openwrt/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh

240 lines
4.9 KiB
Bash
Raw Normal View History

PART_NAME=firmware
REQUIRE_IMAGE_METADATA=1
RAMFS_COPY_BIN='fw_printenv fw_setenv'
RAMFS_COPY_DATA='/etc/fw_env.config /var/lock/fw_printenv.lock'
platform_check_image() {
ipq40xx: add support for ASUS RT-AC58U/RT-ACRH13 This patch adds support for ASUS RT-AC58U/RT-ACRH13. hardware highlights: SOC: IPQ4018 / QCA Dakota CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7 DRAM: 128 MiB DDR3L-1066 @ 537 MHz (1074?) NT5CC64M16GP-DI NOR: 2 MiB Macronix MX25L1606E (for boot, QSEE) NAND: 128 MiB Winbond W25NO1GVZE1G (cal + kernel + root, UBI) ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN) USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC) WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2 WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2 INPUT: one Reset and one WPS button LEDS: Status, WAN, WIFI1/2, USB and LAN (one blue LED for each) Serial: WARNING: The serial port needs a TTL/RS-232 3V3 level converter! The Serial setting is 115200-8-N-1. The board has an unpopulated 1x4 0.1" header. The pinout (VDD, RX, GND, TX) is printed on the PCB right next to the connector. U-Boot Note: The ethernet driver isn't always reliable and can sometime time out... Don't worry, just retry. Access via the serial console is required. As well as a working TFTP-server setup and the initramfs image. (If not provided, it has to be built from the OpenWrt source. Make sure to enable LZMA as the compression for the INITRAMFS!) To install the image permanently, you have to do the following steps in the listed order. 1. Open up the router. There are four phillips screws hiding behind the four plastic feets on the underside. 2. Connect the serial cable (See notes above) 3. Connect your router via one of the four LAN-ports (yellow) to a PC which can set the IP-Address and ssh and scp from. If possible set your PC's IPv4 Address to 192.168.1.70 (As this is the IP-Address the Router's bootloader expects for the tftp server) 4. power up the router and enter the u-boot choose option 1 to upload the initramfs image. And follow through the ipv4 setup. Wait for your router's status LED to stop blinking rapidly and glow just blue. (The LAN LED should also be glowing blue). 3. Connect to the OpenWrt running in RAM The default IPv4-Address of your router will be 192.168.1.1. 1. Copy over the openwrt-sysupgrade.bin image to your router's temporary directory # scp openwrt-sysupgrade.bin root@192.168.1.1:/tmp 2. ssh from your PC into your router as root. # ssh root@192.168.1.1 The default OpenWrt-Image won't ask for a password. Simply hit the Enter-Key. Once connected...: run the following commands on your temporary installation 3. delete the "jffs2" ubi partition to make room for your new root partition # ubirmvol /dev/ubi0 --name=jffs2 4. install OpenWrt on the NAND Flash. # sysupgrade -v /tmp/openwrt-sysupgrade.bin - This will will automatically reboot the router - Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2018-03-07 08:13:10 +00:00
case "$(board_name)" in
asus,rt-ac42u |\
ipq40xx: add support for ASUS RT-AC58U/RT-ACRH13 This patch adds support for ASUS RT-AC58U/RT-ACRH13. hardware highlights: SOC: IPQ4018 / QCA Dakota CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7 DRAM: 128 MiB DDR3L-1066 @ 537 MHz (1074?) NT5CC64M16GP-DI NOR: 2 MiB Macronix MX25L1606E (for boot, QSEE) NAND: 128 MiB Winbond W25NO1GVZE1G (cal + kernel + root, UBI) ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN) USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC) WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2 WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2 INPUT: one Reset and one WPS button LEDS: Status, WAN, WIFI1/2, USB and LAN (one blue LED for each) Serial: WARNING: The serial port needs a TTL/RS-232 3V3 level converter! The Serial setting is 115200-8-N-1. The board has an unpopulated 1x4 0.1" header. The pinout (VDD, RX, GND, TX) is printed on the PCB right next to the connector. U-Boot Note: The ethernet driver isn't always reliable and can sometime time out... Don't worry, just retry. Access via the serial console is required. As well as a working TFTP-server setup and the initramfs image. (If not provided, it has to be built from the OpenWrt source. Make sure to enable LZMA as the compression for the INITRAMFS!) To install the image permanently, you have to do the following steps in the listed order. 1. Open up the router. There are four phillips screws hiding behind the four plastic feets on the underside. 2. Connect the serial cable (See notes above) 3. Connect your router via one of the four LAN-ports (yellow) to a PC which can set the IP-Address and ssh and scp from. If possible set your PC's IPv4 Address to 192.168.1.70 (As this is the IP-Address the Router's bootloader expects for the tftp server) 4. power up the router and enter the u-boot choose option 1 to upload the initramfs image. And follow through the ipv4 setup. Wait for your router's status LED to stop blinking rapidly and glow just blue. (The LAN LED should also be glowing blue). 3. Connect to the OpenWrt running in RAM The default IPv4-Address of your router will be 192.168.1.1. 1. Copy over the openwrt-sysupgrade.bin image to your router's temporary directory # scp openwrt-sysupgrade.bin root@192.168.1.1:/tmp 2. ssh from your PC into your router as root. # ssh root@192.168.1.1 The default OpenWrt-Image won't ask for a password. Simply hit the Enter-Key. Once connected...: run the following commands on your temporary installation 3. delete the "jffs2" ubi partition to make room for your new root partition # ubirmvol /dev/ubi0 --name=jffs2 4. install OpenWrt on the NAND Flash. # sysupgrade -v /tmp/openwrt-sysupgrade.bin - This will will automatically reboot the router - Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2018-03-07 08:13:10 +00:00
asus,rt-ac58u)
local ubidev=$(nand_find_ubi $CI_UBIPART)
local asus_root=$(nand_find_volume $ubidev jffs2)
[ -n "$asus_root" ] || return 0
cat << EOF
jffs2 partition is still present.
There's probably no space left
to install the filesystem.
You need to delete the jffs2 partition first:
# ubirmvol /dev/ubi0 --name=jffs2
ipq40xx: add support for ZTE MF286D ZTE MF286D is a LTE router with four gigabit ethernet ports and integrated QMI mPCIE modem. Hardware specification: - CPU: IPQ4019 - RAM: 256MB - Flash: NAND 128MB + NOR 2MB - WLAN1: Qualcomm Atheros QCA4019 2.4GHz 802.11bgn 2x2:2 - WLAN2: Qualcomm Atheros QCA4019 5GHz 802.11anac 2x2:2 - LTE: mPCIe cat 12 card (Modem chipset MDM9250) - LAN: 4 Gigabit Ports - USB: 1x USB2.0 (regular port). 1x USB3.0 (mpcie - used by the modem) - Serial console: X8 connector 115200 8n1 Known issues: - Many LEDs are driven by the modem. Only internal LEDs and wifi LEDs are driven by cpu. - Wifi LED is triggered by phy0tpt only - No VoIP support - LAN1/WAN port is configured as WAN - ZTE gives only one MAC per device. Use +1/+2/+3 increment for WAN and WLAN0/1 Opening the case: 1. Take of battery lid (no battery support for this model, battery cage is dummy). 2. Unscrew screw placed behind battery lid. 3. Take off back cover. It attached with multiple plastic clamps. 4. Unscrew four more screws hidden behind back case. 5. Remove front panel from blue chassis. There are more plastic clamps. 6. Unscrew two boards, which secures the PCB in the chassis. 7. Extract board from blue chassis. Console connection (X8 connector): 1. Parameters: 115200 8N1 2. Pin description: (from closest pin to X8 descriptor to farthest) - VCC (3.3V) - TX - RX - GND Install Instructions: Serial + initramfs: 1. Place OpenWrt initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.1.3 2. Connect serial console (115200,8n1) to X8 connector. 3. Connect TFTP server to RJ-45 port. 4. Stop in u-Boot and run u-Boot commands: setenv serverip 192.168.1.3 setenv ipaddr 192.168.1.72 set fdt_high 0x85000000 tftp openwrt-ipq40xx-generic-zte_mf286d-initramfs-fit-zImage.itb bootm $loadaddr 5. Please make backup of original partitions, if you think about revert to stock. 6. Login via ssh or serial and remove stock partitions: ubiattach -m 9 ubirmvol /dev/ubi0 -N ubi_rootfs ubirmvol /dev/ubi0 -N ubi_rootfs_data 7. Install image via "sysupgrade -n". Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com> (cosmetic changes to the commit message) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2021-11-23 08:10:14 +00:00
Once this is done. Retry.
EOF
return 1
;;
ipq40xx: Add support ZTE MF18A Light and small router ( In Poland operators sells together with MC7010 outdoor modem to provide WIFI inside home). Device specification SoC Type: Qualcomm IPQ4019 RAM: 256 MiB Flash: 128 MiB SPI NAND (Winbond W25N01GV) ROM: 2MiB SPI Flash (GD25Q16) Wireless 2.4 GHz (IP4019): b/g/n, 2x2 Wireless 5 GHz (QCA9982): a/n/ac, 3x3 Ethernet: 2xGbE (WAN/LAN1, LAN2) USB ports: No Button: 2 (Reset/WPS) LEDs: 3 external leds: Power (blue) , WiFI (blue and red), SMARTHOME (blue and red) and 1 internal (blue) -- NOTE: Power controls all external led (if down ,all others also not lights even signal is up) Power: 5VDC, 2,1A via USB-C socket Bootloader: U-Boot On board ZWave and Zigbee (EFR32 MG1P232GG..) modules ( not supported by orginal software ) Installation 1.Open MF18A case by ungluing rubber pad under the router and unscrew screws, and connect to serial console port, with the following pinout, starting from pin 1, which is the topmost pin when the board is upright (reset button on the bottom) : VCC (3.3V). Do not use unless you need to source power for the converer from it. TX RX GND Default port configuration in U-boot as well as in stock firmware is 115200-8-N-1. 2.Place OpenWrt initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.0.2 3.Connect TFTP server to RJ-45 port (WAN/LAN1). 4.Power on MF18A , stop in u-Boot (using ESC button) and run u-Boot commands: setenv serverip 192.168.0.2 setenv ipaddr 192.168.0.1 set fdt_high 0x85000000 tftpboot 0x84000000 openwrt-ipq40xx-generic-zte_mf18a-initramfs-fit-zImage.itb bootm 0x84000000 5.Please make backup of original partitions, if you think about revert to stock, specially mtd8 (Web UI) and mtd9 (rootFS). Use /tmp as temporary storage and do: WEB PARITION cat /dev/mtd8 > /tmp/mtd8.bin scp /tmp/mtd8.bin root@YOURSERVERIP:/ rm /tmp/mtd8.bin ROOT PARITION cat /dev/mtd9 > /tmp/mtd9.bin scp /tmp/mtd9.bin root@YOURSERVERIP:/ rm /tmp/mtd9.bin If you are sure ,that you want to flash openwrt, from uBoot, before bootm, clean rootfs partition with command: nand erase 0x1800000 0x1D00000 6.Login via ssh or serial and remove stock partitions (default IP 192.168.1.1): ubiattach -m 9 # it could return error if ubi was attached before or rootfs part was erased before ubirmvol /dev/ubi0 -N ubi_rootfs # it could return error if rootfs part was erased before ubirmvol /dev/ubi0 -N ubi_rootfs_data # some devices doesn't have it 7. Install image via : sysupgrade -n /tmp/openwrt-ipq40xx-generic-zte_mf18a-squashfs-sysupgrade.bin previously wgeting bin. Sometimes it could print ubi attach error, but please ignore it if process goes forward. Back to Stock (!!! need original dump taken from initramfs !!!) ------------- Place mtd8.bin and mtd9.bin initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.0.2 Connect serial console (115200,8n1) to serial console connector . Connect TFTP server to RJ-45 port (WAN/LAN1). rename mtd8.bin to web.img and mtd9.bin to root_uImage_s Stop in u-Boot (using ESC button) and run u-Boot commands: This will erase Web and RootFS: nand erase 0x1000000 0x800000 nand erase 0x1800000 0x1D00000 This will restore RootFS: tftpboot 0x84000000 root_uImage_s nand erase 0x1800000 0x1D00000 nand write 0x84000000 0x1800000 0x1D00000 This will restore Web Interface: tftpboot 0x84000000 web.img nand erase 0x1000000 0x800000 nand write 0x84000000 0x1000000 0x800000 After first boot on stock firwmare, do a factory reset. Push reset button for 5 seconds so all parameters will be reverted to the one printed on label on bottom of the router As reference was taken MF289F support by Giammarco Marzano stich86@gmail.com and MF286D by Pawel Dembicki paweldembicki@gmail.com Signed-off-by: Marcin Gajda <mgajda@o2.pl>
2022-12-28 18:01:40 +00:00
zte,mf18a |\
ipq40xx: Add ZTE MF289F It's a 4G Cat.20 router used by Vodafone Italy (called Vodafone FWA) and Vodafone DE\T-Mobile PL (called GigaCube). Modem is a MiniPCIe-to-USB based on Snapdragon X24, it supports 4CA aggregation. There are currently two hardware revisions, which differ on the 5Ghz radio: AT1 = QCA9984 5Ghz Radio on PCI-E bus AT2 = IPQ4019 5Ghz Radio inside IPQ4019 like 2.4Ghz Device specification -------------------- SoC Type: Qualcomm IPQ4019 RAM: 256 MiB Flash: 128 MiB SPI NAND (Winbond W25N01GV) ROM: 2MiB SPI Flash (GD25Q16) Wireless 2.4 GHz (IP4019): b/g/n, 2x2 Wireless 5 GHz: (QCA9984): a/n/ac, 4x4 HW REV AT1 (IPA4019): a/n/ac, 2x2 HW REV AT2 Ethernet: 2xGbE (WAN/LAN1, LAN2) USB ports: No Button: 2 (Reset/WPS) LEDs: 3 external leds: Network (white or red), Wifi, Power and 1 internal (blue) Power: 12 VDC, 1 A Connector type: Barrel Bootloader: U-Boot Installation ------------ 1. Place OpenWrt initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.0.2 2. Connect serial console (115200,8n1) to serial connector GND (which is right next to the thing with MF289F MIMO-V1.0), RX, TX (refer to this image: https://ibb.co/31Gngpr). 3. Connect TFTP server to RJ-45 port (WAN/LAN1). 4. Stop in u-Boot (using ESC button) and run u-Boot commands: setenv serverip 192.168.0.2 setenv ipaddr 192.168.0.1 set fdt_high 0x85000000 tftp openwrt-ipq40xx-generic-zte_mf289f-initramfs-fit-zImage.itb bootm $loadaddr 5. Please make backup of original partitions, if you think about revert to stock, specially mtd16 (Web UI) and mtd17 (rootFS). Use /tmp as temporary storage and do: WEB PARITION -------------------------------------- cat /dev/mtd16 > /tmp/mtd16.bin scp /tmp/mtd16.bin root@YOURSERVERIP:/ rm /tmp/mtd16.bin ROOT PARITION -------------------------------------- cat /dev/mtd17 > /tmp/mtd17.bin scp /tmp/mtd17.bin root@YOURSERVERIP:/ rm /tmp/mtd17.bin 6. Login via ssh or serial and remove stock partitions (default IP 192.168.0.1): # this can return an error, if ubi was attached before # or rootfs part was erased before. ubiattach -m 17 # it could return error if rootfs part was erased before ubirmvol /dev/ubi0 -N ubi_rootfs # some devices doesn't have it ubirmvol /dev/ubi0 -N ubi_rootfs_data 7. download and install image via sysupgrade -n (either use wget/scp to copy the mf289f's squashfs-sysupgrade.bin to the device's /tmp directory) sysupgrade -n /tmp/openwrt-...-zte_mf289f-squashfs-sysupgrade.bin Sometimes it could print ubi attach error, but please ignore it if process goes forward. Flash Layout NAND: mtd8: 000a0000 00020000 "fota-flag" mtd9: 00080000 00020000 "0:ART" mtd10: 00080000 00020000 "mac" mtd11: 000c0000 00020000 "reserved2" mtd12: 00400000 00020000 "cfg-param" mtd13: 00400000 00020000 "log" mtd14: 000a0000 00020000 "oops" mtd15: 00500000 00020000 "reserved3" mtd16: 00800000 00020000 "web" mtd17: 01d00000 00020000 "rootfs" mtd18: 01900000 00020000 "data" mtd19: 03200000 00020000 "fota" mtd20: 0041e000 0001f000 "kernel" mtd21: 0101b000 0001f000 "ubi_rootfs" SPI: mtd0: 00040000 00010000 "0:SBL1" mtd1: 00020000 00010000 "0:MIBIB" mtd2: 00060000 00010000 "0:QSEE" mtd3: 00010000 00010000 "0:CDT" mtd4: 00010000 00010000 "0:DDRPARAMS" mtd5: 00010000 00010000 "0:APPSBLENV" mtd6: 000c0000 00010000 "0:APPSBL" mtd7: 00050000 00010000 "0:reserved1" Back to Stock (!!! need original dump taken from initramfs !!!) ------------- 1. Place mtd16.bin and mtd17.bin initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.0.2 2. Connect serial console (115200,8n1) to serial console connector (refer to the pin-out from above). 3. Connect TFTP server to RJ-45 port (WAN/LAN1). 4. rename mtd16.bin to web.img and mtd17.bin to root_uImage_s 5. Stop in u-Boot (using ESC button) and run u-Boot commands: This will erase RootFS+Web: nand erase 0x1000000 0x800000 nand erase 0x1800000 0x1D00000 This will restore RootFS: tftpboot 0x84000000 ${dir}root_uImage_s nand erase 0x1800000 0x1D00000 nand write $fileaddr 0x1800000 $filesize This will restore Web Interface: tftpboot 0x84000000 ${dir}web.img nand erase 0x1000000 0x800000 nand write $fileaddr 0x1000000 $filesize After first boot on stock firwmare, do a factory reset. Push reset button for 5 seconds so all parameters will be reverted to the one printed on label on bottom of the router Signed-off-by: Giammarco Marzano <stich86@gmail.com> Reviewed-by: Lech Perczak <lech.perczak@gmail.com> (Warning: commit message did not conform to UTF-8 - hopefully fixed?, added description of the pin-out if image goes down, reformatted commit message to be hopefully somewhat readable on git-web, redid some of the gpio-buttons & leds DT nodes, etc.) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-09-14 12:20:43 +00:00
zte,mf286d |\
zte,mf287|\
ipq4019: add support for ZTE MF287+ aka DreiNeo The ZTE MF287+ is a LTE router used (exclusively?) by the network operator "3". The MF287 (i.e. non-plus aka 3Neo) is also supported (the only difference is the LTE modem) Specifications ============== SoC: IPQ4018 RAM: 256MiB Flash: 8MiB SPI-NOR + 128MiB SPI-NAND LAN: 4x GBit LAN LTE: ZTE Cat12 (MF287+) / ZTE Cat6 (MF287) WiFi: 802.11a/b/g/n/ac SoC-integrated MAC addresses ============= LAN: from config + 2 WiFi 1: from config WiFi 2: from config + 1 Installation ============ Option 1 - TFTP --------------- TFTP installation using UART is preferred. Disassemble the device and connect serial. Put the initramfs image as openwrt.bin to your TFTP server and configure a static IP of 192.168.1.100. Load the initramfs image by typing: setenv serverip 192.168.1.100 setenv ipaddr 192.168.1.1 tftpboot 0x82000000 openwrt.bin bootm 0x82000000 From this intiramfs boot you can take a backup of the currently installed partitions as no vendor firmware is available for download: ubiattach -m14 cat /dev/ubi0_0 > /tmp/ubi0_0 cat /dev/ubi0_1 > /tmp/ubi0_1 Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save. Once booted, transfer the sysupgrade image and run sysupgrade. You might have to delete the stock volumes first: ubirmvol /dev/ubi0 -N ubi_rootfs ubirmvol /dev/ubi0 -N kernel Option 2 - From stock firmware ------------------------------ The installation from stock requires an exploit first. The exploit consists of a backup file that forces the firmware to download telnetd via TFTP from 192.168.0.22 and run it. Once exploited, you can connect via telnet and login as admin:admin. The exploit will be available at the device wiki page. Once inside the stock firmware, you can transfer the -factory.bin file to /tmp by using "scp" from the stock frmware or "tftp". ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write access - you need to read from one file in /proc. Once done, you need to erase the UBI partition and flash OpenWrt. Before performing the operation, make sure that mtd13 is the partition labelled "rootfs" by calling "cat /proc/mtd". Complete commands: cd /tmp tftp -g -r factory.bin 192.168.0.22 cat /proc/driver/sensor_id flash_erase /dev/mtd13 0 0 dd if=/tmp/factory.bin of=/dev/mtdblock13 bs=131072 Afterwards, reboot your device and you should have a working OpenWrt installation. Restore Stock ============= Option 1 - via UART ------------------- Boot an OpenWrt initramfs image via TFTP as for the initial installation. Transfer the two backed-up files to your box to /tmp. Then, run the following commands - replace $kernel_length and $rootfs_size by the size of ubi0_0 and ubi0_1 in bytes. ubiattach -m 14 ubirmvol /dev/ubi0 -N kernel ubirmvol /dev/ubi0 -N rootfs ubirmvol /dev/ubi0 -N rootfs_data ubimkvol /dev/ubi0 -N kernel -s $kernel_length ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0 ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1 Option 2 - from within OpenWrt ------------------------------ This option requires to flash an initramfs version first so that access to the flash is possible. This can be achieved by sysupgrading to the recovery.bin version and rebooting. Once rebooted, you are again in a default OpenWrt installation, but no partition is mounted. Follow the commands from Option 1 to flash back to stock. LTE Modem ========= The LTE modem is similar to other ZTE devices and controls some more LEDs and battery management. Configuring the connection using uqmi works properly, the modem provides three serial ports and a QMI CDC ethernet interface. Signed-off-by: Andreas Böhler <dev@aboehler.at> (cherry picked from commit f70ee53b08466f612546f699c556cbdaa39e1466)
2023-06-07 19:24:18 +00:00
zte,mf287plus |\
ipq4019: add support for ZTE MF287 Pro aka DreiNeo Pro The ZTE MF287 Pro is a LTE router used (exclusively?) by the network operator "3". It is very similar to the MF287+, but the hardware layout and partition layout have changed quite a bit. Specifications ============== SoC: IPQ4018 RAM: 256MiB Flash: 8MiB SPI-NOR + 128MiB SPI-NAND LAN: 4x GBit LAN LTE: ZTE Cat12 WiFi: 802.11a/b/g/n/ac SoC-integrated USB: 1x 2.0 MAC addresses ============= LAN: from config + 2 WiFi 1: from config WiFi 2: from config + 1 Installation ============ Option 1 - TFTP --------------- TFTP installation using UART is preferred. Disassemble the device and connect serial. Put the initramfs image as openwrt.bin to your TFTP server and configure a static IP of 192.168.1.100. Load the initramfs image by typing: setenv serverip 192.168.1.100 setenv ipaddr 192.168.1.1 tftpboot 0x82000000 openwrt.bin bootm 0x82000000 From this intiramfs boot you can take a backup of the currently installed partitions as no vendor firmware is available for download: ubiattach -m17 cat /dev/ubi0_0 > /tmp/ubi0_0 cat /dev/ubi0_1 > /tmp/ubi0_1 Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save. Once booted, transfer the sysupgrade image and run sysupgrade. You might have to delete the stock volumes first: ubirmvol /dev/ubi0 -N ubi_rootfs ubirmvol /dev/ubi0 -N kernel Option 2 - From stock firmware ------------------------------ The installation from stock requires an exploit first. The exploit consists of a backup file that forces the firmware to download telnetd via TFTP from 192.168.0.22 and run it. Once exploited, you can connect via telnet and login as admin:admin. The exploit will be available at the device wiki page. Once inside the stock firmware, you can transfer the -factory.bin file to /tmp by using "scp" from the stock frmware or "tftp". ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write access - you need to read from one file in /proc. Once done, you need to erase the UBI partition and flash OpenWrt. Before performing the operation, make sure that mtd13 is the partition labelled "rootfs" by calling "cat /proc/mtd". Complete commands: cd /tmp tftp -g -r factory.bin 192.168.0.22 cat /proc/driver/sensor_id flash_erase /dev/mtd17 0 0 dd if=/tmp/factory.bin of=/dev/mtdblock17 bs=131072 Afterwards, reboot your device and you should have a working OpenWrt installation. Restore Stock ============= Option 1 - via UART ------------------- Boot an OpenWrt initramfs image via TFTP as for the initial installation. Transfer the two backed-up files to your box to /tmp. Then, run the following commands - replace $kernel_length and $rootfs_size by the size of ubi0_0 and ubi0_1 in bytes. ubiattach -m 17 ubirmvol /dev/ubi0 -N kernel ubirmvol /dev/ubi0 -N rootfs ubirmvol /dev/ubi0 -N rootfs_data ubimkvol /dev/ubi0 -N kernel -s $kernel_length ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0 ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1 Option 2 - from within OpenWrt ------------------------------ This option requires to flash an initramfs version first so that access to the flash is possible. This can be achieved by sysupgrading to the recovery.bin version and rebooting. Once rebooted, you are again in a default OpenWrt installation, but no partition is mounted. Follow the commands from Option 1 to flash back to stock. LTE Modem ========= The LTE modem is similar to other ZTE devices and controls some more LEDs and battery management. Configuring the connection using uqmi works properly, the modem provides three serial ports and a QMI CDC ethernet interface. Other Notes =========== Contrary to the stock firmware, the USB port on the back can be used. There is one GPIO Switch "Power button blocker" which, if enabled, does not trigger a reset of the SoC if the modem reboots. If disabled, the SoC is rebooted along with the modem. The modem can be rebooted via the exported GPIO "modem-reset" in /sys/class/gpio. Signed-off-by: Andreas Böhler <dev@aboehler.at> (cherry picked from commit edfe91372adfdaf5ee4e294fb0f5860a16adc551)
2023-07-10 09:55:30 +00:00
zte,mf287pro |\
ipq40xx: Add ZTE MF289F It's a 4G Cat.20 router used by Vodafone Italy (called Vodafone FWA) and Vodafone DE\T-Mobile PL (called GigaCube). Modem is a MiniPCIe-to-USB based on Snapdragon X24, it supports 4CA aggregation. There are currently two hardware revisions, which differ on the 5Ghz radio: AT1 = QCA9984 5Ghz Radio on PCI-E bus AT2 = IPQ4019 5Ghz Radio inside IPQ4019 like 2.4Ghz Device specification -------------------- SoC Type: Qualcomm IPQ4019 RAM: 256 MiB Flash: 128 MiB SPI NAND (Winbond W25N01GV) ROM: 2MiB SPI Flash (GD25Q16) Wireless 2.4 GHz (IP4019): b/g/n, 2x2 Wireless 5 GHz: (QCA9984): a/n/ac, 4x4 HW REV AT1 (IPA4019): a/n/ac, 2x2 HW REV AT2 Ethernet: 2xGbE (WAN/LAN1, LAN2) USB ports: No Button: 2 (Reset/WPS) LEDs: 3 external leds: Network (white or red), Wifi, Power and 1 internal (blue) Power: 12 VDC, 1 A Connector type: Barrel Bootloader: U-Boot Installation ------------ 1. Place OpenWrt initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.0.2 2. Connect serial console (115200,8n1) to serial connector GND (which is right next to the thing with MF289F MIMO-V1.0), RX, TX (refer to this image: https://ibb.co/31Gngpr). 3. Connect TFTP server to RJ-45 port (WAN/LAN1). 4. Stop in u-Boot (using ESC button) and run u-Boot commands: setenv serverip 192.168.0.2 setenv ipaddr 192.168.0.1 set fdt_high 0x85000000 tftp openwrt-ipq40xx-generic-zte_mf289f-initramfs-fit-zImage.itb bootm $loadaddr 5. Please make backup of original partitions, if you think about revert to stock, specially mtd16 (Web UI) and mtd17 (rootFS). Use /tmp as temporary storage and do: WEB PARITION -------------------------------------- cat /dev/mtd16 > /tmp/mtd16.bin scp /tmp/mtd16.bin root@YOURSERVERIP:/ rm /tmp/mtd16.bin ROOT PARITION -------------------------------------- cat /dev/mtd17 > /tmp/mtd17.bin scp /tmp/mtd17.bin root@YOURSERVERIP:/ rm /tmp/mtd17.bin 6. Login via ssh or serial and remove stock partitions (default IP 192.168.0.1): # this can return an error, if ubi was attached before # or rootfs part was erased before. ubiattach -m 17 # it could return error if rootfs part was erased before ubirmvol /dev/ubi0 -N ubi_rootfs # some devices doesn't have it ubirmvol /dev/ubi0 -N ubi_rootfs_data 7. download and install image via sysupgrade -n (either use wget/scp to copy the mf289f's squashfs-sysupgrade.bin to the device's /tmp directory) sysupgrade -n /tmp/openwrt-...-zte_mf289f-squashfs-sysupgrade.bin Sometimes it could print ubi attach error, but please ignore it if process goes forward. Flash Layout NAND: mtd8: 000a0000 00020000 "fota-flag" mtd9: 00080000 00020000 "0:ART" mtd10: 00080000 00020000 "mac" mtd11: 000c0000 00020000 "reserved2" mtd12: 00400000 00020000 "cfg-param" mtd13: 00400000 00020000 "log" mtd14: 000a0000 00020000 "oops" mtd15: 00500000 00020000 "reserved3" mtd16: 00800000 00020000 "web" mtd17: 01d00000 00020000 "rootfs" mtd18: 01900000 00020000 "data" mtd19: 03200000 00020000 "fota" mtd20: 0041e000 0001f000 "kernel" mtd21: 0101b000 0001f000 "ubi_rootfs" SPI: mtd0: 00040000 00010000 "0:SBL1" mtd1: 00020000 00010000 "0:MIBIB" mtd2: 00060000 00010000 "0:QSEE" mtd3: 00010000 00010000 "0:CDT" mtd4: 00010000 00010000 "0:DDRPARAMS" mtd5: 00010000 00010000 "0:APPSBLENV" mtd6: 000c0000 00010000 "0:APPSBL" mtd7: 00050000 00010000 "0:reserved1" Back to Stock (!!! need original dump taken from initramfs !!!) ------------- 1. Place mtd16.bin and mtd17.bin initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.0.2 2. Connect serial console (115200,8n1) to serial console connector (refer to the pin-out from above). 3. Connect TFTP server to RJ-45 port (WAN/LAN1). 4. rename mtd16.bin to web.img and mtd17.bin to root_uImage_s 5. Stop in u-Boot (using ESC button) and run u-Boot commands: This will erase RootFS+Web: nand erase 0x1000000 0x800000 nand erase 0x1800000 0x1D00000 This will restore RootFS: tftpboot 0x84000000 ${dir}root_uImage_s nand erase 0x1800000 0x1D00000 nand write $fileaddr 0x1800000 $filesize This will restore Web Interface: tftpboot 0x84000000 ${dir}web.img nand erase 0x1000000 0x800000 nand write $fileaddr 0x1000000 $filesize After first boot on stock firwmare, do a factory reset. Push reset button for 5 seconds so all parameters will be reverted to the one printed on label on bottom of the router Signed-off-by: Giammarco Marzano <stich86@gmail.com> Reviewed-by: Lech Perczak <lech.perczak@gmail.com> (Warning: commit message did not conform to UTF-8 - hopefully fixed?, added description of the pin-out if image goes down, reformatted commit message to be hopefully somewhat readable on git-web, redid some of the gpio-buttons & leds DT nodes, etc.) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-09-14 12:20:43 +00:00
zte,mf289f)
ipq40xx: add support for ZTE MF286D ZTE MF286D is a LTE router with four gigabit ethernet ports and integrated QMI mPCIE modem. Hardware specification: - CPU: IPQ4019 - RAM: 256MB - Flash: NAND 128MB + NOR 2MB - WLAN1: Qualcomm Atheros QCA4019 2.4GHz 802.11bgn 2x2:2 - WLAN2: Qualcomm Atheros QCA4019 5GHz 802.11anac 2x2:2 - LTE: mPCIe cat 12 card (Modem chipset MDM9250) - LAN: 4 Gigabit Ports - USB: 1x USB2.0 (regular port). 1x USB3.0 (mpcie - used by the modem) - Serial console: X8 connector 115200 8n1 Known issues: - Many LEDs are driven by the modem. Only internal LEDs and wifi LEDs are driven by cpu. - Wifi LED is triggered by phy0tpt only - No VoIP support - LAN1/WAN port is configured as WAN - ZTE gives only one MAC per device. Use +1/+2/+3 increment for WAN and WLAN0/1 Opening the case: 1. Take of battery lid (no battery support for this model, battery cage is dummy). 2. Unscrew screw placed behind battery lid. 3. Take off back cover. It attached with multiple plastic clamps. 4. Unscrew four more screws hidden behind back case. 5. Remove front panel from blue chassis. There are more plastic clamps. 6. Unscrew two boards, which secures the PCB in the chassis. 7. Extract board from blue chassis. Console connection (X8 connector): 1. Parameters: 115200 8N1 2. Pin description: (from closest pin to X8 descriptor to farthest) - VCC (3.3V) - TX - RX - GND Install Instructions: Serial + initramfs: 1. Place OpenWrt initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.1.3 2. Connect serial console (115200,8n1) to X8 connector. 3. Connect TFTP server to RJ-45 port. 4. Stop in u-Boot and run u-Boot commands: setenv serverip 192.168.1.3 setenv ipaddr 192.168.1.72 set fdt_high 0x85000000 tftp openwrt-ipq40xx-generic-zte_mf286d-initramfs-fit-zImage.itb bootm $loadaddr 5. Please make backup of original partitions, if you think about revert to stock. 6. Login via ssh or serial and remove stock partitions: ubiattach -m 9 ubirmvol /dev/ubi0 -N ubi_rootfs ubirmvol /dev/ubi0 -N ubi_rootfs_data 7. Install image via "sysupgrade -n". Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com> (cosmetic changes to the commit message) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2021-11-23 08:10:14 +00:00
CI_UBIPART="rootfs"
local mtdnum="$( find_mtd_index $CI_UBIPART )"
[ ! "$mtdnum" ] && return 1
ubiattach -m "$mtdnum" || true
local ubidev="$( nand_find_ubi $CI_UBIPART )"
local ubi_rootfs=$(nand_find_volume $ubidev ubi_rootfs)
local ubi_rootfs_data=$(nand_find_volume $ubidev ubi_rootfs_data)
[ -n "$ubi_rootfs" ] || [ -n "$ubi_rootfs_data" ] || return 0
cat << EOF
ubi_rootfs partition is still present.
You need to delete the stock partition first:
# ubirmvol /dev/ubi0 -N ubi_rootfs
Please also delete ubi_rootfs_data, if exist:
# ubirmvol /dev/ubi0 -N ubi_rootfs_data
ipq40xx: add support for ASUS RT-AC58U/RT-ACRH13 This patch adds support for ASUS RT-AC58U/RT-ACRH13. hardware highlights: SOC: IPQ4018 / QCA Dakota CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7 DRAM: 128 MiB DDR3L-1066 @ 537 MHz (1074?) NT5CC64M16GP-DI NOR: 2 MiB Macronix MX25L1606E (for boot, QSEE) NAND: 128 MiB Winbond W25NO1GVZE1G (cal + kernel + root, UBI) ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN) USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC) WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2 WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2 INPUT: one Reset and one WPS button LEDS: Status, WAN, WIFI1/2, USB and LAN (one blue LED for each) Serial: WARNING: The serial port needs a TTL/RS-232 3V3 level converter! The Serial setting is 115200-8-N-1. The board has an unpopulated 1x4 0.1" header. The pinout (VDD, RX, GND, TX) is printed on the PCB right next to the connector. U-Boot Note: The ethernet driver isn't always reliable and can sometime time out... Don't worry, just retry. Access via the serial console is required. As well as a working TFTP-server setup and the initramfs image. (If not provided, it has to be built from the OpenWrt source. Make sure to enable LZMA as the compression for the INITRAMFS!) To install the image permanently, you have to do the following steps in the listed order. 1. Open up the router. There are four phillips screws hiding behind the four plastic feets on the underside. 2. Connect the serial cable (See notes above) 3. Connect your router via one of the four LAN-ports (yellow) to a PC which can set the IP-Address and ssh and scp from. If possible set your PC's IPv4 Address to 192.168.1.70 (As this is the IP-Address the Router's bootloader expects for the tftp server) 4. power up the router and enter the u-boot choose option 1 to upload the initramfs image. And follow through the ipv4 setup. Wait for your router's status LED to stop blinking rapidly and glow just blue. (The LAN LED should also be glowing blue). 3. Connect to the OpenWrt running in RAM The default IPv4-Address of your router will be 192.168.1.1. 1. Copy over the openwrt-sysupgrade.bin image to your router's temporary directory # scp openwrt-sysupgrade.bin root@192.168.1.1:/tmp 2. ssh from your PC into your router as root. # ssh root@192.168.1.1 The default OpenWrt-Image won't ask for a password. Simply hit the Enter-Key. Once connected...: run the following commands on your temporary installation 3. delete the "jffs2" ubi partition to make room for your new root partition # ubirmvol /dev/ubi0 --name=jffs2 4. install OpenWrt on the NAND Flash. # sysupgrade -v /tmp/openwrt-sysupgrade.bin - This will will automatically reboot the router - Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2018-03-07 08:13:10 +00:00
Once this is done. Retry.
EOF
return 1
;;
esac
return 0;
}
ipq40xx: add support for Cell C RTL30VW Cell C RTL30VW is a LTE router with tho gigabit ethernets and integrated QMI mPCIE modem. This is stripped version of ASKEY RTL0030VW. Hardware: Specification: -CPU: IPQ4019 -RAM: 256MB -Flash: NAND 128MB + NOR 16MB -WiFi: Integrated bgn/ac -LTE: mPCIe card (Modem chipset MDM9230) -LAN: 2 Gigabit Ports -USB: 2x USB2.0 -Serial console: RJ-45 115200 8n1 -Unsupported VoIP Known issues: None so far. Instruction install: There are two methods: Factory web-gui and serial + tftp. Web-gui: 1. Apply factory image via stock web-gui. Serial + initramfs: 1. Rename OpenWrt initramfs image to "image" 2. Connect serial console (115200,8n1) 3. Set IP to different than 192.168.1.11, but 24 bit mask, eg. 192.168.1.4. 4. U-Boot commands: sf probe && sf read 0x80000000 0x180000 0x10000 setenv serverip 192.168.1.4 set fdt_high 0x85000000 tftpboot 0x84000000 image bootm 0x84000000 5. Install sysupgrade image via "sysupgrade -n" Back to stock: All is needed is swap 0x4c byte in mtd8 from 0 to 1 or 1 to 0, do firstboot and factory reset with OFW: 1. read mtd8: dd if=/dev/mtd8 of=/tmp/mtd8 2. go to tmp: cd /tmp/ 3. write first part of partition: dd if=mtd8 of=mtd8.new bs=1 count=76 4. check which layout uses bootloader: cat /proc/mtd 5a. If first are kernel_1 and rootfs_1 write 0: echo -n -e '\x00' >> mtd8.new 5b. If first are kernel and rootfs write 1: echo -n -e '\x01' >> mtd8.new 6. fill with rest of data: dd if=mtd8 bs=1 skip=77 >> mtd8.new 7. CHECK IF mtd8.new HAVE CHANGED ONLY ONE BYTE! e.g with: hexdump mtd8.new 8. write new mtd8 to flash: mtd write mtd8.new /dev/mtd8 9. do firstboot 10.reboot 11. Do back to factory defaults in OFW GUI. Based on work: Cezary Jackiewicz <cezary@eko.one.pl> Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
2020-03-09 20:16:43 +00:00
askey_do_upgrade() {
local tar_file="$1"
local board_dir=$(tar tf $tar_file | grep -m 1 '^sysupgrade-.*/$')
board_dir=${board_dir%/}
tar Oxf $tar_file ${board_dir}/root | mtd write - rootfs
nand_do_upgrade "$1"
}
ipq40xx: add support for the ZyXEL NBG6617 This patch adds support for ZyXEL NBG6617 Hardware highlights: SOC: IPQ4018 / QCA Dakota CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7 DRAM: 256 MiB DDR3L-1600/1866 Nanya NT5CC128M16IP-DI @ 537 MHz NOR: 32 MiB Macronix MX25L25635F ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN) USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC) WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2 WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2 INPUT: RESET Button, WIFI/Rfkill Togglebutton, WPS Button LEDS: Power, WAN, LAN 1-4, WLAN 2.4GHz, WLAN 5GHz, USB, WPS Serial: WARNING: The serial port needs a TTL/RS-232 3.3v level converter! The Serial setting is 115200-8-N-1. The 1x4 .1" header comes pre-soldered. Pinout: 1. 3v3 (Label printed on the PCB), 2. RX, 3. GND, 4. TX first install / debricking / restore stock: 0. Have a PC running a tftp-server @ 192.168.1.99/24 1. connect the PC to any LAN-Ports 2. put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file into the tftp-server root directory and rename it to just "ras.bin". 3. power-cycle the router and hold down the the WPS button (for 30sek) 4. Wait (for a long time - the serial console provides some progress reports. The u-boot says it best: "Please be patient". 5. Once the power LED starts to flashes slowly and the USB + WPS LEDs flashes fast at the same time. You have to reboot the device and it should then come right up. Installation via Web-UI: 0. Connect a PC to the powered-on router. It will assign your PC a IP-address via DHCP 1. Access the Web-UI at 192.168.1.1 (Default Passwort: 1234) 2. Go to the "Expert Mode" 3. Under "Maintenance", select "Firmware-Upgrade" 4. Upload the OpenWRT factory image 5. Wait for the Device to finish. It will reboot into OpenWRT without any additional actions needed. To open the ZyXEL NBG6617: 0. remove the four rubber feet glued on the backside 1. remove the four philips screws and pry open the top cover (by applying force between the plastic top housing from the backside/lan-port side) Access the real u-boot shell: ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02" When the device is starting up, the user can enter the the loader shell by simply pressing a key within the 3 seconds once the following string appears on the serial console: | Hit any key to stop autoboot: 3 The user is then dropped to a locked shell. |NBG6617> HELP |ATEN x[,y] set BootExtension Debug Flag (y=password) |ATSE x show the seed of password generator |ATSH dump manufacturer related data in ROM |ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations) |ATGO boot up whole system |ATUR x upgrade RAS image (filename) |NBG6617> In order to escape/unlock a password challenge has to be passed. Note: the value is dynamic! you have to calculate your own! First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env) to get the challange value/seed. |NBG6617> ATSE NBG6617 |012345678901 This seed/value can be converted to the password with the help of this bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors): - tool.sh - ror32() { echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) )) } v="0x$1" a="0x${v:2:6}" b=$(( $a + 0x10F0A563)) c=$(( 0x${v:12:14} & 7 )) p=$(( $(ror32 $b $c) ^ $a )) printf "ATEN 1,%X\n" $p - end of tool.sh - |# bash ./tool.sh 012345678901 | |ATEN 1,879C711 copy and paste the result into the shell to unlock zloader. |NBG6617> ATEN 1,0046B0017430 If the entered code was correct the shell will change to use the ATGU command to enter the real u-boot shell. |NBG6617> ATGU |NBG6617# Co-authored-by: David Bauer <mail@david-bauer.net> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: David Bauer <mail@david-bauer.net>
2018-06-21 12:24:59 +00:00
zyxel_do_upgrade() {
local tar_file="$1"
local board_dir=$(tar tf $tar_file | grep -m 1 '^sysupgrade-.*/$')
board_dir=${board_dir%/}
tar Oxf $tar_file ${board_dir}/kernel | mtd write - kernel
if [ -n "$UPGRADE_BACKUP" ]; then
tar Oxf $tar_file ${board_dir}/root | mtd -j "$UPGRADE_BACKUP" write - rootfs
ipq40xx: add support for the ZyXEL NBG6617 This patch adds support for ZyXEL NBG6617 Hardware highlights: SOC: IPQ4018 / QCA Dakota CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7 DRAM: 256 MiB DDR3L-1600/1866 Nanya NT5CC128M16IP-DI @ 537 MHz NOR: 32 MiB Macronix MX25L25635F ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN) USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC) WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2 WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2 INPUT: RESET Button, WIFI/Rfkill Togglebutton, WPS Button LEDS: Power, WAN, LAN 1-4, WLAN 2.4GHz, WLAN 5GHz, USB, WPS Serial: WARNING: The serial port needs a TTL/RS-232 3.3v level converter! The Serial setting is 115200-8-N-1. The 1x4 .1" header comes pre-soldered. Pinout: 1. 3v3 (Label printed on the PCB), 2. RX, 3. GND, 4. TX first install / debricking / restore stock: 0. Have a PC running a tftp-server @ 192.168.1.99/24 1. connect the PC to any LAN-Ports 2. put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file into the tftp-server root directory and rename it to just "ras.bin". 3. power-cycle the router and hold down the the WPS button (for 30sek) 4. Wait (for a long time - the serial console provides some progress reports. The u-boot says it best: "Please be patient". 5. Once the power LED starts to flashes slowly and the USB + WPS LEDs flashes fast at the same time. You have to reboot the device and it should then come right up. Installation via Web-UI: 0. Connect a PC to the powered-on router. It will assign your PC a IP-address via DHCP 1. Access the Web-UI at 192.168.1.1 (Default Passwort: 1234) 2. Go to the "Expert Mode" 3. Under "Maintenance", select "Firmware-Upgrade" 4. Upload the OpenWRT factory image 5. Wait for the Device to finish. It will reboot into OpenWRT without any additional actions needed. To open the ZyXEL NBG6617: 0. remove the four rubber feet glued on the backside 1. remove the four philips screws and pry open the top cover (by applying force between the plastic top housing from the backside/lan-port side) Access the real u-boot shell: ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02" When the device is starting up, the user can enter the the loader shell by simply pressing a key within the 3 seconds once the following string appears on the serial console: | Hit any key to stop autoboot: 3 The user is then dropped to a locked shell. |NBG6617> HELP |ATEN x[,y] set BootExtension Debug Flag (y=password) |ATSE x show the seed of password generator |ATSH dump manufacturer related data in ROM |ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations) |ATGO boot up whole system |ATUR x upgrade RAS image (filename) |NBG6617> In order to escape/unlock a password challenge has to be passed. Note: the value is dynamic! you have to calculate your own! First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env) to get the challange value/seed. |NBG6617> ATSE NBG6617 |012345678901 This seed/value can be converted to the password with the help of this bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors): - tool.sh - ror32() { echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) )) } v="0x$1" a="0x${v:2:6}" b=$(( $a + 0x10F0A563)) c=$(( 0x${v:12:14} & 7 )) p=$(( $(ror32 $b $c) ^ $a )) printf "ATEN 1,%X\n" $p - end of tool.sh - |# bash ./tool.sh 012345678901 | |ATEN 1,879C711 copy and paste the result into the shell to unlock zloader. |NBG6617> ATEN 1,0046B0017430 If the entered code was correct the shell will change to use the ATGU command to enter the real u-boot shell. |NBG6617> ATGU |NBG6617# Co-authored-by: David Bauer <mail@david-bauer.net> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: David Bauer <mail@david-bauer.net>
2018-06-21 12:24:59 +00:00
else
tar Oxf $tar_file ${board_dir}/root | mtd write - rootfs
fi
}
platform_do_upgrade_mikrotik_nand() {
local fw_mtd=$(find_mtd_part kernel)
fw_mtd="${fw_mtd/block/}"
[ -n "$fw_mtd" ] || return
local board_dir=$(tar tf "$1" | grep -m 1 '^sysupgrade-.*/$')
board_dir=${board_dir%/}
[ -n "$board_dir" ] || return
local kernel_len=$(tar xf "$1" ${board_dir}/kernel -O | wc -c)
[ -n "$kernel_len" ] || return
tar xf "$1" ${board_dir}/kernel -O | ubiformat "$fw_mtd" -y -S $kernel_len -f -
CI_KERNPART="none"
nand_do_upgrade "$1"
}
platform_do_upgrade() {
case "$(board_name)" in
8dev,jalapeno |\
ipq40xx: add support for Aruba AP-303 Hardware -------- SoC: Qualcomm IPQ4029 RAM: 512M DDR3 FLASH: - 128MB NAND (Macronix MX30LF1G18AC) - 4MB SPI-NOR (Macronix MX25R3235F) TPM: Atmel AT97SC3203 BLE: Texas Instruments CC2540T attached to ttyMSM0 ETH: Atheros AR8035 LED: WiFi (amber / green) System (red / green) BTN: Reset To connect to the serial console, you can solder to the labled pads next to the USB port or use your Aruba supplied UARt adapter. Do NOT plug a standard USB cable into the Console labled USB-port! Aruba/HPE simply put UART on the micro-USB pins. You can solder yourself an adapter cable: VCC - NC D+ - TX D- - RX GND - GND The console setting in bootloader and OS is 9600 8N1. Voltage level is 3.3V. To enable a full list of commands in the U-Boot "help" command, execute the literal "diag" command. Installation ------------ 1. Get the OpenWrt initramfs image. Rename it to ipq40xx.ari and put it into the TFTP server root directory. Configure the TFTP server to be reachable at 192.168.1.75/24. Connect the machine running the TFTP server to the ethernet port of the access point. 2. Connect to the serial console. Interrupt autobooting by pressing Enter when prompted. 3. Configure the bootargs and bootcmd for OpenWrt. $ setenv bootargs_openwrt "setenv bootargs console=ttyMSM1,9600n8" $ setenv nandboot_openwrt "run bootargs_openwrt; ubi part aos1; ubi read 0x85000000 kernel; bootm 0x85000000" $ setenv ramboot_openwrt "run bootargs_openwrt; setenv ipaddr 192.168.1.105; setenv serverip 192.168.1.75; netget; set fdt_high 0x87000000; bootm" $ setenv bootcmd "run nandboot_openwrt" $ saveenv 4. Load OpenWrt into RAM: $ run ramboot_openwrt 5. After OpenWrt booted, transfer the OpenWrt sysupgrade image to the /tmp folder on the device. 6. Flash OpenWrt: $ ubidetach -p /dev/mtd1 $ ubiformat /dev/mtd1 $ sysupgrade -n /tmp/openwrt-sysupgrade.bin To go back to the stock firmware, simply reset the bootcmd in the bootloader to the original value: $ setenv bootcmd "boot" $ saveenv Signed-off-by: David Bauer <mail@david-bauer.net>
2019-10-23 20:25:14 +00:00
aruba,ap-303 |\
ipq40xx: add support for Aruba AP-303H The Aruba AP-303H is the hospitality version of the Aruba AP-303 with a POE-passthrough enabled ethernet switch instead of a sigle PHY. Hardware -------- SoC: Qualcomm IPQ4029 RAM: 512M DDR3 FLASH: - 128MB SPI-NAND (Macronix) - 4MB SPI-NOR (Macronix MX25R3235F) TPM: Atmel AT97SC3203 BLE: Texas Instruments CC2540T attached to ttyMSM1 ETH: Qualcomm QCA8075 LED: WiFi (amber / green) System (red / green /amber) PSE (green) BTN: Reset USB: USB 2.0 To connect to the serial console, you can solder to the labled pads next to the USB port or use your Aruba supplied UARt adapter. Do NOT plug a standard USB cable into the Console labled USB-port! Aruba/HPE simply put UART on the micro-USB pins. You can solder yourself an adapter cable: VCC - NC D+ - TX D- - RX GND - GND The console setting in bootloader and OS is 9600 8N1. Voltage level is 3.3V. To enable a full list of commands in the U-Boot "help" command, execute the literal "diag" command. Installation ------------ 1. Get the OpenWrt initramfs image. Rename it to ipq40xx.ari and put it into the TFTP server root directory. Configure the TFTP server to be reachable at 192.168.1.75/24. Connect the machine running the TFTP server to the E0 (!) ethernet port of the access point, as it only tries to pull from the WAN port. 2. Connect to the serial console. Interrupt autobooting by pressing Enter when prompted. 3. Configure the bootargs and bootcmd for OpenWrt. $ setenv bootargs_openwrt "setenv bootargs console=ttyMSM0,9600n8" $ setenv nandboot_openwrt "run bootargs_openwrt; ubi part aos1; ubi read 0x85000000 kernel; set fdt_high 0x87000000; bootm 0x85000000" $ setenv ramboot_openwrt "run bootargs_openwrt; setenv ipaddr 192.168.1.105; setenv serverip 192.168.1.75; netget; set fdt_high 0x87000000; bootm" $ setenv bootcmd "run nandboot_openwrt" $ saveenv 4. Load OpenWrt into RAM: $ run ramboot_openwrt 5. After OpenWrt booted, transfer the OpenWrt sysupgrade image to the /tmp folder on the device. You will need to plug into E1-E3 ports of the access point to reach OpenWrt, as E0 is the WAN port of the device. 6. Flash OpenWrt: $ ubidetach -p /dev/mtd16 $ ubiformat /dev/mtd16 $ sysupgrade -n /tmp/openwrt-sysupgrade.bin To go back to the stock firmware, simply reset the bootcmd in the bootloader to the original value: $ setenv bootcmd "boot" $ saveenv Signed-off-by: David Bauer <mail@david-bauer.net>
2020-01-11 23:36:42 +00:00
aruba,ap-303h |\
ipq40xx: add support for Aruba AP-365 Hardware -------- SoC: Qualcomm IPQ4029 RAM: 512M DDR3 FLASH: - 128MB NAND (Macronix MX30LF1G18AC) - 4MB SPI-NOR (Macronix MX25R3235F) TPM: Atmel AT97SC3203 BLE: Texas Instruments CC2540T attached to ttyMSM0 ETH: Atheros AR8035 LED: System (red / green / amber) BTN: Reset The USB port on the device is (in contrast to other Aruba boards) real USB. The AP uses a CP2101 USB TTY converter on the board. Console baudrate is 9600 8n1. To enable a full list of commands in the U-Boot "help" command, execute the literal "diag" command. Installation ------------ 1. Get the OpenWrt initramfs image. Rename it to ipq40xx.ari and put it into the TFTP server root directory. Configure the TFTP server to be reachable at 192.168.1.75/24. Connect the machine running the TFTP server to the ethernet port of the access point. 2. Connect to the serial console. Interrupt autobooting by pressing Enter when prompted. 3. Configure the bootargs and bootcmd for OpenWrt. $ setenv bootargs_openwrt "setenv bootargs console=ttyMSM1,9600n8" $ setenv nandboot_openwrt "run bootargs_openwrt; ubi part aos1; ubi read 0x85000000 kernel; bootm 0x85000000" $ setenv ramboot_openwrt "run bootargs_openwrt; setenv ipaddr 192.168.1.105; setenv serverip 192.168.1.75; netget; set fdt_high 0x87000000; bootm" $ setenv bootcmd "run nandboot_openwrt" $ saveenv 4. Load OpenWrt into RAM: $ run ramboot_openwrt 5. After OpenWrt booted, transfer the OpenWrt sysupgrade image to the /tmp folder on the device. 6. Flash OpenWrt: Make sure you use the mtd partition with the label "ubi" here! $ ubidetach -p /dev/mtd1 $ ubiformat /dev/mtd1 $ sysupgrade -n /tmp/openwrt-sysupgrade.bin To go back to the stock firmware, simply reset the bootcmd in the bootloader to the original value: $ setenv bootcmd "boot" $ saveenv Signed-off-by: David Bauer <mail@david-bauer.net>
2020-05-07 15:50:57 +00:00
aruba,ap-365 |\
ipq40xx: add support for FritzBox 7530 Hardware -------- CPU: Qualcomm IPQ4019 RAM: 256M FLASH: 128M NAND ETH: QCA8075 VDSL: Intel/Lantiq VRX518 PCIe attached currently not supported DECT: Dialog SC14448 currently not supported WiFi2: IPQ4019 2T2R 2SS b/g/n WiFi5: IPQ4019 2T2R 2SS n/ac LED: - Power/DSL green - WLAN green - FON/DECT green - Connect/WPS green - Info green - Info red BTN: - WLAN - FON - WPS/Connect UART: 115200n8 3.3V (located under the Dialog chip) VCC - RX - TX - GND (Square is VCC) Installation ------------ 1. Grab the uboot for the Device from the 'u-boot-fritz7530' subdirectory. Place it in the same directory as the 'eva_ramboot.py' script. It is located in the 'scripts/flashing' subdirectory of the OpenWRT tree. 2. Assign yourself the IP address 192.168.178.10/24. Connect your Computer to one of the boxes LAN ports. 3. Connect Power to the Box. As soon as the LAN port of your computer shows link, load the U-Boot to the box using following command. > ./eva_ramboot.py --offset 0x85000000 192.168.178.1 uboot-fritz7530.bin 4. The U-Boot will now start. Now assign yourself the IP address 192.168.1.70/24. Copy the OpenWRT initramfs (!) image to a TFTP server root directory and rename it to 'FRITZ7530.bin'. 5. The Box will now boot OpenWRT from RAM. This can take up to two minutes. 6. Copy the U-Boot and the OpenWRT sysupgrade (!) image to the Box using scp. SSH into the Box and first write the Bootloader to both previous kernel partitions. > mtd write /path/to/uboot-fritz7530.bin uboot0 > mtd write /path/to/uboot-fritz7530.bin uboot1 7. Remove the AVM filesystem partitions to make room for our kernel + rootfs + overlayfs. > ubirmvol /dev/ubi0 --name=avm_filesys_0 > ubirmvol /dev/ubi0 --name=avm_filesys_1 8. Flash OpenWRT peristently using sysupgrade. > sysupgrade -n /path/to/openwrt-sysupgrade.bin Signed-off-by: David Bauer <mail@david-bauer.net> [removed pcie-dts range node, refreshed on top of AP120-AC/E2600AC] Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2019-02-18 22:58:34 +00:00
avm,fritzbox-7530 |\
ipq40xx: add support for AVM FRITZ!Repeater 1200 Hardware -------- SoC: Qualcomm IPQ4019 RAM: 256M DDR3 FLASH: 128M NAND WiFi: 2T2R IPQ4019 bgn 2T2R IPQ4019 a/n/ac ETH: Atheros AR8033 RGMII PHY BTN: 1x Connect (WPS) LED: Power (green/red/yellow) Installation ------------ 1. Grab the uboot for the Device from the 'u-boot-fritz1200' subdirectory. Place it in the same directory as the 'eva_ramboot.py' script. It is located in the 'scripts/flashing' subdirectory of the OpenWRT tree. 2. Assign yourself the IP address 192.168.178.10/24. Connect your Computer to one of the boxes LAN ports. 3. Connect Power to the Box. As soon as the LAN port of your computer shows link, load the U-Boot to the box using following command. > ./eva_ramboot.py --offset 0x85000000 192.168.178.1 uboot-fritz1200.bin 4. The U-Boot will now start. Now assign yourself the IP address 192.168.1.70/24. Copy the OpenWRT initramfs (!) image to a TFTP server root directory and rename it to 'FRITZ1200.bin'. 5. The Box will now boot OpenWRT from RAM. This can take up to two minutes. 6. Copy the U-Boot and the OpenWRT sysupgrade (!) image to the Box using scp. SSH into the Box and first write the Bootloader to both previous kernel partitions. > mtd write /path/to/uboot-fritz1200.bin uboot0 > mtd write /path/to/uboot-fritz1200.bin uboot1 7. Remove the AVM filesystem partitions to make room for our kernel + rootfs + overlayfs. > ubirmvol /dev/ubi0 --name=avm_filesys_0 > ubirmvol /dev/ubi0 --name=avm_filesys_1 8. Flash OpenWRT peristently using sysupgrade. > sysupgrade -n /path/to/openwrt-sysupgrade.bin Signed-off-by: David Bauer <mail@david-bauer.net>
2019-09-10 19:07:23 +00:00
avm,fritzrepeater-1200 |\
ipq40xx: Add support for Linksys EA8300 (Dallas) The Linksys EA8300 is based on QCA4019 and QCA9888 and provides three, independent radios. NAND provides two, alternate kernel/firmware images with fail-over provided by the OEM U-Boot. Installation: "Factory" images may be installed directly through the OEM GUI. Hardware Highlights: * IPQ4019 at 717 MHz (4 CPUs) * 256 MB NAND (Winbond W29N02GV, 8-bit parallel) * 256 MB RAM * Three, fully-functional radios; `iw phy` reports (FCC/US, -CT): * 2.4 GHz radio at 30 dBm * 5 GHz radio on ch. 36-64 at 23 dBm * 5 GHz radio on ch. 100-144 at 23 dBm (DFS), 149-165 at 30 dBm #{ managed } <= 16, #{ AP, mesh point } <= 16, #{ IBSS } <= 1 * All two-stream, MCS 0-9 * 4x GigE LAN, 1x GigE Internet Ethernet jacks with port lights * USB3, single port on rear with LED * WPS and reset buttons * Four status lights on top * Serial pads internal (unpopulated) "Linksys Dallas WiFi AP router based on Qualcomm AP DK07.1-c1" Implementation Notes: The OEM flash layout is preserved at this time with 3 MB kernel and ~69 MB UBIFS for each firmware version. The sysdiag (1 MB) and syscfg (56 MB) partitions are untouched, available as read-only. Serial Connectivity: Serial connectivity is *not* required to flash. Serial may be accessed by opening the device and connecting a 3.3-V adapter using 115200, 8n1. U-Boot access is good, including the ability to load images over TFTP and either run or flash them. Looking at the top of the board, from the front of the unit, J3 can be found on the right edge of the board, near the rear | J3 | |-| | |O| | (3.3V seen, open-circuit) |O| | TXD |O| | RXD |O| | |O| | GND |-| | | Unimplemented: * serial1 "ttyQHS0" (serial0 works as console) * Bluetooth; Qualcomm CSR8811 (potentially conected to serial1) Other Notes: https://wikidevi.com/wiki/Linksys_EA8300 states FCC docs also cover the Linksys EA8250. According to the RF Test Report BT BR+EDR, "All models are identical except for the EA8300 supports 256QAM and the EA8250 disable 256QAM." Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
2019-04-10 15:34:28 +00:00
avm,fritzrepeater-3000 |\
buffalo,wtr-m2133hp |\
ipq40xx: add support for Crisis Innovation Lab MeshPoint.One MeshPoint.One is Wi-Fi hotspot and smart IoT gateway (based upon Jalapeno module from 8Devices). MeshPoint.One (https://meshpointone.com) is a unique Wi-Fi hotspot and smart city gateway that can be installed and powered from street lighting (even solar power in the future). MeshPoint provides up to 27 hours of interrupted Wi-Fi and IoT services from internal battery even when external power is not available. MeshPoint.One can be used for disaster relief efforts in order to provide instant Wi-Fi coverage that can be easily expanded by just adding more devices that create wide area mesh network. MeshPoint.One devices have standard Luci UI for management. Features: - 1x 1Gpbs WAN - 1x 1Gbps LAN - POE input (eth0) - POE output (eth1) - Sensor for temperature, humidity and pressure (Bosch BME280) - current, voltage and power measurement via TI INA230 - Hardware real time clock - optional power via Li-Ion battery - micro USB port with USB to serial chip for easy OpenWrt terminal access - I2C header for connecting additional sensors Installation: ------------- Simply flash the sysupgrade image from stock firmware. Or use the built in Web recovery into bootloader: Hold Reset button for 5 to 20 seconds or use UART and httpd command. Web UI will appear on 192.168.2.100 by default. For web recovery use the factory.ubi image. Signed-off-by: Damir Samardzic <damir.samardzic@sartura.hr> Signed-off-by: Damir Franusic <damir.franusic@sartura.hr> Signed-off-by: Valent Turkovic <valent@meshpoint.me> Signed-off-by: Robert Marko <robert@meshpoint.me> [commit description long line wrap, usb->USB] Signed-off-by: Petr Štetiar <ynezz@true.cz>
2019-11-25 14:25:00 +00:00
cilab,meshpoint-one |\
edgecore,ecw5211 |\
edgecore,oap100 |\
engenius,eap2200 |\
glinet,gl-a1300 |\
glinet,gl-ap1300 |\
ipq40xx: add support for Luma Home WRTQ-329ACN Luma Home WRTQ-329ACN, also known as Luma WiFi System, is a dual-band wireless access point. Specification SoC: Qualcomm Atheros IPQ4018 RAM: 256 MB DDR3 Flash: 2 MB SPI NOR 128 MB SPI NAND WIFI: 2.4 GHz 2T2R integrated 5 GHz 2T2R integrated Ethernet: 2x 10/100/1000 Mbps QCA8075 USB: 1x 2.0 Bluetooth: 1x 4.0 CSR8510 A10, connected to USB bus LEDS: 16x multicolor LEDs ring, controlled by MSP430G2403 MCU Buttons: 1x GPIO controlled EEPROM: 16 Kbit, compatible with AT24C16 UART: row of 4 holes marked on PCB as J19, starting count from the side of J19 marking on PCB 1. GND, 2. RX, 3. TX, 4. 3.3V baud: 115200, parity: none, flow control: none The device supports OTA or USB flash drive updates, unfotunately they are signed. Until the signing key is known, the UART access is mandatory for installation. The difficult part is disassembling the casing, there are a lot of latches holding it together. Teardown Prepare three thin, but sturdy, prying tools. Place the device with back of it facing upwards. Start with the wall having a small notch. Insert first tool, until You'll feel resistance and keep it there. Repeat the procedure for neighbouring walls. With applying a pressure, one edge of the back cover should pop up. Now carefully slide one of the tools to free the rest of the latches. There's no need to solder pins to the UART holes, You can use hook clips, but wiring them outside the casing, will ease debuging and recovery if problems occur. Installation 1. Prepare TFTP server with OpenWrt initramfs image. 2. Connect to UART port (don't connect the voltage pin). 3. Connect to LAN port. 4. Power on the device, carefully observe the console output and when asked quickly enter the failsafe mode. 5. Invoke 'mount_root'. 6. After the overlayfs is mounted run: fw_setenv bootdelay 3 This will allow to access U-Boot shell. 7. Reboot the device and when prompted to stop autoboot, hit any key. 8. Adjust "ipaddr" and "serverip" addresses in U-Boot environment, use 'setenv' to do that, then run following commands: tftpboot 0x84000000 <openwrt_initramfs_image_name> bootm 0x84000000 and wait till OpenWrt boots. 9. In OpenWrt command line run following commands: fw_setenv openwrt "setenv mtdids nand1=spi_nand; setenv mtdparts mtdparts=spi_nand:-(ubi); ubi part ubi; ubi read 0x84000000 kernel; bootm 0x84000000" fw_setenv bootcmd "run openwrt" 10. Transfer OpenWrt sysupgrade image to /tmp directory and flash it with: ubirmvol /dev/ubi0 -N ubi_rootfs sysupgrade -v -n /tmp/<openwrt_sysupgrade_image_name> 11. After flashing, the access point will reboot to OpenWrt, then it's ready for configuration. Reverting to OEM firmware 1. Execute installation guide steps: 1, 2, 3, 7, 8. 2. In OpenWrt command line run following commands: ubirmvol /dev/ubi0 -N rootfs_data ubirmvol /dev/ubi0 -N rootfs ubirmvol /dev/ubi0 -N kernel ubirename /dev/ubi0 kernel1 kernel ubi_rootfs1 ubi_rootfs ubimkvol /dev/ubi0 -S 34 -N kernel1 ubimkvol /dev/ubi0 -S 320 -N ubi_rootfs1 ubimkvol /dev/ubi0 -S 264 -N rootfs_data fw_setenv bootcmd bootipq 3. Reboot. Known issues The LEDs ring doesn't have any dedicated driver or application to control it, the only available option atm is to manipulate it with 'i2cset' command. The default action after applying power to device is spinning blue light. This light will stay active at all time. To disable it install 'i2c-tools' with opkg and run: i2cset -y 2 0x48 3 1 0 0 i The light will stay off until next cold boot. Additional information After completing 5. step from installation guide, one can disable asking for root password on OEM firmware by running: sed -e 's/root:x:/root::/' -i /etc/passwd This is useful for investigating the OEM firmware. One can look at the communication between the stock firmware and the vendor's cloud servers or as a way of making a backup of both flash chips. The root password seems to be constant across all sold devices. This is output of 'led_ctl' from OEM firmware to illustrate possibilities of LEDs ring: Usage: led_ctl [status | upgrade | force_upgrade | version] led_ctl solid COLOR <brightness> led_ctl single COLOR INDEX <brightness 0 - 15> led_ctl spinning COLOR <period 1 - 16 (lower = faster)> led_ctl fill COLOR <period 1 - 16 (lower = faster)> ( default is 5 ) led_ctl flashing COLOR <on dur 1 - 128> <off dur 1 - 128> (default is 34) ( default is 34 ) led_ctl pulsing COLOR COLOR: red, green, blue, yellow, purple, cyan, white Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl> [squash "ipq-wifi: add BDFs for Luma Home WRTQ-329ACN" into commit, changed ubi volumes for easier integration, slightly reworded commit message, changed ubi volume layout to use standard names all around] Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2020-08-30 11:28:10 +00:00
luma,wrtq-329acn |\
ipq40xx: add support for MobiPromo CM520-79F MobiPromo CM520-79F is an AC1300 dual band router based on IPQ4019 Specification: SoC/Wireless: QCA IPQ4019 RAM: 512MiB Flash: 128MiB SLC NAND Ethernet PHY: QCA8075 Ethernet ports: 1x WAN, 2x LAN LEDs: 7 LEDs 2 (USB, CAN) are GPIO other 5 (2.4G, 5G, LAN1, LAN2, WAN) are connected to a shift register Button: Reset Flash instruction: Disassemble the router, connect UART pins like this: GND TX RX [x x . . x .] [. . . . . .] (QCA8075 and IPQ4019 below) Baud-rate: 115200 Set up TFTP server: IP 192.168.1.188/24 Power on the router and interrupt the booting with UART console env backup (in case you want to go back to stock and need it there): printenv (Copy the output to somewhere save) Set bootenv: setenv set_ubi 'set mtdids nand0=nand0; set mtdparts mtdparts=nand0:0x7480000@0xb80000(fs); ubi part fs' setenv bootkernel 'ubi read 0x84000000 kernel; bootm 0x84000000#config@1' setenv cm520_boot 'run set_ubi; run bootkernel' setenv bootcmd 'run cm520_boot' setenv bootargs saveenv Boot initramfs from TFTP: tftpboot openwrt-ipq40xx-generic-mobipromo_cm520-79f-initramfs-fit-zImage.itb bootm After initramfs image is booted, backup rootfs partition in case of reverting to stock image cat /dev/mtd12 > /tmp/mtd12.bin Then fetch it via SCP Upload nand-factory.ubi to /tmp via SCP, then run mtd erase rootfs mtd write /tmp/*nand-factory.ubi rootfs reboot To revert to stock image, restore default bootenv in uboot UART console setenv bootcmd 'bootipq' printenv use the saved dump you did back when you installed OpenWrt to verify that there are no other differences from back in the day. saveenv upload the backed up mtd12.bin and run tftpboot mtd12.bin nand erase 0xb80000 0x7480000 nand write 0x84000000 0xb80000 0x7480000 The BOOTCONFIG may have been configured to boot from alternate partition (rootfs_1) instead In case of this, set it back to rootfs: cd /tmp cat /dev/mtd7 > mtd7.bin echo -ne '\x0b' | dd of=mtd7.bin conv=notrunc bs=1 count=1 seek=4 for i in 28 48 68 108; do dd if=/dev/zero of=mtd7.bin conv=notrunc bs=1 count=1 seek=$i done mtd write mtd7.bin BOOTCONFIG mtd write mtd7.bin BOOTCONFIG1 Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn> [renamed volume to ubi to support autoboot, as per David Lam's test in PR#2432] Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2020-01-14 14:22:59 +00:00
mobipromo,cm520-79f |\
ipq40xx: add netgear wac510 support This adds support for the Netgear WAC510 Insight Managed Smart Cloud Wireless Access Point, an indoor dual-band, dual-radio 802.11ac business-class wireless AP with integrated omnidirectional antennae and two 10/100/1000 Mbps Ethernet ports. For more information see: <https://www.netgear.com/business/wifi/access-points/wac510> Specifications: SoC: Qualcomm IPQ4018 (DAKOTA) ARM Quad-Core RAM: 256 MiB Flash1: 2 MiB Winbond W25Q16JV SPI-NOR Flash2: 128 MiB Winbond W25N01GVZEIG SPI-NAND Ethernet: Built-in IPQ4018 (SoC, QCA8072 PHY), 2x 1000/100/10 port, WAN port active IEEE 802.3af/at PoE in Wireless1: Built-in IPQ4018 (SoC) 802.11b/g/n 2x2:2, 3 dBi antennae Wireless2: Built-in IPQ4018 (SoC) 802.11a/n/ac 2x2:2, 4 dBi antennae Input: (Optional) Barrel 12 V 2.5 A Power, Reset button SW1 LEDs: Power, Insight, WAN PoE, LAN, 2.4G WLAN, 5G WLAN Serial: Header J2 1 - 3.3 Volt (Do NOT connect!) 2 - TX 3 - RX 4 - Ground WARNING: The serial port needs a TTL/RS-232 3.3 volt level converter! The Serial settings are 115200-8-N-1. Installation via Stock Web Interface: BTW: The default factory console/web interface login user/password are admin/password. In the web interface navigating to Management - Maintenance - Upgrade - 'Firmware Upgrade' will show you what is currently installed e.g.: Manage Firmware Current Firmware Version: V5.0.10.2 Backup Firmware Version: V1.2.5.11 Under 'Upgrade Options' choose Local (alternatively SFTP would be available) then click/select 'Browse File' on the right side, choose openwrt-ipq40xx-generic-netgear_wac510-squashfs-nand-factory.tar and hit the Upgrade button below. After a minute or two your browser should indicate completion printing 'Firmware update complete.' and 'Rebooting AP...'. Note that OpenWrt will use the WAN PoE port as actual WAN port defaulting to DHCP client but NOT allowing LuCI access, use LAN port defaulting to 192.168.1.1/24 to access LuCI. Installation via TFTP Requiring Serial U-Boot Access: Connect to the device's serial port and hit any key to stop autoboot. Upload and boot the initramfs based OpenWrt image as follows: (IPQ40xx) # setenv serverip 192.168.1.1 (IPQ40xx) # setenv ipaddr 192.168.1.2 (IPQ40xx) # tftpboot openwrt-ipq40xx-generic-netgear_wac510-initramfs-fit-uImage.itb (IPQ40xx) # bootm Note: This only runs OpenWrt from RAM and has not installed anything to flash as of yet. One may permanently install OpenWrt as follows: Check the MTD device number of the active partition: root@OpenWrt:/# dmesg | grep 'set to be root filesystem' [ 1.010084] mtd: device 9 (rootfs) set to be root filesystem Upload the factory image ending with .ubi to /tmp (e.g. using scp or tftp). Then flash the image as follows (substituting the 9 in mtd9 below with whatever number reported above): root@OpenWrt:/# ubiformat /dev/mtd9 -f /tmp/openwrt-ipq40xx-generic-netgear_wac510-squashfs-nand-factory.ubi And reboot. Dual Image Configuration: The default U-Boot boot command bootipq uses the U-Boot environment variables primary/secondary to decide which image to boot. E.g. primary=0, secondary=3800000 uses rootfs while primary=3800000, secondary=0 uses rootfs_1. Switching their values changes the active partition. E.g. from within U-Boot: (IPQ40xx) # setenv primary 0 (IPQ40xx) # setenv secondary 3800000 (IPQ40xx) # saveenv Or from a OpenWrt userspace serial/SSH console: fw_setenv primary 0 fw_setenv secondary 3800000 Note that if you install two copies of OpenWrt then each will have its independent configuration not like when switching partitions on the stock firmware. BTW: The kernel log shows which boot partition is active: [ 2.439050] ubi0: attached mtd9 (name "rootfs", size 56 MiB) vs. [ 2.978785] ubi0: attached mtd10 (name "rootfs_1", size 56 MiB) Note: After 3 failed boot attempts it automatically switches partition. Signed-off-by: Robert Marko <robimarko@gmail.com> Signed-off-by: Marcel Ziswiler <marcel@ziswiler.com> [squashed netgear-tar commit into main and rename netgear-tar for now, until it is made generic.] Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2020-11-25 13:23:58 +00:00
netgear,wac510 |\
ipq40xx: add support for P&W R619AC (aka G-DOCK 2.0) P&W R619AC is a IPQ4019 Dual-Band AC1200 router. It is made by P&W (p2w-tech.com) known as P&W R619AC but marketed and sold more popularly as G-DOCK 2.0. Specification: * SOC: Qualcomm Atheros IPQ4019 (717 MHz) * RAM: 512 MiB * Flash: 16 MiB (NOR) + 128 MiB (NAND) * Ethernet: 5 x 10/100/1000 (4 x LAN, 1 x WAN) * Wireless: - 2.4 GHz b/g/n Qualcomm Atheros IPQ4019 - 5 GHz a/n/ac Qualcomm Atheros IPQ4019 * USB: 1 x USB 3.0 * LED: 4 x LAN, 1 x WAN, 2 x WiFi, 1 x Power (All Blue LED) * Input: 1 x reset * 1 x MicroSD card slot * Serial console: 115200bps, pinheader J2 on PCB * Power: DC 12V 2A * 1 x Unpopulated mPCIe Slot (see below how to connect it) * 1 x Unpopulated Sim Card Slot Installation: 1. Access to tty console via UART serial 2. Enter failsafe mode and mount rootfs <https://openwrt.org/docs/guide-user/troubleshooting/failsafe_and_factory_reset> 3. Edit inittab to enable shell on tty console `sed -i 's/#ttyM/ttyM/' /etc/inittab` 4. Reboot and upload `-nand-factory.bin` to the router (using wget) 5. Use `sysupgrade` command to install Another installation method is to hijack the upgrade server domain of stock firmware, because it's using insecure http. This commit is based on @LGA1150(at GitHub)'s work <https://github.com/LGA1150/openwrt/commit/a4932c8d5a275d1fb4297bd20ec03f9270a45d1c> With some changes: 1. Added `qpic_bam` node in dts. I don't know much about this, but I observed other dtses have this node. 2. Removed `ldo` node under `sd_0_pinmux`, because `ldo` cause SD card not working. This fix is from <https://github.com/coolsnowwolf/lede/commit/51143b4c7571f717afe071db60bbb4db1532cbf2> 3. Removed the 32MB NOR variant. 4. Removed `cd-gpios` in `sdhci` node, because it's reported that it makes wlan2g led light up. 5. Added ethphy led config in dts. 6. Changed nand partition label from `rootfs` to `ubi`. About the 128MiB variant: The stock bootloader sets size of nand to 64MiB. But most of this devices have 128MiB nand. If you want to use all 128MiB, you need to modify the `MIBIB` data of bootloader. More details can be found on github: <https://github.com/openwrt/openwrt/pull/3691#issuecomment-818770060> For instructions on how to flash the MIBIB partition from u-boot console: <https://github.com/openwrt/openwrt/pull/3691#issuecomment-819138232> About the Mini PCIe slot: (from "ygleg") "The REFCLK signals on the Mini PCIe slot is not connected on this board out of the box. If you want to use the Mini PCIe slot on the board, you need to (preferably) solder two 0402 resistors: R436 (REFCLK+) and R444 (REFCLK-)..." This and much more information is provoided in the github comment: <https://github.com/openwrt/openwrt/pull/3691#issuecomment-968054670> Signed-off-by: Richard Yu <yurichard3839@gmail.com> Signed-off-by: DENG Qingfang <dqfext@gmail.com> [Added comment about MIBIB+128 MiB variant. Added commit message section about pcie slot. Renamed gpio-leds' subnodes and added color, function+enum properties.] Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2021-11-12 03:16:21 +00:00
p2w,r619ac-64m |\
p2w,r619ac-128m |\
qxwlan,e2600ac-c2 |\
wallys,dr40x9)
nand_do_upgrade "$1"
;;
ipq40xx: add support for GL.iNet GL-B2200 This patch adds supports for the GL-B2200 router. Specifications: - SOC: Qualcomm IPQ4019 ARM Quad-Core - RAM: 512 MiB - Flash: 16 MiB NOR - SPI0 - EMMC: 8GB EMMC - ETH: Qualcomm QCA8075 - WLAN1: Qualcomm Atheros QCA4019 2.4GHz 802.11b/g/n 2x2 - WLAN2: Qualcomm Atheros QCA4019 5GHz 802.11n/ac W2 2x2 - WLAN3: Qualcomm Atheros QCA9886 5GHz 802.11n/ac W2 2x2 - INPUT: Reset, WPS - LED: Power, Internet - UART1: On board pin header near to LED (3.3V, TX, RX, GND), 3.3V without pin - 115200 8N1 - UART2: On board with BLE module - SPI1: On board socket for Zigbee module Update firmware instructions: Please update the firmware via U-Boot web UI (by default at 192.168.1.1, following instructions found at https://docs.gl-inet.com/en/3/troubleshooting/debrick/). Normal sysupgrade, either via CLI or LuCI, is not possible from stock firmware. Please do use the *gl-b2200-squashfs-emmc.img file, gunzipping the produced *gl-b2200-squashfs-emmc.img.gz one first. What's working: - WiFi 2G, 5G - WPA2/WPA3 Not tested: - Bluetooth LE/Zigbee Credits goes to the original authors of this patch. V1->V2: - updates *arm-boot-add-dts-files.patch correctly (sorry, my mistake) - add uboot-envtools support V2->V3: - Li Zhang updated official patch to fix wrong MAC address on wlan0 (PCI) interface V3->V4: - wire up sysupgrade Signed-off-by: Li Zhang <li.zhang@gl-inet.com> [fix tab and trailing space, document what's working and what's not] Signed-off-by: TruongSinh Tran-Nguyen <i@truongsinh.pro> [rebase on top of master, address remaining comments] Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com> [remove redundant check in platform.sh] Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-12-01 15:18:17 +00:00
glinet,gl-b2200)
CI_KERNPART="0:HLOS"
CI_ROOTPART="rootfs"
CI_DATAPART="rootfs_data"
emmc_do_upgrade "$1"
;;
alfa-network,ap120c-ac)
part="$(awk -F 'ubi.mtd=' '{printf $2}' /proc/cmdline | sed -e 's/ .*$//')"
if [ "$part" = "rootfs1" ]; then
fw_setenv active 2 || exit 1
CI_UBIPART="rootfs2"
else
fw_setenv active 1 || exit 1
CI_UBIPART="rootfs1"
fi
nand_do_upgrade "$1"
;;
asus,map-ac2200)
CI_KERNPART="linux"
nand_do_upgrade "$1"
;;
asus,rt-ac42u |\
ipq40xx: add support for ASUS RT-AC58U/RT-ACRH13 This patch adds support for ASUS RT-AC58U/RT-ACRH13. hardware highlights: SOC: IPQ4018 / QCA Dakota CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7 DRAM: 128 MiB DDR3L-1066 @ 537 MHz (1074?) NT5CC64M16GP-DI NOR: 2 MiB Macronix MX25L1606E (for boot, QSEE) NAND: 128 MiB Winbond W25NO1GVZE1G (cal + kernel + root, UBI) ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN) USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC) WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2 WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2 INPUT: one Reset and one WPS button LEDS: Status, WAN, WIFI1/2, USB and LAN (one blue LED for each) Serial: WARNING: The serial port needs a TTL/RS-232 3V3 level converter! The Serial setting is 115200-8-N-1. The board has an unpopulated 1x4 0.1" header. The pinout (VDD, RX, GND, TX) is printed on the PCB right next to the connector. U-Boot Note: The ethernet driver isn't always reliable and can sometime time out... Don't worry, just retry. Access via the serial console is required. As well as a working TFTP-server setup and the initramfs image. (If not provided, it has to be built from the OpenWrt source. Make sure to enable LZMA as the compression for the INITRAMFS!) To install the image permanently, you have to do the following steps in the listed order. 1. Open up the router. There are four phillips screws hiding behind the four plastic feets on the underside. 2. Connect the serial cable (See notes above) 3. Connect your router via one of the four LAN-ports (yellow) to a PC which can set the IP-Address and ssh and scp from. If possible set your PC's IPv4 Address to 192.168.1.70 (As this is the IP-Address the Router's bootloader expects for the tftp server) 4. power up the router and enter the u-boot choose option 1 to upload the initramfs image. And follow through the ipv4 setup. Wait for your router's status LED to stop blinking rapidly and glow just blue. (The LAN LED should also be glowing blue). 3. Connect to the OpenWrt running in RAM The default IPv4-Address of your router will be 192.168.1.1. 1. Copy over the openwrt-sysupgrade.bin image to your router's temporary directory # scp openwrt-sysupgrade.bin root@192.168.1.1:/tmp 2. ssh from your PC into your router as root. # ssh root@192.168.1.1 The default OpenWrt-Image won't ask for a password. Simply hit the Enter-Key. Once connected...: run the following commands on your temporary installation 3. delete the "jffs2" ubi partition to make room for your new root partition # ubirmvol /dev/ubi0 --name=jffs2 4. install OpenWrt on the NAND Flash. # sysupgrade -v /tmp/openwrt-sysupgrade.bin - This will will automatically reboot the router - Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2018-03-07 08:13:10 +00:00
asus,rt-ac58u)
CI_KERNPART="linux"
nand_do_upgrade "$1"
;;
ipq40xx: add support for Cell C RTL30VW Cell C RTL30VW is a LTE router with tho gigabit ethernets and integrated QMI mPCIE modem. This is stripped version of ASKEY RTL0030VW. Hardware: Specification: -CPU: IPQ4019 -RAM: 256MB -Flash: NAND 128MB + NOR 16MB -WiFi: Integrated bgn/ac -LTE: mPCIe card (Modem chipset MDM9230) -LAN: 2 Gigabit Ports -USB: 2x USB2.0 -Serial console: RJ-45 115200 8n1 -Unsupported VoIP Known issues: None so far. Instruction install: There are two methods: Factory web-gui and serial + tftp. Web-gui: 1. Apply factory image via stock web-gui. Serial + initramfs: 1. Rename OpenWrt initramfs image to "image" 2. Connect serial console (115200,8n1) 3. Set IP to different than 192.168.1.11, but 24 bit mask, eg. 192.168.1.4. 4. U-Boot commands: sf probe && sf read 0x80000000 0x180000 0x10000 setenv serverip 192.168.1.4 set fdt_high 0x85000000 tftpboot 0x84000000 image bootm 0x84000000 5. Install sysupgrade image via "sysupgrade -n" Back to stock: All is needed is swap 0x4c byte in mtd8 from 0 to 1 or 1 to 0, do firstboot and factory reset with OFW: 1. read mtd8: dd if=/dev/mtd8 of=/tmp/mtd8 2. go to tmp: cd /tmp/ 3. write first part of partition: dd if=mtd8 of=mtd8.new bs=1 count=76 4. check which layout uses bootloader: cat /proc/mtd 5a. If first are kernel_1 and rootfs_1 write 0: echo -n -e '\x00' >> mtd8.new 5b. If first are kernel and rootfs write 1: echo -n -e '\x01' >> mtd8.new 6. fill with rest of data: dd if=mtd8 bs=1 skip=77 >> mtd8.new 7. CHECK IF mtd8.new HAVE CHANGED ONLY ONE BYTE! e.g with: hexdump mtd8.new 8. write new mtd8 to flash: mtd write mtd8.new /dev/mtd8 9. do firstboot 10.reboot 11. Do back to factory defaults in OFW GUI. Based on work: Cezary Jackiewicz <cezary@eko.one.pl> Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
2020-03-09 20:16:43 +00:00
cellc,rtl30vw)
CI_UBIPART="ubifs"
askey_do_upgrade "$1"
;;
compex,wpj419)
nand_do_upgrade "$1"
;;
ipq40xx: Add subtarget for Google WiFi (Gale) Google WiFi (codename: Gale) is an IPQ4019-based AP, with 2 Ethernet ports, 2x2 2.4+5GHz WiFi, 512 MB RAM, 4 GB eMMC, and a USB type C port. In its stock configuration, it runs a Chromium OS-based system, but you wouldn't know it, since you can only manage it via a "cloud" + mobile-app system. The "v2" label is coded into the bootloader, which prefers the "google,gale-v2" compatible string. I believe "v1" must have been pre-release hardware. Note: this is *not* the Google Nest WiFi, released in 2019. I include "factory.bin" support, where we generate a GPT-based disk image with 2 partitions -- a kernel partition (using the custom "Chrome OS kernel" GUID type) and a root filesystem partition. See below for flashing instructions. Sysupgrade is supported via recent emmc_do_upgrade() helper. This is a subtarget because it enables different features (FEATURES=boot-part rootfs-part) whose configurations don't make sense in the "generic" target, and because it builds in a few USB drivers, which are necessary for installation (installation is performed by booting from USB storage, and so these drivers cannot be built as modules, since we need to load modules from USB storage). Flashing instructions ===================== Documented here: https://openwrt.org/inbox/toh/google/google_wifi Note this requires booting from USB storage. Features ======== I've tested: * Ethernet, both WAN and LAN ports * eMMC * USB-C (hub, power-delivery, peripherals) * LED0 (R/G/B) * WiFi (limited testing) * SPI flash * Serial console: once in developer mode, console can be accessed via the USB-C port with SuzyQable, or other similar "Closed Case Debugging" tools: https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/master/docs/ccd.md#suzyq-suzyqable * Sysupgrade Not tested: * TPM Known not working: * Reboot: this requires some additional TrustZone / SCM configuration to disable Qualcomm's SDI. I have a proposal upstream, and based on IRC chats, this might be acceptable with additional DT logic: [RFC PATCH] firmware: qcom_scm: disable SDI at boot https://lore.kernel.org/linux-arm-msm/20200721080054.2803881-1-computersforpeace@gmail.com/ * SMP: enabling secondary CPUs doesn't currently work using the stock bootloader, as the qcom_scm driver assumes newer features than this TrustZone firmware has. I posted notes here: [RFC] qcom_scm: IPQ4019 firmware does not support atomic API? https://lore.kernel.org/linux-arm-msm/20200913201608.GA3162100@bDebian/ * There's a single external button, and a few useful internal GPIO switches. I haven't hooked them up. The first two are fixed with subsequent commits. Additional notes ================ Much of the DTS is pulled from the Chrome OS kernel 3.18 branch, which the manufacturer image uses. Note: the manufacturer bootloader knows how to patch in calibration data via the wifi{0,1} aliases in the DTB, so while these properties aren't present in the DTS, they are available at runtime: # ls -l /sys/firmware/devicetree/base/soc/wifi@a*/qcom,ath10k-pre-calibration-data -r--r--r-- 1 root root 12064 Jul 15 19:11 /sys/firmware/devicetree/base/soc/wifi@a000000/qcom,ath10k-pre-calibration-data -r--r--r-- 1 root root 12064 Jul 15 19:11 /sys/firmware/devicetree/base/soc/wifi@a800000/qcom,ath10k-pre-calibration-data Ethernet MAC addresses are similarly patched in via the ethernet{0,1} aliases. Signed-off-by: Brian Norris <computersforpeace@gmail.com> (updated 901 - x1pro moved in the process) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2020-05-25 21:50:20 +00:00
google,wifi)
export_bootdevice
export_partdevice CI_ROOTDEV 0
CI_KERNPART="kernel"
CI_ROOTPART="rootfs"
emmc_do_upgrade "$1"
;;
ipq40xx: Add support for Linksys EA8300 (Dallas) The Linksys EA8300 is based on QCA4019 and QCA9888 and provides three, independent radios. NAND provides two, alternate kernel/firmware images with fail-over provided by the OEM U-Boot. Installation: "Factory" images may be installed directly through the OEM GUI. Hardware Highlights: * IPQ4019 at 717 MHz (4 CPUs) * 256 MB NAND (Winbond W29N02GV, 8-bit parallel) * 256 MB RAM * Three, fully-functional radios; `iw phy` reports (FCC/US, -CT): * 2.4 GHz radio at 30 dBm * 5 GHz radio on ch. 36-64 at 23 dBm * 5 GHz radio on ch. 100-144 at 23 dBm (DFS), 149-165 at 30 dBm #{ managed } <= 16, #{ AP, mesh point } <= 16, #{ IBSS } <= 1 * All two-stream, MCS 0-9 * 4x GigE LAN, 1x GigE Internet Ethernet jacks with port lights * USB3, single port on rear with LED * WPS and reset buttons * Four status lights on top * Serial pads internal (unpopulated) "Linksys Dallas WiFi AP router based on Qualcomm AP DK07.1-c1" Implementation Notes: The OEM flash layout is preserved at this time with 3 MB kernel and ~69 MB UBIFS for each firmware version. The sysdiag (1 MB) and syscfg (56 MB) partitions are untouched, available as read-only. Serial Connectivity: Serial connectivity is *not* required to flash. Serial may be accessed by opening the device and connecting a 3.3-V adapter using 115200, 8n1. U-Boot access is good, including the ability to load images over TFTP and either run or flash them. Looking at the top of the board, from the front of the unit, J3 can be found on the right edge of the board, near the rear | J3 | |-| | |O| | (3.3V seen, open-circuit) |O| | TXD |O| | RXD |O| | |O| | GND |-| | | Unimplemented: * serial1 "ttyQHS0" (serial0 works as console) * Bluetooth; Qualcomm CSR8811 (potentially conected to serial1) Other Notes: https://wikidevi.com/wiki/Linksys_EA8300 states FCC docs also cover the Linksys EA8250. According to the RF Test Report BT BR+EDR, "All models are identical except for the EA8300 supports 256QAM and the EA8250 disable 256QAM." Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
2019-04-10 15:34:28 +00:00
linksys,ea6350v3 |\
linksys,ea8300 |\
ipq40xx: add support for Linksys WHW01 v1 This patch adds support for Linksys WHW01 v1 ("Velop") [FCC ID Q87-03331]. Specification ------------- SOC: Qualcomm IPQ4018 WiFi 1: Qualcomm QCA4019 IEEE 802.11b/g/n WiFi 2: Qualcomm QCA4019 IEEE 802.11a/n/ac Bluetooth: Qualcomm CSR8811 (A12U) Ethernet: Qualcomm QCA8072 (2-port) SPI Flash 1: Mactronix MX25L1605D (2MB) SPI Flash 2: Winbond W25M02GV (256MB) DRAM: Nanya NT5CC128M16IP-DI (256MB) LED Controller: NXP PCA963x (I2C) Buttons: Single reset button (GPIO). Notes ----- There does not appear to be a way to trigger TFTP recovery without entering U-Boot. The device must be opened to access the serial console in order to first flash OpenWrt onto a device from factory. The device has automatic recovery backed by a second set of partitions on the larger of the two SPI flash ICs. Both the primary and secondary must be flashed to prevent accidental rollback to "factory" after 3 failed boot attempts. Serial console -------------- A serial console is available on the following pins of the populated J2 connector on the device mainboard (115200 8n1). (<-- Top of PCB / Device) J2 [o o o o o o] | | | | | `-- GND | `---- TX `--------- RX Installation instructions ------------------------- 1. Setup TFTP server with server IP set to 192.168.1.236. 2. Copy compiled `...squashfs-factory.bin` to `nodes-jr.img` in tftp root. 3. Connect to console using pinout detailed in the serial console section. 4. Power on device and press enter when prompted to drop into U-Boot. 5. Flash first partition device via `run flashimg`. 6. Once complete, reset device and allow to power up completely. 7. Once comfortable with device upgrade reboot and drop back into U-Boot. 8. Flash the second partition (recovery) via `run flashimg2`. Revert to "factory" ------------------- 1. Download latest firmware update from vendor support site. 2. Copy extracted `.img` file to `nodes-jr.img` in tftp root. 3. Connect to console using pinout detailed in the serial console section. 4. Power on device and press enter when prompted to drop into U-Boot. 5. Flash first partition device via `run flashimg`. 6. Once complete, reset device and allow to power up completely. 7. Once comfortable with device upgrade reboot and drop back into U-Boot. 8. Flash the second partition (recovery) via `run flashimg2`. Link: https://github.com/openwrt/openwrt/pull/3682 Signed-off-by: Peter Adkins <peter@sunkenlab.com> (calibration from nvmem, updated to 5.10+5.15) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2021-06-09 20:35:46 +00:00
linksys,mr8300 |\
ipq40xx: add support for Linksys WHW03 V2 SOC: Qualcomm IPQ4019 WiFi 1: QCA4019 IEEE 802.11b/g/n WiFi 2: QCA4019 IEEE 802.11a/n/ac WiFi 3: QCA8888 IEEE 802.11a/n/ac Bluetooth: Qualcomm CSR8811 (A12U) Zigbee: Silicon Labs EM3581 NCP + Skyworks SE2432L Ethernet: Qualcomm Atheros QCA8072 (2-port) Flash 1: Mactronix MX30LF4G18AC-XKI RAM (NAND): SK hynix H5TC4G63CFR-PBA (512MB) LED Controller: NXP PCA9633 (I2C) Buttons: Single reset button (GPIO). - The three WiFis were fully tested and are configured with the same settings as in the vendor firmware. - The specific board files were submitted to the ATH10k mailing list but I'm still waiting for a reply. They can be removed once they are approved upstream. - Two ethernet ports are accessible on the device. By default one is configured as WAN and the other one is LAN. They are fully working. Bluetooth: ======== - Fully working with the following caveats: - RFKILL need to be enabled in the kernel. - An older version of bluez is needed as bccmd is needed to configure the chip. Zigbee: ====== - The spidev device is available in the /dev directory. - GPIOs are configured the same way as in the vendor firmware. - Tests are on-going. I am working on getting access to the Silicon Labs stack to validate that it is fully working. Installation: ========= The squash-factory image can be installed via the Linksys Web UI: 1. Open "http://192.168.1.1/ca" (Change the IP with the IP of your device). 2. Login with your admin password. 3. To enter into the support mode, click on the "CA" link and the bottom of the page. 4. Open the "Connectivity" menu and upload the squash-factory image with the "Choose file" button. 5. Click start. Ignore all the prompts and warnings by click "yes" in all the popups. The device uses a dual partition mechanism. The device automatically revert to the previous partition after 3 failed boot attempts. If you want to force the previous firmware to load, you can turn off and then turn on the device for 2 seconds, 3 times in a row. It can also be done via TFTP: 1. Setup a local TFTP server and configure its IP to 192.168.1.100. 2. Rename your image to "nodes_v2.img" and put it to the TFTP root of your server. 3. Connect to the device through the serial console. 4. Power on device and press enter when prompted to drop into U-Boot. 5. Flash the partition of your choice by typing "run flashimg" or "run flashimg2". 6. Once flashed, enter "reset" to reboot the device. Reviewed-by: Robert Marko <robimarko@gmail.com> Signed-off-by: Vincent Tremblay <vincent@vtremblay.dev>
2022-12-23 17:30:36 +00:00
linksys,whw01 |\
linksys,whw03v2)
platform_do_upgrade_linksys "$1"
ipq40xx: add support for Linksys EA6350v3 Specifications: SOC: Qualcomm IPQ4018 RAM: 256 MiB Samsung K4B2G1646F-BYK0 FLASH1: MX25L1605D 2 MB FLASH2: Winbond W25N01GV 128Mb ETH: Qualcomm QCA8075 WLAN0: Qualcomm Atheros QCA4018 2.4GHz 802.11b/g/n 2x2 WLAN1: Qualcomm Atheros QCA4018 5GHz 802.11n/ac W2 2x2 INPUT: WPS, Reset LED: Status - Green SERIAL: Header at J19, Beneath DC Power Jack 1-VCC ; 2-TX ; 3-RX; 4-GND; Serial 115200-8-N-1. Tested and working: - USB (requires extra packages) - LAN Ethernet (Correct MAC-address) - WAN Ethernet (Correct MAC-address) - 2.4 GHz WiFi (Correct MAC-address) - 5 GHz WiFi (Correct MAC-address) - Factory installation from Web UI - OpenWRT sysupgrade - LED - Reset Button Need Testing: - WPS button Install via Web UI: - Attach to a LAN port on the router. - Connect to the Linksys Smart WiFi Page (default 192.168.1.1) and login - Select the connectivity tab on the left - In the manual update box on the right - Select browse, and browse to openwrt-ipq40xx-linksys_ea6350v3-squashfs-factory.bin - Click update. - Read and accept the warning - The router LED will start blinking. When the router LED goes solid, you can now navigate to 192.168.1.1 to your new OpenWrt installation. Sysupgrade: - Flash the sysupgrade image as usual. Please: try to do a reset everytime you can (doing it with LuCI is easy and can be done in the same step). Recovery (Automatic): - If the device fails to boot after install or upgrade, whilst the unit is turned on: 1 - Wait 15 seconds 2 - Switch Off and Wait 10 seconds 3 - Switch on 4 - Repeat steps 1 to 3, 3 times then go to 5. 5 - U-boot will have now erased the failed update and switched back to the last working firmware - you should be able to access your router on LAN. Recovery (Manual): - The steps for manual recovery are the same as the generic u-boot tftp client method. Back To Stock: - Use the generic recovery using the tftp client method to flash the "civic.img". Also you can strip-and-pad the original image and use the generic "mtd" method by flashing over the "kernel" partition. * Just be careful to flash in the partition that the device is currently booted. Signed-off-by: Ryan Pannell <ryan@osukl.com> Signed-off-by: Oever González <notengobattery@gmail.com> [minor edits, removed second compatible of nand, added dtb entry to 4.19] Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2019-01-24 03:20:55 +00:00
;;
meraki,mr33 |\
meraki,mr74)
ipq40xx: Add support for Linksys EA8300 (Dallas) The Linksys EA8300 is based on QCA4019 and QCA9888 and provides three, independent radios. NAND provides two, alternate kernel/firmware images with fail-over provided by the OEM U-Boot. Installation: "Factory" images may be installed directly through the OEM GUI. Hardware Highlights: * IPQ4019 at 717 MHz (4 CPUs) * 256 MB NAND (Winbond W29N02GV, 8-bit parallel) * 256 MB RAM * Three, fully-functional radios; `iw phy` reports (FCC/US, -CT): * 2.4 GHz radio at 30 dBm * 5 GHz radio on ch. 36-64 at 23 dBm * 5 GHz radio on ch. 100-144 at 23 dBm (DFS), 149-165 at 30 dBm #{ managed } <= 16, #{ AP, mesh point } <= 16, #{ IBSS } <= 1 * All two-stream, MCS 0-9 * 4x GigE LAN, 1x GigE Internet Ethernet jacks with port lights * USB3, single port on rear with LED * WPS and reset buttons * Four status lights on top * Serial pads internal (unpopulated) "Linksys Dallas WiFi AP router based on Qualcomm AP DK07.1-c1" Implementation Notes: The OEM flash layout is preserved at this time with 3 MB kernel and ~69 MB UBIFS for each firmware version. The sysdiag (1 MB) and syscfg (56 MB) partitions are untouched, available as read-only. Serial Connectivity: Serial connectivity is *not* required to flash. Serial may be accessed by opening the device and connecting a 3.3-V adapter using 115200, 8n1. U-Boot access is good, including the ability to load images over TFTP and either run or flash them. Looking at the top of the board, from the front of the unit, J3 can be found on the right edge of the board, near the rear | J3 | |-| | |O| | (3.3V seen, open-circuit) |O| | TXD |O| | RXD |O| | |O| | GND |-| | | Unimplemented: * serial1 "ttyQHS0" (serial0 works as console) * Bluetooth; Qualcomm CSR8811 (potentially conected to serial1) Other Notes: https://wikidevi.com/wiki/Linksys_EA8300 states FCC docs also cover the Linksys EA8250. According to the RF Test Report BT BR+EDR, "All models are identical except for the EA8300 supports 256QAM and the EA8250 disable 256QAM." Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
2019-04-10 15:34:28 +00:00
CI_KERNPART="part.safe"
nand_do_upgrade "$1"
;;
mikrotik,cap-ac|\
mikrotik,hap-ac2|\
mikrotik,hap-ac3-lte6-kit|\
mikrotik,lhgg-60ad|\
ipq40xx: add MikroTik wAP ac (RBwAPG-5HacD2HnD) support The MikroTik wAP ac (RBwAPG-5HacD2HnD) is a dual-band dual-radio 802.11ac wireless access point with integrated antenna and two Ethernet ports in a weatherproof enclosure. See https://mikrotik.com/product/wap_ac for more information. Important: this is the new ipq40xx-based wAP ac, not the older ath79-based wAP ac (RBwAPG-5HacT2HnD), already supported in OpenWrt. Specifications: - SoC: Qualcomm Atheros IPQ4018 - CPU: 4x ARM Cortex A7 - RAM: 128MB - Storage: 16MB NOR flash - Wireless - 2.4GHz: Built-in IPQ4018 (SoC) 802.11b/g/n 2x2:2, 2.5 dBi antennae - 5GHz: Built-in IPQ4018 (SoC) 802.11a/n/ac 2x2:2, 2.5 dBi antennae - Ethernet: Built-in IPQ4018 (SoC, QCA8075), 2x 1000/100/10Mb/s ports, one with 802.3af/at PoE in Installation: Boot the initramfs image via TFTP, then flash the sysupgrade image using sysupgrade. Details at https://openwrt.org/toh/mikrotik/common. Notes: This preserves the MAC addresses of the physical Ethernet ports: - eth0 corresponds to the physical port labeled ETH1 and has the base MAC address. This port can be used to power the device. - eth1 corresponds to the physical port labeled ETH2 and has a MAC address one greater than the base. MAC addresses are set from /lib/preinit/05_set_iface_mac_ipq40xx.sh rather than /etc/board.d/02_network so that they are in effect for preinit. This should likely be done for other MikroTik devices and possibly other non-MikroTik devices as well. As this device has 2 physical ports, they are each connected to their respective PHYs, allowing the link status to be visible to software. Since they are not marked on the case with any role (such as LAN or WAN), both are bridged to the lan network by default, although this can easily be changed if needed. Signed-off-by: Mark Mentovai <mark@mentovai.com>
2021-10-04 14:48:29 +00:00
mikrotik,sxtsq-5-ac|\
mikrotik,wap-ac|\
mikrotik,wap-ac-lte|\
mikrotik,wap-r-ac)
[ "$(rootfs_type)" = "tmpfs" ] && mtd erase firmware
default_do_upgrade "$1"
;;
mikrotik,hap-ac3)
platform_do_upgrade_mikrotik_nand "$1"
;;
ipq40xx: add support for Netgear SRR60/SRS60 and RBR50/RBS50 The Netgear SRS60 and SRR60 (sold together as SRK60) are two almost identical AC3000 routers. The SRR60 has one port labeled as wan while the SRS60 not. The RBR50 and RBS50 (sold together as RBK50) have a different external shape but they have an USB 2.0 port on the back. This patch has been tested only on SRS60 and RBR50, but should work on SRR60 and RBS50. Hardware -------- SoC: Qualcomm IPQ4019 (717 MHz, 4 cores 4 threads) RAM: 512MB DDR3 FLASH: 4GB EMMC ETH: - 3x 10/100/1000 Mbps Ethernet - 1x 10/100/1000 Mbps Ethernet (WAN) WIFI: - 2.4GHz: 1x IPQ4019 (2x2:2) - 5GHz: 1x IPQ4019 (2x2:2) - 5GHz: 1x QCA9984 (4x4:4) - 6 internal antennas BTN: - 1x Reset button - 1x Sync button - 1x ON/OFF button LEDS: - 8 leds controlled by TLC59208F (they can be switched on/off independendently but the color can by changed by GPIOs) - 1x Red led (Power) - 1x Green led (Power) UART: - 115200-8-N-1 Everything works correctly. Installation ------------ These routers have a dual partition system. However this firmware works only on boot partition 1 and the OEM web interface will always flash on the partition currently not booted. The following steps will use the SRS60 firmware, but you have to chose the right firmware for your router. There are 2 ways to install Openwrt the first time: 1) Using NMRPflash 1. Download nmrpflash (https://github.com/jclehner/nmrpflash) 2. Put the openwrt-ipq40xx-generic-netgear_srs60-squashfs-factory.img file in the same folder of the nmrpflash executable 3. Connect your pc to the router using the port near the power button. 4. Run "nmrpflash -i XXX -f openwrt-ipq40xx-generic-netgear_srs60-squashfs-factory.img". Replace XXX with your network interface (can be identified by running "nmrpflash -L") 5. Power on the router and wait for the flash to complete. After about a minute the router should boot directly to Openwrt. If nothing happens try to reboot the router. If you have problems flashing try to set "10.164.183.253" as your computer IP address 2) Without NMRPflash The OEM web interface will always flash on the partition currently not booted, so to flash OpenWrt for the first time you have to switch to boot partition 2 and then flash the factory image directly from the OEM web interface. To switch on partition 2 you have to enable telnet first: 1. Go to http://192.168.1.250/debug.htm and check "Enable Telnet". 2. Connect through telent ("telnet 192.168.1.250") and login using admin/password. To read the current boot_part: artmtd -r boot_part To write the new boot_part: artmtd -w boot_part 02 Then reboot the router and then check again the current booted partition Now that you are on boot partition 2 you can flash the factory Openwrt image directly from the OEM web interface. Restore OEM Firmware -------------------- 1. Download the stock firmware from official netgear support. 2. Follow the nmrpflash procedure like above, using the official Netgear firmware (for example SRS60-V2.2.1.210.img) nmrpflash -i XXX -f SRS60-V2.2.1.210.img Notes ----- 1) You can check and edit the boot partition in the Uboot shell using the UART connection. "boot_partition_show" shows the current boot partition "boot_partition_set 1" sets the current boot partition to 1 2) Router mac addresses: LAN XX:XX:XX:XX:XX:69 WAN XX:XX:XX:XX:XX:6a WIFI 2G XX:XX:XX:XX:XX:69 WIFI 5G XX:XX:XX:XX:XX:6b WIFI 5G (2nd) XX:XX:XX:XX:XX:6c LABEL XX:XX:XX:XX:XX:69 Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> Signed-off-by: Robert Marko <robimarko@gmail.com> [added 5.10 changes for 901-arm-boot-add-dts-files.patch, moved sysupgrade mmc.sh to here and renamed it, various dtsi changes] Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2020-09-02 00:10:16 +00:00
netgear,rbr50 |\
netgear,rbs50 |\
netgear,srr60 |\
netgear,srs60)
platform_do_upgrade_netgear_orbi_upgrade "$1"
;;
ipq40xx: add support for OpenMesh A62 * QCA IPQ4019 * 256 MB of RAM * 32 MB of SPI NOR flash (s25fl256s1) - 2x 15 MB available; but one of the 15 MB regions is the recovery image * 2T2R 2.4 GHz - QCA4019 hw1.0 (SoC) - requires special BDF in QCA4019/hw1.0/board-2.bin with bus=ahb,bmi-chip-id=0,bmi-board-id=20,variant=OM-A62 * 2T2R 5 GHz (channel 36-64) - QCA9888 hw2.0 (PCI) - requires special BDF in QCA9888/hw2.0/board-2.bin bus=pci,bmi-chip-id=0,bmi-board-id=16,variant=OM-A62 * 2T2R 5 GHz (channel 100-165) - QCA4019 hw1.0 (SoC) - requires special BDF in QCA4019/hw1.0/board-2.bin with bus=ahb,bmi-chip-id=0,bmi-board-id=21,variant=OM-A62 * multi-color LED (controlled via red/green/blue GPIOs) * 1x button (reset; kmod-input-gpio-keys compatible) * external watchdog - triggered GPIO * 1x USB (xHCI) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 2x gigabit ethernet - phy@mdio3: + Label: Ethernet 1 + gmac0 (ethaddr) in original firmware + 802.3at POE+ - phy@mdio4: + Label: Ethernet 2 + gmac1 (eth1addr) in original firmware + 18-24V passive POE (mode B) * powered only via POE The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the factory image to the u-boot when the device boots up. The initramfs image can be started using setenv bootargs 'loglevel=8 earlycon=msm_serial_dm,0x78af000 console=ttyMSM0,115200 mtdparts=spi0.0:256k(0:SBL1),128k(0:MIBIB),384k(0:QSEE),64k(0:CDT),64k(0:DDRPARAMS),64k(0:APPSBLENV),512k(0:APPSBL),64k(0:ART),64k(0:custom),64k(0:KEYS),15552k(inactive),15552k(inactive2)' tftpboot 0x84000000 openwrt-ipq40xx-openmesh_a62-initramfs-fit-uImage.itb set fdt_high 0x85000000 bootm 0x84000000 Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
2017-08-09 11:52:07 +00:00
openmesh,a42 |\
openmesh,a62 |\
ipq40xx: add support for Plasma Cloud PA2200 Device specifications: * QCA IPQ4019 * 256 MB of RAM * 32 MB of SPI NOR flash (w25q256) - 2x 15 MB available; but one of the 15 MB regions is the recovery image * 2T2R 2.4 GHz - QCA4019 hw1.0 (SoC) - requires special BDF in QCA4019/hw1.0/board-2.bin with bus=ahb,bmi-chip-id=0,bmi-board-id=20,variant=PlasmaCloud-PA2200 * 2T2R 5 GHz (channel 36-64) - QCA9888 hw2.0 (PCI) - requires special BDF in QCA9888/hw2.0/board-2.bin bus=pci,bmi-chip-id=0,bmi-board-id=16,variant=PlasmaCloud-PA2200 * 2T2R 5 GHz (channel 100-165) - QCA4019 hw1.0 (SoC) - requires special BDF in QCA4019/hw1.0/board-2.bin with bus=ahb,bmi-chip-id=0,bmi-board-id=21,variant=PlasmaCloud-PA2200 * GPIO-LEDs for 2.4GHz, 5GHz-SoC and 5GHz-PCIE * GPIO-LEDs for power (orange) and status (blue) * 1x GPIO-button (reset) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 2x gigabit ethernet - phy@mdio3: + Label: Ethernet 1 + gmac0 (ethaddr) in original firmware + used as LAN interface - phy@mdio4: + Label: Ethernet 2 + gmac1 (eth1addr) in original firmware + 802.3at POE+ + used as WAN interface * 12V 2A DC Flashing instructions: The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the factory image to the u-boot when the device boots up. Signed-off-by: Marek Lindner <marek.lindner@kaiwoo.ai> [sven@narfation.org: prepare commit message, rebase, use all LEDs, switch to dualboot_datachk upgrade script, use eth1 as designated WAN interface] Signed-off-by: Sven Eckelmann <sven@narfation.org>
2018-12-14 15:46:53 +00:00
plasmacloud,pa1200 |\
plasmacloud,pa2200)
PART_NAME="inactive"
platform_do_upgrade_dualboot_datachk "$1"
;;
ipq40xx: add support for Sony NCP-HG100/Cellular Sony NCP-HG100/Cellular is a IoT Gateway with 2.4/5 GHz band 11ac (WiFi-5) wireless function, based on IPQ4019. Specification: - SoC : Qualcomm IPQ4019 - RAM : DDR3 512 MiB (H5TC4G63EFR) - Flash : eMMC 4 GiB (THGBMNG5D1LBAIT) - WLAN : 2.4/5 GHz 2T2R (IPQ4019) - Ethernet : 10/100/1000 Mbps x2 - Transceiver : Qualcomm QCA8072 - WWAN : Telit LN940A9 - Z-Wave : Silicon Labs ZM5101 - Bluetooth : Qualcomm CSR8811 - Audio DAC : Realtek ALC5629 - Audio Amp. : Realtek ALC1304 - Voice Input Processor : Conexant CX20924 - Micro Controller Unit : Nuvoton MINI54FDE - RGB LED, Fan, Temp. sensors - Touch Sensor : Cypress CY8C4014LQI - RGB LED driver : TI LP55231 (2x) - LEDs/Keys : 11x, 6x - UART : through-hole on PCB - J1: 3.3V, TX, RX, GND from tri-angle marking - 115200n8 - Power : 12 VDC, 2.5 A Flash instruction using initramfs image: 1. Prepare TFTP server with the IP address 192.168.132.100 and place the initramfs image to TFTP directory with the name "C0A88401.img" 2. Boot NCP-HG100/Cellular and interrupt after the message "Hit any key to stop autoboot: 2" 3. Perform the following commands and set bootcmd to allow booting from eMMC setenv bootcmd "mmc read 0x84000000 0x2e22 0x4000 && bootm 0x84000000" saveenv 4. Perform the following command to load/boot the OpenWrt initramfs image tftpboot && bootm 5. On the initramfs image, perform sysupgrade with the sysupgrade image (if needed, backup eMMC partitions by dd command and download to other place before performing sysupgrade) 6. Wait for ~120 seconds to complete flashing Known issues: - There are no drivers for audio-related chips/functions in Linux Kernel and OpenWrt, they cannot be used. - There is no driver for MINI54FDE Micro-Controller Unit, customized for this device by the firmware in the MCU. This chip controls the following functions, but they cannot be controlled in OpenWrt. - RGB LED - Fan this fan is controlled automatically by MCU by default, without driver - Thermal Sensors (2x) - Currently, there is no driver or tool for CY8C4014LQI and cannot be controlled. It cannot be exited from "booting mode" and moved to "normal op mode" after booting. And also, the 4x buttons (mic mute, vol down, vol up, alexa trigger) connected to the IC cannot be controlled. - it can be exited from "booting mode" by installing and executing i2cset command: opkg update opkg install i2c-tools i2cset -y 1 0x14 0xf 1 - There is a connection issue on the control by uqmi for the WWAN module. But modemmanager can be used without any issues and the use of it is recommended. - With the F2FS format, too many errors are reported on erasing eMMC partition "rootfs_data" while booting: [ 1.360270] sdhci: Secure Digital Host Controller Interface driver [ 1.363636] sdhci: Copyright(c) Pierre Ossman [ 1.369730] sdhci-pltfm: SDHCI platform and OF driver helper [ 1.374729] sdhci_msm 7824900.sdhci: Got CD GPIO ... [ 1.413552] mmc0: SDHCI controller on 7824900.sdhci [7824900.sdhci] using ADMA 64-bit [ 1.528325] mmc0: new HS200 MMC card at address 0001 [ 1.530627] mmcblk0: mmc0:0001 004GA0 3.69 GiB [ 1.533530] mmcblk0boot0: mmc0:0001 004GA0 partition 1 2.00 MiB [ 1.537831] mmcblk0boot1: mmc0:0001 004GA0 partition 2 2.00 MiB [ 1.542918] mmcblk0rpmb: mmc0:0001 004GA0 partition 3 512 KiB, chardev (247:0) [ 1.550323] Alternate GPT is invalid, using primary GPT. [ 1.561669] mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 ... [ 8.841400] mount_root: loading kmods from internal overlay [ 8.860241] kmodloader: loading kernel modules from //etc/modules-boot.d/* [ 8.863746] kmodloader: done loading kernel modules from //etc/modules-boot.d/* [ 9.240465] block: attempting to load /etc/config/fstab [ 9.246722] block: unable to load configuration (fstab: Entry not found) [ 9.246863] block: no usable configuration [ 9.254883] mount_root: overlay filesystem in /dev/mmcblk0p17 has not been formatted yet [ 9.438915] urandom_read: 5 callbacks suppressed [ 9.438924] random: mkfs.f2fs: uninitialized urandom read (16 bytes read) [ 12.243332] mmc_erase: erase error -110, status 0x800 [ 12.246638] mmc0: cache flush error -110 [ 15.134585] mmc_erase: erase error -110, status 0x800 [ 15.135891] mmc_erase: group start error -110, status 0x0 [ 15.139850] mmc_erase: group start error -110, status 0x0 ...(too many the same errors)... [ 17.350811] mmc_erase: group start error -110, status 0x0 [ 17.356197] mmc_erase: group start error -110, status 0x0 [ 17.439498] sdhci_msm 7824900.sdhci: Card stuck in wrong state! card_busy_detect status: 0xe00 [ 17.446910] mmc0: tuning execution failed: -5 [ 17.447111] mmc0: cache flush error -110 [ 18.012440] F2FS-fs (mmcblk0p17): Found nat_bits in checkpoint [ 18.062652] F2FS-fs (mmcblk0p17): Mounted with checkpoint version = 428fa16b [ 18.198691] block: attempting to load /etc/config/fstab [ 18.198972] block: unable to load configuration (fstab: Entry not found) [ 18.203029] block: no usable configuration [ 18.211371] mount_root: overlay filesystem has not been fully initialized yet [ 18.214487] mount_root: switching to f2fs overlay So, this support uses ext4 format instead which has no errors. Note: - The primary uart is shared for debug console and Z-Wave chip. The function is switched by GPIO15 (Linux: 427). value: 1: debug console 0: Z-Wave - NCP-HG100/Cellular has 2x os-image pairs in eMMC. - 0:HLOS, rootfs - 0:HLOS_1, rootfs_1 In OpenWrt, the first image pair is used. - "bootipq" command in U-Boot requires authentication with signed-image by default. To boot unsigned image of OpenWrt, use "mmc read" and "bootm" command instead. - This support is for "Cellular" variant of NCP-HG100 and not tested on "WLAN" (non-cellular) variant. - The board files of ipq-wifi may also be used in "WLAN" variant of NCP-HG100, but unconfirmed and add files as for "Cellular" variant. - "NET" LED is used to indicate WWAN status in stock firmware. - There is no MAC address information in the label on the case, use the address included in UUID in the label as "label-MAC" instead. - The "CLOUD" LEDs are partially used for indication of system status in stock firmware, use they as status LEDs in OpenWrt instead of RGB LED connected to the MCU. MAC addresses: LAN : 5C:FF:35:**:**:ED (ART, 0x6 (hex)) WAN : 5C:FF:35:**:**:EF (ART, 0x0 (hex)) 2.4 GHz: 5C:FF:35:**:**:ED (ART, 0x1006 (hex)) 5 GHz : 5C:FF:35:**:**:EE (ART, 0x5006 (hex)) partition layout in eMMC (by fdisk, GPT): Disk /dev/mmcblk0: 7733248 sectors, 3776M Logical sector size: 512 Disk identifier (GUID): **** Partition table holds up to 20 entries First usable sector is 34, last usable sector is 7634910 Number Start (sector) End (sector) Size Name 1 34 1057 512K 0:SBL1 2 1058 2081 512K 0:BOOTCONFIG 3 2082 3105 512K 0:QSEE 4 3106 4129 512K 0:QSEE_1 5 4130 4641 256K 0:CDT 6 4642 5153 256K 0:CDT_1 7 5154 6177 512K 0:BOOTCONFIG1 8 6178 6689 256K 0:APPSBLENV 9 6690 8737 1024K 0:APPSBL 10 8738 10785 1024K 0:APPSBL_1 11 10786 11297 256K 0:ART 12 11298 11809 256K 0:HSEE 13 11810 28193 8192K 0:HLOS 14 28194 44577 8192K 0:HLOS_1 15 44578 306721 128M rootfs 16 306722 568865 128M rootfs_1 17 568866 3958065 1654M rootfs_data [initial work] Signed-off-by: Iwao Yuki <dev.clef@gmail.com> Co-developed-by: Iwao Yuki <dev.clef@gmail.com> [adjustments, cleanups, commit message, sending patch] Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com> (dropped clk_unused_ignore, dropped 901-* patches, renamed key nodes, changed LEDs chan/labels to match func-en, made :net -> (w)wan leds) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-09-04 12:27:11 +00:00
sony,ncp-hg100-cellular)
sony_emmc_do_upgrade "$1"
;;
ipq40xx: add support for ZTE MF286D ZTE MF286D is a LTE router with four gigabit ethernet ports and integrated QMI mPCIE modem. Hardware specification: - CPU: IPQ4019 - RAM: 256MB - Flash: NAND 128MB + NOR 2MB - WLAN1: Qualcomm Atheros QCA4019 2.4GHz 802.11bgn 2x2:2 - WLAN2: Qualcomm Atheros QCA4019 5GHz 802.11anac 2x2:2 - LTE: mPCIe cat 12 card (Modem chipset MDM9250) - LAN: 4 Gigabit Ports - USB: 1x USB2.0 (regular port). 1x USB3.0 (mpcie - used by the modem) - Serial console: X8 connector 115200 8n1 Known issues: - Many LEDs are driven by the modem. Only internal LEDs and wifi LEDs are driven by cpu. - Wifi LED is triggered by phy0tpt only - No VoIP support - LAN1/WAN port is configured as WAN - ZTE gives only one MAC per device. Use +1/+2/+3 increment for WAN and WLAN0/1 Opening the case: 1. Take of battery lid (no battery support for this model, battery cage is dummy). 2. Unscrew screw placed behind battery lid. 3. Take off back cover. It attached with multiple plastic clamps. 4. Unscrew four more screws hidden behind back case. 5. Remove front panel from blue chassis. There are more plastic clamps. 6. Unscrew two boards, which secures the PCB in the chassis. 7. Extract board from blue chassis. Console connection (X8 connector): 1. Parameters: 115200 8N1 2. Pin description: (from closest pin to X8 descriptor to farthest) - VCC (3.3V) - TX - RX - GND Install Instructions: Serial + initramfs: 1. Place OpenWrt initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.1.3 2. Connect serial console (115200,8n1) to X8 connector. 3. Connect TFTP server to RJ-45 port. 4. Stop in u-Boot and run u-Boot commands: setenv serverip 192.168.1.3 setenv ipaddr 192.168.1.72 set fdt_high 0x85000000 tftp openwrt-ipq40xx-generic-zte_mf286d-initramfs-fit-zImage.itb bootm $loadaddr 5. Please make backup of original partitions, if you think about revert to stock. 6. Login via ssh or serial and remove stock partitions: ubiattach -m 9 ubirmvol /dev/ubi0 -N ubi_rootfs ubirmvol /dev/ubi0 -N ubi_rootfs_data 7. Install image via "sysupgrade -n". Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com> (cosmetic changes to the commit message) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2021-11-23 08:10:14 +00:00
teltonika,rutx10 |\
ipq40xx: add support for Teltonika RUTX50 Hardware -------- CPU: Qualcomm IPQ4018 RAM: 256M Flash: 16MB SPI-NOR (W25Q128) 128MB SPI-NAND (XTX) WiFi: 2T2R (2GHz 802.11n ; 5 GHz 802.11ac) ETH: 4x LAN ; 1x WAN (Gigabit) CELL: Quectel RG501Q 3G/4G/5G UART: Available on the goldfinger connector (Pinout silkscreened) 115200 8N1 3V3 - Only connect RX / TX / GND Installation ------------ 1. Enable SSH in the Teltonika UI (System --> Administration --> Access Control) 2. Check from which partition set the device is currently running from. $ cat /proc/boot_info/rootfs/primaryboot In case this output reads 0, install a Software update from Teltonika first. After upgrade completion, check this file now reads 1 before continuing. 2. Transfer the OpenWrt factory image to the device using scp. Use the same password (user root!) as used for the Web-UI. $ scp -O openwrt-factory.bin root@192.168.1.1:/tmp 3. Connect to the device using ssh as the root user. 4. Install OpenWrt by writing the factory image to flash. $ ubiformat /dev/mtd16 -y -f /tmp/openwrt-factory.bin 5. Instruct the bootloaer to boot from the first partition set. $ echo 0 > /proc/boot_info/rootfs/primaryboot $ cat /proc/boot_info/getbinary_bootconfig > /tmp/bootconfig.bin $ cat /proc/boot_info/getbinary_bootconfig1 > /tmp/bootconfig1.bin $ mtd write /tmp/bootconfig.bin /dev/mtd2 $ mtd write /tmp/bootconfig1.bin /dev/mtd3 6. Reboot the device. $ reboot Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit 844bb4bfad84cc6267f9b138d1f63b07ed3b77d0)
2023-05-06 14:57:18 +00:00
teltonika,rutx50 |\
ipq40xx: Add support ZTE MF18A Light and small router ( In Poland operators sells together with MC7010 outdoor modem to provide WIFI inside home). Device specification SoC Type: Qualcomm IPQ4019 RAM: 256 MiB Flash: 128 MiB SPI NAND (Winbond W25N01GV) ROM: 2MiB SPI Flash (GD25Q16) Wireless 2.4 GHz (IP4019): b/g/n, 2x2 Wireless 5 GHz (QCA9982): a/n/ac, 3x3 Ethernet: 2xGbE (WAN/LAN1, LAN2) USB ports: No Button: 2 (Reset/WPS) LEDs: 3 external leds: Power (blue) , WiFI (blue and red), SMARTHOME (blue and red) and 1 internal (blue) -- NOTE: Power controls all external led (if down ,all others also not lights even signal is up) Power: 5VDC, 2,1A via USB-C socket Bootloader: U-Boot On board ZWave and Zigbee (EFR32 MG1P232GG..) modules ( not supported by orginal software ) Installation 1.Open MF18A case by ungluing rubber pad under the router and unscrew screws, and connect to serial console port, with the following pinout, starting from pin 1, which is the topmost pin when the board is upright (reset button on the bottom) : VCC (3.3V). Do not use unless you need to source power for the converer from it. TX RX GND Default port configuration in U-boot as well as in stock firmware is 115200-8-N-1. 2.Place OpenWrt initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.0.2 3.Connect TFTP server to RJ-45 port (WAN/LAN1). 4.Power on MF18A , stop in u-Boot (using ESC button) and run u-Boot commands: setenv serverip 192.168.0.2 setenv ipaddr 192.168.0.1 set fdt_high 0x85000000 tftpboot 0x84000000 openwrt-ipq40xx-generic-zte_mf18a-initramfs-fit-zImage.itb bootm 0x84000000 5.Please make backup of original partitions, if you think about revert to stock, specially mtd8 (Web UI) and mtd9 (rootFS). Use /tmp as temporary storage and do: WEB PARITION cat /dev/mtd8 > /tmp/mtd8.bin scp /tmp/mtd8.bin root@YOURSERVERIP:/ rm /tmp/mtd8.bin ROOT PARITION cat /dev/mtd9 > /tmp/mtd9.bin scp /tmp/mtd9.bin root@YOURSERVERIP:/ rm /tmp/mtd9.bin If you are sure ,that you want to flash openwrt, from uBoot, before bootm, clean rootfs partition with command: nand erase 0x1800000 0x1D00000 6.Login via ssh or serial and remove stock partitions (default IP 192.168.1.1): ubiattach -m 9 # it could return error if ubi was attached before or rootfs part was erased before ubirmvol /dev/ubi0 -N ubi_rootfs # it could return error if rootfs part was erased before ubirmvol /dev/ubi0 -N ubi_rootfs_data # some devices doesn't have it 7. Install image via : sysupgrade -n /tmp/openwrt-ipq40xx-generic-zte_mf18a-squashfs-sysupgrade.bin previously wgeting bin. Sometimes it could print ubi attach error, but please ignore it if process goes forward. Back to Stock (!!! need original dump taken from initramfs !!!) ------------- Place mtd8.bin and mtd9.bin initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.0.2 Connect serial console (115200,8n1) to serial console connector . Connect TFTP server to RJ-45 port (WAN/LAN1). rename mtd8.bin to web.img and mtd9.bin to root_uImage_s Stop in u-Boot (using ESC button) and run u-Boot commands: This will erase Web and RootFS: nand erase 0x1000000 0x800000 nand erase 0x1800000 0x1D00000 This will restore RootFS: tftpboot 0x84000000 root_uImage_s nand erase 0x1800000 0x1D00000 nand write 0x84000000 0x1800000 0x1D00000 This will restore Web Interface: tftpboot 0x84000000 web.img nand erase 0x1000000 0x800000 nand write 0x84000000 0x1000000 0x800000 After first boot on stock firwmare, do a factory reset. Push reset button for 5 seconds so all parameters will be reverted to the one printed on label on bottom of the router As reference was taken MF289F support by Giammarco Marzano stich86@gmail.com and MF286D by Pawel Dembicki paweldembicki@gmail.com Signed-off-by: Marcin Gajda <mgajda@o2.pl>
2022-12-28 18:01:40 +00:00
zte,mf18a |\
ipq40xx: Add ZTE MF289F It's a 4G Cat.20 router used by Vodafone Italy (called Vodafone FWA) and Vodafone DE\T-Mobile PL (called GigaCube). Modem is a MiniPCIe-to-USB based on Snapdragon X24, it supports 4CA aggregation. There are currently two hardware revisions, which differ on the 5Ghz radio: AT1 = QCA9984 5Ghz Radio on PCI-E bus AT2 = IPQ4019 5Ghz Radio inside IPQ4019 like 2.4Ghz Device specification -------------------- SoC Type: Qualcomm IPQ4019 RAM: 256 MiB Flash: 128 MiB SPI NAND (Winbond W25N01GV) ROM: 2MiB SPI Flash (GD25Q16) Wireless 2.4 GHz (IP4019): b/g/n, 2x2 Wireless 5 GHz: (QCA9984): a/n/ac, 4x4 HW REV AT1 (IPA4019): a/n/ac, 2x2 HW REV AT2 Ethernet: 2xGbE (WAN/LAN1, LAN2) USB ports: No Button: 2 (Reset/WPS) LEDs: 3 external leds: Network (white or red), Wifi, Power and 1 internal (blue) Power: 12 VDC, 1 A Connector type: Barrel Bootloader: U-Boot Installation ------------ 1. Place OpenWrt initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.0.2 2. Connect serial console (115200,8n1) to serial connector GND (which is right next to the thing with MF289F MIMO-V1.0), RX, TX (refer to this image: https://ibb.co/31Gngpr). 3. Connect TFTP server to RJ-45 port (WAN/LAN1). 4. Stop in u-Boot (using ESC button) and run u-Boot commands: setenv serverip 192.168.0.2 setenv ipaddr 192.168.0.1 set fdt_high 0x85000000 tftp openwrt-ipq40xx-generic-zte_mf289f-initramfs-fit-zImage.itb bootm $loadaddr 5. Please make backup of original partitions, if you think about revert to stock, specially mtd16 (Web UI) and mtd17 (rootFS). Use /tmp as temporary storage and do: WEB PARITION -------------------------------------- cat /dev/mtd16 > /tmp/mtd16.bin scp /tmp/mtd16.bin root@YOURSERVERIP:/ rm /tmp/mtd16.bin ROOT PARITION -------------------------------------- cat /dev/mtd17 > /tmp/mtd17.bin scp /tmp/mtd17.bin root@YOURSERVERIP:/ rm /tmp/mtd17.bin 6. Login via ssh or serial and remove stock partitions (default IP 192.168.0.1): # this can return an error, if ubi was attached before # or rootfs part was erased before. ubiattach -m 17 # it could return error if rootfs part was erased before ubirmvol /dev/ubi0 -N ubi_rootfs # some devices doesn't have it ubirmvol /dev/ubi0 -N ubi_rootfs_data 7. download and install image via sysupgrade -n (either use wget/scp to copy the mf289f's squashfs-sysupgrade.bin to the device's /tmp directory) sysupgrade -n /tmp/openwrt-...-zte_mf289f-squashfs-sysupgrade.bin Sometimes it could print ubi attach error, but please ignore it if process goes forward. Flash Layout NAND: mtd8: 000a0000 00020000 "fota-flag" mtd9: 00080000 00020000 "0:ART" mtd10: 00080000 00020000 "mac" mtd11: 000c0000 00020000 "reserved2" mtd12: 00400000 00020000 "cfg-param" mtd13: 00400000 00020000 "log" mtd14: 000a0000 00020000 "oops" mtd15: 00500000 00020000 "reserved3" mtd16: 00800000 00020000 "web" mtd17: 01d00000 00020000 "rootfs" mtd18: 01900000 00020000 "data" mtd19: 03200000 00020000 "fota" mtd20: 0041e000 0001f000 "kernel" mtd21: 0101b000 0001f000 "ubi_rootfs" SPI: mtd0: 00040000 00010000 "0:SBL1" mtd1: 00020000 00010000 "0:MIBIB" mtd2: 00060000 00010000 "0:QSEE" mtd3: 00010000 00010000 "0:CDT" mtd4: 00010000 00010000 "0:DDRPARAMS" mtd5: 00010000 00010000 "0:APPSBLENV" mtd6: 000c0000 00010000 "0:APPSBL" mtd7: 00050000 00010000 "0:reserved1" Back to Stock (!!! need original dump taken from initramfs !!!) ------------- 1. Place mtd16.bin and mtd17.bin initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.0.2 2. Connect serial console (115200,8n1) to serial console connector (refer to the pin-out from above). 3. Connect TFTP server to RJ-45 port (WAN/LAN1). 4. rename mtd16.bin to web.img and mtd17.bin to root_uImage_s 5. Stop in u-Boot (using ESC button) and run u-Boot commands: This will erase RootFS+Web: nand erase 0x1000000 0x800000 nand erase 0x1800000 0x1D00000 This will restore RootFS: tftpboot 0x84000000 ${dir}root_uImage_s nand erase 0x1800000 0x1D00000 nand write $fileaddr 0x1800000 $filesize This will restore Web Interface: tftpboot 0x84000000 ${dir}web.img nand erase 0x1000000 0x800000 nand write $fileaddr 0x1000000 $filesize After first boot on stock firwmare, do a factory reset. Push reset button for 5 seconds so all parameters will be reverted to the one printed on label on bottom of the router Signed-off-by: Giammarco Marzano <stich86@gmail.com> Reviewed-by: Lech Perczak <lech.perczak@gmail.com> (Warning: commit message did not conform to UTF-8 - hopefully fixed?, added description of the pin-out if image goes down, reformatted commit message to be hopefully somewhat readable on git-web, redid some of the gpio-buttons & leds DT nodes, etc.) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-09-14 12:20:43 +00:00
zte,mf286d |\
zte,mf287 |\
ipq4019: add support for ZTE MF287+ aka DreiNeo The ZTE MF287+ is a LTE router used (exclusively?) by the network operator "3". The MF287 (i.e. non-plus aka 3Neo) is also supported (the only difference is the LTE modem) Specifications ============== SoC: IPQ4018 RAM: 256MiB Flash: 8MiB SPI-NOR + 128MiB SPI-NAND LAN: 4x GBit LAN LTE: ZTE Cat12 (MF287+) / ZTE Cat6 (MF287) WiFi: 802.11a/b/g/n/ac SoC-integrated MAC addresses ============= LAN: from config + 2 WiFi 1: from config WiFi 2: from config + 1 Installation ============ Option 1 - TFTP --------------- TFTP installation using UART is preferred. Disassemble the device and connect serial. Put the initramfs image as openwrt.bin to your TFTP server and configure a static IP of 192.168.1.100. Load the initramfs image by typing: setenv serverip 192.168.1.100 setenv ipaddr 192.168.1.1 tftpboot 0x82000000 openwrt.bin bootm 0x82000000 From this intiramfs boot you can take a backup of the currently installed partitions as no vendor firmware is available for download: ubiattach -m14 cat /dev/ubi0_0 > /tmp/ubi0_0 cat /dev/ubi0_1 > /tmp/ubi0_1 Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save. Once booted, transfer the sysupgrade image and run sysupgrade. You might have to delete the stock volumes first: ubirmvol /dev/ubi0 -N ubi_rootfs ubirmvol /dev/ubi0 -N kernel Option 2 - From stock firmware ------------------------------ The installation from stock requires an exploit first. The exploit consists of a backup file that forces the firmware to download telnetd via TFTP from 192.168.0.22 and run it. Once exploited, you can connect via telnet and login as admin:admin. The exploit will be available at the device wiki page. Once inside the stock firmware, you can transfer the -factory.bin file to /tmp by using "scp" from the stock frmware or "tftp". ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write access - you need to read from one file in /proc. Once done, you need to erase the UBI partition and flash OpenWrt. Before performing the operation, make sure that mtd13 is the partition labelled "rootfs" by calling "cat /proc/mtd". Complete commands: cd /tmp tftp -g -r factory.bin 192.168.0.22 cat /proc/driver/sensor_id flash_erase /dev/mtd13 0 0 dd if=/tmp/factory.bin of=/dev/mtdblock13 bs=131072 Afterwards, reboot your device and you should have a working OpenWrt installation. Restore Stock ============= Option 1 - via UART ------------------- Boot an OpenWrt initramfs image via TFTP as for the initial installation. Transfer the two backed-up files to your box to /tmp. Then, run the following commands - replace $kernel_length and $rootfs_size by the size of ubi0_0 and ubi0_1 in bytes. ubiattach -m 14 ubirmvol /dev/ubi0 -N kernel ubirmvol /dev/ubi0 -N rootfs ubirmvol /dev/ubi0 -N rootfs_data ubimkvol /dev/ubi0 -N kernel -s $kernel_length ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0 ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1 Option 2 - from within OpenWrt ------------------------------ This option requires to flash an initramfs version first so that access to the flash is possible. This can be achieved by sysupgrading to the recovery.bin version and rebooting. Once rebooted, you are again in a default OpenWrt installation, but no partition is mounted. Follow the commands from Option 1 to flash back to stock. LTE Modem ========= The LTE modem is similar to other ZTE devices and controls some more LEDs and battery management. Configuring the connection using uqmi works properly, the modem provides three serial ports and a QMI CDC ethernet interface. Signed-off-by: Andreas Böhler <dev@aboehler.at> (cherry picked from commit f70ee53b08466f612546f699c556cbdaa39e1466)
2023-06-07 19:24:18 +00:00
zte,mf287plus |\
ipq4019: add support for ZTE MF287 Pro aka DreiNeo Pro The ZTE MF287 Pro is a LTE router used (exclusively?) by the network operator "3". It is very similar to the MF287+, but the hardware layout and partition layout have changed quite a bit. Specifications ============== SoC: IPQ4018 RAM: 256MiB Flash: 8MiB SPI-NOR + 128MiB SPI-NAND LAN: 4x GBit LAN LTE: ZTE Cat12 WiFi: 802.11a/b/g/n/ac SoC-integrated USB: 1x 2.0 MAC addresses ============= LAN: from config + 2 WiFi 1: from config WiFi 2: from config + 1 Installation ============ Option 1 - TFTP --------------- TFTP installation using UART is preferred. Disassemble the device and connect serial. Put the initramfs image as openwrt.bin to your TFTP server and configure a static IP of 192.168.1.100. Load the initramfs image by typing: setenv serverip 192.168.1.100 setenv ipaddr 192.168.1.1 tftpboot 0x82000000 openwrt.bin bootm 0x82000000 From this intiramfs boot you can take a backup of the currently installed partitions as no vendor firmware is available for download: ubiattach -m17 cat /dev/ubi0_0 > /tmp/ubi0_0 cat /dev/ubi0_1 > /tmp/ubi0_1 Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save. Once booted, transfer the sysupgrade image and run sysupgrade. You might have to delete the stock volumes first: ubirmvol /dev/ubi0 -N ubi_rootfs ubirmvol /dev/ubi0 -N kernel Option 2 - From stock firmware ------------------------------ The installation from stock requires an exploit first. The exploit consists of a backup file that forces the firmware to download telnetd via TFTP from 192.168.0.22 and run it. Once exploited, you can connect via telnet and login as admin:admin. The exploit will be available at the device wiki page. Once inside the stock firmware, you can transfer the -factory.bin file to /tmp by using "scp" from the stock frmware or "tftp". ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write access - you need to read from one file in /proc. Once done, you need to erase the UBI partition and flash OpenWrt. Before performing the operation, make sure that mtd13 is the partition labelled "rootfs" by calling "cat /proc/mtd". Complete commands: cd /tmp tftp -g -r factory.bin 192.168.0.22 cat /proc/driver/sensor_id flash_erase /dev/mtd17 0 0 dd if=/tmp/factory.bin of=/dev/mtdblock17 bs=131072 Afterwards, reboot your device and you should have a working OpenWrt installation. Restore Stock ============= Option 1 - via UART ------------------- Boot an OpenWrt initramfs image via TFTP as for the initial installation. Transfer the two backed-up files to your box to /tmp. Then, run the following commands - replace $kernel_length and $rootfs_size by the size of ubi0_0 and ubi0_1 in bytes. ubiattach -m 17 ubirmvol /dev/ubi0 -N kernel ubirmvol /dev/ubi0 -N rootfs ubirmvol /dev/ubi0 -N rootfs_data ubimkvol /dev/ubi0 -N kernel -s $kernel_length ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0 ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1 Option 2 - from within OpenWrt ------------------------------ This option requires to flash an initramfs version first so that access to the flash is possible. This can be achieved by sysupgrading to the recovery.bin version and rebooting. Once rebooted, you are again in a default OpenWrt installation, but no partition is mounted. Follow the commands from Option 1 to flash back to stock. LTE Modem ========= The LTE modem is similar to other ZTE devices and controls some more LEDs and battery management. Configuring the connection using uqmi works properly, the modem provides three serial ports and a QMI CDC ethernet interface. Other Notes =========== Contrary to the stock firmware, the USB port on the back can be used. There is one GPIO Switch "Power button blocker" which, if enabled, does not trigger a reset of the SoC if the modem reboots. If disabled, the SoC is rebooted along with the modem. The modem can be rebooted via the exported GPIO "modem-reset" in /sys/class/gpio. Signed-off-by: Andreas Böhler <dev@aboehler.at> (cherry picked from commit edfe91372adfdaf5ee4e294fb0f5860a16adc551)
2023-07-10 09:55:30 +00:00
zte,mf287pro |\
ipq40xx: Add ZTE MF289F It's a 4G Cat.20 router used by Vodafone Italy (called Vodafone FWA) and Vodafone DE\T-Mobile PL (called GigaCube). Modem is a MiniPCIe-to-USB based on Snapdragon X24, it supports 4CA aggregation. There are currently two hardware revisions, which differ on the 5Ghz radio: AT1 = QCA9984 5Ghz Radio on PCI-E bus AT2 = IPQ4019 5Ghz Radio inside IPQ4019 like 2.4Ghz Device specification -------------------- SoC Type: Qualcomm IPQ4019 RAM: 256 MiB Flash: 128 MiB SPI NAND (Winbond W25N01GV) ROM: 2MiB SPI Flash (GD25Q16) Wireless 2.4 GHz (IP4019): b/g/n, 2x2 Wireless 5 GHz: (QCA9984): a/n/ac, 4x4 HW REV AT1 (IPA4019): a/n/ac, 2x2 HW REV AT2 Ethernet: 2xGbE (WAN/LAN1, LAN2) USB ports: No Button: 2 (Reset/WPS) LEDs: 3 external leds: Network (white or red), Wifi, Power and 1 internal (blue) Power: 12 VDC, 1 A Connector type: Barrel Bootloader: U-Boot Installation ------------ 1. Place OpenWrt initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.0.2 2. Connect serial console (115200,8n1) to serial connector GND (which is right next to the thing with MF289F MIMO-V1.0), RX, TX (refer to this image: https://ibb.co/31Gngpr). 3. Connect TFTP server to RJ-45 port (WAN/LAN1). 4. Stop in u-Boot (using ESC button) and run u-Boot commands: setenv serverip 192.168.0.2 setenv ipaddr 192.168.0.1 set fdt_high 0x85000000 tftp openwrt-ipq40xx-generic-zte_mf289f-initramfs-fit-zImage.itb bootm $loadaddr 5. Please make backup of original partitions, if you think about revert to stock, specially mtd16 (Web UI) and mtd17 (rootFS). Use /tmp as temporary storage and do: WEB PARITION -------------------------------------- cat /dev/mtd16 > /tmp/mtd16.bin scp /tmp/mtd16.bin root@YOURSERVERIP:/ rm /tmp/mtd16.bin ROOT PARITION -------------------------------------- cat /dev/mtd17 > /tmp/mtd17.bin scp /tmp/mtd17.bin root@YOURSERVERIP:/ rm /tmp/mtd17.bin 6. Login via ssh or serial and remove stock partitions (default IP 192.168.0.1): # this can return an error, if ubi was attached before # or rootfs part was erased before. ubiattach -m 17 # it could return error if rootfs part was erased before ubirmvol /dev/ubi0 -N ubi_rootfs # some devices doesn't have it ubirmvol /dev/ubi0 -N ubi_rootfs_data 7. download and install image via sysupgrade -n (either use wget/scp to copy the mf289f's squashfs-sysupgrade.bin to the device's /tmp directory) sysupgrade -n /tmp/openwrt-...-zte_mf289f-squashfs-sysupgrade.bin Sometimes it could print ubi attach error, but please ignore it if process goes forward. Flash Layout NAND: mtd8: 000a0000 00020000 "fota-flag" mtd9: 00080000 00020000 "0:ART" mtd10: 00080000 00020000 "mac" mtd11: 000c0000 00020000 "reserved2" mtd12: 00400000 00020000 "cfg-param" mtd13: 00400000 00020000 "log" mtd14: 000a0000 00020000 "oops" mtd15: 00500000 00020000 "reserved3" mtd16: 00800000 00020000 "web" mtd17: 01d00000 00020000 "rootfs" mtd18: 01900000 00020000 "data" mtd19: 03200000 00020000 "fota" mtd20: 0041e000 0001f000 "kernel" mtd21: 0101b000 0001f000 "ubi_rootfs" SPI: mtd0: 00040000 00010000 "0:SBL1" mtd1: 00020000 00010000 "0:MIBIB" mtd2: 00060000 00010000 "0:QSEE" mtd3: 00010000 00010000 "0:CDT" mtd4: 00010000 00010000 "0:DDRPARAMS" mtd5: 00010000 00010000 "0:APPSBLENV" mtd6: 000c0000 00010000 "0:APPSBL" mtd7: 00050000 00010000 "0:reserved1" Back to Stock (!!! need original dump taken from initramfs !!!) ------------- 1. Place mtd16.bin and mtd17.bin initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.0.2 2. Connect serial console (115200,8n1) to serial console connector (refer to the pin-out from above). 3. Connect TFTP server to RJ-45 port (WAN/LAN1). 4. rename mtd16.bin to web.img and mtd17.bin to root_uImage_s 5. Stop in u-Boot (using ESC button) and run u-Boot commands: This will erase RootFS+Web: nand erase 0x1000000 0x800000 nand erase 0x1800000 0x1D00000 This will restore RootFS: tftpboot 0x84000000 ${dir}root_uImage_s nand erase 0x1800000 0x1D00000 nand write $fileaddr 0x1800000 $filesize This will restore Web Interface: tftpboot 0x84000000 ${dir}web.img nand erase 0x1000000 0x800000 nand write $fileaddr 0x1000000 $filesize After first boot on stock firwmare, do a factory reset. Push reset button for 5 seconds so all parameters will be reverted to the one printed on label on bottom of the router Signed-off-by: Giammarco Marzano <stich86@gmail.com> Reviewed-by: Lech Perczak <lech.perczak@gmail.com> (Warning: commit message did not conform to UTF-8 - hopefully fixed?, added description of the pin-out if image goes down, reformatted commit message to be hopefully somewhat readable on git-web, redid some of the gpio-buttons & leds DT nodes, etc.) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-09-14 12:20:43 +00:00
zte,mf289f)
ipq40xx: Add support for Teltonika RUTX10 This patch adds support for the Teltonika RUTX10. This device is an industrial DIN-rail router with 4 ethernet ports, 2.4G/5G dualband WiFi, Bluetooth, a USB 2.0 port and two GPIOs. The RUTX series devices are very similiar so common parts of the DTS are kept in a DTSI file. They are based on the QCA AP-DK01.1-C1 dev board. See https://teltonika-networks.com/product/rutx10 for more info. Hardware: SoC: Qualcomm IPQ4018 RAM: 256MB DDR3 SPI Flash 1: XTX XT25F128B (16MB, NOR) SPI Flash 2: XTX XT26G02AWS (256MB, NAND) Ethernet: Built-in IPQ4018 (SoC, QCA8075), 4x 10/100/1000 ports WiFi 1: Qualcomm QCA4019 IEEE 802.11b/g/n Wifi 2: Qualcomm QCA4019 IEEE 802.11a/n/ac USB Hub: Genesys Logic GL852GT Bluetooth: Qualcomm CSR8510 (A10U) LED/GPIO controller: STM32F030 with custom firmware Buttons: Reset button Leds: Power (green, cannot be controlled) WiFi 2.4G activity (green) WiFi 5G activity (green) MACs Details verified with the stock firmware: eth0: Partition 0:CONFIG Offset: 0x0 eth1: = eth0 + 1 radio0 (2.4 GHz): = eth0 + 2 radio1 (5.0 GHz): = eth0 + 3 Label MAC address is from eth0. The LED/GPIO controller needs a separate kernel driver to function. The driver was extracted from the Teltonika GPL sources and can be found at following feed: https://github.com/0xFelix/teltonika-rutx-openwrt USB detection of the bluetooth interface is sometimes a bit flaky. When not detected power cycle the device. When the bluetooth interface was detected properly it can be used with bluez / bluetoothctl. Flash instructions via stock web interface (sysupgrade based): 1. Set PC to fixed ip address 192.168.1.100 2. Push reset button and power on the device 3. Open u-boot HTTP recovery at http://192.168.1.1 4. Upload latest stock firmware and wait until the device is rebooted 5. Open stock web interface at http://192.168.1.1 6. Set some password so the web interface is happy 7. Go to firmware upgrade settings 8. Choose openwrt-ipq40xx-generic-teltonika_rutx10-squashfs-nand-factory.ubi 9. Set 'Keep settings' to off 10. Click update, when warned that it is not a signed image proceed Return to stock firmware: 1. Set PC to fixed ip address 192.168.1.100 2. Push reset button and power on the device 3. Open u-boot HTTP recovery at http://192.168.1.1 4. Upload latest stock firmware and wait until the device is rebooted Note: The DTS expects OpenWrt to be running from the second rootfs partition. u-boot on these devices hot-patches the DTS so running from the first rootfs partition should also be possible. If you want to be save follow the instructions above. u-boot HTTP recovery restores the device so that when flashing OpenWrt from stock firmware it is flashed to the second rootfs partition and the DTS matches. Signed-off-by: Felix Matouschek <felix@matouschek.org>
2021-07-15 19:48:11 +00:00
CI_UBIPART="rootfs"
nand_do_upgrade "$1"
;;
ipq40xx: add support for the ZyXEL NBG6617 This patch adds support for ZyXEL NBG6617 Hardware highlights: SOC: IPQ4018 / QCA Dakota CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7 DRAM: 256 MiB DDR3L-1600/1866 Nanya NT5CC128M16IP-DI @ 537 MHz NOR: 32 MiB Macronix MX25L25635F ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN) USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC) WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2 WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2 INPUT: RESET Button, WIFI/Rfkill Togglebutton, WPS Button LEDS: Power, WAN, LAN 1-4, WLAN 2.4GHz, WLAN 5GHz, USB, WPS Serial: WARNING: The serial port needs a TTL/RS-232 3.3v level converter! The Serial setting is 115200-8-N-1. The 1x4 .1" header comes pre-soldered. Pinout: 1. 3v3 (Label printed on the PCB), 2. RX, 3. GND, 4. TX first install / debricking / restore stock: 0. Have a PC running a tftp-server @ 192.168.1.99/24 1. connect the PC to any LAN-Ports 2. put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file into the tftp-server root directory and rename it to just "ras.bin". 3. power-cycle the router and hold down the the WPS button (for 30sek) 4. Wait (for a long time - the serial console provides some progress reports. The u-boot says it best: "Please be patient". 5. Once the power LED starts to flashes slowly and the USB + WPS LEDs flashes fast at the same time. You have to reboot the device and it should then come right up. Installation via Web-UI: 0. Connect a PC to the powered-on router. It will assign your PC a IP-address via DHCP 1. Access the Web-UI at 192.168.1.1 (Default Passwort: 1234) 2. Go to the "Expert Mode" 3. Under "Maintenance", select "Firmware-Upgrade" 4. Upload the OpenWRT factory image 5. Wait for the Device to finish. It will reboot into OpenWRT without any additional actions needed. To open the ZyXEL NBG6617: 0. remove the four rubber feet glued on the backside 1. remove the four philips screws and pry open the top cover (by applying force between the plastic top housing from the backside/lan-port side) Access the real u-boot shell: ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02" When the device is starting up, the user can enter the the loader shell by simply pressing a key within the 3 seconds once the following string appears on the serial console: | Hit any key to stop autoboot: 3 The user is then dropped to a locked shell. |NBG6617> HELP |ATEN x[,y] set BootExtension Debug Flag (y=password) |ATSE x show the seed of password generator |ATSH dump manufacturer related data in ROM |ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations) |ATGO boot up whole system |ATUR x upgrade RAS image (filename) |NBG6617> In order to escape/unlock a password challenge has to be passed. Note: the value is dynamic! you have to calculate your own! First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env) to get the challange value/seed. |NBG6617> ATSE NBG6617 |012345678901 This seed/value can be converted to the password with the help of this bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors): - tool.sh - ror32() { echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) )) } v="0x$1" a="0x${v:2:6}" b=$(( $a + 0x10F0A563)) c=$(( 0x${v:12:14} & 7 )) p=$(( $(ror32 $b $c) ^ $a )) printf "ATEN 1,%X\n" $p - end of tool.sh - |# bash ./tool.sh 012345678901 | |ATEN 1,879C711 copy and paste the result into the shell to unlock zloader. |NBG6617> ATEN 1,0046B0017430 If the entered code was correct the shell will change to use the ATGU command to enter the real u-boot shell. |NBG6617> ATGU |NBG6617# Co-authored-by: David Bauer <mail@david-bauer.net> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: David Bauer <mail@david-bauer.net>
2018-06-21 12:24:59 +00:00
zyxel,nbg6617)
zyxel_do_upgrade "$1"
;;
*)
default_do_upgrade "$1"
;;
esac
}
ipq40xx: add support for GL.iNet GL-B2200 This patch adds supports for the GL-B2200 router. Specifications: - SOC: Qualcomm IPQ4019 ARM Quad-Core - RAM: 512 MiB - Flash: 16 MiB NOR - SPI0 - EMMC: 8GB EMMC - ETH: Qualcomm QCA8075 - WLAN1: Qualcomm Atheros QCA4019 2.4GHz 802.11b/g/n 2x2 - WLAN2: Qualcomm Atheros QCA4019 5GHz 802.11n/ac W2 2x2 - WLAN3: Qualcomm Atheros QCA9886 5GHz 802.11n/ac W2 2x2 - INPUT: Reset, WPS - LED: Power, Internet - UART1: On board pin header near to LED (3.3V, TX, RX, GND), 3.3V without pin - 115200 8N1 - UART2: On board with BLE module - SPI1: On board socket for Zigbee module Update firmware instructions: Please update the firmware via U-Boot web UI (by default at 192.168.1.1, following instructions found at https://docs.gl-inet.com/en/3/troubleshooting/debrick/). Normal sysupgrade, either via CLI or LuCI, is not possible from stock firmware. Please do use the *gl-b2200-squashfs-emmc.img file, gunzipping the produced *gl-b2200-squashfs-emmc.img.gz one first. What's working: - WiFi 2G, 5G - WPA2/WPA3 Not tested: - Bluetooth LE/Zigbee Credits goes to the original authors of this patch. V1->V2: - updates *arm-boot-add-dts-files.patch correctly (sorry, my mistake) - add uboot-envtools support V2->V3: - Li Zhang updated official patch to fix wrong MAC address on wlan0 (PCI) interface V3->V4: - wire up sysupgrade Signed-off-by: Li Zhang <li.zhang@gl-inet.com> [fix tab and trailing space, document what's working and what's not] Signed-off-by: TruongSinh Tran-Nguyen <i@truongsinh.pro> [rebase on top of master, address remaining comments] Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com> [remove redundant check in platform.sh] Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-12-01 15:18:17 +00:00
platform_copy_config() {
case "$(board_name)" in
ipq40xx: Add subtarget for Google WiFi (Gale) Google WiFi (codename: Gale) is an IPQ4019-based AP, with 2 Ethernet ports, 2x2 2.4+5GHz WiFi, 512 MB RAM, 4 GB eMMC, and a USB type C port. In its stock configuration, it runs a Chromium OS-based system, but you wouldn't know it, since you can only manage it via a "cloud" + mobile-app system. The "v2" label is coded into the bootloader, which prefers the "google,gale-v2" compatible string. I believe "v1" must have been pre-release hardware. Note: this is *not* the Google Nest WiFi, released in 2019. I include "factory.bin" support, where we generate a GPT-based disk image with 2 partitions -- a kernel partition (using the custom "Chrome OS kernel" GUID type) and a root filesystem partition. See below for flashing instructions. Sysupgrade is supported via recent emmc_do_upgrade() helper. This is a subtarget because it enables different features (FEATURES=boot-part rootfs-part) whose configurations don't make sense in the "generic" target, and because it builds in a few USB drivers, which are necessary for installation (installation is performed by booting from USB storage, and so these drivers cannot be built as modules, since we need to load modules from USB storage). Flashing instructions ===================== Documented here: https://openwrt.org/inbox/toh/google/google_wifi Note this requires booting from USB storage. Features ======== I've tested: * Ethernet, both WAN and LAN ports * eMMC * USB-C (hub, power-delivery, peripherals) * LED0 (R/G/B) * WiFi (limited testing) * SPI flash * Serial console: once in developer mode, console can be accessed via the USB-C port with SuzyQable, or other similar "Closed Case Debugging" tools: https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/master/docs/ccd.md#suzyq-suzyqable * Sysupgrade Not tested: * TPM Known not working: * Reboot: this requires some additional TrustZone / SCM configuration to disable Qualcomm's SDI. I have a proposal upstream, and based on IRC chats, this might be acceptable with additional DT logic: [RFC PATCH] firmware: qcom_scm: disable SDI at boot https://lore.kernel.org/linux-arm-msm/20200721080054.2803881-1-computersforpeace@gmail.com/ * SMP: enabling secondary CPUs doesn't currently work using the stock bootloader, as the qcom_scm driver assumes newer features than this TrustZone firmware has. I posted notes here: [RFC] qcom_scm: IPQ4019 firmware does not support atomic API? https://lore.kernel.org/linux-arm-msm/20200913201608.GA3162100@bDebian/ * There's a single external button, and a few useful internal GPIO switches. I haven't hooked them up. The first two are fixed with subsequent commits. Additional notes ================ Much of the DTS is pulled from the Chrome OS kernel 3.18 branch, which the manufacturer image uses. Note: the manufacturer bootloader knows how to patch in calibration data via the wifi{0,1} aliases in the DTB, so while these properties aren't present in the DTS, they are available at runtime: # ls -l /sys/firmware/devicetree/base/soc/wifi@a*/qcom,ath10k-pre-calibration-data -r--r--r-- 1 root root 12064 Jul 15 19:11 /sys/firmware/devicetree/base/soc/wifi@a000000/qcom,ath10k-pre-calibration-data -r--r--r-- 1 root root 12064 Jul 15 19:11 /sys/firmware/devicetree/base/soc/wifi@a800000/qcom,ath10k-pre-calibration-data Ethernet MAC addresses are similarly patched in via the ethernet{0,1} aliases. Signed-off-by: Brian Norris <computersforpeace@gmail.com> (updated 901 - x1pro moved in the process) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2020-05-25 21:50:20 +00:00
glinet,gl-b2200 |\
google,wifi)
ipq40xx: add support for GL.iNet GL-B2200 This patch adds supports for the GL-B2200 router. Specifications: - SOC: Qualcomm IPQ4019 ARM Quad-Core - RAM: 512 MiB - Flash: 16 MiB NOR - SPI0 - EMMC: 8GB EMMC - ETH: Qualcomm QCA8075 - WLAN1: Qualcomm Atheros QCA4019 2.4GHz 802.11b/g/n 2x2 - WLAN2: Qualcomm Atheros QCA4019 5GHz 802.11n/ac W2 2x2 - WLAN3: Qualcomm Atheros QCA9886 5GHz 802.11n/ac W2 2x2 - INPUT: Reset, WPS - LED: Power, Internet - UART1: On board pin header near to LED (3.3V, TX, RX, GND), 3.3V without pin - 115200 8N1 - UART2: On board with BLE module - SPI1: On board socket for Zigbee module Update firmware instructions: Please update the firmware via U-Boot web UI (by default at 192.168.1.1, following instructions found at https://docs.gl-inet.com/en/3/troubleshooting/debrick/). Normal sysupgrade, either via CLI or LuCI, is not possible from stock firmware. Please do use the *gl-b2200-squashfs-emmc.img file, gunzipping the produced *gl-b2200-squashfs-emmc.img.gz one first. What's working: - WiFi 2G, 5G - WPA2/WPA3 Not tested: - Bluetooth LE/Zigbee Credits goes to the original authors of this patch. V1->V2: - updates *arm-boot-add-dts-files.patch correctly (sorry, my mistake) - add uboot-envtools support V2->V3: - Li Zhang updated official patch to fix wrong MAC address on wlan0 (PCI) interface V3->V4: - wire up sysupgrade Signed-off-by: Li Zhang <li.zhang@gl-inet.com> [fix tab and trailing space, document what's working and what's not] Signed-off-by: TruongSinh Tran-Nguyen <i@truongsinh.pro> [rebase on top of master, address remaining comments] Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com> [remove redundant check in platform.sh] Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-12-01 15:18:17 +00:00
emmc_copy_config
;;
esac
return 0;
}