openwrt/package/boot/uboot-envtools/files/ipq40xx

64 lines
1.4 KiB
Plaintext
Raw Normal View History

#!/bin/sh
#
# Copyright (C) 2016 LEDE
#
[ -e /etc/config/ubootenv ] && exit 0
touch /etc/config/ubootenv
. /lib/uboot-envtools.sh
. /lib/functions.sh
board=$(board_name)
ubootenv_mtdinfo () {
UBOOTENV_PART=$(cat /proc/mtd | grep APPSBLENV)
mtd_dev=$(echo $UBOOTENV_PART | awk '{print $1}' | sed 's/:$//')
mtd_size=$(echo $UBOOTENV_PART | awk '{print "0x"$2}')
mtd_erase=$(echo $UBOOTENV_PART | awk '{print "0x"$3}')
nor_flash=$(find /sys/bus/spi/devices/*/mtd -name ${mtd_dev})
if [ -n "$nor_flash" ]; then
ubootenv_size=$mtd_size
else
# size is fixed to 0x40000 in u-boot
ubootenv_size=0x40000
fi
sectors=$(( $ubootenv_size / $mtd_erase ))
echo /dev/$mtd_dev 0x0 $ubootenv_size $mtd_erase $sectors
}
case "$board" in
alfa-network,ap120c-ac |\
ipq40xx: add support for devolo Magic 2 WiFi next SOC: IPQ4018 / QCA Dakota CPU: Quad-Core ARMv7 Processor rev 5 (v71) Cortex-A7 DRAM: 256 MiB NOR: 32 MiB ETH: Qualcomm Atheros QCA8075 (2 ports) PLC: MaxLinear G.hn 88LX5152 WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2 WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2 INPUT: RESET, WiFi, PLC Button LEDS: red/white home, white WiFi To modify a retail device to run OpenWRT firmware: 1) Setup a TFTP server on IP address 192.168.0.100 and copy the OpenWRT initramfs (initramfs-fit-uImage.itb) to the TFTP root as 'uploadfile'. 2) Power on the device while pressing the recessed reset button next to the Ethernet ports. This causes the bootloader to retrieve and start the initramfs. 3) Once the initramfs is booted, the device will come up with IP 192.168.1.1. You can then connect through SSH (allow some time for the first connection). 4) On the device shell, run 'fw_printenv' to show the U-boot environment. Backup this information since it contains device unique factory data. 5) Change the boot command to support booting OpenWRT: # fw_setenv bootcmd 'sf probe && sf read 0x84000000 0x180000 0x400000 && bootm' 6) Change directory to /tmp, download the sysupgrade (e.g. through wget) and install it with sysupgrade. The device will reboot into OpenWRT. Notice that there is currently no support for booting the G.hn chip. This requires userland software we lack the rights to share right now. Signed-off-by: Stefan Schake <stefan.schake@devolo.de>
2020-10-02 12:32:55 +00:00
devolo,magic-2-wifi-next |\
edgecore,ecw5211 |\
glinet,gl-b1300 |\
ipq40xx: add support for Luma Home WRTQ-329ACN Luma Home WRTQ-329ACN, also known as Luma WiFi System, is a dual-band wireless access point. Specification SoC: Qualcomm Atheros IPQ4018 RAM: 256 MB DDR3 Flash: 2 MB SPI NOR 128 MB SPI NAND WIFI: 2.4 GHz 2T2R integrated 5 GHz 2T2R integrated Ethernet: 2x 10/100/1000 Mbps QCA8075 USB: 1x 2.0 Bluetooth: 1x 4.0 CSR8510 A10, connected to USB bus LEDS: 16x multicolor LEDs ring, controlled by MSP430G2403 MCU Buttons: 1x GPIO controlled EEPROM: 16 Kbit, compatible with AT24C16 UART: row of 4 holes marked on PCB as J19, starting count from the side of J19 marking on PCB 1. GND, 2. RX, 3. TX, 4. 3.3V baud: 115200, parity: none, flow control: none The device supports OTA or USB flash drive updates, unfotunately they are signed. Until the signing key is known, the UART access is mandatory for installation. The difficult part is disassembling the casing, there are a lot of latches holding it together. Teardown Prepare three thin, but sturdy, prying tools. Place the device with back of it facing upwards. Start with the wall having a small notch. Insert first tool, until You'll feel resistance and keep it there. Repeat the procedure for neighbouring walls. With applying a pressure, one edge of the back cover should pop up. Now carefully slide one of the tools to free the rest of the latches. There's no need to solder pins to the UART holes, You can use hook clips, but wiring them outside the casing, will ease debuging and recovery if problems occur. Installation 1. Prepare TFTP server with OpenWrt initramfs image. 2. Connect to UART port (don't connect the voltage pin). 3. Connect to LAN port. 4. Power on the device, carefully observe the console output and when asked quickly enter the failsafe mode. 5. Invoke 'mount_root'. 6. After the overlayfs is mounted run: fw_setenv bootdelay 3 This will allow to access U-Boot shell. 7. Reboot the device and when prompted to stop autoboot, hit any key. 8. Adjust "ipaddr" and "serverip" addresses in U-Boot environment, use 'setenv' to do that, then run following commands: tftpboot 0x84000000 <openwrt_initramfs_image_name> bootm 0x84000000 and wait till OpenWrt boots. 9. In OpenWrt command line run following commands: fw_setenv openwrt "setenv mtdids nand1=spi_nand; setenv mtdparts mtdparts=spi_nand:-(ubi); ubi part ubi; ubi read 0x84000000 kernel; bootm 0x84000000" fw_setenv bootcmd "run openwrt" 10. Transfer OpenWrt sysupgrade image to /tmp directory and flash it with: ubirmvol /dev/ubi0 -N ubi_rootfs sysupgrade -v -n /tmp/<openwrt_sysupgrade_image_name> 11. After flashing, the access point will reboot to OpenWrt, then it's ready for configuration. Reverting to OEM firmware 1. Execute installation guide steps: 1, 2, 3, 7, 8. 2. In OpenWrt command line run following commands: ubirmvol /dev/ubi0 -N rootfs_data ubirmvol /dev/ubi0 -N rootfs ubirmvol /dev/ubi0 -N kernel ubirename /dev/ubi0 kernel1 kernel ubi_rootfs1 ubi_rootfs ubimkvol /dev/ubi0 -S 34 -N kernel1 ubimkvol /dev/ubi0 -S 320 -N ubi_rootfs1 ubimkvol /dev/ubi0 -S 264 -N rootfs_data fw_setenv bootcmd bootipq 3. Reboot. Known issues The LEDs ring doesn't have any dedicated driver or application to control it, the only available option atm is to manipulate it with 'i2cset' command. The default action after applying power to device is spinning blue light. This light will stay active at all time. To disable it install 'i2c-tools' with opkg and run: i2cset -y 2 0x48 3 1 0 0 i The light will stay off until next cold boot. Additional information After completing 5. step from installation guide, one can disable asking for root password on OEM firmware by running: sed -e 's/root:x:/root::/' -i /etc/passwd This is useful for investigating the OEM firmware. One can look at the communication between the stock firmware and the vendor's cloud servers or as a way of making a backup of both flash chips. The root password seems to be constant across all sold devices. This is output of 'led_ctl' from OEM firmware to illustrate possibilities of LEDs ring: Usage: led_ctl [status | upgrade | force_upgrade | version] led_ctl solid COLOR <brightness> led_ctl single COLOR INDEX <brightness 0 - 15> led_ctl spinning COLOR <period 1 - 16 (lower = faster)> led_ctl fill COLOR <period 1 - 16 (lower = faster)> ( default is 5 ) led_ctl flashing COLOR <on dur 1 - 128> <off dur 1 - 128> (default is 34) ( default is 34 ) led_ctl pulsing COLOR COLOR: red, green, blue, yellow, purple, cyan, white Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl> [squash "ipq-wifi: add BDFs for Luma Home WRTQ-329ACN" into commit, changed ubi volumes for easier integration, slightly reworded commit message, changed ubi volume layout to use standard names all around] Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2020-08-30 11:28:10 +00:00
luma,wrtq-329acn |\
ipq40xx: add support for OpenMesh A62 * QCA IPQ4019 * 256 MB of RAM * 32 MB of SPI NOR flash (s25fl256s1) - 2x 15 MB available; but one of the 15 MB regions is the recovery image * 2T2R 2.4 GHz - QCA4019 hw1.0 (SoC) - requires special BDF in QCA4019/hw1.0/board-2.bin with bus=ahb,bmi-chip-id=0,bmi-board-id=20,variant=OM-A62 * 2T2R 5 GHz (channel 36-64) - QCA9888 hw2.0 (PCI) - requires special BDF in QCA9888/hw2.0/board-2.bin bus=pci,bmi-chip-id=0,bmi-board-id=16,variant=OM-A62 * 2T2R 5 GHz (channel 100-165) - QCA4019 hw1.0 (SoC) - requires special BDF in QCA4019/hw1.0/board-2.bin with bus=ahb,bmi-chip-id=0,bmi-board-id=21,variant=OM-A62 * multi-color LED (controlled via red/green/blue GPIOs) * 1x button (reset; kmod-input-gpio-keys compatible) * external watchdog - triggered GPIO * 1x USB (xHCI) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 2x gigabit ethernet - phy@mdio3: + Label: Ethernet 1 + gmac0 (ethaddr) in original firmware + 802.3at POE+ - phy@mdio4: + Label: Ethernet 2 + gmac1 (eth1addr) in original firmware + 18-24V passive POE (mode B) * powered only via POE The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the factory image to the u-boot when the device boots up. The initramfs image can be started using setenv bootargs 'loglevel=8 earlycon=msm_serial_dm,0x78af000 console=ttyMSM0,115200 mtdparts=spi0.0:256k(0:SBL1),128k(0:MIBIB),384k(0:QSEE),64k(0:CDT),64k(0:DDRPARAMS),64k(0:APPSBLENV),512k(0:APPSBL),64k(0:ART),64k(0:custom),64k(0:KEYS),15552k(inactive),15552k(inactive2)' tftpboot 0x84000000 openwrt-ipq40xx-openmesh_a62-initramfs-fit-uImage.itb set fdt_high 0x85000000 bootm 0x84000000 Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
2017-08-09 11:52:07 +00:00
openmesh,a42 |\
openmesh,a62 |\
ipq40xx: add support for Plasma Cloud PA2200 Device specifications: * QCA IPQ4019 * 256 MB of RAM * 32 MB of SPI NOR flash (w25q256) - 2x 15 MB available; but one of the 15 MB regions is the recovery image * 2T2R 2.4 GHz - QCA4019 hw1.0 (SoC) - requires special BDF in QCA4019/hw1.0/board-2.bin with bus=ahb,bmi-chip-id=0,bmi-board-id=20,variant=PlasmaCloud-PA2200 * 2T2R 5 GHz (channel 36-64) - QCA9888 hw2.0 (PCI) - requires special BDF in QCA9888/hw2.0/board-2.bin bus=pci,bmi-chip-id=0,bmi-board-id=16,variant=PlasmaCloud-PA2200 * 2T2R 5 GHz (channel 100-165) - QCA4019 hw1.0 (SoC) - requires special BDF in QCA4019/hw1.0/board-2.bin with bus=ahb,bmi-chip-id=0,bmi-board-id=21,variant=PlasmaCloud-PA2200 * GPIO-LEDs for 2.4GHz, 5GHz-SoC and 5GHz-PCIE * GPIO-LEDs for power (orange) and status (blue) * 1x GPIO-button (reset) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 2x gigabit ethernet - phy@mdio3: + Label: Ethernet 1 + gmac0 (ethaddr) in original firmware + used as LAN interface - phy@mdio4: + Label: Ethernet 2 + gmac1 (eth1addr) in original firmware + 802.3at POE+ + used as WAN interface * 12V 2A DC Flashing instructions: The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the factory image to the u-boot when the device boots up. Signed-off-by: Marek Lindner <marek.lindner@kaiwoo.ai> [sven@narfation.org: prepare commit message, rebase, use all LEDs, switch to dualboot_datachk upgrade script, use eth1 as designated WAN interface] Signed-off-by: Sven Eckelmann <sven@narfation.org>
2018-12-14 15:46:53 +00:00
plasmacloud,pa1200 |\
plasmacloud,pa2200)
ubootenv_add_uci_config "/dev/mtd5" "0x0" "0x10000" "0x10000"
;;
buffalo,wtr-m2133hp)
ubootenv_add_uci_config "/dev/mtd8" "0x0" "0x40000" "0x20000"
;;
linksys,ea6350v3)
ubootenv_add_uci_config "/dev/mtd7" "0x0" "0x20000" "0x20000"
;;
linksys,ea8300 |\
linksys,mr8300)
ipq40xx: Add support for Linksys EA8300 (Dallas) The Linksys EA8300 is based on QCA4019 and QCA9888 and provides three, independent radios. NAND provides two, alternate kernel/firmware images with fail-over provided by the OEM U-Boot. Installation: "Factory" images may be installed directly through the OEM GUI. Hardware Highlights: * IPQ4019 at 717 MHz (4 CPUs) * 256 MB NAND (Winbond W29N02GV, 8-bit parallel) * 256 MB RAM * Three, fully-functional radios; `iw phy` reports (FCC/US, -CT): * 2.4 GHz radio at 30 dBm * 5 GHz radio on ch. 36-64 at 23 dBm * 5 GHz radio on ch. 100-144 at 23 dBm (DFS), 149-165 at 30 dBm #{ managed } <= 16, #{ AP, mesh point } <= 16, #{ IBSS } <= 1 * All two-stream, MCS 0-9 * 4x GigE LAN, 1x GigE Internet Ethernet jacks with port lights * USB3, single port on rear with LED * WPS and reset buttons * Four status lights on top * Serial pads internal (unpopulated) "Linksys Dallas WiFi AP router based on Qualcomm AP DK07.1-c1" Implementation Notes: The OEM flash layout is preserved at this time with 3 MB kernel and ~69 MB UBIFS for each firmware version. The sysdiag (1 MB) and syscfg (56 MB) partitions are untouched, available as read-only. Serial Connectivity: Serial connectivity is *not* required to flash. Serial may be accessed by opening the device and connecting a 3.3-V adapter using 115200, 8n1. U-Boot access is good, including the ability to load images over TFTP and either run or flash them. Looking at the top of the board, from the front of the unit, J3 can be found on the right edge of the board, near the rear | J3 | |-| | |O| | (3.3V seen, open-circuit) |O| | TXD |O| | RXD |O| | |O| | GND |-| | | Unimplemented: * serial1 "ttyQHS0" (serial0 works as console) * Bluetooth; Qualcomm CSR8811 (potentially conected to serial1) Other Notes: https://wikidevi.com/wiki/Linksys_EA8300 states FCC docs also cover the Linksys EA8250. According to the RF Test Report BT BR+EDR, "All models are identical except for the EA8300 supports 256QAM and the EA8250 disable 256QAM." Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
2019-04-10 15:34:28 +00:00
ubootenv_add_uci_config "/dev/mtd7" "0x0" "0x40000" "0x20000"
;;
ipq40xx: add support for the ZyXEL NBG6617 This patch adds support for ZyXEL NBG6617 Hardware highlights: SOC: IPQ4018 / QCA Dakota CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7 DRAM: 256 MiB DDR3L-1600/1866 Nanya NT5CC128M16IP-DI @ 537 MHz NOR: 32 MiB Macronix MX25L25635F ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN) USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC) WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2 WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2 INPUT: RESET Button, WIFI/Rfkill Togglebutton, WPS Button LEDS: Power, WAN, LAN 1-4, WLAN 2.4GHz, WLAN 5GHz, USB, WPS Serial: WARNING: The serial port needs a TTL/RS-232 3.3v level converter! The Serial setting is 115200-8-N-1. The 1x4 .1" header comes pre-soldered. Pinout: 1. 3v3 (Label printed on the PCB), 2. RX, 3. GND, 4. TX first install / debricking / restore stock: 0. Have a PC running a tftp-server @ 192.168.1.99/24 1. connect the PC to any LAN-Ports 2. put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file into the tftp-server root directory and rename it to just "ras.bin". 3. power-cycle the router and hold down the the WPS button (for 30sek) 4. Wait (for a long time - the serial console provides some progress reports. The u-boot says it best: "Please be patient". 5. Once the power LED starts to flashes slowly and the USB + WPS LEDs flashes fast at the same time. You have to reboot the device and it should then come right up. Installation via Web-UI: 0. Connect a PC to the powered-on router. It will assign your PC a IP-address via DHCP 1. Access the Web-UI at 192.168.1.1 (Default Passwort: 1234) 2. Go to the "Expert Mode" 3. Under "Maintenance", select "Firmware-Upgrade" 4. Upload the OpenWRT factory image 5. Wait for the Device to finish. It will reboot into OpenWRT without any additional actions needed. To open the ZyXEL NBG6617: 0. remove the four rubber feet glued on the backside 1. remove the four philips screws and pry open the top cover (by applying force between the plastic top housing from the backside/lan-port side) Access the real u-boot shell: ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02" When the device is starting up, the user can enter the the loader shell by simply pressing a key within the 3 seconds once the following string appears on the serial console: | Hit any key to stop autoboot: 3 The user is then dropped to a locked shell. |NBG6617> HELP |ATEN x[,y] set BootExtension Debug Flag (y=password) |ATSE x show the seed of password generator |ATSH dump manufacturer related data in ROM |ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations) |ATGO boot up whole system |ATUR x upgrade RAS image (filename) |NBG6617> In order to escape/unlock a password challenge has to be passed. Note: the value is dynamic! you have to calculate your own! First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env) to get the challange value/seed. |NBG6617> ATSE NBG6617 |012345678901 This seed/value can be converted to the password with the help of this bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors): - tool.sh - ror32() { echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) )) } v="0x$1" a="0x${v:2:6}" b=$(( $a + 0x10F0A563)) c=$(( 0x${v:12:14} & 7 )) p=$(( $(ror32 $b $c) ^ $a )) printf "ATEN 1,%X\n" $p - end of tool.sh - |# bash ./tool.sh 012345678901 | |ATEN 1,879C711 copy and paste the result into the shell to unlock zloader. |NBG6617> ATEN 1,0046B0017430 If the entered code was correct the shell will change to use the ATGU command to enter the real u-boot shell. |NBG6617> ATGU |NBG6617# Co-authored-by: David Bauer <mail@david-bauer.net> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: David Bauer <mail@david-bauer.net>
2018-06-21 12:24:59 +00:00
zyxel,nbg6617)
ubootenv_add_uci_config "/dev/mtd6" "0x0" "0x10000" "0x10000"
;;
esac
config_load ubootenv
config_foreach ubootenv_add_app_config ubootenv
exit 0