the following steps before flashing OpenWrt:
- Boot from initramfs as described in "Flashing via U-Boot" but don't flash anything
- Instead, make a backup of UBI and UBI1 partition
- The created dumps must be written to the initial partitions to revert back to OEM
Flashing via Recovery Web Interface:
- Set your IP address to 192.168.200.10, subnetmask 255.255.255.0
- Press the reset button while powering on the device
- Keep the reset button pressed until the LED blinks red
- Open a Chromium based and goto http://192.168.200.50/ (recovery web interface)
- Download openwrt-mediatek-filogic-dlink_aquila-pro-ai-e30-a1-squashfs-recovery.bin
- Note: The recovery web interface always reports successful flashing, even if it fails
- After flashing, the recovery web interface will try to forward the browser to 192.168.0.1 (can be ignored)
- If flashing was successful, OpenWrt is accessible via 192.168.1.1
- The recovery image boots an initramfs image, flash the sys upgrade image to get to „normal“ OpenWrt mode
Flashing via U-Boot:
- Open the case, connect to the UART console
- Set your IP address to 192.168.200.2, subnet mask 255.255.255.0. Connect to one of the LAN interfaces of the router
- Run a tftp server which provides openwrt-mediatek-filogic-dlink_aquila-pro-ai-e30-a1-initramfs-kernel.bin
- Supply the board with 12V
- Select "7. Load image" in the U-Boot menu
- Enter image file, tftp server IP and device IP (if they differ from the default).
- TFTP download to RAM will start. After a few seconds OpenWrt initramfs should start
- The initramfs is accessible via 192.168.1.1, change your IP address accordingly (or use multiple IP addresses on your interface)
- Perform a sysupgrade using openwrt-mediatek-filogic-dlink_aquila-pro-ai-e30-a1-squashfs-sysupgrade.bin
- Reboot the device. OpenWrt should start from flash now
Flashing via OEM web interface is not possible, as it will change the active partition and OpenWrt is only running on the first UBI partition.
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22776
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for Huasifei WH3000 Pro NAND version.
There is an eMMC already supported in OpenWrt. The only difference is NAND chip.
This commit adds common .dtsi and separate .dts
for eMMC and nand versions.
**Huasifei WH3000 Pro NAND**
Portable Wi-Fi 6 travel router based on MediaTek MT7981A SoC. MT7981B+MT7976CN+RTL8221B Dual Core 1.3GHZ with 5G modems module and PWM Fan.
**Specifications**
SoC: Filogic 820 MT7981A (1.3GHz)
RAM: DDR4 1GB
Flash: 256mb Winbond SPI NAND
WiFi: 2.4GHz and 5GHz with 3 antennas
Ethernet:
1x WAN (10/100/1000M)
1x LAN (10/100/1000/2500M)
USB: 1x USB 3.0 port
Two buttons: reset and mode (BTN_0)
LEDS: blue, red, blue+red=pink
UART: 3.3V, TX, RX, GND / 115200 8N1
M.2 (WWAN) slot
**Installation via U-Boot rescue**
1. Set static IP 192.168.1.2 on your computer and default route as 192.168.1.1
2. Connect to the WAN port and hold the reset button while booting the device.
3. Wait for the LED to blink 5 times, and release the reset button.
4. Open U-boot web page on your browser at http://192.168.1.1
5. Select the OpenWRT sysupgrade image, upload it, and start the upgrade.
6. Wait for the router to flash the new firmware.
7. Wait for the router to reboot itself.
**Installation via sysupgrade**
Just flash sysupgrade file via [LuCI upgrade page](http://192.168.1.1/cgi-bin/luci/admin/system/flash) without saving the settings.
**Installation via SSH**
Upload the file to the router `/tmp` directory, `ssh root@192.168.1.1` and issue a command:
```
sysupgrade -n /tmp/openwrt-mediatek-filogic-huasifei_wh3000-pro-nand-squashfs-sysupgrade.bin
```
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22694
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Remove unnecessary properties as there is no
reg property in child node.
Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22592
Signed-off-by: Robert Marko <robimarko@gmail.com>
This allows us to use the full size of nand,
which extends ubi size from 64Mb to 122.25Mb.
1. Log in to the device and backup all the partitions,
especially unique "Factory" and "bdata" partitions
from System -> Backup / Flash Firmware -> Save mtdblock contents.
2. Install kmod-mtd-rw to unlock mtd partitions for writing
apk update && apk add kmod-mtd-rw && insmod mtd-rw i_want_a_brick=1
3. Write new OpenWrt (U-Boot Layout) "BL2" and "FIP":
mtd -e BL2 write openwrt-mediatek-filogic-cudy_wr3000h-v1-ubootmod-preloader.bin BL2
mtd -e FIP write openwrt-mediatek-filogic-cudy_wr3000h-v1-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC: "192.168.1.254", gateway "192.168.1.1"
5. Serve openwrt-mediatek-filogic-cudy_wr3000h-v1-ubootmod-initramfs-recovery.itb
using TFTP server.
6. Connect Router LAN with PC LAN.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt initramfs recovery has booted,
clean "/dev/mtd5" ubi partition to utilize maximum of free space:
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Perform sysupgrade.
Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21943
Signed-off-by: Robert Marko <robimarko@gmail.com>
This allows us to use the full size of nand,
which extends ubi size from 64Mb to 122.25Mb.
1. Log in to the device and backup all the partitions,
especially unique "Factory" and "bdata" partitions
from System -> Backup / Flash Firmware -> Save mtdblock contents.
2. Install kmod-mtd-rw to unlock mtd partitions for writing
apk update && apk add kmod-mtd-rw && insmod mtd-rw i_want_a_brick=1
3. Write new OpenWrt (U-Boot Layout) "BL2" and "FIP":
mtd -e BL2 write openwrt-mediatek-filogic-cudy_wr3000e-v1-ubootmod-preloader.bin BL2
mtd -e FIP write openwrt-mediatek-filogic-cudy_wr3000e-v1-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC: "192.168.1.254", gateway "192.168.1.1"
5. Serve openwrt-mediatek-filogic-cudy_wr3000e-v1-ubootmod-initramfs-recovery.itb
using TFTP server.
6. Connect Router LAN with PC LAN.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt initramfs recovery has booted,
clean "/dev/mtd5" ubi partition to utilize maximum of free space:
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Perform sysupgrade.
Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21943
Signed-off-by: Robert Marko <robimarko@gmail.com>
This allows us to use the full size of nand,
which extends ubi size from 64Mb to 122.25Mb.
1. Log in to the device and backup all the partitions,
especially unique "Factory" and "bdata" partitions
from System -> Backup / Flash Firmware -> Save mtdblock contents.
2. Install kmod-mtd-rw to unlock mtd partitions for writing
apk update && apk add kmod-mtd-rw && insmod mtd-rw i_want_a_brick=1
3. Write new OpenWrt (U-Boot Layout) "BL2" and "FIP":
mtd -e BL2 write openwrt-mediatek-filogic-cudy_wr3000s-v1-ubootmod-preloader.bin BL2
mtd -e FIP write openwrt-mediatek-filogic-cudy_wr3000s-v1-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC: "192.168.1.254", gateway "192.168.1.1"
5. Serve openwrt-mediatek-filogic-cudy_wr3000s-v1-ubootmod-initramfs-recovery.itb
using TFTP server.
6. Connect Router LAN with PC LAN.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt initramfs recovery has booted,
clean "/dev/mtd5" ubi partition to utilize maximum of free space:
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Perform sysupgrade.
Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21943
Signed-off-by: Robert Marko <robimarko@gmail.com>
This allows us to use the full size of nand,
which extends ubi size from 64Mb to 122.25Mb.
1. Log in to the device and backup all the partitions,
especially unique "Factory" and "bdata" partitions
from System -> Backup / Flash Firmware -> Save mtdblock contents.
2. Install kmod-mtd-rw to unlock mtd partitions for writing
apk update && apk add kmod-mtd-rw && insmod mtd-rw i_want_a_brick=1
3. Write new OpenWrt (U-Boot Layout) "BL2" and "FIP":
mtd -e BL2 write openwrt-mediatek-filogic-cudy_wr3000p-v1-ubootmod-preloader.bin BL2
mtd -e FIP write openwrt-mediatek-filogic-cudy_wr3000p-v1-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC: "192.168.1.254", gateway "192.168.1.1"
5. Serve openwrt-mediatek-filogic-cudy_wr3000p-v1-ubootmod-initramfs-recovery.itb
using TFTP server.
6. Connect Router LAN with PC LAN.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt initramfs recovery has booted,
clean "/dev/mtd5" ubi partition to utilize maximum of free space:
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Perform sysupgrade.
Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21943
Signed-off-by: Robert Marko <robimarko@gmail.com>
The 'phy-connection-type' property is unnecessary and can be removed.
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22575
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is a cosmetic change. The device uses the MT7992AV chip.
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22575
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The RTL8261BE 10GbE PHY's `reset-deassert-us` was set to 100ms (100000us),
but the **RTL8261N datasheet (Table 108, parameter t7)** specifies a
minimum **SMI-ready time of 150ms** after nRESET release before the MDIO
(SMI) bus can be used.
Note: Essentially, the RTL8261N and RTL8261BE are architecturally identical
chips, so their initialization parameters should be consistent.
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22575
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
- Update network port names based on the shell
- Fix boot log errors:
OF: /soc/pcie@11280000/pcie@0,0: Missing device_type
- Match vendor firmware Ethernet and wireless MAC addresses
LAN MAC 50:xx:xx:xx:xx:60
WAN MAC 50:xx:xx:xx:xx:61
2G MAC 50:xx:xx:xx:xx:63
5G MAC 50:xx:xx:xx:xx:65
Fixes: 7d79346581 ("mediatek: filogic: add support for Tenda BE12 Pro")
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/22060
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
- Fix RTL8261N 10GbE PHY `reset-deassert-us` from 100ms to 221ms to meet datasheet minimum SMI-ready timing (t7 >= 150ms), fixing intermittent boot stalls caused by MDIO bus instability
- Add missing WLAN toggle button (GPIO 34) present in stock firmware but absent from OpenWrt DTS
- Fix memory size from 1 GB to the actual 512 MB
Fix 1: The RTL8261N 10GbE PHY's `reset-deassert-us` was set to 100ms (100000us), but the **RTL8261N datasheet (Table 108, parameter t7)** specifies a minimum **SMI-ready time of 150ms** after nRESET release before the MDIO (SMI) bus can be used.
With only 100ms, the kernel attempts MDIO bus access before the RTL8261N's SMI interface is stable. Since the RTL8261N (mdio-bus:00) and the internal MT7988 2.5GbE PHY (mdio-bus:0f) share the same MDIO bus, a not-yet-ready RTL8261N disrupts all MDIO traffic, causing the 2.5GbE PHY firmware loading (`mt798x_2p5ge_phy_config_init`) to stall.
Observed symptoms on warm reboot:
- Sometimes `mt798x_2p5ge_phy_config_init` hangs for 5+ minutes or indefinitely
- RCU CPU stalls (`rcu: INFO: rcu_sched detected stalls on CPUs`)
- mt7996e WiFi chip message timeouts cascading to `chip full reset failed`
- System appears hung with only power LED blinking slowly
UART serial log evidence (warm reboot with 100ms):
```
[ 73.041756] rcu: INFO: rcu_sched self-detected stall on CPU
[ 73.048341] rcu: 2-....: (8 ticks this GP)
[ 73.061641] pc : mt798x_2p5ge_phy_config_init+0x258/0xbb0
[ 73.061653] lr : mt798x_2p5ge_phy_config_init+0x238/0xbb0
...
[ 334.771280] MediaTek MT7988 2.5GbE PHY mdio-bus:0f: Firmware date code: 2024/10/30
```
The 2.5GbE PHY firmware loading, which normally takes ~3 seconds, took **325 seconds** due to MDIO bus instability. In the worst case, the system never recovers.
GPL DTS uses 221ms (`reset-deassert-us = <221000>`), providing 71ms of margin above the 150ms datasheet minimum. All MediaTek MT7988 reference board DTS files in the GPL use this same 221ms value.
Fix 2: Missing WLAN button (GPIO 34)
The BE450 has a physical WLAN toggle button on GPIO 34, defined in the stock TP-Link GPL DTS but missing from the OpenWrt DTS. Without this definition, the button is non-functional under OpenWrt.
The pin name for GPIO 34 in the MT7988 pinctrl is `SPI2_MISO`, confirmed by the kernel pinctrl driver (`pinctrl-mt7988.c`: `MT7988_PIN(34, "SPI2_MISO")`) and the official devicetree binding (`mediatek,mt7988-pinctrl.yaml`).
Note: GPIO 34 is also used by the BE450's First U-Boot as a recovery button (web recovery 192.168.1.1). Registering it in the DTS ensures the kernel claims the pin.
Fix 3: Incorrect memory size in DTS
The OpenWrt DTS declares 1 GB (`0x40000000`) of RAM, but the BE450 has 512 MB (`0x20000000`).
Run tested.
Signed-off-by: Semih Baskan <strst.gs@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22386
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
