aboutsummaryrefslogtreecommitdiffstats
path: root/package/boot/uboot-envtools/files
Commit message (Collapse)AuthorAgeFilesLines
* layerscape: armv8_64b: add Traverse Ten64 NAND variantMathew McBride2023-07-261-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Ten64 board[1] is based around NXP's Layerscape LS1088A SoC. It is capable of booting both standard Linux distributions from disk devices, using EFI, and booting OpenWrt from NAND. See the online manual for more information, including the flash layout[2]. This patchset adds support for generating Ten64 images for NAND boot. For disk boot, one can use the EFI support that was recently added to the armvirt target. We previously supported NAND users by building inside our armvirt/EFI target[3], but this approach is not suitable for OpenWrt upstream. Users who used our supplied NAND images will be able to upgrade to this via sysupgrade. Signed-off-by: Mathew McBride <matt@traverse.com.au> [1] - https://www.traverse.com.au/hardware/ten64 [2] - https://ten64doc.traverse.com.au/hardware/flash/ [3] - Example: https://gitlab.com/traversetech/ls1088firmware/openwrt/-/commit/285e4360e1604eb466880d245d48efd9962143a5 (cherry picked from commit af0546da3440dba24217949527e503820350ff05)
* uboot-mediatek: add H3C Magic NX30 Pro supportChukun Pan2023-07-131-0/+1
| | | | | | | | The OEM uboot limit brush into 3rd-party firmware. So add a custom uboot build to support openwrt. Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn> (cherry picked from commit 437e79ad6d01100afac9786d287976de6d5cf363)
* mediatek: add support for Netgear EX6250v2 seriesWenli Looi2023-07-131-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Netgear EX6250v2, EX6400v3, EX6410v2, EX6470 are wall-plug 802.11ac (Wi-Fi 5) extenders. Like other MT7629 devices, Wi-Fi does not work currently as there is no driver. Related: https://github.com/openwrt/openwrt/pull/5084 For future reference, 2.4GHz MAC = LAN+1, 5GHz MAC = LAN+2. Specifications: * MT7629, 256 MiB RAM, 16 MiB SPI NOR * MT7761N (2.4GHz) / MT7762N (5GHz) - no driver * Ethernet: 1 port 10/100/1000 * UART: 115200 baud (labeled on board) Installation: * Flash the factory image through the stock web interface, or TFTP to the bootloader. NMRP can be used to TFTP without opening the case. * After installation, perform a factory reset. Wait for the device to boot, then hold the reset button for 10 seconds. This is needed because sysupgrade in the stock firmware will attempt to preserve its configuration using sysupgrade.tgz. See https://github.com/openwrt/openwrt/pull/4182 Revert to stock firmware: * Flash the stock firmware to the bootloader using TFTP/NMRP. Signed-off-by: Wenli Looi <wlooi@ucalgary.ca> (cherry picked from commit 73de41898fcd06d837b013449c370c493bcdc595)
* ramips: add support for Sercomm S1500 devicesMikhail Zhilkin2023-07-021-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds support for following wireless routers: - Beeline SmartBox PRO (Serсomm S1500 AWI) - WiFire S1500.NBN (Serсomm S1500 BUC) This commit is based on this PR: - Link: https://github.com/openwrt/openwrt/pull/4770 - Author: Maximilian Weinmann <x1@disroot.org> The opening of this PR was agreed with author. My changes: - Sorting, minor changes and some movings between dts and dtsi - Move leds to dts when possible - Recipes for the factory image - Update of the installation/recovery/return to stock guides - Add reset GPIO for the pcie1 Common specification -------------------- SoC: MediaTek MT7621AT (880 MHz, 2 cores) Switch: MediaTek MT7530 (via SoC MT7621AT) Wireless: 2.4 GHz, MT7602EN, b/g/n, 2x2 Wireless: 5 GHz, MT7612EN, a/n/ac, 2x2 Ethernet: 5 ports - 5×GbE (WAN, LAN1-4) Mini PCIe: via J2 on PCB, not soldered on the board UART: J4 -> GND[], TX, VCC(3.3V), RX BootLoader: U-Boot SerComm/Mediatek Beeline SmartBox PRO specification ---------------------------------- RAM (Nanya NT5CB128M16FP): 256 MiB NAND-Flash (ESMT F59L2G81A): 256 MiB USB ports: 2xUSB2.0 LEDs: Status (white), WPS (blue), 2g (white), 5g (white) + 10 LED Ethernet Buttons: 2 button (reset, wps), 1 switch button (ROUT<->REP) Power: 12 VDC, 1.5 A PCB Sticker: 970AWI0QW00N256SMT Ver. 1.0 CSN: SG15******** MAC LAN: 94:4A:0C:**:**:** Manufacturer's code: 0AWI0500QW1 WiFire S1500.NBN specification ------------------------------ RAM (Nanya NT5CC64M16GP): 128 MiB NAND-Flash (ESMT F59L1G81MA): 128 MiB USB ports: 1xUSB2.0 LEDs: Status (white), WPS (white), 2g (white), 5g (white) + 10 LED Ethernet Buttons: 2 button (RESET, WPS) Power: 12 VDC, 1.0 A PCB Sticker: 970BUC0RW00N128SMT Ver. 1.0 CSN: MH16******** MAC WAN: E0:60:66:**:**:** Manufacturer's code: 0BUC0500RW1 MAC address table (PRO) ----------------------- use address source LAN *:23 factory 0x1000 (label) WAN *:24 factory $label +1 2g *:23 factory $label 5g *:25 factory $label +2 MAC addresses (NBN) ------------------- use address source LAN *:0e factory 0x1000 WAN *:0f LAN +1 (label) 2g *:0f LAN +1 5g *:10 LAN +2 OEM easy installation --------------------- 1. Remove all dots from the factory image filename (except the dot before file extension) 2. Upload and update the firmware via the original web interface 3. Two options are possible after the reboot: a. OpenWrt - that's OK, the mission accomplished b. Stock firmware - install Stock firmware (to switch booflag from Sercomm0 to Sercomm1) and then OpenWrt factory image. Return to Stock --------------- 1. Change the bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock2 reboot 2. Install stock firmware via the web OEM firmware interface Recovery -------- Use sercomm-recovery tool. Link: https://github.com/danitool/sercomm-recovery Tested-by: Pavel Ivanov <pi635v@gmail.com> Tested-by: Denis Myshaev <denis.myshaev@gmail.com> Tested-by: Oleg Galeev <olegingaleev@gmail.com> Tested-By: Ivan Pavlov <AuthorReflex@gmail.com> Co-authored-by: Maximilian Weinmann <x1@disroot.org> Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com> (cherry picked from commit 2d6784a033a994043759fa3b94c48afd5df81f88)
* mediatek: add support for Mercusys MR90X v1Mikhail Zhilkin2023-07-011-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds support for Mercusys MR90X(EU) v1 router. Device specification -------------------- SoC Type: MediaTek MT7986BLA, Cortex-A53, 64-bit RAM: MediaTek MT7986BLA (512MB) Flash: SPI NAND GigaDevice GD5F1GQ5UEYIGY (128 MB) Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8) Ethernet: 1x2.5Gbe (WAN/LAN 2.5Gbps), 3xGbE (WAN/LAN 1Gbps, LAN1, LAN2) WLAN 2g: MediaTek MT7975N, b/g/n/ax, MIMO 4x4 WLAN 5g: MediaTek MT7975P(N), a/n/ac/ax, MIMO 4x4 LEDs: 1 orange and 1 green status LEDs, 4 green gpio-controlled LEDs on ethernet ports Button: 1 (Reset) USB ports: No Power: 12 VDC, 2 A Connector: Barrel Bootloader: Main U-Boot - U-Boot 2022.01-rc4. Additionally, both UBI slots contain "seconduboot" (also U-Boot 2022.01-rc4) Serial console (UART) --------------------- V +-------+-------+-------+-------+ | +3.3V | GND | TX | RX | +---+---+-------+-------+-------+ | +--- Don't connect The R3 (TX line) and R6 (RX line) are absent on the PCB. You should solder them or solder the jumpers. Installation (UART) ------------------- 1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2 2. Attach UART, switch on the router and interrupt the boot process by pressing 'Ctrl-C' 3. Load and run OpenWrt initramfs image: tftpboot initramfs-kernel.bin bootm 4. Once inside OpenWrt, set / update env variables: fw_setenv baudrate 115200 fw_setenv bootargs "ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit" fw_setenv fdtcontroladdr 5ffc0e70 fw_setenv ipaddr 192.168.1.1 fw_setenv loadaddr 0x46000000 fw_setenv mtdids "spi-nand0=spi-nand0" fw_setenv mtdparts "spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)" fw_setenv netmask 255.255.255.0 fw_setenv serverip 192.168.1.2 fw_setenv stderr serial@11002000 fw_setenv stdin serial@11002000 fw_setenv stdout serial@11002000 fw_setenv tp_boot_idx 0 5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image Installation (without UART) --------------------------- 1. Login as root via SSH (router IP, port 20001, password - your web interface password) 2. Open for editing /etc/hotplug.d/iface/65-iptv (e.g., using WinSCP and SSH settings from the p.1) 3. Add a newline after "#!/bin/sh": telnetd -l /bin/login.sh 4. Save "65-iptv" file 5. Toggle "IPTV/VLAN Enable" checkbox in the router web interface and save 6. Make sure that telnetd is running: netstat -ltunp | grep 23 7. Login via telnet to router IP, port 23 (no username and password are required) 8 Upload OpenWrt "initramfs-kernel.bin" to the "/tmp" folder of the router (e.g., using WinSCP and SSH settings from the p.1) 9. Stock busybox doesn't contain ubiupdatevol command. Hence, we need to download and upload the full version of busybox to the router. For example, from here: https://github.com/xerta555/Busybox-Binaries/raw/master/busybox-arm64 Upload busybox-arm64 to the /tmp dir of the router and run: in the telnet shell: cd /tmp chmod a+x busybox-arm64 10. Check "initramfs-kernel.bin" size: du -h initramfs-kernel.bin 11. Delete old and create new "kernel" volume with appropriate size (greater than "initramfs-kernel.bin" size): ubirmvol /dev/ubi0 -N kernel ubimkvol /dev/ubi0 -n 1 -N kernel -s 9MiB 12. Write OpenWrt "initramfs-kernel.bin" to the flash: ./busybox-arm64 ubiupdatevol /dev/ubi0_1 /tmp/initramfs-kernel.bin 13. u-boot-env can be empty so lets create it (or overwrite it if it already exists) with the necessary values: fw_setenv baudrate 115200 fw_setenv bootargs "ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit" fw_setenv fdtcontroladdr 5ffc0e70 fw_setenv ipaddr 192.168.1.1 fw_setenv loadaddr 0x46000000 fw_setenv mtdids "spi-nand0=spi-nand0" fw_setenv mtdparts "spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)" fw_setenv netmask 255.255.255.0 fw_setenv serverip 192.168.1.2 fw_setenv stderr serial@11002000 fw_setenv stdin serial@11002000 fw_setenv stdout serial@11002000 fw_setenv tp_boot_idx 0 14. Reboot to OpenWrt initramfs: reboot 15. Login as root via SSH (IP 192.168.1.1, port 22) 16. Upload OpenWrt sysupgrade.bin image to the /tmp dir of the router 17. Run sysupgrade: sysupgrade -n /tmp/sysupgrade.bin Recovery -------- 1. Press Reset button and power on the router 2. Navigate to U-Boot recovery web server (http://192.168.1.1/) and upload the OEM firmware Recovery (UART) --------------- 1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2 2. Attach UART, switch on the router and interrupt the boot process by pressing 'Ctrl-C' 3. Load and run OpenWrt initramfs image: tftpboot initramfs-kernel.bin bootm 4. Do what you need (restore partitions from a backup, install OpenWrt etc.) Stock layout ------------ 0x000000000000-0x000000200000 : "boot" 0x000000200000-0x000000300000 : "u-boot-env" 0x000000300000-0x000003500000 : "ubi0" 0x000003500000-0x000006700000 : "ubi1" 0x000006700000-0x000006f00000 : "userconfig" 0x000006f00000-0x000007300000 : "tp_data" ubi0/ubi1 format ---------------- U-Boot at boot checks that all volumes are in place: +-------------------------------+ | Volume Name: uboot Vol ID: 0| | Volume Name: kernel Vol ID: 1| | Volume Name: rootfs Vol ID: 2| +-------------------------------+ MAC addresses ------------- +---------+-------------------+-----------+ | | MAC | Algorithm | +---------+-------------------+-----------+ | label | 00:eb:xx:xx:xx:be | label | | LAN | 00:eb:xx:xx:xx:be | label | | WAN | 00:eb:xx:xx:xx:bf | label+1 | | WLAN 2g | 00:eb:xx:xx:xx:be | label | | WLAN 5g | 00:eb:xx:xx:xx:bd | label-1 | +---------+-------------------+-----------+ label MAC address was found in UBI partition "tp_data", file "default-mac". OEM wireless eeprom is also there (file "MT7986_EEPROM.bin"). Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com> (cherry picked from commit e4fe3097ef6a961874b66932a0ac4be18070630a) [Fix merging conflict] Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
* uboot-envtools: Add u-boot env config for GL-MT3000Jianhui Zhao2023-07-011-0/+3
| | | | | | | | | This commit add u-boot env config for GL-MT3000, so that we can use fw_printenv to print u-boot env and use fw_setenv to set u-boot env in GL-MT3000. Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com> (cherry picked from commit 6892603efa11603c6f365bee1cf94e98336d72aa)
* filogic: add support for Netgear WAX220Flole Systems2023-06-261-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware -------- SOC: MediaTek MT7986 RAM: 1024MB DDR3 FLASH: 128MB SPI-NAND (Winbond) WIFI: Mediatek MT7986 DBDC 802.11ax 2.4/5 GHz ETH: Realtek RTL8221B-VB-CG 2.5 N-Base-T PHY with PoE UART: 3V3 115200 8N1 (Pinout silkscreened / Do not connect VCC) Installation ------------ 1. Download the OpenWrt initramfs image. Copy the image to a TFTP server 2. Connect the TFTP server to the WAX220. Conect to the serial console, interrupt the autoboot process by pressing '0' when prompted. 3. Download & Boot the OpenWrt initramfs image. $ setenv ipaddr 192.168.2.1 $ setenv serverip 192.168.2.2 $ tftpboot openwrt.bin $ bootm 4. Wait for OpenWrt to boot. Transfer the sysupgrade image to the device using scp and install using sysupgrade. $ sysupgrade -n <path-to-sysupgrade.bin> Signed-off-by: Flole Systems <flole@flole.de> Signed-off-by: Stefan Agner <stefan@agner.ch> (cherry picked from commit 984786a2f7ec622c99e8c9cdada65d0ea0cf4e0b)
* ath79: add support for Aruba AP-115David Bauer2023-06-231-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware ======== CPU Qualcomm Atheros QCA9558 RAM 256MB DDR2 FLASH 2x 16M SPI-NOR (Macronix MX25L12805D) WIFI Qualcomm Atheros QCA9558 Atheros AR9590 Installation ============ 1. Attach to the serial console of the AP-105. Interrupt autoboot and change the U-Boot env. $ setenv rb_openwrt "setenv ipaddr 192.168.1.1; setenv serverip 192.168.1.66; netget 0x80060000 ap115.bin; go 0x80060000" $ setenv fb_openwrt "bank 1; cp.b 0xbf100040 0x80060000 0x10000; go 0x80060000" $ setenv bootcmd "run fb_openwrt" $ saveenv 2. Load the OpenWrt initramfs image on the device using TFTP. Place the initramfs image as "ap105.bin" in the TFTP server root directory, connect it to the AP and make the server reachable at 192.168.1.66/24. $ run rb_openwrt 3. Once OpenWrt booted, transfer the sysupgrade image to the device using scp and use sysupgrade to install the firmware. Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit 1b467a902ec9b8bf29805c6928627e8bbad0f14c)
* ramips: Add support for Beeline SmartBox TURBO+Maximilian Weinmann2023-06-171-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds support for Beeline Smart Box TURBO+ (Serсomm S3 CQR) router. Device specification -------------------- SoC Type: MediaTek MT7621AT (880 MHz, 2 cores) RAM (Nanya NT5CC64M16GP): 128 MiB Flash (Macronix MX30LF1G18AC): 128 MiB Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2 Wireless 5 GHz (MT7615N): a/n/ac, 4x4 Ethernet: 5 ports - 5×GbE (WAN, LAN1-4) USB ports: 1xUSB3.0 Buttons: 2 button (reset, wps) LEDs: Red, Green, Blue Zigbee (EFR32MG1B232GG): 3.0 Stock bootloader: U-Boot 1.1.3 Power: 12 VDC, 1.5 A Installation (fw 2.0.9) ----------------------- 1. Login to the web interface under SuperUser (root) credentials. Password: SDXXXXXXXXXX, where SDXXXXXXXXXX is serial number of the device written on the backplate stick. 2. Navigate to Setting -> WAN. Add: Name - WAN1 Connection Type - Static IP Address - 172.16.0.1 Netmask - 255.255.255.0 Save -> Apply. Set default: WAN1 3. Enable SSH and HTTP on WAN. Setting -> Remote control. Add: Protocol - SSH Port - 22 IP Address - 172.16.0.1 Netmask - 255.255.255.0 WAN Interface - WAN1 Save ->Apply Add: Protocol - HTTP Port - 80 IP Address - 172.16.0.1 Netmask - 255.255.255.0 WAN interface - WAN1 Save -> Apply 4. Set up your PC ethernet: Connection Type - Static IP Address - 172.16.0.2 Netmask - 255.255.255.0 Gateway - 172.16.0.1 5. Connect PC using ethernet cable to the WAN port of the router 6. Connect to the router using SSH shell under SuperUser account 7. Make a mtd backup (optional, see related section) 8. Change bootflag to Sercomm1 and reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 reboot 9. Login to the router web interface under admin account 10. Remove dots from the OpenWrt factory image filename 11. Update firmware via web using OpenWrt factory image Revert to stock --------------- Change bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 mtd backup ---------- 1. Set up a tftp server (e.g. tftpd64 for windows) 2. Connect to a router using SSH shell and run the following commands: cd /tmp for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \ tftp -l mtd$i -p 172.16.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done tftp -l mtd.md5 -p 171.16.0.2 Recovery -------- Use sercomm-recovery tool. Link: https://github.com/danitool/sercomm-recovery MAC Addresses (fw 2.0.9) ------------------------ +-----+------------+---------+ | use | address | example | +-----+------------+---------+ | LAN | label | *:e8 | | WAN | label + 1 | *:e9 | | 2g | label + 4 | *:ec | | 5g | label + 5 | *:ed | +-----+------------+---------+ The label MAC address was found in Factory 0x21000 Factory image format -------------------- +---+-------------------+-------------+--------------------+ | # | Offset | Size | Description | +---+-------------------+-------------+--------------------+ | 1 | 0x0 | 0x200 | Tag Header Factory | | 2 | 0x200 | 0x100 | Tag Header Kernel1 | | 3 | 0x300 | 0x100 | Tag Header Kernel2 | | 4 | 0x400 | SIZE_KERNEL | Kernel | | 5 | 0x400+SIZE_KERNEL | SIZE_ROOTFS | RootFS(UBI) | +---+-------------------+-------------+--------------------+ Co-authored-by: Mikhail Zhilkin <csharper2005@gmail.com> Signed-off-by: Maximilian Weinmann <x1@disroot.org> (cherry picked from commit 8fcfb21b16e7537b9a871a1f67cb218c6be93149)
* ipq807x: add initial support for prpl Foundation Haze boardPetr Štetiar2023-06-121-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Haze is prpl Foundation's reference board (WNC LVRP). Board info: - IPQ8072A SoC - 2 GiB RAM - 4 GiB eMMC - 8MiB SPI NOR (MX25U6435F) - 3x 1GigE ports (QCA8075) - 1x 10GigE port (AQR113C) - 1x SFP cage - WiFi 6GHz 160MHz (QCN9074) - WiFi 5GHz 80+80MHz (QCN5054) - WiFi 2.4G (QCN5024) - ARM Standard 20-pin 2.54mm/0.1" JTAG (1V8 !!!) - Bluetooth v5.0 + EDR with integrated Class 1 PA (CYW20704) - 1x M.2 B-key socket with PCIe 3.0 - 1x USB 3.0 port - UART marked J6 is 4-pin 2.54mm/0.1" connector 3V3(arrow),RX,TX,GND (115200 8N1) - Reset and WPS buttons Flashing instructions: 1. From U-Boot boot OpenWrt using initramfs image: IPQ807x# tftpboot openwrt-ipq807x-generic-prpl_haze-initramfs-uImage.itb && bootm 2. In OpenWrt running from initramfs execute sysupgrade: root@OpenWrt:/# sysupgrade -n /tmp/openwrt-ipq807x-generic-prpl_haze-squashfs-sysupgrade.bin Work in progress/known issues: * SFP feature not implemented/tested * M.2 feature not implemented/tested * Bluetooth feature not implemented/tested * 6GHz wireless should be working, but not tested * MAC address assigments for LAN interfaces Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit 2e910039dd7170fd28641e7686c376dba6f0d8a5)
* uboot-mediatek: add Qihoo 360T7 supportChukun Pan2023-05-291-0/+1
| | | | | | | | | The vendor uboot will verify firmware at boot. So add a custom uboot build for this device. Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn> (cherry picked from commit c51eb177308835f811ae43b17dde0ea962ed1df1) Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* mediatek: add support for Zyxel EX5601-T0 routerPietro Ameruoso2023-05-241-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Zyxel EX5601-T0 specifics -------------- The operator specific firmware running on the Zyxel branded EX5601-T0 includes U-Boot modifications affecting the OpenWrt installation. Partition Table | dev | size | erasesize | name | | ---- | -------- | --------- | ------------- | | mtd0 | 20000000 | 00040000 | "spi0.1" | | mtd1 | 00100000 | 00040000 | "BL2" | | mtd2 | 00080000 | 00040000 | "u-boot-env" | | mtd3 | 00200000 | 00040000 | "Factory" | | mtd4 | 001c0000 | 00040000 | "FIP" | | mtd5 | 00040000 | 00040000 | "zloader" | | mtd6 | 04000000 | 00040000 | "ubi" | | mtd7 | 04000000 | 00040000 | "ubi2" | | mtd8 | 15a80000 | 00040000 | "zyubi" | The router boots BL2 which than loads FIP (u-boot). U-boot has hardcoded a command to always launch Zloader "mtd read zloader 0x46000000" and than "bootm". Bootargs are deactivated. Zloader is the zyxel booloader which allow to dual-boot ubi or ubi2, by default access to zloader is blocked. Too zloader checks that the firmware contains a particolar file called zyfwinfo. Additional details regarding Zloader can be found here: https://hack-gpon.github.io/zyxel/ https://forum.openwrt.org/t/adding-openwrt-support-for-zyxel-ex5601-t0/155914 Hardware -------- SOC: MediaTek MT7986a CPU: 4 core cortex-a53 (2000MHz) RAM: 1GB DDR4 FLASH: 512MB SPI-NAND (Micron xxx) WIFI: Wifi6 Mediatek MT7976 802.11ax 5 GHz 4x4 + 2.4GHZ 4x4 ETH: MediaTek MT7531 Switch + SoC 3 x builtin 1G phy (lan1, lan2, lan3) 1 x MaxLinear GPY211B 2.5 N-Base-T phy5 (lan4) 1 x MaxLinear GPY211B 2.5Gbit xor SFP/N-Base-T phy6 (wan) USB: 1 x USB 3.2 Enhanced SuperSpeed port UART: 3V3 115200 8N1 (Pinout: GND KEY RX TX VCC) VOIP: 2 FXS ports for analog phones MAC Address Table ----------------- eth0/lan Factory 0x002a eth1/wan Factory 0x0024 wifi 2.4Ghz Factory 0x0004 wifi 5Ghz Factory 0x0004 + 1 Serial console (UART) --------------------- +-------+-------+-------+-------+-------+ | +3.3V | RX | TX | KEY | GND | +---+---+-------+-------+-------+-------+ | +--- Don't connect Installation ------------ Keep in mind that openwrt can only run on the UBI partition, the openwrt firmware is not able to understand the zloader bootargs. The procedure allows restoring the UBI partition with the Zyxel firmware and retains all the OEM functionalities. 1. Unlock Zloader (this will allow to swap manually between partitions UBI and UBI2): - Attach a usb-ttl adapter to your computer and boot the router. - While the router is booting at some point you will read the following: `Please press Enter to activate this console.` - As soon as you read that press enter, type root and than press enter again (just do it, don't care about the logs scrolling). - Most likely the router is still printing the boot log, leave it boot until it stops. - If everything went ok you should have full root access "root@EX5601-T0:/#". - Type the following command and press enter: "fw_setenv EngDebugFlag 0x1". - Reboot the router. - As soon as you read `Hit any key to stop autoboot:` press Enter. - If everything went ok you should have the following prompt: "ZHAL>". - You have successfully unlocked zloader access, this procedure must be done only once. 2. Check the current active partition: - Boot the router and repeat the steps above to gain root access. - Type the following command to check the current active image: "cat /proc/cmdline". - If `rootubi=ubi` it means that the active partition is `mtd6` - If `rootubi=ubi2` it means that the active partition is `mtd7` - As mentioned earlier we need to flash openwrt into ubi/mtd6 and never overwrite ubi2/mtd7 to be able to fully roll-back. - To activate and boot from mtd7 (ubi2) enter into ZHAL> command prompt and type the following commands: atbt 1 # unlock write atsw # swap boot partition atsr # reboot the router - After rebooting check again with "cat /proc/cmdline" that you are correctly booting from mtd7/ubi2 - If yes proceed with the installation guide. If not probably you don't have a firmware into ubi2 or you did something wrong. 3. Flashing: - Download the sysupgrade file for the router from openwrt, than we need to add the zyfwinfo file into the sysupgrade tar. Zloader only checks for the magic (which is a fixed value 'EXYZ') and the crc of the file itself (256bytes). I created a script to create a valid zyfwinfo file but you can use anything that does exactly the same: https://raw.githubusercontent.com/pameruoso/OpenWRT-Zyxel-EX5601-T0/main/gen_zyfwinfo.sh - Add the zyfwinfo file into the sysupgrade tar. - Enter via telnet or ssh into the router with admin credentials - Enter the following commands to disable the firmware and model checks "zycli fwidcheck off" and "zycli modelcheck off" - Open the router web interface and in the update firmware page select the "restore default settings option" - Select the sysupgrade file and click on upload. - The router will flash and reboot itself into openwrt from UBI 4. Restoring and going back to Zyxel firmware. - Use the ZHAL> command line to manually swap the boot parition to UBI2 with the following: atbt 1 # unlock write atsw # swap boot partition atsr # reboot the router - You will boot again the Zyxel firmware you have into UBI2 and you can flash the zyxel firmware to overwrite the UBI partition and openwrt. Working features ---------------- 3 gbit lan ports Wifi Zyxel partitioning for coexistance with Zloader and dual boot. WAN SFP port (only after exporting pins 57 and 10. gpiobase411) leds reset button serial interface usb port lan ethernet 2.5 gbit port (autosense) wan ethernet 2.5 gbit port (autosense) Not working ---------------- voip (missing drivers or proper zyxel platform software) Swapping the wan ethernet/sfp xor port ---------------- The way to swap the wan port between sfp and ethernet is the following: export the pins 57 and 10. Pin 57 is used to probe if an sfp is present. If pin 57 value is 0 it means that an sfp is present into the cage (cat /sys/class/gpio/gpio468/value). If pin 57 value is 1 it means that no sfp is inserted into the cage. In conclusion by default both 57 an 10 pins are by default 1, which means that the active port is the ethernet one. After inserting an SFP pin 57 will become 0 and you have to manually change the value of pin 10 to 0 too. This is totally scriptable of course. Leds description ------------ All the leds are working out of the box but the leds managed by the 2 maxlinear phy (phy 5 lan, phy6 wan). To activate the phy5 led (rj45 ethernet port led on the back of the router) you have to use mdio-tools. To activate the phy6 led (led on the front of the router for 2.5gbit link) you have to use mdio-tools. Example: Set lan5 led to fast blink on 2500/1000, slow blink on 10/100: mdio mdio-bus mmd 5:30 raw 0x0001 0x33FC Set wan 2.5gbit led to constant on when wan is 2.5gbit: mdio mdio-bus mmd 6:30 raw 0x0001 0x0080 Signed-off-by: Pietro Ameruoso <p.ameruoso@live.it> (cherry picked from commit 1c05388ab04c934ec240e8362321908f91381a90) Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ath79: add support for D-Link DIR-859 A3Shiji Yang2023-05-241-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifications: SOC: QCA9563 775 MHz + QCA9880 Switch: QCA8337N-AL3C RAM: Winbond W9751G6KB-25 64 MiB Flash: Winbond W25Q128FVSG 16 MiB WLAN: Wi-Fi4 2.4 GHz 3*3 + 5 GHz 3*3 LAN: LAN ports *4 WAN: WAN port *1 Buttons: reset *1 + wps *1 LEDs: ethernet *5, power, wlan, wps MAC Address: use address source1 source2 label 40:9b:xx:xx:xx:3c lan && wlan u-boot,env@ethaddr lan 40:9b:xx:xx:xx:3c devdata@0x3f $label wan 40:9b:xx:xx:xx:3f devdata@0x8f $label + 3 wlan2g 40:9b:xx:xx:xx:3c devdata@0x5b $label wlan5g 40:9b:xx:xx:xx:3e devdata@0x76 $label + 2 Install via Web UI: Apply factory image in the stock firmware's Web UI. Install via Emergency Room Mode: DIR-859 A1 will enter recovery mode when the system fails to boot or press reset button for about 10 seconds. First, set computer IP to 192.168.0.5 and Gateway to 192.168.0.1. Then we can open http://192.168.0.1 in the web browser to upload OpenWrt factory image or stock firmware. Some modern browsers may need to turn on compatibility mode. Signed-off-by: Shiji Yang <yangshiji66@qq.com> (cherry picked from commit 0ffbef9317a1dc049ad259c1ec1530355efc0552) Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ath79: improve support for D-Link DIR-8x9 A1 seriesShiji Yang2023-05-241-0/+2
| | | | | | | | | | | | | | | | 1. Remove unnecessary new lines in the dts. 2. Remove duplicate included file "gpio.h" in the device dts. 3. Add missing button labels "reset" and "wps". 4. Unify the format of the reg properties. 5. Add u-boot environment support. 6. Reduce spi clock frequency since the max value suggested by the chip datasheet is only 25 MHz. 7. Add seama header fixup for DIR-859 A1. Without this header fixup, u-boot checksum for kernel will fail after the first boot. Signed-off-by: Shiji Yang <yangshiji66@qq.com> (cherry picked from commit e5d8739aa846db621b6368ba83db17c353a35dea) Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ramips: add support for Linksys RE7000Christoph Krapp2023-05-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware specification: - SoC: MediaTek MT7621AT (880 MHz) - Flash: 16 MB (Macronix MX25L12835FM2I-10G) - RAM: 128 MB (Nanya NT5CC64M16GP-DI) - WLAN 2.4 GHz: 2x2 MediaTek MT7603EN - WLAN 5 GHz: 2x2 MediaTek MT7615N - Ethernet: 1x 10/100/1000 Mbps - LED: Power, Wifi, WPS - Button: Reset, WPS - UART: 1:VCC, 2:GND, 3:TX, 4:RX (from LAN port) Serial console @ 57600,8n1 Flash instructions: Connect to serial console and start up the device. As the bootloader got locked you need to type in a password to unlock U-Boot access. When you see the following output on the console: relocate_code Pointer at: 87f1c000 type in the super secure password: 1234567890 Then select TFTP boot from RAM by selecting option 1 in the boot menu. As Linksys decided to leave out a basic TFTP configuration you need to set server- & client ip as well as the image filename the device will search for. You need to use the initramfs openwrt image for the TFTP boot process. Once openwrt has booted up, upload the sysupgrade image via scp and run sysupgrade as normal. Signed-off-by: Christoph Krapp <achterin@gmail.com>
* ramips: add support for SNR-CPE-ME1Maximilian Weinmann2023-05-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | SNR-CPE-ME1 is a wireless WiFi 5 router manufactured by SNR/NAG company. Specification: - SoC : MediaTek MT7621A - RAM : DDR3 256 MiB - Flash : SPI-NOR 16 MiB (GD25Q128CSIG) - WLAN : 2.4 GHz (MediaTek MT7603EN) 5 GHz (MediaTek MT7610EN) - Ethernet : 10/100/1000 Mbps x5 - Switch : MediaTek MT7530 (in SoC) - USB : 3.0 x1 - UART : through-hole on PCB - [J4] 3.3V, RX, TX, GND (57600n8) - Power : 12 VDC, 2 A Flash instruction via TFTP: 1. Boot SNR-CPE-ME1 to recovery mode (hold the reset button while power on) 2. Send firmware via TFTP client: TFTP Server address: 192.168.1.1 TFTP Client address: 192.168.1.131 3. Wait ~120 seconds to complete flashing 4. Do sysupgrade using web-interface Signed-off-by: Maximilian Weinmann <x1@disroot.org>
* ramips: mt7621: add support for ZyXEL WSM20Andreas Böhler2023-04-291-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ZyXEL WSM20 aka Multy M1 is a cheap mesh router system by ZyXEL based on the MT7621 CPU. Specifications ============== SoC: MediaTek MT7621AT (880MHz) RAM: 256MiB Flash: 128MiB NAND Wireless: 802.11ax (2x2 MT7915E DBDC) Ethernet: 4x 10/100/1000 (MT7530) Button: 1x WPS, 1x Reset, 1x LED On/Off LED: 7 LEDs (3x white, 2x red, 2x green) MAC address assignment ====================== The MAC address assignment follows stock: The label MAC address is the LAN MAC address, the WAN address is read from flash. The WiFi MAC addresses are set in userspace to label MAC + 1 and label MAC + 2. Installation (web interface) ============================ The device is cloud-managed, but there is a hidden local firmware upgrade page in the OEM web interface. The device has to be registered in the cloud in order to be able to access this page. The system has a dual firmware design, there is no way to tell which firmware is currently booted. Therefore, an -initramfs version is flashed first. 1. Log into the OEM web GUI 2. Access the hidden upgrade page by navigating to https://192.168.212.1/gui/#/main/debug/firmwareupgrade 3. Upload the -initramfs-kernel.bin file and flash it 4. Wait for OpenWrt to boot and log in via SSH 5. Transfer the sysupgrade file via SCP 6. Run sysupgrade to install the image 7. Reboot and enjoy NB: If the initramfs version was installed in RAS2, the sysupgrade script sets the boot number to the first partition. A backup has to be performed manually in case the OEM firwmare should be kept. Installation (UART method) ========================== The UART method is more difficult, as the boot loader does not have a timeout set. A semi-working stock firmware is required to configure it: 1. Attach UART 2. Boot the stock firmware until the message about failsafe mode appears 3. Enter failsafe mode by pressing "f" and "Enter" 4. Type "mount_root" 5. Run "fw_setenv bootmenu_delay 3" 6. Reboot, U-Boot now presents a menu 7. The -initramfs-kernel.bin image can be flashed using the menu 8. Run the regular sysupgrade for a permanent installation Changing the partition to boot is a bit cumbersome in U-Boot, as there is no menu to select it. It can only be checked using mstc_bootnum. To change it, issue the following commands in U-Boot: nand read 1800000 53c0000 800 mw.b 1800004 1 1 nand erase 53c0000 800 nand write 1800000 53c0000 800 This selects FW1. Replace "mw.b 1800004 1 1" by "mw.b 1800004 2 1" to change to the second slot. Back to stock ============= It is possible to flash back to stock, but a OEM firmware upgrade is required. ZyXEL does not provide the link on its website, but the link can be acquired from the OEM web GUI by analyzing the transferred JSON objects. It is then a matter of writing the firmware to Kernel2 and setting the boot partition to FW2: mtd write zyxel.bin Kernel2 echo -ne "\x02" | dd of=/dev/mtdblock7 count=1 bs=1 seek=4 conv=notrunc Signed-off-by: Andreas Böhler <dev@aboehler.at> Credits to forum users Annick and SirLouen for their initial work on this device
* ath79: add support for Alcatel HH40VAndreas Böhler2023-04-231-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Alcatel HH40V is a CAT4 LTE router used by various ISPs. Specifications ============== SoC: QCA9531 650MHz RAM: 128MiB Flash: 32MiB SPI NOR LAN: 1x 10/100MBit WAN: 1x 10/100MBit LTE: MDM9607 USB 2.0 (rndis configuration) WiFi: 802.11n (SoC integrated) MAC address assignment ====================== There are three MAC addresses stored in the flash ROM, the assignment follows stock. The MAC on the label is the WiFi MAC address. Installation (TFTP) =================== 1. Connect serial console 2. Configure static IP to 192.168.1.112 3. Put OpenWrt factory.bin file as firmware-system.bin 4. Press Power + WPS and plug in power 5. Keep buttons pressed until TFTP requests are visible 6. Wait for the system to finish flashing and wait for reboot 7. Bootup will fail as the kernel offset is wrong 8. Run "setenv bootcmd bootm 0x9f150000" 9. Reset board and enjoy OpenWrt Installation (without UART) =========================== Installation without UART is a bit tricky and requires several steps too long for the commit message. Basic steps: 1. Create configure backup 2. Patch backup file to enable SSH 3. Login via SSH and configure the new bootcmd 3. Flash OpenWrt factory.bin image manually (sysupgrade doesn't work) More detailed instructions will be provided on the Wiki page. Tested by: Christian Heuff <christian@heuff.at> Signed-off-by: Andreas Böhler <dev@aboehler.at>
* uboot-mediatek: add TP-Link TL-XDR4288 and TL-XDR608xDaniel Golle2023-04-221-0/+3
| | | | | | | | | | | | | | | | TP-Link TL-XDR608x comes with locked vendor loader. Add U-Boot build for replacement loader for both TL-XDR6086 and TL-XDR6088. The only difference at U-Boot level is the different filename requested via TFTP, matching the corresponding OpenWrt build artifacts for each device. The TP-Link TL-XDR4288 has the same hardware as the TP-Link TL-XDR6088 except for the wireless part. Also create a uboot for the TP-Link TL-XDR4288. Signed-off-by: Daniel Golle <daniel@makrotopia.org> [rebase to uboot 23.04, correct led and button] Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
* mpc85xx: add support for Enterasys WS-AP3715iDavid Bauer2023-04-081-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware -------- SoC: NXP P1010 (1x e500 @ 800MHz) RAM: 256M DDR3 (2x Samsung K4B1G1646G-BCH9) FLASH: 32M NOR (Spansion S25FL256S) BTN: 1x Reset WiFi: 1x Atheros AR9590 2.4 bgn 3x3 2x Atheros AR9590 5.0 an 3x3 ETH: 2x Gigabit Ethernet (Atheros AR8033 / AR8035) UART: 115200 8N1 (RJ-45 Cisco) Installation ------------ 1. Grab the OpenWrt initramfs, rename it to ap3715.bin. Place it in the root directory of a TFTP server and serve it at 192.168.1.66/24. 2. Connect to the serial port and boot the AP. Stop autoboot in U-Boot by pressing Enter when prompted. Credentials are identical to the one in the APs interface. By default it is admin / new2day. 3. Alter the bootcmd in U-Boot: $ setenv ramboot_openwrt "setenv ipaddr 192.168.1.1; setenv serverip 192.168.1.66; tftpboot 0x2000000 ap3715.bin; bootm" $ setenv boot_openwrt "sf probe 0; sf read 0x2000000 0x140000 0x1000000; bootm 0x2000000" $ setenv bootcmd "run boot_openwrt" $ saveenv 4. Boot the initramfs image $ run ramboot_openwrt 5. Transfer the OpenWrt sysupgrade image to the AP using SCP. Install using sysupgrade. $ sysupgrade -n <path-to-sysupgrade.bin> Signed-off-by: David Bauer <mail@david-bauer.net>
* ramips: add support for Keenetic Lite III rev. AAlexey Bartenev2023-03-271-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | General specification: SoC Type: MediaTek MT7620N (580MHz) ROM: 8 MB SPI-NOR (W25Q64FV) RAM: 64 MB DDR (EM6AB160TSD-5G) Switch: MediaTek MT7530 Ethernet: 5 ports - 5×100MbE (WAN, LAN1-4) Wireless: 2.4 GHz (MediaTek RT5390): b/g/n Buttons: 3 button (POWER, RESET, WPS) Slide switch: 4 position (BASE, ADAPTER, BOOSTER, ACCESS POINT) Bootloader: U-Boot 1.1.3 Power: 9 VDC, 0.6 A MAC in stock: |- + | | LAN | RF-EEPROM + 0x04 | | WLAN | RF-EEPROM + 0x04 | | WAN | RF-EEPROM + 0x28 | OEM easy installation 1. Use a PC to browse to http://my.keenetic.net. 2. Go to the System section and open the Files tab. 3. Under the Files tab, there will be a list of system files. Click on the Firmware file. 4. When a modal window appears, click on the Choose File button and upload the firmware image. 5. Wait for the router to flash and reboot. OEM installation using the TFTP method 1. Download the latest firmware image and rename it to klite3_recovery.bin. 2. Set up a Tftp server on a PC (e.g. Tftpd32) and place the firmware image to the root directory of the server. 3. Power off the router and use a twisted pair cable to connect the PC to any of the router's LAN ports. 4. Configure the network adapter of the PC to use IP address 192.168.1.2 and subnet mask 255.255.255.0. 5. Power up the router while holding the reset button pressed. 6. Wait approximately for 5 seconds and then release the reset button. 7. The router should download the firmware via TFTP and complete flashing in a few minutes. After flashing is complete, use the PC to browse to http://192.168.1.1 or ssh to proceed with the configuration. Signed-off-by: Alexey Bartenev <41exey@proton.me>
* ath79: Add Aruba AP-175 supportMartin Kennedy2023-03-271-10/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This board is very similar to the Aruba AP-105, but is outdoor-first. It is very similar to the MSR2000 (though certain MSR2000 models have a different PHY[^1]). A U-Boot replacement is required to install OpenWrt on these devices[^2]. Specifications -------------- * Device: Aruba AP-175 * SoC: Atheros AR7161 680 MHz MIPS * RAM: 128MB - 2x Mira P3S12D40ETP * Flash: 16MB MXIC MX25L12845EMI-10G (SPI-NOR) * WiFi: 2 x DNMA-H92 Atheros AR9220-AC1A 802.11abgn * ETH: IC+ IP1001 Gigabit + PoE PHY * LED: 2x int., plus 12 ext. on TCA6416 GPIO expander * Console: CP210X linking USB-A Port to CPU console @ 115200 * RTC: DS1374C, with internal battery * Temp: LM75 temperature sensor Factory installation: - Needs a u-boot replacement. The process is almost identical to that of the AP105, except that the case is easier to open, and that you need to compile u-boot from a slightly different branch: https://github.com/Hurricos/u-boot-ap105/tree/ap175 The instructions for performing an in-circuit reflash with an SPI-Flasher like a CH314A can be found on the OpenWrt Wiki (https://openwrt.org/toh/aruba/ap-105); in addition a detailed guide may be found on YouTube[^3]. - Once u-boot has been replaced, a USB-A-to-A cable may be used to connect your PC to the CP210X inside the AP at 115200 baud; at this point, the normal u-boot serial flashing procedure will work (set up networking; tftpboot and boot an OpenWrt initramfs; sysupgrade to OpenWrt proper.) - There is no built-in functionality to revert back to stock firmware, because the AP-175 has been declared by the vendor[^4] end-of-life as of 31 Jul 2020. If for some reason you wish to return to stock firmware, take a backup of the 16MiB flash before flashing u-boot. [^1]: https://github.com/shalzz/aruba-ap-310/blob/master/platform/bootloader/apboot-11n/include/configs/msr2k.h#L186 [^2]: https://github.com/Hurricos/u-boot-ap105/tree/ap175 [^3]: https://www.youtube.com/watch?v=Vof__dPiprs [^4]: https://www.arubanetworks.com/support-services/end-of-life/#product=access-points&version=0 Signed-off-by: Martin Kennedy <hurricos@gmail.com>
* ath79: support Ruckus ZoneFlex 7341/7343/7363Lech Perczak2023-03-221-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ruckus ZoneFlex 7363 is a dual-band, dual-radio 802.11n 2x2 MIMO enterprise access point. ZoneFlex 7343 is the single band variant of 7363 restricted to 2.4GHz, and ZoneFlex 7341 is 7343 minus two Fast Ethernet ports. Hardware highligts: - CPU: Atheros AR7161 SoC at 680 MHz - RAM: 64MB DDR - Flash: 16MB SPI-NOR - Wi-Fi 2.4GHz: AR9280 PCI 2x2 MIMO radio with external beamforming - Wi-Fi 5GHz: AR9280 PCI 2x2 MIMO radio with external beamforming - Ethernet 1: single Gigabit Ethernet port through Marvell 88E1116R gigabit PHY - Ethernet 2: two Fast Ethernet ports through Realtek RTL8363S switch, connected with Fast Ethernet link to CPU. - PoE: input through Gigabit port - Standalone 12V/1A power input - USB: optional single USB 2.0 host port on the -U variants. Serial console: 115200-8-N-1 on internal H1 header. Pinout: H1 ---------- |1|x3|4|5| ---------- Pin 1 is near the "H1" marking. 1 - RX x - no pin 3 - VCC (3.3V) 4 - GND 5 - TX Installation: - Using serial console - requires some disassembly, 3.3V USB-Serial adapter, TFTP server, and removing a single PH1 screw. 0. Connect serial console to H1 header. Ensure the serial converter does not back-power the board, otherwise it will fail to boot. 1. Power-on the board. Then quickly connect serial converter to PC and hit Ctrl+C in the terminal to break boot sequence. If you're lucky, you'll enter U-boot shell. Then skip to point 3. Connection parameters are 115200-8-N-1. 2. Allow the board to boot. Press the reset button, so the board reboots into U-boot again and go back to point 1. 3. Set the "bootcmd" variable to disable the dual-boot feature of the system and ensure that uImage is loaded. This is critical step, and needs to be done only on initial installation. > setenv bootcmd "bootm 0xbf040000" > saveenv 4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed. Use the Gigabit interface, Fast Ethernet ports are not supported under U-boot: > setenv serverip 192.168.1.2 > setenv ipaddr 192.168.1.1 > tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7363-initramfs-kernel.bin > bootm 0x81000000 5. Optional, but highly recommended: back up contents of "firmware" partition: $ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7363_fw_backup.bin 6. Copy over sysupgrade image, and perform actual installation. OpenWrt shall boot from flash afterwards: $ ssh root@192.168.1.1 # sysupgrade -n openwrt-ath79-generic-ruckus_zf7363-squashfs-sysupgrade.bin After unit boots, it should be available at the usual 192.168.1.1/24. Return to factory firmware: 1. Copy over the backup to /tmp, for example using scp 2. Unset the "bootcmd" variable: fw_setenv bootcmd "" 3. Use sysupgrade with force to restore the backup: sysupgrade -F ruckus_zf7363_backup.bin 4. System will reboot. Quirks and known issues: - Fast Ethernet ports on ZF7363 and ZF7343 are supported, but management features of the RTL8363S switch aren't implemented yet, though the switch is visible over MDIO0 bus. This is a gigabit-capable switch, so link establishment with a gigabit link partner may take a longer time because RTL8363S advertises gigabit, and the port magnetics don't support it, so a downshift needs to occur. Both ports are accessible at eth1 interface, which - strangely - runs only at 100Mbps itself. - Flash layout is changed from the factory, to use both firmware image partitions for storage using mtd-concat, and uImage format is used to actually boot the system, which rules out the dual-boot capability. - Both radio has its own EEPROM on board, not connected to CPU. - The stock firmware has dual-boot capability, which is not supported in OpenWrt by choice. It is controlled by data in the top 64kB of RAM which is unmapped, to avoid the interference in the boot process and accidental switch to the inactive image, although boot script presence in form of "bootcmd" variable should prevent this entirely. - On some versions of stock firmware, it is possible to obtain root shell, however not much is available in terms of debugging facitilies. 1. Login to the rkscli 2. Execute hidden command "Ruckus" 3. Copy and paste ";/bin/sh;" including quotes. This is required only once, the payload will be stored in writable filesystem. 4. Execute hidden command "!v54!". Press Enter leaving empty reply for "What's your chow?" prompt. 5. Busybox shell shall open. Source: https://alephsecurity.com/vulns/aleph-2019014 - There is second method to achieve root shell, using command injection in the web interface: 1. Login to web administration interface 2. Go to Administration > Diagnostics 3. Enter |telnetd${IFS}-p${IFS}204${IFS}-l${IFS}/bin/sh into "ping" field 4. Press "Run test" 5. Telnet to the device IP at port 204 6. Busybox shell shall open. Source: https://github.com/chk-jxcn/ruckusremoteshell Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
* ath79: support Ruckus ZoneFlex 7351Lech Perczak2023-03-221-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ruckus ZoneFlex 7351 is a dual-band, dual-radio 802.11n 2x2 MIMO enterprise access point. Hardware highligts: - CPU: Atheros AR7161 SoC at 680 MHz - RAM: 64MB DDR - Flash: 16MB SPI-NOR - Wi-Fi 2.4GHz: AR9280 PCI 2x2 MIMO radio with external beamforming - Wi-Fi 5GHz: AR9280 PCI 2x2 MIMO radio with external beamforming - Ethernet: single Gigabit Ethernet port through Marvell 88E1116R gigabit PHY - Standalone 12V/1A power input - USB: optional single USB 2.0 host port on the 7351-U variant. Serial console: 115200-8-N-1 on internal H1 header. Pinout: H1 ---------- |1|x3|4|5| ---------- Pin 1 is near the "H1" marking. 1 - RX x - no pin 3 - VCC (3.3V) 4 - GND 5 - TX Installation: - Using serial console - requires some disassembly, 3.3V USB-Serial adapter, TFTP server, and removing a single T10 screw. 0. Connect serial console to H1 header. Ensure the serial converter does not back-power the board, otherwise it will fail to boot. 1. Power-on the board. Then quickly connect serial converter to PC and hit Ctrl+C in the terminal to break boot sequence. If you're lucky, you'll enter U-boot shell. Then skip to point 3. Connection parameters are 115200-8-N-1. 2. Allow the board to boot. Press the reset button, so the board reboots into U-boot again and go back to point 1. 3. Set the "bootcmd" variable to disable the dual-boot feature of the system and ensure that uImage is loaded. This is critical step, and needs to be done only on initial installation. > setenv bootcmd "bootm 0xbf040000" > saveenv 4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed: > setenv serverip 192.168.1.2 > setenv ipaddr 192.168.1.1 > tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7351-initramfs-kernel.bin > bootm 0x81000000 5. Optional, but highly recommended: back up contents of "firmware" partition: $ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7351_fw_backup.bin 6. Copy over sysupgrade image, and perform actual installation. OpenWrt shall boot from flash afterwards: $ ssh root@192.168.1.1 # sysupgrade -n openwrt-ath79-generic-ruckus_zf7351-squashfs-sysupgrade.bin After unit boots, it should be available at the usual 192.168.1.1/24. Return to factory firmware: 1. Copy over the backup to /tmp, for example using scp 2. Unset the "bootcmd" variable: fw_setenv bootcmd "" 3. Use sysupgrade with force to restore the backup: sysupgrade -F ruckus_zf7351_backup.bin 4. System will reboot. Quirks and known issues: - Flash layout is changed from the factory, to use both firmware image partitions for storage using mtd-concat, and uImage format is used to actually boot the system, which rules out the dual-boot capability. - Both radio has its own EEPROM on board, not connected to CPU. - The stock firmware has dual-boot capability, which is not supported in OpenWrt by choice. It is controlled by data in the top 64kB of RAM which is unmapped, to avoid the interference in the boot process and accidental switch to the inactive image, although boot script presence in form of "bootcmd" variable should prevent this entirely. - On some versions of stock firmware, it is possible to obtain root shell, however not much is available in terms of debugging facitilies. 1. Login to the rkscli 2. Execute hidden command "Ruckus" 3. Copy and paste ";/bin/sh;" including quotes. This is required only once, the payload will be stored in writable filesystem. 4. Execute hidden command "!v54!". Press Enter leaving empty reply for "What's your chow?" prompt. 5. Busybox shell shall open. Source: https://alephsecurity.com/vulns/aleph-2019014 - There is second method to achieve root shell, using command injection in the web interface: 1. Login to web administration interface 2. Go to Administration > Diagnostics 3. Enter |telnetd${IFS}-p${IFS}204${IFS}-l${IFS}/bin/sh into "ping" field 4. Press "Run test" 5. Telnet to the device IP at port 204 6. Busybox shell shall open. Source: https://github.com/chk-jxcn/ruckusremoteshell Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
* ipq807x: add support for Netgear WAX218Alexandru Gagniuc2023-03-201-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Netgear WAX218 is a 802.11ax AP claiming AX3600 support. It is wall or ceiling mountable. It can be powered via PoE, or a 12 V adapter. The board has footprints for 2.54mm UART headers. They're difficult to solder because the GND is connected to a large copper plane. Only try soldering if you are very skilled. Otherwise, use pogo pins. Specifications: --------------- * CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz * RAM: 366 MB of RAM available to OS, not sure of total amount * Storage: Macronix MX30UF2G18AC 256MB NAND * Ethernet: * 2.5G RJ45 port (QCA8081) with PoE input * WLAN: * 2.4GHz/5GHz with 8 antennas * LEDs: * Power (Amber) * LAN (Blue) * 2G WLAN (Blue) * 5G WLAN (Blue) * Buttons: * 1x Factory reset * Power: 12V DC Jack * UART: Two 4-pin unpopulated headers near the LEDs * "J2 UART" is the CPU UART, 3.3 V level Installation: ============= Web UI method ------------- Flashing OpenWRT using the vendor's Web UI is problematic on this device. The u-boot mechanism for communicating the active rootfs is antiquated and unreliable. Instead of setting the kernel commandline, it relies on patching the DTS partitions of the nand node. The way partitions are patched is incompatible with newer kernels. Newer kernels use the SMEM partition table, which puts "rootfs" on mtd12. The vendor's Web UI will flash to either mtd12 or mtd14. One reliable way to boot from mtd14 and avoid boot loops is to use an initramfs image. 1. In the factory web UI, navigate to System Manager -> Firmware. 2. In the "Local Firmware Upgrade" section, click Browse 3. Navigate and select the 'web-ui-factory.fit' image 4. Click "Upload" 5. On the following page, click on "Proceed" The flash proceeds at this point and the system will reboot automatically to OpenWRT. 6. Flash the 'nand-sysupgrade.bin' using Luci or the commandline SSH method ---------- Enable SSH using the CLI or Web UI. The root account is locked out to ssh, and the admin account defaults to Netgear's CLI application. So we need to get creative: First, make sure the device boots from the second firmware partition: ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \ /usr/sbin/fw_setenv active_fw 1 Then reboot the device, and run the update: scp -O -o kexalgorithms=diffie-hellman-group14-sha1 \ -o hostkeyalgorithms=ssh-rsa \ netgear_wax218-squashfs-nand-factory.ubi \ admin@<ipaddr>:/tmp/openwrt.ubi ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \ /usr/sbin/ubiformat /dev/mtd12 -f /tmp/openwrt.ubi ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \ /usr/sbin/fw_setenv active_fw 0 Now reboot the device, and it should boot into a ready-to-use OpenWRT. Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com> Reviewed-by: Robert Marko <robimarko@gmail.com> Tested-by: Francisco G Luna <frangonlun@gmail.com>
* ipq806x: add support for Nokia Airscale AC400iKristjan Krušič2023-03-191-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware -------- SoC: Qualcomm IPQ8065 RAM: 512 MB DDR3 Flash: 256 MB NAND (Macronix MX30UF2G18AC) (split into 2x128MB) 4 MB SPI-NOR (Macronix MX25U3235F) WLAN: Qualcomm Atheros QCA9984 - 2.4Ghz Qualcomm Atheros QCA9984 - 5Ghz ETH: eth0 - POE (100Mbps in U-Boot, 1000Mbps in OpenWrt) eth1 - (1000Mbps in both) Auto-negotiation broken on both. USB: USB 2.0 LED: 5G, 2.4G, ETH1, ETH2, CTRL, PWR (All support green and red) BTN: Reset Other: SD card slot (non-functional) Serial: 115200bps, near the Ethernet transformers, labeled 9X. Connections from the arrow to the 9X text: [NC] - [TXD] - [GND] - [RXD] - [NC] Installation ------------ 0. Connect to the device Plug your computer into LAN2 (1000Mbps connection required). If you use the LAN1/POE port, set your computer to force a 100Mbps link. Connect to the device via TTL (Serial) 115200n8. Locate the header (or solder pads) labeled 9X, near the Ethernet jacks/transformers. There should be an arrow on the other side of the header marking. The connections should go like this: (from the arrow to the 9X text): NC - TXD - GND - RXD - NC 1. Prepare for installation While the AP is powering up, interrupt the startup process. MAKE SURE TO CHECK YOUR CURRENT PARTITION! If you see: "Current Partition is : partB" or "Need to switch partition from partA to partB", you have to force the device into partA mode, before continuing. This can be done by changing the PKRstCnt to 5 and resetting the device. setenv PKRstCnt 5 saveenv reset After you interrupt the startup process again, you should see: Need to switch partition from partB to partA You can now continue to the next step. If you see: "Current Partition is : partA", you can continue to the next step. 2. Prevent partition switching. To prevent the device from switching partitions, we are going to modify the startup command. set bootcmd "setenv PKRstCnt 0; saveenv; bootipq" setenv 3. First boot Now, we have to boot the OpenWrt intifs. The easiest way to do this is by using Tiny PXE. You can also use the normal U-Boot tftp method. Run "bootp" this will get an IP from the DHCP server and possibly the firmware image. If it doesn't download the firmware image, run "tftpboot". Now run "bootm" to run the image. You might see: "ERROR: new format image overwritten - must RESET the board to recover" this means that the image you are trying to load is too big. Use a smaller image for the initial boot. 4. Install OpenWrt from initfs Once you are booted into OpenWrt, transfer the OpenWrt upgrade image and use sysupgrade to install OpenWrt to the device. Signed-off-by: Kristjan Krušič <kristjan.krusic@krusic22.com>
* ramips: add support for SNR-CPE-ME2-SFPAleksey Nasibulin2023-03-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SNR-CPE-ME2-SFP is a wireless router with SFP cage manufactured by SNR/NAG company. Specification: - SoC: MediaTek MT7621A - CPU: 880MHz - Flash: 16 MB (GD25Q127CSIG) - RAM: 256 MB - WLAN: 2.4 GHz, 5 GHz (MediaTek MT7615DN) - Ethernet: 4x 10/100/1000 Mbps - SFP cage (using RTL8211FS-CG) - USB 3.0 port - Power: 12 VDC, 2 A Flash instruction via TFTP: 1. Boot SNR-CPE-ME2 to recovery mode (press reset button and power on device, hold button for ~10 seconds) 2. Send firmware via TFTP client: TFTP Server address: 192.168.1.1 TFTP Client address: 192.168.1.131 3. Wait ~120 seconds to complete flashing 4. Do sysupgrade using web-interface MAC Addresses(stock) -------------------- +----------+------------------+-------------------+ | use | address | example | +----------+------------------+-------------------+ | Device | label | 6A:C4:DD:xx:xx:28 | | Ethernet | + 1 | 6A:C4:DD:xx:xx:29 | | 2g | + 2 | 6A:C4:DD:xx:xx:2A | | 5g | + 3 | 6A:C4:DD:xx:xx:2B | +----------+------------------+-------------------+ Notes: - Reading sfp eeprom is not supported [1] (driver issue). Stock image has the same situation. References: 1. https://forum.openwrt.org/t/mt7621-and-reading-sfp-eeprom/152249 Signed-off-by: Aleksey Nasibulin <alealexpro100@ya.ru>
* mpc85xx: add support for Watchguard Firebox T10David Bauer2023-03-071-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware -------- SoC: Freescale P1010 RAM: 512MB FLASH: 1 MB SPI-NOR 512 MB NAND ETH: 3x Gigabite Ethernet (Atheros AR8033) SERIAL: Cisco RJ-45 (115200 8N1) RTC: Battery-Backed RTC (I2C) Installation ------------ 1. Patch U-Boot by dumping the content of the SPI-Flash using a SPI programmer. The SHA1 hash for the U-Boot password is currently unknown. A tool for patching U-Boot is available at https://github.com/blocktrron/t10-uboot-patcher/ You can also patch the unknown password yourself. The SHA1 hash is E597301A1D89FF3F6D318DBF4DBA0A5ABC5ECBEA 2. Interrupt the bootmenu by pressing CTRL+C. A password prompt appears. The patched password is '1234' (without quotation marks) 3. Download the OpenWrt initramfs image. Copy it to a TFTP server reachable at 10.0.1.13/24 and rename it to uImage. 4. Connect the TFTP server to ethernet port 0 of the Watchguard T10. 5. Download and boot the initramfs image by entering "tftpboot; bootm;" in U-Boot. 6. After OpenWrt booted, create a UBI volume on the old data partition. The "ubi" mtd partition should be mtd7, check this using $ cat /proc/mtd Create a UBI partition by executing $ ubiformat /dev/mtd7 -y 7. Increase the loadable kernel-size of U-Boot by executing $ fw_setenv SysAKernSize 800000 8. Transfer the OpenWrt sysupgrade image to the Watchguard T10 using scp. Install the image by using sysupgrade: $ sysupgrade -n <path-to-sysupgrade> Note: The LAN ports of the T10 are 1 & 2 while 0 is WAN. You might have to change the ethernet-port. 9. OpenWrt should now boot from the internal NAND. Enjoy. Signed-off-by: David Bauer <mail@david-bauer.net>
* mvebu: add support for Buffalo LinkStation LS220DEDaniel González Cabanelas2023-02-261-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Buffalo LinkStation LS220DE is a dual bay NAS, based on Marvell Armada 370 Hardware: SoC: Marvell Armada 88F6707 CPU: Cortex-A9 800 MHz, 1 core Flash 1: SPI-NOR 1 MiB (U-Boot) Flash 2: NAND 512 MiB (OS) RAM: DDR3 256 MiB Ethernet: 1x 1GbE USB: 1x 2.0 SATA: 2x 3Gb/s LEDs/Input: 5x / 2x (1x button, 1x slide-switch) Fan: 1x casing Flash instructions, from hard drive: 1. Get access to the "boot" partition at the hard drive where the stock firmware is installed. It can be done with acp-commander or by plugging the hard drive to a computer. 2. Backup the stock uImage: mv /boot/uImage.buffalo /boot/uImage.buffalo.bak 3. Move and rename the Openwrt initramfs image to the boot partition: mv openwrt-initramfs-kernel.bin /boot/uImage.buffalo 4. Power on the Linkstation with the hardrive inside. Now Openwrt will boot, but still not installed. 5. Connect via ssh to OpenWrt: ssh root@192.168.1.1 6. Rename boot files inside boot partition mount -t ext3 /dev/sda1 /mnt mv /mnt/uImage.buffalo /mnt/uImage.buffalo.openwrt.bak mv /mnt/initrd.buffalo /mnt/initrd.buffalo.bak 7. Format ubi partitions at the NAND flash ("kernel_ubi" and "ubi"): ubiformat /dev/mtd0 -y ubidetach -p /dev/mtd1 ubiformat /dev/mtd1 -y 8. Flash the sysupgrade image: sysupgrade -n openwrt-squashfs-sysupgrade.bin 9. Wait until it finish, the device will reboot with OpenWrt installed on the NAND flash. Restore the stock firmware: 1. Take the hard drive used for the installation and restore boot backup files to their original names: mount -t ext3 /dev/sda1 /mnt mv /mnt/uImage.buffalo.bak /mnt/uImage.buffalo mv /mnt/initrd.buffalo.bak /mnt/initrd.buffalo 2. Boot from the hard drive and perform a stock firmware update using the Buffalo utility. The NAND will be restored to the original state. Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com>
* ramips: add support for Senao Engenius EPG600Michael Pratt2023-02-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FCC ID: A8J-EPG600 Engenius EPG600 is an indoor wireless router with 1 Gb ethernet switch, dual-band wireless, internal antenna plates, USB, and phone lines (not supported) this board is a Senao device: the hardware is equivalent to EnGenius ESR600 (except for phone lines) the software is Senao SDK which is based on openwrt and uboot which uses the legacy Senao header with Vendor / Product IDs to verify the firmware upgrade image. **Specification:** - MT7620 SOC MIPS 24kec, 2.4 GHz WMAC, 2x2 - RT5592N WLAN PCI chip, 5 GHz, 2x2 - QCA8337N Gb SW RGMII GbE, SW P0 -- SOC P5, 5 LEDs - 40 MHz clock - 16 MB FLASH MX25L12845EMI-10G - 64 MB RAM NT5TU32M16 - UART console J2, populated - USB 2.0 port direct to SOC - 6 GPIO LEDs power, 2G, 5G, wps2g, wps5g, line - 3 buttons reset, wps, "reg" (registeration) - 4 antennas internal omni-directional plates NOT YET SUPPORTED: VoIP - Si3050-FT + Si3019-FT Voice DAA, SPI control, PCM data - Phone Ports "TEL", "LINE" RJ11, 4P2C (2 pins) **MAC addresses:** MAC address labeled as MAC ADDRESS MACs present in both wifi cal data and uboot environment eth0.1/phy1 ---- *:82 rf 0x4 phy0 ---- *:83 factory 0x4 eth0.2 MAC *:b8 "wanaddr" **Installation:** Method 1: Firmware upgrade page: (if you cannot access the APs webpage) factory reset with the reset button connect ethernet to a computer OEM webpage at 192.168.0.1 username and password 'admin' Navigate to gear icon, "Device Management", "Tools" select the factory.dlf image Upload and verify checksum Method 2: Serial to upload initramfs: Follow directions for TFTP recovery upload and boot initramfs and do a sysupgrade **TFTP recovery:** Requires UART serial console, reset button does nothing rename initramfs-kernel.bin to 'uImageEPG600' make available on TFTP server at 192.168.99.8 power board, interrupt boot with "4" execute `tftpboot` and `bootm` (with the load address) **Return to OEM:** Images from OEM are provided, but not compatible with openwrt sysupgrade. So it must be modified. Alternatively, back up all mtd partitions before flashing **Note on switch registers:** The necessary registers needed for the QCA8337 switch can be read from interrupted boot (tftpboot, bootm) by using the following lines in the switch driver ar8327.c in the function 'ar8327_hw_config_of' where 'qca,ar8327-initvals' is parsed from DTS before the new register values are written: pr_info("0x04 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD0_MODE)); pr_info("0x08 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD5_MODE)); pr_info("0x0c %08x\n", ar8xxx_read(priv, AR8327_REG_PAD6_MODE)); pr_info("0x10 %08x\n", ar8xxx_read(priv, AR8327_REG_POWER_ON_STRAP)); Signed-off-by: Michael Pratt <mcpratt@pm.me>
* uboot-envtools: add support for APRESIA ApresiaLightGS120GT-SSINAGAKI Hiroshi2023-02-131-0/+8
| | | | | | | This patch adds support for APRESIA ApresiaLightGS120GT-SS to uboot-envtools. Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
* ramips: add support for ASUS RT-AX54Karl Chan2023-02-121-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifications: - Device: ASUS RT-AX54 (AX1800S/HP,AX54HP) - SoC: MT7621AT - Flash: 128MB - RAM: 256MB - Switch: 1 WAN, 4 LAN (10/100/1000 Mbps) - WiFi: MT7905 2x2 2.4G + MT7975 2x2 5G - LEDs: 1x POWER (blue, configurable) 1x LAN (blue, configurable) 1x WAN (blue, configurable) 1x 2.4G (blue, not configurable) 1x 5G (blue, not configurable) Flash by U-Boot TFTP method: - Configure your PC with IP 192.168.1.2 - Set up TFTP server and put the factory.bin image on your PC - Connect serial port(rate:115200) and turn on AP, then interrupt "U-Boot Boot Menu" by hitting any key Select "2. Upgrade firmware" Press enter when show "Run firmware after upgrading? (Y/n):" Select 0 for TFTP method Input U-Boot's IP address: 192.168.1.1 Input TFTP server's IP address: 192.168.1.2 Input IP netmask: 255.255.255.0 Input file name: openwrt-ramips-mt7621-asus_rt-ax1800hp-squashfs-factory.bin - Restart AP aftre see the log "Firmware upgrade completed!" Signed-off-by: Karl Chan <exkc@exkc.moe>
* uboot-envtools: filogic: bpi-r3: fix env selectionDaniel Golle2023-01-291-4/+7
| | | | | | | | Selecting the environment when booting from SD card has been broken by a previous commit. Fix it. Fixes: f46355b4d7 ("uboot-envtools: mediatek_filogic: fix BPi-R3 when no OS is installed") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-envtools: mt7622: bpi-r64: fix env selectionDaniel Golle2023-01-291-3/+6
| | | | | | | | Selecting the environment when booting from SD card has been broken by a previous commit. Fix it. Fixes: 84b5b0f88c ("uboot-envtools: mediatek/mt7622: don't rely on mapped rootfs") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ath79: add support for Senao Engenius EWS660APMichael Pratt2023-01-281-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FCC ID: A8J-EWS660AP Engenius EWS660AP is an outdoor wireless access point with 2 gigabit ethernet ports, dual-band wireless, internal antenna plates, and 802.3at PoE+ **Specification:** - QCA9558 SOC 2.4 GHz, 3x3 - QCA9880 WLAN mini PCIe card, 5 GHz, 3x3, 26dBm - AR8035-A PHY RGMII GbE with PoE+ IN - AR8033 PHY SGMII GbE with PoE+ OUT - 40 MHz clock - 16 MB FLASH MX25L12845EMI-10G - 2x 64 MB RAM - UART at J1 populated, RX grounded - 6 internal antenna plates (5 dbi, omni-directional) - 5 LEDs, 1 button (power, eth0, eth1, 2G, 5G) (reset) **MAC addresses:** Base MAC addressed labeled as "MAC" Only one Vendor MAC address in flash eth0 *:d4 MAC art 0x0 eth1 *:d5 --- art 0x0 +1 phy1 *:d6 --- art 0x0 +2 phy0 *:d7 --- art 0x0 +3 **Serial Access:** the RX line on the board for UART is shorted to ground by resistor R176 therefore it must be removed to use the console but it is not necessary to remove to view boot log optionally, R175 can be replaced with a solder bridge short the resistors R175 and R176 are next to the UART RX pin **Installation:** 2 ways to flash factory.bin from OEM: Method 1: Firmware upgrade page: OEM webpage at 192.168.1.1 username and password "admin" Navigate to "Firmware Upgrade" page from left pane Click Browse and select the factory.bin image Upload and verify checksum Click Continue to confirm and wait 3 minutes Method 2: Serial to load Failsafe webpage: After connecting to serial console and rebooting... Interrupt uboot with any key pressed rapidly execute `run failsafe_boot` OR `bootm 0x9fd70000` wait a minute connect to ethernet and navigate to "192.168.1.1/index.htm" Select the factory.bin image and upload wait about 3 minutes **Return to OEM:** If you have a serial cable, see Serial Failsafe instructions otherwise, uboot-env can be used to make uboot load the failsafe image ssh into openwrt and run `fw_setenv rootfs_checksum 0` reboot, wait 3 minutes connect to ethernet and navigate to 192.168.1.1/index.htm select OEM firmware image from Engenius and click upgrade **TFTP recovery:** Requires serial console, reset button does nothing rename initramfs.bin to '0101A8C0.img' make available on TFTP server at 192.168.1.101 power board, interrupt boot execute tftpboot and bootm 0x81000000 **Format of OEM firmware image:** The OEM software of EWS660AP is a heavily modified version of Openwrt Kamikaze. One of the many modifications is to the sysupgrade program. Image verification is performed simply by the successful ungzip and untar of the supplied file and name check and header verification of the resulting contents. To form a factory.bin that is accepted by OEM Openwrt build, the kernel and rootfs must have specific names... openwrt-ar71xx-generic-ews660ap-uImage-lzma.bin openwrt-ar71xx-generic-ews660ap-root.squashfs and begin with the respective headers (uImage, squashfs). Then the files must be tarballed and gzipped. The resulting binary is actually a tar.gz file in disguise. This can be verified by using binwalk on the OEM firmware images, ungzipping then untaring. Newer EnGenius software requires more checks but their script includes a way to skip them, otherwise the tar must include a text file with the version and md5sums in a deprecated format. The OEM upgrade script is at /etc/fwupgrade.sh. OKLI kernel loader is required because the OEM software expects the kernel to be no greater than 1536k and the factory.bin upgrade procedure would otherwise overwrite part of the kernel when writing rootfs. Note on PLL-data cells: The default PLL register values will not work because of the external AR8035 switch between the SOC and the ethernet port. For QCA955x series, the PLL registers for eth0 and eth1 can be see in the DTSI as 0x28 and 0x48 respectively. Therefore the PLL registers can be read from uboot for each link speed after attempting tftpboot or another network action using that link speed with `md 0x18050028 1` and `md 0x18050048 1`. The clock delay required for RGMII can be applied at the PHY side, using the at803x driver `phy-mode`. Therefore the PLL registers for GMAC0 do not need the bits for delay on the MAC side. This is possible due to fixes in at803x driver since Linux 5.1 and 5.3 Tested-by: Niklas Arnitz <openwrt@arnitz.email> Signed-off-by: Michael Pratt <mcpratt@pm.me>
* ath79: consolidate Netgear EX7300 series imagesWenli Looi2023-01-251-1/+0
| | | | | | | | | | | | | | | | | | | | | | | This change consolidates Netgear EX7300 series devices into two images corresponding to devices that share the same manufacturer firmware image. Similar to the manufacturer firmware, the actual device model is detected at runtime. The logic is taken from the netgear GPL dumps in a file called generate_board_conf.sh. Hardware details for EX7300 v2 variants --------------------------------------- SoC: QCN5502 Flash: 16 MiB RAM: 128 MiB Ethernet: 1 gigabit port Wireless 2.4GHz (currently unsupported due to lack of ath9k support): - EX6250 / EX6400 v2 / EX6410 / EX6420: QCN5502 3x3 - EX7300 v2 / EX7320: QCN5502 4x4 Wireless 5GHz: - EX6250: QCA9986 3x3 (detected by ath10k as QCA9984 3x3) - EX6400 v2 / EX6410 / EX6420 / EX7300 v2 / EX7320: QCA9984 4x4 Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
* ipq807x: Add ZyXEL NBG7815André Valentin2023-01-191-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ZyXEL NBG7815 is a premium 802.11ax "tri"-band router/AP. Specifications: * CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz * RAM: 1 GB 2x Nanya NT5CC256M16ER-EK * Storage: * 8MB serial flash Winbond W25Q64DW * 4GB eMMC flash Kingston EMMC04G-M627 * Ethernet: * 4x1G RJ45 ports (QCA8074A) with 1x status LED per port * 1x2.5G RJ45 port (QCA8081) with 1x status LED * 1x10G RJ45 port (AQR113C) with 1x status LED * Switch: Qualcomm Atheros QCA8075 * WLAN: * 2.4GHz: Qualcomm QCN5024 4x4@40MHz 802.11b/g/n/ax 1147 Mbps PHY rate * 2x 5GHz: Qualcomm QCN5054 4x4 802.11a/b/g/n/ac/ax 2402 PHY rate * Bluetooth CSR8811 using HSUART, currently unsupported * USB: 1x USB3.0 Type-A port * LED-s currently not supported: * White * Dark Blu * Amber * Purple * Purple and dark blue * Red * Buttons: * 1x Soft reset * Power: 12V DC Jack Installation instructions: * Disconnect WAN * Reset device to factory defaults by pushing reset button 15 sec, LEDs should lit orange color. * After 5-10 minutes, when the LEDs turn constant dark blue, put your LAN cable and connect at address 192.168.123.1 by telnet on port 23 * Login with NBG7815 login: root password: nbg7815@2019 * cd /tmp/ApplicationData * wget -O openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin http://... * wget https://github.com/itorK/nbg7815_tools/blob/main/flash_to_openwrt.sh * run flash_to_openwrt.sh If you can't use wget, you can transfer the files via nc. See https://openwrt.org/inbox/toh/zyxel/nbg7815_armor_g5 for installation details. Bluetooth usage: * you need at least package bluez-utils, recommended bluez-daemon * run following commands to enable and start hciattach /dev/ttyMSM1 bcsp hciconfig hci0 up Many thanks to itorK for his work on this device: https://github.com/itorK/openwrt/tree/nbg7815 Reviewed-by: Robert Marko <robimarko@gmail.com> Signed-off-by: André Valentin <avalentin@marcant.net>
* uboot-envtools: ipq40xx: fix WHW03V2 mtd partitionVincent Tremblay2023-01-181-2/+4
| | | | | | | | | | | The configured u_env partition for the Linksys WHW03 V2 was not correct. It should have been set to mtd6. This fix allow to flash the OEM firmware from OpenWRT and to change the boot partition using fw_setenv. Fixes: 9e4ede8344d6 ("ipq40xx: add support for Linksys WHW03 V2") Signed-off-by: Vincent Tremblay <vincent@vtremblay.dev>
* ipq807x: add Dynalink DL-WRX36Dirk Buchwalder2023-01-161-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Dynalink DL-WRX36 is a AX WIFI router with 4 1G and 1 2.5G ports. Specifications: • CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz • RAM: 1024MB of DDR3 • Storage: 256MB Nand • Ethernet: 4x 1G RJ45 ports (QCA8075) + 1 2.5G Port (QCA8081) • WLAN: 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 1174 Mbps PHY rate 5GHz: Qualcomm QCN5054 4x4 802.11a/b/g/n/ac/ax 2402 PHY rate • 1x USB 3.0 • 1 gpio-controlled dual color led (blue/red) • Buttons: 1x soft reset / 1x WPS • Power: 12V DC jack A poulated serial header is onboard (J1004) the connector size is a 4-pin 2.0 mm JST PH. RX/TX is working, u-boot bootwait is active, secure boot is enabled. Notes: - Serial is completely deactivated in the stock firmware image. - This commit adds only single partition support, that means sysupgrade is upgrading the current rootfs partition. - Installation can be done by serial connection or SSH access on OEM firmware Installation Instructions: Most part of the installation is performed from an initramfs image running OpenWrt, and there are two options to boot it. Boot initramfs option 1: Using serial connection (3.3V) 1. Stop auto boot to get to U-boot shell 2. Transfer initramfs image to device (openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb) Tested using TFTP and a FAT-formatted USB flash drive. 3. Boot the initramfs image # bootm Boot initramfs option 2: From SSH access on OEM firmware 1. Copy the initramfs image to a FAT-formatted flash drive (tested on single-partition drive) and connect it to device USB port. 2. Change boot command so it loads the initramfs image on next boot Fallback to OEM firmware is provided. # fw_setenv bootcmd 'usb start && fatload usb 0:1 0x44000000 openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb && bootm 0x44000000; bootipq' 3. Reboot the device to boot the initramfs # reboot Install OpenWrt from initramfs image: 1. Use SCP (or other way) to transfer OpenWrt factory image 2. Connect to device using SSH (on a LAN port) 3. Check MTD partition table. rootfs and rootfs_1 should be mtd18 and mtd20 depending on current OEM slot. # cat /proc/mtd 4. Do a ubiformat to both rootfs partitions: # ubiformat /dev/mtd18 -y -f /path_to/factory_image # ubiformat /dev/mtd20 -y -f /path_to/factory_image 5. Set U-boot env variable: mtdids # fw_setenv mtdids 'nand0=nand0' 6. Get offset of mtd18 to determine current OEM slot - If current OEM slot is 1, offset is 16777216 (0x1000000) - If current OEM slot is 2, offset is 127926272 (0x7a00000) # cat /sys/class/mtd/mtd18/offset 7. Set U-boot env variable: mtdparts If current OEM slot is 1, run: # fw_setenv mtdparts 'mtdparts=nand0:0x6100000@0x1000000(fs),0x6100000@0x7a00000(fs_1)' If current OEM slot is 2, run: # fw_setenv mtdparts 'mtdparts=nand0:0x6100000@0x7a00000(fs),0x6100000@0x1000000(fs_1)' 8. Set U-boot env variable: bootcmd # fw_setenv bootcmd 'setenv bootargs console=ttyMSM0,115200n8 ubi.mtd=rootfs rootfstype=squashfs rootwait; ubi part fs; ubi read 0x44000000 kernel; bootm 0x44000000#config@rt5010w-d350-rev0' 9. Reboot the device # reboot Note: this PR adds only single partition support, that means sysupgrade is upgrading the current rootfs partition Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
* ipq807x: add Edgecore EAP102Matthew Hagan2023-01-161-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Edgecore EAP102 is a wall/ceiling mountable AP. The AP can be powered by either PoE or AC adapter. Device info: - IPQ8071-A SoC - 1GiB RAM - 256MiB NAND flash - 32MiB SPI NOR - 2 Ethernet ports - 1 Console port - 2GHz/5GHz AX WLAN - 2 USB 2.0 ports Install instructions: Prerequistes - TFTP server, preferrably within 192.168.1.0/24 Console cable plugged in (115200 8N1 no flow control) 1. Power on device and interrupt u-boot to obtain u-boot CLI 2. set serverip to IP address of the TFTP server: `setenv serverip 192.168.1.250` 3. Download image from TFTP server: `tftpboot 0x44000000 openwrt-ipq807x-generic-edgecore_eap102-squashfs-nand-factory.ubi` 4. Flash ubi image to both partitions and reset: `sf probe imxtract 0x44000000 ubi nand device 0 nand erase 0x0 0x3400000 nand erase 0x3c00000 0x3400000 nand write $fileaddr 0x0 $filesize nand write $fileaddr 0x3c00000 $filesize reset` Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
* ipq807x: Add Xiaomi AX9000Robert Marko2023-01-161-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Xiaomi AX9000 is a premium 802.11ax "tri"-band router/AP. Specifications: * CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz * RAM: 1024MB of DDR3 * Storage: 256MB of parallel NAND * Ethernet: * 4x1G RJ45 ports (QCA8075) with 1x status LED per port * 1x2.5G RJ45 port (QCA8081) with 1x status LED * WLAN: * PCI based Qualcomm QCA9889 1x1 802.11ac Wawe 2 for IoT * 2.4GHz: Qualcomm QCN5024 4x4@40MHz 802.11b/g/n/ax 1147 Mbps PHY rate * 5.8GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402Mbps PHY rate * 5GHz: PCI based Qualcomm QCN9024 4x4@160MHz 802.11a/b/g/n/ac/ax 4804Mbps PHY rate * USB: 1x USB3.0 Type-A port * LED-s: * System (Blue and Yellow) * Network (Blue and Yellow) * RGB light bar on top in X shape * Buttons: * 1x Power switch * 1x Soft reset * 1x Mesh button * Power: 12V DC Jack Installation instructions: Obtaining SSH access is mandatory https://openwrt.org/inbox/toh/xiaomi/ax9000#obtain_ssh_access Installation is done by the ubiformat method, through SSH: 1. Open an SSH shell to the router 2. Copy the file openwrt-ipq807x-generic-xiaomi_ax9000-initramfs-factory.ubi to the /tmp directory 3. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1): nvram get flag_boot_rootfs 4. Find the rootfs and rootfs_1 mtd indexes respectively: cat /proc/mtd Please confirm if mtd21 and mtd22 are the correct indexes from above! 5. Use the command ubiformat to flash the opposite mtd with UBI image: If nvram get flag_boot_rootfs returned 0: ubiformat /dev/mtd22 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit otherwise: ubiformat /dev/mtd21 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit 6. Reboot the device by: reboot Previous commands flashed an ubinized OpenWrt initramfs that will serve as the intermediate step since OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for packages. Continue in order to pernamently flash OpenWrt: 7. SSH into OpenWrt from one of the LAN ports 8. Copy the file openwrt-ipq807x-generic-xiaomi_ax9000-squashfs-sysupgrade.bin to the /tmp directory 9. Sysupgrade the device: sysupgrade -n /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-squashfs-sysupgrade.bin Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired. Signed-off-by: Robert Marko <robimarko@gmail.com>
* ipq807x: add QNAP 301wDirk Buchwalder2023-01-161-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | QNAP 301w is a AX WIFI router with 4 1G and 2 10G ports. Specifications: • CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz • RAM: 1024MB of DDR3 • Storage: 4GB eMMC (contains kernel and rootfs) / 8MB NOR (contains art and u-boot-env) • Ethernet: 4x 1G RJ45 ports + 2 10G ports (Aquantia AQR113C) • WLAN: 2.4GHz: Qualcomm QCN5024 4x4 (40 MHz) 802.11b/g/n/ax 1174 Mbps PHY rate 5GHz: Qualcomm QCN5054 4x4 (80 MHz) or 2x2 (160 MHz) 802.11a/b/g/n/ac/ax 2402 PHY rate • LEDs: 7 x GPIO-controlled dual color LEDs + 2 GPIO-controlled single color LEDs • Buttons: 1x soft reset / 1x WPS • Power: 12V DC jack A poulated serial header is onboard. RX/TX is working, bootwait is active, secure boot is not enabled. SSH can be activated in the stock firmware, hold WPS button til the second beep (yes the router has a buzzer) SSH is available on port 22200, login with user admin and password "mac address of the router". Installation Instructions: • obtain serial access (https://openwrt.org/inbox/toh/qnap/301w#serial) • stop auto boot • setenv serverip 192.168.10.1 • setenv ipaddr 192.168.10.10 • tftpboot the initramfs image (openwrt-ipq807x-generic-qnap_301w-initramfs-fit-uImage.itb) • bootm • make sure that current_entry is set to "0": "fw_printenv -n current_entry" should be print "0". If not, do "fw_setenv current_entry 0" • copy openwrt-ipq807x-generic-qnap_301w-squashfs-sysupgrade.bin to the device to /tmp folder • sysupgrade -n /tmp/openwrt-ipq807x-generic-qnap_301w-squashfs-sysupgrade.bin this flashes openwrt to the first kernel and rootfs partition (mmcblk0p1 / mmcblk0p4) • reboot Note: this leaves the second kernel / rootfs parition untouched. So if you want to go back to stock, stop u-boot autoboot, "setenv current_entry 1" , "saveenv", "bootipq". Stock firmware should start from the second partition. Then do a firmwareupgrade in the stock gui, that should overwrite the openwrt in the first partitions Make 10G Aquantia phy's work: The aquantia phy's need a firmware to work. This can either be loaded in linux with a userspace tool or in u-boot. I was not successfull to load the firmware in linux (aq-fw-download) but luckily there is aq_load_fw available in u-boot. But first the right firmware needs to write to the 0:ETHPHYFW mtd partition (it is empty on my device) Grab the ethphy firmware image from: https://github.com/kirdesde/nbg7815_gpl/blob/master/target/linux/ipq/ipq807x_64/prebuilt_images/AQR_ethphyfw.mbn and scp that to openwrt. Check the 0:ETHPHYFW partition number: cat /proc/mtd|grep "0:ETHPHYFW", should be mtd10. Backup the 0:ETHPHYFW partition: dd if=/dev/mtd10 of=/tmp/ethphyfw.backup, scp ethphyfw.backup to a save place. Write the new firmware image to the 0:ETHPHYFW partition: "mtd erase /dev/mtd10", "mtd -n write AQR_ethphyfw.mbn /dev/mtd10". Reboot to u-boot. Check if aq_load_fw is working: "aq_load_fw 0", that checks the firmware and if successfull, loads iram and dram to one of the aquantia phy's. If that worked, add the aq_load_fw to the bootcmd: setenv bootcmd "aq_load_fw 0 && aq_load_fw 8 && bootipq" "saveenv" "reset" Board reboots and the firmware load to both phy's should start and then openwrt boots. Check if the 10G ports work. Note: lan port labeled "10G-2" is configured as WAN port as per default. All other port are in the br-lan. This can be changed in the network config. Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
* ipq807x: add Edimax CAX1800Dirk Buchwalder2023-01-161-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Edimax CAX1800 is a 802.11 ax dual-band AP with PoE. AP can be ceiling or wall mount. Specifications: • CPU: Qualcomm IPQ8070A Quad core Cortex-A53 1.4GHz • RAM: 512MB of DDR3 • Storage: 128MB NAND (contains rootfs) / 8MB NOR (contains art and uboot-env) • Ethernet: 1x 1G RJ45 port (QCA8072) PoE • WLAN: 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate 5GHz: Qualcomm QCN5054 2x2 802.11a/b/g/n/ac/ax 1201 PHY rate • LEDs: 3 x GPIO-controlled System-LEDs (form one virtual RGB System-LED) black_small_square Buttons: 1x soft reset black_small_square Power: 12V DC jack or PoE (802.3af ) An unpopulated serial header is onboard. RX/TX is working, bootwait is active, secure boot is not enabled. SSH can be activated in the stock firmware, but it drops only to a limited shell . Installation Instructions: black_small_square obtain serial access black_small_square stop auto boot black_small_square tftpboot the initramfs image (serverip is set to 192.168.99.8 in uboot) black_small_square bootm black_small_square copy openwrt-ipq807x-generic-edimax_cax1800-squashfs-nand-factory.ubi to the device black_small_square write the image to the NAND: black_small_square cat /proc/mtd and look for rootfs partition (should be mtd0) black_small_square ubiformat /dev/mtd0 -f -y openwrt-ipq807x-generic-edimax_cax1800-squashfs- nand-factory.ubi black_small_square reboot Note: Device is not using dual partitioning (NAND contains other partitions with different manufacture data etc.) Draytek VigorAP 960C and Lancom LW-600 both look similar, but I haven't checked them. Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
* ipq807x: add Redmi AX6Zhijun You2023-01-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Redmi AX6 is a budget 802.11ax dual-band router/AP Specifications: * CPU: Qualcomm IPQ8071A Quad core Cortex-A53 1.4GHz * RAM: 512MB of DDR3 * Storage: 128MB NAND * Ethernet: 4x1G RJ45 ports (QCA8075) * WLAN: * 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate * 5GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate * LEDs: * System (Blue/Yellow) * Network (Blue/Yellow) *Buttons: 1x soft reset *Power: 12V DC jack Installation instructions: Obtaining SSH access is mandatory https://openwrt.org/inbox/toh/xiaomi/xiaomi_redmi_ax6_ax3000#ssh_access Installation is done by the ubiformat method, through SSH: 1. Open an SSH shell to the router 2. Copy the file openwrt-ipq807x-generic-redmi_ax6-initramfs-factory.ubi to the /tmp directory 3. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1): nvram get flag_boot_rootfs 4. Find the rootfs and rootfs_1 mtd indexes respectively: cat /proc/mtd Please confirm if mtd12 and mtd13 are the correct indexes from above! 5. Use the command ubiformat to flash the opposite mtd with UBI image: If nvram get flag_boot_rootfs returned 0: ubiformat /dev/mtd13 -y -f /tmp/openwrt-ipq807x-generic-redmi_ax6-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit otherwise: ubiformat /dev/mtd12 -y -f /tmp/openwrt-ipq807x-generic-redmi_ax6-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit 6. Reboot the device by: reboot Previous commands flashed an ubinized OpenWrt initramfs that will serve as the intermediate step since OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for packages. Continue in order to pernamently flash OpenWrt: 7. SSH into OpenWrt from one of the LAN ports 8. Copy the file openwrt-ipq807x-generic-redmi_ax6-squashfs-sysupgrade.bin to the /tmp directory 9. Sysupgrade the device: sysupgrade -n /tmp/openwrt-ipq807x-generic-redmi_ax6-squashfs-sysupgrade.bin Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired. Signed-off-by: Zhijun You <hujy652@gmail.com>
* ipq807x: add Xiaomi AX3600Robert Marko2023-01-161-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Xiaomi AX3600 is a budget 802.11ax dual-band router/AP. Specifications: * CPU: Qualcomm IPQ8071A Quad core Cortex-A53 1.4GHz * RAM: 512MB of DDR3 * Storage: 256MB of parallel NAND * Ethernet: 4x1G RJ45 ports (QCA8075) with 1x status LED per port * WLAN: * PCI based Qualcomm QCA9889 1x1 802.11ac Wawe 2 for IoT * 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate * 5GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate * LED-s: * System (Blue and Yellow) * IoT (Blue) * Network (Blue and Yellow) * Buttons: 1x Soft reset * Power: 12V DC Jack Installation instructions: Obtaining SSH access is mandatory https://openwrt.org/inbox/toh/xiaomi/xiaomi_ax3600#obtain_ssh_access Installation is done by the ubiformat method, through SSH: 1. Open an SSH shell to the router 2. Copy the file openwrt-ipq807x-generic-xiaomi_ax3600-initramfs-factory.ubi to the /tmp directory 3. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1): nvram get flag_boot_rootfs 4. Find the rootfs and rootfs_1 mtd indexes respectively: cat /proc/mtd Please confirm if mtd12 and mtd13 are the correct indexes from above! 5. Use the command ubiformat to flash the opposite mtd with UBI image: If nvram get flag_boot_rootfs returned 0: ubiformat /dev/mtd13 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax3600-initramfs-factory.ubi -s 2048 -O 2048 && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit otherwise: ubiformat /dev/mtd12 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax3600-initramfs-factory.ubi -s 2048 -O 2048 && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit 6. Reboot the device by: reboot Previous commands flashed an ubinized OpenWrt initramfs that will serve as the intermediate step since OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for packages. Continue in order to pernamently flash OpenWrt: 7. SSH into OpenWrt from one of the LAN ports 8. Copy the file openwrt-ipq807x-generic-xiaomi_ax3600-squashfs-sysupgrade.bin to the /tmp directory 9. Sysupgrade the device: sysupgrade -n /tmp/openwrt-ipq807x-generic-xiaomi_ax3600-squashfs-sysupgrade.bin Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Signed-off-by: Robert Marko <robimarko@gmail.com>
* ramips: mt7621: Add Arcadyan WE420223-99 supportHarm Berntsen2023-01-151-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Arcadyan WE420223-99 is a WiFi AC simultaneous dual-band access point distributed as Experia WiFi by KPN in the Netherlands. It features two ethernet ports and 2 internal antennas. Specifications -------------- SOC : Mediatek MT7621AT ETH : Two 1 gigabit ports, built into the SOC WIFI : MT7615DN BUTTON: Reset BUTTON: WPS LED : Power (green+red) LED : WiFi (green+blue) LED : WPS (green+red) LED : Followme (green+red) Power : 12 VDC, 1A barrel plug Winbond variant: RAM : Winbond W631GG6MB12J, 1GBIT DDR3 SDRAM Flash : Winbond W25Q256JVFQ, 256Mb SPI U-Boot: 1.1.3 (Nov 23 2017 - 16:40:17), Ralink 5.0.0.1 Macronix variant: RAM : Nanya NT5CC64M16GP-DI, 1GBIT DDR3 SDRAM Flash : MX25l25635FMI-10G, 256Mb SPI U-Boot: 1.1.3 (Dec 4 2017 - 11:37:57), Ralink 5.0.0.1 Serial ------ The serial port needs a TTL/RS-232 3V3 level converter! The Serial setting is 57600-8-N-1. The board has an unpopulated 2.54mm straight pin header. The pinout is: VCC (the square), RX, TX, GND. Installation ------------ See the Wiki page [1] for more details, it comes down to: 1. Open the device, take off the heat sink 2. Connect the SPI flash chip to a flasher, e.g. a Raspberry Pi. Also connect the RESET pin for stability (thanks @FPSUsername for reporting) 3. Make a backup in case you want to revert to stock later 4. Flash the squashfs-factory.trx file to offset 0x50000 of the flash 5. Ensure the bootpartition variable is set to 0 in the U-Boot environment located at 0x30000 Note that the U-Boot is password protected, this can optionally be removed. See the forum [2] for more details. MAC Addresses(stock) -------------------- +----------+------------------+-------------------+ | use | address | example | +----------+------------------+-------------------+ | Device | label | 00:00:00:11:00:00 | | Ethernet | + 3 | 00:00:00:11:00:03 | | 2g | + 0x020000f00001 | 02:00:00:01:00:01 | | 5g | + 1 | 00:00:00:11:00:01 | +----------+------------------+-------------------+ The label address is stored in ASCII in the board_data partition Notes ----- - This device has a dual-boot partition scheme, but OpenWRT will claim both partitions for more storage space. Known issues ------------ - 2g MAC address does not match stock due to missing support for that in macaddr_add - Only the power LED is configured by default References ---------- [1] https://openwrt.org/inbox/toh/arcadyan/astoria/we420223-99 [2] https://forum.openwrt.org/t/adding-openwrt-support-for-arcadyan-we420223-99-kpn-experia-wifi/132653 Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com> Signed-off-by: Harm Berntsen <git@harmberntsen.nl>
* ipq40xx: add support for Linksys WHW03 V2Vincent Tremblay2023-01-151-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SOC: Qualcomm IPQ4019 WiFi 1: QCA4019 IEEE 802.11b/g/n WiFi 2: QCA4019 IEEE 802.11a/n/ac WiFi 3: QCA8888 IEEE 802.11a/n/ac Bluetooth: Qualcomm CSR8811 (A12U) Zigbee: Silicon Labs EM3581 NCP + Skyworks SE2432L Ethernet: Qualcomm Atheros QCA8072 (2-port) Flash 1: Mactronix MX30LF4G18AC-XKI RAM (NAND): SK hynix H5TC4G63CFR-PBA (512MB) LED Controller: NXP PCA9633 (I2C) Buttons: Single reset button (GPIO). - The three WiFis were fully tested and are configured with the same settings as in the vendor firmware. - The specific board files were submitted to the ATH10k mailing list but I'm still waiting for a reply. They can be removed once they are approved upstream. - Two ethernet ports are accessible on the device. By default one is configured as WAN and the other one is LAN. They are fully working. Bluetooth: ======== - Fully working with the following caveats: - RFKILL need to be enabled in the kernel. - An older version of bluez is needed as bccmd is needed to configure the chip. Zigbee: ====== - The spidev device is available in the /dev directory. - GPIOs are configured the same way as in the vendor firmware. - Tests are on-going. I am working on getting access to the Silicon Labs stack to validate that it is fully working. Installation: ========= The squash-factory image can be installed via the Linksys Web UI: 1. Open "http://192.168.1.1/ca" (Change the IP with the IP of your device). 2. Login with your admin password. 3. To enter into the support mode, click on the "CA" link and the bottom of the page. 4. Open the "Connectivity" menu and upload the squash-factory image with the "Choose file" button. 5. Click start. Ignore all the prompts and warnings by click "yes" in all the popups. The device uses a dual partition mechanism. The device automatically revert to the previous partition after 3 failed boot attempts. If you want to force the previous firmware to load, you can turn off and then turn on the device for 2 seconds, 3 times in a row. It can also be done via TFTP: 1. Setup a local TFTP server and configure its IP to 192.168.1.100. 2. Rename your image to "nodes_v2.img" and put it to the TFTP root of your server. 3. Connect to the device through the serial console. 4. Power on device and press enter when prompted to drop into U-Boot. 5. Flash the partition of your choice by typing "run flashimg" or "run flashimg2". 6. Once flashed, enter "reset" to reboot the device. Reviewed-by: Robert Marko <robimarko@gmail.com> Signed-off-by: Vincent Tremblay <vincent@vtremblay.dev>
* ramips: add basic support for TP-Link EC330-G5u v1Mikhail Zhilkin2023-01-141-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds basic support for TP-Link EC330-G5u Ver:1.0 router (also known as TP-Link Archer C9ERT). Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 128 MiB, Nanya NT5CC64M16GP-DI Flash: 128 MiB NAND, ESMT F59L1G81MA-25T Wireless 2.4 GHz (MediaTek MT7615N): b/g/n, 4x4 Wireless 5 GHz (MediaTek MT7615N): a/n/ac, 4x4 Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1xUSB3.0 Button: 4 (Led, WiFi On/Off, Reset, WPS) LEDs: 7 blue LEDs, 1 orange(amber) LED, 1 white(non-gpio) LED Power: 12 VDC, 2 A Connector type: Barrel Bootloader: First U-Boot (1.1.3), Main U-Boot (1.1.3). Additionally, original TP-Link firmware contains Image U-Boot (1.1.3). Serial console (UART) --------------------- V +-------+-------+-------+-------+ | +3.3V | GND | TX | RX | +---+---+-------+-------+-------+ | J2 | +--- Don't connect Installation ------------ 1. Rename OpenWrt initramfs image to test.bin and place it on tftp server with IP 192.168.0.5 2. Attach UART, switch on the router and interrupt the boot process by pressing 't' 3. Load and run OpenWrt initramfs image: tftpboot bootm 4. Once inside OpenWrt, switch to the first boot image: fw_setenv BootImage 0 5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv BootImage 1 reboot Recovery -------- 1. Press Reset button and power on the router 2. Navigate to U-Boot recovery web server (http://192.168.0.1/) and upload the OEM firmware MAC addresses ------------- +---------+-------------------+-------------------+-------------+ | | MAC example 1 | MAC example 2 | Algorithm | +---------+-------------------+-------------------+-------------+ | label | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | LAN | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WAN | 72:ff:7b:xx:xx:f5 | 54:d4:f7:xx:xx:db | label+1 [1] | | WLAN 2g | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WLAN 5g | 68:ff:7b:xx:xx:f6 | 50:d4:f7:xx:xx:dc | label+2 | +---------+-------------------+-------------------+-------------+ label MAC address was found in factory at 0x165 (text format xx:xx:xx:xx:xx:xx). Notes ----- [1] WAN MAC address: a. First octet of WAN MAC is differ than others and OUI is not related to TP-Link company. This probably should be fixed. b. Flipping bits in first octet and hex delta are different for the different MAC examples: +-----------------+----------------+----------------+ | | Example 1 | Example 2 | +-----------------+----------------+----------------+ | LAN | 68 = 0110 1000 | 50 = 0101 0000 | | MAC (1st octet) | ^ ^ ^ | | +-----------------+----------------+----------------+ | WAN | 72 = 0111 0010 | 54 = 0101 0100 | | MAC (1st octet) | ^ ^ ^ | ^ | +-----------------+----------------+----------------+ | HEX delta | 0xa | 0x4 | +-----------------+----------------+----------------+ | DEC delta | 4 | 4 | +-----------------+----------------+----------------+ c. DEC delta is a constant (4). This looks like a mistake in OEM firmware and probably should be fixed. Based on the above, I decided to keep correct OUI and make WAN MAC = label + 1. [2] Bootloaders The device contains 3 bootloaders: - First U-Boot: U-Boot 1.1.3 (Mar 18 2019 - 12:50:24). The First U-Boot located on NAND Flash to load next full-feature Uboot. - Main U-Boot + its backup: U-Boot 1.1.3 (Mar 18 2019 - 12:50:29). This bootloader includes recovery webserver. Requires special uImages to continue the boot process: 0x00 (os0, os1) - firmware uImage 0x40 (os0, os1) - standalone uImage (OpenWrt kernel is here) - Additionally, both slots of the original TP-Link firmware contains Image U-Boot: U-Boot 1.1.3 (Oct 16 2019 - 08:14:45). It checks image magics and CRCs. We don't use this U-Boot with OpenWrt. Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
* ipq40xx: fix up Linksys WHW01 board name, device definitionTony Ambardar2022-12-311-1/+1
| | | | | | | | | | | | | | Update the board name defined in DTS to match online documentation and the name encoded into factory firmware. This helps supports flashing firmware factory images using 'sysupgrade'. Original WHW01 device definition assumes the rootfs IMAGE_SIZE is 33 MB instead of the correct 74 MB, and defines factory images which include extra adjustments/padding that do not match OEM factory images and may cause problems flashing. Update image size and build recipe to fix these. Suggested-by: Wyatt Martin <wawowl@gmail.com> Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
* mediatek: drop redmi-ax6000 variant with modified envChuanhong Guo2022-12-301-1/+0
| | | | | | | | | | | | | | | | | | | This variant uses xiaomi factory u-boot and modified u-boot-env & bootcmd. By modifying uboot-env, the xiaomi firmware recovery provided in the vendor u-boot doesn't work anymore. It's possible to put u-boot into a state where it refuese to take any serial input. If the u-boot is in this state, users can't restore their firmware without taking the flash off the board. We now have a -stock variant where the vendor u-boot is used in a way that xiaomi firmware recovery still works, and a -ubootmod variant where we get rid of all xiaomi components, have more usable space and no uart console lock. These two should cover all use cases and we don't need this variant anymore. Drop this redmi-ax6000 variant. Existing users of this variant should perform a u-boot mod or restore to the -stock layout. Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-07 21:07:19 +0000