aboutsummaryrefslogtreecommitdiffstats
path: root/target/linux
Commit message (Collapse)AuthorAgeFilesLines
* bmips: fix missing NVMEM subsystemPetr Štetiar2021-07-211-0/+1
| | | | | | | | | | | MAC address retrieval was switched to more generic upstream (5.13) NVMEM based solution in commit 32adbfc789f6 ("bmips: convert mtd-mac-address to nvmem implementation"), but NVMEM subsystem wasn't enabled in the kernel, so fix it now. References: https://github.com/openwrt/openwrt/pull/4041#issuecomment-883322801 Fixes: 32adbfc789f6 ("bmips: convert mtd-mac-address to nvmem implementation") Signed-off-by: Petr Štetiar <ynezz@true.cz>
* mediatek: mt7623: add back needed build steps for U7623 boardDaniel Golle2021-07-211-0/+21
| | | | | | | | When reworking the BPi-R2 the mtk-mmc-img build step was removed despite it was still needed to build the image for the UniElec U7623 board. Add it back for now until U7623 gets its facelift. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* mediatek: remove ext4 images from mt7623 buildDaniel Golle2021-07-201-1/+1
| | | | | | | | A full read-write rootfs cannot work inside uImage.FIT as the hash will obviously change once writing to it. Disable generating ext4 rootfs images. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* linux/rockchip: update the USB 3.0 controller node patchRui Salvaterra2021-07-203-28/+26
| | | | | | | | | This has been added in Linux 5.10.51 [1], but it's broken/incomplete. Update our patch and refresh the remaining patches. [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.10.51&id=421aff50af5e4cdc56b3ac8d6b670e09697bc8ac Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* mediatek: fix typo in kernel mt7623/config-5.10Daniel Golle2021-07-201-1/+1
| | | | | | Fix typo reported by github user @mans0n. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* mediatek: drop kmod-mmcDaniel Golle2021-07-201-1/+1
| | | | | | | Support for MMC is built-into the kernel anyway, no need to select the (empty/stub) kmod package. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* mediatek: rework Bananapi BPi-R2Daniel Golle2021-07-208-147/+153
| | | | | | | | | | | | | * introduce recovery (=initramfs) vs. production dual boot scheme * make use of uImage.FIT (instead of FAT partition) * generate images using build steps (instead of external scripts) * simplify sysupgrade and config restore (thanks to uImage.FIT) * make sure mmc devices are ordered persistently (set DT aliases) This commit breaks sysupgrade from existing installations, you will have to re-install using the sdcard.img.gz image. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* kernel: make uImage.FIT partition parser work on MBR partitionsDaniel Golle2021-07-202-2/+38
| | | | | | | Introduce new partition type 0x2e representing uImage.FIT and trigger FIT partition parser on partitions having that type. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* mediatek: mt7623: import patch to fix flow offloadingDaniel Golle2021-07-201-0/+24
| | | | | | | Hardware flow offloading was reported to work when setting the right version identifier. Import a patch from Frank Wunderlich doing that. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* mediatek: mt7623: build with Linux 5.10Daniel Golle2021-07-202-90/+76
| | | | | | | | Update Kernel config and set Linux 5.10 for mediatek/mt7623. (patches have already been updated to 5.10 when mt7622 was bumped) Tested on Bananapi BPi-R2. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* kernel: bump 5.10 to 5.10.51Rui Salvaterra2021-07-2014-30/+30
| | | | | | No deleted or manually refreshed patches. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* x86: include kmod-fs-vfat by default in generic imagesDaniel Golle2021-07-202-2/+2
| | | | | | | | | As x86/64 and x86/generic may be using UEFI, mounting the FAT-32 /boot is necessary in order not to loose configuration files accross sysupgrades. Include kmod-fs-vfat by default to make sure /boot can always be mounted. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* bmips: convert mtd-mac-address to nvmem implementationAnsuel Smith2021-07-196-13/+82
| | | | | | | Define nvmem-cells and convert mtd-mac-address to nvmem implementation. The conversion is done with an automated script. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* ipq40xx: convert mtd-mac-address to nvmem implementationAnsuel Smith2021-07-192-4/+32
| | | | | | | Define nvmem-cells and convert mtd-mac-address to nvmem implementation. The conversion is done with an automated script. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* mediatek: convert mtd-mac-address to nvmem implementationAnsuel Smith2021-07-195-12/+89
| | | | | | | Define nvmem-cells and convert mtd-mac-address to nvmem implementation. The conversion is done with an automated script. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* mpc85xx: convert mtd-mac-address to nvmem implementationAnsuel Smith2021-07-192-3/+26
| | | | | | | Define nvmem-cells and convert mtd-mac-address to nvmem implementation. The conversion is done with an automated script. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* octeon: convert mtd-mac-address to nvmem implementationAnsuel Smith2021-07-193-9/+46
| | | | | | | Define nvmem-cells and convert mtd-mac-address to nvmem implementation. The conversion is done with an automated script. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* ramips: convert mtd-mac-address to nvmem implementationAnsuel Smith2021-07-19319-434/+4213
| | | | | | | Define nvmem-cells and convert mtd-mac-address to nvmem implementation. The conversion is done with an automated script. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* ath79: convert mtd-mac-address to nvmem implementationAnsuel Smith2021-07-19177-364/+2637
| | | | | | | Define nvmem-cells and convert mtd-mac-address to nvmem implementation. The conversion is done with an automated script. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* mvebu: convert mtd-mac-address to nvmem implementationAnsuel Smith2021-07-191-3/+20
| | | | | | | Define nvmem-cells and convert mtd-mac-address to nvmem implementation. The conversion is done with an automated script. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* lantiq: convert mtd-mac-address to nvmem implementationAnsuel Smith2021-07-1921-30/+270
| | | | | | | Define nvmem-cells and convert mtd-mac-address to nvmem implementation. The conversion is done with an automated script. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* ipq806x: convert mtd-mac-address to nvmem implementationAnsuel Smith2021-07-1911-26/+196
| | | | | | | Define nvmem-cells and convert mtd-mac-address to nvmem implementation. The conversion is done with an automated script. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* treewide: convert mtd-mac-address-increment* to generic implementationAnsuel Smith2021-07-19158-242/+507
| | | | | | | | | | | | | Rework patch 681-NET-add-mtd-mac-address-support to implement only the function to read the mac-address from mtd. Generalize mtd-mac-address-increment function so it can be applied to any source of of_get_mac_address. Rename any mtd-mac-address-increment to mac-address-increment. Rename any mtd-mac-address-increment-byte to mac-address-increment-byte. This should make simplify the conversion of target to nvmem implementation. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* x86: kernel: set NR_CPUS to 512Edgar Su2021-07-182-4/+4
| | | | | | | | | | NR_CPUS limits the number of CPUs supported to 8. This makes total sense on hardware-restircted platforms, but not on x86_64, where CPUs with more than 8 cores can be easily acquired and with less physical limitaions. see also: https://forum.openwrt.org/t/x86-64-8-cpu-limitation-on-vanilla-release/100946 Signed-off-by: Edgar Su <sjs333@outlook.com>
* generic: add missing symbolDavid Bauer2021-07-172-0/+2
| | | | | | | | | When compiling with all modules enabled, Kconfig complains about CONFIG_I2C_DESIGNWARE_SLAVE being unset. Disable this symbol by default. Fixes commit e9c9b5ec72e4 ("kernel: package Synopsys Designware PCI to I2C controller") Signed-off-by: David Bauer <mail@david-bauer.net>
* ipq40xx: fix FRITZRepeater 1200 RGMII delayDavid Bauer2021-07-171-1/+1
| | | | | | | | | | | | | | When the AVM FRITZ!Repeater 1200 was introduced on Kernel 4.19, the at803x PHY driver incorrectly set up the delays, not disabling delays set by the bootloader. The PHY was always operating with RX as well as TX delays enabled, but with kernel 5.4 and later, the required TX delay is disabled, breaking ethernet operation. Correct the PHY mode, so the driver enables both delays. Signed-off-by: David Bauer <mail@david-bauer.net>
* kernel: bump 5.10 to 5.10.50Rui Salvaterra2021-07-1713-19/+19
| | | | | | No deleted or manually refreshed patches. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* kernel: bump 5.10 to 5.10.49Rui Salvaterra2021-07-171-1/+1
| | | | | | No deleted or manually refreshed patches. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* kernel: bump 5.10 to 5.10.48Rui Salvaterra2021-07-171-1/+1
| | | | | | No deleted or manually refreshed patches. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* kernel: bump 5.10 to 5.10.47Rui Salvaterra2021-07-172-5/+5
| | | | | | No deleted or manually refreshed patches. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* kernel: bump 5.4 to 5.4.132John Audia2021-07-1733-116/+116
| | | | | | | | | | | | | | | Manually rebased: layerscape/patches-5.4/805-display-0002-drm-rockchip-prepare-common-code-for-cdns-and-rk-dpi.patch All other patches automatically rebased. Build system: x86_64 Build-tested: ipq806x/R7800 Run-tested: ipq806x/R7800 No dmesg regressions, everything functional Signed-off-by: John Audia <graysky@archlinux.us>
* kernel: bump 5.4 to 5.4.130John Audia2021-07-171-1/+1
| | | | | | | | | | | | All patches automatically rebased. Build system: x86_64 Build-tested: ipq806x/R7800 Run-tested: ipq806x/R7800 No dmesg regressions, everything functional Signed-off-by: John Audia <graysky@archlinux.us>
* kernel: bump 5.4 to 5.4.129John Audia2021-07-177-12/+12
| | | | | | | | | | | | All patches automatically rebased. Build system: x86_64 Build-tested: ipq806x/R7800 Run-tested: ipq806x/R7800 No dmesg regressions, everything functional Signed-off-by: John Audia <graysky@archlinux.us>
* ramips: fix Wifi MAC address setup for D-Link DIR-853 R1Adrian Schmutzler2021-07-121-3/+3
| | | | | | | | Commands in 10_fix_wifi_mac were not properly concatenated, so this was also triggered for the second phy without giving a MAC address as argument. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ramips: add support for D-Link DIR-853 A3Karim Dehouche2021-07-125-3/+223
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifications: * SoC: MT7621AT * RAM: 256MB * Flash: 128MB NAND flash * WiFi: MT7615DN (2.4GHz+5Ghz) with DBDC * LAN: 5x1000M * Firmware layout is Uboot with extra 96 bytes in header * Base PCB is DIR-1360 REV1.0 * LEDs Power Blue+Orange,Wan Blue+Orange,WPS Blue,"2.4G"Blue, "5G" Blue, USB Blue * Buttons Reset,WPS, Wifi MAC addresses on OEM firmware: lan factory 0xe000 f4:*:*:a8:*:65 (label) wan factory 0xe006 f4:*:*:a8:*:68 2.4 GHz [not on flash] f6:*:*:c8:*:66 5.0 GHz factory 0x4 f4:*:*:a8:*:66 The increment of the 4th byte for the 2.4g address appears to vary. Reported cases: 5g 2.4g increment f4:XX:XX:a8:XX:66 f6:XX:XX:c8:XX:66 +0x20 x0:xx:xx:68:xx:xx x2:xx:xx:48:xx:xx -0x20 x4:xx:xx:6a:xx:xx x6:xx:xx:4a:xx:xx -0x20 Since increment is inconsistent and there is no obvious pattern in swapping bytes, and the 2.4g address has local bit set anyway, it seems safer to use the LAN address with flipped byte here in order to prevent collisions between OpenWrt devices and OEM devices for this interface. This way we at least use an address as base that is definitely owned by the device at hand. Flashing instruction: The Dlink "Emergency Room" cannot be accessed through the reset button on this device. You can either use console or use the encrypted factory image availble in the openwrt forum. Once the encrypted image is flashed throuh the stock Dlink web interface, the sysupgrade images can be used. Header pins needs to be soldered near the WPS and Wifi buttons. The layout for the pins is (VCC,RX,TX,GND). No need to connect the VCC. the settings are: Bps/Par/Bits : 57600 8N1 Hardware Flow Control : No Software Flow Control : No Connect your client computer to LAN1 of the device Set your client IP address manually to 192.168.0.101 / 255.255.255.0. Call the recovery page or tftp for the device at http://192.168.0.1 Use the provided emergency web GUI to upload and flash a new firmware to the device At the time of adding support the wireless config needs to be set up by editing the wireless config file: * Setting the country code is mandatory, otherwise the router loses connectivity at the next reboot. This is mandatory and can be done from luci. After setting the country code the router boots correctly. A reset with the reset button will fix the issue and the user has to reconfigure. * This is minor since the 5g interface does not come up online although it is not set as disabled. 2 options here: 1- Either run the "wifi" command. Can be added from LUCI in system - startup - local startup and just add wifi above "exit 0". 2- Or add the serialize option in the wireless config file as shown below. This one would work and bring both interfaces automatically at every boot: config wifi-device 'radio0' option serialize '1' config wifi-device 'radio1' option serialize '1' Signed-off-by: Karim Dehouche <karimdplay@gmail.com> [rebase, improve MAC table, update wireless config comment, fix 2.4g macaddr setup] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: add support for TP-Link RE455 v1Roberto Valentini2021-07-115-2/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link RE455 v1 is a dual band router/range-extender based on Qualcomm/Atheros QCA9563 + QCA9880. This device is nearly identical to RE450 v3 Specification: - 775 MHz CPU - 64 MB of RAM (DDR2) - 8 MB of FLASH (SPI NOR) - 3T3R 2.4 GHz - 3T3R 5 GHz - 1x 10/100/1000 Mbps Ethernet (AR8033 PHY) - 7x LED, 4x button - UART header on PCB[1] Flash instruction: Apply factory image in OEM firmware web-gui. [1] Didn't work, probably need to short unpopulated resistor R64 and R69 as RE450v3 Signed-off-by: Roberto Valentini <valantin89@gmail.com>
* ramips: add support for Linksys EA8100 v2Tee Hao Wei2021-07-117-4/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifications: - SoC: MT7621AT - RAM: 256MB - Flash: 128MB NAND - Ethernet: 5 Gigabit ports - WiFi: 2.4G/5G MT7615N - USB: 1 USB 3.0, 1 USB 2.0 This device is very similar to the EA7300 v1/v2, EA7500 v2, and EA8100 v1. Installation: Upload the generated factory image through the factory web interface. (following part taken from EA7300 v2 commit message:) This might fail due to the A/B nature of this device. When flashing, OEM firmware writes over the non-booted partition. If booted from 'A', flashing over 'B' won't work. To get around this, you should flash the OEM image over itself. This will then boot the router from 'B' and allow you to flash OpenWRT without problems. Reverting to factory firmware: Hard-reset the router three times to force it to boot from 'B.' This is where the stock firmware resides. To remove any traces of OpenWRT from your router simply flash the OEM image at this point. With thanks to Tom Wizetek (@wizetek) for testing. Signed-off-by: Tee Hao Wei <angelsl@in04.sg>
* ipq40xx: increase SPI frequency for Zyxel NBG6617Dmitry Tunin2021-07-111-3/+3
| | | | | | | | | | | | The mx25l25635f supports clock speed up to 50Mhz. Also remove obsolete "mx25l25635f" hack and rename the matching device-tree flash node. Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com> [mention node rename as well. chip is very very likely always the "f" revision for all NBG6617] Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* ramips: mt7628an: remove redundant console setup for bootargsAdrian Schmutzler2021-07-102-8/+0
| | | | | | This is already set in mt7628an.dtsi Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ramips: add support for D-Link DIR-853-R1Stas Fiduchi2021-07-104-0/+161
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR adds support for router D-Link DIR-853-R1 Specifications: SoC: MT7621AT RAM: 128MB Flash: 16MB SPI WiFi: MT7615DN (2.4GHz+5Ghz) with DBDC (This mode allows this single chip act as an 2x2 11n radio and an 2x2 11ac radio at the same time) LAN: 5x1000M LEDs Power Blue+Orange,Wan Blue+Orange,WPS Blue,"2.4G"Blue, "5G" Blue USB Blue Buttons Reset,WPS, Wifi MAC addresses: |Interface | MAC | Factory |Comment |------------|-----------------|-------------|---------------- |WAN sticker |C4:XX:XX:6E:XX:2A| |Sticker |LAN |C4:XX:XX:6E:XX:2B| | |Wifi (5g) |C4:XX:XX:6E:XX:2C|0x4 | |Wifi (2.4g) |C6:XX:XX:7E:XX:2C| | | | | | | |C4:XX:XX:6E:XX:2E|0x8004 0xe000| | |C4:XX:XX:6E:XX:2F|0xe006 | The increment of the 4th byte for the 2.4g address appears to vary. Reported cases: 5g 2.4g increment C4:XX:XX:6E:XX:2C C6:XX:XX:7E:XX:2C 0x10 f4:XX:XX:16:XX:32 f6:XX:XX:36:XX:32 0x20 F4:XX:XX:A6:XX:E3 F6:XX:XX:B6:XX:E3 0x10 Since increment is inconsistent and there is no obvious pattern in swapping bytes, and the 2.4g address has local bit set anyway, it seems safer to use the LAN address with flipped byte here in order to prevent collisions between OpenWrt devices and OEM devices for this interface. This way we at least use an address as base that is definitely owned by the device at hand. Flashing instruction: The Dlink "Emergency Room" Connect your client computer to LAN1 of the device Set your client IP address manually to 192.168.0.101 / 255.255.255.0. Then, power down the router, press and hold the reset button, then re-plug it. Keep the reset button pressed until the internet LED stops flashing Call the recovery page or tftp for the device at http://192.168.0.1 Use the provided emergency web GUI to upload and flash a new firmware to the device. Signed-off-by: Stas Fiduchi <fiduchi@protonmail.com> [commit title/message improvements, use correct label MAC address, calculate MAC addresses based on 0x4, minor DTS style fixes, add uart2 to state_default, remove factory image, add 2.4g MAC address, use partition DTSI, add macaddr comment in DTS] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* treewide: call check-size before append-metadataAdrian Schmutzler2021-07-1023-75/+64
| | | | | | | | | | sysupgrade metadata is not flashed to the device, so check-size should be called _before_ adding metadata to the image. While at it, do some obvious wrapping improvements. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> Acked-by: Paul Spooren <mail@aparcar.org>
* ath79: add missing MTD_NAND_RB91X symbolKoen Vandeputte2021-07-091-0/+1
| | | | | | | Looks like the symbol was forgotten for 5.4 Fixes: 820e660cd7 ("ath79: add NAND driver for MikroTik RB91xG series") Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* mediatek: prevent duplicate hardware flow offload entriesFelix Fietkau2021-07-081-0/+26
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* kernel: backport a few upstream flow offloading fixesFelix Fietkau2021-07-088-6/+570
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* ramips: minew g1-c: add the old device name to the supported devicesAlexander Couzens2021-07-071-0/+1
| | | | | | | Allow to use the sysupgrade image as factory image without additional force. Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
* ath79: increase SPI frequency for OCEDO boardsDavid Bauer2021-07-073-3/+3
| | | | | | | | | | The MX25L12805D used on all ath79 OCEDO boards supports clock speeds up to 50 MHz. Thus, we can increase the maximum SPI frequency the flash chip is controlled at to 50 MHz, increasing transfer speed. Signed-off-by: David Bauer <mail@david-bauer.net>
* ath79: increase WS-AP3610 SPI frequencyDavid Bauer2021-07-071-1/+1
| | | | | | | | The M25P80 used on the Siemens WS-AP3610 supports clock speeds up to 54 MHz. Thus, we can safely increase the maximum SPI frequency the flash chip is controlled at to 50 MHz, increasing transfer speed. Signed-off-by: David Bauer <mail@david-bauer.net>
* ramips: add support for minew g1-cAlexander Couzens2021-07-053-0/+159
| | | | | | | | | | | | | | | | | | | | | | The minew g1-c is a smart home gateway / BLE gateway. A Nordic nRF52832 is available via USB UART (cp210x) to support BLE. The LED ring is a ring of 24x ws2812b connect to a generic GPIO (unsupported). There is a small LED which is only visible when the device is open which will be used as LED until the ws2812b is supported. The board has also a micro sdcard/tfcard slot (untested). The Nordic nRF52832 exposes SWD over a 5pin header (GND, VCC, SWD, SWC, RST). The vendor uses an older OpenWrt version, sysupgrade can be used via serial or ssh. CPU: MT7628AN / 580MHz RAM: DDR2 128 MiB RAM Flash: SPI NOR 16 MiB W25Q128 Ethernet: 1x 100 mbit (Port 0) (PoE in) USB: USB hub, 2x external, 1x internal to USB UART Power: via micro usb or PoE 802.11af UART: 3.3V, 115200 8n1 Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
* ath79: base-files: fix broken network configPetr Štetiar2021-07-051-1/+1
| | | | | | | | | | | | | | Fix bash syntax error introduced in commit cce2e8db564b ("ath79: add support for TP-Link TL-WR941HP v1") which resulted in broken default network configuration. In target/linux/ath79/generic/base-files/etc/board.d/02_network line 402: tplink,tl-wr842n-v2)\ ^-- SC1073: Couldn't parse this case item. Fix to allow more checks. References: https://gitlab.com/ynezz/openwrt-device-runtime-testing/-/jobs/1398837698/artifacts/file/cram-result-archer-c7-v5-initramfs.txt Fixes: cce2e8db564b ("ath79: add support for TP-Link TL-WR941HP v1") Signed-off-by: Petr Štetiar <ynezz@true.cz>
* ath79: add support for Xiaomi AIoT Router AC2350Evgeniy Isaev2021-07-055-1/+199
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device specifications * SoC: QCA9563 @ 775MHz (MIPS 74Kc) * RAM: 128MiB DDR2 * Flash: 16MiB SPI-NOR (EN25QH128) * Wireless 2.4GHz (SoC): b/g/n, 3x3 * Wireless 5Ghz (QCA9988): a/n/ac, 4x4 MU-MIMO * IoT Wireless 2.4GHz (QCA6006): currently unusable * Ethernet (AR8327): 3 LAN × 1GbE, 1 WAN × 1GbE * LEDs: Internet (blue/orange), System (blue/orange) * Buttons: Reset * UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1) * Power: 12VDC, 1,5A MAC addresses map (like in OEM firmware) art@0x0 88:C3:97:*:57 wan/label art@0x1002 88:C3:97:*:2D lan/wlan2g art@0x5006 88:C3:97:*:2C wlan5g Obtain SSH Access 1. Download and flash the firmware version 1.3.8 (China). 2. Login to the router web interface and get the value of `stok=` from the URL 3. Open a new tab and go to the following URL (replace <STOK> with the stok value gained above; line breaks are only for easier handling, please put together all four lines into a single URL without any spaces): http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev ?bssid=any&user_id=any&ssid=-h%0Anvram%20set%20ssh_en%3D1%0Anvram%20commit %0Ased%20-i%20%27s%2Fchannel%3D.%2A%2Fchannel%3D%5C%5C%22debug%5C%5C%22%2F g%27%20%2Fetc%2Finit.d%2Fdropbear%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A 4. Wait 30-60 seconds (this is the time required to generate keys for the SSH server on the router). Create Full Backup 1. Obtain SSH Access. 2. Create backup of all flash (on router): dd if=/dev/mtd0 of=/tmp/ALL.backup 3. Copy backup to PC (on PC): scp root@192.168.31.1:/tmp/ALL.backup ./ Tip: backup of the original firmware, taken three times, increases the chances of recovery :) Calculate The Password * Locally using shell (replace "12345/E0QM98765" with your router's serial number): On Linux printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | \ md5sum - | head -c8 && echo On macOS printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | \ md5 | head -c8 * Locally using python script (replace "12345/E0QM98765" with your router's serial number): wget https://raw.githubusercontent.com/eisaev/ax3600-files/master/scripts/calc_passwd.py python3.7 -c 'from calc_passwd import calc_passwd; print(calc_passwd("12345/E0QM98765"))' * Online https://www.oxygen7.cn/miwifi/ Debricking (lite) If you have a healthy bootloader, you can use recovery via TFTP using programs like TinyPXE on Windows or dnsmasq on Linux. To switch the router to TFTP recovery mode, hold down the reset button, connect the power supply, and release the button after about 10 seconds. The router must be connected directly to the PC via the LAN port. Debricking You will need a full dump of your flash, a CH341 programmer, and a clip for in-circuit programming. Install OpenWRT 1. Obtain SSH Access. 2. Create script (on router): echo '#!/bin/sh' > /tmp/flash_fw.sh echo >> /tmp/flash_fw.sh echo '. /bin/boardupgrade.sh' >> /tmp/flash_fw.sh echo >> /tmp/flash_fw.sh echo 'board_prepare_upgrade' >> /tmp/flash_fw.sh echo 'mtd erase rootfs_data' >> /tmp/flash_fw.sh echo 'mtd write /tmp/openwrt.bin firmware' >> /tmp/flash_fw.sh echo 'sleep 3' >> /tmp/flash_fw.sh echo 'reboot' >> /tmp/flash_fw.sh echo >> /tmp/flash_fw.sh chmod +x /tmp/flash_fw.sh 3. Copy `openwrt-ath79-generic-xiaomi_aiot-ac2350-squashfs-sysupgrade.bin` to the router (on PC): scp openwrt-ath79-generic-xiaomi_aiot-ac2350-squashfs-sysupgrade.bin \ root@192.168.31.1:/tmp/openwrt.bin 4. Flash OpenWRT (on router): /bin/ash /tmp/flash_fw.sh & 5. SSH connection will be interrupted - this is normal. 6. Wait for the indicator to turn blue. Signed-off-by: Evgeniy Isaev <isaev.evgeniy@gmail.com> [improve commit message formatting slightly] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-30 06:39:17 +0000