aboutsummaryrefslogtreecommitdiffstats
path: root/package/boot/uboot-envtools
Commit message (Collapse)AuthorAgeFilesLines
* ramips: mt7621: Add support for ZyXEL NR7101Bjørn Mork2021-05-091-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ZyXEL NR7101 is an 802.3at PoE powered 5G outdoor (IP68) CPE with integrated directional 5G/LTE antennas. Specifications: - SoC: MediaTek MT7621AT - RAM: 256 MB - Flash: 128 MB MB NAND (MX30LF1G18AC) - WiFi: MediaTek MT7603E - Switch: 1 LAN port (Gigabiti) - 5G/LTE: Quectel RG502Q-EA connected by USB3 to SoC - SIM: 2 micro-SIM slots under transparent cover - Buttons: Reset, WLAN under same cover - LEDs: Multicolour green/red/yellow under same cover (visible) - Power: 802.3at PoE via LAN port The device is built as an outdoor ethernet to 5G/LTE bridge or router. The Wifi interface is intended for installation and/or temporary management purposes only. UART Serial: 57600N1 Located on populated 5 pin header J5: [o] GND [ ] key - no pin [o] RX [o] TX [o] 3.3V Vcc Remove the SIM/button/LED cover, the WLAN button and 12 screws holding the back plate and antenna cover together. The GPS antenna is fixed to the cover, so be careful with the cable. Remove 4 screws fixing the antenna board to the main board, again being careful with the cables. A bluetooth TTL adapter is recommended for permanent console access, to keep the router water and dustproof. The 3.3V pin is able to power such an adapter. MAC addresses: OpenWrt OEM Address Found as lan eth2 08:26:97:*:*:BC Factory 0xe000 (hex), label wlan0 ra0 08:26:97:*:*:BD Factory 0x4 (hex) wwan0 usb0 random WARNING!! ISP managed firmware might at any time update itself to a version where all known workarounds have been disabled. Never boot an ISP managed firmware with a SIM in any of the slots if you intend to use the router with OpenWrt. The bootloader lock can only be disabled with root access to running firmware. The flash chip is physically inaccessible without soldering. Installation from OEM web GUI: - Log in as "supervisor" on https://172.17.1.1/ - Upload OpenWrt initramfs-recovery.bin image on the Maintenance -> Firmware page - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - (optional) Copy OpenWrt to the recovery partition. See below - Sysupgrade to the OpenWrt sysupgrade image and reboot Installation from OEM ssh: - Log in as "root" on 172.17.1.1 port 22022 - scp OpenWrt initramfs-recovery.bin image to 172.17.1.1:/tmp - Prepare bootloader config by running: nvram setro uboot DebugFlag 0x1 nvram setro uboot CheckBypass 0 nvram commit - Run "mtd_write -w write initramfs-recovery.bin Kernel" and reboot - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - (optional) Copy OpenWrt to the recovery partition. See below - Sysupgrade to the OpenWrt sysupgrade image and reboot Copying OpenWrt to the recovery partition: - Verify that you are running a working OpenWrt recovery image from flash - ssh to root@192.168.1.1 and run: fw_setenv CheckBypass 0 mtd -r erase Kernel2 - Wait while the bootloader mirrors Image1 to Image2 NOTE: This should only be done after successfully booting the OpenWrt recovery image from the primary partition during installation. Do not do this after having sysupgraded OpenWrt! Reinstalling the recovery image on normal upgrades is not required or recommended. Installation from Z-Loader: - Halt boot by pressing Escape on console - Set up a tftp server to serve the OpenWrt initramfs-recovery.bin image at 10.10.10.3 - Type "ATNR 1,initramfs-recovery.bin" at the "ZLB>" prompt - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - Sysupgrade to the OpenWrt sysupgrade image NOTE: ATNR will write the recovery image to both primary and recovery partitions in one go. Booting from RAM: - Halt boot by pressing Escape on console - Type "ATGU" at the "ZLB>" prompt to enter the U-Boot menu - Press "4" to select "4: Entr boot command line interface." - Set up a tftp server to serve the OpenWrt initramfs-recovery.bin image at 10.10.10.3 - Load it using "tftpboot 0x88000000 initramfs-recovery.bin" - Boot with "bootm 0x8800017C" to skip the 380 (0x17C) bytes ZyXEL header This method can also be used to RAM boot OEM firmware. The warning regarding OEM applies! Never boot an unknown OEM firmware, or any OEM firmware with a SIM in any slot. NOTE: U-Boot configuration is incomplete (on some devices?). You may have to configure a working mac address before running tftp using "setenv eth0addr <mac>" Unlocking the bootloader: If you are unebale to halt boot, then the bootloader is locked. The OEM firmware locks the bootloader on every boot by setting DebugFlag to 0. Setting it to 1 is therefore only temporary when OEM firmware is installed. - Run "nvram setro uboot DebugFlag 0x1; nvram commit" in OEM firmware - Run "fw_setenv DebugFlag 0x1" in OpenWrt NOTE: OpenWrt does this automatically on first boot if necessary NOTE2: Setting the flag to 0x1 avoids the reset to 0 in known OEM versions, but this might change. WARNING: Writing anything to flash while the bootloader is locked is considered extremely risky. Errors might cause a permanent brick! Enabling management access from LAN: Temporary workaround to allow installing OpenWrt if OEM firmware has disabled LAN management: - Connect to console - Log in as "root" - Run "iptables -I INPUT -i br0 -j ACCEPT" Notes on the OEM/bootloader dual partition scheme The dual partition scheme on this device uses Image2 as a recovery image only. The device will always boot from Image1, but the bootloader might copy Image2 to Image1 under specific conditions. This scheme prevents repurposing of the space occupied by Image2 in any useful way. Validation of primary and recovery images is controlled by the variables CheckBypass, Image1Stable, and Image1Try. The bootloader sets CheckBypass to 0 and reboots if Image1 fails validation. If CheckBypass is 0 and Image1 is invalid then Image2 is copied to Image1. If CheckBypass is 0 and Image2 is invalid, then Image1 is copied to Image2. If CheckBypass is 1 then all tests are skipped and Image1 is booted unconditionally. CheckBypass is set to 1 after each successful validation of Image1. Image1Try is incremented if Image1Stable is 0, and Image2 is copied to Image1 if Image1Try is 3 or larger. But the bootloader only tests Image1Try if CheckBypass is 0, which is impossible unless the booted image sets it to 0 before failing. The system is therefore not resilient against runtime errors like failure to mount the rootfs, unless the kernel image sets CheckBypass to 0 before failing. This is not yet implemented in OpenWrt. Setting Image1Stable to 1 prevents the bootloader from updating Image1Try on every boot, saving unnecessary writes to the environment partition. Keeping an OpenWrt initramfs recovery as Image2 is recommended primarily to avoid unwanted OEM firmware boots on failure. Ref the warning above. It enables console-less recovery in case of some failures to boot from Image1. Signed-off-by: Bjørn Mork <bjorn@mork.no>
* uboot-envtools: change size for unifi-6-lrDaniel Golle2021-05-071-1/+1
| | | | | | | The previous commit increased the U-Boot environment size of the UniFi 6 LR to 0x4000. Also change it uboot-envtools accordingly. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-envtools: add support for Buffalo WZR-HP-G300NHMauri Sandberg2021-04-301-0/+4
| | | | | | This adds an entries for wzr-hp-g300nh-rb and wzr-hp-g300nh-s. Signed-off-by: Mauri Sandberg <sandberg@mailfence.com>
* uboot-envtools: mvebu: add Buffalo LS421DEDaniel González Cabanelas2021-04-171-0/+3
| | | | | | | | The Buffalo Linkstation LS421DE NAS lacks an uboot env config file. Create it via scripts. Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com>
* uboot-envtools: support environment in spi-nand on bpi-r64Daniel Golle2021-04-111-3/+11
| | | | | | | Default to U-Boot env in UBI if root device is not mmc block device. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Signed-off-by: Oskari Lemmela <oskari@lemmela.net>
* mediatek: fix writing bananapi bpi-r64 envOskari Lemmela2021-04-111-3/+4
| | | | | | | Use generic functions to get env partition. Fixes: 7043e4334f0 ("mediatek: mt7622: improve sysupgrade on MMC") Signed-off-by: Oskari Lemmela <oskari@lemmela.net>
* uboot-envtools: oxnas: drop redundant space after case keywordsPiotr Dymacz2021-04-101-1/+1
| | | | Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
* uboot-envtools: layerscape: drop redundant space after case keywordsPiotr Dymacz2021-04-101-1/+1
| | | | Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
* uboot-envtools: ipq806x: drop redundant space after case keywordsPiotr Dymacz2021-04-101-3/+3
| | | | Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
* uboot-envtools: ipq40xx: drop redundant space after case keywordsPiotr Dymacz2021-04-101-10/+10
| | | | Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
* uboot-envtools: imx6: drop redundant space after case keywordsPiotr Dymacz2021-04-101-28/+28
| | | | Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
* uboot-envtools: drop shebang from uci-defaults and lib filesPiotr Dymacz2021-04-1016-18/+0
| | | | | | These files are sourced and non-executable, a shebang is redundant. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
* uboot-envtools: add env settings for ubnt,unifi-6-lr-ubootmodDaniel Golle2021-04-091-2/+5
| | | | | | | | | Add settings for fw_printenv/fw_setenv for the Ubiquiti UniFi 6 LR when running OpenWrt's version of U-Boot. The settings should work equally with the unmodified version, but that has not yet been tested. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-envtools: add wrapper scripts for alternate configBjørn Mork2021-04-083-0/+6
| | | | | | | | Now that we can create an alternate configuration file, add two wrapper scripts for simple access to it using the alternate alternate application names `fw_printsys' and `fw_setsys'. Signed-off-by: Bjørn Mork <bjorn@mork.no>
* uboot-envtools: add support for multiple config partitionsBjørn Mork2021-04-083-15/+32
| | | | | | | | | | | | | | | | | | | | | | Most (all?) of the realtek devices have two u-boot config partitions with a different set of variables in each. The U-Boot shell provides two sets of apps to manipulate these: printenv- print environment variables printsys- printsys - print system information variables saveenv - save environment variables to persistent storage savesys - savesys - save system information variables to persistent storage setenv - set environment variables setsys - setsys - set system information variables Add support for multiple ubootenv configuration types, allowing more than one configuration file. Section names are not suitable for naming the different configurations since each file can be the result of multiple sections in case of backup partitions. Signed-off-by: Bjørn Mork <bjorn@mork.no>
* mediatek: Fix writing U-Boot env on Buffalo WSR-2533DHP2Hauke Mehrtens2021-03-171-1/+1
| | | | | | | This fixes writing to the U-Boot environment by making the partition writable and setting the correct flash sector size of 128K. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* mediatek: add support for Buffalo WSR-2533DHP2INAGAKI Hiroshi2021-03-151-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds support for the Buffalo WSR-2533DHP2. The device uses the Broadcom TRX image format with a special magic. To be able to boot the images or load them they have to be wrapped with different headers depending how it is loaded. There are multiple ways to install OpenWrt on this device. Boot ramdisk from U-Boot ---------------------------- This will load the image and not write it into the flash. 1. Stop boot menu with "space" key 2. Select "System Load Linux to SDRAM via TFTP." 3. Load this image: openwrt-mediatek-mt7622-buffalo_wsr-2533dhp2-initramfs-kernel.bin 4. The system boots the image Write to flash from U-Boot ----------------------------- This will load the image over tftp and directly write it into the flash. 1. Stop boot menu with "space" key 2. Select "System Load Linux Kernel then write to Flash via TFTP." 3. Load this image: openwrt-mediatek-mt7622-buffalo_wsr-2533dhp2-squashfs-factory-uboot.bin 4. The system writes this image into the flash and boots into it. Write to flash from Web UI ----------------------------- This will load the image over over the Web UI and write it into the flash 1. Open the Web UI 2. Go to "管理" -> "ファームウェア更新" 3. Select "ローカルファイル指定" and click "更新実行" 4. Load this image: openwrt-mediatek-mt7622-buffalo_wsr-2533dhp2-squashfs-factory.bin 5. The system writes this image into the flash and boots into it. Specifications ------------------- * SoC: MT7622 (4x4 2.4 GHz Wifi) * Wifi: MT7615 (4x4 5 GHz Wifi) * Flash: Winbond W29N01HZ 128MB SLC NAND * RAM 256MB * Ethernet: Realtek RTL8367S (5 x 1GBit/s, SoC via 2.5GBit/s) Co-Developed-by: Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com> Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* realtek: Add ZyXEL GS1900-8Hauke Mehrtens2021-03-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ZyXEL GS1900-8 is a 8 port switch without any PoE functionality or SFP ports, but otherwise similar to the other GS1900 switches. Specifications -------------- * Device: ZyXEL GS1900-8 v1.2 * SoC: Realtek RTL8380M 500 MHz MIPS 4KEc * Flash: Macronix MX25L12835F 16 MiB * RAM: Nanya NT5TU128M8GE-AC 128 MiB DDR2 SDRAM * Ethernet: 8x 10/100/1000 Mbit * LEDs: 1 PWR LED (green, not configurable) 1 SYS LED (green, configurable) 8 ethernet port status LEDs (green, SoC controlled) * Buttons: 1 on-off glide switch at the back (not configurable) 1 reset button at the right side, behind the air-vent (not configurable) 1 reset button on front panel (configurable) * Power 12V 1A barrel connector * UART: 1 serial header (JP2) with populated standard pin connector on the left side of the PCB, towards the back. Pins are labelled: + VCC (3.3V) + TX (really RX) + RX (really TX) + GND the labelling is done from the usb2serial connector's point of view, so RX/ TX are mixed up. Serial connection parameters for both devices: 115200 8N1. Installation ------------ Instructions are identical to those for the GS1900-10HP and GS1900-8HP. * Configure your client with a static 192.168.1.x IP (e.g. 192.168.1.10). * Set up a TFTP server on your client and make it serve the initramfs image. * Connect serial, power up the switch, interrupt U-boot by hitting the space bar, and enable the network: > rtk network on * Since the GS1900-10HP is a dual-partition device, you want to keep the OEM firmware on the backup partition for the time being. OpenWrt can only boot off the first partition anyway (hardcoded in the DTS). To make sure we are manipulating the first partition, issue the following commands: > setsys bootpartition 0 > savesys * Download the image onto the device and boot from it: > tftpboot 0x84f00000 192.168.1.10:openwrt-realtek-generic-zyxel_gs1900-8-initramfs-kernel.bin > bootm * Once OpenWrt has booted, scp the sysupgrade image to /tmp and flash it: > sysupgrade /tmp/openwrt-realtek-generic-zyxel_gs1900-8-squashfs-sysupgrade.bin Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* uboot-envtools: adjust compile patch to version v2021.01Ronny Kotzschmar2021-03-011-2/+2
| | | | | | | with u-boot v2020.07 some variables have been renamed so this patch needs to be adjusted otherwise at least with macOS as build system there are build errors Signed-off-by: Ronny Kotzschmar <ro.ok@me.com>
* uboot-envtools: add defaults for Bananapi BPi-R64Daniel Golle2021-02-281-0/+7
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-envtools: add defaults for linksys-e8450-ubiDaniel Golle2021-02-281-0/+25
| | | | | | | | Add U-Boot environment configuration for the Linksys E8450 (UBI) to allow access to the bootloader environment from OpenWrt via 'fw_printenv' and 'fw_setenv'. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ramips: add support for ZTE MF283+Lech Perczak2021-02-261-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ZTE MF283+ is a dual-antenna LTE category 4 router, based on Ralink RT3352 SoC, and built-in ZTE P685M PCIe MiniCard LTE modem. Hardware highlighs: - CPU: MIPS24KEc at 400MHz, - RAM: 64MB DDR2, - Flash: 16MB SPI, - Ethernet: 4 10/100M port switch with VLAN support, - Wireless: Dual-stream 802.11n (RT2860), with two internal antennas, - WWAN: Built-in ZTE P685M modem, with two internal antennas and two switching SMA connectors for external antennas, - FXS: Single ATA, with two connectors marked PHONE1 and PHONE2, internally wired in parallel by 0-Ohm resistors, handled entirely by internal WWAN modem. - USB: internal miniPCIe slot for modem, unpopulated USB A connector on PCB. - SIM slot for the WWAN modem. - UART connector for the console (unpopulated) at 3.3V, pinout: 1: VCC, 2: TXD, 3: RXD, 4: GND, settings: 57600-8-N-1. - LEDs: Power (fixed), WLAN, WWAN (RGB), phone (bicolor, controlled by modem), Signal, 4 link/act LEDs for LAN1-4. - Buttons: WPS, reset. Installation: As the modem is, for most of the time, provided by carriers, there is no possibility to flash through web interface, only built-in FOTA update and TFTP recovery are supported. There are two installation methods: (1) Using serial console and initramfs-kernel - recommended, as it allows you to back up original firmware, or (2) Using TFTP recovery - does not require disassembly. (1) Using serial console: To install OpenWrt, one needs to disassemble the router and flash it via TFTP by using serial console: - Locate unpopulated 4-pin header on the top of the board, near buttons. - Connect UART adapter to the connector. Use 3.3V voltage level only, omit VCC connection. Pin 1 (VCC) is marked by square pad. - Put your initramfs-kernel image in TFTP server directory. - Power-up the device. - Press "1" to load initramfs image to RAM. - Enter IP address chosen for the device (defaults to 192.168.0.1). - Enter TFTP server IP address (defaults to 192.168.0.22). - Enter image filename as put inside TFTP server - something short, like firmware.bin is recommended. - Hit enter to load the image. U-boot will store above values in persistent environment for next installation. - If you ever might want to return to vendor firmware, BACK UP CONTENTS OF YOUR FLASH NOW. For this router, commonly used by mobile networks, plain vendor images are not officially available. To do so, copy contents of each /dev/mtd[0-3], "firmware" - mtd3 being the most important, and copy them over network to your PC. But in case anything goes wrong, PLEASE do back up ALL OF THEM. - From under OpenWrt just booted, load the sysupgrade image to tmpfs, and execute sysupgrade. (2) Using TFTP recovery - Set your host IP to 192.168.0.22 - for example using: sudo ip addr add 192.168.0.22/24 dev <interface> - Set up a TFTP server on your machine - Put the sysupgrade image in TFTP server root named as 'root_uImage' (no quotes), for example using tftpd: cp openwrt-ramips-rt305x-zte_mf283plus-squashfs-sysupgrade.bin /srv/tftp/root_uImage - Power on the router holding BOTH Reset and WPS buttons held for around 5 seconds, until after WWAN and Signal LEDs blink. - Wait for OpenWrt to start booting up, this should take around a minute. Return to original firmware: Here, again there are two possibilities are possible, just like for installation: (1) Using initramfs-kernel image and serial console (2) Using TFTP recovery (1) Using initramfs-kernel image and serial console - Boot OpenWrt initramfs-kernel image via TFTP the same as for installation. - Copy over the backed up "firmware.bin" image of "mtd3" to /tmp/ - Use "mtd write /tmp/firmware.bin /dev/mtd3", where firmware.bin is your backup taken before OpenWrt installation, and /dev/mtd3 is the "firmware" partition. (2) Using TFTP recovery - Follow the same steps as for installation, but replacing 'root_uImage' with firmware backup you took during installation, or by vendor firmware obtained elsewhere. A few quirks of the device, noted from my instance: - Wired and wireless MAC addresses written in flash are the same, despite being in separate locations. - Power LED is hardwired to 3.3V, so there is no status LED per se, and WLAN LED is controlled by WLAN driver, so I had to hijack 3G/4G LED for status - original firmware also does this in bootup. - FXS subsystem and its LED is controlled by the modem, so it work independently of OpenWrt. Tested to work even before OpenWrt booted. I managed to open up modem's shell via ADB, and found from its kernel logs, that FXS and its LED is indeed controlled by modem. - While finding LEDs, I had no GPL source drop from ZTE, so I had to probe for each and every one of them manually, so this might not be complete - it looks like bicolor LED is used for FXS, possibly to support dual-ported variant in other device sharing the PCB. - Flash performance is very low, despite enabling 50MHz clock and fast read command, due to using 4k sectors throughout the target. I decided to keep it at the moment, to avoid breaking existing devices - I identified one potentially affected, should this be limited to under 4MB of Flash. The difference between sysupgrade durations is whopping 3min vs 8min, so this is worth pursuing. In vendor firmware, WWAN LED behaviour is as follows, citing the manual: - red - no registration, - green - 3G, - blue - 4G. Blinking indicates activity, so netdev trigger mapped from wwan0 to blue:wwan looks reasonable at the moment, for full replacement, a script similar to "rssileds" would need to be developed. Behaviour of "Signal LED" in vendor firmware is as follows: - Off - no signal, - Blinking - poor coverage - Solid - good coverage. A few more details on the built-in LTE modem: Modem is not fully supported upstream in Linux - only two CDC ports (DIAG and one for QMI) probe. I sent patches upstream to add required device IDs for full support. The mapping of USB functions is as follows: - CDC (QCDM) - dedicated to comunicating with proprietary Qualcomm tools. - CDC (PCUI) - not supported by upstream 'option' driver yet. Patch submitted upstream. - CDC (Modem) - Exactly the same as above - QMI - A patch is sent upstream to add device ID, with that in place, uqmi did connect successfully, once I selected correct PDP context type for my SIM (IPv4-only, not default IPv4v6). - ADB - self-explanatory, one can access the ADB shell with a device ID added to 51-android.rules like so: SUBSYSTEM!="usb", GOTO="android_usb_rules_end" LABEL="android_usb_rules_begin" SUBSYSTEM=="usb", ATTR{idVendor}=="19d2", ATTR{idProduct}=="1275", ENV{adb_user}="yes" ENV{adb_user}=="yes", MODE="0660", GROUP="plugdev", TAG+="uaccess" LABEL="android_usb_rules_end" While not really needed in OpenWrt, it might come useful if one decides to move the modem to their PC to hack it further, insides seem to be pretty interesting. ADB also works well from within OpenWrt without that. O course it isn't needed for normal operation, so I left it out of DEVICE_PACKAGES. Signed-off-by: Lech Perczak <lech.perczak@gmail.com> [remove kmod-usb-ledtrig-usbport, take merged upstream patches] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* uboot-envtools: add support for ZyXEL GS-1900-8HP v1 and v2Stijn Segers2021-02-231-0/+2
| | | | | | This adds the necessary nuts and bolts for the uboot settings for both the ZyXEL GS1900-8HP v1 and v2. Signed-off-by: Stijn Segers <foss@volatilesystems.org>
* uboot-envtools: Update to version 2021.01Hauke Mehrtens2021-02-081-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* ath79: add support for Senao Engenius EAP1200HMichael Pratt2021-01-231-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FCC ID: A8J-EAP1200H Engenius EAP1200H is an indoor wireless access point with 1 Gb ethernet port, dual-band wireless, internal antenna plates, and 802.3at PoE+ **Specification:** - QCA9557 SOC - QCA9882 WLAN PCI card, 5 GHz, 2x2, 26dBm - AR8035-A PHY RGMII GbE with PoE+ IN - 40 MHz clock - 16 MB FLASH MX25L12845EMI-10G - 2x 64 MB RAM NT5TU32M16FG - UART at J10 populated - 4 internal antenna plates (5 dbi, omni-directional) - 5 LEDs, 1 button (power, eth0, 2G, 5G, WPS) (reset) **MAC addresses:** MAC addresses are labeled as ETH, 2.4G, and 5GHz Only one Vendor MAC address in flash eth0 ETH *:a2 art 0x0 phy1 2.4G *:a3 --- phy0 5GHz *:a4 --- **Serial Access:** the RX line on the board for UART is shorted to ground by resistor R176 therefore it must be removed to use the console but it is not necessary to remove to view boot log optionally, R175 can be replaced with a solder bridge short the resistors R175 and R176 are next to the UART RX pin at J10 **Installation:** 2 ways to flash factory.bin from OEM: Method 1: Firmware upgrade page: OEM webpage at 192.168.1.1 username and password "admin" Navigate to "Firmware Upgrade" page from left pane Click Browse and select the factory.bin image Upload and verify checksum Click Continue to confirm and wait 3 minutes Method 2: Serial to load Failsafe webpage: After connecting to serial console and rebooting... Interrupt uboot with any key pressed rapidly execute `run failsafe_boot` OR `bootm 0x9fd70000` wait a minute connect to ethernet and navigate to "192.168.1.1/index.htm" Select the factory.bin image and upload wait about 3 minutes **Return to OEM:** If you have a serial cable, see Serial Failsafe instructions otherwise, uboot-env can be used to make uboot load the failsafe image *DISCLAIMER* The Failsafe image is unique to Engenius boards. If the failsafe image is missing or damaged this will brick the device DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt ssh into openwrt and run `fw_setenv rootfs_checksum 0` reboot, wait 3 minutes connect to ethernet and navigate to 192.168.1.1/index.htm select OEM firmware image from Engenius and click upgrade **TFTP recovery:** Requires serial console, reset button does nothing rename initramfs to 'vmlinux-art-ramdisk' make available on TFTP server at 192.168.1.101 power board, interrupt boot execute tftpboot and bootm 0x81000000 NOTE: TFTP is not reliable due to bugged bootloader set MTU to 600 and try many times **Format of OEM firmware image:** The OEM software of EAP1200H is a heavily modified version of Openwrt Kamikaze. One of the many modifications is to the sysupgrade program. Image verification is performed simply by the successful ungzip and untar of the supplied file and name check and header verification of the resulting contents. To form a factory.bin that is accepted by OEM Openwrt build, the kernel and rootfs must have specific names... openwrt-ar71xx-generic-eap1200h-uImage-lzma.bin openwrt-ar71xx-generic-eap1200h-root.squashfs and begin with the respective headers (uImage, squashfs). Then the files must be tarballed and gzipped. The resulting binary is actually a tar.gz file in disguise. This can be verified by using binwalk on the OEM firmware images, ungzipping then untaring. Newer EnGenius software requires more checks but their script includes a way to skip them, otherwise the tar must include a text file with the version and md5sums in a deprecated format. The OEM upgrade script is at /etc/fwupgrade.sh. OKLI kernel loader is required because the OEM software expects the kernel to be no greater than 1536k and the factory.bin upgrade procedure would otherwise overwrite part of the kernel when writing rootfs. Note on PLL-data cells: The default PLL register values will not work because of the external AR8035 switch between the SOC and the ethernet port. For QCA955x series, the PLL registers for eth0 and eth1 can be see in the DTSI as 0x28 and 0x48 respectively. Therefore the PLL registers can be read from uboot for each link speed after attempting tftpboot or another network action using that link speed with `md 0x18050028 1` and `md 0x18050048 1`. The clock delay required for RGMII can be applied at the PHY side, using the at803x driver `phy-mode`. Therefore the PLL registers for GMAC0 do not need the bits for delay on the MAC side. This is possible due to fixes in at803x driver since Linux 5.1 and 5.3 Signed-off-by: Michael Pratt <mcpratt@pm.me>
* uboot-envtools: use $(AUTORELEASE) for PKG_RELEASEPaul Spooren2021-01-221-1/+1
| | | | | | | Use `$(AUTORELEASE)` variable rather than setting a PKG_RELEASE on every commit manually. Signed-off-by: Paul Spooren <mail@aparcar.org>
* ramips: mt7621: add support for Xiaomi Mi Router 4Dmytro Oz2021-01-211-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Xiaomi Mi Router 4 is the same as Xiaomi Mi Router 3G, except for the RAM (256Mib→128Mib), LEDs and gpio (MiNet button). Specifications: Power: 12 VDC, 1 A Connector type: barrel CPU1: MediaTek MT7621A (880 MHz, 4 cores) FLA1: 128 MiB (ESMT F59L1G81MA) RAM1: 128 MiB (ESMT M15T1G1664A) WI1 chip1: MediaTek MT7603EN WI1 802dot11 protocols: bgn WI1 MIMO config: 2x2:2 WI1 antenna connector: U.FL WI2 chip1: MediaTek MT7612EN WI2 802dot11 protocols: an+ac WI2 MIMO config: 2x2:2 WI2 antenna connector: U.FL ETH chip1: MediaTek MT7621A Switch: MediaTek MT7621A UART Serial [o] TX [o] GND [o] RX [ ] VCC - Do not connect it MAC addresses as verified by OEM firmware: use address source LAN *:c2 factory 0xe000 (label) WAN *:c3 factory 0xe006 2g *:c4 factory 0x0000 5g *:c5 factory 0x8000 Flashing instructions: 1.Create a simple http server (nginx etc) 2.set uart enable To enable writing to the console, you must reset to factory settings Then you see uboot boot, press the keyboard 4 button (enter uboot command line) If it is not successful, repeat the above operation of restoring the factory settings. After entering the uboot command line, type: setenv uart_en 1 saveenv boot 3.use shell in uart cd /tmp wget http://"your_computer_ip:80"/openwrt-ramips-mt7621-xiaomi_mir4-squashfs-kernel1.bin wget http://"your_computer_ip:80"/openwrt-ramips-mt7621-xiaomi_mir4-squashfs-rootfs0.bin mtd write openwrt-ramips-mt7621-xiaomi_mir4-squashfs-kernel1.bin kernel1 mtd write openwrt-ramips-mt7621-xiaomi_mir4-squashfs-rootfs0.bin rootfs0 nvram set flag_try_sys1_failed=1 nvram commit reboot 4.login to the router http://192.168.1.1/ Installation via Software exploit Find the instructions in the https://github.com/acecilia/OpenWRTInvasion Signed-off-by: Dmytro Oz <sequentiality@gmail.com> [commit message facelift, rebase onto shared DTSI/common device definition, bump uboot-envtools] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: Add support for OpenMesh MR1750 v2Sven Eckelmann2021-01-192-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications: ====================== * Qualcomm/Atheros QCA9558 ver 1 rev 0 * 720/600/240 MHz (CPU/DDR/AHB) * 128 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 3T3R 2.4 GHz Wi-Fi (11n) * 3T3R 5 GHz Wi-Fi (11ac) * 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default)) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 1x ethernet - AR8035 ethernet PHY (RGMII) - 10/100/1000 Mbps Ethernet - 802.3af POE - used as LAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org> [rebase, add LED migration] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: Add support for OpenMesh MR1750 v1Sven Eckelmann2021-01-191-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications: ====================== * Qualcomm/Atheros QCA9558 ver 1 rev 0 * 720/600/240 MHz (CPU/DDR/AHB) * 128 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 3T3R 2.4 GHz Wi-Fi (11n) * 3T3R 5 GHz Wi-Fi (11ac) * 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default)) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 1x ethernet - AR8035 ethernet PHY (RGMII) - 10/100/1000 Mbps Ethernet - 802.3af POE - used as LAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org> [rebase, apply shared DTSI/device node, add LED migration] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: Add support for OpenMesh MR900 v2Sven Eckelmann2021-01-192-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications: ====================== * Qualcomm/Atheros QCA9558 ver 1 rev 0 * 720/600/240 MHz (CPU/DDR/AHB) * 128 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 3T3R 2.4 GHz Wi-Fi * 3T3R 5 GHz Wi-Fi * 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default)) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 1x ethernet - AR8035 ethernet PHY (RGMII) - 10/100/1000 Mbps Ethernet - 802.3af POE - used as LAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org> [rebase, add LED migration] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: Add support for OpenMesh MR900 v1Sven Eckelmann2021-01-191-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications: ====================== * Qualcomm/Atheros QCA9558 ver 1 rev 0 * 720/600/240 MHz (CPU/DDR/AHB) * 128 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 3T3R 2.4 GHz Wi-Fi * 3T3R 5 GHz Wi-Fi * 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default)) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 1x ethernet - AR8035 ethernet PHY (RGMII) - 10/100/1000 Mbps Ethernet - 802.3af POE - used as LAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org> [rebase, add LED migration] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: Add support for OpenMesh MR600 v2Sven Eckelmann2021-01-192-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications: ====================== * Qualcomm/Atheros AR9344 rev 2 * 560/450/225 MHz (CPU/DDR/AHB) * 128 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 2T2R 2.4 GHz Wi-Fi * 2T2R 5 GHz Wi-Fi * 8x GPIO-LEDs (6x wifi, 1x wps, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default)) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 1x ethernet - AR8035 ethernet PHY (RGMII) - 10/100/1000 Mbps Ethernet - 802.3af POE - used as LAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org> [rebase, add LED migration] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: Add support for OpenMesh MR600 v1Sven Eckelmann2021-01-191-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications: ====================== * Qualcomm/Atheros AR9344 rev 2 * 560/450/225 MHz (CPU/DDR/AHB) * 128 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 2T2R 2.4 GHz Wi-Fi * 2T2R 5 GHz Wi-Fi * 4x GPIO-LEDs (2x wifi, 1x wps, 1x power) * 1x GPIO-button (reset) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 1x ethernet - AR8035 ethernet PHY (RGMII) - 10/100/1000 Mbps Ethernet - 802.3af POE - used as LAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org> [rebase, make WLAN LEDs consistent, add LED migration] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* uboot-envtools: add support for Aruba AP-303 and AP-365Jan Alexander2021-01-141-0/+6
| | | | | | | | | Both devices use u-boot env variables to boot OpenWrt from its flash partition. Using u-boot envtools, it is possible to change the bootcmd back to the stock firmware partition directly from OpenWrt without attaching a serial cable or even physically accessing the device. Signed-off-by: Jan Alexander <jan@nalx.net>
* ipq806x: add support for Ubiquiti UniFi AC HDJan Alexander2021-01-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware -------- SoC: Qualcomm IPQ8064 RAM: 512MB DDR3 Flash: 256MB NAND (Micron MT29F2G08ABBEAH4) 32MB SPI-NOR (Macronix MX25U25635F) WLAN: Qualcomm Atheros QCA9994 4T4R b/g/n Qualcomm Atheros QCA9994 4T4R a/n/ac ETH: eth0 - SECONDARY (Atheros AR8033) eth1 - MAIN (Atheros AR8033) USB: USB-C LED: Dome (white / blue) BTN: Reset Installation ------------ Copy the OpenWrt sysupgrade image to the /tmp directory of the device using scp. Default IP address is 192.168.1.20 and default username and password are "ubnt". SSH to the device and write the bootselect flag to ensure it is booting from the mtd partition the OpenWrt image will be written to. Verify the output device below matches mtd partition "bootselect" using /proc/mtd. > dd if=/dev/zero bs=1 count=1 seek=7 conv=notrunc of=/dev/mtd11 Write the OpenWrt sysupgrade image to the mtd partition labeled "kernel0". Also verify the used partition device using /proc/mtd. > dd if=/tmp/sysupgrade.bin of=/dev/mtdblock12 Reboot the device. Back to stock ------------- Use the TFTP recovery procedure with the Ubiquiti firmware image to restore the vendor firmware. Signed-off-by: Jan Alexander <jan@nalx.net>
* ath79: Add support for OpenMesh OM5PSven Eckelmann2020-12-302-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications: ====================== * Qualcomm/Atheros AR9344 rev 2 * 560/450/225 MHz (CPU/DDR/AHB) * 64 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 2x 10/100 Mbps Ethernet * 2T2R 5 GHz Wi-Fi * 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 2x fast ethernet - eth0 + builtin switch port 1 + used as LAN interface - eth1 + 18-24V passive POE (mode B) + used as WAN interface * 12-24V 1A DC * internal antennas WAN/LAN LEDs appear to be wrong in ar71xx and have been swapped here. Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org> [add LED swap comment] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: Add support for OpenMesh OM2P v2Sven Eckelmann2020-12-302-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications: ====================== * Qualcomm/Atheros AR9330 rev 1 * 400/400/200 MHz (CPU/DDR/AHB) * 64 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 2x 10/100 Mbps Ethernet * 1T1R 2.4 GHz Wi-Fi * 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 2x fast ethernet - eth0 + builtin switch port 1 + used as LAN interface - eth1 + 18-24V passive POE (mode B) + used as WAN interface * 12-24V 1A DC * external antenna Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org>
* ath79: Add support for OpenMesh OM2P-LCSven Eckelmann2020-12-302-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications: ====================== * Qualcomm/Atheros AR9330 rev 1 * 400/400/200 MHz (CPU/DDR/AHB) * 64 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 2x 10/100 Mbps Ethernet * 1T1R 2.4 GHz Wi-Fi * 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 2x fast ethernet - eth0 + builtin switch port 1 + used as LAN interface - eth1 + 18-24V passive POE (mode B) + used as WAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org>
* ath79: add support for OpenMesh OM2P-HS v3Sven Eckelmann2020-12-292-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications: ====================== * Qualcomm/Atheros AR9341 rev 1 * 535/400/200 MHz (CPU/DDR/AHB) * 64 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 2x 10/100 Mbps Ethernet * 2T2R 2.4 GHz Wi-Fi * 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 2x fast ethernet - eth0 + 802.3af POE + builtin switch port 1 + used as LAN interface - eth1 + 18-24V passive POE (mode B) + used as WAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org>
* ath79: add support for OpenMesh OM2P-HS v2Sven Eckelmann2020-12-292-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications: ====================== * Qualcomm/Atheros AR9341 rev 1 * 535/400/200 MHz (CPU/DDR/AHB) * 64 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 2x 10/100 Mbps Ethernet * 2T2R 2.4 GHz Wi-Fi * 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 2x fast ethernet - eth0 + 802.3af POE + builtin switch port 1 + used as LAN interface - eth1 + 18-24V passive POE (mode B) + used as WAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org>
* ath79: add support for OpenMesh OM2P-HS v1Sven Eckelmann2020-12-292-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications: ====================== * Qualcomm/Atheros AR9341 rev 1 * 535/400/200 MHz (CPU/DDR/AHB) * 64 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 2x 10/100 Mbps Ethernet * 2T2R 2.4 GHz Wi-Fi * 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 2x fast ethernet - eth0 + 802.3af POE + builtin switch port 1 + used as LAN interface - eth1 + 18-24V passive POE (mode B) + used as WAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org> [drop redundant status from eth1] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: Add support for OpenMesh OM2P-HS v4Sven Eckelmann2020-12-282-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications: ====================== * Qualcomm/Atheros QCA9533 v2 * 650/600/217 MHz (CPU/DDR/AHB) * 64 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 2x 10/100 Mbps Ethernet * 2T2R 2.4 GHz Wi-Fi * 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 2x fast ethernet - eth0 + 24V passive POE (mode B) + used as WAN interface - eth1 + 802.3af POE + builtin switch port 1 + used as LAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org>
* ath79: Add support for OpenMesh OM2P v4Sven Eckelmann2020-12-282-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications: ====================== * Qualcomm/Atheros QCA9533 v2 * 650/600/217 MHz (CPU/DDR/AHB) * 64 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 2x 10/100 Mbps Ethernet * 1T1R 2.4 GHz Wi-Fi * 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 2x fast ethernet - eth0 + Label: Ethernet 1 + 24V passive POE (mode B) - eth1 + Label: Ethernet 2 + 802.3af POE + builtin switch port 1 * 12-24V 1A DC * external antenna Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org> [wrap two very long lines, fix typo in comment] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ipq40xx: add support for GL.iNet GL-AP1300Dongming Han2020-12-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifications: SOC: Qualcomm IPQ4018 (DAKOTA) ARM Quad-Core RAM: 256 MiB FLASH1: 4 MiB NOR FLASH2: 128 MiB NAND ETH: Qualcomm QCA8075 WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11b/g/n 2x2 WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11n/ac W2 2x2 INPUT: Reset LED: Power, Internet UART1: On board pin header near to LED (3.3V, TX, RX, GND), 3.3V without pin - 115200 8N1 OTHER: On board with BLE module - by cp210x USB serial chip On board hareware watchdog with GPIO0 high to turn on, and GPIO4 for watchdog feed Install via uboot tftp or uboot web failsafe. By uboot tftp: (IPQ40xx) # tftpboot 0x84000000 openwrt-ipq40xx-generic-glinet_gl-ap1300-squashfs-nand-factory.ubi (IPQ40xx) # run lf By uboot web failsafe: Push the reset button for 10 seconds util the power led flash faster, then use broswer to access http://192.168.1.1 Afterwards upgrade can use sysupgrade image. Signed-off-by: Dongming Han <handongming@gl-inet.com>
* ath79: add support for Senao Engenius EAP350 v1Michael Pratt2020-12-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FCC ID: U2M-EAP350 Engenius EAP350 is a wireless access point with 1 gigabit PoE ethernet port, 2.4 GHz wireless, external ethernet switch, and 2 internal antennas. Specification: - AR7242 SOC - AR9283 WLAN (2.4 GHz, 2x2, PCIe on-board) - AR8035-A switch (GbE with 802.3af PoE) - 40 MHz reference clock - 8 MB FLASH MX25L6406E - 32 MB RAM EM6AA160TSA-5G - UART at J2 (populated) - 3 LEDs, 1 button (power, eth, 2.4 GHz) (reset) - 2 internal antennas MAC addresses: MAC address is labeled as "MAC" Only 1 address on label and in flash The OEM software reports these MACs for the ifconfig eth0 MAC *:0c art 0x0 phy0 --- *:0d --- Installation: 2 ways to flash factory.bin from OEM: - if you get Failsafe Mode from failed flash: only use it to flash Original firmware from Engenius or risk kernel loop or halt which requires serial cable Method 1: Firmware upgrade page: OEM webpage at 192.168.10.1 username and password "admin" Navigate to "Upgrade Firmware" page from left pane Click Browse and select the factory.bin image Upload and verify checksum Click Continue to confirm and wait 3 minutes Method 2: Serial to load Failsafe webpage: After connecting to serial console and rebooting... Interrupt uboot with any key pressed rapidly execute `run failsafe_boot` OR `bootm 0x9f670000` wait a minute connect to ethernet and navigate to "192.168.1.1/index.htm" Select the factory.bin image and upload wait about 3 minutes Return to OEM: If you have a serial cable, see Serial Failsafe instructions otherwise, uboot-env can be used to make uboot load the failsafe image *DISCLAIMER* The Failsafe image is unique to Engenius boards. If the failsafe image is missing or damaged this will not work DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt ssh into openwrt and run `fw_setenv rootfs_checksum 0` reboot, wait 3 minutes connect to ethernet and navigate to 192.168.1.1/index.htm select OEM firmware image from Engenius and click upgrade Format of OEM firmware image: The OEM software of EAP350 is a heavily modified version of Openwrt Kamikaze. One of the many modifications is to the sysupgrade program. Image verification is performed simply by the successful ungzip and untar of the supplied file and name check and header verification of the resulting contents. To form a factory.bin that is accepted by OEM Openwrt build, the kernel and rootfs must have specific names... openwrt-senao-eap350-uImage-lzma.bin openwrt-senao-eap350-root.squashfs and begin with the respective headers (uImage, squashfs). Then the files must be tarballed and gzipped. The resulting binary is actually a tar.gz file in disguise. This can be verified by using binwalk on the OEM firmware images, ungzipping then untaring. The OEM upgrade script is at /etc/fwupgrade.sh Later models in the EAP series likely have a different platform and the upgrade and image verification process differs. OKLI kernel loader is required because the OEM software expects the kernel to be no greater than 1024k and the factory.bin upgrade procedure would overwrite part of the kernel when writing rootfs. Note on PLL-data cells: The default PLL register values will not work because of the external AR8035-A switch between the SOC and the ethernet PHY chips. For AR724x series, the PLL register for GMAC0 can be seen in the DTSI as 0x2c. Therefore the PLL register can be read from uboot for each link speed after attempting tftpboot or another network action using that link speed with `md 0x1805002c 1`. uboot did not have a good value for 1 GBps so it was taken from other similar DTS file. Tested from master, all link speeds functional Signed-off-by: Michael Pratt <mcpratt@pm.me>
* ath79: add support for Senao Engenius EAP600Michael Pratt2020-12-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FCC ID: A8J-EAP600 Engenius EAP600 is a wireless access point with 1 gigabit ethernet port, dual-band wireless, external ethernet switch, 4 internal antennas and 802.3af PoE. Specification: - AR9344 SOC (5 GHz, 2x2, WMAC) - AR9382 WLAN (2.4 GHz, 2x2, PCIe on-board) - AR8035-A switch (GbE with 802.3af PoE) - 40 MHz reference clock - 16 MB FLASH MX25L12845EMI-10G - 2x 64 MB RAM NT5TU32M16DG - UART at H1 (populated) - 5 LEDs, 1 button (power, eth, 2.4 GHz, 5 GHz, wps) (reset) - 4 internal antennas MAC addresses: MAC addresses are labeled MAC1 and MAC2 The MAC address in flash is not on the label The OEM software reports these MACs for the ifconfig eth0 MAC 1 *:5e --- phy1 MAC 2 *:5f --- (2.4 GHz) phy0 ----- *:60 art 0x0 (5 GHz) Installation: 2 ways to flash factory.bin from OEM: - if you get Failsafe Mode from failed flash: only use it to flash Original firmware from Engenius or risk kernel loop or halt which requires serial cable Method 1: Firmware upgrade page: OEM webpage at 192.168.1.1 username and password "admin" Navigate to "Upgrade Firmware" page from left pane Click Browse and select the factory.bin image Upload and verify checksum Click Continue to confirm and wait 3 minutes Method 2: Serial to load Failsafe webpage: After connecting to serial console and rebooting... Interrupt uboot with any key pressed rapidly execute `run failsafe_boot` OR `bootm 0x9fdf0000` wait a minute connect to ethernet and navigate to "192.168.1.1/index.htm" Select the factory.bin image and upload wait about 3 minutes Return to OEM: If you have a serial cable, see Serial Failsafe instructions otherwise, uboot-env can be used to make uboot load the failsafe image *DISCLAIMER* The Failsafe image is unique to Engenius boards. If the failsafe image is missing or damaged this will not work DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt ssh into openwrt and run `fw_setenv rootfs_checksum 0` reboot, wait 3 minutes connect to ethernet and navigate to 192.168.1.1/index.htm select OEM firmware image from Engenius and click upgrade Format of OEM firmware image: The OEM software of EAP600 is a heavily modified version of Openwrt Kamikaze. One of the many modifications is to the sysupgrade program. Image verification is performed simply by the successful ungzip and untar of the supplied file and name check and header verification of the resulting contents. To form a factory.bin that is accepted by OEM Openwrt build, the kernel and rootfs must have specific names... openwrt-senao-eap600-uImage-lzma.bin openwrt-senao-eap600-root.squashfs and begin with the respective headers (uImage, squashfs). Then the files must be tarballed and gzipped. The resulting binary is actually a tar.gz file in disguise. This can be verified by using binwalk on the OEM firmware images, ungzipping then untaring. The OEM upgrade script is at /etc/fwupgrade.sh Later models in the EAP series likely have a different platform and the upgrade and image verification process differs. OKLI kernel loader is required because the OEM software expects the kernel to be no greater than 1536k and the factory.bin upgrade procedure would overwrite part of the kernel when writing rootfs. Note on PLL-data cells: The default PLL register values will not work because of the external AR8035-A switch between the SOC and the ethernet PHY chips. For AR934x series, the PLL register for GMAC0 can be seen in the DTSI as 0x2c. Therefore the PLL register can be read from uboot for each link speed after attempting tftpboot or another network action using that link speed with `md 0x1805002c 1`. Unfortunately uboot did not have the best values so they were taken from other similar DTS files. Tested from master, all link speeds functional Signed-off-by: Michael Pratt <mcpratt@pm.me>
* ath79: add support for Senao Engenius ECB600Michael Pratt2020-12-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FCC ID: A8J-ECB600 Engenius ECB600 is a wireless access point with 1 gigabit PoE ethernet port, dual-band wireless, external ethernet switch, and 4 external antennas. Specification: - AR9344 SOC (5 GHz, 2x2, WMAC) - AR9382 WLAN (2.4 GHz, 2x2, PCIe on-board) - AR8035-A switch (GbE with 802.3af PoE) - 40 MHz reference clock - 16 MB FLASH MX25L12845EMI-10G - 2x 64 MB RAM NT5TU32M16DG - UART at H1 (populated) - 4 LEDs, 1 button (power, eth, 2.4 GHz, 5 GHz) (reset) - 4 external antennas MAC addresses: MAC addresses are labeled MAC1 and MAC2 The MAC address in flash is not on the label The OEM software reports these MACs for the ifconfig phy1 MAC 1 *:52 --- (2.4 GHz) phy0 MAC 2 *:53 --- (5 GHz) eth0 ----- *:54 art 0x0 Installation: 2 ways to flash factory.bin from OEM: - if you get Failsafe Mode from failed flash: only use it to flash Original firmware from Engenius or risk kernel loop or halt which requires serial cable Method 1: Firmware upgrade page: OEM webpage at 192.168.1.1 username and password "admin" Navigate to "Upgrade Firmware" page from left pane Click Browse and select the factory.bin image Upload and verify checksum Click Continue to confirm and wait 3 minutes Method 2: Serial to load Failsafe webpage: After connecting to serial console and rebooting... Interrupt uboot with any key pressed rapidly execute `run failsafe_boot` OR `bootm 0x9fdf0000` wait a minute connect to ethernet and navigate to "192.168.1.1/index.htm" Select the factory.bin image and upload wait about 3 minutes Return to OEM: If you have a serial cable, see Serial Failsafe instructions otherwise, uboot-env can be used to make uboot load the failsafe image *DISCLAIMER* The Failsafe image is unique to Engenius boards. If the failsafe image is missing or damaged this will not work DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt ssh into openwrt and run `fw_setenv rootfs_checksum 0` reboot, wait 3 minutes connect to ethernet and navigate to 192.168.1.1/index.htm select OEM firmware image from Engenius and click upgrade Format of OEM firmware image: The OEM software of ECB600 is a heavily modified version of Openwrt Kamikaze. One of the many modifications is to the sysupgrade program. Image verification is performed simply by the successful ungzip and untar of the supplied file and name check and header verification of the resulting contents. To form a factory.bin that is accepted by OEM Openwrt build, the kernel and rootfs must have specific names... openwrt-senao-ecb600-uImage-lzma.bin openwrt-senao-ecb600-root.squashfs and begin with the respective headers (uImage, squashfs). Then the files must be tarballed and gzipped. The resulting binary is actually a tar.gz file in disguise. This can be verified by using binwalk on the OEM firmware images, ungzipping then untaring. The OEM upgrade script is at /etc/fwupgrade.sh Later models in the ECB series likely have a different platform and the upgrade and image verification process differs. OKLI kernel loader is required because the OEM software expects the kernel to be no greater than 1536k and the factory.bin upgrade procedure would overwrite part of the kernel when writing rootfs. Note on PLL-data cells: The default PLL register values will not work because of the external AR8035-A switch between the SOC and the ethernet PHY chips. For AR934x series, the PLL register for GMAC0 can be seen in the DTSI as 0x2c. Therefore the PLL register can be read from uboot for each link speed after attempting tftpboot or another network action using that link speed with `md 0x1805002c 1`. Unfortunately uboot did not have the best values so they were taken from other similar DTS files. Tested from master, all link speeds functional Signed-off-by: Michael Pratt <mcpratt@pm.me>
* ipq40xx: add support for devolo Magic 2 WiFi nextStefan Schake2020-12-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SOC: IPQ4018 / QCA Dakota CPU: Quad-Core ARMv7 Processor rev 5 (v71) Cortex-A7 DRAM: 256 MiB NOR: 32 MiB ETH: Qualcomm Atheros QCA8075 (2 ports) PLC: MaxLinear G.hn 88LX5152 WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2 WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2 INPUT: RESET, WiFi, PLC Button LEDS: red/white home, white WiFi To modify a retail device to run OpenWRT firmware: 1) Setup a TFTP server on IP address 192.168.0.100 and copy the OpenWRT initramfs (initramfs-fit-uImage.itb) to the TFTP root as 'uploadfile'. 2) Power on the device while pressing the recessed reset button next to the Ethernet ports. This causes the bootloader to retrieve and start the initramfs. 3) Once the initramfs is booted, the device will come up with IP 192.168.1.1. You can then connect through SSH (allow some time for the first connection). 4) On the device shell, run 'fw_printenv' to show the U-boot environment. Backup this information since it contains device unique factory data. 5) Change the boot command to support booting OpenWRT: # fw_setenv bootcmd 'sf probe && sf read 0x84000000 0x180000 0x400000 && bootm' 6) Change directory to /tmp, download the sysupgrade (e.g. through wget) and install it with sysupgrade. The device will reboot into OpenWRT. Notice that there is currently no support for booting the G.hn chip. This requires userland software we lack the rights to share right now. Signed-off-by: Stefan Schake <stefan.schake@devolo.de>
* ath79: add support for Senao Engenius EnStationAC v1Michael Pratt2020-12-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FCC ID: A8J-ENSTAC Engenius EnStationAC v1 is an outdoor wireless access point/bridge with 2 gigabit ethernet ports on 2 external ethernet switches, 5 GHz only wireless, internal antenna plates, and proprietery PoE. Specification: - QCA9557 SOC - QCA9882 WLAN (PCI card, 5 GHz, 2x2, 26dBm) - AR8035-A switch (RGMII GbE with PoE+ IN) - AR8031 switch (SGMII GbE with PoE OUT) - 40 MHz reference clock - 16 MB FLASH MX25L12845EMI-10G - 2x 64 MB RAM NT5TU32M16FG - UART at J10 (unpopulated) - internal antenna plates (19 dbi, directional) - 7 LEDs, 1 button (power, eth, wlan, RSSI) (reset) MAC addresses: MAC addresses are labeled as ETH and 5GHz Vendor MAC addresses in flash are duplicate eth0 ETH *:d3 art 0x0/0x6 eth1 ---- *:d4 --- phy0 5GHz *:d5 --- Installation: 2 ways to flash factory.bin from OEM: - if you get Failsafe Mode from failed flash: only use it to flash Original firmware from Engenius or risk kernel loop or halt which requires serial cable Method 1: Firmware upgrade page: OEM webpage at 192.168.1.1 username and password "admin" Navigate to "Firmware" page from left pane Click Browse and select the factory.bin image Upload and verify checksum Click Continue to confirm and wait 3 minutes Method 2: Serial to load Failsafe webpage: After connecting to serial console and rebooting... Interrupt uboot with any key pressed rapidly execute `run failsafe_boot` OR `bootm 0x9fd70000` wait a minute connect to ethernet and navigate to "192.168.1.1/index.htm" Select the factory.bin image and upload wait about 3 minutes Return to OEM: If you have a serial cable, see Serial Failsafe instructions otherwise, uboot-env can be used to make uboot load the failsafe image *DISCLAIMER* The Failsafe image is unique to Engenius boards. If the failsafe image is missing or damaged this will not work DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt ssh into openwrt and run `fw_setenv rootfs_checksum 0` reboot, wait 3 minutes connect to ethernet and navigate to 192.168.1.1/index.htm select OEM firmware image from Engenius and click upgrade TFTP recovery: rename initramfs to 'vmlinux-art-ramdisk' make available on TFTP server at 192.168.1.101 power board hold or press reset button repeatedly NOTE: for some Engenius boards TFTP is not reliable try setting MTU to 600 and try many times Format of OEM firmware image: The OEM software of EnStationAC is a heavily modified version of Openwrt Altitude Adjustment 12.09. One of the many modifications is to the sysupgrade program. Image verification is performed simply by the successful ungzip and untar of the supplied file and name check and header verification of the resulting contents. To form a factory.bin that is accepted by OEM Openwrt build, the kernel and rootfs must have specific names... openwrt-ar71xx-enstationac-uImage-lzma.bin openwrt-ar71xx-enstationac-root.squashfs and begin with the respective headers (uImage, squashfs). Then the files must be tarballed and gzipped. The resulting binary is actually a tar.gz file in disguise. This can be verified by using binwalk on the OEM firmware images, ungzipping then untaring. Newer EnGenius software requires more checks but their script includes a way to skip them, otherwise the tar must include a text file with the version and md5sums in a deprecated format. The OEM upgrade script is at /etc/fwupgrade.sh. OKLI kernel loader is required because the OEM software expects the kernel to be no greater than 1536k and the factory.bin upgrade procedure would otherwise overwrite part of the kernel when writing rootfs. Note on PLL-data cells: The default PLL register values will not work because of the external AR8033 switch between the SOC and the ethernet PHY chips. For QCA955x series, the PLL registers for eth0 and eth1 can be see in the DTSI as 0x28 and 0x48 respectively. Therefore the PLL registers can be read from uboot for each link speed after attempting tftpboot or another network action using that link speed with `md 0x18050028 1` and `md 0x18050048 1`. For eth0 at 1000 speed, the value returned was ae000000 but that didn't work, so following the logical pattern from the rest of the values, the guessed value of a3000000 works better. later discovered that delay can be placed on the PHY end only with phy-mode as 'rgmii-id' and set register to 0x82... Tested from master, all link speeds functional Signed-off-by: Michael Pratt <mcpratt@pm.me> [fixed SoB to match From:] Signed-off-by: Petr Štetiar <ynezz@true.cz>
* ipq40xx: add support for Plasma Cloud PA2200Marek Lindner2020-12-221-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications: * QCA IPQ4019 * 256 MB of RAM * 32 MB of SPI NOR flash (w25q256) - 2x 15 MB available; but one of the 15 MB regions is the recovery image * 2T2R 2.4 GHz - QCA4019 hw1.0 (SoC) - requires special BDF in QCA4019/hw1.0/board-2.bin with bus=ahb,bmi-chip-id=0,bmi-board-id=20,variant=PlasmaCloud-PA2200 * 2T2R 5 GHz (channel 36-64) - QCA9888 hw2.0 (PCI) - requires special BDF in QCA9888/hw2.0/board-2.bin bus=pci,bmi-chip-id=0,bmi-board-id=16,variant=PlasmaCloud-PA2200 * 2T2R 5 GHz (channel 100-165) - QCA4019 hw1.0 (SoC) - requires special BDF in QCA4019/hw1.0/board-2.bin with bus=ahb,bmi-chip-id=0,bmi-board-id=21,variant=PlasmaCloud-PA2200 * GPIO-LEDs for 2.4GHz, 5GHz-SoC and 5GHz-PCIE * GPIO-LEDs for power (orange) and status (blue) * 1x GPIO-button (reset) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 2x gigabit ethernet - phy@mdio3: + Label: Ethernet 1 + gmac0 (ethaddr) in original firmware + used as LAN interface - phy@mdio4: + Label: Ethernet 2 + gmac1 (eth1addr) in original firmware + 802.3at POE+ + used as WAN interface * 12V 2A DC Flashing instructions: The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the factory image to the u-boot when the device boots up. Signed-off-by: Marek Lindner <marek.lindner@kaiwoo.ai> [sven@narfation.org: prepare commit message, rebase, use all LEDs, switch to dualboot_datachk upgrade script, use eth1 as designated WAN interface] Signed-off-by: Sven Eckelmann <sven@narfation.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-17 02:09:04 +0000