aboutsummaryrefslogtreecommitdiffstats
path: root/package/boot
Commit message (Collapse)AuthorAgeFilesLines
* ramips: add support for Senao Engenius EPG600Michael Pratt2023-02-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FCC ID: A8J-EPG600 Engenius EPG600 is an indoor wireless router with 1 Gb ethernet switch, dual-band wireless, internal antenna plates, USB, and phone lines (not supported) this board is a Senao device: the hardware is equivalent to EnGenius ESR600 (except for phone lines) the software is Senao SDK which is based on openwrt and uboot which uses the legacy Senao header with Vendor / Product IDs to verify the firmware upgrade image. **Specification:** - MT7620 SOC MIPS 24kec, 2.4 GHz WMAC, 2x2 - RT5592N WLAN PCI chip, 5 GHz, 2x2 - QCA8337N Gb SW RGMII GbE, SW P0 -- SOC P5, 5 LEDs - 40 MHz clock - 16 MB FLASH MX25L12845EMI-10G - 64 MB RAM NT5TU32M16 - UART console J2, populated - USB 2.0 port direct to SOC - 6 GPIO LEDs power, 2G, 5G, wps2g, wps5g, line - 3 buttons reset, wps, "reg" (registeration) - 4 antennas internal omni-directional plates NOT YET SUPPORTED: VoIP - Si3050-FT + Si3019-FT Voice DAA, SPI control, PCM data - Phone Ports "TEL", "LINE" RJ11, 4P2C (2 pins) **MAC addresses:** MAC address labeled as MAC ADDRESS MACs present in both wifi cal data and uboot environment eth0.1/phy1 ---- *:82 rf 0x4 phy0 ---- *:83 factory 0x4 eth0.2 MAC *:b8 "wanaddr" **Installation:** Method 1: Firmware upgrade page: (if you cannot access the APs webpage) factory reset with the reset button connect ethernet to a computer OEM webpage at 192.168.0.1 username and password 'admin' Navigate to gear icon, "Device Management", "Tools" select the factory.dlf image Upload and verify checksum Method 2: Serial to upload initramfs: Follow directions for TFTP recovery upload and boot initramfs and do a sysupgrade **TFTP recovery:** Requires UART serial console, reset button does nothing rename initramfs-kernel.bin to 'uImageEPG600' make available on TFTP server at 192.168.99.8 power board, interrupt boot with "4" execute `tftpboot` and `bootm` (with the load address) **Return to OEM:** Images from OEM are provided, but not compatible with openwrt sysupgrade. So it must be modified. Alternatively, back up all mtd partitions before flashing **Note on switch registers:** The necessary registers needed for the QCA8337 switch can be read from interrupted boot (tftpboot, bootm) by using the following lines in the switch driver ar8327.c in the function 'ar8327_hw_config_of' where 'qca,ar8327-initvals' is parsed from DTS before the new register values are written: pr_info("0x04 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD0_MODE)); pr_info("0x08 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD5_MODE)); pr_info("0x0c %08x\n", ar8xxx_read(priv, AR8327_REG_PAD6_MODE)); pr_info("0x10 %08x\n", ar8xxx_read(priv, AR8327_REG_POWER_ON_STRAP)); Signed-off-by: Michael Pratt <mcpratt@pm.me>
* uboot-envtools: add support for APRESIA ApresiaLightGS120GT-SSINAGAKI Hiroshi2023-02-131-0/+8
| | | | | | | This patch adds support for APRESIA ApresiaLightGS120GT-SS to uboot-envtools. Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
* ramips: add support for ASUS RT-AX54Karl Chan2023-02-121-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifications: - Device: ASUS RT-AX54 (AX1800S/HP,AX54HP) - SoC: MT7621AT - Flash: 128MB - RAM: 256MB - Switch: 1 WAN, 4 LAN (10/100/1000 Mbps) - WiFi: MT7905 2x2 2.4G + MT7975 2x2 5G - LEDs: 1x POWER (blue, configurable) 1x LAN (blue, configurable) 1x WAN (blue, configurable) 1x 2.4G (blue, not configurable) 1x 5G (blue, not configurable) Flash by U-Boot TFTP method: - Configure your PC with IP 192.168.1.2 - Set up TFTP server and put the factory.bin image on your PC - Connect serial port(rate:115200) and turn on AP, then interrupt "U-Boot Boot Menu" by hitting any key Select "2. Upgrade firmware" Press enter when show "Run firmware after upgrading? (Y/n):" Select 0 for TFTP method Input U-Boot's IP address: 192.168.1.1 Input TFTP server's IP address: 192.168.1.2 Input IP netmask: 255.255.255.0 Input file name: openwrt-ramips-mt7621-asus_rt-ax1800hp-squashfs-factory.bin - Restart AP aftre see the log "Firmware upgrade completed!" Signed-off-by: Karl Chan <exkc@exkc.moe>
* uboot-envtools: filogic: bpi-r3: fix env selectionDaniel Golle2023-01-291-4/+7
| | | | | | | | Selecting the environment when booting from SD card has been broken by a previous commit. Fix it. Fixes: f46355b4d7 ("uboot-envtools: mediatek_filogic: fix BPi-R3 when no OS is installed") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-envtools: mt7622: bpi-r64: fix env selectionDaniel Golle2023-01-291-3/+6
| | | | | | | | Selecting the environment when booting from SD card has been broken by a previous commit. Fix it. Fixes: 84b5b0f88c ("uboot-envtools: mediatek/mt7622: don't rely on mapped rootfs") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ath79: add support for Senao Engenius EWS660APMichael Pratt2023-01-281-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FCC ID: A8J-EWS660AP Engenius EWS660AP is an outdoor wireless access point with 2 gigabit ethernet ports, dual-band wireless, internal antenna plates, and 802.3at PoE+ **Specification:** - QCA9558 SOC 2.4 GHz, 3x3 - QCA9880 WLAN mini PCIe card, 5 GHz, 3x3, 26dBm - AR8035-A PHY RGMII GbE with PoE+ IN - AR8033 PHY SGMII GbE with PoE+ OUT - 40 MHz clock - 16 MB FLASH MX25L12845EMI-10G - 2x 64 MB RAM - UART at J1 populated, RX grounded - 6 internal antenna plates (5 dbi, omni-directional) - 5 LEDs, 1 button (power, eth0, eth1, 2G, 5G) (reset) **MAC addresses:** Base MAC addressed labeled as "MAC" Only one Vendor MAC address in flash eth0 *:d4 MAC art 0x0 eth1 *:d5 --- art 0x0 +1 phy1 *:d6 --- art 0x0 +2 phy0 *:d7 --- art 0x0 +3 **Serial Access:** the RX line on the board for UART is shorted to ground by resistor R176 therefore it must be removed to use the console but it is not necessary to remove to view boot log optionally, R175 can be replaced with a solder bridge short the resistors R175 and R176 are next to the UART RX pin **Installation:** 2 ways to flash factory.bin from OEM: Method 1: Firmware upgrade page: OEM webpage at 192.168.1.1 username and password "admin" Navigate to "Firmware Upgrade" page from left pane Click Browse and select the factory.bin image Upload and verify checksum Click Continue to confirm and wait 3 minutes Method 2: Serial to load Failsafe webpage: After connecting to serial console and rebooting... Interrupt uboot with any key pressed rapidly execute `run failsafe_boot` OR `bootm 0x9fd70000` wait a minute connect to ethernet and navigate to "192.168.1.1/index.htm" Select the factory.bin image and upload wait about 3 minutes **Return to OEM:** If you have a serial cable, see Serial Failsafe instructions otherwise, uboot-env can be used to make uboot load the failsafe image ssh into openwrt and run `fw_setenv rootfs_checksum 0` reboot, wait 3 minutes connect to ethernet and navigate to 192.168.1.1/index.htm select OEM firmware image from Engenius and click upgrade **TFTP recovery:** Requires serial console, reset button does nothing rename initramfs.bin to '0101A8C0.img' make available on TFTP server at 192.168.1.101 power board, interrupt boot execute tftpboot and bootm 0x81000000 **Format of OEM firmware image:** The OEM software of EWS660AP is a heavily modified version of Openwrt Kamikaze. One of the many modifications is to the sysupgrade program. Image verification is performed simply by the successful ungzip and untar of the supplied file and name check and header verification of the resulting contents. To form a factory.bin that is accepted by OEM Openwrt build, the kernel and rootfs must have specific names... openwrt-ar71xx-generic-ews660ap-uImage-lzma.bin openwrt-ar71xx-generic-ews660ap-root.squashfs and begin with the respective headers (uImage, squashfs). Then the files must be tarballed and gzipped. The resulting binary is actually a tar.gz file in disguise. This can be verified by using binwalk on the OEM firmware images, ungzipping then untaring. Newer EnGenius software requires more checks but their script includes a way to skip them, otherwise the tar must include a text file with the version and md5sums in a deprecated format. The OEM upgrade script is at /etc/fwupgrade.sh. OKLI kernel loader is required because the OEM software expects the kernel to be no greater than 1536k and the factory.bin upgrade procedure would otherwise overwrite part of the kernel when writing rootfs. Note on PLL-data cells: The default PLL register values will not work because of the external AR8035 switch between the SOC and the ethernet port. For QCA955x series, the PLL registers for eth0 and eth1 can be see in the DTSI as 0x28 and 0x48 respectively. Therefore the PLL registers can be read from uboot for each link speed after attempting tftpboot or another network action using that link speed with `md 0x18050028 1` and `md 0x18050048 1`. The clock delay required for RGMII can be applied at the PHY side, using the at803x driver `phy-mode`. Therefore the PLL registers for GMAC0 do not need the bits for delay on the MAC side. This is possible due to fixes in at803x driver since Linux 5.1 and 5.3 Tested-by: Niklas Arnitz <openwrt@arnitz.email> Signed-off-by: Michael Pratt <mcpratt@pm.me>
* ath79: consolidate Netgear EX7300 series imagesWenli Looi2023-01-251-1/+0
| | | | | | | | | | | | | | | | | | | | | | | This change consolidates Netgear EX7300 series devices into two images corresponding to devices that share the same manufacturer firmware image. Similar to the manufacturer firmware, the actual device model is detected at runtime. The logic is taken from the netgear GPL dumps in a file called generate_board_conf.sh. Hardware details for EX7300 v2 variants --------------------------------------- SoC: QCN5502 Flash: 16 MiB RAM: 128 MiB Ethernet: 1 gigabit port Wireless 2.4GHz (currently unsupported due to lack of ath9k support): - EX6250 / EX6400 v2 / EX6410 / EX6420: QCN5502 3x3 - EX7300 v2 / EX7320: QCN5502 4x4 Wireless 5GHz: - EX6250: QCA9986 3x3 (detected by ath10k as QCA9984 3x3) - EX6400 v2 / EX6410 / EX6420 / EX7300 v2 / EX7320: QCA9984 4x4 Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
* ipq807x: Add ZyXEL NBG7815André Valentin2023-01-191-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ZyXEL NBG7815 is a premium 802.11ax "tri"-band router/AP. Specifications: * CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz * RAM: 1 GB 2x Nanya NT5CC256M16ER-EK * Storage: * 8MB serial flash Winbond W25Q64DW * 4GB eMMC flash Kingston EMMC04G-M627 * Ethernet: * 4x1G RJ45 ports (QCA8074A) with 1x status LED per port * 1x2.5G RJ45 port (QCA8081) with 1x status LED * 1x10G RJ45 port (AQR113C) with 1x status LED * Switch: Qualcomm Atheros QCA8075 * WLAN: * 2.4GHz: Qualcomm QCN5024 4x4@40MHz 802.11b/g/n/ax 1147 Mbps PHY rate * 2x 5GHz: Qualcomm QCN5054 4x4 802.11a/b/g/n/ac/ax 2402 PHY rate * Bluetooth CSR8811 using HSUART, currently unsupported * USB: 1x USB3.0 Type-A port * LED-s currently not supported: * White * Dark Blu * Amber * Purple * Purple and dark blue * Red * Buttons: * 1x Soft reset * Power: 12V DC Jack Installation instructions: * Disconnect WAN * Reset device to factory defaults by pushing reset button 15 sec, LEDs should lit orange color. * After 5-10 minutes, when the LEDs turn constant dark blue, put your LAN cable and connect at address 192.168.123.1 by telnet on port 23 * Login with NBG7815 login: root password: nbg7815@2019 * cd /tmp/ApplicationData * wget -O openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin http://... * wget https://github.com/itorK/nbg7815_tools/blob/main/flash_to_openwrt.sh * run flash_to_openwrt.sh If you can't use wget, you can transfer the files via nc. See https://openwrt.org/inbox/toh/zyxel/nbg7815_armor_g5 for installation details. Bluetooth usage: * you need at least package bluez-utils, recommended bluez-daemon * run following commands to enable and start hciattach /dev/ttyMSM1 bcsp hciconfig hci0 up Many thanks to itorK for his work on this device: https://github.com/itorK/openwrt/tree/nbg7815 Reviewed-by: Robert Marko <robimarko@gmail.com> Signed-off-by: André Valentin <avalentin@marcant.net>
* uboot-mediatek: Fix ramips/mt76x8 buildbotJo Deisenhofer2023-01-181-4/+5
| | | | | | | | | | | Move defines from header to defconfig The package build and the Buildbot hang in 'make syncconfig' for u-boot-ravpower_rp-wd009 because CONFIG_SYS_MIPS_TIMER_FREQ is not in the .config, causing a console prompt. Also moved two other defines in defconfig causing duplicate definition warnings. Fixes: 3d5c5427e17a ("uboot-mediatek: update to U-Boot 2023.01") Signed-off-by: Jo Deisenhofer <jo.deisenhofer@gmail.com>
* uboot-envtools: ipq40xx: fix WHW03V2 mtd partitionVincent Tremblay2023-01-181-2/+4
| | | | | | | | | | | The configured u_env partition for the Linksys WHW03 V2 was not correct. It should have been set to mtd6. This fix allow to flash the OEM firmware from OpenWRT and to change the boot partition using fw_setenv. Fixes: 9e4ede8344d6 ("ipq40xx: add support for Linksys WHW03 V2") Signed-off-by: Vincent Tremblay <vincent@vtremblay.dev>
* uboot-mvebu: update to version 2023.01Josef Schlehofer2023-01-171-5/+5
| | | | | | | | | In the version 2023.01, the U-boot image was renamed because of the upstream change [1] [1] https://source.denx.de/u-boot/u-boot/-/commit/87ac4b4b4ca5f00e2ddcdac41c9dc691ab2aecf1 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* ipq807x: add Dynalink DL-WRX36Dirk Buchwalder2023-01-161-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Dynalink DL-WRX36 is a AX WIFI router with 4 1G and 1 2.5G ports. Specifications: • CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz • RAM: 1024MB of DDR3 • Storage: 256MB Nand • Ethernet: 4x 1G RJ45 ports (QCA8075) + 1 2.5G Port (QCA8081) • WLAN: 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 1174 Mbps PHY rate 5GHz: Qualcomm QCN5054 4x4 802.11a/b/g/n/ac/ax 2402 PHY rate • 1x USB 3.0 • 1 gpio-controlled dual color led (blue/red) • Buttons: 1x soft reset / 1x WPS • Power: 12V DC jack A poulated serial header is onboard (J1004) the connector size is a 4-pin 2.0 mm JST PH. RX/TX is working, u-boot bootwait is active, secure boot is enabled. Notes: - Serial is completely deactivated in the stock firmware image. - This commit adds only single partition support, that means sysupgrade is upgrading the current rootfs partition. - Installation can be done by serial connection or SSH access on OEM firmware Installation Instructions: Most part of the installation is performed from an initramfs image running OpenWrt, and there are two options to boot it. Boot initramfs option 1: Using serial connection (3.3V) 1. Stop auto boot to get to U-boot shell 2. Transfer initramfs image to device (openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb) Tested using TFTP and a FAT-formatted USB flash drive. 3. Boot the initramfs image # bootm Boot initramfs option 2: From SSH access on OEM firmware 1. Copy the initramfs image to a FAT-formatted flash drive (tested on single-partition drive) and connect it to device USB port. 2. Change boot command so it loads the initramfs image on next boot Fallback to OEM firmware is provided. # fw_setenv bootcmd 'usb start && fatload usb 0:1 0x44000000 openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb && bootm 0x44000000; bootipq' 3. Reboot the device to boot the initramfs # reboot Install OpenWrt from initramfs image: 1. Use SCP (or other way) to transfer OpenWrt factory image 2. Connect to device using SSH (on a LAN port) 3. Check MTD partition table. rootfs and rootfs_1 should be mtd18 and mtd20 depending on current OEM slot. # cat /proc/mtd 4. Do a ubiformat to both rootfs partitions: # ubiformat /dev/mtd18 -y -f /path_to/factory_image # ubiformat /dev/mtd20 -y -f /path_to/factory_image 5. Set U-boot env variable: mtdids # fw_setenv mtdids 'nand0=nand0' 6. Get offset of mtd18 to determine current OEM slot - If current OEM slot is 1, offset is 16777216 (0x1000000) - If current OEM slot is 2, offset is 127926272 (0x7a00000) # cat /sys/class/mtd/mtd18/offset 7. Set U-boot env variable: mtdparts If current OEM slot is 1, run: # fw_setenv mtdparts 'mtdparts=nand0:0x6100000@0x1000000(fs),0x6100000@0x7a00000(fs_1)' If current OEM slot is 2, run: # fw_setenv mtdparts 'mtdparts=nand0:0x6100000@0x7a00000(fs),0x6100000@0x1000000(fs_1)' 8. Set U-boot env variable: bootcmd # fw_setenv bootcmd 'setenv bootargs console=ttyMSM0,115200n8 ubi.mtd=rootfs rootfstype=squashfs rootwait; ubi part fs; ubi read 0x44000000 kernel; bootm 0x44000000#config@rt5010w-d350-rev0' 9. Reboot the device # reboot Note: this PR adds only single partition support, that means sysupgrade is upgrading the current rootfs partition Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
* ipq807x: add Edgecore EAP102Matthew Hagan2023-01-161-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Edgecore EAP102 is a wall/ceiling mountable AP. The AP can be powered by either PoE or AC adapter. Device info: - IPQ8071-A SoC - 1GiB RAM - 256MiB NAND flash - 32MiB SPI NOR - 2 Ethernet ports - 1 Console port - 2GHz/5GHz AX WLAN - 2 USB 2.0 ports Install instructions: Prerequistes - TFTP server, preferrably within 192.168.1.0/24 Console cable plugged in (115200 8N1 no flow control) 1. Power on device and interrupt u-boot to obtain u-boot CLI 2. set serverip to IP address of the TFTP server: `setenv serverip 192.168.1.250` 3. Download image from TFTP server: `tftpboot 0x44000000 openwrt-ipq807x-generic-edgecore_eap102-squashfs-nand-factory.ubi` 4. Flash ubi image to both partitions and reset: `sf probe imxtract 0x44000000 ubi nand device 0 nand erase 0x0 0x3400000 nand erase 0x3c00000 0x3400000 nand write $fileaddr 0x0 $filesize nand write $fileaddr 0x3c00000 $filesize reset` Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
* ipq807x: Add Xiaomi AX9000Robert Marko2023-01-161-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Xiaomi AX9000 is a premium 802.11ax "tri"-band router/AP. Specifications: * CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz * RAM: 1024MB of DDR3 * Storage: 256MB of parallel NAND * Ethernet: * 4x1G RJ45 ports (QCA8075) with 1x status LED per port * 1x2.5G RJ45 port (QCA8081) with 1x status LED * WLAN: * PCI based Qualcomm QCA9889 1x1 802.11ac Wawe 2 for IoT * 2.4GHz: Qualcomm QCN5024 4x4@40MHz 802.11b/g/n/ax 1147 Mbps PHY rate * 5.8GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402Mbps PHY rate * 5GHz: PCI based Qualcomm QCN9024 4x4@160MHz 802.11a/b/g/n/ac/ax 4804Mbps PHY rate * USB: 1x USB3.0 Type-A port * LED-s: * System (Blue and Yellow) * Network (Blue and Yellow) * RGB light bar on top in X shape * Buttons: * 1x Power switch * 1x Soft reset * 1x Mesh button * Power: 12V DC Jack Installation instructions: Obtaining SSH access is mandatory https://openwrt.org/inbox/toh/xiaomi/ax9000#obtain_ssh_access Installation is done by the ubiformat method, through SSH: 1. Open an SSH shell to the router 2. Copy the file openwrt-ipq807x-generic-xiaomi_ax9000-initramfs-factory.ubi to the /tmp directory 3. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1): nvram get flag_boot_rootfs 4. Find the rootfs and rootfs_1 mtd indexes respectively: cat /proc/mtd Please confirm if mtd21 and mtd22 are the correct indexes from above! 5. Use the command ubiformat to flash the opposite mtd with UBI image: If nvram get flag_boot_rootfs returned 0: ubiformat /dev/mtd22 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit otherwise: ubiformat /dev/mtd21 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit 6. Reboot the device by: reboot Previous commands flashed an ubinized OpenWrt initramfs that will serve as the intermediate step since OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for packages. Continue in order to pernamently flash OpenWrt: 7. SSH into OpenWrt from one of the LAN ports 8. Copy the file openwrt-ipq807x-generic-xiaomi_ax9000-squashfs-sysupgrade.bin to the /tmp directory 9. Sysupgrade the device: sysupgrade -n /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-squashfs-sysupgrade.bin Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired. Signed-off-by: Robert Marko <robimarko@gmail.com>
* ipq807x: add QNAP 301wDirk Buchwalder2023-01-161-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | QNAP 301w is a AX WIFI router with 4 1G and 2 10G ports. Specifications: • CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz • RAM: 1024MB of DDR3 • Storage: 4GB eMMC (contains kernel and rootfs) / 8MB NOR (contains art and u-boot-env) • Ethernet: 4x 1G RJ45 ports + 2 10G ports (Aquantia AQR113C) • WLAN: 2.4GHz: Qualcomm QCN5024 4x4 (40 MHz) 802.11b/g/n/ax 1174 Mbps PHY rate 5GHz: Qualcomm QCN5054 4x4 (80 MHz) or 2x2 (160 MHz) 802.11a/b/g/n/ac/ax 2402 PHY rate • LEDs: 7 x GPIO-controlled dual color LEDs + 2 GPIO-controlled single color LEDs • Buttons: 1x soft reset / 1x WPS • Power: 12V DC jack A poulated serial header is onboard. RX/TX is working, bootwait is active, secure boot is not enabled. SSH can be activated in the stock firmware, hold WPS button til the second beep (yes the router has a buzzer) SSH is available on port 22200, login with user admin and password "mac address of the router". Installation Instructions: • obtain serial access (https://openwrt.org/inbox/toh/qnap/301w#serial) • stop auto boot • setenv serverip 192.168.10.1 • setenv ipaddr 192.168.10.10 • tftpboot the initramfs image (openwrt-ipq807x-generic-qnap_301w-initramfs-fit-uImage.itb) • bootm • make sure that current_entry is set to "0": "fw_printenv -n current_entry" should be print "0". If not, do "fw_setenv current_entry 0" • copy openwrt-ipq807x-generic-qnap_301w-squashfs-sysupgrade.bin to the device to /tmp folder • sysupgrade -n /tmp/openwrt-ipq807x-generic-qnap_301w-squashfs-sysupgrade.bin this flashes openwrt to the first kernel and rootfs partition (mmcblk0p1 / mmcblk0p4) • reboot Note: this leaves the second kernel / rootfs parition untouched. So if you want to go back to stock, stop u-boot autoboot, "setenv current_entry 1" , "saveenv", "bootipq". Stock firmware should start from the second partition. Then do a firmwareupgrade in the stock gui, that should overwrite the openwrt in the first partitions Make 10G Aquantia phy's work: The aquantia phy's need a firmware to work. This can either be loaded in linux with a userspace tool or in u-boot. I was not successfull to load the firmware in linux (aq-fw-download) but luckily there is aq_load_fw available in u-boot. But first the right firmware needs to write to the 0:ETHPHYFW mtd partition (it is empty on my device) Grab the ethphy firmware image from: https://github.com/kirdesde/nbg7815_gpl/blob/master/target/linux/ipq/ipq807x_64/prebuilt_images/AQR_ethphyfw.mbn and scp that to openwrt. Check the 0:ETHPHYFW partition number: cat /proc/mtd|grep "0:ETHPHYFW", should be mtd10. Backup the 0:ETHPHYFW partition: dd if=/dev/mtd10 of=/tmp/ethphyfw.backup, scp ethphyfw.backup to a save place. Write the new firmware image to the 0:ETHPHYFW partition: "mtd erase /dev/mtd10", "mtd -n write AQR_ethphyfw.mbn /dev/mtd10". Reboot to u-boot. Check if aq_load_fw is working: "aq_load_fw 0", that checks the firmware and if successfull, loads iram and dram to one of the aquantia phy's. If that worked, add the aq_load_fw to the bootcmd: setenv bootcmd "aq_load_fw 0 && aq_load_fw 8 && bootipq" "saveenv" "reset" Board reboots and the firmware load to both phy's should start and then openwrt boots. Check if the 10G ports work. Note: lan port labeled "10G-2" is configured as WAN port as per default. All other port are in the br-lan. This can be changed in the network config. Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
* ipq807x: add Edimax CAX1800Dirk Buchwalder2023-01-161-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Edimax CAX1800 is a 802.11 ax dual-band AP with PoE. AP can be ceiling or wall mount. Specifications: • CPU: Qualcomm IPQ8070A Quad core Cortex-A53 1.4GHz • RAM: 512MB of DDR3 • Storage: 128MB NAND (contains rootfs) / 8MB NOR (contains art and uboot-env) • Ethernet: 1x 1G RJ45 port (QCA8072) PoE • WLAN: 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate 5GHz: Qualcomm QCN5054 2x2 802.11a/b/g/n/ac/ax 1201 PHY rate • LEDs: 3 x GPIO-controlled System-LEDs (form one virtual RGB System-LED) black_small_square Buttons: 1x soft reset black_small_square Power: 12V DC jack or PoE (802.3af ) An unpopulated serial header is onboard. RX/TX is working, bootwait is active, secure boot is not enabled. SSH can be activated in the stock firmware, but it drops only to a limited shell . Installation Instructions: black_small_square obtain serial access black_small_square stop auto boot black_small_square tftpboot the initramfs image (serverip is set to 192.168.99.8 in uboot) black_small_square bootm black_small_square copy openwrt-ipq807x-generic-edimax_cax1800-squashfs-nand-factory.ubi to the device black_small_square write the image to the NAND: black_small_square cat /proc/mtd and look for rootfs partition (should be mtd0) black_small_square ubiformat /dev/mtd0 -f -y openwrt-ipq807x-generic-edimax_cax1800-squashfs- nand-factory.ubi black_small_square reboot Note: Device is not using dual partitioning (NAND contains other partitions with different manufacture data etc.) Draytek VigorAP 960C and Lancom LW-600 both look similar, but I haven't checked them. Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
* ipq807x: add Redmi AX6Zhijun You2023-01-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Redmi AX6 is a budget 802.11ax dual-band router/AP Specifications: * CPU: Qualcomm IPQ8071A Quad core Cortex-A53 1.4GHz * RAM: 512MB of DDR3 * Storage: 128MB NAND * Ethernet: 4x1G RJ45 ports (QCA8075) * WLAN: * 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate * 5GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate * LEDs: * System (Blue/Yellow) * Network (Blue/Yellow) *Buttons: 1x soft reset *Power: 12V DC jack Installation instructions: Obtaining SSH access is mandatory https://openwrt.org/inbox/toh/xiaomi/xiaomi_redmi_ax6_ax3000#ssh_access Installation is done by the ubiformat method, through SSH: 1. Open an SSH shell to the router 2. Copy the file openwrt-ipq807x-generic-redmi_ax6-initramfs-factory.ubi to the /tmp directory 3. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1): nvram get flag_boot_rootfs 4. Find the rootfs and rootfs_1 mtd indexes respectively: cat /proc/mtd Please confirm if mtd12 and mtd13 are the correct indexes from above! 5. Use the command ubiformat to flash the opposite mtd with UBI image: If nvram get flag_boot_rootfs returned 0: ubiformat /dev/mtd13 -y -f /tmp/openwrt-ipq807x-generic-redmi_ax6-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit otherwise: ubiformat /dev/mtd12 -y -f /tmp/openwrt-ipq807x-generic-redmi_ax6-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit 6. Reboot the device by: reboot Previous commands flashed an ubinized OpenWrt initramfs that will serve as the intermediate step since OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for packages. Continue in order to pernamently flash OpenWrt: 7. SSH into OpenWrt from one of the LAN ports 8. Copy the file openwrt-ipq807x-generic-redmi_ax6-squashfs-sysupgrade.bin to the /tmp directory 9. Sysupgrade the device: sysupgrade -n /tmp/openwrt-ipq807x-generic-redmi_ax6-squashfs-sysupgrade.bin Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired. Signed-off-by: Zhijun You <hujy652@gmail.com>
* ipq807x: add Xiaomi AX3600Robert Marko2023-01-161-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Xiaomi AX3600 is a budget 802.11ax dual-band router/AP. Specifications: * CPU: Qualcomm IPQ8071A Quad core Cortex-A53 1.4GHz * RAM: 512MB of DDR3 * Storage: 256MB of parallel NAND * Ethernet: 4x1G RJ45 ports (QCA8075) with 1x status LED per port * WLAN: * PCI based Qualcomm QCA9889 1x1 802.11ac Wawe 2 for IoT * 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate * 5GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate * LED-s: * System (Blue and Yellow) * IoT (Blue) * Network (Blue and Yellow) * Buttons: 1x Soft reset * Power: 12V DC Jack Installation instructions: Obtaining SSH access is mandatory https://openwrt.org/inbox/toh/xiaomi/xiaomi_ax3600#obtain_ssh_access Installation is done by the ubiformat method, through SSH: 1. Open an SSH shell to the router 2. Copy the file openwrt-ipq807x-generic-xiaomi_ax3600-initramfs-factory.ubi to the /tmp directory 3. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1): nvram get flag_boot_rootfs 4. Find the rootfs and rootfs_1 mtd indexes respectively: cat /proc/mtd Please confirm if mtd12 and mtd13 are the correct indexes from above! 5. Use the command ubiformat to flash the opposite mtd with UBI image: If nvram get flag_boot_rootfs returned 0: ubiformat /dev/mtd13 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax3600-initramfs-factory.ubi -s 2048 -O 2048 && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit otherwise: ubiformat /dev/mtd12 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax3600-initramfs-factory.ubi -s 2048 -O 2048 && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit 6. Reboot the device by: reboot Previous commands flashed an ubinized OpenWrt initramfs that will serve as the intermediate step since OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for packages. Continue in order to pernamently flash OpenWrt: 7. SSH into OpenWrt from one of the LAN ports 8. Copy the file openwrt-ipq807x-generic-xiaomi_ax3600-squashfs-sysupgrade.bin to the /tmp directory 9. Sysupgrade the device: sysupgrade -n /tmp/openwrt-ipq807x-generic-xiaomi_ax3600-squashfs-sysupgrade.bin Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Signed-off-by: Robert Marko <robimarko@gmail.com>
* ramips: mt7621: Add Arcadyan WE420223-99 supportHarm Berntsen2023-01-151-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Arcadyan WE420223-99 is a WiFi AC simultaneous dual-band access point distributed as Experia WiFi by KPN in the Netherlands. It features two ethernet ports and 2 internal antennas. Specifications -------------- SOC : Mediatek MT7621AT ETH : Two 1 gigabit ports, built into the SOC WIFI : MT7615DN BUTTON: Reset BUTTON: WPS LED : Power (green+red) LED : WiFi (green+blue) LED : WPS (green+red) LED : Followme (green+red) Power : 12 VDC, 1A barrel plug Winbond variant: RAM : Winbond W631GG6MB12J, 1GBIT DDR3 SDRAM Flash : Winbond W25Q256JVFQ, 256Mb SPI U-Boot: 1.1.3 (Nov 23 2017 - 16:40:17), Ralink 5.0.0.1 Macronix variant: RAM : Nanya NT5CC64M16GP-DI, 1GBIT DDR3 SDRAM Flash : MX25l25635FMI-10G, 256Mb SPI U-Boot: 1.1.3 (Dec 4 2017 - 11:37:57), Ralink 5.0.0.1 Serial ------ The serial port needs a TTL/RS-232 3V3 level converter! The Serial setting is 57600-8-N-1. The board has an unpopulated 2.54mm straight pin header. The pinout is: VCC (the square), RX, TX, GND. Installation ------------ See the Wiki page [1] for more details, it comes down to: 1. Open the device, take off the heat sink 2. Connect the SPI flash chip to a flasher, e.g. a Raspberry Pi. Also connect the RESET pin for stability (thanks @FPSUsername for reporting) 3. Make a backup in case you want to revert to stock later 4. Flash the squashfs-factory.trx file to offset 0x50000 of the flash 5. Ensure the bootpartition variable is set to 0 in the U-Boot environment located at 0x30000 Note that the U-Boot is password protected, this can optionally be removed. See the forum [2] for more details. MAC Addresses(stock) -------------------- +----------+------------------+-------------------+ | use | address | example | +----------+------------------+-------------------+ | Device | label | 00:00:00:11:00:00 | | Ethernet | + 3 | 00:00:00:11:00:03 | | 2g | + 0x020000f00001 | 02:00:00:01:00:01 | | 5g | + 1 | 00:00:00:11:00:01 | +----------+------------------+-------------------+ The label address is stored in ASCII in the board_data partition Notes ----- - This device has a dual-boot partition scheme, but OpenWRT will claim both partitions for more storage space. Known issues ------------ - 2g MAC address does not match stock due to missing support for that in macaddr_add - Only the power LED is configured by default References ---------- [1] https://openwrt.org/inbox/toh/arcadyan/astoria/we420223-99 [2] https://forum.openwrt.org/t/adding-openwrt-support-for-arcadyan-we420223-99-kpn-experia-wifi/132653 Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com> Signed-off-by: Harm Berntsen <git@harmberntsen.nl>
* ipq40xx: add support for Linksys WHW03 V2Vincent Tremblay2023-01-151-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SOC: Qualcomm IPQ4019 WiFi 1: QCA4019 IEEE 802.11b/g/n WiFi 2: QCA4019 IEEE 802.11a/n/ac WiFi 3: QCA8888 IEEE 802.11a/n/ac Bluetooth: Qualcomm CSR8811 (A12U) Zigbee: Silicon Labs EM3581 NCP + Skyworks SE2432L Ethernet: Qualcomm Atheros QCA8072 (2-port) Flash 1: Mactronix MX30LF4G18AC-XKI RAM (NAND): SK hynix H5TC4G63CFR-PBA (512MB) LED Controller: NXP PCA9633 (I2C) Buttons: Single reset button (GPIO). - The three WiFis were fully tested and are configured with the same settings as in the vendor firmware. - The specific board files were submitted to the ATH10k mailing list but I'm still waiting for a reply. They can be removed once they are approved upstream. - Two ethernet ports are accessible on the device. By default one is configured as WAN and the other one is LAN. They are fully working. Bluetooth: ======== - Fully working with the following caveats: - RFKILL need to be enabled in the kernel. - An older version of bluez is needed as bccmd is needed to configure the chip. Zigbee: ====== - The spidev device is available in the /dev directory. - GPIOs are configured the same way as in the vendor firmware. - Tests are on-going. I am working on getting access to the Silicon Labs stack to validate that it is fully working. Installation: ========= The squash-factory image can be installed via the Linksys Web UI: 1. Open "http://192.168.1.1/ca" (Change the IP with the IP of your device). 2. Login with your admin password. 3. To enter into the support mode, click on the "CA" link and the bottom of the page. 4. Open the "Connectivity" menu and upload the squash-factory image with the "Choose file" button. 5. Click start. Ignore all the prompts and warnings by click "yes" in all the popups. The device uses a dual partition mechanism. The device automatically revert to the previous partition after 3 failed boot attempts. If you want to force the previous firmware to load, you can turn off and then turn on the device for 2 seconds, 3 times in a row. It can also be done via TFTP: 1. Setup a local TFTP server and configure its IP to 192.168.1.100. 2. Rename your image to "nodes_v2.img" and put it to the TFTP root of your server. 3. Connect to the device through the serial console. 4. Power on device and press enter when prompted to drop into U-Boot. 5. Flash the partition of your choice by typing "run flashimg" or "run flashimg2". 6. Once flashed, enter "reset" to reboot the device. Reviewed-by: Robert Marko <robimarko@gmail.com> Signed-off-by: Vincent Tremblay <vincent@vtremblay.dev>
* ramips: add basic support for TP-Link EC330-G5u v1Mikhail Zhilkin2023-01-141-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds basic support for TP-Link EC330-G5u Ver:1.0 router (also known as TP-Link Archer C9ERT). Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 128 MiB, Nanya NT5CC64M16GP-DI Flash: 128 MiB NAND, ESMT F59L1G81MA-25T Wireless 2.4 GHz (MediaTek MT7615N): b/g/n, 4x4 Wireless 5 GHz (MediaTek MT7615N): a/n/ac, 4x4 Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1xUSB3.0 Button: 4 (Led, WiFi On/Off, Reset, WPS) LEDs: 7 blue LEDs, 1 orange(amber) LED, 1 white(non-gpio) LED Power: 12 VDC, 2 A Connector type: Barrel Bootloader: First U-Boot (1.1.3), Main U-Boot (1.1.3). Additionally, original TP-Link firmware contains Image U-Boot (1.1.3). Serial console (UART) --------------------- V +-------+-------+-------+-------+ | +3.3V | GND | TX | RX | +---+---+-------+-------+-------+ | J2 | +--- Don't connect Installation ------------ 1. Rename OpenWrt initramfs image to test.bin and place it on tftp server with IP 192.168.0.5 2. Attach UART, switch on the router and interrupt the boot process by pressing 't' 3. Load and run OpenWrt initramfs image: tftpboot bootm 4. Once inside OpenWrt, switch to the first boot image: fw_setenv BootImage 0 5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv BootImage 1 reboot Recovery -------- 1. Press Reset button and power on the router 2. Navigate to U-Boot recovery web server (http://192.168.0.1/) and upload the OEM firmware MAC addresses ------------- +---------+-------------------+-------------------+-------------+ | | MAC example 1 | MAC example 2 | Algorithm | +---------+-------------------+-------------------+-------------+ | label | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | LAN | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WAN | 72:ff:7b:xx:xx:f5 | 54:d4:f7:xx:xx:db | label+1 [1] | | WLAN 2g | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WLAN 5g | 68:ff:7b:xx:xx:f6 | 50:d4:f7:xx:xx:dc | label+2 | +---------+-------------------+-------------------+-------------+ label MAC address was found in factory at 0x165 (text format xx:xx:xx:xx:xx:xx). Notes ----- [1] WAN MAC address: a. First octet of WAN MAC is differ than others and OUI is not related to TP-Link company. This probably should be fixed. b. Flipping bits in first octet and hex delta are different for the different MAC examples: +-----------------+----------------+----------------+ | | Example 1 | Example 2 | +-----------------+----------------+----------------+ | LAN | 68 = 0110 1000 | 50 = 0101 0000 | | MAC (1st octet) | ^ ^ ^ | | +-----------------+----------------+----------------+ | WAN | 72 = 0111 0010 | 54 = 0101 0100 | | MAC (1st octet) | ^ ^ ^ | ^ | +-----------------+----------------+----------------+ | HEX delta | 0xa | 0x4 | +-----------------+----------------+----------------+ | DEC delta | 4 | 4 | +-----------------+----------------+----------------+ c. DEC delta is a constant (4). This looks like a mistake in OEM firmware and probably should be fixed. Based on the above, I decided to keep correct OUI and make WAN MAC = label + 1. [2] Bootloaders The device contains 3 bootloaders: - First U-Boot: U-Boot 1.1.3 (Mar 18 2019 - 12:50:24). The First U-Boot located on NAND Flash to load next full-feature Uboot. - Main U-Boot + its backup: U-Boot 1.1.3 (Mar 18 2019 - 12:50:29). This bootloader includes recovery webserver. Requires special uImages to continue the boot process: 0x00 (os0, os1) - firmware uImage 0x40 (os0, os1) - standalone uImage (OpenWrt kernel is here) - Additionally, both slots of the original TP-Link firmware contains Image U-Boot: U-Boot 1.1.3 (Oct 16 2019 - 08:14:45). It checks image magics and CRCs. We don't use this U-Boot with OpenWrt. Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
* uboot-mediatek: update to U-Boot 2023.01Daniel Golle2023-01-1370-12398/+118
| | | | | | | | Support for MT7981 and MT7986 has been merged, remove patches. Tested on a couple of MT7986, MT7622 and MT7623 boards. MIPS builds are untested. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-envtools: update to 2023.01Linhui Liu2023-01-131-3/+3
| | | | | | Update to latest version. Signed-off-by: Linhui Liu <liulinhui36@gmail.com>
* tfa-layerscape: Use trusted-firmware-a.mkHauke Mehrtens2022-12-311-70/+55
| | | | | | | | This converts the trusted firmware arm build Makefile to make use of the common trusted-firmware-a.mk file. This also fixes the build with binutils 2.39. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* arm-trusted-firmware-mvebu: Use host flags for cryptest compilationHauke Mehrtens2022-12-312-0/+15
| | | | | | | | | Without these changes it used the system LDFLAGS for the compilation of the cryptopp library. This does not always work when we add "-no-warn-rwx-segments" which is done to support binutils 2.39 inside of OpenWrt. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* arm-trusted-firmware-sunxi: Use common trusted-firmware-a.mkHauke Mehrtens2022-12-312-39/+27
| | | | | | | Make use of the definitions from trusted-firmware-a.mk to build the Trusted firmware arm. This fixes the build with binutils 2.39. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* ipq40xx: fix up Linksys WHW01 board name, device definitionTony Ambardar2022-12-311-1/+1
| | | | | | | | | | | | | | Update the board name defined in DTS to match online documentation and the name encoded into factory firmware. This helps supports flashing firmware factory images using 'sysupgrade'. Original WHW01 device definition assumes the rootfs IMAGE_SIZE is 33 MB instead of the correct 74 MB, and defines factory images which include extra adjustments/padding that do not match OEM factory images and may cause problems flashing. Update image size and build recipe to fix these. Suggested-by: Wyatt Martin <wawowl@gmail.com> Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
* mediatek: drop redmi-ax6000 variant with modified envChuanhong Guo2022-12-301-1/+0
| | | | | | | | | | | | | | | | | | | This variant uses xiaomi factory u-boot and modified u-boot-env & bootcmd. By modifying uboot-env, the xiaomi firmware recovery provided in the vendor u-boot doesn't work anymore. It's possible to put u-boot into a state where it refuese to take any serial input. If the u-boot is in this state, users can't restore their firmware without taking the flash off the board. We now have a -stock variant where the vendor u-boot is used in a way that xiaomi firmware recovery still works, and a -ubootmod variant where we get rid of all xiaomi components, have more usable space and no uart console lock. These two should cover all use cases and we don't need this variant anymore. Drop this redmi-ax6000 variant. Existing users of this variant should perform a u-boot mod or restore to the -stock layout. Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
* uboot-mediatek: add support for Xiaomi Redmi Router AX6000Furong Xu2022-12-293-0/+412
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | U-Boot flash instructions: 0. OpenWrt U-Boot does not support stock layout, it comes with recovery boot support, automatic tftp recovery and never blocks UART. A new flash layout is introduced, we call it OpenWrt U-Boot layout, stock flash layout and the old OpenWrt layout are not supported. During the whole flash procedure, please do not reboot or power off unless requested explicitly, or you will break your device. 1. Your device should already running OpenWrt. If not, follow the instructions to flash OpenWrt: https://github.com/openwrt/openwrt/pull/11115 2. Backup BL2 Nvram Bdata Factory and FIP in case you break something or in case you want to go back to stock firmware one day. cat /dev/mtdblock0 > /tmp/BL2.bin cat /dev/mtdblock1 > /tmp/Nvram.bin cat /dev/mtdblock2 > /tmp/Bdata.bin cat /dev/mtdblock3 > /tmp/Factory.bin cat /dev/mtdblock4 > /tmp/FIP.bin And save all whose bin files to somewhere safe. Then backup your configurations, since ubiformat for entire mtd device is required to create new ubootenv volume for OpenWrt U-Boot. 3. Run the following cmd to boot into an initramfs with the new OpenWrt U-Boot layout that expand ubi partion to the end of flash: ubiformat /dev/mtd7 -y -f /tmp/ax6000-ubootmod-initramfs-factory.ubi 4. After boot into initramfs, check mtd partion info. The ubi partion should be mtd5 root@OpenWrt:~# cat /proc/mtd dev: size erasesize name mtd0: 00100000 00020000 BL2 mtd1: 00040000 00020000 Nvram mtd2: 00040000 00020000 Bdata mtd3: 00200000 00020000 Factory mtd4: 00200000 00020000 FIP mtd5: 07a80000 00020000 ubi 5. Load kmod-mtd-rw to temporarily make the bootloader partions writable. The kmod-mtd-rw is from the feeds, it is not packed in initramfs-factory by default. To install kmod-mtd-rw via opkg: opkg update && opkg install kmod-mtd-rw Or, download kmod-mtd-rw.ipk from OpenWrt server and install it manually e.g: https://downloads.openwrt.org/snapshots/targets/mediatek/filogic/kmods/ Select your OpenWrt release version and kernel version accordingly. Load kmod-mtd-rw: insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1 6. Run the following cmd to clean all pending crash dumps in pstore, or OpenWrt U-Boot may boot into NAND recovery or tftp recovery. rm -f /sys/fs/pstore/* 7. Format ubi and create new ubootenv volume: ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5 ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB 8. This is optional. Skip this if you do not want to have NAND recovery boot feature offered by OpenWrt U-Boot. Don't worry, you always have automatic tftp recovery feature enabled. ubimkvol /dev/ubi0 -n 2 -N recovery -s 10MiB ubiupdatevol /dev/ubi0_2 /tmp/ax6000-ubootmod-initramfs-recovery.itb 9. Now, flash new U-Boot. Bye-bye ugly stock U-Boot. mtd write /tmp/ax6000-ubootmod-preloader.bin BL2 mtd write /tmp/ax6000-ubootmod-bl31-uboot.fip FIP 10. Flash the squashfs-sysupgrade.bin as usual: sysupgrade -n /tmp/ax6000-ubootmod-squashfs-sysupgrade.itb Enjoy! Signed-off-by: Furong Xu <xfr@outlook.com>
* uboot-envtools: add support for ramips Asus RX-AX53UFelix Baumann2022-12-281-0/+1
| | | | | | | | | Adds uboot-envtools support for ramips Asus RX-AX53U now that partition can be correctly read. Signed-off-by: Felix Baumann <felix.bau@gmx.de> [ improve commit title and description ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* uboot-omap: build with omap generic subtargetKuan-Yi Li2022-12-251-0/+1
| | | | | | | | | | Fix image build fail by using the generic subtarget. Fixes: b2bfea48 ("omap: add generic subtarget") Ref: 40e3f660 ("uboot-fritz4040: build with ipq40xx generic subtarget") Signed-off-by: Kuan-Yi Li <kyli@abysm.org> [ add commit description ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* uboot-tegra: build with tegra generic subtargetKuan-Yi Li2022-12-251-0/+1
| | | | | | | | | | Fix image build fail by using the generic subtarget. Fixes: c028e1b1 ("tegra: add generic subtarget") Ref: 40e3f660 ("uboot-fritz4040: build with ipq40xx generic subtarget") Signed-off-by: Kuan-Yi Li <kyli@abysm.org> [ add commit description ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* uboot-zynq: build with zynq generic subtargetKuan-Yi Li2022-12-251-0/+1
| | | | | | | | | | Fix image build fail by using the generic subtarget. Fixes: 6d7129ef ("zynq: add generic subtarget") Ref: 40e3f660 ("uboot-fritz4040: build with ipq40xx generic subtarget") Signed-off-by: Kuan-Yi Li <kyli@abysm.org> [ add commit description ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* uboot-mxs: build with mxs generic subtargetKuan-Yi Li2022-12-251-0/+1
| | | | | | | | | | Fix image build fail by using the generic subtarget. Fixes: 64ef920b ("mxs: add generic subtarget") Ref: 40e3f660 ("uboot-fritz4040: build with ipq40xx generic subtarget") Signed-off-by: Kuan-Yi Li <kyli@abysm.org> [ add commit description ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* uboot-kirkwood: build with kirkwood generic subtargetKuan-Yi Li2022-12-251-0/+1
| | | | | | | | | | Fix image build fail by using the generic subtarget. Fixes: cada395a ("kirkwood: add generic subtarget") Ref: 40e3f660 ("uboot-fritz4040: build with ipq40xx generic subtarget") Signed-off-by: Kuan-Yi Li <kyli@abysm.org> [ add commit description ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* uboot-sunxi: use UUID of bootdev and bootpartJan-Niklas Burfeind2022-12-221-3/+5
| | | | | | | | | | | | | | | | | | | | | | | Several sunxi devices come with multiple mmc devices. On such devices, the mmc device order is unpredictable, so using /dev/mmcblk0p2 as root device doesn't always work, which results in unbootable devices. For the Banana Pi BPI-R3 in the mediatek target, this has been solved by defining aliases for the mmc devices in the DTS. Ideally we would do the same here, but for sunxi-a64 we already use UUID probing, so let's start with that (5f2ff607e286 ("uboot-sunxi: a64: allow booting directly from eMMC")). Since we're building and including u-boot in each supported device image, and this method has been proven to work fine for a64, let's just change the default u-boot env file to do the same. Fixes: #10080 Fixes: e6d9f6fdff ("sunxi: add support for FriendlyARM NanoPi R1") Co-authored-by: Karl Palsson <karlp@etactica.com> Signed-off-by: Jan-Niklas Burfeind <git@aiyionpri.me> [use UUID in default u-boot env, rewrite commit message] Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* sunxi: remove frequency for NanoPi R1Jan-Niklas Burfeind2022-12-221-2/+1
| | | | | | | The frequency appears as unlisted initial frequency. Removed it as Hauke suggested. Signed-off-by: Jan-Niklas Burfeind <git@aiyionpri.me>
* arm-trusted-firmware-sunxi: drop CPE IDStijn Tintel2022-12-201-1/+0
| | | | | | The CPE ID is already set in trusted-firmware-a.mk. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* ramips: add support for SNR-CPE-W4N-MT routerAlexey Bartenev2022-12-171-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | General specification: - SoC Type: MediaTek MT7620N (580MHz) - ROM: 8 MB SPI-NOR (W25Q64FV) - RAM: 64 MB DDR (M13S5121632A) - Switch: MediaTek MT7530 - Ethernet: 5 ports - 5×100MbE (WAN, LAN1-4) - Wireless 2.4 GHz: b/g/n - Buttons: 1 button (RESET) - Bootloader: U-Boot 1.1.3, MediaTek U-Boot: 5.0.0.5 - Power: 12 VDC, 1.0 A Flash by the native uploader in 2 stages: 1. Use the native uploader to flash an initramfs image. Choose openwrt-ramips-mt7620-snr_cpe-w4n-mt-initramfs-kernel.bin file by "Administration/Management/Firmware update/Choose File" in vendor's web interface (ip: 192.168.1.10, login: Admin, password: Admin). Wait ~160 seconds. 2. Flash a sysupgrade image via the initramfs image. Choose openwrt-ramips-mt7620-snr_cpe-w4n-mt-squashfs-sysupgrade.bin file by "System/Backup/Flash Firmware/Flash image..." in LuCI web interface (ip: 192.168.1.1, login: root, no password). Wait ~240 seconds. Flash by U-Boot TFTP method: 1. Configure your PC with IP 192.168.1.131 2. Set up TFTP server and put the openwrt-ramips-mt7620-snr_cpe-w4n-mt-squashfs-sysupgrade.bin image on your PC 3. Connect serial port (57600 8N1) and turn on the router. Then interrupt "U-Boot Boot Menu" by hitting 2 key (select "2: Load system code then write to Flash via TFTP."). Press Y key when show "Warning!! Erase Linux in Flash then burn new one. Are you sure? (Y/N)" Input device IP (192.168.1.1) ==:192.168.1.1 Input server IP (192.168.1.131) ==:192.168.1.131 Input Linux Kernel filename () ==: openwrt-ramips-mt7620-snr_cpe-w4n-mt-squashfs-sysupgrade.bin 3. Wait ~120 seconds to complete flashing Signed-off-by: Alexey Bartenev <41exey@proton.me>
* sunxi: fix board_name for MarsBoard A10Chukun Pan2022-12-171-2/+2
| | | | | | | The compatible in the device tree is "haoyu,a10-marsboard", modify the board_name to keep it consistent. Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
* mediatek: add alternative stock layout for Xiaomi Redmi Router AX6000Chen Minqiang2022-12-171-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In this implementation, the flash partition layout is adjusted to avoid modifying the uboot environment of mtdparts. This ensures that the 30M ubi_kernel partition remains aligned with the stock ubi partition, and the kernel volume is placed in it. This allows the stock uboot to boot from it without changing the mtdparts, which is useful for reverting back to the stock firmware using Xiaomi Firmware Tools. In actual testing, modifying mtdparts has been found to break Xiaomi Firmware Tools. 1. use ARTIFACTS to generate initramfs-factory.ubi for easy installation. 2. The NAND flash layout is changed to allow for reverting back to the stock firmware. 3. Before performing sysupgrade, do some cleanup in platform_pre_upgrade to ensure a clean installation of OpenWRT. 4. Setup the uboot env to ensure that the system always boot, which can be helpful for users who may forget to do this before sysupgrade in the initramfs. New flash instructions: 1. Gain ssh access. Please refer to: https://openwrt.org/toh/xiaomi/redmi_ax6000#installation) 2. Check which system current u-boot is loading from: COMMAND: `cat /proc/cmdline` sample OUTPUT: `console=ttyS0,115200n1 loglevel=8 firmware=1 uart_en=1` if firmware=1, current system is ubi1 if firmware=0, current system is ubi0 3. Setup nvram and write the firmware: If the current system is ubi1, please set it up so that the next time it will boot from ubi, and write the firmware to ubi: ``` nvram set boot_wait=on nvram set uart_en=1 nvram set flag_boot_rootfs=0 nvram set flag_last_success=0 nvram set flag_boot_success=1 nvram set flag_try_sys1_failed=0 nvram set flag_try_sys2_failed=0 nvram commit ubiformat /dev/mtd8 -y -f /tmp/initramfs-factory.ubi ``` If the current system is ubi, please set it up so that the next time it will boot from ubi1, and write the firmware to ubi1: ``` nvram set boot_wait=on nvram set uart_en=1 nvram set flag_boot_rootfs=1 nvram set flag_last_success=1 nvram set flag_boot_success=1 nvram set flag_try_sys1_failed=0 nvram set flag_try_sys2_failed=0 nvram commit ubiformat /dev/mtd9 -y -f /tmp/initramfs-factory.ubi ``` 4. After rebooting, the system should now boot into the openwrt initramfs. Flash the squashfs-sysupgrade.bin via using ssh or luci. ``` sysupgrade -n /tmp/squashfs-sysupgrade.bin ``` Done. For existing users of the Redmi AX6000 running OpenWrt, here are the steps to switch to this new layout: 1. Flash initramfs-factory.ubi ``` mtd -r -e ubi write /tmp/initramfs-factory.ubi ubi ``` 2. After rebooting, the system will boot into the new openwrt-initramfs. Log in and perform a sysupgrade to complete the process. ``` sysupgrade -n /tmp/squashfs-sysupgrade.bin ``` Signed-off-by: Chen Minqiang <ptpt52@gmail.com> Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
* ramips: add support for Etisalat S3Mikhail Zhilkin2022-12-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Etisalat S3 is a wireless WiFi 5 router manufactured by Sercomm company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB Flash: 128 MiB Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2 Wireless 5 GHz (MT7615E): a/n/ac, 4x4 Ethernet: 5x GbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1x USB3.0 Button: 2 buttons (Reset & WPS) LEDs: - 1x Status (RGB) - 1x 2.4G (blue, hardware, mt76-phy0) - 1x 5G (blue, hardware, mt76-phy1) Power: 12 VDC, 1.5 A Connector type: barrel Bootloader: U-Boot Installation ----------------- 1. Login to the router web interface under admin account 2. Navigate to Settings -> Configuration -> Save to Computer 3. Decode the configuration. For example, using cfgtool.py tool (see related section): cfgtool.py -u configurationBackup.cfg 4. Open configurationBackup.xml and find the following line: <PARAMETER name="Password" type="string" value="<your router serial \ is here>" writable="1" encryption="1" password="1"/> 5. Insert the following line after and save: <PARAMETER name="Enable" type="boolean" value="1" writable="1" encryption="0"/> 6. Encode the configuration. For example, using cfgtool.py tool: cfgtool.py -p configurationBackup.xml 7. Upload the changed configuration (configurationBackup_changed.cfg) to the router 8. Login to the router web interface (SuperUser:ETxxxxxxxxxx, where ETxxxxxxxxxx is the serial number from the backplate label) 9. Navigate to Settings -> WAN -> Add static IP interface (e.g. 10.0.0.1/255.255.255.0) 10. Navigate to Settings -> Remote cotrol -> Add SSH, port 22, 10.0.0.0/255.255.255.0 and interface created before 11. Change IP of your client to 10.0.0.2/255.255.255.0 and connect the ethernet cable to the WAN port of the router 12. Connect to the router using SSH shell under SuperUser account 13. Run in SSH shell: sh 14. Make a mtd backup (optional, see related section) 15. Change bootflag to Sercomm1 and reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 reboot 16. Login to the router web interface under admin account 17. Remove dots from the OpenWrt factory image filename 18. Update firmware via web using OpenWrt factory image Revert to stock --------------- Change bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 mtd backup ---------- 1. Set up a tftp server (e.g. tftpd64 for windows) 2. Connect to a router using SSH shell and run the following commands: cd /tmp for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \ tftp -l mtd$i -p 10.0.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done tftp -l mtd.md5 -p 10.0.0.2 Recovery -------- Use sercomm-recovery tool. Link: https://github.com/danitool/sercomm-recovery MAC Addresses ------------- +-----+------------+---------+ | use | address | example | +-----+------------+---------+ | LAN | label | *:50 | | WAN | label + 11 | *:5b | | 2g | label + 2 | *:52 | | 5g | label + 3 | *:53 | +-----+------------+---------+ The label MAC address was found in Factory 0x21000 cfgtool.py ---------- A tool for decoding and encoding Sercomm configs. Link: https://github.com/r3d5ky/sercomm_cfg_unpacker Co-authored-by: Karim Dehouche <karimdplay@gmail.com> Co-authored-by: Maximilian Weinmann <x1@disroot.org> Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
* sunxi: fix 253-sunxi-h5-add-support-for-nanopi-r1s-h5 patch offsetChristian Lamparter2022-12-121-1/+1
| | | | | | | This showed up in the log: |Hunk #1 succeeded at 555 (offset -83 lines). Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* uboot-bcm4908: update to the latest genericRafał Miłecki2022-12-081-3/+3
| | | | | | 4435700d18 Remove redundant YYLOC global declaration Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* uboot-mediatek: bpi-r3: raise CONFIG_LMB_MAX_REGIONS to 64Daniel Golle2022-11-291-6/+8
| | | | | | | | Raise CONFIG_LMB_MAX_REGIONS to 64 as there are going to be more than 8 (the default value) reserved regions to allow supporting offloading Wireless-to-Ethernet traffic on MT7986. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* layerscape: Switch LS1012A-FRDM initramfs to gzipPawel Dembicki2022-11-271-1/+1
| | | | | | | | | | At this moment LS1012A-FRDM have uncompressed initramfs image. Error was caused, because gzip extract area overlap image. Let's change loadaddr and enable gzip initramfs images again. Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
* ath79: add support for Senao Engenius EAP1750HMichael Pratt2022-11-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FCC ID: A8J-EAP1750H Engenius EAP1750H is an indoor wireless access point with 1 Gb ethernet port, dual-band wireless, internal antenna plates, and 802.3at PoE+ **Specification:** - QCA9558 SOC - QCA9880 WLAN PCI card, 5 GHz, 3x3, 26dBm - AR8035-A PHY RGMII GbE with PoE+ IN - 40 MHz clock - 16 MB FLASH MX25L12845EMI-10G - 2x 64 MB RAM NT5TU32M16FG - UART at J10 populated - 4 internal antenna plates (5 dbi, omni-directional) - 5 LEDs, 1 button (power, eth0, 2G, 5G, WPS) (reset) **MAC addresses:** MAC addresses are labeled as ETH, 2.4G, and 5GHz Only one Vendor MAC address in flash eth0 ETH *:fb art 0x0 phy1 2.4G *:fc --- phy0 5GHz *:fd --- **Serial Access:** the RX line on the board for UART is shorted to ground by resistor R176 therefore it must be removed to use the console but it is not necessary to remove to view boot log optionally, R175 can be replaced with a solder bridge short the resistors R175 and R176 are next to the UART RX pin at J10 **Installation:** 2 ways to flash factory.bin from OEM: Method 1: Firmware upgrade page: OEM webpage at 192.168.1.1 username and password "admin" Navigate to "Firmware Upgrade" page from left pane Click Browse and select the factory.bin image Upload and verify checksum Click Continue to confirm and wait 3 minutes Method 2: Serial to load Failsafe webpage: After connecting to serial console and rebooting... Interrupt uboot with any key pressed rapidly execute `run failsafe_boot` OR `bootm 0x9fd70000` wait a minute connect to ethernet and navigate to "192.168.1.1/index.htm" Select the factory.bin image and upload wait about 3 minutes **Return to OEM:** If you have a serial cable, see Serial Failsafe instructions otherwise, uboot-env can be used to make uboot load the failsafe image ssh into openwrt and run `fw_setenv rootfs_checksum 0` reboot, wait 3 minutes connect to ethernet and navigate to 192.168.1.1/index.htm select OEM firmware image from Engenius and click upgrade **TFTP recovery:** Requires serial console, reset button does nothing rename initramfs to 'vmlinux-art-ramdisk' make available on TFTP server at 192.168.1.101 power board, interrupt boot execute tftpboot and bootm 0x81000000 NOTE: TFTP is not reliable due to bugged bootloader set MTU to 600 and try many times if your TFTP server supports setting block size higher block size is better. **Format of OEM firmware image:** The OEM software of EAP1750H is a heavily modified version of Openwrt Kamikaze. One of the many modifications is to the sysupgrade program. Image verification is performed simply by the successful ungzip and untar of the supplied file and name check and header verification of the resulting contents. To form a factory.bin that is accepted by OEM Openwrt build, the kernel and rootfs must have specific names... openwrt-ar71xx-generic-eap1750h-uImage-lzma.bin openwrt-ar71xx-generic-eap1750h-root.squashfs and begin with the respective headers (uImage, squashfs). Then the files must be tarballed and gzipped. The resulting binary is actually a tar.gz file in disguise. This can be verified by using binwalk on the OEM firmware images, ungzipping then untaring. Newer EnGenius software requires more checks but their script includes a way to skip them, otherwise the tar must include a text file with the version and md5sums in a deprecated format. The OEM upgrade script is at /etc/fwupgrade.sh. OKLI kernel loader is required because the OEM software expects the kernel to be no greater than 1536k and the factory.bin upgrade procedure would otherwise overwrite part of the kernel when writing rootfs. Note on PLL-data cells: The default PLL register values will not work because of the external AR8035 switch between the SOC and the ethernet port. For QCA955x series, the PLL registers for eth0 and eth1 can be see in the DTSI as 0x28 and 0x48 respectively. Therefore the PLL registers can be read from uboot for each link speed after attempting tftpboot or another network action using that link speed with `md 0x18050028 1` and `md 0x18050048 1`. The clock delay required for RGMII can be applied at the PHY side, using the at803x driver `phy-mode`. Therefore the PLL registers for GMAC0 do not need the bits for delay on the MAC side. This is possible due to fixes in at803x driver since Linux 5.1 and 5.3 Signed-off-by: Michael Pratt <mcpratt@pm.me>
* uboot-mediatek: optimize MMC eraseDaniel Golle2022-11-174-7/+7
| | | | | | | | | Fix mmc_write_vol hush script used by many boards to avoid timeouts on slow SD cards: Instead of erasing a complete partition, only erase blocks for the to-be-written image when writing to MMC. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ath79: support Ruckus ZoneFlex 7025Lech Perczak2022-11-131-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ruckus ZoneFlex 7025 is a single 2.4GHz radio 802.11n 1x1 enterprise access point with built-in Ethernet switch, in an electrical outlet form factor. Hardware highligts: - CPU: Atheros AR7240 SoC at 400 MHz - RAM: 64MB DDR2 - Flash: 16MB SPI-NOR - Wi-Fi: AR9285 built-in 2.4GHz 1x1 radio - Ethernet: single Fast Ethernet port inside the electrical enclosure, coupled with internal LSA connector for direct wiring, four external Fast Ethernet ports on the lower side of the device. - PoE: 802.3af PD input inside the electrical box. 802.3af PSE output on the LAN4 port, capable of sourcing class 0 or class 2 devices, depending on power supply capacity. - External 8P8C pass-through connectors on the back and right side of the device - Standalone 48V power input on the side, through 2/1mm micro DC barrel jack Serial console: 115200-8-N-1 on internal JP1 header. Pinout: ---------- JP1 |5|4|3|2|1| ---------- Pin 1 is near the "H1" marking. 1 - RX 2 - n/c 3 - VCC (3.3V) 4 - GND 5 - TX Installation: There are two methods of installation: - Using serial console [1] - requires some disassembly, 3.3V USB-Serial adapter, TFTP server, and removing a single T10 screw, but with much less manual steps, and is generally recommended, being safer. - Using stock firmware root shell exploit, SSH and TFTP [2]. Does not work on some rare versions of stock firmware. A more involved, and requires installing `mkenvimage` from u-boot-tools package if you choose to rebuild your own environment, but can be used without disassembly or removal from installation point, if you have the credentials. If for some reason, size of your sysupgrade image exceeds 13312kB, proceed with method [1]. For official images this is not likely to happen ever. [1] Using serial console: 0. Connect serial console to H1 header. Ensure the serial converter does not back-power the board, otherwise it will fail to boot. 1. Power-on the board. Then quickly connect serial converter to PC and hit Ctrl+C in the terminal to break boot sequence. If you're lucky, you'll enter U-boot shell. Then skip to point 3. Connection parameters are 115200-8-N-1. 2. Allow the board to boot. Press the reset button, so the board reboots into U-boot again and go back to point 1. 3. Set the "bootcmd" variable to disable the dual-boot feature of the system and ensure that uImage is loaded. This is critical step, and needs to be done only on initial installation. > setenv bootcmd "bootm 0x9f040000" > saveenv 4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed: > setenv serverip 192.168.1.2 > setenv ipaddr 192.168.1.1 > tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7025-initramfs-kernel.bin > bootm 0x81000000 5. Optional, but highly recommended: back up contents of "firmware" partition: $ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7025_fw1_backup.bin 6. Copy over sysupgrade image, and perform actual installation. OpenWrt shall boot from flash afterwards: $ ssh root@192.168.1.1 # sysupgrade -n openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin [2] Using stock root shell: 0. Reset the device to factory defaullts. Power-on the device and after it boots, hold the reset button near Ethernet connectors for 5 seconds. 1. Connect the device to the network. It will acquire address over DHCP, so either find its address using list of DHCP leases by looking for label MAC address, or try finding it by scanning for SSH port: $ nmap 10.42.0.0/24 -p22 From now on, we assume your computer has address 10.42.0.1 and the device has address 10.42.0.254. 2. Set up a TFTP server on your computer. We assume that TFTP server root is at /srv/tftp. 3. Obtain root shell. Connect to the device over SSH. The SSHD ond the frmware is pretty ancient and requires enabling HMAC-MD5. $ ssh 10.42.0.254 \ -o UserKnownHostsFile=/dev/null \ -o StrictHostKeyCheking=no \ -o MACs=hmac-md5 Login. User is "super", password is "sp-admin". Now execute a hidden command: Ruckus It is case-sensitive. Copy and paste the following string, including quotes. There will be no output on the console for that. ";/bin/sh;" Hit "enter". The AP will respond with: grrrr OK Now execute another hidden command: !v54! At "What's your chow?" prompt just hit "enter". Congratulations, you should now be dropped to Busybox shell with root permissions. 4. Optional, but highly recommended: backup the flash contents before installation. At your PC ensure the device can write the firmware over TFTP: $ sudo touch /srv/tftp/ruckus_zf7025_firmware{1,2}.bin $ sudo chmod 666 /srv/tftp/ruckus_zf7025_firmware{1,2}.bin Locate partitions for primary and secondary firmware image. NEVER blindly copy over MTD nodes, because MTD indices change depending on the currently active firmware, and all partitions are writable! # grep rcks_wlan /proc/mtd Copy over both images using TFTP, this will be useful in case you'd like to return to stock FW in future. Make sure to backup both, as OpenWrt uses bot firmwre partitions for storage! # tftp -l /dev/<rcks_wlan.main_mtd> -r ruckus_zf7025_firmware1.bin -p 10.42.0.1 # tftp -l /dev/<rcks_wlan.bkup_mtd> -r ruckus_zf7025_firmware2.bin -p 10.42.0.1 When the command finishes, copy over the dump to a safe place for storage. $ cp /srv/tftp/ruckus_zf7025_firmware{1,2}.bin ~/ 5. Ensure the system is running from the BACKUP image, i.e. from rcks_wlan.bkup partition or "image 2". Otherwise the installation WILL fail, and you will need to access mtd0 device to write image which risks overwriting the bootloader, and so is not covered here and not supported. Switching to backup firmware can be achieved by executing a few consecutive reboots of the device, or by updating the stock firmware. The system will boot from the image it was not running from previously. Stock firmware available to update was conveniently dumped in point 4 :-) 6. Prepare U-boot environment image. Install u-boot-tools package. Alternatively, if you build your own images, OpenWrt provides mkenvimage in host staging directory as well. It is recommended to extract environment from the device, and modify it, rather then relying on defaults: $ sudo touch /srv/tftp/u-boot-env.bin $ sudo chmod 666 /srv/tftp/u-boot-env.bin On the device, find the MTD partition on which environment resides. Beware, it may change depending on currently active firmware image! # grep u-boot-env /proc/mtd Now, copy over the partition # tftp -l /dev/mtd<N> -r u-boot-env.bin -p 10.42.0.1 Store the stock environment in a safe place: $ cp /srv/tftp/u-boot-env.bin ~/ Extract the values from the dump: $ strings u-boot-env.bin | tee u-boot-env.txt Now clean up the debris at the end of output, you should end up with each variable defined once. After that, set the bootcmd variable like this: bootcmd=bootm 0x9f040000 You should end up with something like this: bootcmd=bootm 0x9f040000 bootargs=console=ttyS0,115200 rootfstype=squashfs init=/sbin/init baudrate=115200 ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee mtdparts=mtdparts=ar7100-nor0:256k(u-boot),7168k(rcks_wlan.main),7168k(rcks_wlan.bkup),1280k(datafs),256k(u-boot-env) mtdids=nor0=ar7100-nor0 bootdelay=2 filesize=52e000 fileaddr=81000000 ethact=eth0 stdin=serial stdout=serial stderr=serial partition=nor0,0 mtddevnum=0 mtddevname=u-boot ipaddr=192.168.0.1 serverip=192.168.0.2 stderr=serial ethact=eth0 These are the defaults, you can use most likely just this as input to mkenvimage. Now, create environment image and copy it over to TFTP root: $ mkenvimage -s 0x40000 -b -o u-boot-env.bin u-boot-env.txt $ sudo cp u-boot-env.bin /srv/tftp This is the same image, gzipped and base64-encoded: H4sICOLMEGMAA3UtYm9vdC1lbnYtbmV3LmJpbgDt0E1u00AUAGDfgm2XDUrTsUV/pTkFSxZoEk+o lcQJtlNaLsURwU4FikDiBN+3eDNvLL/3Zt5/+vFuud8Pq10dp3V3EV4e1uFDGBXTQeq+9HG1b/v9 NsdheP0Y5mV5U4Vw0Y1f1/3wesix/3pM/dO6v2jaZojX/bJpr6dtsUzHuktDjm//FHl4SnXdxfAS wmN4SWkMy+UYVqsx1PUYci52Q31I3dDHP5vU3ZUhXLX7LjxWN7eby+PVNNxsflfe3m8uu9Wm//xt m9rFLjXtv6fLzfEwm5fVfdhc1mlI6342Pytzldvn2dS1qfs49Tjvd3qFOm/Ta6yKdbPNffM9x5sq Ty805acL3Zfh5HTD1RDHJRT9WLGNfe6atJ2S/XE4y3LX/c6mSzZDs29P3edhmqXOz+1xF//s0y7H t3GL5nDqWT5Ui/Gii7Aoi7HQ81jrcHZY/dXkfLLiJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8 xy8jb4zOAAAEAA== 7. Perform actual installation. Copy over OpenWrt sysupgrade image to TFTP root: $ sudo cp openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin /srv/tftp Now load both to the device over TFTP: # tftp -l /tmp/u-boot-env.bin -r u-boot-env.bin -g 10.42.0.1 # tftp -l /tmp/openwrt.bin -r openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin -g 10.42.0.1 Verify checksums of both images to ensure the transfer over TFTP was completed: # sha256sum /tmp/u-boot-env.bin /tmp/openwrt.bin And compare it against source images: $ sha256sum /srv/tftp/u-boot-env.bin /srv/tftp/openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin Locate MTD partition of the primary image: # grep rcks_wlan.main /proc/mtd Now, write the images in place. Write U-boot environment last, so unit still can boot from backup image, should power failure occur during this. Replace MTD placeholders with real MTD nodes: # flashcp /tmp/openwrt.bin /dev/<rcks_wlan.main_mtd> # flashcp /tmp/u-boot-env.bin /dev/<u-boot-env_mtd> Finally, reboot the device. The device should directly boot into OpenWrt. Look for the characteristic power LED blinking pattern. # reboot -f After unit boots, it should be available at the usual 192.168.1.1/24. Return to factory firmware: 1. Boot into OpenWrt initramfs as for initial installation. To do that without disassembly, you can write an initramfs image to the device using 'sysupgrade -F' first. 2. Unset the "bootcmd" variable: fw_setenv bootcmd "" 3. Concatenate the firmware backups, if you took them during installation using method 2: $ cat ruckus_zf7025_fw1_backup.bin ruckus_zf7025_fw2_backup.bin > ruckus_zf7025_backup.bin 3. Write factory images downloaded from manufacturer website into fwconcat0 and fwconcat1 MTD partitions, or restore backup you took before installation: # mtd write ruckus_zf7025_backup.bin /dev/mtd1 4. Reboot the system, it should load into factory firmware again. Quirks and known issues: - Flash layout is changed from the factory, to use both firmware image partitions for storage using mtd-concat, and uImage format is used to actually boot the system, which rules out the dual-boot capability. - The 2.4 GHz radio has its own EEPROM on board, not connected to CPU. - The stock firmware has dual-boot capability, which is not supported in OpenWrt by choice. It is controlled by data in the top 64kB of RAM which is unmapped, to avoid the interference in the boot process and accidental switch to the inactive image, although boot script presence in form of "bootcmd" variable should prevent this entirely. - On some versions of stock firmware, it is possible to obtain root shell, however not much is available in terms of debugging facitilies. 1. Login to the rkscli 2. Execute hidden command "Ruckus" 3. Copy and paste ";/bin/sh;" including quotes. This is required only once, the payload will be stored in writable filesystem. 4. Execute hidden command "!v54!". Press Enter leaving empty reply for "What's your chow?" prompt. 5. Busybox shell shall open. Source: https://alephsecurity.com/vulns/aleph-2019014 Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
* uboot-envtools: ath79: add support for Ubiquiti XM devicesLech Perczak2022-11-131-0/+8
| | | | | | | | | | | | | Inspired by commit 9565c5726a34da7c9c953d2293b70fdbfef0e0be, and by facts that all Ubiquiti XM devices share flash layout, and images are mostly compatible between all of them - enable uboot-envtools support for whole XM line. Build tested on: Ubiquiti Airrouter, Bullet-M (7240,7241), Nanobridge-M, Nanostation-M (+ Loco), Picostation-M, Powerbridge-M, Rocket-M. Runtime tested on: Ubiquiti Nanobridge M5 (XM). Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-11 09:55:28 +0000