In the conversion to dts, qca,led-pin was used for both interfaces.
Unfortunately, it's mutually exclusive with gpio-controller which made
it not do anything.
Fixes: 949e1a0 ("mpc85xx: tl-wdr4900: move platform code to dts")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19758
Signed-off-by: Robert Marko <robimarko@gmail.com>
843a736a4e26 ubus: fix type check in procd ubus data callback
94c3869941b0 interface: avoid memleaks on invalid interfaces
6ead304877ad global: use blobmsg_parse_attr
813b9882dbab config: add support for defining devices via procd data
575b04326e32 config: add support for defining interfaces via procd data
a0be934399cf examples: sync wireless.uc
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Modernize the target slightly to use kernel+dtb FIT images in all
subtargets. LZMA compression will be used for the cortexa53 devices,
and we'll stay conservative and use gzip for the cortexa7/a8 devices
due to performance differences.
Tested-on:
- Linksprite pcDuino v2 (cortexa8 / A10)
- Olinuxino Micro (cortexa7 / A20)
- Banana Pi M2 Berry (cortexa7 / V40)
- Banana Pi P2 Zero (cortexa7 / H2+)
- Xunlong Orange Pi 2 (cortexa7/ H3)
- OrangePi PC Zero 2 (cortexa53 / H616)
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
Running the bootstrap script autogen.sh
handles the execution of autotools already,
so calling autoreconf before configure
makes this happen twice, which is unnecessary
and can lead to an occasional build problem.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/19748
Signed-off-by: Robert Marko <robimarko@gmail.com>
Currently, the build system overrides the value of the CC variable
for actual compilation after configuring for target builds.
However, the configure script now modifies the CC variable
to include "-std=gnu23" when the test for C23 features is successful.
The configure script also tests for the ability to use alignof
without including the stdalign.h header, and only includes it if necessary.
The test in the configure script is being done with the C23 standard option
but the compilation is being done without the C23 standard option,
leading to an unusual build error where alignof() is not defined.
Resolving the conflict between the autoconf macros and the build system
causes several other packages to fail, so instead in the meantime,
force the use of C23 standard to compile as part of the new standard
includes alignof as a keyword to deprecate the stdalign.h macro.
Forcing use of the new standard is safe for target builds
as the toolchain is known to support the option
and is always within our scope of version control.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/19748
Signed-off-by: Robert Marko <robimarko@gmail.com>
Remove the needless restriction
for which auxillary files are installed.
This aligns the behavior of libtoolize
with the existing behavior of automake.
This can prevent the seemingly random error
if autoreconf happens to be ran multiple times:
configure: error: cannot find required auxiliary files: compile
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/19748
Signed-off-by: Robert Marko <robimarko@gmail.com>
The new "std-gnu23" module has the stated goal of:
"...to update the c99 module to depend on std-gnu23
instead of on std-gnu11, and to make std-gnu11 obsolete."
in upstream commit 8990abb50 ("std-gnu23: new module").
However, for now, it's design is optional, so that
definitions of the latest standard module overrides the former.
At some point, upstream gnulib will replace the dependency
instead of add it alongside the older one.
Because all macros are copied to the aclocal directory,
for complex projects, not including the module
may cause the macros to apply only to some subdirectories
rather than all of them and top-level together.
For projects that import source from local gnulib,
always include the std-gnu23.m4 macros for consistency.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/19748
Signed-off-by: Robert Marko <robimarko@gmail.com>
While checking setup routines for stability and completeness,
random RTL838x SoC I/O areas were intentionally overwritten.
As soon as L2_CTRL_1->FAST_AGE_OUT is set to 1, the system
stalls during bootup. Analysis shows that it loops endlessly
in rtl838x_hw_stop()
/* Flush L2 address cache */
if (priv->family_id == RTL8380_FAMILY_ID) {
for (int i = 0; i <= priv->cpu_port; i++) {
sw_w32(1 << 26 | 1 << 23 | i << 5, priv->r->l2_tbl_flush_ctrl);
do { } while (sw_r32(priv->r->l2_tbl_flush_ctrl) & (1 << 26));
}
This is exactly the same logic as in the vendor GPL. There
are no hints about possible timeouts or issues. The reason is
still unclear. Nevertheless harden the function for further fuzzy
tests. Do this by resetting the configuration value to its SoC
default.
Additionally convert some shifts to BIT() for better readability.
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/19679
Signed-off-by: Robert Marko <robimarko@gmail.com>
Invalid hash was added during the 5.3 update and CI will fail since none
of the available sources has the tarball with incorrect hash.
Fixes: 423ed9fc5a ("tools: bash: update to 5.3")
Signed-off-by: Robert Marko <robimarko@gmail.com>
`loglevel=8` causes the kernel to output all logs, including debug logs, at boot time
It is enabled by default on the upstream eval board because it is aimed at developer debugging.
Most devices reference the eval board directly without modification, and the debug log should be hidden at release
Signed-off-by: Coia Prant <coiaprant@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19714
Signed-off-by: Robert Marko <robimarko@gmail.com>
The bootloader on these devices uses 0x81000000 as load address for the
compressed image. Since the kernel uses a load address 0x80100000, this
only leaves a space of 15 MiB for the uncompressed image. For larger
images, the compressed data starts to get overwritten, and at some point
the boot will fail:
## Booting image from partition ... 0
## Booting kernel from Legacy Image at 81000000 ...
Version: 9.9.9.9
Created: 2025-08-07 14:56:09 UTC
Data Size: 6756645 Bytes = 6.4 MB
Checksum ... OK
Uncompressing ... LZMA: uncompress or overwrite error 1 - must RESET board to recover
Currently, initramfs images with default config are already over the
limit. And while they still happen to work regardless, adding additional
packages easily pushes the size so much that the boot fails.
Fix this by switching to rt-loader (which relocates the data to the
upper end of the RAM before decompression). The switch includes regular
kernel images to avoid this becoming an issue again in the future.
Signed-off-by: Jan Hoffmann <jan@3e8.eu>
Link: https://github.com/openwrt/openwrt/pull/19734
Signed-off-by: Robert Marko <robimarko@gmail.com>
The .rma_bpdu_fld_pmask is not used anywhere in the code for RTL930x nor
RTL931x. But the RTL930x was still initializing this member. To avoid
problems in the future, simply initialize it also on RTL931x.
Signed-off-by: Harshal Gohel <hg@simonwunderlich.de>
Signed-off-by: Sharadanand Karanjkar <sk@simonwunderlich.de>
Link: https://github.com/openwrt/openwrt/pull/19569
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit renames the network ports of the Minisforum MS-A2
Mini PC: the two 2.5G RJ45 ports are now named lan1 and lan2,
and the two 10G SFP+ ports sfp1 and sfp2.
All four ports are also added to the default lan interface.
--- Hardware Highlights ---
AMD Ryzen™ 9 9955HX/7945HX
Dual DDR5-5600MHz, up to 96GB
2x 10G SFP+, 2x 2.5G RJ45
WiFi 6E, Bluetooth 5.3
Built-in PCIe x16 Slot
Signed-off-by: Til Kaiser <mail@tk154.de>
Link: https://github.com/openwrt/openwrt/pull/19689
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
OpenSSL 3.5.2 is a bug fix release:
This release incorporates the following bug fixes and mitigations:
Miscellaneous minor bug fixes.
The FIPS provider now performs a PCT on key import for RSA, EC and ECX.
This is mandated by FIPS 140-3 IG 10.3.A additional comment 1.
Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)
Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/19725
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The RTL930x mdio functions are scattered around the code. Relocate
them to the bus (still inside the ethernet driver). With this change
the phy identification looks into the proper registers. The SerDes
phy identifier (register 2/3) must be changed.
Additionally provide a consistent SerDes register access through the
mdio bus. Until now when a SerDes directly drives a SFP module there
is no clear rule of how to handle its register set that consists of
two parts:
- c22 phy registers 0-15 live in the fiber page (2) of the SerDes
- other SerDes specific registers exist in pages before and after
The mdio bus and other SerDes functions are a wild mix of directly
looking into page 2 or just using self defined methods to access
data.
Adapt the bus to the new consistent phy interface that mixes the
SerDes register set like classic Realtek phys do it.
- Use register 31 as page select (already in the bus)
- Always keep the common registers 0-15 in place and read fiber page
- Map the SerDes internal registers into the upper vendor specific
registers 16-23 according to the page select register (31).
That gives a register mapping as follows:
+-----------------------+-----------------------+---------------+-------------+
| reg 0x00-0x0f | reg 0x10-0x17 | reg 0x18-0x1e | reg 0x1f |
+-----------------------+-----------------------+---------------+-------------+
| SerDes fiber page (3) | real SerDes registers | zero | SerDes page |
| registers 0 - 15 | in packages of 8 | | select reg |
+-----------------------+-----------------------+---------------+-------------+
Example to make it as clear as possible.
SerDes registers on a RTL930x show
Page / Reg | 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B ...
-------------+----------------------------------------------------------------
0 - SDS | 0C03 0F00 7060 7106 074D 0EBF 0F0F 0359 5248 0000 0F80 0000 ...
1 - SDS_EXT | 0000 0000 85FA 8C6D 5CCC 0000 20D8 0003 79AA 8C64 00C3 1482 ...
2 - FIB | 1140 6189 001C CA40 01A0 0000 0000 0004 0000 0000 0000 0000 ...
3 - FIB_EXT | 1140 6109 001C CA40 01A0 0000 0000 0004 0000 0000 0000 0000 ...
This translates to this phy layout
| SerDes fiber registers normal SerDes registers zero p.sel
Page / Reg | 0x00 0x01 0x02 0x03 ... 0x10 0x11 0x12 0x13 ... 0x18 ... 0x1f
-------------+---------------------------------------------------------------
0 | 1140 6189 001C CA40 ... 0C03 0F00 7060 7106 ... 0000 ... 0000
1 | 1140 6189 001C CA40 ... 5248 0000 0F80 0000 ... 0000 ... 0001
...
4 | 1140 6189 001C CA40 ... 0000 0000 85FA 8C6D ... 0000 ... 0004
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/19692
Signed-off-by: Robert Marko <robimarko@gmail.com>
Some known RTL93xx devices like the Linksys LGS328C or LGS352C are
NAND based. These require additional drivers and packages (e.g. UBI).
The current subtargets are already taylored down for devices with
only 16MB flash. Adding features that are not used will only make
the storage situation more complicated.
Add two new subtargets for RTL93xx that include the basic NAND, UBI
and MTD features. To achieve this do the following:
- Create new subtarget folders
- Copy the existing config and makefiles over
- Add the basic additional features
- Mark them as SOURCE-ONLY
- Add empty image makefiles
- Remove unneded NAND/MTD features from existing configs
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/19700
Signed-off-by: Robert Marko <robimarko@gmail.com>
Execute scripts in /etc/rc.wps until one of them returns a exit code of 0.
Split up sta and ap handling of wps into separate scripts.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
These devices need a tiny (<8MB) initramfs. There are first
occurrences where this fails with newer kernels and diagnostic
packages.
Switch the recipe over to use lzma compression and rt-loader.
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/19687
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is an industrial 4G router equipped with OpenWrt SNAPSHOT OEM
customized version
WARNING: The original firmware device tree is modified from evb
boards, and the device tree name is evb board. This submitted device
tree is a modified version, which deletes the non-this-device parts
and adds GPIO watchdog.
Specification:
- SoC: MediaTek MT7628NN
- Flash: 16 MB
- RAM: 128 MB
- Power: DC 5V-36V 1.5A
- Ethernet: 1x WAN [slot not install], 1x LAN (10/100 Mbps)
- Wireless radio: 802.11n 2.4g-only [antenna not install]
- LED:
System/Power (RUN): GPIO/37 active-low
Modem: GPIO/3 active-low
RF (Modem Signal): GPIO/2 active-low
- Button:
WPS / RESET: GPIO/11 active-low
- UART: 1x UART on PCB - 115200 8N1
- Serial / COM: 1X RS232/RS485 on board (GPIO/6 hi:RS485 lo:RS232)
- GPIO Watchdog: GPIO/0 mode=toggle timeout=1s
- Modem: 1x Built-in modem on board (Power: GPIO/4 active-high)
- PCIe: 1x miniPCIe for modem [slot not install]
- SIM Slots: 1x SIM Slots
Issue:
- Factory partition not store mac address on original firmware
Flash instruction:
Using SSH/Telnet:
1. Connect the board to the computer via RJ45 Ethernet
2. Login 192.168.8.1 with root password "superzxmn" (SSH Port 22, Telnet Port 5188)
3. Download openwrt firmware on the computer.
4. Use scp or sftp put firmware to board /tmp
5. Use command "mtd -r write openwrt-ramips-mt76x8-hongdian_h7920-v40-squashfs-sysupgrade.bin firmware"
to flash
Original Firmware Dump / More details:
https://blog.gov.cooking/archives/research-hongdian-h7920-v40-and-flash.html
Signed-off-by: Coia Prant <coiaprant@gmail.com>
Tested-by: Coia Prant <coiaprant@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17726
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
CreatLentem CLT-R30B1 is a wireless WiFi 6 router.
This device uses the CLT-R30B1_0824_V1.1 board
shared by EDUP RT2980, Dragonglass DXG21,
and other diamond-shaped 5-antenna routers.
Specification
-------------
- SoC : MediaTek MT7981B dual-core ARM Cortex-A53 1.3 GHz
- RAM : DDR3 256 MiB
- Flash : SPI-NAND 128 MiB (ESMT F50L1G41LB)
- WLAN : MediaTek MT7976CN dual-band WiFi 6
- 2.4 GHz : b/g/n/ax, MU-MIMO (2x 5 dBi antennas)
- 5 GHz : a/n/ac/ax, MU-MIMO (3x 5 dBi antennas)
- Ethernet :
- LAN x3 : 10/100/1000 Mbps (MediaTek MT7531AE)
- WAN x1 : 10/100/1000 Mbps (MT7981 internal PHY)
- UART : through-hole on PCB
- assignment : (RX), (TX), (GND), [3.3V]
- settings : 115200n8
- Buttons x2 : Mesh/WPS, Reset
- LEDs x2 : Status (Red, Green)
- Power : 12 VDC, 1 A, 2.1*5.5 mm
Important notes
---------------
The device is supplied in two variants.
The main difference is the size of the mtd5 (ubi)
partition in the flash layout: 64M or 112M.
112M version: Has ImmortalWrt firmware installed with LuCI WebUI.
64M version: Has stock firmware based on OpenWrt,
with the WaveLink/GL.iNet WebUI and older U-Boot
compared to the 112M version.
Flash instructions for 112M version
-----------------------------------
Follow the standard OpenWrt sysupgrade procedure without saving data.
Use the clt-r30b1-112m-squashfs-sysupgrade.bin image.
All checks should pass - don't proceed if a "not supported"
warning is issued.
Flash instructions for 64M version
----------------------------------
WebUI Method:
1. Prepare the upgrade image with clt-r30b1-squashfs-sysupgrade.bin
using the script: make_staged_upgrade_tar.sh
or use the prepared image: staged_openwrt_upgrade.bin
Downloaded from:
https://github.com/andros-ua/owrt-misc/tree/main/clt-r30b1
2. Install the prepared image using the stock WebUI update page.
3. Press and hold the reset button after reboot
to wipe the stock config and gain access.
SSH Method:
1. Connect via SSH using dg:ivanlee credentials.
2. Upload the clt-r30b1-squashfs-sysupgrade.bin image.
3. Use the command: sysupgrade -n
All checks should pass - don't proceed if a "not supported"
warning is issued.
Return to stock
---------------
Flash a backup of the ubi mtdblock (mtd5)
using the OpenWrt sysupgrade method.
Recovery
--------
Both variants:
Connect UART and use the U-Boot menu to flash the firmware image
or boot an OpenWrt initramfs image.
112M with newer U-Boot:
Power on the router while pressing the mesh button for 3 seconds.
The U-Boot Flash WebUI will be available at http://192.168.1.1
MAC Addresses:
-------------------------------------------------------
| Interface | MAC | Source |
---------------|-------------------|-------------------
| LAN | B4:4D:43:D1:xx:xx | Factory, 0x2A |
| WAN | B4:4D:43:D1:xx:xx | Factory, 0x24 |
| WLAN 2.4 GHz | B4:4D:43:D2:xx:xx | Factory, 0x4 |
| WLAN 5 GHz | B4:4D:43:D2:xx:xx | Factory, 0x4 + 1 |
-------------------------------------------------------
Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19534
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Build DWC3 driver in the right mode:
- host mode if kernel have usb host support only.
- gadget mode if kernel have usbgadget support only.
- dual-role mode if kernel have both usb host and usbgadget support.
Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/19246
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The usb role driver does not depend on the kernel config CONFIG_USB (host
side support). It only depends on the kernel config CONFIG_USB_SUPPORT.
Now it depends on the OpenWrt configurations USB_SUPPORT or
USB_GADGET_SUPPORT (usb and usbgadget features). We can assume that if usb
or usbgadget features are set, CONFIG_USB_SUPPORT has been set in the
target/subtarget kernel config.
Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/19246
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The current variables tagged_ports and untagged_ports suggest that
these are distinct and describe only the ports in each of these
configuration types.
That is wrong. The hardware is configured via member ports and
untagged ports. The first one being a superset of the second.
Rename the variables to reflect that.
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/19684
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Both RTL930x and RTL931x were missing the code to support enabling and
disabling MAC address learning and unknown unicast flooding on a per-port
basis.
* rtl93*x_enable_learning() allows toggling of dynamic MAC learning on
individual ports by modifying the L2 learning constraint control
register.
* rtl93*x_enable_flood() provides the ability to control unknown unicast
flooding behavior, disabling forwarding when set. If it is enabled, it
will just forward it. If it is disabled, packets will simply be dropped.
Signed-off-by: Harshal Gohel <hg@simonwunderlich.de>
Signed-off-by: Sharadanand Karanjkar <sk@simonwunderlich.de>
Link: https://github.com/openwrt/openwrt/pull/19581
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware
--------
- SOC: MediaTek MT7981B
- RAM: 256MB DDR3
- FLASH: 128MB SPI-NAND WinBond W25N01GVZEIG
- NETWORK: 2x1Gb Lan 1x1Gb Wan
- WIFI: MediaTek MT7981B 2x2 DBDC 802.11ax 2T2R (2.4/5)
- LEDs: 3x WAN/LAN (green) 2x STATUS (red/blue)
- USB: 1x XHCI
Installation via Webinterface
-----------------------------
1. Rename OpenWrt sysupgrade bin to wavlink_wl-wn551X3-squashfs-sysupgrade.bin
The uppercase chars 551X3 are essential and checked by web interface.
2. Logon to webinterface
3. Go to network configuration -> mode selection
4. Choose mode "LAN bridge/access point"
5. Save configuration (maybe network reconfig needed)
6. Go to system upgrade
7. Choose local upgrade and provide renamed sysupgrade file
8. Start upgrade and wait for completion
9. Logon to OpenWrt (network config is preserved during upgrade)
Boot initramfs via TFTP & console
---------------------------------
1. Connect switch to network via LAN1 or LAN2
2. Power on switch
3. Press ESC until prompt reached "MT7981>"
4. Set own IP "setenv ipaddr 192.168.x.y"
5. Set TFTP IP "setenv serverip 192.168.a.b"
6. Set memory address "setenv loadaddr 0x46000000"
7. Download image "tftpboot openwrt-mediatek-filogic-wavlink_wl-wn551x3-initramfs.itb"
8. Boot image "bootm"
Notes
-----
- The red/blue LEDs give a background illumination to the top of the
case. The red LED is totally disabled to avoid noisy blinking.
- Aside from the design and the different LED colors & placements
the hardware and partitioning matches the WAVLINK WL-WN586X3 Rev B.
Therefor a common DTSI was prepared.
MAC Addresses (same as stock)
-----------------------------
LAN : 80:3F:5D:xx:xx:B1 (hw, 0x44e(text))
WAN : 80:3F:5D:xx:xx:B2 (hw, 0x460(text))
2.4GHz: 80:3F:5D:xx:xx:B1 (Factory, 0x4 (hex))
5GHz : driver auto generated
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/19515
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Define MSM430 as alternative name, to explicitly show the device is
supported using existing image (MSM460).
I can confirm that the guide from
https://github.com/blocktrron/msm460-flashing works perfectly fine with
the HP MSM430 as well.
In fact, the MSM430 running the original firmware operates as
a 2x3:2 access point, but after flashing it with OpenWRT, it functions
as a 3x3:3 access point — just like the MSM460 model.
It seems that the MSM430 is essentially the same hardware as the MSM460,
with limitations imposed by the original (HP) software.
Signed-off-by: Jan Taczanowski <jan.taczanowski@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19540
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for a dual-band AC1200 wall plug
manufactured by Shenzhen Century Xinyang Tech Co., Ltd.
SoC: Mediatek MT7628AN (MIPS 24KEc single core, 580 MHz)
RAM: 128 MiB DDR2 (Hynix HY5PS1G1631C)
ROM: 8 MiB SPI NOR (Zbit ZB25VQ64ASIG)
Wired: one FE RJ45 port (+ an unpopulated footprint for a 2nd)
WiFi: Mediatek MT7612E
Ant.: four 2 dBi external antennas (two 2.4GHz, two 5 GHz)
LEDs: - Power (green, always on)
- 2.4G (green, controlled by MT7628)
- 5G (green, controlled by MT7612)
- Extender (green, GPIO 37, used as status LED)
- LAN (green/yellow, controlled by RT3050 ESW)
Buttons: WPS and reset (both connected to GPIO 38)
Power: 5V 2-pin JST-XH on main PCB
110/220V AC to 5V 1.5A DC on auxiliary PCB
UART: 57600 8n1 3.3v, holes available on the PCB as J5
pinout is (Gnd) (Tx) (Rx)
MAC: 1C:BF:CE:xx:xx:xx (2.4 GHz, label)
1C:BF:CE:xx:xx:xx + 1 (LAN)
1C:BF:CE:xx:xx:xx + 2 (WAN, not in use)
1C:BF:CE:xx:xx:xx + 3 (5 GHz)
Original firmware is Chaos Calmer 15.05.01 (kernel 3.10.108)
with a few custom packages and a non-LuCI web interface.
Telnet is enabled, requiring an unknown root password [1].
Root password is also needed to access the router via UART console,
but passwordless telnet can be enabled via a trivial web exploit [2]
and then the root password can be removed by editing `/etc/shadow`.
Installation: Upload `sysupgrade` binary via web interface at
`http://192.168.188.1/settings.shtml`. Alternatively, remove
root password and use u-boot menu to flash image via TFTP.
Notes:
- Device model in Chaos Calmer is "mtk-apsoc-demo".
- It is sold under several brands, e.g., Fenvi and Linkavenir.
It is available in two colors: white and black.
- PCB is marked "WD206AD v1.0".
- Instead of a standard ethernet transformer, the PCB has a few tiny
SMD coils.
- The housing is identical to the one used by a 2020 model,
WD-R1203U, which is RTL8812-based. The older model has an FCC
listing with external and internal images: ZNPWD-R1203U.
The FCC listing contains a letter [3] claiming WD-R1203U and
WD-R1208U are internally identical, but evidently they are not.
[1] root:$1$7rmMiPJj$91iv9LWhfkZE/t7aCBdo.0:18388:0:99999:7:::
This is the same hash as in Wodesys WD-R1802U.
There are other root password hashes in `/etc/shadow_sf` and
`/etc/shadow_yn`.
[2] curl -X POST http://192.168.188.1/cgi-bin/adm.cgi \
-d page=Lang -d langType="en;killall telnetd;telnetd -l /bin/sh"
[3] https://fcc.report/FCC-ID/ZNPWD-R1203U/4767033
Signed-off-by: Rani Hod <rani.hod@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19535
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
