ALFA Network Quad-E4G is a universal Wi-Fi/4G platform, which offers
three miniPCIe (PCIe, USB 2.0, SIM) and a single M.2 B-key (dual-SIM,
USB 3.0) slots, RTC and five Gigabit Ethernet ports with PoE support.
Specification:
- MT7621A (880 MHz)
- 256/512 MB of RAM (DDR3)
- 16/32+ MB of FLASH (SPI NOR)
- optional second SPI flash (8-pin WSON/SOIC)
- 1x microSD (SDXC) flash card reader
- 5x 10/100/1000 Mbps Ethernet, with passive PoE support (24 V) in LAN1
- optional 802.3at/af PoE module for WAN
- 3x miniPCIe slot (with PCIe and USB 2.0 buses, micro SIM and 5 V)
- 1x M.2/NGFF B-key 3042 (USB 3.0/2.0, mini + micro SIM)
- RTC (TI BQ32002, I2C bus) with backup battery (CR2032)
- external hardware watchdog (EM Microelectronic EM6324)
- 1x USB 2.0 Type-A
- 1x micro USB Type-B for system serial console (Holtek HT42B534)
- 11x LED (5 for Ethernet, 5 driven by GPIO, 1x power indicator)
- 3x button (reset, user1, user2)
- 1x I2C (4-pin, 2.54 mm pitch) header on PCB
- 4x SIM (6-pin, 2.00 mm pitch) headers on PCB
- 2x UART2/3 (4-pin, 2.54 mm pitch) headers on PCB
- 1x mechanical power switch
- 1x DC jack with lock (24 V)
Other:
- U-Boot selects default SIM slot, based on value of 'default_sim' env
variable: '1' or unset -> SIM1 (mini), '2' -> SIM2 (micro). This board
has additional logic circuit for M.2 SIM switching. The 'sim-select'
will work only if both SIM slots are occupied. Otherwise, always slot
with SIM inside is selected, no matter 'sim-select' value.
- U-Boot enables power in all three miniPCIe and M.2 slots before
loading the kernel
- this board supports 'dual image' feature (controlled by 'dual_image'
U-Boot environment variable)
- all three miniPCIe slots have additional 5 V supply on pins 47 and 49
- the board allows to install up to two oversized miniPCIe cards (vendor
has dedicated MediaTek MT7615N/D cards for this board)
- this board has additional logic circuit controlling PERSTn pins inside
miniPCIe slots. By default, PERSTn (GPIO19) is routed to all miniPCIe
slots but setting GPIO22 to high allows PERSTn control per slot, using
GPIO23-25 (value is inverted)
Flash instructions:
You can use the 'sysupgrade' image directly in vendor firmware which is
based on OpenWrt (make sure to not preserve settings - use 'sysupgrade
-n -F ...' command). Alternatively, use web recovery mode in U-Boot:
1. Power the device with reset button pressed, the modem LED will start
blinking slowly and after ~3 seconds, when it starts blinking faster,
you can release the button.
2. Setup static IP 192.168.1.2/24 on your PC.
3. Go to 192.168.1.1 in browser and upload 'sysupgrade' image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
(backported from commit e68539aca43a560077364de27eb220f1d85ca3ef)
ALFA Network R36M-E4G is a dual-SIM, N300 Wi-Fi, compact size platform
based on MediaTek MT7620A WiSoC. This product is designed for operation
with 4G modem (can be bought in bundle with Quectel EC25, EG25 or EP06)
but supports also Wi-Fi modules (miniPCIe slot has USB and PCIe buses).
Specification:
- MT7620A (580 MHz)
- 64/128/256 MB of RAM (DDR2)
- 16/32+ MB of FLASH (SPI NOR)
- 2x 10/100 Mbps Ethernet, with passive PoE support (24 V)
- 2T2R 2.4 GHz (MT7620A), with ext. LNA (RFFM4227)
- 1x miniPCIe slot (with PCIe and USB 2.0 buses and optional 5 V)
- 2x SIM slot (mini, micro) with detect and switch driven by GPIO
- 2x u.fl antenna connectors (for Wi-Fi)
- 8x LED (7 driven by GPIO)
- 2x button (reset, wifi)
- 2x UART (4-pin/2.54 mm pitch, 10-pin/1.27 mm pitch) headers on PCB
- 1x I2C (4-pin, 1.27 mm pitch) header on PCB
- 1x LED (8-pin, 1.27 mm pitch) header on PCB
- 1x DC jack with lock (12 V)
Other:
- there is a dedicated, 4-pin connector for optional RTC module (Holtek
HT138x) with 'enable' input, not available at the time of preparing
support for this board
- miniPCIe slot supports additional 5 V supply on pins 47 and 49 but a
jumper resistor (R174) is not installed by default
- U-Boot selects default SIM slot, based on value of 'default_sim' env
variable: '1' or unset -> SIM1 (mini), '2' -> SIM2 (micro). This will
work only if both slots are occupied, otherwise U-Boot will always
select slot with SIM card inside (user can override it later, in
user-space)
- U-Boot resets the modem, using PERSTn signal, before starting kernel
- this board supports 'dual image' feature (controlled by 'dual_image'
U-Boot environment variable)
Flash instruction:
You can use the 'sysupgrade' image directly in vendor firmware which is
based on OpenWrt (make sure to not preserve settings - use 'sysupgrade
-n -F ...' command). Alternatively, use web recovery mode in U-Boot:
1. Power the device with reset button pressed, the modem LED will start
blinking slowly and after ~3 seconds, when it starts blinking faster,
you can release the button.
2. Setup static IP 192.168.1.2/24 on your PC.
3. Go to 192.168.1.1 in browser and upload 'sysupgrade' image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
(backported from commit dfecf94c2059998411f95067de3866aa7cdf5ec9)
New U-Boot version for MediaTek MT76x8/MT762x based ALFA Network boards
includes support for a 'dual image' feature. Users can enable it using
U-Boot environment variable 'dual_image' ('1' -> enabled).
When 'dual image' feature is enabled, U-Boot will modify DTB and divide
the original 'firmware' flash area into two, equal in size and aligned
to 64 KB partitions: 'firmware' and 'backup'. U-Boot will also adjust
size of 'firmware' area to match installed flash chip size.
U-Boot will load kernel from active partition which is marked with env
variable 'bootactive' ('1' -> first partition, '2' -> second partition)
and rename both partitions accordingly ('firmware' <-> 'backup').
There are 3 additional env variables used to control 'dual image' mode:
- bootlimit - maximum number of unsuccessful boot tries (default: '3')
- bootcount - current number of boot tries
- bootchanged - flag which informs that active partition was changed; if
it is set and 'bootcount' reaches 'bootlimit' value,
U-Boot will start web-based recovery which then updates
both partitions with provided image
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
(backported from commit bc173ddd8381b03dde8cc2e6c66d0cd392c62bbd)
Upstream kernel added support for RAW_APPENDED_DTB on ralink arch
in the following commit:
02564fc89d3d ("ralink: Introduce fw_passed_dtb to arch/mips/ralink")
Use upstream solution and get rid of our OWRTDTB hack.
This commit set DEVICE_DTS to $$(DTS) instead of replacing DTS with
DEVICE_DTS in device profile because DTS variable will be dropped
in later commits.
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
[Tested on mt7621/mt76x8]
Tested-by: Chuanhong Guo <gch981213@gmail.com>
[Tested on rt305x/mt7620]
Tested-by: INAGAKI Hiroshi <musashino.open@gmail.com>
(cherry picked from commit 7a8d3432c739c6ff038295176e8b6324e92fc116)
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
The stock firmware and bootloader only accept uImage with names that
match certain patterns. This patch enables OpenWrt installation from
stock firmware without having to reflash the bootloader or access the
UART console.
Installation via web interface:
1. Flash **initramfs** image through the stock web interface.
2. Boot into OpenWrt and perform sysupgrade with sysupgrade image.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
(cherry picked from commit 19800ac095f6ddbba03ccab08e5197b1eec4a49e)
[backported]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The two ASUS WL-330N and WL-330N3G had the
reset keycode assigned to the WPS button. This patch
changes all three devices to use KEY_WPS_BUTTON in
the hopes that this fixes unwanted restarts/
unexpected behavior from the users point of view.
[dropped RG21S]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit ad65d9d7b264d6d17293c59469e770905d2f785a)
Disable the DIR-300 B1 image by default as the device has insufficient
flash space for release build images.
Fixes: FS#2606
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Commit 60f41c6c9e ("ramips: add usb-ledtrig-usbport to DEVICE_PACKAGES
of CY-SWR1100") added stray | during backport which caused build
breakage on the buildbots:
bash: -c: line 0: syntax error near unexpected token `|'
bash: -c: line 0: `echo kmod-usb-core kmod-usb-ledtrig-usbport kmod-usb-ohci kmod-usb2 swconfig | | mkhash md5 | head -c 8'
Fixes: 60f41c6c9e ("ramips: add usb-ledtrig-usbport to DEVICE_PACKAGES of CY-SWR1100")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
CY-SWR1100 has a USB LED but kmod-usb-ledtrig-usbport is missing
in default images. This commit adds it.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
[changed commit title, backported to 19.07]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit 261c746631d2bf311a6b62a6d3bacce6fde90976)
Ethernet MAC address setup has been broken since c3e420f28c. Restore
original setting.
Fixes: c3e420f28c ("ramips: Add support for D-Link DCH-M225")
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
(cherry picked from commit 7231c1edd99217c6baa8d7d5d841d75ad9de26f1)
[backported due to base-files split]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
All buttons on the Netgear R6220 are active-low while they are flagged
as active-high.
The GPIO status reads the following for no buttons pressed:
root@64367-r6220:~# cat /sys/kernel/debug/gpio
gpio-7 ( |wps ) in hi
gpio-8 ( |wifi ) in hi
gpio-14 ( |reset ) in hi
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit f7f9fe5256ebb660d3160452c3c01a9eb080938f)
The 2.4 GHz radio had very poor signal reception (-89 dBm for an AP
sitting 5 m away). By enabling the external amplifier, received signal
has improved to -50 dBm for the same AP.
Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
(cherry picked from commit e667d6f46b5fa9ade5da1d76c8cc1aab1df1dcb6)
So far, WiFi MAC addresses for this device have been set up from
caldata. However, this returns values which do not look like MAC
addresses. They also do not match stock firmware:
wlan0 (5.0): 00:11:22:00:17:D0 from 0x8004
wlan1 (2.4): 00:11:22:00:17:CD from 0x4 (and 0x2e)
It looks like the only valid MAC address on this device is at 0x28.
So, this patch changes setup to calculate addresses based on the
value at 0x28:
lan: *:0A (flash, label)
wan: *:0B (flash + 1)
wifi2: *:0A (flash)
wifi5: *:0C (flash + 2)
Thanks to Roger Pueyo Centelles <roger.pueyo@guifi.net> for
investigating this on his devices.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit d1072096f49823eb39357f9555d7854a9c91bcfb)
Memory auto-detection for mt7621 has just been added to 19.07
stable branch.
This removes the memory node for the ZBT-WE1326, which will support
revision 5 that has 256MiB RAM (Nanya NT5CC128M16IP-DI) instead of
512MiB (up to revision 4).
ref: #1930
This is taken from master commit a2c19f1d2f65 ("ramips: dts: drop
memory nodes"), where _all_ memory nodes were removed.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
mt7621 has the following memory map:
0x0-0x1c000000: lower 448m memory
0x1c000000-0x2000000: peripheral registers
0x20000000-0x2400000: higher 64m memory
detect_memory_region in arch/mips/kernel/setup.c only add the first
memory region and isn't suitable for 512m memory detection because
it may accidentally read the memory area for peripheral registers.
This commit adds memory detection capability for mt7621:
1. add the highmem area when 512m is detected.
2. guard memcmp from accessing peripheral registers:
This only happens when some weird user decided to change
kernel load address to 256m or higher address. Since this
is a quite unusual case, we just skip 512m testing and return
256m as memory size.
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
(cherry picked from commit 6d91ddf5175d2eac3c4bc4a404cc0f5dd44cf25b)
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This adds an easy-installation factory image for the NETGEAR R6220
router. The factory image can either be flashed via the vendor Web-UI or
the bootloader using nmrpflash.
Tested with NETGEAR V1.1.0.86 firmware.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 607dfdf211bebb5043cbc0267c1e2c3e3c2514b4)
This backports the only non-cosmetic fix from 6640e1c3681b
("ramips: clean and improve MAC address setup in 02_network").
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
In 555ca422d1 ("ramips: fix D-Link DIR-615 H1 switch port
mapping"), port setup for dir-615-h1 was changed without removing
the old one. This was working as the new one was triggered earlier
than the old one.
(In the meantine, changed sorting during ramips rename patches
actually inversed that order.)
Anyway, just remove the wrong case now.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit e35e4a996e26f17b69d200505ecea78af96a2704)
ARC FreeStation5 is present twice in MAC address setup.
>From older commits/changes, it is not possible to reconstruct
the correct choice only by reading the annotations.
Thus, remove the second case and keep the first one, so behavior
stays the same (as nobody seems to have complained about it).
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit ad4eb2241b33b05b0942a3fa7ed2e53fb6e84386)
Image generation is currently failing on builbots due to the following
error:
WARNING: Image file openwrt-19.07-snapshot-r10495-db5164d3d0-ramips-mt7620-wt3020-4M-squashfs-factory.bin is too big
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
stage2 passes image path to platform_do_upgrade() as an argument so it
can be simply accessed using $1
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 8b4bc7abe073489a3595eeb2d81818852319c148)
[rmilecki: dropping ARGV without this change broke sysupgrade]
Fixes: 6ac62c4b6c ("base-files: don't set ARGV and ARGC")
There are currently the following issues present for the Netgear R6220,
R6350 and WNDR3700 v5:
- LAN and WAN MAC-addresses are inverted
- WAN MAC-address is off. It are +2 compared to the LAN MAC-address
(R6350 only)
- Switchport order is inverted in LuCi
This commit fixes both these issues by assigning correct MAC-addresses
to LAN and WAN interfaces and defining the switchports with the correct
labels.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 13937a16d40693df67d3d39faa3a80644bdb7abf)
This commit switches the default trigger for the WiFi LED from a netdev
trigger on "wlan0" to a wireless-phy based trigger. THis allows the LED
to work, even when the wireless interface is not named "wlan0" without
modifiying the LED settings.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit fa46c9b208fe3833f085e9f6ddf7c492b16f6c34)
The MediaTek MT7621 NAND driver currently intransparently shifts NAND
pages when a block is marked as bad. Because of this, offsets for e.g.
caldata and MAC-addresses seem to be off.
This is, howeer, not a task for the mtd NAND driver, as the flash
translation layer is tasked with this.
This patch disables this badblock shifting. This fix was originally
proposed by Jo-Philipp Wich at
https://bugs.openwrt.org/index.php?do=details&task_id=1926
Fixes FS#1926 ("MTD partition offset not correctly mapped when bad
eraseblocks present")
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 527832e54bf3bc4d699a145ae66f34230246f0a9)
SoC: MediaTek MT7621AT
RAM: 128M (Winbond W631GG6KB-15)
FLASH: 16MB (Spansion S25FL128SA)
WiFi: MediaTek MT7603EN bgn 2SS
WiFi: MediaTek MT7612EN nac 2SS
BTN: Reset - WPS
LED: - Power
- LAN {1-4}
- WAN
- WiFi 2.4 GHz
- WiFi 5 GHz
- USB
UART: UART is present next to the Power LED.
TX - RX - GND - 3V3 / 57600-8N1
3V3 is the nearest one to the Power LED.
Installation
------------
Via TFTP:
1. Set your computers IP-Address to 192.168.1.75.
2. Power up the Router with the Reset button pressed.
3. Release the Reset button after 5 seconds.
4. Upload OpenWRT sysupgrade image via TFTP:
> tftp -4 -v -m binary 192.168.1.1 -c put <IMAGE>
Via SSH:
Note: User/password for SSH is identical with the one used in the
Web-interface.
1. Complete the initial setup wizard.
2. Activate SSH under "Administration" -> "System".
3. Transfer the OpenWrt sysupgrade image via scp:
> scp owrt.bin admin@192.168.1.1:/tmp
4. Connect via SSH to the router.
> ssh admin@192.168.1.1
5. Write the OpenWrt image to flash.
> mtd-write -i /tmp/owrt.bin -d linux
6. Reboot the router
> reboot
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 14e0e4f138e35c3e2a15cc3a836c939547ee053b)
Image generation is currently failing on builbots due to the following
error:
WARNING: Image file [...] mt7620-ex2700-squashfs-factory.bin is too big
Signed-off-by: Petr Štetiar <ynezz@true.cz>
This makes interrupt-based gpio-keys working.
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
(cherry picked from commit 110daa16e44bb53941a18396ab6a7d9fdd1fa362)
Refreshed all patches.
This bump contains upstream commits which seem to avoid (not properly fix)
the errors as seen in FS#2305 and FS#2297
Altered patches:
- 403-net-mvneta-convert-to-phylink.patch
- 410-sfp-hack-allow-marvell-10G-phy-support-to-use-SFP.patch
Compile-tested on: ar71xx, cns3xxx, imx6, mvebu, x86_64
Runtime-tested on: ar71xx, cns3xxx, imx6, x86_64
Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
01_leds has several redundant LED-cases. This commit cleans
up the file by merging these cases into shared cases.
Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
ASUS RP-N53 and Buffalo WHR-600D use RT5592 for 5GHz wireless
After commit 367813b9b1 the driver for RT5592 (rt2800pci)
is not selected by default anymore, which broke their 5GHz wireless
Add it back to device packages
Fixes: 367813b9b1 ("ramips: mt7620: fix dependencies")
Signed-off-by: Deng Qingfang <dengqf6@mail2.sysu.edu.cn>
Specifications:
- SoC: MT7628DAN (MT7628AN with 64MB built-in RAM)
- Flash: 8M SPI NOR
- Ethernet: 5x 10/100Mbps
- WiFi: 2.4G: MT7628 built-in
5G: MT7612E
- 1x miniPCIe slot for LTE modem (only USB pins connected)
- 1x SIM slot
Flash instruction:
U-boot has a builtin web recovery page:
1. Hold the reset button while powering it up
2. Connect to the ethernet and set an IP in 192.168.1.0/24 range
3. Open your browser and upload firmware through http://192.168.1.1
Note about the LTE modem:
If your router comes with an EC25 module and it doesn't show up
as a QMI device, you should do the following to switch it to QMI
mode:
1. Install kmod-usb-serial-option and a terminal software
(e.g. minicom or screen). All 4 serial ports of the modem
should be available now.
2. Open /dev/ttyUSB3 with the terminal software and type this
AT command: AT+QCFG="usbnet",0
3. Power-cycle the router. You should now get a QMI device
recognized.
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
Support for D-Link DWR-118 A1 was added before LEDs feature
in mt76x0e driver.
This fixes the 5GHz WiFi LED which was previously inverted.
Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
This ioctl is currently routed through generic interface code.
dev_ioctl
dev_ethtool
__ethtool_get_link_ksettings
phy_ethtool_ioctl
Cc: Felix Fietkau <nbd@nbd.name>
Cc: John Crispin <john@phrozen.org>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
The R6220 and WNDR3700v5 are identical apart from using NAND/NOR flash and
having a different casing. This adds a new cleaned up R6220.dtsi with the
common bits for both devices. Both devices now have feature parity.
Performed cleanup:
* generic DTS node names
* regulator for usb power
* added missing pinctrl groups
* use switch port instead of VLAN as trigger for WAN LED
Fixes for WNDR3700v5:
* all LEDS work
* correct ethernet MAC addresses
Signed-off-by: Jan Hoffmann <jan@3e8.eu>
- SoC: MediaTek MT7628AN
- Flash: 16MB (Winbond W25Q128JV)
- RAM: 64MB
- Serial: As marked on PCB, 3V3 logic, baudrate is 115200
- Ethernet: 3x 10/100 Mbps (switched, 2x LAN + WAN)
- WIFI0: MT7628AN 2.4GHz 802.11b/g/n
- WIFI1: MT7612EN 5GHz 802.11ac
- Antennas: 4x external (2 per radio), non-detachable
- LEDs: Programmable power-LED (two-colored, yellow/blue)
Non-programmable internet-LED (shows WAN-activity)
- Buttons: Reset
INSTALLATION:
1. Connect to the serial port of the router and power it up.
If you get a prompt asking for boot-mode, go to step 3.
2. Unplug the router after
> Erasing SPI Flash...
> raspi_erase: offs:20000 len:10000
occurs on the serial port. Plug the router back in.
3. At the prompt select option 2 (Load system code then
write to Flash via TFTP.)
4. Enter 192.168.1.1 as the device IP and 192.168.1.2 as the
Server-IP.
5. Connect your computer to LAN1 and assign it as 192.168.1.2/24.
6. Rename the sysupgrade image to test.bin and serve it via TFTP.
7. Enter test.bin on the serial console and press enter.
Signed-off-by: Markus Scheck <markus@mscheck.de>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
[added mt76 compatible]
Cudy WR1200 is an AC1200 AP with 3-port FE and 2 non-detachable antennas
Specifications:
MT7628 (580 MHz)
64 MB of RAM (DDR2)
8 MB of FLASH
2T2R 2.4 GHz (MT7628)
2T2R 5 GHz (MT7612E)
3x 10/100 Mbps Ethernet (2 LAN + 1 WAN)
2x external, non-detachable antennas (5dbi)
UART header on PCB (57600 8n1)
7x LED, 2x button
Known issues:
The Power LED is always ON, probably because it is connected
directly to power.
Flash instructions
------------------
Load the ...-factory.bin image via the stock web interface.
Openwrt upgrade instructions
----------------------------
Use the ...-sysupgrade.bin image for future upgrades.
Revert to stock FW
------------------
Warning! This tutorial will work only with the following OEM FW:
WR1000_EU_92.122.2.4987.201806261618.bin
WR1000_US_92.122.2.4987.201806261609.bin
If in the future these firmwares will not be available anymore,
you have to find the new XOR key.
1) Download the original FW from the Cudy website.
(For example WR1000_EU_92.122.2.4987.201806261618.bin)
2) Remove the header.
dd if="WR1000_EU_92.122.2.4987.201806261618.bin" of="WR1000_EU_92.122.2.4987.201806261618.bin.mod" skip=8 bs=64
3) XOR the new file with the region key.
FOR EU: 7B76741E67594351555042461D625F4545514B1B03050208000603020803000D
FOR US: 7B76741E675943555D5442461D625F454555431F03050208000603060007010C
You can use OpenWrt's tools/firmware-utils/src/xorimage.c tool for this:
xorimage -i WR1000..bin.mod -o stock-firmware.bin -x -p 7B767..
Or, you can use this tool (CHANGE THE XOR KEY ACCORDINGLY!):
https://gchq.github.io/CyberChef/#recipe=XOR(%7B'option':'Hex','string':''%7D,'',false)
4) Check the resulting decrypted image.
Check if bytes from 0x20 to 0x3f are:
4C 69 6E 75 78 20 4B 65 72 6E 65 6C 20 49 6D 61 67 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Alternatively, you can use u-boot's tool dumpimage tool to check
if the decryption was successful. It should look like:
# dumpimage -l stock-firmware.bin
Image Name: Linux Kernel Image
Created: Tue Jun 26 10:24:54 2018
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 4406635 Bytes = 4303.35 KiB = 4.20 MiB
Load Address: 80000000
Entry Point: 8000c150
5) Flash it via forced firmware upgrade and don't "Keep Settings"
CLI: sysupgrade -F -n stock-firmware.bin
LuCI: make sure to click on the "Keep settings" checkbox
to disable it. You'll need to do this !TWICE! because
on the first try, LuCI will refuse the image and reset
the "Keep settings" to enable. However a new
"Force upgrade" checkbox will appear as well.
Make sure to do this very carefully!
Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
[added wifi compatible, spiffed-up the returned to stock instructions]
This uses the existing rules for Sercomm factory images and moves them
to the ramips image Makefile, so they can be used in all subtargets.
The new factory image for WNDR3700v5 can be flashed using nmrpflash.
Signed-off-by: Jan Hoffmann <jan@3e8.eu>
Specification:
CPU: MT7628 580 MHz. MIPS 24K
RAM: 128 MB
Flash: 32 MB
WIFI: 802.11n/g/b 20/40 MHz
Ethernet: 5 Port ethernet switch
UART: 2x
Flash instruction:
The U-boot is based on Ralink SDK so we can flash the firmware using UART:
1. Configure PC with a static IP address and setup an TFTP server.
2. Put the firmware into the tftp directory.
3. Connect the UART0 line as described on the PCB.
4. Power up the device and press 2, follow the instruction to
set device and tftp server IP address and input the firmware
file name. U-boot will then load the firmware and write it into
the flash.
5. After firmware is started connect via ethernet at 192.168.1.1
Signed-off-by: Liu Yu <f78fk@live.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com> [removed dupped subject]
ZBT WE826-E is a dual-SIM version of the ZBT WE826. The router has the
following specifications:
- MT7620A (580 MHz)
- 128MB RAM
- 32MB of flash (SPI NOR)
- 5x 10/100Mbps Ethernet (MT7620A built-in switch)
- 1x microSD slot
- 1x miniPCIe slot (only USB2.0 bus)
- 2x SIM card slots (standard size)
- 1x USB2.0 port
- 1x 2.4GHz wifi (rt2800)
- 10x LEDs (4 GPIO-controlled)
- 1x reset button
The following have been tested and working:
- Ethernet switch
- wifi
- miniPCIe slot
- USB port
- microSD slot
- sysupgrade
- reset button
Installation and recovery:
In order to install OpenWRT the first time or recover the router, you
can use the web-based recovery system. Keep the reset button pressed
during boot and access 192.168.1.1 in your browser when your machine
obtains an IP address. Upload the firmware to start the recovery
process.
How to swap SIMs:
You control which SIM slot to use by writing 0/1 to
/sys/class/gpio/gpio13/value. In order for the change to take effect,
you can either use AT-commands (AT+CFUN) or power-cycle the modem (write
0/1 to /sys/class/gpio/gpio14/value).
Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
Head Weblink HDRM200 is a dual-sim router based on MT7620A. The detailed
specifications are:
- MT7620A (580MHz)
- 64MB RAM
- 16MB of flash (SPI NOR)
- 6x 10/100Mbps Ethernet (MT7620A built-in switch)
- 1x microSD slot
- 1x miniPCIe slot (only USB2.0 bus). Device is shipped with a SIMCOM
SIM7100E LTE modem.
- 2x SIM slots (standard size)
- 1x USB2.0 port
- 1x 2.4GHz wifi (rt2800)
- 1x 5GHz wifi (mt7612)
- 1x reset button
- 1x WPS button
- 3x GPIO-controllable LEDs
- 1x 10 pin terminal block (RS232, RS485, 4 x GPIO)
Tested:
- Ethernet switch
- Wifi
- USB slot
- SD card slot
- miniPCIe-slot
- sysupgrade
- reset button
Installation instructions:
Installing OpenWRT for the first time requires a bit of work, as the
board does not ship with OpenWRT. In addition, the bootloader
automatically reboots when installing an image over tftp. In order to
install OpenWRT on the HDRM200, you need to do the following:
* Copy the initramfs-image to your tftp-root (default filename is
test.bin) and configure networking accordingly (default server IP is
10.10.10.3, client 10.10.10.123). Start your tftp server.
* Open the board and connect to UART. The pins are exposed and clearly
marked.
* Boot the board and press 1.
* Either use the default filename and client/server IP-addresses, or
specify your own.
The image should now be loaded to memory and board boot. If the router
reboots while the image is loading, you need to try again. Once the
board has booted, copy the sysupgrade-image to the router and run
sysupgrade in order to install OpenWRT to the flash.
Notes:
- You control which SIM slot to use by writing 0/1 to
/sys/class/gpio/gpio0/value. In order for the change to take
effect, you can either use AT-commands (AT+CFUN) or power-cycle the
modem (write 0/1 to /sys/class/gpio/gpio21/value).
- RS485 is available on /dev/ttyS0.
- RS232 is available on /dev/ttyS1.
- The name of the ioX-gpios map to the labels on the casing.
Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
[fixed whitespace issue and merge conflict in target.mk]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Jo-Philipp Wich