aboutsummaryrefslogtreecommitdiffstats
path: root/target
Commit message (Collapse)AuthorAgeFilesLines
* realtek: rename rtl838x_reg structureBirger Koblitz2022-02-172-6/+6
| | | | | | | | Rename the SoC-specific rtl838x_reg structure in the Ethernet driver to avoid confusion with the structure of the same name in the DSA driver. New name is: rtl838x_eth_reg Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Fix RTL839x TX CPU-TagBirger Koblitz2022-02-171-2/+2
| | | | | | | | | | Setting bits 20 and 23 in a u16 is obviously wrong. According to https://www.svanheule.net/realtek/cypress/cputag cpu_tag[2] starts at bit 48 in the cpu-tag structure, so bit 43 is bit 5 in cpu_tag[2] and bit 40 is bit 8 in cpu_tag[2]. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Increase zone size for Ethernet driver DMABirger Koblitz2022-02-173-2/+4
| | | | | | | | | | Set CONFIG_FORCE_MAX_ZONEORDER setting to 13 to allow larger contiguous memory allocation for the DMA of the Ethernet driver. Increase the number of entries in the RX ring to 300 making use of the larger DMA region now possible for receiveing packets. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Add support for ZyXEL GS1900-48 SwitchBirger Koblitz2022-02-173-1/+340
| | | | | | | | | | | | | | | | | | | | | | | | The GS1900-48 is a 48 + 2 port Gigabit L2 switch with 48 gigabit ports. Hardware: RTL8393M SoC Macronix MX25l12805D (16MB flash) 128MB RAM 6 * RTL8218B external PHY 2 * RTL8231 GPIO extenders to control the port LEDs, system LED and Reset button 2 Uplink ports are SFP cages which support 1000 Base-X mini GBIC modules. Power is supplied via a 230 volt mains connector. The board has a hard reset switch SW1, which is is not reachable from the outside. J4 provides a 12V RS232 serial connector which is connected through U8 to the 3.3V UART of the RTL8393. Conversion is done by U8, a SIPEX 3232EC. To connect to the UART, wires can be soldered to R603 (TX) and R602 (RX). Installation: Install the squashfs image via Realtek's original Web-Interface. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Update rtl839x.dtsi for realtek,rtl-intc, new gpio controller ↵Birger Koblitz2022-02-171-0/+225
| | | | | | | | | | | | | | | | remove RTL8231 node Update the IRQ configuration to work with the new rtl-intc controller. Also change all KSEG1 addresses in reg = <> of the devics to physical addresses. Use the new gpio-otto controller instead of the legacy driver. Also remove the memory node as this is better put into a device .dts. Also remove the RTL8231 GPIO controller node from this base file since the chip might not be found in all Realtek RTL839x devices. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Update RTL838X DTS to new Realtek IRQ controller notationBirger Koblitz2022-02-171-26/+13
| | | | | | | | Replace the interrupt controller node with the new realtek,rtl-intc node and change all device interrupts to use the 2 field notation: interrupts = <[SoC IRQ] [Index to MIPS IRQ]> Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Add VPE support for the IRQ driverBirger Koblitz2022-02-171-0/+393
| | | | | | | | In order to support VSMP, enable support for both VPEs of the RTL839X and RTL930X SoCs in the irq-realtek-rtl driver. Add support for IRQ affinity setting. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Add kernel config for RTL839x SoCsBirger Koblitz2022-02-171-0/+202
| | | | | | | Adds a dedicated kernel configuration for RTL839X SoCs enabling SMP. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Enable Multithreading support in prom.cBirger Koblitz2022-02-171-0/+20
| | | | | | Adds Multithreading support functions in prom.c. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Change Platform defines to depend on CONFIG_RTL83XXBirger Koblitz2022-02-171-2/+2
| | | | | | | In order for the Platform includes to be available on all sub-targets, make them dependent on CONFIG_RTL83XX. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Optimize kernel configuration for RTL838XBirger Koblitz2022-02-171-5/+3
| | | | | | | The RTL838X SoCs do not use Aquantia PHYs, remove this. Also the RTL838X uses a high resolution R4K timer. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Create 4 different Realtek PlatformsBirger Koblitz2022-02-1710-19/+65
| | | | | | | | Creates RTL83XX as a basic kernel config parameter for the RTL838X, RTL839x, RTL930X and RTL931X platforms with respective configurations for the SoCs, which are introduced in addition. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Create rtl838x sub-target specific makefilesBirger Koblitz2022-02-173-128/+129
| | | | | | | | Create the RTL838x specific Makefiles. Move CPU-type into rtl838x.mk as this is specifc to that platform. Add rtl838x subtarget into main Makefile. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Add initial kernel config for RTL838x sub-targetBirger Koblitz2022-02-171-0/+0
| | | | | | Move the generic kernel configs to the rtl838x sub-target. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Add Makefile for RTL839x sub-architectureBirger Koblitz2022-02-171-0/+13
| | | | | | Adds the initial Makefile for the RTL839x sub-architecture. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Set RTL838X sub-target specific propertiesBirger Koblitz2022-02-171-1/+15
| | | | | | | This defines the sub-target specific properties for the RTL838X sub-target. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Create rtl838x subtargetBirger Koblitz2022-02-171-0/+0
| | | | | | | mv generic/target.mk to rtl838x/target.mk in order to create an initial makefile for the rtl838x sub-architecture Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Add support for SFP EEPROM-access over SMBusBirger Koblitz2022-02-174-0/+294
| | | | | | | | | | | | | | | | | The EEPROMs on SFP modules are compatible both to I2C as well as SMBus. However, the kernel so far only supports I2C access. We add SMBus access routines, because the I2C driver for the RTL9300 HW only supports that protocol. At the same time we disable I2C access to PHYs on SFP modules as otherwise detection of any SFP module would fail. This is not in any way problematic at this point in time since the RTL93XX platform so far does not support PHYs on SFP modules. The patches are copied and rebased version of: https://bootlin.com/blog/sfp-modules-on-a-board-running-linux/ Signed-off-by: Daniel Golle <daniel@makrotopia.org> Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Add support for RTL9300/RTL9310 I2C multiplexingBirger Koblitz2022-02-174-37/+359
| | | | | | | | | | | | The RTL9300/RTL9310 I2C controllers have support for 2 independent I2C masters, each with a fixed SCL pin, that cannot be changed. Each of these masters can use 8 (RTL9300) or 16 (RTL9310) different pins for SDA. This multiplexer directly controls the two masters and their shared IO configuration registers to allow multiplexing between any of these busses. The two masters cannot be used in parallel as the multiplex is protected by a standard multiplex lock. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Add support for RTL9300/RTL9310 I2C controllerBirger Koblitz2022-02-174-0/+581
| | | | | | | | | | This adds support for the RTL9300 and RTL9310 I2C controller. The controller implements the SMBus protocol for SMBus transfers over an I2C bus. The driver supports selecting one of the 2 possible SCL pins and any of the 8 possible SDA pins. Bus speeds of 100kHz (standard speed) and 400kHz (high speed I2C) are supported. Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: remove legacy GPIO driver supportBirger Koblitz2022-02-173-500/+0
| | | | | | | This patch removes support for the legacy GPIO driver, since now the gpio-otto driver can be used on all platforms Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: Add GPIO support for RTL930X and RTL931XBirger Koblitz2022-02-171-0/+165
| | | | | | | | We add support for the RTL930X and RTL931X architectures in the gpio-realtek-otto.c driver. Signed-off-by: Sebastian Gottschall <s.gottschall@dd-wrt.com> Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
* realtek: drop support for Linux 5.4Daniel Golle2022-02-1763-16843/+0
| | | | | | | Drop patches and files for Linux 5.4 now that we've been using 5.10 for a while and support for Linux 5.4 has gone out-of-sync. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ath25: drop Linux 5.4 supportRui Salvaterra2022-02-1713-3843/+0
| | | | | | We've been bumped to 5.10, no need to carry this stuff anymore. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* ramips: fix NAND flash driver ECC bit position maskFelix Fietkau2022-02-161-1/+1
| | | | | | | | The bit position mask was accidentally made too wide, overlapping with the LSB from the byte position mask. This caused ECC calculation to fail for odd bytes Signed-off-by: Chad Monroe <chad.monroe@smartrg.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
* kernel: backport fix for initializing skb->cb in the bridge code to 5.4Felix Fietkau2022-02-162-2/+30
| | | | | | Fixes issues with proxyarp Signed-off-by: Felix Fietkau <nbd@nbd.name>
* bcm4908: backport watchdog and I2C changesRafał Miłecki2022-02-1616-26/+282
| | | | Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* kernel: fix a race condition leading to a crash in hw flow offloadingFelix Fietkau2022-02-141-5/+6
| | | | | | | flowtable->net was initialized too late, and this could be triggered even without hardware offload support on the device Signed-off-by: Felix Fietkau <nbd@nbd.name>
* kernel: fix copy&paste mistake in bridge offload codeFelix Fietkau2022-02-141-1/+1
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* ramips: mt7621: do memory detection on KSEG1Chuanhong Guo2022-02-141-0/+58
| | | | | | | | | | | | | | | | | | | | It's reported that current memory detection code occasionally detects larger memory under some bootloaders. Current memory detection code tests whether address space wraps around on KSEG0, which is unreliable because it's cached. Rewrite memory size detection to perform the same test on KSEG1 instead. While at it, this patch also does the following two things: 1. use a fixed pattern instead of a random function pointer as the magic value. 2. add an additional memory write and a second comparison as part of the test to prevent possible smaller memory detection result due to leftover values in memory. Fixes: 6d91ddf517 ("ramips: mt7621: add support for memory detection") Reported-by: Rui Salvaterra <rsalvaterra@gmail.com> Tested-by: Rui Salvaterra <rsalvaterra@gmail.com> Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
* kernel: remove 640-bridge-only-accept-EAP-locally.patchFelix Fietkau2022-02-122-164/+0
| | | | | | | The issue of EAP frames sent to group address (or the wrong address) has been addressed in mac80211, so this hack is no longer needed Signed-off-by: Felix Fietkau <nbd@nbd.name>
* kernel: add a fast path for the bridge codeFelix Fietkau2022-02-122-4/+821
| | | | | | | | | This caches flows between MAC addresses on separate ports, including their VLAN in order to bypass the normal bridge forwarding code. In my test on MT7622, this reduces LAN->WLAN bridging CPU usage by 6-10%, potentially even more on weaker platforms Signed-off-by: Felix Fietkau <nbd@nbd.name>
* kernel: bump 5.10 to 5.10.100John Audia2022-02-116-9/+9
| | | | | | | | | | All patches automatically rebased. Build system: x86_64 Build-tested: bcm2711/RPi4B, mt7622/RT3200 Run-tested: bcm2711/RPi4B, mt7622/RT3200 Signed-off-by: John Audia <graysky@archlinux.us>
* kernel: bump 5.10 to 5.10.99John Audia2022-02-115-56/+5
| | | | | | | | | | | | | | | | | | | | Had to update generic defconfig (make kernel_menuconfig CONFIG_TARGET=generic) for this bump, but since that only modifies the target defined in .config, and since that target also needed to be updated for unrelated reasons, manually propagated the newly added symbol to the generic config. Removed upstreamed: pending-5.10/860-Revert-ASoC-mediatek-Check-for-error-clk-pointer.patch[1] All other patches automatically rebased. 1. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.10.99&id=080f371d984e8039c66db87f3c54804b0d172329 Build system: x86_64 Build-tested: bcm2711/RPi4B, mt7622/RT3200 Run-tested: bcm2711/RPi4B, mt7622/RT3200 Signed-off-by: John Audia <graysky@archlinux.us>
* kernel: bump 5.10 to 5.10.98John Audia2022-02-1125-90/+66
| | | | | | | | | | | | | Manually rebased: bcm27xx/patches-5.10/950-0675-drm-vc4-hdmi-Drop-devm-interrupt-handler-for-CEC-int.patch All other patches automatically rebased. Build system: x86_64 Build-tested: bcm2711/RPi4B, mt7622/RT3200 Run-tested: bcm2711/RPi4B, mt7622/RT3200 Signed-off-by: John Audia <graysky@archlinux.us>
* ramips: add support for ELECOM WRC-2533GS2INAGAKI Hiroshi2022-02-112-0/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ELECOM WRC-2533GS2 is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on MT7621A. Specification: - SoC : MediaTek MT7621A - RAM : DDR3 128 MiB (NT5CC64M16GP-DI) - Flash : SPI-NOR 16 MiB (MX25L12835FM2I-10G) - WLAN : 2.4/5GHz 4T4R (2x MediaTek MT7615) - Ethernet : 10/100/1000 Mbps x5 - Switch : MediaTek MT7530 (SoC) - LEDs/Keys : 4x/6x (2x buttons, 1x slide-switch) - UART : through-hole on PCB - J4: 3.3V, GND, TX, RX from ethernet port side - 57600n8 - Power : 12 VDC, 1.5 A Flash instruction using factory image: 1. Boot WRC-2533GS2 normally with "Router" mode 2. Access to "http://192.168.2.1/" and open firmware update page ("ファームウェア更新") 3. Select the OpenWrt factory image and click apply ("適用") button 4. Wait ~120 seconds to complete flashing MAC Addresses: LAN : 04:AB:18:xx:xx:FB (Factory, 0xFFF4 (hex)) WAN : 04:AB:18:xx:xx:FC (Factory, 0xFFFA (hex)) 2.4 GHz : 04:AB:18:xx:xx:FD (Factory, 0x4 (hex)) 5 GHz : 04:AB:18:xx:xx:FE (Factory, 0x8004 (hex)) Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
* ramips: move MAC configs to device dts from wrc-gs-2pci.dtsiINAGAKI Hiroshi2022-02-117-24/+144
| | | | | | | | | | | | | | | | | | | | | | The locations of MAC addresses in mtd for LAN/WAN on ELECOM WRC-2533GS2 are changed from the other WRC-GS/GST devices with 2x PCIe. So move the related configurations in mt7621_elecom_wrc-gs-2pci.dtsi to dts of each model. - WRC-1750GS - WRC-1750GSV - WRC-1750GST2 - WRC-1900GST - WRC-2533GST - WRC-2533GST2 -> LAN: 0xE000, WAN: 0xE006 - WRC-2533GS2 -> LAN: 0xFFF4, WAN: 0xFFFA Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
* ramips: update WLAN MAC address of ipTIME A3004TSungbo Eo2022-02-111-0/+6
| | | | | | | | | | | | | | | | Reported MAC addresses: | interface | MAC address | source | comment |-----------|-------------------|----------------|--------- | LAN | 90:xx:xx:18:xx:1F | | [1] | WAN | 90:xx:xx:18:xx:1D | | | WLAN 2G | 92:xx:xx:48:xx:1C | | | WLAN 5G | 90:xx:xx:18:xx:1C | factory 0x4 | | | 90:xx:xx:18:xx:1C | config ethaddr | [1] Used in this patch as WLAN 2G MAC address with the local bit set Signed-off-by: Sungbo Eo <mans0n@gorani.run>
* ramips: add support for ipTIME AX2004MSungbo Eo2022-02-114-0/+192
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ipTIME AX2004M is an 802.11ax (Wi-Fi 6) router, based on MediaTek MT7621A. Specifications: * SoC: MT7621A * RAM: 256 MiB * Flash: NAND 128 MiB * Wi-Fi: * MT7915D: 2.4/5 GHz (DBDC) * Ethernet: 5x 1GbE * Switch: SoC built-in * USB: 1x 3.0 * UART: J4 (115200 baud) * Pinout: [3V3] (TXD) (RXD) (GND) MAC addresses: | interface | MAC address | source | comment |-----------|-------------------|----------------|--------- | LAN | 58:xx:xx:00:xx:9B | | [1] | WAN | 58:xx:xx:00:xx:99 | | | WLAN 2G | 58:xx:xx:00:xx:98 | factory 0x4 | | WLAN 5G | 5A:xx:xx:40:xx:98 | | | | 58:xx:xx:00:xx:98 | config ethaddr | [1] Used in this patch as WLAN 5G MAC address with the local bit set Load addresses: * stock * 0x80010000: FIT image * 0x81001000: kernel image -> entry * OpenWrt * 0x80010000: FIT image * 0x82000000: uncompressed kernel+relocate image * 0x80001000: relocated kernel image -> entry Notes: * This device has a dual-boot partition scheme, but this firmware works only on boot partition 1. The stock web interface will flash only on the inactive boot partition, but the recovery web page will always flash on boot partition 1. Installation via recovery mode: 1. Press reset button, power up the device, wait >10s for CPU LED to stop blinking. 2. Upload recovery image through the recovery web page at 192.168.0.1. Revert to stock firmware: 1. Install stock image via recovery mode. Signed-off-by: Sungbo Eo <mans0n@gorani.run>
* octeon: switch to Kernel 5.10Paul Spooren2022-02-111-2/+1
| | | | | Acked-by: Stijn Tintel <stijn@linux-ipv6.be> Signed-off-by: Paul Spooren <mail@aparcar.org>
* target/linux: add missing symbolRosen Penev2022-02-111-0/+1
| | | | | | Found when building the qoriq target. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* mt7622: linksys-e8450: enable using mt7531 switch irqDaniel Golle2022-02-101-0/+4
| | | | | | | | Turns out the MT7531 switch IRQ line is connected to GPIO#53 just like on the BPi-R64, so this seems to be part of the reference design and will probably apply to most MT7622+MT7531 boards. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* mt7622: bpi-r64: enable using mt7531 switch irqDaniel Golle2022-02-101-0/+13
| | | | | | | | | | Now that we support link-state-change interrupts, wire up MT7531 IRQ line which is connected to GPIO#53 according to the schematics [1]. As a result, PHY state no longer needs to be polled on that board. [1]: https://forum.banana-pi.org/t/bpi-r64-mt7622-schematic-diagram-public/10118 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* kernel: backport MT7530 IRQ supportDENG Qingfang2022-02-102-0/+428
| | | | | | | | | | | Support MT7530 PHY link change interrupts, and enable for MT7621. For external MT7530, a GPIO IRQ line is required, which is board-specific, so it should be added to each DTS. In case the interrupt-controller property is missing, it will fall back to polling mode. Signed-off-by: DENG Qingfang <dqfext@gmail.com>
* ath25: switch to 5.10 KernelPaul Spooren2022-02-101-1/+1
| | | | | Tested-by: Chuanhong Guo <gch981213@gmail.com> Signed-off-by: Paul Spooren <mail@aparcar.org>
* kernel: backport MediaTek Ethernet PHY driverDENG Qingfang2022-02-095-0/+163
| | | | | | | | | | | | | | Add support for MediaTek Gigabit Ethernet PHYs found in MT7530 and MT7531. Fix some link up/down issues. The errornous check for the PHY mode which broke things with MT7531 has been removed as suggested by patch net: phy: mediatek: remove PHY mode check on MT7531 As a result, things are working fine now on MT7622+MT7531 as well. Signed-off-by: DENG Qingfang <dqfext@gmail.com> Tested-by: Daniel Golle <daniel@makrotopia.org> Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com> Tested-by: Stijn Tintel <stijn@linux-ipv6.be>
* kernel: generic: select the fq_codel qdisc by defaultRui Salvaterra2022-02-092-101/+4
| | | | | | | | | The kernel configuration allows us to select a default qdisc. Let's do this for 5.10 (as 5.4 is on its way out) and get rid of the hacky patch we've been carrying. Acked-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* ramips: move KERNEL_LOADADDR into Device/DefaultSungbo Eo2022-02-081-1/+1
| | | | | | | | | | | | Commit f4a79148f8cb ("ramips: add support for ipTIME AX2004M") was reverted due to KERNEL_LOADADDR leakage, and it seems the problem can be mitigated by moving the variable definition into Device/Default. By this, KERNEL_LOADADDR redefined in a device recipe will not be leaked into the subsequent device recipes anymore and thus will remain as a per-device variable. Ref: cd6a6e3030ff ("Revert "ramips: add support for ipTIME AX2004M"") Signed-off-by: Sungbo Eo <mans0n@gorani.run>
* ipq806x: Enlarge D7800 flash - use netgear partitionMike Lothian2022-02-082-7/+4
| | | | | | | | | | | | | | | | | | | | | | Increase the available flash memory size in Netgear R7800 by repurposing the unused "netgear" partition that is located after the firmware partition. Available flash space for kernel+rootfs+overlay increases by 68 MB from 32 MB to 100 MB. In a typical build, overlay space increases from 15 to 85, increasing the package installation possibilities greatly. Reverting to the OEM firmware is still possible, as the OEM firmware contains logic to initialise the "netgear" partition if its contents do not match expectations. In OEM firmware, "netgear" contains 6 UBI sub-partitions that are defined in /etc/netgear.cfg and initialisation is done by /etc/preinit This is based on https://github.com/openwrt/openwrt/commit/fb8a578aa70572b3e56b64d296e22c2931e77b69 Signed-off-by: Mike Lothian <mike@fireburn.co.uk>
* ramips: add support for Xiaomi Mi Router CR660x seriesRaymond Wang2022-02-078-0/+261
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Xiaomi Mi Router CR6606 is a Wi-Fi6 AX1800 Router with 4 GbE Ports. Alongside the general model, it has three carrier customized models: CR6606 (China Unicom), CR6608 (China Mobile), CR6609 (China Telecom) Specifications: - SoC: MediaTek MT7621AT - RAM: 256MB DDR3 (ESMT M15T2G16128A) - Flash: 128MB NAND (ESMT F59L1G81MB) - Ethernet: 1000Base-T x4 (MT7530 SoC) - WLAN: 2x2 2.4GHz 574Mbps + 2x2 5GHz 1201Mbps (MT7905DAN + MT7975DN) - LEDs: System (Blue, Yellow), Internet (Blue, Yellow) - Buttons: Reset, WPS - UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1) - Power: 12VDC, 1A Jailbreak Notes: 1. Get shell access. 1.1. Get yourself a wireless router that runs OpenWrt already. 1.2. On the OpenWrt router: 1.2.1. Access its console. 1.2.2. Create and edit /usr/lib/lua/luci/controller/admin/xqsystem.lua with the following code (exclude backquotes and line no.): ``` 1 module("luci.controller.admin.xqsystem", package.seeall) 2 3 function index() 4 local page = node("api") 5 page.target = firstchild() 6 page.title = ("") 7 page.order = 100 8 page.index = true 9 page = node("api","xqsystem") 10 page.target = firstchild() 11 page.title = ("") 12 page.order = 100 13 page.index = true 14 entry({"api", "xqsystem", "token"}, call("getToken"), (""), 103, 0x08) 15 end 16 17 local LuciHttp = require("luci.http") 18 19 function getToken() 20 local result = {} 21 result["code"] = 0 22 result["token"] = "; nvram set ssh_en=1; nvram commit; sed -i 's/channel=.*/channel=\"debug\"/g' /etc/init.d/dropbear; /etc/init.d/drop bear start;" 23 LuciHttp.write_json(result) 24 end ``` 1.2.3. Browse http://{OWRT_ADDR}/cgi-bin/luci/api/xqsystem/token It should give you a respond like this: {"code":0,"token":"; nvram set ssh_en=1; nvram commit; ..."} If so, continue; Otherwise, check the file, reboot the rout- er, try again. 1.2.4. Set wireless network interface's IP to 169.254.31.1, turn off DHCP of wireless interface's zone. 1.2.5. Connect to the router wirelessly, manually set your access device's IP to 169.254.31.3, make sure http://169.254.31.1/cgi-bin/luci/api/xqsystem/token still have a similar result as 1.2.3 shows. 1.3. On the Xiaomi CR660x: 1.3.1. Login to the web interface. Your would be directed to a page with URL like this: http://{ROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/web/home#r- outer 1.3.2. Browse this URL with {STOK} from 1.3.1, {WIFI_NAME} {PASSWORD} be your OpenWrt router's SSID and password: http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/misy- stem/extendwifi_connect?ssid={WIFI_NAME}&password={PASSWO- RD} It should return 0. 1.3.3. Browse this URL with {STOK} from 1.3.1: http://{MIROUTER_ADDR}/cgi-bin/luci/;stok={STOK}/api/xqsy- stem/oneclick_get_remote_token?username=xxx&password=xxx&- nonce=xxx 1.4. Before rebooting, you can now access your CR660x via SSH. For CR6606, you can calculate your root password by this project: https://github.com/wfjsw/xiaoqiang-root-password, or at https://www.oxygen7.cn/miwifi. The root password for carrier-specific models should be the admi- nistration password or the default login password on the label. It is also feasible to change the root password at the same time by modifying the script from step 1.2.2. You can treat OpenWrt Router however you like from this point as long as you don't mind go through this again if you have to expl- oit it again. If you do have to and left your OpenWrt router unt- ouched, start from 1.3. 2. There's no official binary firmware available, and if you lose the content of your flash, no one except Xiaomi can help you. Dump these partitions in case you need them: "Bootloader" "Nvram" "Bdata" "crash" "crash_log" "firmware" "firmware1" "overlay" "obr" Find the corespond block device from /proc/mtd Read from read-only block device to avoid misoperation. It's recommended to use /tmp/syslogbackup/ as destination, since files would be available at http://{ROUTER_ADDR}/backup/log/YOUR_DUMP Keep an eye on memory usage though. 3. Since UART access is locked ootb, you should get UART access by modify uboot env. Otherwise, your router may become bricked. Excute these in stock firmware shell: a. nvram set boot_wait=on b. nvram set bootdelay=3 c. nvram commit Or in OpenWrt: a. opkg update && opkg install kmod-mtd-rw b. insmod mtd-rw i_want_a_brick=1 c. fw_setenv boot_wait on d. fw_setenv bootdelay 3 e. rmmod mtd-rw Migrate to OpenWrt: 1. Transfer squashfs-firmware.bin to the router. 2. nvram set flag_try_sys1_failed=0 3. nvram set flag_try_sys2_failed=1 4. nvram commit 5. mtd -r write /path/to/image/squashfs-firmware.bin firmware Additional Info: 1. CR660x series routers has a different nand layout compared to other Xiaomi nand devices. 2. This router has a relatively fresh uboot (2018.09) compared to other Xiaomi devices, and it is capable of booting fit image firmware. Unfortunately, no successful attempt of booting OpenWrt fit image were made so far. The cause is still yet to be known. For now, we use legacy image instead. Signed-off-by: Raymond Wang <infiwang@pm.me>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-25 14:48:52 +0000