Specifications:
* SoC: MediaTek MT7622BV
* RAM: DDR3 512 MiB (Nanya NT5CC256M16ER-EK)
* Flash: SPI-NAND 256 MiB (Toshiba TC58CVG1S3HRAIJ)
* Wi-Fi 2.4/5 GHz 4T4R:
* 2.4 GHz: MediaTek MT7622BV
* 5 GHz: MediaTek MT7915AN/MT7975AN
* Ethernet: 4x 10/100/1000 Mbps LAN,
1x 10/100/1000/2500 Mbps WAN (Realtek RTL8221B PHY)
* Switch: MediaTek MT7531AE
* LEDs/Keys: 8/1 (Power, Internet, LAN1, LAN2, LAN3, LAN4,
Wifin and Wifia dual-colour LEDs + Reset pin)
* UART: Marked J19 on board VCC GND TX RX, beginning from "1". 3.3v,
115200n8
* Power: 12 VDC, 2.5 A
Installation:
* Flash the factory image through the stock web interface, or TFTP to
the bootloader. NMRP can be used to TFTP without opening the case.
* U-Boot allows booting an initramfs image via TFTP as follows:
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.100
tftpboot openwrt-mediatek-mt7622-netgear_wax206-initramfs-recovery.itb
bootm
Known Limitations:
* The 2.5G WAN port labeled 'wan' only works for speeds up to 1G at the
moment. If connected to a multi-gig port the speed has to be manually
set to 1G/full either for the switch port or in OpenWrt. For example
add the following to /etc/rc.local to set it on boot:
/usr/sbin/ethtool -s wan speed 1000 duplex full
Revert to stock firmware:
* Flash the stock firmware to the bootloader using TFTP/NMRP.
References to WAX206 GPL source:
https://www.downloads.netgear.com/files/GPL/WAX206_V1.0.4.0_Source.rar
* openwrt/target/linux/mediatek/dts/mt7622-netgear-wax206.dts
DTS file for this device.
* openwrt/target/linux/mediatek/image/mt7622.mk
Image creation code for this device
Signed-off-by: Marcel Ziswiler <marcel@ziswiler.com>
[fix WAN port (1G only), adjust partition layout, adjust image creation]
Signed-off-by: Thomas Kupper <thomas.kupper@gmail.com>
Also known as the "Xiaomi Router AX3200" in western markets,
but only the AX6S is widely installation-capable at this time.
SoC: MediaTek MT7622B
RAM: DDR3 256 MiB (ESMT M15T2G16128A)
Flash: SPI-NAND 128 MiB (ESMT F50L1G41LB or Gigadevice GD5F1GQ5xExxG)
WLAN: 2.4/5 GHz 4T4R
2.4 GHz: MediaTek MT7622B
5 GHz: MediaTek MT7915E
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531B
LEDs/Keys: 2/2 (Internet + System LED, Mesh button + Reset pin)
UART: Marked J1 on board VCC RX GND TX, beginning from "1". 3.3v, 115200n8
Power: 12 VDC, 1.5 A
Notes:
U-Boot passes through the ethaddr from uboot-env partition,
but also has been known to reset it to a generic mac address
hardcoded in the bootloader.
However, bdata is also populated with the ethernet mac addresses,
but is also typically never written to. Thus this is used instead.
Installation:
1. Flash stock Xiaomi "closed beta" image labelled
'miwifi_rb03_firmware_stable_1.2.7_closedbeta.bin'.
(MD5: 5eedf1632ac97bb5a6bb072c08603ed7)
2. Calculate telnet password from serial number and login
3. Execute commands to prepare device
nvram set ssh_en=1
nvram set uart_en=1
nvram set boot_wait=on
nvram set flag_boot_success=1
nvram set flag_try_sys1_failed=0
nvram set flag_try_sys2_failed=0
nvram commit
4. Download and flash image
On computer:
python -m http.server
On router:
cd /tmp
wget http://<IP>:8000/factory.bin
mtd -r write factory.bin firmware
Device should reboot at this point.
Reverting to stock:
Stock Xiaomi recovery tftp that accepts their signed images,
with default ips of 192.168.31.1 + 192.168.31.100.
Stock image should be renamed to tftp server ip in hex (Eg. C0A81F64.img)
Triggered by holding reset pin on powerup.
A simple implementation of this would be via dnsmasq's
dhcp-boot option or using the vendor's (Windows only)
recovery tool available on their website.
Signed-off-by: Richard Huynh <voxlympha@gmail.com>
This was added recently and thus overlooked in 85b1f4d8ca
("treewide: remove execute bit and shebang from board.d files").
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The vendor flash layout of the Linksys E8450 is problematic as it uses
the SPI-NAND chip without any wear-leveling while at the same time
wasting a lot of space for padding.
Use an all-UBI layout instead, storing the kernel+dtb+squashfs in
uImage.FIT standard format in UBI volume 'fit', the read-write
overlay in UBI volume 'rootfs_data' as well as reduntant U-Boot
environments 'ubootenv' and 'ubootenv2', and a 'recovery'
kernel+dtb+initramfs uImage.FIT for dual-boot.
** WARNING **
THIS PROCEDURE CAN EASILY BRICK YOUR DEVICE PERMANENTLY IF NOT CARRIED
OUT VERY CAREFULLY AND EXACTLY AS DESCRIBED!
Step 0
* Configure your PC to have the static IPv4 address 192.168.1.254/24
* Provide bin/targets/mediatek/mt7622 via TFTP
Now continue EITHER with step 1A or 1B, depending on your preference
(and on having serial console wired up or not).
Step 1A (Using the vendor web interface (or non-UBI OpenWrt install))
In order to update to the new bootloader and UBI-based firmware,
use the web browser of your choice to open the routers web-interface
accessible on http://192.168.1.1
* Navigate to
'Configuration' -> 'Administration' -> 'Firmware Upgrade'
* Upload the file
openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb
and proceed with the upgrade.
* Once OpenWrt comes up, use SCP to upload the new bootloader files to
/tmp on the router:
*-mt7622-linksys_e8450-ubi-preloader.bin
*-mt7622-linksys_e8450-ubi-bl31-uboot.fip
* Connect via SSH as you will now need to replace the bootloader in
the Flash.
ssh root@192.168.1.1
(the usual warnings)
* First of all, backup all the flash now:
for mtd in /dev/mtdblock*; do
dd if=$mtd of=/tmp/$(basename $mtd);
done
* Then use SCP to copy /tmp/mtdblock* from the router and keep them
safe. You will need them should you ever want to return to the
factory firmware!
* Now flow the uploaded files:
mtd -e /dev/mtd0 write /tmp/*linksys_e8450-ubi-preloader.bin /dev/mtd0
mtd -e /dev/mtd1 write /tmp/*linksys_e8450-ubi-bl31-uboot.fip /dev/mtd1
If and only if both writes look like the completed successfully
reboot the router. Now continue with step 2.
Step 1B (Using the vendor bootloader serial console)
* Use the serial to backup all /dev/mtd* devices before using the
stock firmware (you got root shell when connected to serial).
* Then reboot and select 'U-Boot Console' in the boot menu.
* Copy the following lines, one by one:
tftpboot 0x40080000 openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin
tftpboot 0x40100000 openwrt-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip
nand erase 0x0 0x180000
nand write 0x40080000 0x0 0x180000
reset
Now continue with step 2
Step 2
Once the new bootchain comes up, the loader will initialize UBI and the
ubootenv volumes. It will then of course fail to find any bootable
volume and hence resort to load kernel via TFTP from server
192.168.1.254 while giving itself the address 192.168.1.1
The requested file is called
openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb
and your TFTP server should provide exactly that :)
It will be written to UBI as recovery image and booted.
You can then continue and flash the production OS image, either
by using sysupgrade in the booted initramfs recovery OS, or by using
the bootloader menu and TFTP.
That's it. Go ahead and mess around with a bootchain built almost
completely from source (only DRAM calibration blobs are fitted in bl2,
and the irreplacable on-chip ROM loader remains, of course).
And enjoy U-Boot built with many great features out-of-the-box.
You can access the bootloader environment from within OpenWrt using the
'fw_printenv' and 'fw_setenv' commands. Don't be afraid, once you got
the new bootchain installed the device should be fairly unbrickable
(holding reset button before and during power-on resets things and
allows reflashing recovery image via TFTP)
Special thanks to @dvn0 (Devan Carpenter) for providing amazingly fast
infra for test-builds, allowing for `make clean ; make -j$(nproc)` in
less than two minutes :)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The Linksys E8450, also known as Belkin RT3200, is a dual-band
IEEE 802.11bgn/ac/ax router based on MediaTek MT7622BV and
MediaTek MT7915AN chips.
FCC: K7S-03571 and K7S-03572
Hardware highlights:
- CPU: MediaTek MT7622BV (2x ARM Cortex-A53 @ 1350 MHz max.)
- RAM: 512MB DDR3
- Flash: 128MB SPI-NAND (2k+64)
- Ethernet: MT7531BE switch with 5 1000Base-T ports
CPU port connected with 2500Base-X
- WiFi 2.4 GHz: 802.11bgn 4T4R built-in antennas
MT7622VB built-in
- WiFi 5 GHz: 802.11ac/ax 4T4R built-in antennas
MT7915AN chip on-board via PCIe
MT7975AN front-end
- Buttons: Reset and WPS
- LEDS: 3 user controllable LEDs, 4 wired to switch
- USB: USB2.0, single port
- no Bluetooth (supported by SoC, not wired on board)
- Serial: JST PH 2.0MM 6 Pin connector inside device
----_____________----
[ GND RX - TX - - ]
---------------------
- JTAG: unpopulated ARM JTAG 20-pin connector (works)
This commit adds support for the device in a way that is compatible
with the vendor firmware's bootloader and dual-boot flash layout, the
resulting image can directly be flashed using the vendor firmware.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
