Files
openwrt/target/linux/ramips/dts/mt7628an_wodesys_wd-r1208u.dts
Rani Hod cbc2cdbb80 ramips: mt76x8: add support for Wodesys WD-R1208U
This commit adds support for a dual-band AC1200 wall plug
manufactured by Shenzhen Century Xinyang Tech Co., Ltd.

SoC:     Mediatek MT7628AN (MIPS 24KEc single core, 580 MHz)
RAM:     128 MiB DDR2 (Hynix HY5PS1G1631C)
ROM:     8 MiB SPI NOR (Zbit ZB25VQ64ASIG)
Wired:   one FE RJ45 port (+ an unpopulated footprint for a 2nd)
WiFi:    Mediatek MT7612E
Ant.:    four 2 dBi external antennas (two 2.4GHz, two 5 GHz)
LEDs:    - Power    (green, always on)
         - 2.4G     (green, controlled by MT7628)
         - 5G       (green, controlled by MT7612)
         - Extender (green, GPIO 37, used as status LED)
         - LAN      (green/yellow, controlled by RT3050 ESW)
Buttons: WPS and reset (both connected to GPIO 38)
Power:   5V 2-pin JST-XH on main PCB
         110/220V AC to 5V 1.5A DC on auxiliary PCB
UART:    57600 8n1 3.3v, holes available on the PCB as J5
         pinout is (Gnd) (Tx) (Rx)
MAC:     1C:BF:CE:xx:xx:xx       (2.4 GHz, label)
         1C:BF:CE:xx:xx:xx + 1   (LAN)
         1C:BF:CE:xx:xx:xx + 2   (WAN, not in use)
         1C:BF:CE:xx:xx:xx + 3   (5 GHz)

Original firmware is Chaos Calmer 15.05.01 (kernel 3.10.108)
with a few custom packages and a non-LuCI web interface.
Telnet is enabled, requiring an unknown root password [1].
Root password is also needed to access the router via UART console,
but passwordless telnet can be enabled via a trivial web exploit [2]
and then the root password can be removed by editing `/etc/shadow`.

Installation: Upload `sysupgrade` binary via web interface at
  `http://192.168.188.1/settings.shtml`. Alternatively, remove
  root password and use u-boot menu to flash image via TFTP.

Notes:
- Device model in Chaos Calmer is "mtk-apsoc-demo".
- It is sold under several brands, e.g., Fenvi and Linkavenir.
  It is available in two colors: white and black.
- PCB is marked "WD206AD v1.0".
- Instead of a standard ethernet transformer, the PCB has a few tiny
  SMD coils.
- The housing is identical to the one used by a 2020 model,
  WD-R1203U, which is RTL8812-based. The older model has an FCC
  listing with external and internal images: ZNPWD-R1203U.
  The FCC listing contains a letter [3] claiming WD-R1203U and
  WD-R1208U are internally identical, but evidently they are not.

[1] root:$1$7rmMiPJj$91iv9LWhfkZE/t7aCBdo.0:18388:0:99999:7:::
    This is the same hash as in Wodesys WD-R1802U.
    There are other root password hashes in `/etc/shadow_sf` and
    `/etc/shadow_yn`.
[2] curl -X POST http://192.168.188.1/cgi-bin/adm.cgi \
    -d page=Lang -d langType="en;killall telnetd;telnetd -l /bin/sh"
[3] https://fcc.report/FCC-ID/ZNPWD-R1203U/4767033

Signed-off-by: Rani Hod <rani.hod@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19535
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2025-08-07 18:48:54 +02:00

149 lines
2.5 KiB
Plaintext

// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
#include "mt7628an.dtsi"
#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>
#include <dt-bindings/leds/common.h>
/ {
compatible = "wodesys,wd-r1208u", "mediatek,mt7628an-soc";
model = "Wodesys WD-R1208U";
aliases {
led-boot = &led_status;
led-failsafe = &led_status;
led-running = &led_status;
led-upgrade = &led_status;
label-mac-device = &wmac;
};
keys {
compatible = "gpio-keys";
button-reset { // both reset and wps button
label = "reset";
gpios = <&gpio 38 GPIO_ACTIVE_LOW>;
linux,code = <KEY_RESTART>;
};
};
leds {
compatible = "gpio-leds";
led_status: led-0 {
function = LED_FUNCTION_STATUS;
color = <LED_COLOR_ID_GREEN>;
gpios = <&gpio 37 GPIO_ACTIVE_LOW>;
};
// non-GPIO LEDs:
// Power, WLAN_2GHZ, WLAN_5GHZ, LAN
};
};
&spi0 {
status = "okay";
flash@0 {
compatible = "jedec,spi-nor";
reg = <0>;
spi-max-frequency = <40000000>;
partitions {
compatible = "fixed-partitions";
#address-cells = <1>;
#size-cells = <1>;
partition@0 {
label = "u-boot";
reg = <0x0 0x30000>;
read-only;
};
partition@30000 {
label = "u-boot-env";
reg = <0x30000 0x10000>;
read-only;
};
partition@40000 {
label = "factory";
reg = <0x40000 0x10000>;
read-only;
nvmem-layout {
compatible = "fixed-layout";
#address-cells = <1>;
#size-cells = <1>;
eeprom_factory_0: eeprom@0 {
reg = <0x0 0x400>;
};
eeprom_factory_8000: eeprom@8000 {
reg = <0x8000 0x200>;
};
macaddr_factory_28: macaddr@28 {
reg = <0x28 0x6>;
};
};
};
partition@50000 {
compatible = "denx,uimage";
label = "firmware";
reg = <0x50000 0x7b0000>;
};
};
};
};
&state_default {
gpio {
groups = "wdt", "refclk", "p4led_an";
function = "gpio";
};
wlan {
groups = "wled_an";
function = "wled_an";
};
};
&ethernet {
nvmem-cells = <&macaddr_factory_28>;
nvmem-cell-names = "mac-address";
};
&esw {
mediatek,portdisable = <0x27>;
};
&wmac {
status = "okay";
nvmem-cells = <&eeprom_factory_0>;
nvmem-cell-names = "eeprom";
};
&pcie {
status = "okay";
};
&pcie0 {
wifi@0,0 {
compatible = "mediatek,mt76";
reg = <0x0000 0 0 0 0>;
nvmem-cells = <&eeprom_factory_8000>;
nvmem-cell-names = "eeprom";
ieee80211-freq-limit = <5000000 6000000>;
led {
led-sources = <2>;
led-active-low;
};
};
};