fe6f298b07
The VAR11N-300 is a tiny wireless-N device with a hardwired Ethernet cable, one extra Ethernet port, and an internal antenna, based on the MediaTek MT7620n chipset. Specs: - MT7620n WiSoC @ 600MHz - 32 MB SDRAM - 4 MB SPI flash - 2T2R 2.4GHz WiFi-N - 1 attached 10/100 Ethernet cable (LAN) - 1 10/100 Ethernet port (WAN) - 1 attached USB / barrel 5vdc power cable - 5 LEDs (see notes below) - 1 reset button - 1 UART (3 pads on board) Installation: The stock firmware does not support uploading new firmware directly, only checking the manufacturer's site for updates. This process may be possible to spoof, but the update check uses some kind of homebrew encryption that I didn't investigate. Instead, you can install via a backdoor: 1. Set up a TFTP server to serve the firmware binary (lede-ramips-mt7620-var11n-300-squashfs-sysupgrade.bin) 2. Factory reset the device by holding the reset button for a few seconds. 3. Open the web interface (default IP: 192.168.253.254) 4. Log in with the "super admin" credentials: username `vonets`, password `vonets26642519`. 5. On the "Operative Status" page, click the text "System Uptime", then quickly click the uptime value. 6. If successful, an alert dialog will appear reading "Ated start", and the device will now accept telnet connections. If the alert does not appear, repeat step 5 until it works (the timing is a bit tricky). 7. Telnet to the device using credentials "admin / admin" 8. Retrieve the firmware binary from the tftp server: `tftp -l lede.bin -r lede-ramips-mt7620-var11n-300-squashfs-sysupgrade.bin -g <tftp-server-ip>` 9. Write the firmware to flash: `mtd_write write lede.bin /dev/mtd4` 10. Reboot Tested: - LAN / WAN ethernet - WiFi - LAN / WAN / status LED GPIOs (see notes below) - Reset button - Sysupgrade Notes: LEDs: The board has 5 LEDs - two green LEDs for LAN / WAN activity, one blue LED for WiFi, and a pair of "status" LEDs connected to the same GPIO (the blue LED lights when the GPIO is low, and the green when it's high). I was unable to determine how to operate the WiFi LED, as it does not appear to be controlled by a GPIO directly. Recovery: The default U-boot installation will only boot from flash due to a missing environment block. I generated a valid 4KB env block using U-boot's `fw_setenv` tool and wrote it to flash at 0x30000 using an external programmer. After this, it was possible to enter the U-boot commandline interface and download a new image via TFTP (`tftpboot 81b00000 <image-filename>`), but while I could boot this image sucessfully (`bootm`), writing it to flash (`cp.linux`) just corrupted the flash chip. The sysupgrade file can be written to flash at 0x50000 using an external programmer. Signed-off-by: Andrew Crawley <acrawley@gmail.com>
536 lines
10 KiB
Bash
Executable file
536 lines
10 KiB
Bash
Executable file
#!/bin/sh
|
|
|
|
. /lib/functions.sh
|
|
. /lib/functions/uci-defaults.sh
|
|
. /lib/functions/system.sh
|
|
|
|
ramips_setup_rt3x5x_vlans()
|
|
{
|
|
if [ ! -x /sbin/swconfig ]; then
|
|
# legacy default
|
|
ucidef_set_interfaces_lan_wan "eth0.1" "eth0.2"
|
|
return
|
|
fi
|
|
local wanports=""
|
|
local lanports=""
|
|
for port in 5 4 3 2 1 0; do
|
|
if [ `swconfig dev rt305x port $port get disable` = "1" ]; then
|
|
continue
|
|
fi
|
|
if [ `swconfig dev rt305x port $port get lan` = "0" ]; then
|
|
wanports="$port:wan $wanports"
|
|
else
|
|
lanports="$port:lan $lanports"
|
|
fi
|
|
done
|
|
ucidef_add_switch "rt305x" $lanports $wanports "6t@eth0"
|
|
}
|
|
|
|
ramips_setup_interfaces()
|
|
{
|
|
local board="$1"
|
|
|
|
case $board in
|
|
11acnas|\
|
|
w2914nsv2|\
|
|
zbt-we2026)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan:4" "1:lan:3" "2:lan:2" "3:lan:1" "4:wan:5" "6@eth0"
|
|
;;
|
|
3g150b|\
|
|
3g300m|\
|
|
a5-v11|\
|
|
all0256n-4M|\
|
|
all0256n-8M|\
|
|
all5002|\
|
|
all5003|\
|
|
broadway|\
|
|
dcs-930|\
|
|
dcs-930l-b1|\
|
|
ht-tm02|\
|
|
linkits7688 | \
|
|
m2m|\
|
|
microwrt|\
|
|
mpr-a2|\
|
|
ncs601w|\
|
|
omega2 | \
|
|
omega2p | \
|
|
timecloud|\
|
|
w150m|\
|
|
widora-neo|\
|
|
wnce2001|\
|
|
zbt-cpe102|\
|
|
zte-q7)
|
|
ucidef_add_switch "switch0"
|
|
ucidef_add_switch_attr "switch0" "enable" "false"
|
|
ucidef_set_interface_lan "eth0"
|
|
;;
|
|
mlw221|\
|
|
mr-102n)
|
|
ucidef_set_interface_lan "eth0.2"
|
|
;;
|
|
3g-6200n|\
|
|
ai-br100|\
|
|
d240|\
|
|
db-wrt01|\
|
|
dir-300-b7|\
|
|
dir-320-b1|\
|
|
dir-610-a1|\
|
|
dir-615-h1|\
|
|
ew1200|\
|
|
firewrt|\
|
|
hc5661a|\
|
|
hc5962|\
|
|
hlk-rm04|\
|
|
k2p|\
|
|
kn|\
|
|
kn_rc|\
|
|
mac1200rv2|\
|
|
miwifi-mini|\
|
|
miwifi-nano|\
|
|
mt7621|\
|
|
mt7628|\
|
|
mzk-750dhp|\
|
|
mzk-w300nh2|\
|
|
nixcore-x1-8M|\
|
|
nixcore-x1-16M|\
|
|
oy-0001|\
|
|
pbr-m1|\
|
|
psg1208|\
|
|
psg1218a|\
|
|
r6220|\
|
|
rt-n12p|\
|
|
sap-g3200u3|\
|
|
sk-wb8|\
|
|
u7621-06-256M-16M|\
|
|
vr500|\
|
|
wf-2881|\
|
|
witi|\
|
|
wl-wn575a3|\
|
|
wndr3700v5|\
|
|
wt1520-4M|\
|
|
wt1520-8M|\
|
|
y1|\
|
|
youku-yk1|\
|
|
zbt-ape522ii|\
|
|
zbt-we1326|\
|
|
zbtlink,zbt-we3526|\
|
|
zbt-we826-16M|\
|
|
zbt-we826-32M|\
|
|
zbt-wg2626|\
|
|
zbt-wg3526-16M|\
|
|
zbt-wg3526-32M|\
|
|
zbt-wr8305rt)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan" "1:lan" "2:lan" "3:lan" "4:wan" "6@eth0"
|
|
;;
|
|
mir3g)
|
|
ucidef_add_switch "switch0" \
|
|
"2:lan:2" "3:lan:1" "1:wan" "6t@eth0"
|
|
;;
|
|
psg1218b)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan:3" "1:lan:2" "2:lan:1" "3:wan" "6@eth0"
|
|
;;
|
|
whr-300hp2|\
|
|
whr-600d|\
|
|
wsr-1166|\
|
|
wsr-600)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan:1" "1:lan:2" "2:lan:3" "3:lan:4" "4:wan:5" "6@eth0"
|
|
;;
|
|
ar670w|\
|
|
ar725w|\
|
|
rt-ac51u)
|
|
ucidef_add_switch "switch0" \
|
|
"0:wan" "1:lan" "2:lan" "3:lan" "4:lan" "6t@eth0"
|
|
;;
|
|
rt-n15|\
|
|
wl-351)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan" "1:lan" "2:lan" "3:lan" "4:wan" "5@eth0"
|
|
;;
|
|
asl26555-8M|\
|
|
asl26555-16M|\
|
|
rp-n53)
|
|
ucidef_add_switch "switch0" \
|
|
"1:lan" "2:lan" "3:lan" "4:lan" "6t@eth0"
|
|
;;
|
|
atp-52b|\
|
|
awm002-evb-4M|\
|
|
awm002-evb-8M|\
|
|
c20i|\
|
|
dir-645|\
|
|
f5d8235-v2|\
|
|
gl-mt300a|\
|
|
gl-mt300n|\
|
|
gl-mt750|\
|
|
hg255d|\
|
|
jhr-n805r|\
|
|
jhr-n825r|\
|
|
jhr-n926r|\
|
|
mzk-wdpr|\
|
|
rb750gr3|\
|
|
rt-n14u|\
|
|
tl-wr840n-v4|\
|
|
tl-wr840n-v5|\
|
|
tl-wr841n-v13|\
|
|
u7628-01-128M-16M|\
|
|
ubnt-erx|\
|
|
ubnt-erx-sfp|\
|
|
ur-326n4g|\
|
|
wrtnode|\
|
|
wrtnode2p | \
|
|
wrtnode2r | \
|
|
wt3020-4M|\
|
|
wt3020-8M|\
|
|
zbt-wa05)
|
|
ucidef_add_switch "switch0" \
|
|
"1:lan" "2:lan" "3:lan" "4:lan" "0:wan" "6@eth0"
|
|
;;
|
|
c20|\
|
|
c50)
|
|
ucidef_add_switch "switch0" \
|
|
"1:lan:3" "2:lan:4" "3:lan:1" "4:lan:2" "0:wan" "6@eth0"
|
|
;;
|
|
dir-860l-b1)
|
|
ucidef_add_switch "switch0" \
|
|
"1:lan:4" "2:lan:3" "3:lan:2" "4:lan:1" "0:wan" "6@eth0"
|
|
;;
|
|
gb-pc1)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan" "4:lan" "6@eth0"
|
|
;;
|
|
gl-mt300n-v2)
|
|
ucidef_add_switch "switch0" \
|
|
"1:lan" "0:wan" "6@eth0"
|
|
;;
|
|
awapn2403)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan" "1:wan" "6@eth0"
|
|
;;
|
|
b2c|\
|
|
nw718|\
|
|
psr-680w|\
|
|
sl-r7205|\
|
|
ur-336un|\
|
|
w502u|\
|
|
wr6202)
|
|
ucidef_set_interfaces_lan_wan "eth0.1" "eth0.2"
|
|
;;
|
|
br-6475nd)
|
|
ucidef_add_switch "switch0" \
|
|
"1:lan" "2:lan" "3:lan" "4:lan" "0:wan" "9@eth0"
|
|
;;
|
|
c108|\
|
|
cf-wr800n)
|
|
ucidef_add_switch "switch0" \
|
|
"4:lan" "6t@eth0"
|
|
;;
|
|
cy-swr1100)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan" "1:lan" "2:lan" "3:lan" "4:wan" "9@eth0"
|
|
;;
|
|
cs-qr10|\
|
|
d105|\
|
|
dch-m225|\
|
|
ex2700|\
|
|
ex3700|\
|
|
hpm|\
|
|
mzk-ex300np|\
|
|
mzk-ex750np|\
|
|
na930|\
|
|
pbr-d1|\
|
|
u25awf-h1|\
|
|
wli-tx4-ag300n|\
|
|
wmdr-143n|\
|
|
wmr-300|\
|
|
wn3000rpv3|\
|
|
wrh-300cr)
|
|
ucidef_set_interface_lan "eth0"
|
|
;;
|
|
duzun-dm06)
|
|
ucidef_add_switch "switch0" \
|
|
"1:lan" "0:wan" "6@eth0"
|
|
;;
|
|
e1700|\
|
|
mt7620a_mt7530)
|
|
ucidef_add_switch "switch1" \
|
|
"0:lan" "1:lan" "2:lan" "3:lan" "4:wan" "6@eth0"
|
|
;;
|
|
hc5*61|\
|
|
y1s)
|
|
ucidef_add_switch "switch0" \
|
|
"1:lan" "2:lan" "3:lan" "4:lan" "5:lan" "0:wan" "6@eth0"
|
|
;;
|
|
kn_rf)
|
|
ucidef_add_switch "switch0" \
|
|
"0:wan" "1:lan" "2:lan" "3:lan" "4:lan" "6@eth0"
|
|
;;
|
|
kng_rc)
|
|
ucidef_add_switch "switch1" \
|
|
"0:lan" "1:lan" "2:lan" "3:lan" "4:wan" "7t@eth0"
|
|
;;
|
|
mlwg2|\
|
|
wizard8800|\
|
|
wl-330n)
|
|
ucidef_set_interface_lan "eth0.1"
|
|
;;
|
|
mr200)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan" "1:lan" "2:lan" "3:lan" "6t@eth0"
|
|
ucidef_set_interface_wan "usb0"
|
|
;;
|
|
mzk-dp150n|\
|
|
vocore-8M|\
|
|
vocore-16M)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan" "4:lan" "6t@eth0"
|
|
;;
|
|
newifi-d1)
|
|
ucidef_add_switch "switch0" \
|
|
"1:lan:2" "2:lan:1" "4:wan" "6@eth0"
|
|
;;
|
|
re350-v1)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan" "6@eth0"
|
|
;;
|
|
re6500)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan:1" "1:lan:2" "2:lan:3" "3:lan:4" "6@eth0"
|
|
;;
|
|
rt-n56u)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan" "1:lan" "2:lan" "3:lan" "4:wan" "8@eth0"
|
|
;;
|
|
tew-638apb-v2)
|
|
ucidef_add_switch "switch0" \
|
|
"4:lan" "6@eth0"
|
|
;;
|
|
tew-691gr|\
|
|
tew-692gr|\
|
|
wlr-6000)
|
|
ucidef_add_switch "switch0" \
|
|
"1:lan" "2:lan" "3:lan" "4:lan" "5:wan" "0@eth0"
|
|
;;
|
|
vonets,var11n-300)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan" "4:wan" "6@eth0"
|
|
;;
|
|
vocore2|\
|
|
vocore2lite)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan" "2:lan" "6t@eth0"
|
|
;;
|
|
f5d8235-v1|\
|
|
tew-714tru|\
|
|
v11st-fe|\
|
|
wzr-agl300nh)
|
|
ucidef_add_switch "switch0" \
|
|
"1:lan" "2:lan" "3:lan" "4:lan" "0:wan" "5@eth0"
|
|
;;
|
|
wcr-1166ds)
|
|
ucidef_add_switch "switch0" \
|
|
"3:lan" "4:wan" "6@eth0"
|
|
;;
|
|
wcr-150gn|\
|
|
we1026-5g-16m)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan" "6t@eth0"
|
|
;;
|
|
whr-1166d)
|
|
ucidef_add_switch "switch0" \
|
|
"0:lan" "1:lan" "2:lan" "3:lan" "5:wan" "6@eth0"
|
|
;;
|
|
wizfi630a)
|
|
ucidef_add_switch "switch0" \
|
|
"1:lan" "2:lan" "0:wan" "6@eth0"
|
|
;;
|
|
*)
|
|
RT3X5X=`cat /proc/cpuinfo | egrep "(RT3.5|RT5350)"`
|
|
if [ -n "${RT3X5X}" ]; then
|
|
ramips_setup_rt3x5x_vlans
|
|
else
|
|
ucidef_set_interfaces_lan_wan "eth0.1" "eth0.2"
|
|
fi
|
|
;;
|
|
esac
|
|
}
|
|
|
|
ramips_setup_macs()
|
|
{
|
|
local board="$1"
|
|
local lan_mac=""
|
|
local wan_mac=""
|
|
|
|
case $board in
|
|
a5-v11|\
|
|
ht-tm02|\
|
|
wmdr-143n)
|
|
lan_mac=$(cat /sys/class/net/eth0/address)
|
|
;;
|
|
all0239-3g|\
|
|
carambola|\
|
|
freestation5|\
|
|
w502u|\
|
|
wnce2001)
|
|
wan_mac=$(mtd_get_mac_binary factory 46)
|
|
;;
|
|
bc2|\
|
|
broadway|\
|
|
d105|\
|
|
dir-300-b7|\
|
|
dir-320-b1|\
|
|
dir-620-a1|\
|
|
esr-9753|\
|
|
freestation5|\
|
|
hlk-rm04|\
|
|
mpr-a1|\
|
|
psr-680w|\
|
|
sl-r7205|\
|
|
y1|\
|
|
y1s)
|
|
lan_mac=$(cat /sys/class/net/eth0/address)
|
|
lan_mac=$(macaddr_setbit_la "$lan_mac")
|
|
wan_mac=$(macaddr_add "$lan_mac" 1)
|
|
;;
|
|
br-6475nd)
|
|
lan_mac=$(cat /sys/class/net/eth0/address)
|
|
wan_mac=$(mtd_get_mac_binary devdata 7)
|
|
;;
|
|
cy-swr1100|\
|
|
dch-m225)
|
|
lan_mac=$(mtd_get_mac_ascii factory lanmac)
|
|
;;
|
|
dir-645)
|
|
lan_mac=$(mtd_get_mac_ascii nvram lanmac)
|
|
wan_mac=$(mtd_get_mac_ascii nvram wanmac)
|
|
;;
|
|
dir-860l-b1)
|
|
lan_mac=$(mtd_get_mac_ascii factory lanmac)
|
|
wan_mac=$(mtd_get_mac_ascii factory wanmac)
|
|
;;
|
|
e1700)
|
|
wan_mac=$(mtd_get_mac_ascii config WAN_MAC_ADDR)
|
|
;;
|
|
gl-mt300n-v2)
|
|
wan_mac=$(mtd_get_mac_binary factory 4)
|
|
;;
|
|
hc5*61|\
|
|
hc5661a|\
|
|
hc5962)
|
|
lan_mac=`mtd_get_mac_ascii bdinfo "Vfac_mac "`
|
|
[ -n "$lan_mac" ] || lan_mac=$(cat /sys/class/net/eth0/address)
|
|
wan_mac=$(macaddr_add "$lan_mac" 1)
|
|
;;
|
|
kn_rc|\
|
|
kn_rf|\
|
|
kng_rc)
|
|
wan_mac=$(mtd_get_mac_binary factory 40)
|
|
;;
|
|
linkits7688)
|
|
wan_mac=$(mtd_get_mac_binary factory 4)
|
|
lan_mac=$(mtd_get_mac_binary factory 46)
|
|
;;
|
|
mac1200rv2)
|
|
lan_mac=$(mtd_get_mac_binary factory_info 13)
|
|
wan_mac=$(macaddr_add "$lan_mac" 1)
|
|
;;
|
|
mir3g)
|
|
lan_mac=$(mtd_get_mac_binary Factory 0xe006)
|
|
;;
|
|
miwifi-mini)
|
|
wan_mac=$(cat /sys/class/net/eth0/address)
|
|
lan_mac=$(macaddr_setbit_la "$wan_mac")
|
|
;;
|
|
m3|\
|
|
m4-4M|\
|
|
m4-8M|\
|
|
x5|\
|
|
x8)
|
|
lan_mac=$(cat /sys/class/net/eth0/address)
|
|
lan_mac=$(macaddr_add "$lan_mac" -2)
|
|
;;
|
|
newifi-d1)
|
|
lan_mac=$(cat /sys/class/net/eth0/address)
|
|
lan_mac=$(macaddr_add "$lan_mac" 2)
|
|
;;
|
|
omega2|\
|
|
omega2p)
|
|
wan_mac=$(mtd_get_mac_binary factory 4)
|
|
lan_mac=$(mtd_get_mac_binary factory 46)
|
|
;;
|
|
oy-0001)
|
|
lan_mac=$(mtd_get_mac_binary factory 40)
|
|
wan_mac=$(mtd_get_mac_binary factory 46)
|
|
;;
|
|
r6220)
|
|
wan_mac=$(mtd_get_mac_binary factory 4)
|
|
lan_mac=$(macaddr_add "$wan_mac" 1)
|
|
;;
|
|
rt-n56u)
|
|
lan_mac=$(cat /sys/class/net/eth0/address)
|
|
lan_mac=$(macaddr_setbit_la "$lan_mac")
|
|
wan_mac=$(mtd_get_mac_binary factory 32772)
|
|
;;
|
|
sk-wb8)
|
|
wan_mac=$(mtd_get_mac_binary factory 57350)
|
|
;;
|
|
tew-691gr)
|
|
wan_mac=$(macaddr_add "$(mtd_get_mac_binary factory 4)" 3)
|
|
;;
|
|
tew-692gr)
|
|
wan_mac=$(macaddr_add "$(mtd_get_mac_binary factory 4)" 1)
|
|
;;
|
|
tiny-ac)
|
|
lan_mac=$(mtd_get_mac_ascii u-boot-env LAN_MAC_ADDR)
|
|
wan_mac=$(mtd_get_mac_ascii u-boot-env WAN_MAC_ADDR)
|
|
;;
|
|
vr500)
|
|
lan_mac=$(mtd_get_mac_binary factory 57344)
|
|
wan_mac=$(mtd_get_mac_binary factory 57350)
|
|
;;
|
|
w306r-v20)
|
|
lan_mac=$(cat /sys/class/net/eth0/address)
|
|
wan_mac=$(macaddr_add "$lan_mac" 5)
|
|
;;
|
|
wcr-1166ds|\
|
|
wsr-1166)
|
|
local index="$(find_mtd_index "board_data")"
|
|
wan_mac="$(grep -m1 mac= "/dev/mtd${index}" | cut -d= -f2)"
|
|
lan_mac=$wan_mac
|
|
;;
|
|
wcr-150gn)
|
|
wan_mac=$(mtd_get_mac_binary factory 40)
|
|
;;
|
|
whr-1166d|\
|
|
whr-300hp2|\
|
|
whr-600d|\
|
|
wsr-600)
|
|
wan_mac=$(mtd_get_mac_binary factory 4)
|
|
lan_mac=$wan_mac
|
|
;;
|
|
wizfi630a)
|
|
lan_mac=$(mtd_get_mac_binary factory 4)
|
|
wan_mac=$(mtd_get_mac_binary factory 40)
|
|
;;
|
|
wlr-6000)
|
|
wan_mac=$(macaddr_add "$(mtd_get_mac_binary factory 32772)" 2)
|
|
;;
|
|
*)
|
|
lan_mac=$(cat /sys/class/net/eth0/address)
|
|
wan_mac=$(macaddr_add "$lan_mac" 1)
|
|
;;
|
|
esac
|
|
|
|
[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
|
|
[ -n "$wan_mac" ] && ucidef_set_interface_macaddr "wan" $wan_mac
|
|
}
|
|
|
|
board_config_update
|
|
board=$(board_name)
|
|
ramips_setup_interfaces $board
|
|
ramips_setup_macs $board
|
|
board_config_flush
|
|
|
|
exit 0
|