The web-recovery of the Genexis EX400 validates uploaded images to fit
in the rootf_0 partition.
With OpenWrt, only the kernel is stored in this partition, leaving the
partition very small. Currently, the first factory release image won't
be accepted by the recovery interface after the OpenWrt installation.
Pad the image of the ubifs to 10MB. This allows the 24.10 release image
to be uploaded, enabling device recovery.
Signed-off-by: David Bauer <mail@david-bauer.net>
Clean the temporary directory the UBI image is generated from before
generation.
Currently it is removed after the image generation, which leads to files
possibly not being cleared after a build failure in this step.
Signed-off-by: David Bauer <mail@david-bauer.net>
This is the same hardware as the Cudy WR2100 that's
had support for some time now, just without the WLAN
hardware.
This PR is mostly copied from the commit that added
support for the WR2100, here: 3501db9
Specifications:
SoC: MT7621
CPU: 880 MHz
Flash: 16 MiB
RAM: 128 MiB
Ethernet: 5x Gbit ports
Installation:
There are two known options:
The Luci-based UI.
Press and hold the reset button during power up.
The router will request 'recovery.bin' from a TFTP server at
192.168.1.88.
Both options require a signed firmware binary.
A signed firmware can be found in GitHub PR #18532.
R4 & R5 need to be shorted (0-100Ω) for the UART to work.
Link: https://github.com/openwrt/openwrt/pull/18532
Signed-off-by: David DeGraw <degraw@fastmail.com>
Add the necessary package dependencies as well as device-tree properties
to support the touch-inputs as well as missing LEDs on the Genexis Pulse
EX400 range extender.
Signed-off-by: David Bauer <mail@david-bauer.net>
This sub-target is source only now. We don't need to disable build
for specific devices.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/18745
Signed-off-by: Robert Marko <robimarko@gmail.com>
The factory image generation for the Genexis EX400 image currently fails
if CONFIG_TARGET_ROOTFS_INITRAMFS is disabled.
Create the factory image only if said config option is enabled to avoid
failing builds.
Signed-off-by: David Bauer <mail@david-bauer.net>
Specification:
- MT7620A 580 MHz MIPS24KEc
- 64MB RAM
- 8MB SPI NOR
- MediaTek MT7612E 5.0GHz 802.11a/n/ac
- MediaTek MT7620 2.4GHz 802.11b/g/n
- 5 LEDs (white)
- 1 button
- 1 Gbit port Realtek RTL8211E GbE Phy
Serial Interface:
- 3 Pins GND, RX, TX
- Settings: 57600, 8N1
Based on support from edimax_ew-7476rpc/edimax_ew-747x
and netgear_ex3700/netgear_ex3x00_ex61xx
Notes:
- ATM there is no known way to revert to stock firmware
Flash instruction:
The only known way to flash OpenWrt image is to use tftp in U-Boot, with the
aid of a serial adapter for U-Boot console access:
1. Open the device and connect to the serial port. The device is very similar
to Edimax 7476RPC. See https://openwrt.org/toh/edimax/ew-7476rpc. No VCC!
2. Configure PC with static IP 192.168.1.2/24 and tftp server and
connect PC to device using an ethernet cable.
3. Power on the device and, on the serial console, as soon as U-Boot starts
loading, press "2" to interrupt loading.
4. Enter device ip address 192.168.1.1, PC ip address 192.168.1.2
and the firmware filename placed on the TFTP server.
5. Device will download file from server, write it to flash and reboot.
Signed-off-by: Hugo Monteiro <monteiro.hugo@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16956
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The Xiaomi MiWiFi 3A wireless router has a similar system architecture as the Xiaomi Mi 4A router, which is already officially supported by OpenWrt.
Product website: https://www.mi.com/miwifi3a
Device specification
--------------------
SoC: MT7628AN MIPS_24KEc @ 580 MHz 2.4G-bgn 2x2
WiFi: MT7612EN 5G-an, ac 80 MHz 2T2R
Flash: 16 MB
DRAM: 64 MB
Switch: MT7628AN (integrated in SoC)
Ethernet: 1 x 10 /100 Mbps
USB: None
Antennas: 2 x 2,4 GHz and 2 x 5 GHz (all are external and non-detachable)
LEDs: blue/red/amber
Buttons: Reset
Serial: 115200,8n1
MAC addresses as verified by OEM firmware:
------------------------------------------
use address source
LAN *:DD factory 0x28
WAN *:DD factory 0x28
2g *:DE factory 0x4
5g *:DF factory 0x8004
OEM firmware uses VLAN's to create the network interface for WAN and LAN.
Bootloader info:
----------------
The stock bootloader uses a "Dual ROM Partition System".
OS1 is a deep copy of OS2.
The bootloader starts OS2 by default.
To force start OS1 it is needed to set "flag_try_sys2_failed=1".
How to install:
---------------
1- Use OpenWRTInvasion to gain Telnet, SSH and FTP access: https://github.com/acecilia/OpenWRTInvasion
[IP: 192.168.31.1 | Username: root | Password: root | FTP-Port: 21]
2- Connect to router using telnet or ssh.
3- Backup all partitions. Use command "dd if=/dev/mtd0 of=/tmp/mtd0". Copy /tmp/mtd0 to computer using ftp.
4- Copy openwrt-ramips-mt76x8-xiaomi_miwifi-3a-squashfs-sysupgrade.bin to /tmp in router using ftp.
5- Enable UART access and change start image to OS1.
nvram set uart_en=1
nvram set flag_last_success=1
nvram set boot_wait=on
nvram set flag_try_sys2_failed=1
nvram commit
6- Erase OS1 & OS2 and install OpenWrt
mtd erase OS1
mtd erase OS2
mtd -r write /tmp/openwrt-ramips-mt76x8-xiaomi_miwifi-3a-squashfs-sysupgrade.bin OS1
Credits:
--------
This PR is based on the work of Zehao Zhang (Github: @ZZH-Finalize) that he had published in the PR: #15698
Signed-off-by: Olgun Demir <olgun.demir@mail.com.tr>
Link: https://github.com/openwrt/openwrt/pull/18427
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specifications:
SoC: Mediatek MT7621AT (880 MHz MIPS dual-core, quad-thread, CPU)
512 Megabyte DDR3 SDRAM
32 Megabyte NOR Flash
4 Gigabit RJ45 PoE ports
2 MT7615N wifi chips (2.4GHz and 5GHz)
2 USB ports (1xUSB2 and 1xUSB3 - GL3510 chip)
RJ45 RS232 port on front panel (Max3232 chip)
2x mPCIe 2.0 slots for 4G/5G cards
2x SIM slot
1x SDCard Slot
Power via DC12V
4x Cell Antennae
4x Wifi Antennae
MAC Address Locations:
Purpose Ex. Partition Offset
2.4 Ghz *:01 factory 0x4
5 GHz *:02 factory 0x8004
LAN *:03 factory 0xe000
WAN *:04 factory 0xe006
MAC address prefix E4:3A:65 is registered to MofiNetwork Inc
and used as the prefix for all MAC addresses.
Manual: https://mofinetwork.com/files/MoFi_Network_MOFI5500_5GXeLTE_EM7690_SPECS.pdf
WiFi chip specs: https://www.mediatek.com/products/broadband-wifi/mt7615
CPU chip specs: https://www.mediatek.com/products/home-networking/mt7621
Teardown Pictures: https://fccid.io/2AE6X-MOFI5500/Internal-Photos/Internal-Photos-5591739
Installation:
Update Mofi 5500 to at least stock firmware version 4.8.6. (Available on the Mofi website.)
Previous versions are untested in the upgrade process. Log into the LuCI web interface,
usually at 192.168.10.1 and visit the 'System->Backup/Flash Firmware' page.
Upload and flash the firmware as usual.
Note to Maintainers: Do not remove SUPPORTED_DEVICES from the Makefile!
The customized Mofi version of OpenWRT (stock firmware) expects to see mofi5500 as the device
name. The stock firmware does not allow for forcing an installation.
Without this line, users cannot upload the new firmware through the stock Mofi firmware.
This device uses cell modems that could use QMI or MBIM.
Add LuCI Modem Manager to allow people to use these. Also, if they have
two cell network cards, ethernet, USB, or other kinds of networks, they may wish
to use MWAN3 to allow failover amongst their networks.
Please compile it with mwan3 for multiple WAN connections.
Co-authored-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Signed-off-by: Rick Mac Gillis <noreply@rickmacgillis.com>
Specification:
SoC: MediaTek MT7628AN
RAM: 128 MB, Zentel A3R1GE40JBF-8E
Flash: 16MB, Winbond W25Q128JV
Switch: rt3050-esw, 2 ports 100 Mbps
WiFi: MediaTek mt7628-wmac 2.4GHz 802.11n and MediaTek MT7663 5GHz
802.11ac (PCIe)
WWAN: Quectel EC200A-EL 4G modem (USB)
GPIO:
* 1 button (Reset/WPS)
* 6 LEDs (Power+WPS, LAN, 3xSignal)
* USB port power controls
* Modem reset
* Modem programming switch
* Internal/external antenna switch for 4G
Serial Interface:
TP10 - 3.3V can be used for level shifter, if needed
TP9 - TX
TP8 - RX
TP11 - GND
Interface properties: 115200, 8N1
Access to console using serial port for OEM firmware:
Username: admin
Password: 1234
Flashing via TFTP (no disassembling or soldering required):
1. Connect your PC and router to port LAN
2. Configure PC interface using static IP 192.168.1.225, mask
255.255.255.0
3. Place OpenWRT firmware image (*-squashfs-tftp-recovery.bin) to TFTP
root folder and renamed it to tp_recovery.bin
4. Unplug power from router
5. Press and hold Reset/WPS button
6. Power up the router
7. Wait until TFTP started uploading image (~10 seconds after power up)
and release Reset/WPS button
8. Wait until image uploaded, i.e. until LAN LED start lighting
9. Enable DHCP address on PC interface and wait for assigning address
10. Use ssh (root@192.168.1.1) to configure router properties
Depends on patch for firmware-utils package:
https://github.com/openwrt/firmware-utils/commit/2051fe5b
Signed-off-by: Sergii Shcherbakov <shchers@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17819
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
SoC: MediaTek MT7628AN
RAM: 128M DDR2, ESMT M14D128168A (2Y)
Flash: 32M, cFeon EN25QH256A (Dual Boot on OEM, concatenated on OpenWrt,
SPI)
Switch: MediaTek MT7628AN, 3 ports 100 Mbps
WiFi: MediaTek MT7628AN 2.4 GHz 802.11n
USB: 1 port USB 2.0
GPIO: 1 button (Wi-Fi & Reset on OEM, Reset on OpenWrt), 3 LEDs (Power,
Internet, Wi-Fi), USB port power controls
Disassembly:
There are 2 screws at the bottom near the LEDs hidden by rubber mounts.
After removing the screws, pry the gray plastic part around (it is secured
with latches) and remove it.
UART Interface:
The UART interface can be connected to the 5 pin located between LAN
ports and the WAN one.
Pins (from the second LAN port to the WAN one): VCC, TX, RX, NC, GND
Settings: 115200, 8N1
Flashing via TFTP:
1. Connect your PC and router to the first LAN port, configure PC
interface using IP 192.168.1.2, mask 255.255.255.0
2. Serve the firmware image (for OpenWrt it is *-squashfs-factory.bin)
renamed to KN-1221_recovery.bin via TFTP
3. Power up the router while pressing Wi-Fi button
4. Release Wi-Fi button when Power LED starts blinking
To revert back to OEM firmware:
The return to the OEM firmware is carried out by using the methods
described above with the help of the appropriate firmware image found on
osvault.keenetic.net.
When using OEM bootloader, the firmware image size cannot exceed the size
of one OEM «Firmware_x» partition or Kernel + rootFS size.
Signed-off-by: Ivan Davydov <lotigara@lotigara.ru>
Link: https://github.com/openwrt/openwrt/pull/18164
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for Maginon MC-1200AC.
Hardware specifications:
SoC: MediaTek MT7621
Flash: 16 MB SPI Flash
RAM: 128 MB RAM
Ethernet:
2x 1G RJ45 ports
WLAN:
2.4GHz: MediaTek MT7603E
5GHz: MediaTek MT7613BE
LEDs: Red and blue status lights
Power: 12V DC
UART: 3.3V, 115200 baud, 8N1, like printed on silkscreen (GND,TX,RX,3.3V)
MAC addresses
-------------
+---------+-------------------+
| | MAC example |
+---------+-------------------+
| LAN | 80:3F:5D:xx:xx:72 |
| WAN | 80:3F:5D:xx:xx:73 |
| WLAN 2g | 80:3F:5D:xx:xx:74 |
| WLAN 5g | 80:3F:5D:xx:xx:75 |
+---------+-------------------+
Installation:
The firmware can be flashed via the U-Boot recovery web interface.
To access it, hold the reset button while powering on the device.
U-Boot recovery web interface is then avaiable at 192.168.10.1.
Alternatively, the image can be loaded using the U-Boot serial interface and TFTP.
Signed-off-by: Simon Etzlstorfer <simon@etzi.at>
Link: https://github.com/openwrt/openwrt/pull/17671
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The Zyxel LTE7490-M904 is an 802.3at PoE powered LTE outdoor (IP68) CPE
with integrated directional antennas.
Specifications:
- SoC: MediaTek MT7621AT
- RAM: 256 MB
- Flash: 128 MB MB NAND (MX30LF1G18AC)
- WiFi: MediaTek MT7603E 802.11b/g/n
- Switch: 1 LAN port (1 Gbps)
- LTE/3G/2G: Quectel EG18-EA LTE-A Cat. 18 connected by USB3 to SoC
- SIM: 1 micro-SIM slots under transparent cover
- Buttons: Reset, WLAN under same cover
- LEDs: Multicolour green/red/amber under same cover (visible)
- Power: 802.3at PoE via LAN port
The device is built as an outdoor ethernet to LTE bridge or router.
The wifi interface is intended for installation and/or temporary
management purposes only.
UART Serial:
57600N1, located on populated 5 pin header J5:
[o] GND
[ ] key - no pin
[o] RX
[o] TX
[o] 3.3V Vcc
Remove the SIM/button/LED cover and 12 screws holding the back plate
and antenna cover together. Be careful with the cables.
Installation from OEM web GUI:
- Log in as "admin" on OEM web GUI
- Upload OpenWrt initramfs-recovery.bin image on the
Maintenance -> Firmware page
- Wait for OpenWrt to boot and ssh to root@192.168.1.1
- Sysupgrade to the OpenWrt sysupgrade image and reboot
For more details about flashing see:
2449a63208 (ramips: mt7621: Add support for ZyXEL NR7101, 2021-04-19)
Main porting work done by Ernesto Castellotti <ernesto@castellotti.net>:
bf1c12f68b (ramips: add support for ZyXEL LTE7490-M904, 2023-12-20)
Signed-off-by: Eric Schäfer <eric@es86.de>
Link: https://github.com/openwrt/openwrt/pull/17485
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The M1200 v1 is similar to the TR1200 series from Cudy. Differences:
- Only 1 LAN port
- No USB
Specifications:
- MT7628
- MT7628AN (2.4G b/g/n) and MT7613BE (5G ac/n) wifi
- 128 MB RAM
- 16 MB flash
MAC Addresses:
- There is one on the label, e.g. xx:xx:xx:xx:xx:A4
- LAN (bottom connector) is the same as the label, e.g. xx:xx:xx:xx:xx:A4
- WAN (top connector) is label + 1, e.g. xx:xx:xx:xx:xx:A5
- WLAN (2.4G) is the same as the label, e.g. xx:xx:xx:xx:xx:A4
- WLAN (5G) is label + 2, e.g. xx:xx:xx:xx:xx:A6
UART:
- is available via the pin holes on the board
- The pinout is printed to the board: P: VCC, G: GND, R: RX, T:TX
- RX and TX require solder bridges to be installed
- Do NOT connect VCC
- Settings: 3.3V, 115200, 8N1
GPIO:
- There are two LEDs: Red (GPIO 4) and White (GPIO 0)
- There are two buttons: Reset (GPIO 11) and WPS (GPIO 5)
Migration to OpenWrt:
- Download the migration image from the Cudy website (it should be available as soon as OpenWrt officially supports the device)
- Connect computer to LAN (bottom connector) and flash the migration image via OEM web interface
- OpenWrt is now accessible via 192.168.1.1
Revert back to OEM firmware:
- Set up a TFTP server on IP 192.168.1.88 and connect to the WAN port (upper port)
- Provide the Cudy firmware as recovery.bin in the TFTP server
- Press the reset button while powering on the device
- Recovery process is started now
- When recovery process is done, OEM firmware is accessible via 192.168.10.1 again
General information:
- No possibility to load a initramfs image via U-Boot because there is no option to interrupt U-Boot
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18233
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Instead of hardcoded metadata, put some sensible data instead.
Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>
Link: https://github.com/openwrt/openwrt/pull/17551
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add support for Genexis Pulse EX400 / Inteno Pulse EX400. A branded
variant for the Finnish ISP DNA has already been added in fea2264d9f
(ramips: mt7621: Add DNA Valokuitu Plus EX400, 2023-07-31). This commit
adds support for the generic variants with Inteno and Genexis branding.
Inteno changed its name to Genexis and both brandings exist.
In terms of electronics, there is no difference between the DNA-branded
version and other brandings. LED markings on the case are different,
though. While the DNA-version has a "software-update" LED, the other
versions have a WPS LED. To reduce user confusion, create a separate
image.
Add the different device-tree with the different LED and rename things
to work the same way for both variants.
Specifications:
- Device: Genexis Pulse EX400 / Inteno Pulse EX400
- SoC: MT7621A
- Flash: 256 MB NAND
- RAM: 256 MB
- Ethernet: Built-in, 2 x 1 GbE
- Wifi: MT7603 2.4 GHz 2x2 MIMO, MT7615 5 GHz 4x4 MU-MIMO
- USB: 1x 2.0
- LEDs (GPIO): green/red status, green WPS
- LEDs (SX9512, unsupported): Broadband, Wi-Fi 2.4G, Wi-Fi 5G
- Buttons (GPIO): Reset
- Buttons (SX9512, unsupported): Wi-Fi 2.4G, Wi-Fi 5G, WPS
MAC addresses:
- LAN: U-Boot 'ethaddr' (label)
- WAN: label + 1
- 2.4 GHz: label + 6
- 5 GHz: label + 7
Serial:
There is a black block connector next to the red ethernet connector. It
is accessible also through holes in the casing.
Pinout (TTL 3.3V)
+---+---+
|Tx |Rx |
+---+---+
|Vcc|Gnd|
+---+---+
Firmware:
The vendor firmware is a fork of OpenWrt (Reboot) with a kernel version
4.4.93. The flash is arranged as below and there is a dual boot
mechanism alternating between rootfs_0 and rootfs_1.
+-------+------+------+-----------+-----------+
| | env1 | env2 | rootfs_0 | rootfs_1 |
| +------+------+-----------+-----------+
| | UBI volumes |
+-------+-------------------------------------+
|U-Boot | UBI |
+-------+-------------------------------------+
|mtd0 | mtd1 |
+-------+-------------------------------------+
| NAND |
+---------------------------------------------+
In OpenWrt rootfs_0 will be used as a boot partition that will contain the
kernel and the dtb. The squashfs rootfs and overlay are standard OpenWrt
behaviour.
+-------+------+------+-----------+--------+------------+
| | env1 | env2 | rootfs_0 | rootfs | rootfs_data|
| +------+------+-----------+--------+------------+
| | UBI volumes |
+-------+-----------------------------------------------+
|U-Boot | UBI |
+-------+-----------------------------------------------+
|mtd0 | mtd1 |
+-------+-----------------------------------------------+
| NAND |
+-------------------------------------------------------+
U-boot:
With proper serial access, booting can be halted to U-boot by pressing
any key. TFTP and flash writes are available, but only the first one has
been tested.
NOTE: Recovery mode can be accessed by holding down the reset button while
powering on the device. The led 'Update' will show a solid green light
once ready. A web server will be running at 192.168.1.1:80 and it will
allow flashing a firmware package. You can cycle between rootfs_0 and
rootfs_1 by pressing the reset button once.
Root password:
With the vendor web UI create a backup of your settings and download the
archive to your computer. Within the archive in the file
/etc/shadow replace the password hash for root with that of a password you
know. Restore the configuration with the vendor web UI and you will have
changed the root password.
SSH access:
You might need to enable the SSH service for LAN interface as by default
it's enabled for WAN only.
Installing OpenWrt:
With the vendor web UI, or from the U-Boot recovery UI, install the
OpenWrt factory image. Alternatively, ssh to the device and use
sysupgrade -n from cli.
Finalize by installing the OpenWrt sysupgrade image to get a fully
functioning system.
Reverting to the vendor firmware:
Boot with OpenWrt initramfs image
- Remove volumes rootfs_0, rootfs and rootfs_data and create vendor
volumes.
ubirmvol /dev/ubi0 -n 2
ubirmvol /dev/ubi0 -n 3
ubirmvol /dev/ubi0 -n 4
ubimkvol /dev/ubi0 -N rootfs_0 -S 990
ubimkvol /dev/ubi0 -N rootfs_1 -S 990
Power off and enter to the U-boot recovery to install the vendor
firmware.
Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>
Link: https://github.com/openwrt/openwrt/pull/17551
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is an industrial 4G router equipped with OpenWrt 14.07 OEM
customized version
WARNING: The original firmware device tree is common to multiple
boards, and the device tree name is H9350. This submitted device
tree is a modified version, which deletes the non-this-device parts
and adds GPIO watchdog.
Specification:
- SoC: MediaTek MT7620A
- Flash: 16 MB
- RAM: 128 MB
- Power: DC 5V-36V 1.5A
- Ethernet: 1x WAN, 4x LAN (10/100 Mbps)
- Wireless radio: 802.11n 2.4g-only
- LED:
System/Power (RUN): GPIO/26 active-low
Ethernet: 1x WAN, 4x LAN
Modem 1: GPIO/66 active-low
RF 1 (Modem 1 Signal): GPIO/67 active-low
Modem 2: GPIO 71 active-low
RF 2 (Modem 2 Signal): GPIO/24 active-low
WLAN: GPIO/72 active-low
WPS: GPIO/12 active-low
- Button:
WPS / RESET: GPIO/34 active-low
- UART: 1x UART on PCB - 115200 8N1
- GPIO Watchdog: GPIO/62 mode=toggle timeout=1s
- PCIe: 2x miniPCIe for modem
- SIM Slots: 2x SIM Slots
Issue:
- No factory partition, eeprom is located
at /lib/firmware/mt7620a.eeprom
Flash instruction:
Using UART:
1. Configure PC with a static IP address and setup an TFTP server.
2. Put rootfs into the tftp directory.
3. Connect the UART line as described on the PCB.
4. Power up the device and press Ctrl+C to break auto boot.
5. Use `system 6` command and follow the instruction to set device
and tftp server IP address and input the rootfs file name.
U-boot will then load the rootfs and write it into
the flash.
6. Use `system 1` command and follow the instruction to set device
and tftp server IP address and input the firmware file name.
U-boot will then load the firmware once.
7. Login to LuCI and use LuCI upgrade firmware.
Original Firmware Dump / More details:
https://blog.gov.cooking/archives/research-hongdian-h8922-and-flash.html
Signed-off-by: Coia Prant <coiaprant@gmail.com>
Tested-by: Coia Prant <coiaprant@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17472
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The M1300 v2 is similar to the WR1300 series from Cudy. Differences:
- Only 1 LAN port
- No USB
Specifications:
- MT7621
- MT7603E (2.4G b/g/n) and MT7613BE (5G ac/n) wifi
- 128 MB RAM
- 16 MB flash
MAC Addresses:
- There is one on the label, e.g. xx:xx:xx:xx:xx:1C
- LAN (bottom connector) is the same as the label, e.g. xx:xx:xx:xx:xx:1C
- WAN (top connector) is label +2, e.g. xx:xx:xx:xx:xx:1E
- WLAN (2.4G) is the same as the label, e.g. xx:xx:xx:xx:xx:1C
- WLAN (5G) is the same as WAN, e.g. xx:xx:xx:xx:xx:1E
UART:
- is available via the pin holes on the board
- From inner to outer pin: TX, RX, GND, VCC
- Do NOT connect VCC
- Settings: 3.3V, 115200, 8N1
GPIO:
- There are two LEDs: Red (GPIO 3) and White (GPIO 4)
- There are two buttons: Reset (GPIO 8) and WPS (GPIO 10)
Migration to OpenWrt:
- Download the migration image from the Cudy website (it should be available as soon as OpenWrt officially supports the device)
- The migration image is also available here until a image is provided by Cudy: https://github.com/RolandoMagico/openwrt-build/releases/tag/M1300_Build_20240222
- File: openwrt-ramips-mt7621-cudy_m1300-v2-squashfs-flash-signed.bin
- Connect computer to LAN (bottom connector) and flash the migration image via OEM web interface
- In the migration image, LAN and WAN are swapped. Computer must be connected to the other port after flashing
- OpenWrt is now accessible via 192.168.1.1
- After flashing an up to date OpenWrt image, LAN and WAN settings are again the same as in the OEM firmware
- So use the other connector again
Revert back to OEM firmware:
- Set up a TFTP server on IP 192.168.1.88 and connect to the LAN port (lower port)
- Provide the Cudy firmware as recovery.bin in the TFTP server
- Press the reset button while powering on the device
- Recovery process is started now
- When recovery process is done, OEM firmware is accessible via 192.168.10.1 again
General information:
- No possibility to load a initramfs image via U-Boot because there is no option to interrupt U-Boot
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18139
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Both share the same OEM firmware but differ in product_name for safeloader
product_name:MR1800X,product_ver:1.0.0,special_id:45550000
Signed-off-by: Robert Senderek <robert.senderek@10g.pl>
Link: https://github.com/openwrt/openwrt/pull/17965
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Fixed the 5G mac address on KN-1910, rolled back the image size to stock
(there are no errors with loading large images in version 24.10.0),
minor spelling errors.
Signed-off-by: Anton Yu. Ivanusev <ivanusevanton@yandex.ru>
Link: https://github.com/openwrt/openwrt/pull/17946
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is a MT7621-based device with 128MB NAND flash, 256MB RAM, and a USB port.
It is identical hardware to the already supported TP-Link ER605 v2 right
down to the PCB ID. The only differences are the color of the case and
the factory firmware features.
Signed-off-by: Raylynn Knight <rayknight@me.com>
Link: https://github.com/openwrt/openwrt/pull/17728
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The image size has been changed to prevent failures in routers and bootloop
when flashing a large image using a stock bootloader. The LED trigger
package has been removed for 1910, which is no longer in use.
Signed-off-by: Anton Yu. Ivanusev <ivanusevanton@yandex.ru>
Link: https://github.com/openwrt/openwrt/pull/17630
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
SoC: MediaTek MT7621A
RAM: 128M DDR3, Winbond W631GG6MB-12 (DDR3-1600) or Winbond W631GG6MB-11
Flash: 128M, Macronix MX30LF1G18AC-TI (Dual Boot, Parallel-NAND)
Switch: MT7530, 5 ports 1Gbps
WiFi: MT7615DN, 2.4GHz 802.11n and 5GHz 802.11ac
USB: 2 ports USB 2.0
GPIO: 4 buttons (Wi-Fi, Reset, FN1, FN2), 4 LEDs (Power, Internet, FN, Wi-Fi), USB port power controls
LAN: RF-EEPROM + 0x04
WAN: RF-EEPROM + 0x28
2.4 GHz: RF-EEPROM + 0x04
5 GHz: 2.4GHz + 82:00:00:00:00:00
Disassembly:
There are 2 screws at the bottom. After removing the screws, pry the gray plastic part around (it is secured with latches) and remove it.
Serial Interface:
The serial interface can be connected to the 4 pin dots to the left of the radiator.
Pins (from LAN ports to LEDs):
3.3V (do not connect)
TX
RX
GND
Settings: 57600, 8N1
Flashing via OEM recovery software:
1. Download the OEM recovery software from the manufacturer's website
2. Download the firmware image (for OpenWRT it is *-squashfs-factory.bin), rename it to KN-1910_recovery.bin
3. Replace the file in the fw folder OEM recovery software with the file from step 2.
4. Run the OEM recovery software and follow the instructions.
Flashing via TFTP:
1. Connect your PC and router to port 1-4, configure PC interface using IP 192.168.1.2, mask 255.255.255.252
2. Serve the firmware image (for OpenWRT it is *-squashfs-factory.bin) renamed to KN-1910_recovery.bin via TFTP
3. Power up the router while pressing Reset button on the back
4. Release Restart button when Power LED starts blinking
To revert back to OEM firmware:
The return to the OEM firmware is carried out by using the methods described above with the help of the appropriate firmware image.
Keenetic's bootloader supports booting a LZMA compressed kernel but seems to fail if the uncompressed data is larger than a fixed buffer therefore it is safer to use a uimage-lzma-loader. When using OEM bootloader, the firmware image size cannot exceed the size of one OEM «Firmware_x» partition or Kernel + rootFS size.
Signed-off-by: Anton Yu. Ivanusev <ivanusevanton@yandex.ru>
Link: https://github.com/openwrt/openwrt/pull/17381
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
SoC: MediaTek MT7628AN
RAM: 128 MB, ESMT M14D1G1664A (DDR2)
Flash: 32MB, Winbond 25Q256JVFQ (Dual Boot, SPI)
Switch: MediaTek MT7628AN, 5 ports 100 Mbps
WiFi: MediaTek MT7603 2T2R/2.4GHz 802.11n and MediaTek MT7613AEN 2T2R/5GHz 802.11ac
USB: 1 port USB 2.0
GPIO: 3 buttons (Wi-Fi, Reset, FN), 4 LEDs (Power, Internet, FN, Wi-Fi), USB port power controls
Disassembly:
At the bottom there are 4 screws hidden by rubber feet. After removing the screws, pry the gray plastic part around (it is secured with latches) and remove it.
Serial Interface:
The serial interface can be connected to the 4 pin dots to the left of the flash.
Pins (from LEDs to LAN ports):
3.3V (do not connect)
TX
RX
GND
Settings: 115200, 8N1
Flashing via OEM recovery software:
1. Download the OEM recovery software from the manufacturer's website
2. Download the firmware image (for OpenWRT it is *-squashfs-factory.bin), rename it to KN-1711_recovery.bin
3. Replace the file in the fw folder OEM recovery software with the file from step 2.
4. Run the OEM recovery software and follow the instructions.
Flashing via TFTP:
1. Connect your PC and router to port 1-4, configure PC interface using IP 192.168.1.2, mask 255.255.255.252
2. Serve the firmware image (for OpenWRT it is *-squashfs-factory.bin) renamed to KN-1711_recovery.bin via TFTP
3. Power up the router while pressing Reset button on the back
4. Release Restart button when Power LED starts blinking
To revert back to OEM firmware:
The return to the OEM firmware is carried out by using the methods described above with the help of the appropriate firmware image.
When using OEM bootloader, the firmware image size cannot exceed the size of one OEM «Firmware_x» partition or Kernel + rootFS size.
Signed-off-by: Anton Yu. Ivanusev <ivanusevanton@yandex.ru>
Link: https://github.com/openwrt/openwrt/pull/17519
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This adds a new port for the above device.
Currently, there is no easy installation method except
opening the device up and soldering a UART header on and
getting u-boot shell access. You boot the initramfs version
first using tftpboot, then once booted, you sysupgrade.
Shell access to root on vendor firmware:
admin:1234
To get U-Boot console, spam '4' into the serial console at boot.
with LEDs on the left, serial pinout is:
o - tx
o - rx
o - gnd
x - 3v3
server ip for tftpboot
192.168.0.225
The initramfs-kernel version boots without touching onboard flash with:
MT7628# tftpboot 0x80000000 openwrt-ramips-mt76x8-tplink_archer-mr200-v6-initramfs-kernel.bin
MT7628# bootm 0x80000000
Then when it boots off RAM, you copy
openwrt-ramips-mt76x8-tplink_archer-mr200-v6-squashfs-sysupgrade.bin
to /tmp/sysupgrade.bin of the device and run:
root@OpenWrt:/tmp# sysupgrade -n sysupgrade.bin
- [x] LEDs working
- [x] Buttons working
- [x] wlan detected
- [x] wwan detected
- [x] initramfs image working
- [x] sysupgrade working
Signed-off-by: Damien Zammit <damien@zamaudio.com>
Link: https://github.com/openwrt/openwrt/pull/15610
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
SoC: MediaTek MT7628AN
RAM: 128M DDR2, Etron Technology EM68C16CWQG-25H
Flash: 32M, cFeon EN25QH256A (Dual Boot, SPI)
Switch: MediaTek MT7628AN, 4 ports 100 Mbps
WiFi: MediaTek MT7628AN 2.4 GHz 802.11n and MediaTek MT7613BEN 5 GHz 802.11ac
USB: 1 port USB 2.0
GPIO: 3 buttons (Wi-Fi, Reset, FN), 4 LEDs (Power, Internet, FN, Wi-Fi), USB port power controls
Disassembly:
There are 2 screws at the bottom. After removing the screws, pry the gray plastic part around (it is secured with latches) and remove it.
UART Interface:
The UART interface can be connected to the 5 pin located between the WAN port and the RESET button.
Pins (from WAN port to Reset button): VCC, TX, RX, NC, GRD
Settings: 115200, 8N1
Flashing via OEM recovery software:
1. Download the OEM recovery software from the manufacturer's website
2. Download the firmware image (for OpenWRT it is *-squashfs-factory.bin), rename it to KN-1713_recovery.bin
3. Replace the file in the fw folder OEM recovery software with the file from step 2.
4. Run the OEM recovery software and follow the instructions.
Flashing via TFTP:
1. Connect your PC and router to port 1-3, configure PC interface using IP 192.168.1.2, mask 255.255.255.252
2. Serve the firmware image (for OpenWRT it is *-squashfs-factory.bin) renamed to KN-1713_recovery.bin via TFTP
3. Power up the router while pressing Reset button on the back
4. Release Restart button when Power LED starts blinking
To revert back to OEM firmware:
The return to the OEM firmware is carried out by using the methods described above with the help of the appropriate firmware image.
When using OEM bootloader, the firmware image size cannot exceed the size of one OEM «Firmware_x» partition or Kernel + rootFS size.
Signed-off-by: Anton Yu. Ivanusev <ivanusevanton@yandex.ru>
Link: https://github.com/openwrt/openwrt/pull/17382
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
After adding the correct package and pin group configurations,
the SDXC card slot can now function properly.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/17446
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Switch to using loader-kernel to accommodate
larger image sizes that are problematic for
many mt7621 uboots.
Signed-off-by: Jonathan Sturges <jsturges@redhat.com>
Link: https://github.com/openwrt/openwrt/pull/17389
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specifications:
- Device: ASUS 4g-AX56
- SoC: MT7621AT
- Flash: 128MB
- RAM: 512MB
- Switch: 1 WAN, 4 LAN (10/100/1000 Mbps)
- WiFi: MT7905 2x2 2.4G + MT7975 2x2 5G
- LTE : Fibocom FG621-EA
- LEDs: 1x POWER (white, configurable)
1x 2.4G (white, not configurable)
1x 5G (white, not configurable)
1x WAN (white, not configurable)
1x 3G/4G (white, not configurable)
3x signal (white, not configurable)
Flash by U-Boot TFTP method:
- Configure your PC with IP 192.168.0.2
- Set up TFTP server and put the factory.bin image on your PC
- Connect serial port(rate:115200) and turn on AP, then interrupt "U-Boot Boot Menu" by hitting any key
Select "2. Upgrade firmware"
Press enter when show "Run firmware after upgrading? (Y/n):"
Select 0 for TFTP method
Input U-Boot's IP address: 192.168.0.1
Input TFTP server's IP address: 192.168.0.2
Input IP netmask: 255.255.255.0
Input file name: openwrt-ramips-mt7621-asus_4g-ax56-squashfs-factory.bin
- Restart AP aftre see the log "Firmware upgrade completed!"
Notice:
- LTE module is disable after flash openwrt image so you must active LTE by following two AT command
echo -e "AT+GTAUTOCONNECT=1\r\n" > /dev/ttyUSB0
echo -e "AT+GTRNDIS=1,1\r\n" > /dev/ttyUSB0
- After finish AT command once, you don't need to input command later even if reboot/restore default
Signed-off-by: Chuncheng Chen <ccchen1984@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16752
Signed-off-by: John Crispin <john@phrozen.org>
Hardware
* Mediatek MT7620A + Mediatek MT7610EN
* 64MB RAM
* 8MB NAND (Winbond 25064FVSIG )
Both 2.4GHZ and 5GHZ are working, it is enabled by default since there is no
physical ethernet port in the device.
All LED's and buttons work.
UART: 57600 8N1 3.3V
Installation
Upload the openwrt-ramips-mt7620-trendnet_tha103ac-initramfs-kernel.bin via
the manufacturer firmware upgrade page on the device.
Upon reboot wait +- 3 mins until the green power LED is not flashing anymore
(do not be tempted to switch the device off while the LED is flashing, unless
you are ready for soldering and TTL) and then press the WPS button to enable
the default OpenWrt Wifi AP, the BLUE wifi LED will start flash.
Then install openwrt-ramips-mt7620-trendnet_tha103ac-squashfs-sysupgrade.bin
via OpenWrt.
The integrated power monitoring and relay do not work in OpenWrt as the PL7223
chip source/documentation is unavailable.
Recovery
Mis-configuration can be dealt with using the RESET button to reset to factory,
worst case scenario will require some serious work and soldering, there's pads
on the PCB for both the UART and ETH0, and I soldered and tested that it does
work.
You will have to power the board using the header pins GND & 5V, see the 8-pin
header socket.
Signed-off-by: Die Peter Pan <diepeterpan@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17114
Signed-off-by: John Crispin <john@phrozen.org>
Keenetic KN-3211 is a 2.4 Ghz band 11n (Wi-Fi 4) Wi-Fi repeater, based on MT7628AN.
Specification:
- System-On-Chip: MT7628AN
- CPU/Speed: 575 MHz
- Flash-Chip: Winbond w25q256
- Flash size: 32768 KiB
- RAM: 64 MiB
- 1x 10/100 Mbps Ethernet
- 2x external, non-detachable antennas
- UART (J1) header on PCB (115200 8n1)
- Wireless No1 (2T2R): SoC Built-in 2.4 GHz 802.11bgn
- 3x LED, 1x button, 1x mode switch
Notes:
- The device supports dual boot mode
- The firmware partitions were concatenated into one
- The status button has been reassigned as the WPS button.
Flash instruction:
This device doesn't support sysupgrade, so the only way to flash OpenWrt image
is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24 and tftp server.
2. Rename "openwrt-ramips-mt76x8-keenetic_kn-3211-squashfs-factory.bin"
to "KN-3211_recovery.bin" and place it in tftp server directory.
3. Connect PC with the ethernet port, press the reset button, power up
the router and keep button pressed until power led starts blinking.
4. Router will download file from server, write it to flash and reboot.
Signed-off-by: Ivan Davydov <lotigara@lotigara.ru>
Link: https://github.com/openwrt/openwrt/pull/17080
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is required for upcoming Keenetic KN-3911 support
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16830
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Code cleanup. Simplify and unify how kernel image is passed to
Build/dna-bootfs
Signed-off-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Link: https://github.com/openwrt/openwrt/pull/16811
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The Zbtlink ZBT-WE2426-B is an indoor dual band WiFi router
with 4 external non detachable antennas and 5 Fast Ethernet ports.
Hardware of ZBT-WE2426-B:
- SoC: MT7628AN
- RAM: 64 MB (Winbond W9751G6K8-25)
- Storage: 8 MB SPI flash (S25FL064K)
- Ethernet: 5x 10/100 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
- Wireless: 2.4GHz: on SoC (802.11b/g/n)
- Wireless: 5GHz: Mediatek MT7612EN (802.11n/ac)
- LEDs: 8x
- Buttons: 1x reset
- USB: 1x 2.0
- MicroSD slot: 1x
- Power: 9 VDC, 1 A
- Uart: GND TX RX PWR - J1 on the PCB
- Board silkscreen: "ZBT-WE2426-C V04" "2018-02-28" "CTT" "13 18"
Backup the stock firmware, settings and calibration data:
This router comes with PandoraBox OpenWrt firmware, so it is
possible to get all MTD partitions using scp.
Installation:
- Using the bootloader web server. Hold the reset button while turning
the power on. Upload the sysupgrade image on http://192.168.1.1.
- Using the sysupgrade command in PandoraBox OpenWrt.
LEDs:
- LAN1,LAN2,LAN3,LAN4,WAN,WLAN2G use GPIO pins of the MT7628AN SoC
(GPIOs 43,42,41,40,39,44)
- WLAN5G uses pin of MT7612EN.
- The POWER LED is directly connected to the VCC. It can be reconnected to
the GPIO 37 of the MT7628AN SoC by resoldering SMD resistor on the PCB.
Buttons:
- The RESET button is connected to the GPIO 38 of the MT7628AN SoC.
MAC addresses as verified by OEM firmware:
use address source
2g *:b0 factory 0x4 (label)
5g *:b1 factory 0x8004
LAN *:b2 factory 0x28
WAN *:b3 factory 0x2e
Signed-off-by: Vaclav Svoboda <svoboda@neng.cz>
Link: https://github.com/openwrt/openwrt/pull/16927
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
IMAGE_SIZE was previously set to kernel1 + ubi size = 256768k, now
kernel1 is 6MB adjust this value to add 3072k to total image size.
Signed-off-by: Tim Lunn <tim@feathertop.org>
Link: https://github.com/openwrt/openwrt/pull/15194
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Edgerouter-X factory images have not built automatically since 19.x due
to images being over 3MB. While it was possible to build custom images
with very stripped down config, this is no longer possible with the size
increases of linux 6.1 and 6.6.
Drop code for generation of factory images, if some dev later wishes to
try custom images they can revert this commit.
Signed-off-by: Tim Lunn <tim@feathertop.org>
Link: https://github.com/openwrt/openwrt/pull/15194
Signed-off-by: Petr Štetiar <ynezz@true.cz>
With the new layout providing 6MB for kernel there will be no issues
with kernel size affecting build of images.
Re-enable image builds for Edgerouter-X and X-SFP.
Signed-off-by: Tim Lunn <tim@feathertop.org>
Tested-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Link: https://github.com/openwrt/openwrt/pull/15194
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Refer user to the wiki page for instructions on how to migrate to the
new kernel layout.
Signed-off-by: Tim Lunn <tim@feathertop.org>
Tested-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Link: https://github.com/openwrt/openwrt/pull/15194
Signed-off-by: Petr Štetiar <ynezz@true.cz>
With the updated partition layout set in dts, set the KERNEL_SIZE
parameter to 6MB allowing builds of Linux 6.1 and later to fit.
Signed-off-by: Tim Lunn <tim@feathertop.org>
Tested-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Link: https://github.com/openwrt/openwrt/pull/15194
Signed-off-by: Petr Štetiar <ynezz@true.cz>
A factory image for DNA EX400 depends on an initramfs image and they
were explicitly removed from the imagebuilder recently. Now the factory
image creation fails miserably and it also affects custom image creation
with the firmware selector.
Add the initramfs kernel to the staging so that it's shipped with the
imagebuilder. Also remove a image build target added solely for DNA EX400.
Tested by creating a factory and syspupgrade images locally with
the imagebuilder and verified their functionality.
Related work
c85348d9ab ("imagebuilder: remove initramfs image files")
Fixes: fea2264d9f ("ramips: mt7621: Add DNA Valokuitu Plus EX400")
Signed-off-by: Mauri Sandberg <maukka@ext.kapsi.fi>
---
v4: use append-image-stage, remove Build/kernel-initramfs-bin
v3: adjust commit subject
v2: remove fix for inconsistent line ending elsewhere in the file
Link: https://github.com/openwrt/openwrt/pull/16659
Signed-off-by: Robert Marko <robimarko@gmail.com>
Drop kmod-i2c-ralink from ASUS RP-AC56 as it was wrongly added. Such
kmod is not supported on mt7621 as i2c is handled by the mediatek driver
and not bay the ralink downstream one.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
The Gemtek WVRTM-127ACN is an indoor dual band wifi router
with internal antennas and 3 Gigabit Ethernet ports.
The Gemtek WVRTM-130ACN is an indoor dual band wifi router
with external antennas and 5 Gigabit Ethernet ports.
Hardware of WVRTM-127ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB
- Storage: 128 MB NAND SLC flash
- Ethernet: 3x 10/100/1000 Mbps LAN1,LAN2 & WAN
- Wireless: 2.4GHz: Mediatek MT7603EN (802.11b/g/n)
- Wireless: 5GHz: Mediatek MT7612EN (802.11n/ac)
- LEDs: 11x
- Buttons: 2x WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ IN (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-127ACN_V02" "19K-513-8500R" "RoHS" "1717"
Hardware of WVRTM-130ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB (Kioxia TC58BVG0S3HTA00)
- Storage: 128 MB NAND SLC (Winbond W971GG6SB-25)
- Ethernet: 5x 10/100/1000 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
- Wireless: 2.4GHz and 5GHz Mediatek MT7615DN (802.11ac/b/g/n) (DBDC)
- LEDs: 10x
- Buttons: 3x Power, WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-130ACN_V01" "19K-515-4500R" "RoHS" "2112"
Enable access to uboot menu (needed in wvrtm-130acn):
- The access to uboot menu is blocked by `bootdelay = 0` set in ubootenv.
With stock firmware version 01.01.02.163 and previous, you can use CVE 2020-24365
command injection https://nvd.nist.gov/vuln/detail/CVE-2020-24365
python3 exploit.py -t 192.168.1.1 -c "fw_setenv bootdelay 3; fw_saveenv"
Backup the stock firmware:
- Connect via uart
- Connect via ethernet and assign your pc the address 192.168.15.x/24
- Power on the device; and start typing '4' to enter uboot menu
- Set factory mode and boot
MT7621 # setenv factory 2; saveenv
MT7621 # nand read 2800000 2000000 81000000; bootm
- Telnet and copy all mtd blocks
telnet 192.168.15.1
- Copy all mtd blocks and start webserver
for N in $(seq 0 6); do dd if=/dev/mtd$N of=/tmp/eeprom_mtd$N.bin; done
mount -o bind /tmp /www
lighttpd -f /etc/lighttpd.conf
- Backup stock rootfs_data (optional)
dd if=/dev/mtd7 of=/tmp/eeprom_mtd7.bin
dd if=/dev/mtd8 of=/tmp/eeprom_mtd8.bin
- Download to your pc from http://192.168.15.1/eeprom_mtd$N.bin
Installation:
- Connect via uart
- Connect via ethernet and assign your pc the address 10.10.10.3/24
- Start a tftp server and serve the image initramfs-kernel.bin
mkdir /tmp/ftpd;
cp initramfs-kernel.bin /tmp/ftpd/kernel.bin
dnsmasq --enable-tftp --tftp-root=/tmp/ftpd
- Power on the device; and start typing '4' to halt the bootloader
- Change the active mtd partition from mtd6 to mtd5 (needed by uboot)
MT7621 # setenv mtddevnum 5; saveenv
- Write the openwrt initramfs in ram via tftp and boot it
MT7621 # tftpboot 81000000 kernel.bin; bootm
- From the initramfs create the ubi device and install openwrt via sysupgrade
ubiformat /dev/mtd11 -y
sysupgrade -n -v /tmp/sysupgrade.bin
Recovery:
Restore the stock firmware from the backup of the mtd blocks
mtd write eeprom_mtd5.bin firmware
mtd write eeprom_mtd6.bin Kernel2
mtd write eeprom_mtd7.bin Storage1
mtd write eeprom_mtd8.bin Storage2
ubiformat /dev/mtd8 -y
reboot
Links to previous works on wvrtm-127acn:
https://github.com/digiampietro/hacking-gemtekhttps://forum.openwrt.org/t/add-support-for-gemtek-wvrtm-127acn-linkem-provider/168757
Signed-off-by: Samuele Longhi <agave@dracaena.it>
Link: https://github.com/openwrt/openwrt/pull/16685
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
