aboutsummaryrefslogtreecommitdiffstats
path: root/package/boot
Commit message (Collapse)AuthorAgeFilesLines
* uboot-fritz4040: build FritzBox 7520 variantAndre Heider2022-10-201-1/+6
| | | | | | | | | | | | Support was added as variant of 7530 (DEVICE_ALT0_*) in: cb6f4be1 "ipq40xx: add support for FRITZ!Box 7520" u-boot has a distinct config for it [0], built it. [0] https://github.com/chunkeey/FritzBox-4040-UBOOT/pull/6 Signed-off-by: Andre Heider <a.heider@gmail.com> Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
* arm-trusted-firmware-sunxi: add package CPE IDPetr Štetiar2022-10-191-0/+1
| | | | | | | | Common Platform Enumeration (CPE) is a structured naming scheme for information technology systems, software, and packages. Suggested-by: Steffen Pfendtner <s.pfendtner@ads-tec.de> Signed-off-by: Petr Štetiar <ynezz@true.cz>
* uboot-envtools: mediatek/mt7622: don't rely on mapped rootfsDaniel Golle2022-10-191-6/+3
| | | | | | | | Similar to the implementation for the BPi-R3 use the same logic also for determining the device to look for the U-Boot environment of the BPi-R64. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-envtools: mediatek_filogic: fix BPi-R3 when no OS is installedDaniel Golle2022-10-181-7/+4
| | | | | | | | | | Fix accessing the environment in case no OS is installed on the flash media selected for boot as this is possible when booting initramfs. In case of relying on the device specified to be mounted as rootfs to be present, rather just use the kernel cmdline 'root' variable as a hint to decide where to read/write the U-Boot environment. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-mediatek: update to U-Boot 2022.10Daniel Golle2022-10-1868-8705/+73
| | | | | | | | | Remove patches adding support for MT7621 which have been merged upsteam. Patches for MT7981 and MT7986 have been merged too, but not in time to be included in the 2022.10 release, so we have to keep carrying them until the 2023.01 release. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* arm-trusted-firmware-mvebu: add Methode eDPU supportRobert Marko2022-10-171-1/+12
| | | | | | | Provide ATF support for Methode eDPU as well, this makes it easy for OpenWrt users to update the included U-boot+ATF combo. Signed-off-by: Robert Marko <robert.marko@sartura.hr>
* uboot-mvebu: add Methode eDPU supportRobert Marko2022-10-171-1/+7
| | | | | | | Add support for building for Methode eDPU board, no patches are needed as board has been upstreamed and is part of the 2022.10-rc releases. Signed-off-by: Robert Marko <robert.marko@sartura.hr>
* uboot-mvebu: update to 2022.10Robert Marko2022-10-174-101/+2
| | | | | | | | | | | | Update mvebu U-boot to 2022.10 to avoid backporting patches in order to support Methode eDPU. It also allows dropping existing patches as they are all backports. Tested-by: Andre Heider <a.heider@gmail.com> # espressobin-v3-v5-1gb-2cs Tested-by: Russell Morris <github@rkmorris.us> # espressobin-v3-v5-1gb-1cs Tested-by: Josef Schlehofer <pepe.schlehofer@gmail.com> [Turris Omnia] Signed-off-by: Robert Marko <robert.marko@sartura.hr>
* uboot-mediatek: fixes defconfig typo for UniFi 6 LRChukun Pan2022-10-111-1/+1
| | | | | | | CONFIG_CMD_MTDPART does not exist, fix it. Fixes: e9ad412 ("uboot-mediatek: add build for Ubiquiti Networks UniFi 6 LR") Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
* uboot-mediatek: fixes defconfig typo for Linksys E8450Chukun Pan2022-10-111-1/+1
| | | | | | | CONFIG_CMD_MTDPART does not exist, fix it. Fixes: ed50004 ("uboot-mediatek: add support for Linksys E8450") Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
* uboot-mvebu: backport LibreSSL patches for older version of LibreSSLJosef Schlehofer2022-10-022-0/+55
| | | | | | | | | | | | | If you would like to compile the newest version of U-boot together with the stable OpenWrt version, which does not have LibreSSL >= 3.5, which was updated in the master branch by commit 5451b03b7ceb2315445c683fe174e28bbdd49c2f ("tools/libressl: bump to v3.5.3"), then you need these two patches to fix it. They are backported from U-boot repository. This should be backported to stable OpenWrt versions. Reported-by: Michal Vasilek <michal.vasilek@nic.cz> Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* uboot-mvebu: backport patch to fix compilation on non glibc systemJosef Schlehofer2022-10-021-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | This issue was reported by @paper42, who is using Void Linux with musl to compile OpenWrt and its packages and found out it is not possible to compile U-boot for Turris Omnia (neither any other). It fixes following output: ``` HOSTCC tools/kwboot tools/kwboot.c: In function 'kwboot_tty_change_baudrate': tools/kwboot.c:662:6: error: 'struct termios' has no member named 'c_ospeed' 662 | tio.c_ospeed = tio.c_ispeed = baudrate; | ^ tools/kwboot.c:662:21: error: 'struct termios' has no member named 'c_ispeed' 662 | tio.c_ospeed = tio.c_ispeed = baudrate; | ^ tools/kwboot.c:690:31: error: 'struct termios' has no member named 'c_ospeed' 690 | if (!_is_within_tolerance(tio.c_ospeed, baudrate, 3)) | ^ tools/kwboot.c:693:31: error: 'struct termios' has no member named 'c_ispeed' 693 | if (!_is_within_tolerance(tio.c_ispeed, baudrate, 3)) | ``` Tested-by: Michal Vasilek <michal.vasilek@nic.cz> Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* arm-trusted-firmware-mvebu: stop cluttering Image BuilderTomasz Maciej Nowak2022-09-211-21/+20
| | | | | | | | | | | | | | All contents of staging_dir/image are included in Image Builder (IB) in case some binary needs to be included in final image. But in case of this package, all sources are stored there and those clutter the final tarball of IB for no reason. Those sources are not used during image creation and are just dead weight. To put it in perspective, the IB for 21.02.0 is 158 MiB, 22.03.0-rc6 is 366 MiB and snapshot is over 620 MiB! To fix it, put them in package build directory, so they won't end up included in IB tarball. Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com> Reviewed-by: Andre Heider <a.heider@gmail.com>
* realtek: add support for TP-Link SG2210PAlexandru Gagniuc2022-09-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for the TP-Link SG2210P switch. This is an RTL8380 based switch with eight RJ-45 ports with 802.3af PoE, and two SFP ports. This device shares the same board with the SG2008P and SG2008. To model this, declare all the capabilities in the sg2xxx dtsi, and disable unpopulated on the lower end models. Specifications: --------------- - SoC: Realtek RTL8380M - Flash: 32 MiB SPI flash (Vendor varies) - RAM: 256 MiB (Vendor varies) - Ethernet: 8x 10/100/1000 Mbps with PoE (all ports) 2x SFP ports - Buttons: 1x "Reset" button on front panel - Power: 53.5V DC barrel jack - UART: 1x serial header, unpopulated - PoE: 2x TI TPS23861 I2C PoE controller Works: ------ - (8) RJ-45 ethernet ports - (2) SFP ports (with caveats) - Switch functions - System LED Not yet enabled: ---------------- - Power-over-Ethernet (driver works, but doesn't enable "auto" mode) - PoE LEDs Enabling SFP ports: ------------------- The SFP port control lines are hardwired, except for tx-disable. These lines are controller by the RTL8231 in shift register mode. There is no driver support for this yet. However, to enable the lasers on SFP1 and SFP2 respectively: echo 0x0510ff00 > /sys/kernel/debug/rtl838x/led/led_p_en_ctrl echo 0x140 > /sys/kernel/debug/rtl838x/led/led_sw_p_ctrl.26 echo 0x140 > /sys/kernel/debug/rtl838x/led/led_sw_p_ctrl.24 Install via serial console/tftp: -------------------------------- The footprints R27 (0201) and R28 (0402) are not populated. To enable serial console, 50 ohm resistors should be soldered -- any value from 0 ohm to 50 ohm will work. R27 can be replaced by a solder bridge. The u-boot firmware drops to a TP-Link specific "BOOTUTIL" shell at 38400 baud. There is no known way to exit out of this shell, and no way to do anything useful. Ideally, one would trick the bootloader into flashing the sysupgrade image first. However, if the image exceeds 6MiB in size, it will not work. The sysupgrade image can also be flashed. To install OpenWrt: Prepare a tftp server with: 1. server address: 192.168.0.146 2. the image as: "uImage.img" Power on device, and stop boot by pressing any key. Once the shell is active: 1. Ground out the CLK (pin 16) of the ROM (U7) 2. Select option "3. Start" 3. Bootloader notes that "The kernel has been damaged!" 4. Release CLK as sson as bootloader thinks image is corrupted. 5. Bootloader enters automatic recovery -- details printed on console 6. Watch as the bootloader flashes and boots OpenWrt. Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com> [OpenWrt capitalisation in commit message] Signed-off-by: Sander Vanheule <sander@svanheule.net>
* uboot-mediatek: fix extraneous right parensPetr Štetiar2022-09-131-1/+1
| | | | | | | | Fixes following warning: Makefile:310: extraneous text after 'ifeq' directive Signed-off-by: Petr Štetiar <ynezz@true.cz>
* mediatek: add support for ipTIME A6004MX Add basic support for ipTIME A6004MX.Yoonji Park2022-09-121-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | Hardware: SoC: MediaTek MT7629 Cortex-A7 (ARMv7 1.25GHz, Dual-Core) RAM: DDR3 128MB Flash: Macronix MX35LF1GE4AB (SPI-NAND 128MB) WiFi: MediaTek MT7761N (2.4GHz) / MediaTek MT7762N (5GHz) - no driver Ethernet: SoC (WAN) / MediaTek MT7531 (LAN x4) UART: [GND, RX, TX, 3.3V] (115200) Installation: - Flash recovery image with TFTP recovery Revert to stock firmware: - Flash stock firmware with TFTP recovery TFTP Recovery method: 1. Unplug the router 2. Hold the reset button and plug in 3. Release when the power LED stops flashing and go off 4. Set your computer IP address manually to 192.168.0.x / 255.255.255.0 5. Flash image with TFTP client to 192.168.0.1 Signed-off-by: Yoonji Park <koreapyj@dcmys.kr>
* ath79: add support for Senao Watchguard AP100Michael Pratt2022-09-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FCC ID: U2M-CAP2100AG WatchGuard AP100 is an indoor wireless access point with 1 Gb ethernet port, dual-band but single-radio wireless, internal antenna plates, and 802.3at PoE+ this board is a Senao device: the hardware is equivalent to EnGenius EAP300 v2 the software is modified Senao SDK which is based on openwrt and uboot including image checksum verification at boot time, and a failsafe image that boots if checksum fails **Specification:** - AR9344 SOC MIPS 74kc, 2.4 GHz AND 5 GHz WMAC, 2x2 - AR8035-A EPHY RGMII GbE with PoE+ IN - 25 MHz clock - 16 MB FLASH mx25l12805d - 2x 64 MB RAM - UART console J11, populated - GPIO watchdog GPIO 16, 20 sec toggle - 2 antennas 5 dBi, internal omni-directional plates - 5 LEDs power, eth0 link/data, 2G, 5G - 1 button reset **MAC addresses:** Label has no MAC Only one Vendor MAC address in flash at art 0x0 eth0 ---- *:e5 art 0x0 -2 phy0 ---- *:e5 art 0x0 -2 **Installation:** Method 1: OEM webpage use OEM webpage for firmware upgrade to upload factory.bin Method 2: root shell It may be necessary to use a Watchguard router to flash the image to the AP and / or to downgrade the software on the AP to access SSH For some Watchguard devices, serial console over UART is disabled. NOTE: DHCP is not enabled by default after flashing **TFTP recovery:** reset button has no function at boot time only possible with modified uboot environment, (see commit message for Watchguard AP300) **Return to OEM:** user should make backup of MTD partitions and write the backups back to mtd devices in order to revert to OEM reliably It may be possible to use sysupgrade with an OEM image as well... (not tested) **OEM upgrade info:** The OEM upgrade script is at /etc/fwupgrade.sh OKLI kernel loader is required because the OEM software expects the kernel to be no greater than 1536k and the factory.bin upgrade procedure would otherwise overwrite part of the kernel when writing rootfs. **Note on eth0 PLL-data:** The default Ethernet Configuration register values will not work because of the external AR8035 switch between the SOC and the ethernet port. For AR934x series, the PLL registers for eth0 can be see in the DTSI as 0x2c. Therefore the PLL registers can be read from uboot for each link speed after attempting tftpboot or another network action using that link speed with `md 0x1805002c 1`. The clock delay required for RGMII can be applied at the PHY side, using the at803x driver `phy-mode`. Therefore the PLL registers for GMAC0 do not need the bits for delay on the MAC side. This is possible due to fixes in at803x driver since Linux 5.1 and 5.3 **Note on WatchGuard Magic string:** The OEM upgrade script is a modified version of the generic Senao sysupgrade script which is used on EnGenius devices. On WatchGuard boards produced by Senao, images are verified using a md5sum checksum of the upgrade image concatenated with a magic string. this checksum is then appended to the end of the final image. This variable does not apply to all the senao devices so set to null string as default Tested-by: Steve Wheeler <stephenw10@gmail.com> Signed-off-by: Michael Pratt <mcpratt@pm.me>
* ath79: add support for Senao WatchGuard AP200Michael Pratt2022-09-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FCC ID: U2M-CAP4200AG WatchGuard AP200 is an indoor wireless access point with 1 Gb ethernet port, dual-band wireless, internal antenna plates, and 802.3at PoE+ this board is a Senao device: the hardware is equivalent to EnGenius EAP600 the software is modified Senao SDK which is based on openwrt and uboot including image checksum verification at boot time, and a failsafe image that boots if checksum fails **Specification:** - AR9344 SOC MIPS 74kc, 2.4 GHz WMAC, 2x2 - AR9382 WLAN PCI card 168c:0030, 5 GHz, 2x2, 26dBm - AR8035-A EPHY RGMII GbE with PoE+ IN - 25 MHz clock - 16 MB FLASH mx25l12805d - 2x 64 MB RAM - UART console J11, populated - GPIO watchdog GPIO 16, 20 sec toggle - 4 antennas 5 dBi, internal omni-directional plates - 5 LEDs power, eth0 link/data, 2G, 5G - 1 button reset **MAC addresses:** Label has no MAC Only one Vendor MAC address in flash at art 0x0 eth0 ---- *:be art 0x0 -2 phy1 ---- *:bf art 0x0 -1 phy0 ---- *:be art 0x0 -2 **Installation:** Method 1: OEM webpage use OEM webpage for firmware upgrade to upload factory.bin Method 2: root shell It may be necessary to use a Watchguard router to flash the image to the AP and / or to downgrade the software on the AP to access SSH For some Watchguard devices, serial console over UART is disabled. NOTE: DHCP is not enabled by default after flashing **TFTP recovery:** reset button has no function at boot time only possible with modified uboot environment, (see commit message for Watchguard AP300) **Return to OEM:** user should make backup of MTD partitions and write the backups back to mtd devices in order to revert to OEM reliably It may be possible to use sysupgrade with an OEM image as well... (not tested) **OEM upgrade info:** The OEM upgrade script is at /etc/fwupgrade.sh OKLI kernel loader is required because the OEM software expects the kernel to be no greater than 1536k and the factory.bin upgrade procedure would otherwise overwrite part of the kernel when writing rootfs. **Note on eth0 PLL-data:** The default Ethernet Configuration register values will not work because of the external AR8035 switch between the SOC and the ethernet port. For AR934x series, the PLL registers for eth0 can be see in the DTSI as 0x2c. Therefore the PLL registers can be read from uboot for each link speed after attempting tftpboot or another network action using that link speed with `md 0x1805002c 1`. The clock delay required for RGMII can be applied at the PHY side, using the at803x driver `phy-mode`. Therefore the PLL registers for GMAC0 do not need the bits for delay on the MAC side. This is possible due to fixes in at803x driver since Linux 5.1 and 5.3 **Note on WatchGuard Magic string:** The OEM upgrade script is a modified version of the generic Senao sysupgrade script which is used on EnGenius devices. On WatchGuard boards produced by Senao, images are verified using a md5sum checksum of the upgrade image concatenated with a magic string. this checksum is then appended to the end of the final image. This variable does not apply to all the senao devices so set to null string as default Tested-by: Steve Wheeler <stephenw10@gmail.com> Tested-by: John Delaney <johnd@ankco.net> Signed-off-by: Michael Pratt <mcpratt@pm.me>
* ath79: add support for Senao WatchGuard AP300Michael Pratt2022-09-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FCC ID: Q6G-AP300 WatchGuard AP300 is an indoor wireless access point with 1 Gb ethernet port, dual-band wireless, internal antenna plates, and 802.3at PoE+ this board is a Senao device: the hardware is equivalent to EnGenius EAP1750 the software is modified Senao SDK which is based on openwrt and uboot including image checksum verification at boot time, and a failsafe image that boots if checksum fails **Specification:** - QCA9558 SOC MIPS 74kc, 2.4 GHz WMAC, 3x3 - QCA9880 WLAN PCI card 168c:003c, 5 GHz, 3x3, 26dBm - AR8035-A PHY RGMII GbE with PoE+ IN - 40 MHz clock - 32 MB FLASH S25FL512S - 2x 64 MB RAM NT5TU32M16 - UART console J10, populated - GPIO watchdog GPIO 16, 20 sec toggle - 6 antennas 5 dBi, internal omni-directional plates - 5 LEDs power, eth0 link/data, 2G, 5G - 1 button reset **MAC addresses:** MAC address labeled as ETH Only one Vendor MAC address in flash at art 0x0 eth0 ETH *:3c art 0x0 phy1 ---- *:3d --- phy0 ---- *:3e --- **Serial console access:** For this board, its not certain whether UART is possible it is likely that software is blocking console access the RX line on the board for UART is shorted to ground by resistor R176 the resistors R175 and R176 are next to the UART RX pin at J10 however console output is garbage even after this fix **Installation:** Method 1: OEM webpage use OEM webpage for firmware upgrade to upload factory.bin Method 2: root shell access downgrade XTM firewall to v2.0.0.1 downgrade AP300 firmware: v1.0.1 remove / unpair AP from controller perform factory reset with reset button connect ethernet to a computer login to OEM webpage with default address / pass: wgwap enable SSHD in OEM webpage settings access root shell with SSH as user 'root' modify uboot environment to automatically try TFTP at boot time (see command below) rename initramfs-kernel.bin to test.bin load test.bin over TFTP (see TFTP recovery) (optionally backup all mtdblocks to have flash backup) perform a sysupgrade with sysupgrade.bin NOTE: DHCP is not enabled by default after flashing **TFTP recovery:** server ip: 192.168.1.101 reset button seems to do nothing at boot time... only possible with modified uboot environment, running this command in the root shell: fw_setenv bootcmd 'if ping 192.168.1.101; then tftp 0x82000000 test.bin && bootm 0x82000000; else bootm 0x9f0a0000; fi' and verify that it is correct with fw_printenv then, before boot, the device will attempt TFTP from 192.168.1.101 looking for file 'test.bin' to return uboot environment to normal: fw_setenv bootcmd 'bootm 0x9f0a0000' **Return to OEM:** user should make backup of MTD partitions and write the backups back to mtd devices in order to revert to OEM (see installation method 2) It may be possible to use sysupgrade with an OEM image as well... (not tested) **OEM upgrade info:** The OEM upgrade script is at /etc/fwupgrade.sh OKLI kernel loader is required because the OEM software expects the kernel to be no greater than 1536k and the factory.bin upgrade procedure would otherwise overwrite part of the kernel when writing rootfs. **Note on eth0 PLL-data:** The default Ethernet Configuration register values will not work because of the external AR8035 switch between the SOC and the ethernet port. For QCA955x series, the PLL registers for eth0 and eth1 can be see in the DTSI as 0x28 and 0x48 respectively. Therefore the PLL registers can be read from uboot for each link speed after attempting tftpboot or another network action using that link speed with `md 0x18050028 1` and `md 0x18050048 1`. The clock delay required for RGMII can be applied at the PHY side, using the at803x driver `phy-mode`. Therefore the PLL registers for GMAC0 do not need the bits for delay on the MAC side. This is possible due to fixes in at803x driver since Linux 5.1 and 5.3 **Note on WatchGuard Magic string:** The OEM upgrade script is a modified version of the generic Senao sysupgrade script which is used on EnGenius devices. On WatchGuard boards produced by Senao, images are verified using a md5sum checksum of the upgrade image concatenated with a magic string. this checksum is then appended to the end of the final image. This variable does not apply to all the senao devices so set to null string as default Tested-by: Alessandro Kornowski <ak@wski.org> Tested-by: John Wagner <john@wagner.us.org> Signed-off-by: Michael Pratt <mcpratt@pm.me>
* ath79: support Ruckus ZoneFlex 7321Lech Perczak2022-09-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ruckus ZoneFlex 7321 is a dual-band, single radio 802.11n 2x2 MIMO enterprise access point. It is very similar to its bigger brother, ZoneFlex 7372. Hardware highligts: - CPU: Atheros AR9342 SoC at 533 MHz - RAM: 64MB DDR2 - Flash: 32MB SPI-NOR - Wi-Fi: AR9342 built-in dual-band 2x2 MIMO radio - Ethernet: single Gigabit Ethernet port through AR8035 gigabit PHY - PoE: input through Gigabit port - Standalone 12V/1A power input - USB: optional single USB 2.0 host port on the 7321-U variant. Serial console: 115200-8-N-1 on internal H1 header. Pinout: H1 ---------- |1|x3|4|5| ---------- Pin 1 is near the "H1" marking. 1 - RX x - no pin 3 - VCC (3.3V) 4 - GND 5 - TX JTAG: Connector H5, unpopulated, similar to MIPS eJTAG, standard, but without the key in pin 12 and not every pin routed: ------- H5 |1 |2 | ------- |3 |4 | ------- |5 |6 | ------- |7 |8 | ------- |9 |10| ------- |11|12| ------- |13|14| ------- 3 - TDI 5 - TDO 7 - TMS 9 - TCK 2,4,6,8,10 - GND 14 - Vref 1,11,12,13 - Not connected Installation: There are two methods of installation: - Using serial console [1] - requires some disassembly, 3.3V USB-Serial adapter, TFTP server, and removing a single T10 screw, but with much less manual steps, and is generally recommended, being safer. - Using stock firmware root shell exploit, SSH and TFTP [2]. Does not work on some rare versions of stock firmware. A more involved, and requires installing `mkenvimage` from u-boot-tools package if you choose to rebuild your own environment, but can be used without disassembly or removal from installation point, if you have the credentials. If for some reason, size of your sysupgrade image exceeds 13312kB, proceed with method [1]. For official images this is not likely to happen ever. [1] Using serial console: 0. Connect serial console to H1 header. Ensure the serial converter does not back-power the board, otherwise it will fail to boot. 1. Power-on the board. Then quickly connect serial converter to PC and hit Ctrl+C in the terminal to break boot sequence. If you're lucky, you'll enter U-boot shell. Then skip to point 3. Connection parameters are 115200-8-N-1. 2. Allow the board to boot. Press the reset button, so the board reboots into U-boot again and go back to point 1. 3. Set the "bootcmd" variable to disable the dual-boot feature of the system and ensure that uImage is loaded. This is critical step, and needs to be done only on initial installation. > setenv bootcmd "bootm 0x9f040000" > saveenv 4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed: > setenv serverip 192.168.1.2 > setenv ipaddr 192.168.1.1 > tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7321-initramfs-kernel.bin > bootm 0x81000000 5. Optional, but highly recommended: back up contents of "firmware" partition: $ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7321_fw1_backup.bin $ ssh root@192.168.1.1 cat /dev/mtd5 > ruckus_zf7321_fw2_backup.bin 6. Copy over sysupgrade image, and perform actual installation. OpenWrt shall boot from flash afterwards: $ ssh root@192.168.1.1 # sysupgrade -n openwrt-ath79-generic-ruckus_zf7321-squashfs-sysupgrade.bin [2] Using stock root shell: 0. Reset the device to factory defaullts. Power-on the device and after it boots, hold the reset button near Ethernet connectors for 5 seconds. 1. Connect the device to the network. It will acquire address over DHCP, so either find its address using list of DHCP leases by looking for label MAC address, or try finding it by scanning for SSH port: $ nmap 10.42.0.0/24 -p22 From now on, we assume your computer has address 10.42.0.1 and the device has address 10.42.0.254. 2. Set up a TFTP server on your computer. We assume that TFTP server root is at /srv/tftp. 3. Obtain root shell. Connect to the device over SSH. The SSHD ond the frmware is pretty ancient and requires enabling HMAC-MD5. $ ssh 10.42.0.254 \ -o UserKnownHostsFile=/dev/null \ -o StrictHostKeyCheking=no \ -o MACs=hmac-md5 Login. User is "super", password is "sp-admin". Now execute a hidden command: Ruckus It is case-sensitive. Copy and paste the following string, including quotes. There will be no output on the console for that. ";/bin/sh;" Hit "enter". The AP will respond with: grrrr OK Now execute another hidden command: !v54! At "What's your chow?" prompt just hit "enter". Congratulations, you should now be dropped to Busybox shell with root permissions. 4. Optional, but highly recommended: backup the flash contents before installation. At your PC ensure the device can write the firmware over TFTP: $ sudo touch /srv/tftp/ruckus_zf7321_firmware{1,2}.bin $ sudo chmod 666 /srv/tftp/ruckus_zf7321_firmware{1,2}.bin Locate partitions for primary and secondary firmware image. NEVER blindly copy over MTD nodes, because MTD indices change depending on the currently active firmware, and all partitions are writable! # grep rcks_wlan /proc/mtd Copy over both images using TFTP, this will be useful in case you'd like to return to stock FW in future. Make sure to backup both, as OpenWrt uses bot firmwre partitions for storage! # tftp -l /dev/<rcks_wlan.main_mtd> -r ruckus_zf7321_firmware1.bin -p 10.42.0.1 # tftp -l /dev/<rcks_wlan.bkup_mtd> -r ruckus_zf7321_firmware2.bin -p 10.42.0.1 When the command finishes, copy over the dump to a safe place for storage. $ cp /srv/tftp/ruckus_zf7321_firmware{1,2}.bin ~/ 5. Ensure the system is running from the BACKUP image, i.e. from rcks_wlan.bkup partition or "image 2". Otherwise the installation WILL fail, and you will need to access mtd0 device to write image which risks overwriting the bootloader, and so is not covered here and not supported. Switching to backup firmware can be achieved by executing a few consecutive reboots of the device, or by updating the stock firmware. The system will boot from the image it was not running from previously. Stock firmware available to update was conveniently dumped in point 4 :-) 6. Prepare U-boot environment image. Install u-boot-tools package. Alternatively, if you build your own images, OpenWrt provides mkenvimage in host staging directory as well. It is recommended to extract environment from the device, and modify it, rather then relying on defaults: $ sudo touch /srv/tftp/u-boot-env.bin $ sudo chmod 666 /srv/tftp/u-boot-env.bin On the device, find the MTD partition on which environment resides. Beware, it may change depending on currently active firmware image! # grep u-boot-env /proc/mtd Now, copy over the partition # tftp -l /dev/mtd<N> -r u-boot-env.bin -p 10.42.0.1 Store the stock environment in a safe place: $ cp /srv/tftp/u-boot-env.bin ~/ Extract the values from the dump: $ strings u-boot-env.bin | tee u-boot-env.txt Now clean up the debris at the end of output, you should end up with each variable defined once. After that, set the bootcmd variable like this: bootcmd=bootm 0x9f040000 You should end up with something like this: bootcmd=bootm 0x9f040000 bootargs=console=ttyS0,115200 rootfstype=squashfs init=/sbin/init baudrate=115200 ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee mtdparts=mtdparts=ar7100-nor0:256k(u-boot),13312k(rcks_wlan.main),2048k(datafs),256k(u-boot-env),512k(Board Data),13312k(rcks_wlan.bkup) mtdids=nor0=ar7100-nor0 bootdelay=2 ethact=eth0 filesize=78a000 fileaddr=81000000 partition=nor0,0 mtddevnum=0 mtddevname=u-boot ipaddr=10.0.0.1 serverip=10.0.0.5 stdin=serial stdout=serial stderr=serial These are the defaults, you can use most likely just this as input to mkenvimage. Now, create environment image and copy it over to TFTP root: $ mkenvimage -s 0x40000 -b -o u-boot-env.bin u-boot-env.txt $ sudo cp u-boot-env.bin /srv/tftp This is the same image, gzipped and base64-encoded: H4sIAAAAAAAAA+3QQW7TQBQAUF8EKRtQI6XtJDS0VJoN4gYcAE3iCbWS2MF2Sss1ORDYqVq6YMEB3rP0 Z/7Yf+aP3/56827VNP16X8Zx3E/Cw8dNuAqDYlxI7bcurpu6a3Y59v3jlzCbz5eLECbt8HbT9Y+HHLvv x9TdbbpJVVd9vOxWVX05TotVOpZt6nN8qilyf5fKso3hIYTb8JDSEFarIazXQyjLIeRc7PvykNq+iy+T 1F7PQzivmzbcLpYftmfH87G56Wz+/v18sT1r19vu649dqi/2qaqns0W4utmelalPm27I/lac5/p+OluO NZ+a1JaTz8M3/9hmtT0epmMjVdnF8djXLZx+TJl36TEuTlda93EYQrGpdrmrfuZ4fZPGHzjmp/vezMNJ MV6n6qumPm06C+MRZb6vj/v4Mk/7HJ+6LarDqXweLsZnXnS5vc9tdXheWRbd0GIdh/Uq7cakOfavsty2 z1nxGwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAD+1x9eTkHLAAAEAA== 7. Perform actual installation. Copy over OpenWrt sysupgrade image to TFTP root: $ sudo cp openwrt-ath79-generic-ruckus_zf7321-squashfs-sysupgrade.bin /srv/tftp Now load both to the device over TFTP: # tftp -l /tmp/u-boot-env.bin -r u-boot-env.bin -g 10.42.0.1 # tftp -l /tmp/openwrt.bin -r openwrt-ath79-generic-ruckus_zf7321-squashfs-sysupgrade.bin -g 10.42.0.1 Vverify checksums of both images to ensure the transfer over TFTP was completed: # sha256sum /tmp/u-boot-env.bin /tmp/openwrt.bin And compare it against source images: $ sha256sum /srv/tftp/u-boot-env.bin /srv/tftp/openwrt-ath79-generic-ruckus_zf7321-squashfs-sysupgrade.bin Locate MTD partition of the primary image: # grep rcks_wlan.main /proc/mtd Now, write the images in place. Write U-boot environment last, so unit still can boot from backup image, should power failure occur during this. Replace MTD placeholders with real MTD nodes: # flashcp /tmp/openwrt.bin /dev/<rcks_wlan.main_mtd> # flashcp /tmp/u-boot-env.bin /dev/<u-boot-env_mtd> Finally, reboot the device. The device should directly boot into OpenWrt. Look for the characteristic power LED blinking pattern. # reboot -f After unit boots, it should be available at the usual 192.168.1.1/24. Return to factory firmware: 1. Boot into OpenWrt initramfs as for initial installation. To do that without disassembly, you can write an initramfs image to the device using 'sysupgrade -F' first. 2. Unset the "bootcmd" variable: fw_setenv bootcmd "" 3. Write factory images downloaded from manufacturer website into fwconcat0 and fwconcat1 MTD partitions, or restore backup you took before installation: mtd write ruckus_zf7321_fw1_backup.bin /dev/mtd1 mtd write ruckus_zf7321_fw2_backup.bin /dev/mtd5 4. Reboot the system, it should load into factory firmware again. Quirks and known issues: - Flash layout is changed from the factory, to use both firmware image partitions for storage using mtd-concat, and uImage format is used to actually boot the system, which rules out the dual-boot capability. - The 5GHz radio has its own EEPROM on board, not connected to CPU. - The stock firmware has dual-boot capability, which is not supported in OpenWrt by choice. It is controlled by data in the top 64kB of RAM which is unmapped, to avoid the interference in the boot process and accidental switch to the inactive image, although boot script presence in form of "bootcmd" variable should prevent this entirely. - U-boot disables JTAG when starting. To re-enable it, you need to execute the following command before booting: mw.l 1804006c 40 And also you need to disable the reset button in device tree if you intend to debug Linux, because reset button on GPIO0 shares the TCK pin. - On some versions of stock firmware, it is possible to obtain root shell, however not much is available in terms of debugging facitilies. 1. Login to the rkscli 2. Execute hidden command "Ruckus" 3. Copy and paste ";/bin/sh;" including quotes. This is required only once, the payload will be stored in writable filesystem. 4. Execute hidden command "!v54!". Press Enter leaving empty reply for "What's your chow?" prompt. 5. Busybox shell shall open. Source: https://alephsecurity.com/vulns/aleph-2019014 Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
* ath79: support Ruckus ZoneFlex 7372Lech Perczak2022-09-111-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ruckus ZoneFlex 7372 is a dual-band, dual-radio 802.11n 2x2 MIMO enterprise access point. Ruckus ZoneFlex 7352 is also supported, lacking the 5GHz radio part. Hardware highligts: - CPU: Atheros AR9344 SoC at 560 MHz - RAM: 128MB DDR2 - Flash: 32MB SPI-NOR - Wi-Fi 2.4GHz: AR9344 built-in 2x2 MIMO radio - Wi-Fi 5Ghz: AR9582 2x2 MIMO radio (Only in ZF7372) - Antennas: - Separate internal active antennas with beamforming support on both bands with 7 elements per band, each controlled by 74LV164 GPIO expanders, attached to GPIOs of each radio. - Two dual-band external RP-SMA antenna connections on "7372-E" variant. - Ethernet 1: single Gigabit Ethernet port through AR8035 gigabit PHY - Ethernet 2: single Fast Ethernet port through AR9344 built-in switch - PoE: input through Gigabit port - Standalone 12V/1A power input - USB: optional single USB 2.0 host port on "-U" variants. The same image should support: - ZoneFlex 7372E (variant with external antennas, without beamforming capability) - ZoneFlex 7352 (single-band, 2.4GHz-only variant). which are based on same baseboard (codename St. Bernard), with different populated components. Serial console: 115200-8-N-1 on internal H1 header. Pinout: H1 --- |5| --- |4| --- |3| --- |x| --- |1| --- Pin 5 is near the "H1" marking. 1 - RX x - no pin 3 - VCC (3.3V) 4 - GND 5 - TX JTAG: Connector H2, similar to MIPS eJTAG, standard, but without the key in pin 12 and not every pin routed: ------- H2 |1 |2 | ------- |3 |4 | ------- |5 |6 | ------- |7 |8 | ------- |9 |10| ------- |11|12| ------- |13|14| ------- 3 - TDI 5 - TDO 7 - TMS 9 - TCK 2,4,6,8,10 - GND 14 - Vref 1,11,12,13 - Not connected Installation: There are two methods of installation: - Using serial console [1] - requires some disassembly, 3.3V USB-Serial adapter, TFTP server, and removing a single T10 screw, but with much less manual steps, and is generally recommended, being safer. - Using stock firmware root shell exploit, SSH and TFTP [2]. Does not work on some rare versions of stock firmware. A more involved, and requires installing `mkenvimage` from u-boot-tools package if you choose to rebuild your own environment, but can be used without disassembly or removal from installation point, if you have the credentials. If for some reason, size of your sysupgrade image exceeds 13312kB, proceed with method [1]. For official images this is not likely to happen ever. [1] Using serial console: 0. Connect serial console to H1 header. Ensure the serial converter does not back-power the board, otherwise it will fail to boot. 1. Power-on the board. Then quickly connect serial converter to PC and hit Ctrl+C in the terminal to break boot sequence. If you're lucky, you'll enter U-boot shell. Then skip to point 3. Connection parameters are 115200-8-N-1. 2. Allow the board to boot. Press the reset button, so the board reboots into U-boot again and go back to point 1. 3. Set the "bootcmd" variable to disable the dual-boot feature of the system and ensure that uImage is loaded. This is critical step, and needs to be done only on initial installation. > setenv bootcmd "bootm 0x9f040000" > saveenv 4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed: > setenv serverip 192.168.1.2 > setenv ipaddr 192.168.1.1 > tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7372-initramfs-kernel.bin > bootm 0x81000000 5. Optional, but highly recommended: back up contents of "firmware" partition: $ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7372_fw1_backup.bin $ ssh root@192.168.1.1 cat /dev/mtd5 > ruckus_zf7372_fw2_backup.bin 6. Copy over sysupgrade image, and perform actual installation. OpenWrt shall boot from flash afterwards: $ ssh root@192.168.1.1 # sysupgrade -n openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin [2] Using stock root shell: 0. Reset the device to factory defaullts. Power-on the device and after it boots, hold the reset button near Ethernet connectors for 5 seconds. 1. Connect the device to the network. It will acquire address over DHCP, so either find its address using list of DHCP leases by looking for label MAC address, or try finding it by scanning for SSH port: $ nmap 10.42.0.0/24 -p22 From now on, we assume your computer has address 10.42.0.1 and the device has address 10.42.0.254. 2. Set up a TFTP server on your computer. We assume that TFTP server root is at /srv/tftp. 3. Obtain root shell. Connect to the device over SSH. The SSHD ond the frmware is pretty ancient and requires enabling HMAC-MD5. $ ssh 10.42.0.254 \ -o UserKnownHostsFile=/dev/null \ -o StrictHostKeyCheking=no \ -o MACs=hmac-md5 Login. User is "super", password is "sp-admin". Now execute a hidden command: Ruckus It is case-sensitive. Copy and paste the following string, including quotes. There will be no output on the console for that. ";/bin/sh;" Hit "enter". The AP will respond with: grrrr OK Now execute another hidden command: !v54! At "What's your chow?" prompt just hit "enter". Congratulations, you should now be dropped to Busybox shell with root permissions. 4. Optional, but highly recommended: backup the flash contents before installation. At your PC ensure the device can write the firmware over TFTP: $ sudo touch /srv/tftp/ruckus_zf7372_firmware{1,2}.bin $ sudo chmod 666 /srv/tftp/ruckus_zf7372_firmware{1,2}.bin Locate partitions for primary and secondary firmware image. NEVER blindly copy over MTD nodes, because MTD indices change depending on the currently active firmware, and all partitions are writable! # grep rcks_wlan /proc/mtd Copy over both images using TFTP, this will be useful in case you'd like to return to stock FW in future. Make sure to backup both, as OpenWrt uses bot firmwre partitions for storage! # tftp -l /dev/<rcks_wlan.main_mtd> -r ruckus_zf7372_firmware1.bin -p 10.42.0.1 # tftp -l /dev/<rcks_wlan.bkup_mtd> -r ruckus_zf7372_firmware2.bin -p 10.42.0.1 When the command finishes, copy over the dump to a safe place for storage. $ cp /srv/tftp/ruckus_zf7372_firmware{1,2}.bin ~/ 5. Ensure the system is running from the BACKUP image, i.e. from rcks_wlan.bkup partition or "image 2". Otherwise the installation WILL fail, and you will need to access mtd0 device to write image which risks overwriting the bootloader, and so is not covered here and not supported. Switching to backup firmware can be achieved by executing a few consecutive reboots of the device, or by updating the stock firmware. The system will boot from the image it was not running from previously. Stock firmware available to update was conveniently dumped in point 4 :-) 6. Prepare U-boot environment image. Install u-boot-tools package. Alternatively, if you build your own images, OpenWrt provides mkenvimage in host staging directory as well. It is recommended to extract environment from the device, and modify it, rather then relying on defaults: $ sudo touch /srv/tftp/u-boot-env.bin $ sudo chmod 666 /srv/tftp/u-boot-env.bin On the device, find the MTD partition on which environment resides. Beware, it may change depending on currently active firmware image! # grep u-boot-env /proc/mtd Now, copy over the partition # tftp -l /dev/mtd<N> -r u-boot-env.bin -p 10.42.0.1 Store the stock environment in a safe place: $ cp /srv/tftp/u-boot-env.bin ~/ Extract the values from the dump: $ strings u-boot-env.bin | tee u-boot-env.txt Now clean up the debris at the end of output, you should end up with each variable defined once. After that, set the bootcmd variable like this: bootcmd=bootm 0x9f040000 You should end up with something like this: bootcmd=bootm 0x9f040000 bootargs=console=ttyS0,115200 rootfstype=squashfs init=/sbin/init baudrate=115200 ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee bootdelay=2 mtdids=nor0=ar7100-nor0 mtdparts=mtdparts=ar7100-nor0:256k(u-boot),13312k(rcks_wlan.main),2048k(datafs),256k(u-boot-env),512k(Board Data),13312k(rcks_wlan.bkup) ethact=eth0 filesize=1000000 fileaddr=81000000 ipaddr=192.168.0.7 serverip=192.168.0.51 partition=nor0,0 mtddevnum=0 mtddevname=u-boot stdin=serial stdout=serial stderr=serial These are the defaults, you can use most likely just this as input to mkenvimage. Now, create environment image and copy it over to TFTP root: $ mkenvimage -s 0x40000 -b -o u-boot-env.bin u-boot-env.txt $ sudo cp u-boot-env.bin /srv/tftp This is the same image, gzipped and base64-encoded: H4sIAAAAAAAAA+3QTW7TQBQAYB+AQ2TZSGk6Tpv+SbNBrNhyADSJHWolsYPtlJaDcAWOCXaqQhdIXOD7 Fm/ee+MZ+/nHu58fV03Tr/dFHNf9JDzdbcJVGGRjI7Vfurhu6q7ZlbHvnz+FWZ4vFyFM2mF30/XPhzJ2 X4+pe9h0k6qu+njRrar6YkyzVToWberL+HImK/uHVBRtDE8h3IenlIawWg1hvR5CUQyhLE/vLcpdeo6L bN8XVdHFumlDTO1NHsL5mI/9Q2r7Lv5J3uzeL5bX27Pj+XjRdJZfXuaL7Vm73nafv+1SPd+nqp7OFuHq dntWpD5tuqH6e+K8rB+ns+V45n2T2mLyYXjmH9estsfD9DTSuo/DErJNtSu76vswbjg5NU4D3752qsOp zu8W8/z6dh7mN1lXto9lWx3eNJd5Ng5V9VVTn2afnSYuysf6uI9/8rQv48s3Z93wn+o4XFWl3Vg0x/5N Vbbta5X9AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAID/+Q2Z/B7cAAAEAA== 7. Perform actual installation. Copy over OpenWrt sysupgrade image to TFTP root: $ sudo cp openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin /srv/tftp Now load both to the device over TFTP: # tftp -l /tmp/u-boot-env.bin -r u-boot-env.bin -g 10.42.0.1 # tftp -l /tmp/openwrt.bin -r openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin -g 10.42.0.1 Verify checksums of both images to ensure the transfer over TFTP was completed: # sha256sum /tmp/u-boot-env.bin /tmp/openwrt.bin And compare it against source images: $ sha256sum /srv/tftp/u-boot-env.bin /srv/tftp/openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin Locate MTD partition of the primary image: # grep rcks_wlan.main /proc/mtd Now, write the images in place. Write U-boot environment last, so unit still can boot from backup image, should power failure occur during this. Replace MTD placeholders with real MTD nodes: # flashcp /tmp/openwrt.bin /dev/<rcks_wlan.main_mtd> # flashcp /tmp/u-boot-env.bin /dev/<u-boot-env_mtd> Finally, reboot the device. The device should directly boot into OpenWrt. Look for the characteristic power LED blinking pattern. # reboot -f After unit boots, it should be available at the usual 192.168.1.1/24. Return to factory firmware: 1. Boot into OpenWrt initramfs as for initial installation. To do that without disassembly, you can write an initramfs image to the device using 'sysupgrade -F' first. 2. Unset the "bootcmd" variable: fw_setenv bootcmd "" 3. Write factory images downloaded from manufacturer website into fwconcat0 and fwconcat1 MTD partitions, or restore backup you took before installation: mtd write ruckus_zf7372_fw1_backup.bin /dev/mtd1 mtd write ruckus_zf7372_fw2_backup.bin /dev/mtd5 4. Reboot the system, it should load into factory firmware again. Quirks and known issues: - This is first device in ath79 target to support link state reporting on FE port attached trough the built-in switch. - Flash layout is changed from the factory, to use both firmware image partitions for storage using mtd-concat, and uImage format is used to actually boot the system, which rules out the dual-boot capability. The 5GHz radio has its own EEPROM on board, not connected to CPU. - The stock firmware has dual-boot capability, which is not supported in OpenWrt by choice. It is controlled by data in the top 64kB of RAM which is unmapped, to avoid the interference in the boot process and accidental switch to the inactive image, although boot script presence in form of "bootcmd" variable should prevent this entirely. - U-boot disables JTAG when starting. To re-enable it, you need to execute the following command before booting: mw.l 1804006c 40 And also you need to disable the reset button in device tree if you intend to debug Linux, because reset button on GPIO0 shares the TCK pin. - On some versions of stock firmware, it is possible to obtain root shell, however not much is available in terms of debugging facitilies. 1. Login to the rkscli 2. Execute hidden command "Ruckus" 3. Copy and paste ";/bin/sh;" including quotes. This is required only once, the payload will be stored in writable filesystem. 4. Execute hidden command "!v54!". Press Enter leaving empty reply for "What's your chow?" prompt. 5. Busybox shell shall open. Source: https://alephsecurity.com/vulns/aleph-2019014 - Stock firmware has beamforming functionality, known as BeamFlex, using active multi-segment antennas on both bands - controlled by RF analog switches, driven by a pair of 74LV164 shift registers. Shift registers used for each radio are connected to GPIO14 (clock) and GPIO15 of the respective chip. They are mapped as generic GPIOs in OpenWrt - in stock firmware, they were most likely handled directly by radio firmware, given the real-time nature of their control. Lack of this support in OpenWrt causes the antennas to behave as ordinary omnidirectional antennas, and does not affect throughput in normal conditions, but GPIOs are available to tinker with nonetheless. Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
* ramips: add support for Linksys E7350Rosen Penev2022-09-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Linksys E7350 is an 802.11ax (Wi-Fi 6) router, based on MediaTek MT7621A. Specifications: - SoC: MT7621 (880MHz, 2 Cores) - RAM: 256 MB - Flash: 128 MB NAND - Wi-Fi: - MT7915D: 2.4/5 GHz (DBDC) - Ethernet: 5x 1GiE MT7530 - USB: 1x USB 3.0 - UART: J4 (57600 baud) - Pinout: [3V3] (TXD) (RXD) (blank) (GND) Notes: * This device has a dual-boot partition scheme, but this firmware works only on boot partition 1. Installation: Upload the generated factory.bin image via the stock web firmware updater. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* ramips: add support for Belkin RT1800Rosen Penev2022-09-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Belkin RT1800 is an 802.11ax (Wi-Fi 6) router, based on MediaTek MT7621A. Specifications: - SoC: MT7621 (880MHz, 2 Cores) - RAM: 256 MB - Flash: 128 MB NAND - Wi-Fi: - MT7915D: 2.4/5 GHz (DBDC) - Ethernet: 5x 1GiE MT7530 - USB: 1x USB 3.0 - UART: J4 (57600 baud) - Pinout: [3V3] (TXD) (RXD) (blank) (GND) Notes: * This device has a dual-boot partition scheme, but this firmware works only on boot partition 1. Installation: Upload the generated factory.bin image via the stock web firmware updater. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* ramips: add support for Kroks Rt-Cse SIM Injector DSAndrey Butirsky2022-09-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Aka Kroks Rt-Cse5 UW DRSIM (KNdRt31R16), ID 1958: https://kroks.ru/search/?text=1958 See Kroks OpenWrt fork for support of other models: https://github.com/kroks-free/openwrt Device specs: - CPU: MediaTek MT7628AN - Flash: 16MB SPI NOR - RAM: 64MB - Bootloader: U-Boot - Ethernet: 5x 10/100 Mbps - 2.4 GHz: b/g/n SoC - USB: 1x - SIM-reader: 2x (driven by a dedicated chip with it's own firmware) - Buttons: reset - LEDs: 1x Power, 1x Wi-Fi, 12x others (SIM status, Internet, etc.) Flashing: - sysupgrade image via stock firmware WEB interface, IP: 192.168.1.254 - U-Boot launches a WEB server if Reset button is held during power up, IP: 192.168.1.1 MAC addresses as verified by OEM firmware: vendor OpenWrt source LAN eth0 factory 0x4 (label) 2g wlan0 label Signed-off-by: Andrey Butirsky <butirsky@gmail.com>
* ramips: add support for Kroks Rt-Pot mXw DS RSIM routerAndrey Butirsky2022-09-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Aka "Kroks KNdRt31R19". Ported from v19.07.8 of OpenWrt fork: see https://github.com/kroks-free/openwrt for support of other models. Device specs: - CPU: MediaTek MT7628AN - Flash: 16MB SPI NOR - RAM: 64MB - Bootloader: U-Boot - Ethernet: 1x 10/100 Mbps - 2.4 GHz: b/g/n SoC - mPCIe: 1x (usually equipped with an LTE modem by vendor) - Buttons: reset - LEDs: 1x Modem, 1x Injector, 1x Wi-Fi, 1x Status Flashing: - sysupgrade image via stock firmware WEB interface. - U-Boot launches a WEB server if Reset button is held during power up. Server IP: 192.168.1.1 SIM card switching: The device supports up to 4 SIM cards - 2 locally on board and 2 on remote SIM-injector. By default, 1-st local SIM is active. To switch to e.g. 1-st remote SIM: echo 0 > /sys/class/gpio/modem1power/value echo 0 > /sys/class/gpio/modem1sim1/value echo 1 > /sys/class/gpio/modem1rsim1/value echo 1 > /sys/class/gpio/modem1power/value MAC addresses as verified by OEM firmware: vendor OpenWrt source LAN eth0 factory 0x4 (label) 2g wlan0 label Signed-off-by: Kroks <dev@kroks.ru> [butirsky@gmail.com: port to master; drop dts-v1] Signed-off-by: Andrey Butirsky <butirsky@gmail.com>
* realtek: add support for TP-Link SG2452P v4 aka T1600G-52PS v4Andreas Böhler2022-09-101-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is an RTL8393-based switch with 802.3af on all 48 ports. Specifications: --------------- * SoC: Realtek RTL8393M * Flash: 32 MiB SPI flash * RAM: 256 MiB * Ethernet: 48x 10/100/1000 Mbps with PoE+ * Buttons: 1x "Reset" button, 1x "Speed" button * UART: 1x serial header, unpopulated * PoE: 12x TI TPS23861 I2C PoE controller, 384W PoE budget * SFP: 4 SFP ports Works: ------ - (48) RJ-45 ethernet ports - Switch functions - Buttons - All LEDs on front panel except port LEDs - Fan monitoring and basic control Not yet enabled: ---------------- - PoE - ICs are not in AUTO mode, so the kernel driver is not usable - Port LEDs - SFP cages Install via web interface: ------------------------- Not supported at this time. Install via serial console/tftp: -------------------------------- The U-Boot firmware drops to a TP-Link specific "BOOTUTIL" shell at 38400 baud. There is no known way to exit out of this shell, and no way to do anything useful. Ideally, one would trick the bootloader into flashing the sysupgrade image first. However, if the image exceeds 6MiB in size, it will not work. To install OpenWRT: Prepare a tftp server with: 1. server address: 192.168.0.146 2. the image as: "uImage.img" Power on device, and stop boot by pressing any key. Once the shell is active: 1. Ground out the CLK (pin 16) of the ROM (U6) 2. Select option "3. Start" 3. Bootloader notes that "The kernel has been damaged!" 4. Release CLK as soon as bootloader thinks image is corrupted. 5. Bootloader enters automatic recovery -- details printed on console 6. Watch as the bootloader flashes and boots OpenWRT. Blind install via tftp: ----------------------- This method works when it's not feasible to install a serial header. Prepare a tftp server with: 1. server address: 192.168.0.146 2. the image as: "uImage.img" 3. Watch network traffic (tcpdump or wireshark works) 4. Power on the device. 5. Wait 1-2 seconds then ground out the CLK (pin 16) of the ROM (U6) 6. When 192.168.0.30 makes tftp requests, release pin 16 7. Wait 2-3 minutes for device to auto-flash and boot OpenWRT Signed-off-by: Andreas Böhler <dev@aboehler.at>
* mediatek: filogic: use WPS button instead of RST on BPi-R3Daniel Golle2022-09-101-3/+3
| | | | | | | | | The GPIO used for the RST button is also used for PCIe-CLKREQ signal. Hence it cannot be used as button signal if PCIe is also used. Wire up WPS button to serve as KEY_RESTART in Linux and "reset" button in U-Boot. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ipq40xx: add support for Pakedge WR-1Tomasz Maciej Nowak2022-09-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pakedge WR-1 is a dual-band wireless router. Specification SoC: Qualcomm Atheros IPQ4018 RAM: 256 MB DDR3 Flash: 32 MB SPI NOR WIFI: 2.4 GHz 2T2R integrated 5 GHz 2T2R integrated Ethernet: 5x 10/100/1000 Mbps QCA8075 USB: 1x 2.0 LEDS: 8x (3 GPIO controlled, 5 connected to switch) Buttons: 1x GPIO controlled UART: pin header J5 1. 3.3V, 2. GND, 3. TX, 4. RX baud: 115200, parity: none, flow control: none Installation 1. Rename initramfs image to: openwrt-ipq806x-qcom-ipq40xx-ap.dk01.1-c1-fit-uImage-initramfs.itb and copy it to USB flash drive with FAT32 file system. 2. Connect USB flash drive to the router and apply power while pressing reset button. Hold the button, on the lates bootloader version, when Power and WiFi-5 LEDs will start blinking release it. For the older bootloader holding it for 15 seconds should suffice. 3. Now the router boots the initramfs image, at some point (close to one minute) the Power LED will start blinking, when stops, router is fully booted. 4. Connect to one of LAN ports and use SSH to open the shell at 192.168.1.1. 5. ATTENTION! now backup the mtd8 and mtd9 partitions, it's necessary if, at some point, You want to go back to original firmware. The firmware provided by manufacturer on its site is encrypted and U-Boot accepts only decrypted factory images, so there's no way to restore original firmware. 6. If the backup is prepared, transfer the sysupgrade image to the router and use 'sysupgrade' command to flash it. 7. After successful flashing router will reboot. At some point the Power LED will start blinking, wait till it stops, then router is ready for configuration. Additional information U-Boot command line is password protected. Password is unknown. Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
* arm-trusted-firmware-tools: update to v2.7Daniel Golle2022-09-071-10/+4
| | | | | | | Update host build of fiptool and use the new python sptool.py instead of the previous sptool executable. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-envtools: update to 2022.07Nick Hainke2022-09-024-429/+2
| | | | | | | | | | | Update to latest version. Remove upstreamed patches: - 100-fw_env-make-flash_io-take-buffer-as-an-argument.patch - 101-fw_env-simplify-logic-code-paths-in-the-fw_env_open.patch - 102-fw_env-add-fallback-to-Linux-s-NVMEM-based-access.patch Signed-off-by: Nick Hainke <vincent@systemli.org>
* at91bootstrap: use sdmmc0 as booting media for sama5d27_som1_ekClaudiu Beznea2022-09-021-7/+1
| | | | | | | | | | Commit 0b7c66c ("at91bootstrap: add sama5d27_som1_eksd1_uboot as default defconfig") changed default booting media for sama5d27_som1_ek board w/o any reason. Changed it back to sdmmc0 as it is for all the other Microchip supported distributions for this board (Buildroot, Yocto Project). The initial commit cannot be cleanly reverted. Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
* uboot-at91: use sdmmc0 as booting media for sama5d27_som1_ekClaudiu Beznea2022-09-021-3/+3
| | | | | | | | | | | Commit adc69fe (""uboot-at91: changed som1 ek default defconfigs") changed the booting media to sdmmc1 as default booting w/o any reason. The Microchip releases for the rest of supported distributions (Buildroot, Yocto Project) uses sdmmc0 as default booting media for this board. Thus change it back to sdmmc0. With this remove references to sdmmc1 config. The initial commit cannot be cleanly reverted. Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
* arm-trusted-firmware-mediatek: update to sources of 2022-08-31Daniel Golle2022-08-313-75/+3
| | | | | | | Drop downstream patches which have been replaced with equivalent upstream changes. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-mediatek: replace patches with updated versionsDaniel Golle2022-08-3136-164/+791
| | | | | | | | | | | | | | | | Weijie Gao has submitted an updated version of the patchset adding support for MT7986 and MT7981 to U-Boot. Use that v2 patchset. Changes of v2: - Add cpu driver for print_cpuinfo() - Fix NULL pointer dereference in mtk_image (was already fixed in OpenWrt) - Fix coding style - Minor changes https://patchwork.ozlabs.org/project/uboot/list/?series=316148 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-envtools: add support for Bananapi BPi-R3Daniel Golle2022-08-301-0/+45
| | | | | | | Create new mediatek_filogic file and add entries for environment on MMC, UBI and NOR for the Bananapi BPi-R3. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-mediatek: add support for Bananapi BPi-R3Daniel Golle2022-08-302-3/+1428
| | | | | | | | | | | | | | | The Bananapi BPi-R3 board can boot from eMMC, SD card, SPI-NAND and SPI-NOR, depending on the position of switches controlling the BOOTSEL bootstrap pins as we as hard-wired chip-select lines. The position of the chip-select switch SW6 decides whether either SD card or eMMC can be accessed, SW5 selects either SPI-NAND or SPI-NOR. Generate U-Boot for all 4 boot options. The SD card version allows installation to SPI-NAND and SPI-NOR (eMMC cannot be accessed simultanously with the SD card), the SPI-NAND version allows installation to eMMC. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-mediatek: no compression means IH_COMP_NONEDaniel Golle2022-08-283-1/+120
| | | | | | | | | | Treat missing compression node in FIT image as IH_COMP_NONE. This is implicentely already happening in most places, but for now was still triggering an annoying warning about initramfs compression being obsolete despite compression note being absent. Fix this. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-mediatek: mt7986: add generic reset button supportDaniel Golle2022-08-281-0/+40
| | | | | | | Allow resetting environment to default values when defined button exists in device tree. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-mediatek: mt7986: support PSTORE/ramoopsDaniel Golle2022-08-281-0/+38
| | | | | | Assign reserved memory for PSTORE/ramoops for the MT7986 SoC. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-mediatek: additions from MTK SDKDaniel Golle2022-08-2845-276/+10562
| | | | | | | | | | | | | | | * updated SNAND/SNFI driver brings support for MT7981 * add support for MediaTek NAND Memory bad Block Management (NMBM) (not used for any boards atm, but could be useful in future) * wire up NMBM support for MT7622, MT7629, MT7981 and MT7986 * replace some local patches with updated version from SDK * bring some legacy precompiler symbols which haven't been converted into Kconfig symbols in U-Boot 2022.07, remove when bumbping to U-Boot 2022.10: 100-28-include-configs-mt7986-h-from-SDK.patch Source: https://github.com/mtk-openwrt/u-boot Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-mediatek: add support for MT798x platformsDaniel Golle2022-08-2836-6/+12173
| | | | | | Import pending patches to support the upcoming Filogic platforms. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-mediatek: add support for compressed BL3/FIP imageDaniel Golle2022-08-282-13/+7
| | | | | | | MediaTek's ARM Trusted Firmware v2.7+ allows the images inside a FIP structure to be compressed. Make use of that for boards with NOR flash. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-mediatek: fix factory reset on UBIDaniel Golle2022-08-282-2/+2
| | | | | | | Truncating a UBI volume using `ubi write 0x0 volname 0x0` results in segfault on newer U-Boot. Write 1MB of 0s instead. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* arm-trusted-firmware-mediatek: update to v2.7+ from MediaTekDaniel Golle2022-08-284-50/+192
| | | | | | | | | | | | | | | | | | | | The updated sources bring support for the MT798x Filogic SoC family. Add builds for MT7986 with most supported storage types, each for DDR3 and DDR4 configurations. A better solution for skipping bad blocks on SPI-NAND connected via the SNFI interface has been implemented upstream, so drop local patch. Add pending patches [1] and [2] to fix boot on existing MT7622 boards. Tested on BananaPi BPi-R64 (SDMMC, eMMC, SPI-NAND), Linksys E8450 and Ubiquiti UniFi 6 LR as well as upcoming Bananapi BPi-R3 board for which support will be added in future patches. [1]: https://github.com/mtk-openwrt/arm-trusted-firmware/pulls/#3 [2]: https://github.com/mtk-openwrt/arm-trusted-firmware/pulls/#4 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* trusted-firmware-a.mk: pass DTC path similar to u-boot.mkDaniel Golle2022-08-284-0/+4
| | | | | | | | | Instead of relying on dtc being provided by the build host use the dtc from $(LINUX_DIR) similar to how it's done also in u-boot.mk. For this to work kernel.mk now needs to be included before trusted-firmware-a.mk, add this include to all affected packages. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-envtools: mt7622: use 4k sectors for UniFi 6 LR (ubootmod)Daniel Golle2022-08-281-1/+1
| | | | | | | | Use 4k sectors when accessing the U-Boot environment on the 64MiB SPI-NOR flash chip found in the UniFi 6 LR. The speeds up environment write access as only 4kB instead of 64kB have to be written. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-mediatek: fix Ubiquiti UniFi 6 LR U-Boot modDaniel Golle2022-08-281-20/+8
| | | | | | | Image names as well as the calculation of the padded image size did not work as intended. Fix that. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* realtek: d-link: add support for dgs-1210-10mpDaniel Groth2022-08-201-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | General hardware info: ------------------------------------------------------------------------------- D-Link DGS-1210-10MP is a switch with 8 ethernet ports and 2 SFP ports, all ports Gbit capable. It is based on a RTL8380 SoC @ 500MHz, DRAM 128MB and 32MB flash. All ethernet ports are 802.3af/at PoE capable with a total PoE power budget of 130W. File info: ------------------------------------------------------------------------------- The dgs-1210-10mp is very similar to dgs-1210-10p so I used that as a start. rtl838x.mk: - Removed lua-rs232 package since it was a leftover from the old rtl83xx-poe package. - Updated the soc to 8380. - Specified device variant: F. - Installed the new realtek-poe package. rtl8380_d-link_dgs-1210-10mp.dts: - Moved dgs-1210 family common parts and non PoE related ports on rtl8231 to the new device tree dtsi files. Serial connection: ------------------------------------------------------------------------------- The UART for the SoC (115200 8N1) is available close to the front panel next to the LED/key card connector via unpopulated standard 0.1" pin header marked j4. Pin1 is marked with arrow and square. Pin 1: Vcc 3,3V Pin 2: Tx Pin 3: Rx Pin 4: Gnd Installation with TFTP from u-boot ------------------------------------------------------------------------------- I originally used the install procedure: 'OpenWrt installation using the TFTP method and serial console access' found in the device wiki for the dgs-1210-16. < https://openwrt.org/toh/d-link/dgs-1210-16_g1#openwrt_installation_using _the_tftp_method_and_serial_console_access > About the realtek-poe package ------------------------------------------------------------------------------- The realtek-poe package is installed but there isn't any automatic PoE config setting at this time so for now the PoE config must be edited manually. Original OEM hardware/firmware data at first installation ------------------------------------------------------------------------------- It has been installed, developed, and tested on a device with these OEM hardware and firmware versions. - U-boot: 2011.12.(2.1.5.67086)-Candidate1 (Jun 22 2020 - 15:03:58) - Boot version: 1.01.001 - Firmware version: 6.20.007 - Hardware version: F1 Things to be done when support are developed ------------------------------------------------------------------------------- - realtek-poe has been included in OpenWrt but the automatic config handling has not been solved yet so in the future there will probably be some minor updates for this device to handle the poe config. - LED link_act and poe are per function supposed to be connected to the PoE system. But some software development is also needed to make this LED work and shift the LED array between act and poe indication and to shift the mode lights with mode key. - LED poe_max should probably be used as straight forward error output from the realtek-poe package error handling. But no code has been written for this. - SFP is currently not hot pluggable. Development is under progress to get working I2C communication with SFP and have them hot pluggable. When any device in the dgs-1210 family gets this working, I expect it should be possible to implement the same solution in this device. Signed-off-by: Daniel Groth <flygarn12@gmail.com> [Capitalisation of abbreviations, DEVICE_VARIANT and update filenames, device compatibles on single line] Signed-off-by: Sander Vanheule <sander@svanheule.net>
* ramips: add support for Beeline SmartBox TURBOMikhail Zhilkin2022-08-131-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Beeline SmartBox TURBO is a wireless WiFi 5 router manufactured by Sercomm company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB Flash: 256 MiB, Micron MT29F2G08ABAGA3W Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2 Wireless 5 GHz (MT7615E): a/n/ac, 4x4 Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1xUSB3.0 Button: 2 buttons (Reset & WPS) LEDs: 1 RGB LED Power: 12 VDC, 1.5 A Connector type: barrel Bootloader: U-Boot Installation ----------------- 1. Login to the router web interface (admin:admin) 2. Navigate to Settings -> WAN -> Add static IP interface (e.g. 10.0.0.1/255.255.255.0) 3. Navigate to Settings -> Remote cotrol -> Add SSH, port 22, 10.0.0.0/255.255.255.0 and interface created before 4. Change IP of your client to 10.0.0.2/255.255.255.0 and connect the ethernet cable to the WAN port of the router 5. Connect to the router using SSH shell (SuperUser:SNxxxxxxxxxx, where SNxxxxxxxxxx is the serial number from the backplate label) 6. Run in SSH shell: sh 7. Make a mtd backup (optional, see related section) 8. Change bootflag to Sercomm1 and reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 reboot 9. Login to the router web interface (admin:admin) 10. Remove dots from the OpenWrt factory image filename 11. Update firmware via web using OpenWrt factory image Revert to stock --------------- 1. Change bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 2. Optional: Update with any stock (Beeline) firmware if you want to overwrite OpenWrt in Slot 0 completely. mtd backup ---------- 1. Set up a tftp server (e.g. tftpd64 for windows) 2. Connect to a router using SSH shell and run the following commands: cd /tmp for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \ tftp -l mtd$i -p 10.0.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done tftp -l mtd.md5 -p 10.0.0.2 MAC Addresses ------------- +-----+-----------+---------+ | use | address | example | +-----+-----------+---------+ | LAN | label | *:54 | | WAN | label + 1 | *:55 | | 2g | label + 4 | *:58 | | 5g | label + 5 | *:59 | +-----+-----------+---------+ The label MAC address was found in Factory 0x21000 Co-developed-by: Maximilian Weinmann <x1@disroot.org> Signed-off-by: Maximilian Weinmann <x1@disroot.org> Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
* realtek: add support for TP-Link SG2008PAlexandru Gagniuc2022-08-131-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for the TP-Link SG2008P switch. This is an RTL8380 based switch with 802.3af one the first four ports. Specifications: --------------- * SoC: Realtek RTL8380M * Flash: 32 MiB SPI flash (Vendor varies) * RAM: 256 MiB (Vendor varies) * Ethernet: 8x 10/100/1000 Mbps with PoE on 4 ports * Buttons: 1x "Reset" button on front panel * Power: 53.5V DC barrel jack * UART: 1x serial header, unpopulated * PoE: 1x TI TPS23861 I2C PoE controller Works: ------ - (8) RJ-45 ethernet ports - Switch functions - System LED Not yet enabled: ---------------- - Power-over-Ethernet (driver works, but doesn't enable "auto" mode) - PoE, Link/Act, PoE max and System LEDs Install via web interface: ------------------------- Not supported at this time. Install via serial console/tftp: -------------------------------- The footprints R27 (0201) and R28 (0402) are not populated. To enable serial console, 50 ohm resistors should be soldered -- any value from 0 ohm to 50 ohm will work. R27 can be replaced by a solder bridge. The u-boot firmware drops to a TP-Link specific "BOOTUTIL" shell at 38400 baud. There is no known way to exit out of this shell, and no way to do anything useful. Ideally, one would trick the bootloader into flashing the sysupgrade image first. However, if the image exceeds 6MiB in size, it will not work. The sysupgrade image can also be flashed. To install OpenWRT: Prepare a tftp server with: 1. server address: 192.168.0.146 2. the image as: "uImage.img" Power on device, and stop boot by pressing any key. Once the shell is active: 1. Ground out the CLK (pin 16) of the ROM (U7) 2. Select option "3. Start" 3. Bootloader notes that "The kernel has been damaged!" 4. Release CLK as sson as bootloader thinks image is corrupted. 5. Bootloader enters automatic recovery -- details printed on console 6. Watch as the bootloader flashes and boots OpenWRT. Blind install via tftp: ----------------------- This method works when it's not feasible to install a serial header. Prepare a tftp server with: 1. server address: 192.168.0.146 2. the image as: "uImage.img" 3. Watch network traffic (tcpdump or wireshark works) 4. Power on the device. 5. Wait 1-2 seconds then ground out the CLK (pin 16) of the ROM (U7) 6. When 192.168.0.30 makes tftp requests, release pin 16 7. Wait 2-3 minutes for device to auto-flash and boot OpenWRT Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-30 15:40:32 +0000