ath79: add support for Buffalo WZR-HP-AG300H
Buffalo WZR-HP-AG300H is a dual band router based on
Qualcom Atheros AR7161 rev 2
Specification:
- 680 MHz CPU (Qualcomm Atheros AR7161)
- 128 MiB RAM (2x Samsung K4H511638G-LCCC)
- 32 MiB Flash (2x Winbond 25Q128BVFG)
- WiFi 5 GHz a/n (Atheros AR9220)
- WiFi 2.4 GHz b/g/n (Atheros AR9223)
- 1000Base-T WAN (Atheros AR7161)
- 4x 1000Base-T Switch (Atheros AR8316)
- 1x USB 2.0
- 3 Buttons (AOSS/WPS, Reset, USB Eject)
- 2 Slide switches (Router (on/off/auto), Movie Engine (on/off))
- 9 LEDs (Power green, WLAN 2GHz green, WLAN 2GHz amber,
WLAN 5GHz green, WLAN 5GHz LED amber, Router green,
Diag red, Movie Engine blue, USB green)
It is already supported by the ar71xx target.
For more information on the device visit the wiki:
<https://openwrt.org/toh/buffalo/wzr-hp-ag300h>
Serial console:
- The UART Header is next to Movie Engine Switch.
- Pinout is RX - TX - GND - 3.3V (Square Pad is 3.3V)
- The Serial setting is 115200-8-N-1.
Installation of OpenWRT from vendor firmware:
- Connect to the Web-interface at http://192.168.11.1
- Go to “Administration” → “Firmware Upgrade”
- Upload the OpenWrt factory image
Tested:
- Ethernet (LAN, WAN)
- WiFi
- Installation
- via TFTP rescue
- via factory image
- on firmware v1.77 (28-05-2012)
- on pro firmware v24SP2 r30356 (26-03-2018)
- via sysupgrade from ar71xx
(wlan devices don't work because of new names)
- via sysupgrade from itself
- Buttons
- LEDS
- USB (Power control and device recognition)
Signed-off-by: Bernhard Frauendienst <openwrt@nospam.obeliks.de>
2018-08-18 16:28:02 +00:00
|
|
|
include ./common-buffalo.mk
|
2018-06-13 08:51:51 +00:00
|
|
|
include ./common-netgear.mk
|
2021-02-12 18:24:32 +00:00
|
|
|
include ./common-senao.mk
|
2019-06-25 08:32:58 +00:00
|
|
|
include ./common-tp-link.mk
|
2019-08-12 23:26:45 +00:00
|
|
|
include ./common-yuncore.mk
|
2021-12-25 08:19:52 +00:00
|
|
|
include ./common-ubnt.mk
|
2018-03-02 18:28:50 +00:00
|
|
|
|
2018-09-04 21:27:02 +00:00
|
|
|
DEVICE_VARS += ADDPATTERN_ID ADDPATTERN_VERSION
|
2018-12-29 09:22:32 +00:00
|
|
|
DEVICE_VARS += SEAMA_SIGNATURE SEAMA_MTDBLOCK
|
2021-01-01 21:48:52 +00:00
|
|
|
DEVICE_VARS += KERNEL_INITRAMFS_PREFIX DAP_SIGNATURE
|
2020-11-28 11:04:00 +00:00
|
|
|
DEVICE_VARS += EDIMAX_HEADER_MAGIC EDIMAX_HEADER_MODEL
|
ath79: add support for ZyXEL NWA1121-NI
Specifications:
* AR9342, 16 MiB Flash, 64 MiB RAM, 802.11n 2T2R, 2.4 GHz
* 1x Gigabit Ethernet (AR8035), 802.3af PoE
Installation:
* OEM Web UI is at 192.168.1.2
login as `admin` with password `1234`
* Flash factory-AABJ.bin
The string `AABJ` needs to be present within the file name of the uploaded
image to be accepted by the OEM Web-based updater, the factory image is
named accordingly to save the user from the hassle of manual renaming.
TFTP Recovery:
* Open the case, connect to TTL UART port (this is the official method
described by Zyxel, the reset button is useless during power-on)
* Extract factory image (.tar.bz2), serve `vmlinux_mi124_f1e.lzma.uImage`
and `mi124_f1e-jffs2` via tftp at 192.168.1.10
* Interrupt uboot countdown, execute commands
`run lk`
`run lf`
to flash the kernel / filesystem accordingly
MAC addresses as verified by OEM firmware:
use address source
LAN *:cc mib0 0x30 ('eth0mac'), art 0x1002 (label)
2g *:cd mib0 0x4b ('wifi0mac')
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2020-09-09 18:42:53 +00:00
|
|
|
DEVICE_VARS += OPENMESH_CE_TYPE ZYXEL_MODEL_STRING
|
2022-11-10 14:16:32 +00:00
|
|
|
DEVICE_VARS += SUPPORTED_TELTONIKA_DEVICES
|
2018-09-04 21:27:02 +00:00
|
|
|
|
2019-08-22 12:34:45 +00:00
|
|
|
define Build/addpattern
|
|
|
|
|
-$(STAGING_DIR_HOST)/bin/addpattern -B $(ADDPATTERN_ID) \
|
|
|
|
|
-v v$(ADDPATTERN_VERSION) -i $@ -o $@.new
|
|
|
|
|
-mv "$@.new" "$@"
|
|
|
|
|
endef
|
|
|
|
|
|
2020-02-02 16:09:50 +00:00
|
|
|
define Build/append-md5sum-bin
|
2021-05-09 20:28:15 +00:00
|
|
|
$(MKHASH) md5 $@ | sed 's/../\\\\x&/g' |\
|
2020-02-02 16:09:50 +00:00
|
|
|
xargs echo -ne >> $@
|
|
|
|
|
endef
|
|
|
|
|
|
2019-08-22 12:34:45 +00:00
|
|
|
define Build/cybertan-trx
|
|
|
|
|
@echo -n '' > $@-empty.bin
|
|
|
|
|
-$(STAGING_DIR_HOST)/bin/trx -o $@.new \
|
|
|
|
|
-f $(IMAGE_KERNEL) -F $@-empty.bin \
|
|
|
|
|
-x 32 -a 0x10000 -x -32 -f $@
|
|
|
|
|
-mv "$@.new" "$@"
|
|
|
|
|
-rm $@-empty.bin
|
|
|
|
|
endef
|
|
|
|
|
|
2020-12-07 02:01:38 +00:00
|
|
|
define Build/edimax-headers
|
|
|
|
|
$(eval edimax_magic=$(word 1,$(1)))
|
|
|
|
|
$(eval edimax_model=$(word 2,$(1)))
|
|
|
|
|
|
|
|
|
|
$(STAGING_DIR_HOST)/bin/edimax_fw_header -M $(edimax_magic) -m $(edimax_model)\
|
|
|
|
|
-v $(VERSION_DIST)$(firstword $(subst +, , $(firstword $(subst -, ,$(REVISION))))) \
|
|
|
|
|
-n "uImage" \
|
|
|
|
|
-i $(KDIR)/loader-$(DEVICE_NAME).uImage \
|
|
|
|
|
-o $@.uImage
|
|
|
|
|
$(STAGING_DIR_HOST)/bin/edimax_fw_header -M $(edimax_magic) -m $(edimax_model)\
|
|
|
|
|
-v $(VERSION_DIST)$(firstword $(subst +, , $(firstword $(subst -, ,$(REVISION))))) \
|
|
|
|
|
-n "rootfs" \
|
|
|
|
|
-i $@ \
|
|
|
|
|
-o $@.rootfs
|
|
|
|
|
cat $@.uImage $@.rootfs > $@
|
|
|
|
|
rm -rf $@.uImage $@.rootfs
|
|
|
|
|
endef
|
|
|
|
|
|
2020-05-13 15:37:31 +00:00
|
|
|
define Build/mkdapimg2
|
|
|
|
|
$(STAGING_DIR_HOST)/bin/mkdapimg2 \
|
|
|
|
|
-i $@ -o $@.new \
|
|
|
|
|
-s $(DAP_SIGNATURE) \
|
|
|
|
|
-v $(VERSION_DIST)-$(firstword $(subst +, , \
|
|
|
|
|
$(firstword $(subst -, ,$(REVISION))))) \
|
|
|
|
|
-r Default \
|
|
|
|
|
$(if $(1),-k $(1))
|
|
|
|
|
mv $@.new $@
|
|
|
|
|
endef
|
|
|
|
|
|
2019-07-25 09:59:56 +00:00
|
|
|
define Build/mkmylofw_16m
|
|
|
|
|
$(eval device_id=$(word 1,$(1)))
|
|
|
|
|
$(eval revision=$(word 2,$(1)))
|
|
|
|
|
|
|
|
|
|
# On WPJ344, WPJ531, and WPJ563, the default boot command tries 0x9f680000
|
|
|
|
|
# first and fails if the remains of the stock image are sill there
|
|
|
|
|
# - resulting in an infinite boot loop.
|
|
|
|
|
# The size parameter is grown to have that block deleted if the firmware
|
|
|
|
|
# isn't big enough by itself.
|
|
|
|
|
|
|
|
|
|
let \
|
|
|
|
|
size="$$(stat -c%s $@)" \
|
|
|
|
|
pad="$(subst k,* 1024,$(BLOCKSIZE))" \
|
|
|
|
|
pad="(pad - (size % pad)) % pad" \
|
|
|
|
|
newsize='size + pad' ; \
|
|
|
|
|
[ $$newsize -lt $$((0x660000)) ] && newsize=0x660000 ; \
|
|
|
|
|
$(STAGING_DIR_HOST)/bin/mkmylofw \
|
|
|
|
|
-B WPE72 -i 0x11f6:$(device_id):0x11f6:$(device_id) -r $(revision) \
|
|
|
|
|
-s 0x1000000 -p0x30000:$$newsize:al:0x80060000:"OpenWRT":$@ \
|
|
|
|
|
$@.new
|
|
|
|
|
@mv $@.new $@
|
|
|
|
|
endef
|
|
|
|
|
|
ath79: add support for D-Link DAP-2695-A1
Hardware:
* SoC: Qualcomm Atheros QCA9558
* RAM: 256MB
* Flash: 16MB SPI NOR
* Ethernet: 2x 10/100/1000 (1x 802.3at PoE-PD)
* WiFi 2.4GHz: Qualcomm Atheros QCA9558
* WiFi 5GHz: Qualcomm Ahteros QCA9880-2R4E
* LEDS: 1x 5GHz, 1x 2.4GHz, 1x LAN1(POE), 1x LAN2, 1x POWER
* Buttons: 1x RESET
* UART: 1x RJ45 RS-232 Console port
Installation via stock firmware:
* Install the factory image via the stock firmware web interface
Installation via bootloader Emergency Web Server:
* Connect your PC to the LAN1(PoE) port
* Configure your PC with IP address 192.168.0.90
* Open a serial console to the Console port (115200,8n1)
* Press "q" within 2s when "press 'q' to stop autoboot" appears
* Open http://192.168.0.50 in a browser
* Upload either the factory or the sysupgrade image
* Once you see "write image into flash...OK,dest addr=0x9f070000" you
can power-cycle the device. Ignore "checksum bad" messages.
Setting the MAC addresses for the ethernet interfaces via
/etc/board.d/02_network adds the following snippets to
/etc/config/network:
config device 'lan_eth0_1_dev'
option name 'eth0.1'
option macaddr 'xx:xx:xx:xx:xx:xx'
config device 'wan_eth1_2_dev'
option name 'eth1.2'
option macaddr 'xx:xx:xx:xx:xx:xx'
This would result in the proper MAC addresses being set for the VLAN
subinterfaces, but the parent interfaces would still have a random MAC
address. Using untagged VLANs could solve this, but would still leave
those extra snippets in /etc/config/network, and then the device VLAN
setup would differ from the one used in ar71xx. Therefore, the MAC
addresses of the ethernet interfaces are being set via preinit instead.
The bdcfg partition contains 4 MAC address labels:
- lanmac
- wanmac
- wlanmac
- wlanmac_a
The first 3 all contain the same MAC address, which is also the one on
the label.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-06-07 23:11:34 +00:00
|
|
|
define Build/mkwrggimg
|
|
|
|
|
$(STAGING_DIR_HOST)/bin/mkwrggimg -b \
|
|
|
|
|
-i $@ -o $@.imghdr -d /dev/mtdblock/1 \
|
|
|
|
|
-m $(DEVICE_MODEL)-$(DEVICE_VARIANT) -s $(DAP_SIGNATURE) \
|
|
|
|
|
-v $(VERSION_DIST) -B $(REVISION)
|
|
|
|
|
mv $@.imghdr $@
|
|
|
|
|
endef
|
|
|
|
|
|
2019-03-16 04:27:32 +00:00
|
|
|
define Build/nec-enc
|
|
|
|
|
$(STAGING_DIR_HOST)/bin/nec-enc \
|
|
|
|
|
-i $@ -o $@.new -k $(1)
|
|
|
|
|
mv $@.new $@
|
|
|
|
|
endef
|
|
|
|
|
|
2018-12-08 06:18:17 +00:00
|
|
|
define Build/nec-fw
|
|
|
|
|
( stat -c%s $@ | tr -d "\n" | dd bs=16 count=1 conv=sync; ) >> $@
|
|
|
|
|
( \
|
|
|
|
|
echo -n -e "$(1)" | dd bs=16 count=1 conv=sync; \
|
|
|
|
|
echo -n "0.0.00" | dd bs=16 count=1 conv=sync; \
|
|
|
|
|
dd if=$@; \
|
|
|
|
|
) > $@.new
|
|
|
|
|
mv $@.new $@
|
|
|
|
|
endef
|
|
|
|
|
|
2019-08-04 14:13:45 +00:00
|
|
|
define Build/pisen_wmb001n-factory
|
|
|
|
|
-[ -f "$@" ] && \
|
|
|
|
|
mkdir -p "$@.tmp" && \
|
|
|
|
|
cp "$(KDIR)/loader-$(word 1,$(1)).uImage" "$@.tmp/uImage" && \
|
|
|
|
|
mv "$@" "$@.tmp/rootfs" && \
|
|
|
|
|
cp "bin/pisen_wmb001n_factory-header.bin" "$@" && \
|
|
|
|
|
$(TAR) -cp --numeric-owner --owner=0 --group=0 --mode=a-s --sort=name \
|
|
|
|
|
$(if $(SOURCE_DATE_EPOCH),--mtime="@$(SOURCE_DATE_EPOCH)") \
|
|
|
|
|
-C "$@.tmp" . | gzip -9n >> "$@" && \
|
|
|
|
|
rm -rf "$@.tmp"
|
|
|
|
|
endef
|
|
|
|
|
|
2020-02-02 16:09:50 +00:00
|
|
|
define Build/teltonika-fw-fake-checksum
|
|
|
|
|
# Teltonika U-Boot web based firmware upgrade/recovery routine compares
|
|
|
|
|
# 16 bytes from md5sum1[16] field in TP-Link v1 header (offset: 76 bytes
|
|
|
|
|
# from begin of the firmware file) with 16 bytes stored just before
|
|
|
|
|
# 0xdeadc0de marker. Values are only compared, MD5 sum is not verified.
|
|
|
|
|
let \
|
2021-06-21 21:27:56 +00:00
|
|
|
offs="$$(stat -c%s $@) - $(1)"; \
|
2020-02-02 16:09:50 +00:00
|
|
|
dd if=$@ bs=1 count=16 skip=76 |\
|
|
|
|
|
dd of=$@ bs=1 count=16 seek=$$offs conv=notrunc
|
|
|
|
|
endef
|
|
|
|
|
|
2021-06-21 21:27:56 +00:00
|
|
|
define Build/teltonika-v1-header
|
|
|
|
|
$(STAGING_DIR_HOST)/bin/mktplinkfw \
|
|
|
|
|
-c -H $(TPLINK_HWID) -W $(TPLINK_HWREV) -L $(KERNEL_LOADADDR) \
|
|
|
|
|
-E $(if $(KERNEL_ENTRY),$(KERNEL_ENTRY),$(KERNEL_LOADADDR)) \
|
|
|
|
|
-m $(TPLINK_HEADER_VERSION) -N "$(VERSION_DIST)" -V "RUT2xx " \
|
|
|
|
|
-k $@ -o $@.new $(1)
|
|
|
|
|
@mv $@.new $@
|
|
|
|
|
endef
|
|
|
|
|
|
2022-11-10 14:16:32 +00:00
|
|
|
metadata_json_teltonika = \
|
|
|
|
|
'{ $(if $(IMAGE_METADATA),$(IMAGE_METADATA)$(comma)) \
|
|
|
|
|
"metadata_version": "1.1", \
|
|
|
|
|
"compat_version": "$(call json_quote,$(compat_version))", \
|
|
|
|
|
"version":"$(call json_quote,$(VERSION_DIST))-$(call json_quote,$(VERSION_NUMBER))-$(call json_quote,$(REVISION))", \
|
|
|
|
|
"device_code": [".*"], \
|
|
|
|
|
"hwver": [".*"], \
|
|
|
|
|
"batch": [".*"], \
|
|
|
|
|
"serial": [".*"], \
|
|
|
|
|
$(if $(DEVICE_COMPAT_MESSAGE),"compat_message": "$(call json_quote,$(DEVICE_COMPAT_MESSAGE))"$(comma)) \
|
|
|
|
|
$(if $(filter-out 1.0,$(compat_version)),"new_supported_devices": \
|
|
|
|
|
[$(call metadata_devices,$(SUPPORTED_TELTONIKA_DEVICES))]$(comma) \
|
|
|
|
|
"supported_devices": ["$(call json_quote,$(legacy_supported_message))"]$(comma)) \
|
|
|
|
|
$(if $(filter 1.0,$(compat_version)),"supported_devices":[$(call metadata_devices,$(SUPPORTED_TELTONIKA_DEVICES))]$(comma)) \
|
|
|
|
|
"version_wrt": { \
|
|
|
|
|
"dist": "$(call json_quote,$(VERSION_DIST))", \
|
|
|
|
|
"version": "$(call json_quote,$(VERSION_NUMBER))", \
|
|
|
|
|
"revision": "$(call json_quote,$(REVISION))", \
|
|
|
|
|
"target": "$(call json_quote,$(TARGETID))", \
|
|
|
|
|
"board": "$(call json_quote,$(if $(BOARD_NAME),$(BOARD_NAME),$(DEVICE_NAME)))" \
|
|
|
|
|
}, \
|
|
|
|
|
"hw_support": {}, \
|
|
|
|
|
"hw_mods": {} \
|
|
|
|
|
}'
|
|
|
|
|
|
|
|
|
|
define Build/append-metadata-teltonika
|
|
|
|
|
echo $(call metadata_json_teltonika) | fwtool -I - $@
|
|
|
|
|
endef
|
|
|
|
|
|
ath79: add support for D-Link DAP-2695-A1
Hardware:
* SoC: Qualcomm Atheros QCA9558
* RAM: 256MB
* Flash: 16MB SPI NOR
* Ethernet: 2x 10/100/1000 (1x 802.3at PoE-PD)
* WiFi 2.4GHz: Qualcomm Atheros QCA9558
* WiFi 5GHz: Qualcomm Ahteros QCA9880-2R4E
* LEDS: 1x 5GHz, 1x 2.4GHz, 1x LAN1(POE), 1x LAN2, 1x POWER
* Buttons: 1x RESET
* UART: 1x RJ45 RS-232 Console port
Installation via stock firmware:
* Install the factory image via the stock firmware web interface
Installation via bootloader Emergency Web Server:
* Connect your PC to the LAN1(PoE) port
* Configure your PC with IP address 192.168.0.90
* Open a serial console to the Console port (115200,8n1)
* Press "q" within 2s when "press 'q' to stop autoboot" appears
* Open http://192.168.0.50 in a browser
* Upload either the factory or the sysupgrade image
* Once you see "write image into flash...OK,dest addr=0x9f070000" you
can power-cycle the device. Ignore "checksum bad" messages.
Setting the MAC addresses for the ethernet interfaces via
/etc/board.d/02_network adds the following snippets to
/etc/config/network:
config device 'lan_eth0_1_dev'
option name 'eth0.1'
option macaddr 'xx:xx:xx:xx:xx:xx'
config device 'wan_eth1_2_dev'
option name 'eth1.2'
option macaddr 'xx:xx:xx:xx:xx:xx'
This would result in the proper MAC addresses being set for the VLAN
subinterfaces, but the parent interfaces would still have a random MAC
address. Using untagged VLANs could solve this, but would still leave
those extra snippets in /etc/config/network, and then the device VLAN
setup would differ from the one used in ar71xx. Therefore, the MAC
addresses of the ethernet interfaces are being set via preinit instead.
The bdcfg partition contains 4 MAC address labels:
- lanmac
- wanmac
- wlanmac
- wlanmac_a
The first 3 all contain the same MAC address, which is also the one on
the label.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-06-07 23:11:34 +00:00
|
|
|
define Build/wrgg-pad-rootfs
|
|
|
|
|
$(STAGING_DIR_HOST)/bin/padjffs2 $(IMAGE_ROOTFS) -c 64 >>$@
|
|
|
|
|
endef
|
|
|
|
|
|
ath79: add support for ZyXEL NWA1121-NI
Specifications:
* AR9342, 16 MiB Flash, 64 MiB RAM, 802.11n 2T2R, 2.4 GHz
* 1x Gigabit Ethernet (AR8035), 802.3af PoE
Installation:
* OEM Web UI is at 192.168.1.2
login as `admin` with password `1234`
* Flash factory-AABJ.bin
The string `AABJ` needs to be present within the file name of the uploaded
image to be accepted by the OEM Web-based updater, the factory image is
named accordingly to save the user from the hassle of manual renaming.
TFTP Recovery:
* Open the case, connect to TTL UART port (this is the official method
described by Zyxel, the reset button is useless during power-on)
* Extract factory image (.tar.bz2), serve `vmlinux_mi124_f1e.lzma.uImage`
and `mi124_f1e-jffs2` via tftp at 192.168.1.10
* Interrupt uboot countdown, execute commands
`run lk`
`run lf`
to flash the kernel / filesystem accordingly
MAC addresses as verified by OEM firmware:
use address source
LAN *:cc mib0 0x30 ('eth0mac'), art 0x1002 (label)
2g *:cd mib0 0x4b ('wifi0mac')
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2020-09-09 18:42:53 +00:00
|
|
|
define Build/zyxel-tar-bz2
|
|
|
|
|
mkdir -p $@.tmp
|
|
|
|
|
mv $@ $@.tmp/$(word 2,$(1))
|
|
|
|
|
cp $(KDIR)/loader-$(DEVICE_NAME).uImage $@.tmp/$(word 1,$(1)).lzma.uImage
|
|
|
|
|
$(TAR) -cjf $@ -C $@.tmp .
|
|
|
|
|
rm -rf $@.tmp
|
|
|
|
|
endef
|
2020-09-25 18:04:54 +00:00
|
|
|
|
2018-12-29 09:22:32 +00:00
|
|
|
define Device/seama
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | relocate-kernel | lzma
|
|
|
|
|
KERNEL_INITRAMFS := $$(KERNEL) | seama
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
SEAMA_MTDBLOCK := 1
|
|
|
|
|
|
|
|
|
|
# 64 bytes offset:
|
|
|
|
|
# - 28 bytes seama_header
|
|
|
|
|
# - 36 bytes of META data (4-bytes aligned)
|
|
|
|
|
IMAGE/default := append-kernel | pad-offset $$$$(BLOCKSIZE) 64 | append-rootfs
|
2019-12-19 19:42:19 +00:00
|
|
|
IMAGE/sysupgrade.bin := $$(IMAGE/default) | seama | pad-rootfs | \
|
2021-06-20 16:54:36 +00:00
|
|
|
check-size | append-metadata
|
2019-12-19 19:42:19 +00:00
|
|
|
IMAGE/factory.bin := $$(IMAGE/default) | pad-rootfs -x 64 | seama | \
|
2020-03-10 13:58:27 +00:00
|
|
|
seama-seal | check-size
|
2018-12-29 09:22:32 +00:00
|
|
|
SEAMA_SIGNATURE :=
|
|
|
|
|
endef
|
|
|
|
|
|
2019-08-22 12:34:45 +00:00
|
|
|
|
2019-04-11 16:31:23 +00:00
|
|
|
define Device/8dev_carambola2
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9331
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := 8devices
|
|
|
|
|
DEVICE_MODEL := Carambola2
|
2020-09-18 11:56:53 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2
|
2019-04-11 16:31:23 +00:00
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
SUPPORTED_DEVICES += carambola2
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += 8dev_carambola2
|
|
|
|
|
|
2020-07-08 10:51:34 +00:00
|
|
|
define Device/8dev_lima
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := 8devices
|
|
|
|
|
DEVICE_MODEL := Lima
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
|
|
|
|
IMAGE_SIZE := 15616k
|
|
|
|
|
SUPPORTED_DEVICES += lima
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += 8dev_lima
|
|
|
|
|
|
ath79: add support for Bluesocket BSAP1880 board
This board was used in dual-band 802.11n enterprise access points, models
BSAP-1800v2 and BSAP-1840, introduced in 2010 by Bluesocket, which was
acquired by Adtran in 2011, who has now EOL'ed them. They differed only in
that the BSAP-1840's antennae were detachable, while the BSAP-1800v2's were
inside the case. They have an external RJ-45 console port, which works with
standard Cisco 72-3383-01 console cables.
Specification:
- System-On-Chip: AR7161
- CPU/Speed: 600 MHz
- Flash-Chip: Macronix MX25L12845E
- Flash size: 16 MiB
- RAM: 64 MiB
- Wireless No1: Lite-On WN2601A card: AR9160/AR9103 2.4GHz 802.11bgn
- Wireless No2: Lite-On WN2502A card: AR9160/AR9106 5GHz 802.11an
- PHY: Vitesse VSC8601, Rev. B
Installation:
1. Connect to the serial console using a terminal that supports YMODEM at
115200 bps, 8 data bits, no parity, 1 stop bit
2. Interrupt the bootloader using its password, which is: r00t
3. Issue the "fis init" command, confirming if prompted
4. Look at the length of the openwrt-ath79-generic-*-squashfs-kernel.bin
file, and substitute it below, instead of where I have "LeNgTh"
5. Issue the following command, and upload this file using YMODEM protocol
load -r -v -b 0x80060000 -m ymodem
6. Issue the following commands, substituting as mentioned above:
fis create -b 0x80060000 -l LeNgTh vmlinux_2
load -r -v -b 0x80100000 -m ymodem
7. Using YMODEM, upload openwrt-ath79-generic-*-squashfs-rootfs.bin
8. Issue the "fis free" command, and for the first range in its response,
use a hexadecimal calculator to subtract the start from the end in order
to substitute it below, with the leading "0x" to specify it in
hexadecimal, instead of where I have "LeNgTh"
9. Issue the following commands, substituting as mentioned above:
fis create -b 0x80100000 -l LeNgTh -e 0 -r 0 rootfs
reset
10.Wait for the status LED to go solid green
Tested-by: Brian Gonyer <bgonyer@gmail.com>
Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
[fixed obsolete $ARGV in platform_do_upgrade]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2018-09-01 02:28:35 +00:00
|
|
|
define Device/adtran_bsap1880
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar7161
|
ath79: add support for Bluesocket BSAP1880 board
This board was used in dual-band 802.11n enterprise access points, models
BSAP-1800v2 and BSAP-1840, introduced in 2010 by Bluesocket, which was
acquired by Adtran in 2011, who has now EOL'ed them. They differed only in
that the BSAP-1840's antennae were detachable, while the BSAP-1800v2's were
inside the case. They have an external RJ-45 console port, which works with
standard Cisco 72-3383-01 console cables.
Specification:
- System-On-Chip: AR7161
- CPU/Speed: 600 MHz
- Flash-Chip: Macronix MX25L12845E
- Flash size: 16 MiB
- RAM: 64 MiB
- Wireless No1: Lite-On WN2601A card: AR9160/AR9103 2.4GHz 802.11bgn
- Wireless No2: Lite-On WN2502A card: AR9160/AR9106 5GHz 802.11an
- PHY: Vitesse VSC8601, Rev. B
Installation:
1. Connect to the serial console using a terminal that supports YMODEM at
115200 bps, 8 data bits, no parity, 1 stop bit
2. Interrupt the bootloader using its password, which is: r00t
3. Issue the "fis init" command, confirming if prompted
4. Look at the length of the openwrt-ath79-generic-*-squashfs-kernel.bin
file, and substitute it below, instead of where I have "LeNgTh"
5. Issue the following command, and upload this file using YMODEM protocol
load -r -v -b 0x80060000 -m ymodem
6. Issue the following commands, substituting as mentioned above:
fis create -b 0x80060000 -l LeNgTh vmlinux_2
load -r -v -b 0x80100000 -m ymodem
7. Using YMODEM, upload openwrt-ath79-generic-*-squashfs-rootfs.bin
8. Issue the "fis free" command, and for the first range in its response,
use a hexadecimal calculator to subtract the start from the end in order
to substitute it below, with the leading "0x" to specify it in
hexadecimal, instead of where I have "LeNgTh"
9. Issue the following commands, substituting as mentioned above:
fis create -b 0x80100000 -l LeNgTh -e 0 -r 0 rootfs
reset
10.Wait for the status LED to go solid green
Tested-by: Brian Gonyer <bgonyer@gmail.com>
Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
[fixed obsolete $ARGV in platform_do_upgrade]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2018-09-01 02:28:35 +00:00
|
|
|
DEVICE_VENDOR := Adtran/Bluesocket
|
|
|
|
|
DEVICE_PACKAGES += -swconfig -uboot-envtools fconfig
|
2019-09-17 14:21:51 +00:00
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | pad-to $$(BLOCKSIZE)
|
ath79: add support for Bluesocket BSAP1880 board
This board was used in dual-band 802.11n enterprise access points, models
BSAP-1800v2 and BSAP-1840, introduced in 2010 by Bluesocket, which was
acquired by Adtran in 2011, who has now EOL'ed them. They differed only in
that the BSAP-1840's antennae were detachable, while the BSAP-1800v2's were
inside the case. They have an external RJ-45 console port, which works with
standard Cisco 72-3383-01 console cables.
Specification:
- System-On-Chip: AR7161
- CPU/Speed: 600 MHz
- Flash-Chip: Macronix MX25L12845E
- Flash size: 16 MiB
- RAM: 64 MiB
- Wireless No1: Lite-On WN2601A card: AR9160/AR9103 2.4GHz 802.11bgn
- Wireless No2: Lite-On WN2502A card: AR9160/AR9106 5GHz 802.11an
- PHY: Vitesse VSC8601, Rev. B
Installation:
1. Connect to the serial console using a terminal that supports YMODEM at
115200 bps, 8 data bits, no parity, 1 stop bit
2. Interrupt the bootloader using its password, which is: r00t
3. Issue the "fis init" command, confirming if prompted
4. Look at the length of the openwrt-ath79-generic-*-squashfs-kernel.bin
file, and substitute it below, instead of where I have "LeNgTh"
5. Issue the following command, and upload this file using YMODEM protocol
load -r -v -b 0x80060000 -m ymodem
6. Issue the following commands, substituting as mentioned above:
fis create -b 0x80060000 -l LeNgTh vmlinux_2
load -r -v -b 0x80100000 -m ymodem
7. Using YMODEM, upload openwrt-ath79-generic-*-squashfs-rootfs.bin
8. Issue the "fis free" command, and for the first range in its response,
use a hexadecimal calculator to subtract the start from the end in order
to substitute it below, with the leading "0x" to specify it in
hexadecimal, instead of where I have "LeNgTh"
9. Issue the following commands, substituting as mentioned above:
fis create -b 0x80100000 -l LeNgTh -e 0 -r 0 rootfs
reset
10.Wait for the status LED to go solid green
Tested-by: Brian Gonyer <bgonyer@gmail.com>
Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
[fixed obsolete $ARGV in platform_do_upgrade]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2018-09-01 02:28:35 +00:00
|
|
|
KERNEL_INITRAMFS := kernel-bin | append-dtb
|
|
|
|
|
IMAGE_SIZE := 11200k
|
|
|
|
|
IMAGES += kernel.bin rootfs.bin
|
2019-09-17 14:21:51 +00:00
|
|
|
IMAGE/kernel.bin := append-kernel
|
2022-06-07 13:58:30 +00:00
|
|
|
IMAGE/rootfs.bin := append-rootfs | pad-rootfs | pad-to $$(BLOCKSIZE)
|
2019-12-19 19:42:19 +00:00
|
|
|
IMAGE/sysupgrade.bin := append-rootfs | pad-rootfs | \
|
2020-03-10 13:58:27 +00:00
|
|
|
check-size | sysupgrade-tar rootfs=$$$$@ | append-metadata
|
ath79: add support for Bluesocket BSAP1880 board
This board was used in dual-band 802.11n enterprise access points, models
BSAP-1800v2 and BSAP-1840, introduced in 2010 by Bluesocket, which was
acquired by Adtran in 2011, who has now EOL'ed them. They differed only in
that the BSAP-1840's antennae were detachable, while the BSAP-1800v2's were
inside the case. They have an external RJ-45 console port, which works with
standard Cisco 72-3383-01 console cables.
Specification:
- System-On-Chip: AR7161
- CPU/Speed: 600 MHz
- Flash-Chip: Macronix MX25L12845E
- Flash size: 16 MiB
- RAM: 64 MiB
- Wireless No1: Lite-On WN2601A card: AR9160/AR9103 2.4GHz 802.11bgn
- Wireless No2: Lite-On WN2502A card: AR9160/AR9106 5GHz 802.11an
- PHY: Vitesse VSC8601, Rev. B
Installation:
1. Connect to the serial console using a terminal that supports YMODEM at
115200 bps, 8 data bits, no parity, 1 stop bit
2. Interrupt the bootloader using its password, which is: r00t
3. Issue the "fis init" command, confirming if prompted
4. Look at the length of the openwrt-ath79-generic-*-squashfs-kernel.bin
file, and substitute it below, instead of where I have "LeNgTh"
5. Issue the following command, and upload this file using YMODEM protocol
load -r -v -b 0x80060000 -m ymodem
6. Issue the following commands, substituting as mentioned above:
fis create -b 0x80060000 -l LeNgTh vmlinux_2
load -r -v -b 0x80100000 -m ymodem
7. Using YMODEM, upload openwrt-ath79-generic-*-squashfs-rootfs.bin
8. Issue the "fis free" command, and for the first range in its response,
use a hexadecimal calculator to subtract the start from the end in order
to substitute it below, with the leading "0x" to specify it in
hexadecimal, instead of where I have "LeNgTh"
9. Issue the following commands, substituting as mentioned above:
fis create -b 0x80100000 -l LeNgTh -e 0 -r 0 rootfs
reset
10.Wait for the status LED to go solid green
Tested-by: Brian Gonyer <bgonyer@gmail.com>
Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
[fixed obsolete $ARGV in platform_do_upgrade]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2018-09-01 02:28:35 +00:00
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/adtran_bsap1800-v2
|
|
|
|
|
$(Device/adtran_bsap1880)
|
|
|
|
|
DEVICE_MODEL := BSAP-1800
|
|
|
|
|
DEVICE_VARIANT := v2
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += adtran_bsap1800-v2
|
|
|
|
|
|
|
|
|
|
define Device/adtran_bsap1840
|
|
|
|
|
$(Device/adtran_bsap1880)
|
|
|
|
|
DEVICE_MODEL := BSAP-1840
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += adtran_bsap1840
|
|
|
|
|
|
ath79: add support for AirTight C-75
AirTight Networks (later renamed to Mojo Networks) C-75 is a dual-band
access point, also sold by WatchGuard under name AP320.
Specification
SoC: Qualcomm Atheros QCA9550
RAM: 128 MiB DDR2
Flash: 2x 16 MiB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
5 GHz 3T3R QCA9890 oversized Mini PCIe card
Ethernet: 2x 10/100/1000 Mbps QCA8334
port labeled LAN1 is PoE capable (802.3at)
USB: 1x 2.0
LEDs: 7x which two are GPIO controlled, four switch controlled, one
controlled by wireless driver
Buttons: 1x GPIO controlled
Serial: RJ-45 port, Cisco pinout
baud: 115200, parity: none, flow control: none
JTAG: Yes, pins marked J1 on PCB
Installation
1. Prepare TFTP server with OpenWrt initramfs-kernel image.
2. Connect to one of LAN ports.
3. Connect to serial port.
4. Power on the device and when prompted to stop autoboot, hit any key.
5. Adjust "ipaddr" and "serverip" addresses in U-Boot environment, use
'setenv' to do that, then run following commands:
tftpboot 0x81000000 <openwrt_initramfs-kernel_image_name>
bootm 0x81000000
6. Wait about 1 minute for OpenWrt to boot.
7. Transfer OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade -n /tmp/<openwrt_sysupgrade_image_name>
8. After flashing, the access point will reboot to OpenWrt. Wait few
minutes, until the Power LED stops blinking, then it's ready for
configuration.
Known issues
Green power LED does not work.
Additional information
The U-Boot fails to initialise ethernet ports correctly when a UART
adapter is attached to UART pins (marked J3 on PCB).
Cc: Vladimir Georgievsky <vladimir.georgievsky@yahoo.com>
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
2020-12-17 16:24:26 +00:00
|
|
|
define Device/airtight_c-75
|
|
|
|
|
SOC := qca9550
|
|
|
|
|
DEVICE_VENDOR := AirTight Networks
|
|
|
|
|
DEVICE_MODEL := C-75
|
|
|
|
|
DEVICE_ALT0_VENDOR := Mojo Networks
|
|
|
|
|
DEVICE_ALT0_MODEL := C-75
|
|
|
|
|
DEVICE_ALT1_VENDOR := WatchGuard
|
|
|
|
|
DEVICE_ALT1_MODEL := AP320
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct kmod-usb2
|
2020-12-17 16:24:27 +00:00
|
|
|
IMAGE_SIZE := 32320k
|
|
|
|
|
KERNEL_SIZE := 15936k
|
ath79: add support for AirTight C-75
AirTight Networks (later renamed to Mojo Networks) C-75 is a dual-band
access point, also sold by WatchGuard under name AP320.
Specification
SoC: Qualcomm Atheros QCA9550
RAM: 128 MiB DDR2
Flash: 2x 16 MiB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
5 GHz 3T3R QCA9890 oversized Mini PCIe card
Ethernet: 2x 10/100/1000 Mbps QCA8334
port labeled LAN1 is PoE capable (802.3at)
USB: 1x 2.0
LEDs: 7x which two are GPIO controlled, four switch controlled, one
controlled by wireless driver
Buttons: 1x GPIO controlled
Serial: RJ-45 port, Cisco pinout
baud: 115200, parity: none, flow control: none
JTAG: Yes, pins marked J1 on PCB
Installation
1. Prepare TFTP server with OpenWrt initramfs-kernel image.
2. Connect to one of LAN ports.
3. Connect to serial port.
4. Power on the device and when prompted to stop autoboot, hit any key.
5. Adjust "ipaddr" and "serverip" addresses in U-Boot environment, use
'setenv' to do that, then run following commands:
tftpboot 0x81000000 <openwrt_initramfs-kernel_image_name>
bootm 0x81000000
6. Wait about 1 minute for OpenWrt to boot.
7. Transfer OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade -n /tmp/<openwrt_sysupgrade_image_name>
8. After flashing, the access point will reboot to OpenWrt. Wait few
minutes, until the Power LED stops blinking, then it's ready for
configuration.
Known issues
Green power LED does not work.
Additional information
The U-Boot fails to initialise ethernet ports correctly when a UART
adapter is attached to UART pins (marked J3 on PCB).
Cc: Vladimir Georgievsky <vladimir.georgievsky@yahoo.com>
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
2020-12-17 16:24:26 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += airtight_c-75
|
|
|
|
|
|
2019-07-04 12:08:10 +00:00
|
|
|
define Device/alfa-network_ap121f
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9331
|
2019-07-04 12:08:10 +00:00
|
|
|
DEVICE_VENDOR := ALFA Network
|
|
|
|
|
DEVICE_MODEL := AP121F
|
2020-09-18 11:56:53 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2 kmod-usb-storage -swconfig
|
2019-07-04 12:08:10 +00:00
|
|
|
IMAGE_SIZE := 16064k
|
|
|
|
|
SUPPORTED_DEVICES += ap121f
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += alfa-network_ap121f
|
|
|
|
|
|
ath79: add support for ALFA Network AP121FE
The AP121FE is a slightly modified version of already supported AP121F
model (added to ar71xx in 0c6165d21a and to ath79 in 334bbc5198).
The differences in compare to AP121F:
- no micro SD card reader
- USB data lines are included in Type-A plug
- USB bus switched to device/peripheral mode (permanently, in bootstrap)
Other than that, specifications are the same:
- Atheros AR9331
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR1)
- 16 MB of flash (SPI NOR)
- 1x 10/100 Mbps Ethernet
- 1T1R 2.4 GHz Wi-Fi, up to 15 dBm
- 1x IPEX/U.FL connector, internal PCB antenna
- 3x LED, 1x button, 1x switch
- 4-pin UART header on PCB (2 mm pitch)
- USB 2.0 Type-A plug (power and data)
Flash instruction (under U-Boot web recovery mode):
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with RJ45 port, press the reset button, power up device,
wait for first blink of all LEDs (indicates network setup), then keep
button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-03-21 22:20:31 +00:00
|
|
|
define Device/alfa-network_ap121fe
|
|
|
|
|
SOC := ar9331
|
|
|
|
|
DEVICE_VENDOR := ALFA Network
|
|
|
|
|
DEVICE_MODEL := AP121FE
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2 kmod-usb-gadget-eth -swconfig
|
|
|
|
|
IMAGE_SIZE := 16064k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += alfa-network_ap121fe
|
|
|
|
|
|
2020-09-18 16:55:23 +00:00
|
|
|
define Device/alfa-network_n2q
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := ALFA Network
|
|
|
|
|
DEVICE_MODEL := N2Q
|
|
|
|
|
DEVICE_PACKAGES := kmod-i2c-gpio kmod-gpio-pcf857x kmod-usb2 \
|
|
|
|
|
kmod-usb-ledtrig-usbport rssileds
|
|
|
|
|
IMAGE_SIZE := 15872k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += alfa-network_n2q
|
|
|
|
|
|
ath79: add support for ALFA Network N5Q
ALFA Network N5Q is a successor of previous model, the N5 (outdoor
CPE/AP, based on Atheros AR7240 + AR9280). New version is based on
Atheros AR9344.
Support for this device was first introduced in 4b0eebe9df (ar71xx
target) but users are advised to migrate from ar71xx target without
preserving settings as ath79 support includes some changes in network
and LED default configuration. They were aligned with vendor firmware
and recently added N2Q model (both Ethernet ports as LAN, labelled as
LAN1 and LAN2).
Specifications:
- Atheros AR9344
- 550/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x 10/100 Mbps Ethernet, with passive PoE support (24 V)
- 2T2R 5 GHz Wi-Fi, with ext. PA (RFPA5542) and LNA, up to 27 dBm
- 2x IPEX/U.FL or MMCX antenna connectors (for PCBA version)
- 8x LED (7 are driven by GPIO)
- 1x button (reset)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- header for optional 802.3at/af PoE module
- DC jack for main power input (optional, not installed by default)
- UART (4-pin, 2.54 mm pitch) header on PCB
- LEDs (2x 5-pin, 2.54 mm pitch) header on PCB
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on OpenWrt/LEDE. Alternatively, you can use web recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
device, wait for first blink of all LEDs (indicates network setup),
then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-05-12 21:44:10 +00:00
|
|
|
define Device/alfa-network_n5q
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_VENDOR := ALFA Network
|
|
|
|
|
DEVICE_MODEL := N5Q
|
|
|
|
|
DEVICE_PACKAGES := rssileds
|
|
|
|
|
IMAGE_SIZE := 15872k
|
|
|
|
|
SUPPORTED_DEVICES += n5q
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += alfa-network_n5q
|
|
|
|
|
|
ath79: add support for ALFA Network Pi-WiFi4
ALFA Network Pi-WiFi4 is a Qualcomm QCA9531 v2 based, high-power 802.11n
WiFi board in Raspberry Pi 3B shape, equipped with 1x FE and 4x USB 2.0.
Specifications:
- Qualcomm/Atheros QCA9531 v2
- 650/400/200 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16+ MB of flash (SPI NOR)
- 1x 10/100 Mbps Ethernet
- 2T2R 2.4 GHz Wi-Fi with Qorvo RFFM8228P FEM
- 2x IPEX/U.FL connectors on PCB
- 4x USB 2.0 Type-A
- Genesys Logic GL850G 4-port USB HUB
- USB power is controlled by GPIO
- 5x LED (3x on PCB, 2x in RJ45, 4x driven by GPIO)
- 1x button (reset)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- 1x micro USB Type-B for power and system console (Holtek HT42B534)
- UART and GPIO (8-pin, 1.27 mm pitch) header on PCB
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on LEDE/OpenWrt. Alternatively, you can use web recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
device, wait for first blink of all LEDs (indicates network setup),
then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-10-09 05:30:24 +00:00
|
|
|
define Device/alfa-network_pi-wifi4
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := ALFA Network
|
|
|
|
|
DEVICE_MODEL := Pi-WiFi4
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport -swconfig
|
|
|
|
|
IMAGE_SIZE := 15872k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += alfa-network_pi-wifi4
|
|
|
|
|
|
ath79: add support for ALFA Network R36A
ALFA Network R36A is a successor of the previous model, the R36 (Ralink
RT3050F based). New version is based on Qualcomm/Atheros QCA9531 v2, FCC
ID: 2AB879531.
Support for this device was first introduced in af8f0629df (ar71xx
target). When updating from previous release (and/or ar71xx target),
user should only adjust the WAN LED trigger type (netdev in ar71xx,
switch port in ath79).
Specifications:
- Qualcomm/Atheros QCA9531 v2
- 650/400/200 MHz (CPU/DDR/AHB)
- 128 MB (R36AH/-U2) or 64 MB (R36A) of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x 10/100 Mbps Ethernet
- Passive PoE input support (12~36 V) in RJ45 near DC jack
- 2T2R 2.4 GHz Wi-Fi with Qorvo RFFM8228P FEM
- 2x IPEX/U.FL connectors on PCB
- 1x USB 2.0 Type-A
- 1x USB 2.0 mini Type-B in R36AH-U2 version
- USB power is controlled by GPIO
- 6/7x LED (5/6 of them are driven by GPIO)
- 2x button (reset, wifi/wps)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- DC jack with lock, for main power input (12 V)
- UART (4-pin, 2.54 mm pitch) header on PCB
Optional/additional features in R36A series (R36A was the first model):
- for R36AH: USB 2.0 hub*
- for R36AH-U2: USB 2.0 hub*, 1x USB 2.0 mini Type-B, one more LED
*) there are at least three different USB 2.0 hub in R36AH/-U2 variants:
- Terminus-Tech FE 1.1
- Genesys Logic GL852G
- Genesys Logic GL850G (used in latests revision)
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on LEDE/OpenWrt. Alternatively, you can use web recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
device, wait for first blink of all LEDs (indicates network setup),
then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-07-02 05:03:33 +00:00
|
|
|
define Device/alfa-network_r36a
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := ALFA Network
|
|
|
|
|
DEVICE_MODEL := R36A
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport
|
|
|
|
|
IMAGE_SIZE := 15872k
|
|
|
|
|
SUPPORTED_DEVICES += r36a
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += alfa-network_r36a
|
|
|
|
|
|
2022-02-17 22:22:25 +00:00
|
|
|
define Device/alfa-network_tube-2hq
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := ALFA Network
|
|
|
|
|
DEVICE_MODEL := Tube-2HQ
|
|
|
|
|
DEVICE_PACKAGES := rssileds -swconfig
|
|
|
|
|
IMAGE_SIZE := 15872k
|
|
|
|
|
SUPPORTED_DEVICES += tube-2hq
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += alfa-network_tube-2hq
|
|
|
|
|
|
ath79: add support for ALLNET ALL-WAP02860AC
ALLNET ALL-WAP02860AC is a dual-band wireless access point.
Specification
SoC: Qualcomm Atheros QCA9558
RAM: 128 MB DDR2
Flash: 16 MB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
5 GHz 3T3R QCA9880 Mini PCIe card
Ethernet: 1x 10/100/1000 Mbps AR8035-A, PoE capable (802.3at)
LEDS: 5x, which four are GPIO controlled
Buttons: 1x GPIO controlled
UART: 4 pin header near Mini PCIe card, starting count from white
triangle on PCB
1. VCC 3.3V, 2. GND, 3. TX, 4. RX
baud: 115200, parity: none, flow control: none
MAC addresses
Calibration data does not contain valid MAC addresses.
The calculated MAC addresses are chosen in accordance with OEM firmware.
Because of:
a) constrained environment (SNMP) when connecting through Telnet
or SSH,
b) hard-coded kernel and rootfs sizes,
c) checksum verification of kerenel and rootfs images in bootloder,
creating factory image accepted by OEM web interface is difficult,
therefore, to install OpenWrt on this device UART connection is needed.
The teardown is simple, unscrew four screws to disassemble the casing,
plus two screws to separate mainboard from the casing.
Before flashing, be sure to have a copy of factory firmware, in case You
wish to revert to original firmware.
Installation
1. Prepare TFTP server with OpenWrt initramfs-kernel image.
2. Connect to LAN port.
3. Connect to UART port.
4. Power on the device and when prompted to stop autoboot, hit any key.
5. Alter U-Boot environment with following commands:
setenv failsafe_boot bootm 0x9f0a0000
saveenv
6. Adjust "ipaddr" and "serverip" addresses in U-Boot environment, use
'setenv' to do that, then run following commands:
tftpboot 0x81000000 <openwrt_initramfs-kernel_image_name>
bootm 0x81000000
7. Wait about 1 minute for OpenWrt to boot.
8. Transfer OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade -n /tmp/<openwrt_sysupgrade_image_name>
9. After flashing, the access point will reboot to OpenWrt. Wait few
minutes, until the Power LED stops blinking, then it's ready for
configuration.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
[add MAC address comment to commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-08-14 16:03:40 +00:00
|
|
|
define Device/allnet_all-wap02860ac
|
2021-02-12 23:58:00 +00:00
|
|
|
$(Device/senao_loader_okli)
|
ath79: add support for ALLNET ALL-WAP02860AC
ALLNET ALL-WAP02860AC is a dual-band wireless access point.
Specification
SoC: Qualcomm Atheros QCA9558
RAM: 128 MB DDR2
Flash: 16 MB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
5 GHz 3T3R QCA9880 Mini PCIe card
Ethernet: 1x 10/100/1000 Mbps AR8035-A, PoE capable (802.3at)
LEDS: 5x, which four are GPIO controlled
Buttons: 1x GPIO controlled
UART: 4 pin header near Mini PCIe card, starting count from white
triangle on PCB
1. VCC 3.3V, 2. GND, 3. TX, 4. RX
baud: 115200, parity: none, flow control: none
MAC addresses
Calibration data does not contain valid MAC addresses.
The calculated MAC addresses are chosen in accordance with OEM firmware.
Because of:
a) constrained environment (SNMP) when connecting through Telnet
or SSH,
b) hard-coded kernel and rootfs sizes,
c) checksum verification of kerenel and rootfs images in bootloder,
creating factory image accepted by OEM web interface is difficult,
therefore, to install OpenWrt on this device UART connection is needed.
The teardown is simple, unscrew four screws to disassemble the casing,
plus two screws to separate mainboard from the casing.
Before flashing, be sure to have a copy of factory firmware, in case You
wish to revert to original firmware.
Installation
1. Prepare TFTP server with OpenWrt initramfs-kernel image.
2. Connect to LAN port.
3. Connect to UART port.
4. Power on the device and when prompted to stop autoboot, hit any key.
5. Alter U-Boot environment with following commands:
setenv failsafe_boot bootm 0x9f0a0000
saveenv
6. Adjust "ipaddr" and "serverip" addresses in U-Boot environment, use
'setenv' to do that, then run following commands:
tftpboot 0x81000000 <openwrt_initramfs-kernel_image_name>
bootm 0x81000000
7. Wait about 1 minute for OpenWrt to boot.
8. Transfer OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade -n /tmp/<openwrt_sysupgrade_image_name>
9. After flashing, the access point will reboot to OpenWrt. Wait few
minutes, until the Power LED stops blinking, then it's ready for
configuration.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
[add MAC address comment to commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-08-14 16:03:40 +00:00
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := ALLNET
|
|
|
|
|
DEVICE_MODEL := ALL-WAP02860AC
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
|
2021-02-12 23:58:00 +00:00
|
|
|
IMAGE_SIZE := 11584k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x220000
|
|
|
|
|
SENAO_IMGNAME := senao-allwap02860ac
|
ath79: add support for ALLNET ALL-WAP02860AC
ALLNET ALL-WAP02860AC is a dual-band wireless access point.
Specification
SoC: Qualcomm Atheros QCA9558
RAM: 128 MB DDR2
Flash: 16 MB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
5 GHz 3T3R QCA9880 Mini PCIe card
Ethernet: 1x 10/100/1000 Mbps AR8035-A, PoE capable (802.3at)
LEDS: 5x, which four are GPIO controlled
Buttons: 1x GPIO controlled
UART: 4 pin header near Mini PCIe card, starting count from white
triangle on PCB
1. VCC 3.3V, 2. GND, 3. TX, 4. RX
baud: 115200, parity: none, flow control: none
MAC addresses
Calibration data does not contain valid MAC addresses.
The calculated MAC addresses are chosen in accordance with OEM firmware.
Because of:
a) constrained environment (SNMP) when connecting through Telnet
or SSH,
b) hard-coded kernel and rootfs sizes,
c) checksum verification of kerenel and rootfs images in bootloder,
creating factory image accepted by OEM web interface is difficult,
therefore, to install OpenWrt on this device UART connection is needed.
The teardown is simple, unscrew four screws to disassemble the casing,
plus two screws to separate mainboard from the casing.
Before flashing, be sure to have a copy of factory firmware, in case You
wish to revert to original firmware.
Installation
1. Prepare TFTP server with OpenWrt initramfs-kernel image.
2. Connect to LAN port.
3. Connect to UART port.
4. Power on the device and when prompted to stop autoboot, hit any key.
5. Alter U-Boot environment with following commands:
setenv failsafe_boot bootm 0x9f0a0000
saveenv
6. Adjust "ipaddr" and "serverip" addresses in U-Boot environment, use
'setenv' to do that, then run following commands:
tftpboot 0x81000000 <openwrt_initramfs-kernel_image_name>
bootm 0x81000000
7. Wait about 1 minute for OpenWrt to boot.
8. Transfer OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade -n /tmp/<openwrt_sysupgrade_image_name>
9. After flashing, the access point will reboot to OpenWrt. Wait few
minutes, until the Power LED stops blinking, then it's ready for
configuration.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
[add MAC address comment to commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-08-14 16:03:40 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += allnet_all-wap02860ac
|
|
|
|
|
|
ath79: add support for Araknis AN-300-AP-I-N
FCC ID: U2M-AN300APIN
Araknis AN-300-AP-I-N is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
this board is a Senao device:
the hardware is equivalent to EnGenius EWS310AP
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails
**Specification:**
- AR9344 SOC MIPS 74kc, 2.4 GHz WMAC, 2x2
- AR9382 WLAN PCI on-board 168c:0030, 5 GHz, 2x2
- AR8035-A PHY RGMII GbE with PoE+ IN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM 1839ZFG V59C1512164QFJ25
- UART console J10, populated, RX shorted to ground
- 4 antennas 5 dBi, internal omni-directional plates
- 4 LEDs power, 2G, 5G, wps
- 1 button reset
NOTE: all 4 gpio controlled LEDS are viewed through the same lightguide
therefore, the power LED is off for default state
**MAC addresses:**
MAC address labeled as ETH
Only one Vendor MAC address in flash at art 0x0
eth0 ETH *:7d art 0x0
phy1 2.4G *:7e ---
phy0 5GHz *:7f ---
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin at J10
**Installation:**
Method 1: Firmware upgrade page:
(if you cannot access the APs webpage)
factory reset with the reset button
connect ethernet to a computer
OEM webpage at 192.168.20.253
username and password 'araknis'
make a new password, login again...
Navigate to 'File Management' page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm
wait about 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
192.168.20.253
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
Method 1: Serial to load Failsafe webpage (above)
Method 2: delete a checksum from uboot-env
this will make uboot load the failsafe image at next boot
because it will fail the checksum verification of the image
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait a minute
connect to ethernet and navigate to
192.168.20.253
select OEM firmware image and click upgrade
Method 3: backup mtd partitions before upgrade
**TFTP recovery:**
Requires serial console, reset button does nothing
rename initramfs-kernel.bin to '0101A8C0.img'
make available on TFTP server at 192.168.1.101
power board, interrupt boot with serial console
execute `tftpboot` and `bootm 0x81000000`
NOTE: TFTP may not be reliable due to bugged bootloader
set MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software is built using SDKs from Senao
which is based on a heavily modified version
of Openwrt Kamikaze or Altitude Adjustment.
One of the many modifications is sysupgrade being performed by a custom script.
Images are verified through successful unpackaging, correct filenames
and size requirements for both kernel and rootfs files, and that they
start with the correct magic numbers (first 2 bytes) for the respective headers.
Newer Senao software requires more checks but their script
includes a way to skip them.
The OEM upgrade script is at
/etc/fwupgrade.sh
OKLI kernel loader is required because the OEM software
expects the kernel to be less than 1536k
and the OEM upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied at the PHY side,
using the at803x driver `phy-mode` setting through the DTS.
Therefore, the Ethernet Configuration registers for GMAC0
do not need the bits for RGMII delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2021-03-26 06:12:26 +00:00
|
|
|
define Device/araknis_an-300-ap-i-n
|
|
|
|
|
$(Device/senao_loader_okli)
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_VENDOR := Araknis
|
|
|
|
|
DEVICE_MODEL := AN-300-AP-I-N
|
|
|
|
|
IMAGE_SIZE := 12096k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x220000
|
|
|
|
|
SENAO_IMGNAME := senao-an300
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += araknis_an-300-ap-i-n
|
|
|
|
|
|
ath79: add support for Araknis AN-500-AP-I-AC
FCC ID: 2AG6R-AN500APIAC
Araknis AN-500-AP-I-AC is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
this board is a Senao device:
the hardware is equivalent to EnGenius EAP1200
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails
**Specification:**
- QCA9557 SOC MIPS 74kc, 2.4 GHz WMAC, 2x2
- QCA9882 WLAN PCI card 168c:003c, 5 GHz, 2x2, 26dBm
- AR8035-A PHY RGMII GbE with PoE+ IN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16
- UART console J10, populated, RX shorted to ground
- 4 antennas 5 dBi, internal omni-directional plates
- 4 LEDs power, 2G, 5G, wps
- 1 button reset
NOTE: all 4 gpio controlled LEDS are viewed through the same lightguide
therefore, the power LED is off for default state
**MAC addresses:**
MAC address labeled as ETH
Only one Vendor MAC address in flash at art 0x0
eth0 ETH *:e1 art 0x0
phy1 2.4G *:e2 ---
phy0 5GHz *:e3 ---
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin at J10
**Installation:**
Method 1: Firmware upgrade page:
(if you cannot access the APs webpage)
factory reset with the reset button
connect ethernet to a computer
OEM webpage at 192.168.20.253
username and password 'araknis'
make a new password, login again...
Navigate to 'File Management' page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm
wait about 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
192.168.20.253
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
Method 1: Serial to load Failsafe webpage (above)
Method 2: delete a checksum from uboot-env
this will make uboot load the failsafe image at next boot
because it will fail the checksum verification of the image
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait a minute
connect to ethernet and navigate to
192.168.20.253
select OEM firmware image and click upgrade
Method 3: backup mtd partitions before upgrade
**TFTP recovery:**
Requires serial console, reset button does nothing
rename initramfs-kernel.bin to '0101A8C0.img'
make available on TFTP server at 192.168.1.101
power board, interrupt boot with serial console
execute `tftpboot` and `bootm 0x81000000`
NOTE: TFTP may not be reliable due to bugged bootloader
set MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software is built using SDKs from Senao
which is based on a heavily modified version
of Openwrt Kamikaze or Altitude Adjustment.
One of the many modifications is sysupgrade being performed by a custom script.
Images are verified through successful unpackaging, correct filenames
and size requirements for both kernel and rootfs files, and that they
start with the correct magic numbers (first 2 bytes) for the respective headers.
Newer Senao software requires more checks but their script
includes a way to skip them.
The OEM upgrade script is at
/etc/fwupgrade.sh
OKLI kernel loader is required because the OEM software
expects the kernel to be less than 1536k
and the OEM upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied at the PHY side,
using the at803x driver `phy-mode` setting through the DTS.
Therefore, the Ethernet Configuration registers for GMAC0
do not need the bits for RGMII delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2021-03-17 05:07:36 +00:00
|
|
|
define Device/araknis_an-500-ap-i-ac
|
|
|
|
|
$(Device/senao_loader_okli)
|
|
|
|
|
SOC := qca9557
|
|
|
|
|
DEVICE_VENDOR := Araknis
|
|
|
|
|
DEVICE_MODEL := AN-500-AP-I-AC
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
|
|
|
|
|
IMAGE_SIZE := 11584k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x220000
|
|
|
|
|
SENAO_IMGNAME := senao-generic-v1-an500
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += araknis_an-500-ap-i-ac
|
|
|
|
|
|
ath79: add support for Araknis AN-700-AP-I-AC
FCC ID: 2AG6R-AN700APIAC
Araknis AN-700-AP-I-AC is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
this board is a Senao device:
the hardware is equivalent to EnGenius EAP1750
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails
**Specification:**
- QCA9558 SOC MIPS 74kc, 2.4 GHz WMAC, 3x3
- QCA9880 WLAN PCI card, 5 GHz, 3x3, 26dBm
- AR8035-A PHY RGMII GbE with PoE+ IN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16
- UART console J10, populated, RX shorted to ground
- 4 antennas 5 dBi, internal omni-directional plates
- 4 LEDs power, 2G, 5G, wps
- 1 button reset
NOTE: all 4 gpio controlled LEDS are viewed through the same lightguide
therefore, the power LED is off for default state
**MAC addresses:**
MAC address labeled as ETH
Only one Vendor MAC address in flash at art 0x0
eth0 ETH *:xb art 0x0
phy1 2.4G *:xc ---
phy0 5GHz *:xd ---
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin at J10
**Installation:**
Method 1: Firmware upgrade page:
(if you cannot access the APs webpage)
factory reset with the reset button
connect ethernet to a computer
OEM webpage at 192.168.20.253
username and password 'araknis'
make a new password, login again...
Navigate to 'File Management' page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm
wait about 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
192.168.20.253
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
Method 1: Serial to load Failsafe webpage (above)
Method 2: delete a checksum from uboot-env
this will make uboot load the failsafe image at next boot
because it will fail the checksum verification of the image
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait a minute
connect to ethernet and navigate to
192.168.20.253
select OEM firmware image and click upgrade
Method 3: backup mtd partitions before upgrade
**TFTP recovery:**
Requires serial console, reset button does nothing
rename initramfs-kernel.bin to '0101A8C0.img'
make available on TFTP server at 192.168.1.101
power board, interrupt boot with serial console
execute `tftpboot` and `bootm 0x81000000`
NOTE: TFTP may not be reliable due to bugged bootloader
set MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software is built using SDKs from Senao
which is based on a heavily modified version
of Openwrt Kamikaze or Altitude Adjustment.
One of the many modifications is sysupgrade being performed by a custom script.
Images are verified through successful unpackaging, correct filenames
and size requirements for both kernel and rootfs files, and that they
start with the correct magic numbers (first 2 bytes) for the respective headers.
Newer Senao software requires more checks but their script
includes a way to skip them.
The OEM upgrade script is at
/etc/fwupgrade.sh
OKLI kernel loader is required because the OEM software
expects the kernel to be less than 1536k
and the OEM upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied at the PHY side,
using the at803x driver `phy-mode` setting through the DTS.
Therefore, the Ethernet Configuration registers for GMAC0
do not need the bits for RGMII delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2021-09-08 21:00:00 +00:00
|
|
|
define Device/araknis_an-700-ap-i-ac
|
|
|
|
|
$(Device/senao_loader_okli)
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := Araknis
|
|
|
|
|
DEVICE_MODEL := AN-700-AP-I-AC
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
|
|
|
|
|
IMAGE_SIZE := 11584k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x220000
|
|
|
|
|
SENAO_IMGNAME := senao-generic-v1-an700
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += araknis_an-700-ap-i-ac
|
|
|
|
|
|
2020-01-12 12:36:23 +00:00
|
|
|
define Device/arduino_yun
|
|
|
|
|
SOC := ar9331
|
|
|
|
|
DEVICE_VENDOR := Arduino
|
|
|
|
|
DEVICE_MODEL := Yun
|
2020-09-18 11:56:53 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2 kmod-usb-ledtrig-usbport \
|
2020-01-12 12:36:23 +00:00
|
|
|
kmod-usb-storage block-mount -swconfig
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
SUPPORTED_DEVICES += arduino-yun
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += arduino_yun
|
|
|
|
|
|
2019-05-05 17:56:03 +00:00
|
|
|
define Device/aruba_ap-105
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar7161
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := Aruba
|
|
|
|
|
DEVICE_MODEL := AP-105
|
2019-05-05 17:56:03 +00:00
|
|
|
IMAGE_SIZE := 16000k
|
2020-03-05 14:42:18 +00:00
|
|
|
DEVICE_PACKAGES := kmod-i2c-gpio kmod-tpm-i2c-atmel
|
2019-05-05 17:56:03 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += aruba_ap-105
|
|
|
|
|
|
2022-09-18 16:15:57 +00:00
|
|
|
define Device/aruba_ap-175
|
|
|
|
|
SOC := ar7161
|
|
|
|
|
DEVICE_VENDOR := Aruba
|
|
|
|
|
DEVICE_MODEL := AP-175
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
DEVICE_PACKAGES := kmod-gpio-pca953x kmod-hwmon-lm75 kmod-i2c-gpio kmod-rtc-ds1374
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += aruba_ap-175
|
|
|
|
|
|
ath79: add support for ASUS PL-AC56
Asus PL-AC56 Powerline Range Extender Rev.A1
(in kit with Asus PL-E56P Powerline-slave)
Hardware specifications:
Board: AP152
SoC: QCA9563 2.4G n 3x3
PLC: QCA7500
WiFi: QCA9882 5G ac 2x2
Switch: QCA8337 3x1000M
Flash: 16MB 25L12835F SPI-NOR
DRAM SoC: 64MB w9751g6kb-25
DRAM PLC: 128MB w631gg6kb-15
Clocks: CPU:775.000MHz, DDR:650.000MHz, AHB:258.333MHz, Ref:25.000MHz
MAC addresses as verified by OEM firmware:
use address source
Lan/Wan/PLC *:10 art 0x1002 (label)
2G *:10 art 0x1000
5G *:14 art 0x5000
Important notes:
the PLC firmware has to be provided and copied manually onto the
device! The PLC here has no dedicated flash, thus the firmware file
has to be uploaded to the PLC controller at every system start
the PLC functionality is managed by the script /etc/init.d/plc_basic,
a very basic script based on the the one from Netadair (netadair dot de)
Installation:
Asus windows recovery tool:
have to have the latest Asus firmware flashed before continuing!
install the Asus firmware restoration utility
unplug the router, hold the reset button while powering it on
release when the power LED flashes slowly
specify a static IP on your computer:
IP address: 192.168.1.75
Subnet mask 255.255.255.0
start the Asus firmware restoration utility, specify the factory image
and press upload
do NOT power off the device after OpenWrt has booted until the LED flashing
TFTP Recovery method:
have to have the latest Asus firmware flashed before continuing!
set computer to a static ip, 192.168.1.75
connect computer to the LAN 1 port of the router
hold the reset button while powering on the router for a few seconds
send firmware image using a tftp client; i.e from linux:
$ tftp
tftp> binary
tftp> connect 192.168.1.1
tftp> put factory.bin
tftp> quit
do NOT power off the device after OpenWrt has booted until the LED flashing
Additional notes:
the pairing buttons have to have pressed for at least half a second,
it doesn't matter on which plc device (master or slave) first
it is possible to pair the devices without the button-pairing requirement
simply by pressing reset on the slave device. This will default to the
firmware settings, which is also how the plc_basic script is setting up
the master device, i.e. configuring it to firmware defaults
the PL-E56P slave PLC has its dedicated 4MByte SPI, thus it is capable
to store all firmware currently available. Note that some other
slave devices are not guarantied to have the capacity for the newer
~1MByte firmware blobs!
To have a good overlook about the slave device, here are its specs:
same QCA7500 PLC controller, same w631gg6kb-15 128MB RAM,
25L3233F 4MB SPI-NOR and an AR8035-A 1000M-Transceiver
Signed-off-by: Tamas Balogh <tamasbalogh@hotmail.com>
2022-06-28 10:31:59 +00:00
|
|
|
define Device/asus_pl-ac56
|
|
|
|
|
SOC := qca9563
|
|
|
|
|
DEVICE_VENDOR := ASUS
|
|
|
|
|
DEVICE_MODEL := PL-AC56
|
|
|
|
|
DEVICE_VARIANT := A1
|
|
|
|
|
IMAGE_SIZE := 15488k
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct-smallbuffers ath10k-firmware-qca988x-ct
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += asus_pl-ac56
|
|
|
|
|
|
2022-06-28 10:35:05 +00:00
|
|
|
define Device/asus_rp-ac51
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := ASUS
|
|
|
|
|
DEVICE_MODEL := RP-AC51
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
IMAGES += factory.bin
|
2022-09-17 16:07:32 +00:00
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs
|
2022-06-28 10:35:05 +00:00
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct \
|
|
|
|
|
-swconfig
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += asus_rp-ac51
|
|
|
|
|
|
2021-12-27 17:04:51 +00:00
|
|
|
define Device/asus_rp-ac66
|
|
|
|
|
SOC := qca9563
|
|
|
|
|
DEVICE_VENDOR := ASUS
|
|
|
|
|
DEVICE_MODEL := RP-AC66
|
2022-01-25 13:16:37 +00:00
|
|
|
IMAGE_SIZE := 16000k
|
2021-12-27 17:04:51 +00:00
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct-smallbuffers ath10k-firmware-qca988x-ct \
|
|
|
|
|
rssileds -swconfig
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += asus_rp-ac66
|
|
|
|
|
|
ath79: add support for Atheros DB120 reference board
Atheros DB120 reference board.
Specifications:
SoC: QCA9344
DRAM: 128Mb DDR2
Flash: 8Mb SPI-NOR, 128Mb NAND flash
Switch: 5x 10/100Mbps via AR8229 switch (integrated into SoC),
5x 10/100/1000Mbps via QCA8237 via RGMII
WLAN: AR9300 (SoC, 2.4G+5G) + AR9340 (PCIe, 5G-only)
USB: 1x 2.0
UART: standard QCA UART header
JTAG: yes
Button: 1x reset
LEDs: a lot
Slots: 2x mPCIe + 1x mini-PCI, but using them requires
additional undocumented changes.
Misc: The board allows to boot off NAND, and there is
I2S audio support as well - also requiring
additional undocumented changes.
Installation:
1. Original bootloader
Connect the board to ethernet
Set up a server with an IP address of 192.168.1.10
Make the openwrt-ath79-generic-atheros_db120-squashfs-factory.bin
available via TFTP
tftpboot 0x80060000 openwrt-ath79-generic-atheros_db120-squashfs-factory.bin
erase 0x9f050000 +$filesize
cp.b $fileaddr 0x9f050000 $filesize
2. pepe2k's u-boot_mod
Connect the board to ethernet
Set up a server with an IP address of 192.168.1.10
Make the openwrt-ath79-generic-atheros_db120-squashfs-factory.bin
available via TFTP, as "firmware.bin"
run fw_upg
Reboot the board.
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
[explicit factory recipe in generic.mk, sorting in 10-ath9k-eeprom,
convert to nvmem, use fwconcat* names in DTS, remove unneeded DT
labels, remove redundant uart node]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-09-07 16:52:31 +00:00
|
|
|
define Device/atheros_db120
|
2021-09-26 14:07:44 +00:00
|
|
|
$(Device/loader-okli-uimage)
|
ath79: add support for Atheros DB120 reference board
Atheros DB120 reference board.
Specifications:
SoC: QCA9344
DRAM: 128Mb DDR2
Flash: 8Mb SPI-NOR, 128Mb NAND flash
Switch: 5x 10/100Mbps via AR8229 switch (integrated into SoC),
5x 10/100/1000Mbps via QCA8237 via RGMII
WLAN: AR9300 (SoC, 2.4G+5G) + AR9340 (PCIe, 5G-only)
USB: 1x 2.0
UART: standard QCA UART header
JTAG: yes
Button: 1x reset
LEDs: a lot
Slots: 2x mPCIe + 1x mini-PCI, but using them requires
additional undocumented changes.
Misc: The board allows to boot off NAND, and there is
I2S audio support as well - also requiring
additional undocumented changes.
Installation:
1. Original bootloader
Connect the board to ethernet
Set up a server with an IP address of 192.168.1.10
Make the openwrt-ath79-generic-atheros_db120-squashfs-factory.bin
available via TFTP
tftpboot 0x80060000 openwrt-ath79-generic-atheros_db120-squashfs-factory.bin
erase 0x9f050000 +$filesize
cp.b $fileaddr 0x9f050000 $filesize
2. pepe2k's u-boot_mod
Connect the board to ethernet
Set up a server with an IP address of 192.168.1.10
Make the openwrt-ath79-generic-atheros_db120-squashfs-factory.bin
available via TFTP, as "firmware.bin"
run fw_upg
Reboot the board.
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
[explicit factory recipe in generic.mk, sorting in 10-ath9k-eeprom,
convert to nvmem, use fwconcat* names in DTS, remove unneeded DT
labels, remove redundant uart node]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-09-07 16:52:31 +00:00
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_VENDOR := Atheros
|
|
|
|
|
DEVICE_MODEL := DB120
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
|
|
|
|
IMAGE_SIZE := 7808k
|
|
|
|
|
SUPPORTED_DEVICES += db120
|
|
|
|
|
LOADER_FLASH_OFFS := 0x50000
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x4f4b4c49
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | check-size | pad-to 6336k | \
|
|
|
|
|
append-loader-okli-uimage $(1) | pad-to 64k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += atheros_db120
|
|
|
|
|
|
2020-04-12 11:33:01 +00:00
|
|
|
define Device/avm
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := AVM
|
2018-03-02 18:28:50 +00:00
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | eva-image
|
|
|
|
|
KERNEL_INITRAMFS := $$(KERNEL)
|
|
|
|
|
IMAGE/sysupgrade.bin := append-kernel | pad-to 64k | \
|
2019-12-19 19:42:19 +00:00
|
|
|
append-squashfs-fakeroot-be | pad-to 256 | append-rootfs | pad-rootfs | \
|
2021-06-20 16:54:36 +00:00
|
|
|
check-size | append-metadata
|
2020-04-12 11:33:01 +00:00
|
|
|
DEVICE_PACKAGES := fritz-tffs
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/avm_fritz1750e
|
|
|
|
|
$(Device/avm)
|
|
|
|
|
SOC := qca9556
|
|
|
|
|
IMAGE_SIZE := 15232k
|
|
|
|
|
DEVICE_MODEL := FRITZ!WLAN Repeater 1750E
|
2020-04-17 12:15:06 +00:00
|
|
|
DEVICE_PACKAGES += rssileds kmod-ath10k-ct-smallbuffers \
|
2020-04-12 11:33:01 +00:00
|
|
|
ath10k-firmware-qca988x-ct -swconfig
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += avm_fritz1750e
|
|
|
|
|
|
|
|
|
|
define Device/avm_fritz300e
|
|
|
|
|
$(Device/avm)
|
|
|
|
|
SOC := ar7242
|
|
|
|
|
IMAGE_SIZE := 15232k
|
|
|
|
|
DEVICE_MODEL := FRITZ!WLAN Repeater 300E
|
|
|
|
|
DEVICE_PACKAGES += rssileds -swconfig
|
2020-02-13 13:46:52 +00:00
|
|
|
SUPPORTED_DEVICES += fritz300e
|
2018-03-02 18:28:50 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += avm_fritz300e
|
|
|
|
|
|
ath79: add support for Fritz!Box 4020
This commit adds support for the AVM Fritz!Box 4020 WiFi-router.
SoC: Qualcomm Atheros QCA9561 (Dragonfly) 750MHz
RAM: Winbond W971GG6KB-25
FLASH: Macronix MX25L12835F
WiFi: QCA9561 b/g/n 3x3 450Mbit/s
USB: 1x USB 2.0
IN: WPS button, WiFi button
OUT: Power LED green, Internet LED green, WLAN LED green,
LAN LED green, INFO LED green, INFO LED red
UART: Header Next to Black metal shield
Pinout is 3.3V - RX - TX - GND (Square Pad is 3.3V)
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet (LAN + WAN)
- WiFi (correct MAC)
- Installation via EVA bootloader
- OpenWRT sysupgrade
- Buttons
- LEDs
The USB port doesn't work. Both Root Hubs are detected as having 0 Ports:
[ 3.670807] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 3.723267] usbcore: registered new interface driver usbfs
[ 3.729058] usbcore: registered new interface driver hub
[ 3.734616] usbcore: registered new device driver usb
[ 3.744181] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 3.758357] SCSI subsystem initialized
[ 3.766026] ehci-platform: EHCI generic platform driver
[ 3.771548] ehci-platform ehci-platform.0: EHCI Host Controller
[ 3.777708] ehci-platform ehci-platform.0: new USB bus registered, assigned bus number 1
[ 3.788169] ehci-platform ehci-platform.0: irq 48, io mem 0x1b000000
[ 3.816647] ehci-platform ehci-platform.0: USB 2.0 started, EHCI 0.00
[ 3.824001] hub 1-0:1.0: USB hub found
[ 3.828219] hub 1-0:1.0: config failed, hub doesn't have any ports! (err -19)
[ 3.835825] ehci-platform ehci-platform.1: EHCI Host Controller
[ 3.842009] ehci-platform ehci-platform.1: new USB bus registered, assigned bus number 2
[ 3.852481] ehci-platform ehci-platform.1: irq 49, io mem 0x1b400000
[ 3.886631] ehci-platform ehci-platform.1: USB 2.0 started, EHCI 0.00
[ 3.894011] hub 2-0:1.0: USB hub found
[ 3.898190] hub 2-0:1.0: config failed, hub doesn't have any ports! (err -19)
[ 3.908928] usbcore: registered new interface driver usb-storage
[ 3.915634] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
A few words about the shift-register:
AVM used a trick to control the shift-register for the LEDs with only 2
pins, SERCLK and MOSI. Q7S, normally used for daisy-chaining multiple
shift-registers, pulls the latch, moving the shift register-state to
the storage register. It also pulls down MR (normally pulled up) to
clear the storage register, so the latch gets released and will not be
pulled by the remaining bits in the shift-register. Shift register is
all-zero after this.
For that we need to make sure output 7 is set to high on driver probe.
We accomplish this by using gpio-hogging.
Installation via EVA:
In the first seconds after Power is connected, the bootloader will
listen for FTP connections on 169.254.157.1 (Might also be 192.168.178.1).
Firmware can be uploaded like following:
ftp> quote USER adam2
ftp> quote PASS adam2
ftp> binary
ftp> debug
ftp> passive
ftp> quote MEDIA FLSH
ftp> put openwrt-sysupgrade.bin mtd1
Note that this procedure might take up to two minutes. After transfer is
complete you need to powercycle the device to boot OpenWRT.
Signed-off-by: David Bauer <mail@david-bauer.net>
2018-08-18 16:30:46 +00:00
|
|
|
define Device/avm_fritz4020
|
2020-04-12 11:33:01 +00:00
|
|
|
$(Device/avm)
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9561
|
ath79: add support for Fritz!Box 4020
This commit adds support for the AVM Fritz!Box 4020 WiFi-router.
SoC: Qualcomm Atheros QCA9561 (Dragonfly) 750MHz
RAM: Winbond W971GG6KB-25
FLASH: Macronix MX25L12835F
WiFi: QCA9561 b/g/n 3x3 450Mbit/s
USB: 1x USB 2.0
IN: WPS button, WiFi button
OUT: Power LED green, Internet LED green, WLAN LED green,
LAN LED green, INFO LED green, INFO LED red
UART: Header Next to Black metal shield
Pinout is 3.3V - RX - TX - GND (Square Pad is 3.3V)
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet (LAN + WAN)
- WiFi (correct MAC)
- Installation via EVA bootloader
- OpenWRT sysupgrade
- Buttons
- LEDs
The USB port doesn't work. Both Root Hubs are detected as having 0 Ports:
[ 3.670807] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 3.723267] usbcore: registered new interface driver usbfs
[ 3.729058] usbcore: registered new interface driver hub
[ 3.734616] usbcore: registered new device driver usb
[ 3.744181] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 3.758357] SCSI subsystem initialized
[ 3.766026] ehci-platform: EHCI generic platform driver
[ 3.771548] ehci-platform ehci-platform.0: EHCI Host Controller
[ 3.777708] ehci-platform ehci-platform.0: new USB bus registered, assigned bus number 1
[ 3.788169] ehci-platform ehci-platform.0: irq 48, io mem 0x1b000000
[ 3.816647] ehci-platform ehci-platform.0: USB 2.0 started, EHCI 0.00
[ 3.824001] hub 1-0:1.0: USB hub found
[ 3.828219] hub 1-0:1.0: config failed, hub doesn't have any ports! (err -19)
[ 3.835825] ehci-platform ehci-platform.1: EHCI Host Controller
[ 3.842009] ehci-platform ehci-platform.1: new USB bus registered, assigned bus number 2
[ 3.852481] ehci-platform ehci-platform.1: irq 49, io mem 0x1b400000
[ 3.886631] ehci-platform ehci-platform.1: USB 2.0 started, EHCI 0.00
[ 3.894011] hub 2-0:1.0: USB hub found
[ 3.898190] hub 2-0:1.0: config failed, hub doesn't have any ports! (err -19)
[ 3.908928] usbcore: registered new interface driver usb-storage
[ 3.915634] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
A few words about the shift-register:
AVM used a trick to control the shift-register for the LEDs with only 2
pins, SERCLK and MOSI. Q7S, normally used for daisy-chaining multiple
shift-registers, pulls the latch, moving the shift register-state to
the storage register. It also pulls down MR (normally pulled up) to
clear the storage register, so the latch gets released and will not be
pulled by the remaining bits in the shift-register. Shift register is
all-zero after this.
For that we need to make sure output 7 is set to high on driver probe.
We accomplish this by using gpio-hogging.
Installation via EVA:
In the first seconds after Power is connected, the bootloader will
listen for FTP connections on 169.254.157.1 (Might also be 192.168.178.1).
Firmware can be uploaded like following:
ftp> quote USER adam2
ftp> quote PASS adam2
ftp> binary
ftp> debug
ftp> passive
ftp> quote MEDIA FLSH
ftp> put openwrt-sysupgrade.bin mtd1
Note that this procedure might take up to two minutes. After transfer is
complete you need to powercycle the device to boot OpenWRT.
Signed-off-by: David Bauer <mail@david-bauer.net>
2018-08-18 16:30:46 +00:00
|
|
|
IMAGE_SIZE := 15232k
|
2020-04-12 11:33:01 +00:00
|
|
|
DEVICE_MODEL := FRITZ!Box 4020
|
2019-02-23 12:12:49 +00:00
|
|
|
SUPPORTED_DEVICES += fritz4020
|
ath79: add support for Fritz!Box 4020
This commit adds support for the AVM Fritz!Box 4020 WiFi-router.
SoC: Qualcomm Atheros QCA9561 (Dragonfly) 750MHz
RAM: Winbond W971GG6KB-25
FLASH: Macronix MX25L12835F
WiFi: QCA9561 b/g/n 3x3 450Mbit/s
USB: 1x USB 2.0
IN: WPS button, WiFi button
OUT: Power LED green, Internet LED green, WLAN LED green,
LAN LED green, INFO LED green, INFO LED red
UART: Header Next to Black metal shield
Pinout is 3.3V - RX - TX - GND (Square Pad is 3.3V)
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet (LAN + WAN)
- WiFi (correct MAC)
- Installation via EVA bootloader
- OpenWRT sysupgrade
- Buttons
- LEDs
The USB port doesn't work. Both Root Hubs are detected as having 0 Ports:
[ 3.670807] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 3.723267] usbcore: registered new interface driver usbfs
[ 3.729058] usbcore: registered new interface driver hub
[ 3.734616] usbcore: registered new device driver usb
[ 3.744181] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 3.758357] SCSI subsystem initialized
[ 3.766026] ehci-platform: EHCI generic platform driver
[ 3.771548] ehci-platform ehci-platform.0: EHCI Host Controller
[ 3.777708] ehci-platform ehci-platform.0: new USB bus registered, assigned bus number 1
[ 3.788169] ehci-platform ehci-platform.0: irq 48, io mem 0x1b000000
[ 3.816647] ehci-platform ehci-platform.0: USB 2.0 started, EHCI 0.00
[ 3.824001] hub 1-0:1.0: USB hub found
[ 3.828219] hub 1-0:1.0: config failed, hub doesn't have any ports! (err -19)
[ 3.835825] ehci-platform ehci-platform.1: EHCI Host Controller
[ 3.842009] ehci-platform ehci-platform.1: new USB bus registered, assigned bus number 2
[ 3.852481] ehci-platform ehci-platform.1: irq 49, io mem 0x1b400000
[ 3.886631] ehci-platform ehci-platform.1: USB 2.0 started, EHCI 0.00
[ 3.894011] hub 2-0:1.0: USB hub found
[ 3.898190] hub 2-0:1.0: config failed, hub doesn't have any ports! (err -19)
[ 3.908928] usbcore: registered new interface driver usb-storage
[ 3.915634] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
A few words about the shift-register:
AVM used a trick to control the shift-register for the LEDs with only 2
pins, SERCLK and MOSI. Q7S, normally used for daisy-chaining multiple
shift-registers, pulls the latch, moving the shift register-state to
the storage register. It also pulls down MR (normally pulled up) to
clear the storage register, so the latch gets released and will not be
pulled by the remaining bits in the shift-register. Shift register is
all-zero after this.
For that we need to make sure output 7 is set to high on driver probe.
We accomplish this by using gpio-hogging.
Installation via EVA:
In the first seconds after Power is connected, the bootloader will
listen for FTP connections on 169.254.157.1 (Might also be 192.168.178.1).
Firmware can be uploaded like following:
ftp> quote USER adam2
ftp> quote PASS adam2
ftp> binary
ftp> debug
ftp> passive
ftp> quote MEDIA FLSH
ftp> put openwrt-sysupgrade.bin mtd1
Note that this procedure might take up to two minutes. After transfer is
complete you need to powercycle the device to boot OpenWRT.
Signed-off-by: David Bauer <mail@david-bauer.net>
2018-08-18 16:30:46 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += avm_fritz4020
|
|
|
|
|
|
2020-04-14 01:58:37 +00:00
|
|
|
define Device/avm_fritz450e
|
|
|
|
|
$(Device/avm)
|
|
|
|
|
SOC := qca9556
|
|
|
|
|
IMAGE_SIZE := 15232k
|
|
|
|
|
DEVICE_MODEL := FRITZ!WLAN Repeater 450E
|
|
|
|
|
SUPPORTED_DEVICES += fritz450e
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += avm_fritz450e
|
|
|
|
|
|
2020-05-14 08:44:21 +00:00
|
|
|
define Device/avm_fritzdvbc
|
|
|
|
|
$(Device/avm)
|
|
|
|
|
SOC := qca9556
|
|
|
|
|
IMAGE_SIZE := 15232k
|
|
|
|
|
DEVICE_MODEL := FRITZ!WLAN Repeater DVB-C
|
|
|
|
|
DEVICE_PACKAGES += rssileds kmod-ath10k-ct-smallbuffers \
|
|
|
|
|
ath10k-firmware-qca988x-ct -swconfig
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += avm_fritzdvbc
|
|
|
|
|
|
2020-11-28 11:04:00 +00:00
|
|
|
define Device/belkin_f9x-v2
|
2021-09-26 14:07:44 +00:00
|
|
|
$(Device/loader-okli-uimage)
|
2020-12-07 02:01:38 +00:00
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := Belkin
|
|
|
|
|
IMAGE_SIZE := 14464k
|
|
|
|
|
DEVICE_PACKAGES += kmod-ath10k-ct ath10k-firmware-qca988x-ct kmod-usb2 \
|
|
|
|
|
kmod-usb3 kmod-usb-ledtrig-usbport
|
|
|
|
|
LOADER_FLASH_OFFS := 0x50000
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x4f4b4c49
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | check-size | \
|
2020-11-28 11:04:00 +00:00
|
|
|
edimax-headers $$$$(EDIMAX_HEADER_MAGIC) $$$$(EDIMAX_HEADER_MODEL) | \
|
|
|
|
|
pad-to $$$$(BLOCKSIZE)
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/belkin_f9j1108-v2
|
|
|
|
|
$(Device/belkin_f9x-v2)
|
|
|
|
|
DEVICE_MODEL := F9J1108 v2 (AC1750 DB Wi-Fi)
|
|
|
|
|
EDIMAX_HEADER_MAGIC := F9J1108v1
|
|
|
|
|
EDIMAX_HEADER_MODEL := BR-6679BAC
|
2020-12-07 02:01:38 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += belkin_f9j1108-v2
|
|
|
|
|
|
2020-11-28 11:08:42 +00:00
|
|
|
define Device/belkin_f9k1115-v2
|
|
|
|
|
$(Device/belkin_f9x-v2)
|
|
|
|
|
DEVICE_MODEL := F9K1115 v2 (AC1750 DB Wi-Fi)
|
|
|
|
|
EDIMAX_HEADER_MAGIC := eDiMaX
|
|
|
|
|
EDIMAX_HEADER_MODEL := F9K1115V2
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += belkin_f9k1115-v2
|
|
|
|
|
|
2018-09-11 11:50:35 +00:00
|
|
|
define Device/buffalo_bhr-4grv
|
2020-09-13 12:48:26 +00:00
|
|
|
$(Device/buffalo_common)
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar7242
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_MODEL := BHR-4GRV
|
2020-09-13 12:48:26 +00:00
|
|
|
BUFFALO_PRODUCT := BHR-4GRV
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport
|
2018-09-11 11:50:35 +00:00
|
|
|
IMAGE_SIZE := 32256k
|
|
|
|
|
SUPPORTED_DEVICES += wzr-hp-g450h
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += buffalo_bhr-4grv
|
|
|
|
|
|
ath79: modify mtd partitions for Buffalo BHR-4GRV2
This commit modifies mtd partitions define for Buffalo BHR-4GRV2 and
move it to generic subtarget.
In Buffalo BHR-4GRV2, "kernel" partition is located behined "rootfs"
partition in the stock firmware. This causes the size of the kernel
to be limited by the fixed value.
0x50000 0xe80000 0xff0000
+-------------------------------+--------------+
| rootfs | kernel |
| (14528k) | (1472k) |
+-------------------------------+--------------+
After ar71xx was updated to Kernel 4.14, the kernel size of BHR-4GRV2
exceeded the limit, and it breaks builds on official buildbot.
Since this issue was also confirmed in ath79, I modified the mtd
partitions to get rid of that limitation.
0x50000 0xff0000
+----------------------------------------------+
| firmware |
| (16000k) |
+----------------------------------------------+
However, this commit breaks compatibility with ar71xx firmware, so I
dropped "SUPPORTED_DEVICES += bhr-4grv2".
This commit requires new flash instruction instead of the old one.
Flash instruction using initramfs image:
1. Connect the computer to the LAN port of BHR-4GRV2
2. Set the IP address of the computer to 192.168.12.10
3. Rename the OpenWrt initramfs image to
"bhr4grv2-uImage-initramfs-gzip.bin" and place it into the TFTP
directory
4. Start the tftp server on the computer
5. While holding down the "ECO" button, connect power cable to
BHR-4GRV2 and turn on it
6. Flashing (orange) diag LED and release the finger from the button,
BHR-4GRV2 downloads the intiramfs image from TFTP server and boot
with it
7. On the initramfs image, create "/etc/fw_env.config" file with
following contents
/dev/mtd1 0x0 0x10000 0x10000
8. Execute following commands to add environment variables for
u-boot
fw_setenv ipaddr 192.168.12.1
fw_setenv serverip 192.168.12.10
fw_setenv ethaddr 00:aa:bb:cc:dd:ee
fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
9. Perform sysupgrade with squashfs-sysupgrade image
10. Wait ~150 seconds to complete flashing
And this commit includes small fix; BHR-4GRV2 has QCA9557 as a SoC,
not QCA9558.
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2018-11-06 13:37:43 +00:00
|
|
|
define Device/buffalo_bhr-4grv2
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9557
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := Buffalo
|
|
|
|
|
DEVICE_MODEL := BHR-4GRV2
|
ath79: modify mtd partitions for Buffalo BHR-4GRV2
This commit modifies mtd partitions define for Buffalo BHR-4GRV2 and
move it to generic subtarget.
In Buffalo BHR-4GRV2, "kernel" partition is located behined "rootfs"
partition in the stock firmware. This causes the size of the kernel
to be limited by the fixed value.
0x50000 0xe80000 0xff0000
+-------------------------------+--------------+
| rootfs | kernel |
| (14528k) | (1472k) |
+-------------------------------+--------------+
After ar71xx was updated to Kernel 4.14, the kernel size of BHR-4GRV2
exceeded the limit, and it breaks builds on official buildbot.
Since this issue was also confirmed in ath79, I modified the mtd
partitions to get rid of that limitation.
0x50000 0xff0000
+----------------------------------------------+
| firmware |
| (16000k) |
+----------------------------------------------+
However, this commit breaks compatibility with ar71xx firmware, so I
dropped "SUPPORTED_DEVICES += bhr-4grv2".
This commit requires new flash instruction instead of the old one.
Flash instruction using initramfs image:
1. Connect the computer to the LAN port of BHR-4GRV2
2. Set the IP address of the computer to 192.168.12.10
3. Rename the OpenWrt initramfs image to
"bhr4grv2-uImage-initramfs-gzip.bin" and place it into the TFTP
directory
4. Start the tftp server on the computer
5. While holding down the "ECO" button, connect power cable to
BHR-4GRV2 and turn on it
6. Flashing (orange) diag LED and release the finger from the button,
BHR-4GRV2 downloads the intiramfs image from TFTP server and boot
with it
7. On the initramfs image, create "/etc/fw_env.config" file with
following contents
/dev/mtd1 0x0 0x10000 0x10000
8. Execute following commands to add environment variables for
u-boot
fw_setenv ipaddr 192.168.12.1
fw_setenv serverip 192.168.12.10
fw_setenv ethaddr 00:aa:bb:cc:dd:ee
fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
9. Perform sysupgrade with squashfs-sysupgrade image
10. Wait ~150 seconds to complete flashing
And this commit includes small fix; BHR-4GRV2 has QCA9557 as a SoC,
not QCA9558.
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2018-11-06 13:37:43 +00:00
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += buffalo_bhr-4grv2
|
|
|
|
|
|
2020-09-13 13:27:49 +00:00
|
|
|
define Device/buffalo_wzr_ar7161
|
2020-09-13 12:48:26 +00:00
|
|
|
$(Device/buffalo_common)
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar7161
|
2020-09-13 12:48:26 +00:00
|
|
|
BUFFALO_PRODUCT := WZR-HP-AG300H
|
2019-12-19 19:42:19 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2 kmod-usb-ledtrig-usbport \
|
|
|
|
|
kmod-leds-reset kmod-owl-loader
|
2020-09-13 12:48:26 +00:00
|
|
|
IMAGE_SIZE := 32320k
|
ath79: add support for Buffalo WZR-HP-AG300H
Buffalo WZR-HP-AG300H is a dual band router based on
Qualcom Atheros AR7161 rev 2
Specification:
- 680 MHz CPU (Qualcomm Atheros AR7161)
- 128 MiB RAM (2x Samsung K4H511638G-LCCC)
- 32 MiB Flash (2x Winbond 25Q128BVFG)
- WiFi 5 GHz a/n (Atheros AR9220)
- WiFi 2.4 GHz b/g/n (Atheros AR9223)
- 1000Base-T WAN (Atheros AR7161)
- 4x 1000Base-T Switch (Atheros AR8316)
- 1x USB 2.0
- 3 Buttons (AOSS/WPS, Reset, USB Eject)
- 2 Slide switches (Router (on/off/auto), Movie Engine (on/off))
- 9 LEDs (Power green, WLAN 2GHz green, WLAN 2GHz amber,
WLAN 5GHz green, WLAN 5GHz LED amber, Router green,
Diag red, Movie Engine blue, USB green)
It is already supported by the ar71xx target.
For more information on the device visit the wiki:
<https://openwrt.org/toh/buffalo/wzr-hp-ag300h>
Serial console:
- The UART Header is next to Movie Engine Switch.
- Pinout is RX - TX - GND - 3.3V (Square Pad is 3.3V)
- The Serial setting is 115200-8-N-1.
Installation of OpenWRT from vendor firmware:
- Connect to the Web-interface at http://192.168.11.1
- Go to “Administration” → “Firmware Upgrade”
- Upload the OpenWrt factory image
Tested:
- Ethernet (LAN, WAN)
- WiFi
- Installation
- via TFTP rescue
- via factory image
- on firmware v1.77 (28-05-2012)
- on pro firmware v24SP2 r30356 (26-03-2018)
- via sysupgrade from ar71xx
(wlan devices don't work because of new names)
- via sysupgrade from itself
- Buttons
- LEDS
- USB (Power control and device recognition)
Signed-off-by: Bernhard Frauendienst <openwrt@nospam.obeliks.de>
2018-08-18 16:28:02 +00:00
|
|
|
SUPPORTED_DEVICES += wzr-hp-ag300h
|
|
|
|
|
endef
|
2020-09-13 13:27:49 +00:00
|
|
|
|
|
|
|
|
define Device/buffalo_wzr-600dhp
|
|
|
|
|
$(Device/buffalo_wzr_ar7161)
|
|
|
|
|
DEVICE_MODEL := WZR-600DHP
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += buffalo_wzr-600dhp
|
|
|
|
|
|
|
|
|
|
define Device/buffalo_wzr-hp-ag300h
|
|
|
|
|
$(Device/buffalo_wzr_ar7161)
|
|
|
|
|
DEVICE_MODEL := WZR-HP-AG300H
|
|
|
|
|
endef
|
ath79: add support for Buffalo WZR-HP-AG300H
Buffalo WZR-HP-AG300H is a dual band router based on
Qualcom Atheros AR7161 rev 2
Specification:
- 680 MHz CPU (Qualcomm Atheros AR7161)
- 128 MiB RAM (2x Samsung K4H511638G-LCCC)
- 32 MiB Flash (2x Winbond 25Q128BVFG)
- WiFi 5 GHz a/n (Atheros AR9220)
- WiFi 2.4 GHz b/g/n (Atheros AR9223)
- 1000Base-T WAN (Atheros AR7161)
- 4x 1000Base-T Switch (Atheros AR8316)
- 1x USB 2.0
- 3 Buttons (AOSS/WPS, Reset, USB Eject)
- 2 Slide switches (Router (on/off/auto), Movie Engine (on/off))
- 9 LEDs (Power green, WLAN 2GHz green, WLAN 2GHz amber,
WLAN 5GHz green, WLAN 5GHz LED amber, Router green,
Diag red, Movie Engine blue, USB green)
It is already supported by the ar71xx target.
For more information on the device visit the wiki:
<https://openwrt.org/toh/buffalo/wzr-hp-ag300h>
Serial console:
- The UART Header is next to Movie Engine Switch.
- Pinout is RX - TX - GND - 3.3V (Square Pad is 3.3V)
- The Serial setting is 115200-8-N-1.
Installation of OpenWRT from vendor firmware:
- Connect to the Web-interface at http://192.168.11.1
- Go to “Administration” → “Firmware Upgrade”
- Upload the OpenWrt factory image
Tested:
- Ethernet (LAN, WAN)
- WiFi
- Installation
- via TFTP rescue
- via factory image
- on firmware v1.77 (28-05-2012)
- on pro firmware v24SP2 r30356 (26-03-2018)
- via sysupgrade from ar71xx
(wlan devices don't work because of new names)
- via sysupgrade from itself
- Buttons
- LEDS
- USB (Power control and device recognition)
Signed-off-by: Bernhard Frauendienst <openwrt@nospam.obeliks.de>
2018-08-18 16:28:02 +00:00
|
|
|
TARGET_DEVICES += buffalo_wzr-hp-ag300h
|
|
|
|
|
|
2020-09-07 19:04:26 +00:00
|
|
|
define Device/buffalo_wzr-hp-g300nh
|
|
|
|
|
$(Device/buffalo_common)
|
|
|
|
|
SOC := ar9132
|
|
|
|
|
BUFFALO_PRODUCT := WZR-HP-G300NH
|
|
|
|
|
BUFFALO_HWVER := 1
|
2022-02-05 23:07:10 +00:00
|
|
|
DEVICE_PACKAGES := kmod-gpio-cascade kmod-mux-gpio kmod-usb2 kmod-usb-ledtrig-usbport
|
2020-09-07 19:04:26 +00:00
|
|
|
BLOCKSIZE := 128k
|
|
|
|
|
IMAGE_SIZE := 32128k
|
|
|
|
|
SUPPORTED_DEVICES += wzr-hp-g300nh
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/buffalo_wzr-hp-g300nh-rb
|
|
|
|
|
$(Device/buffalo_wzr-hp-g300nh)
|
|
|
|
|
DEVICE_MODEL := WZR-HP-G300NH (RTL8366RB switch)
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += buffalo_wzr-hp-g300nh-rb
|
|
|
|
|
|
|
|
|
|
define Device/buffalo_wzr-hp-g300nh-s
|
|
|
|
|
$(Device/buffalo_wzr-hp-g300nh)
|
|
|
|
|
DEVICE_MODEL := WZR-HP-G300NH (RTL8366S switch)
|
2022-04-26 21:51:32 +00:00
|
|
|
DEVICE_PACKAGES += kmod-switch-rtl8366rb
|
2020-09-07 19:04:26 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += buffalo_wzr-hp-g300nh-s
|
|
|
|
|
|
2018-10-02 13:28:45 +00:00
|
|
|
define Device/buffalo_wzr-hp-g302h-a1a0
|
2020-09-13 12:48:26 +00:00
|
|
|
$(Device/buffalo_common)
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar7242
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_MODEL := WZR-HP-G302H
|
|
|
|
|
DEVICE_VARIANT := A1A0
|
2020-09-13 12:48:26 +00:00
|
|
|
BUFFALO_PRODUCT := WZR-HP-G302H
|
|
|
|
|
BUFFALO_HWVER := 4
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport
|
2018-10-02 13:28:45 +00:00
|
|
|
IMAGE_SIZE := 32128k
|
|
|
|
|
SUPPORTED_DEVICES += wzr-hp-g300nh2
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += buffalo_wzr-hp-g302h-a1a0
|
|
|
|
|
|
2018-08-02 07:14:10 +00:00
|
|
|
define Device/buffalo_wzr-hp-g450h
|
2020-09-13 12:48:26 +00:00
|
|
|
$(Device/buffalo_common)
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar7242
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_MODEL := WZR-HP-G450H/WZR-450HP
|
2020-09-13 12:48:26 +00:00
|
|
|
BUFFALO_PRODUCT := WZR-HP-G450H
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport
|
2018-08-02 07:14:10 +00:00
|
|
|
IMAGE_SIZE := 32256k
|
|
|
|
|
SUPPORTED_DEVICES += wzr-hp-g450h
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += buffalo_wzr-hp-g450h
|
|
|
|
|
|
ath79: add support for COMFAST CF-E110N
This patch adds support for the COMFAST CF-E110N, an outdoor wireless
CPE with two Ethernet ports and a 802.11bgn radio.
Specifications:
- 650/400/216 MHz (CPU/DDR/AHB)
- 2x 10/100 Mbps Ethernet, both with PoE-in support
- 64 MB of RAM (DDR2)
- 16 MB of FLASH
- 2T2R 2.4 GHz, up to 26 dBm
- 11 dBi built-in antenna
- POWER/LAN/WAN/WLAN green LEDs
- 4x RSSI LEDs (2x red, 2x green)
- UART (115200 8N1) and GPIO (J9) headers on PCB
Flashing instructions:
The original firmware is based on OpenWrt so a sysupgrade image can be
installed via the stock web GUI. Settings from the original firmware
will be saved and restored on the new want, so a factory reset will be
needed: once the new firmware is flashed, perform the factory reset by
pushing the reset button several times during the boot process, while the
WAN LED flashes, until it starts flashing quicker.
The U-boot bootloader contains a recovery HTTP server to upload the
firmware. Push the reset button while powering the device on and keep it
pressed for >10 seconds. The recovery page will be at http://192.168.1.1
Notes:
The device is advertised, sold and labeled as "CF-E110N", but the
bootloader and the stock firmware identify it as "v2".
Acknowledgments:
Petr Štetiar <ynezz@true.cz>
Sebastian Kemper <sebastian_ml@gmx.net>
Chuanhong Guo <gch981213@gmail.com>
Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
[drop unused labels from devicetree source file]
Signed-off-by: Mathias Kresin <dev@kresin.me>
2018-12-10 14:44:56 +00:00
|
|
|
define Device/comfast_cf-e110n-v2
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9533
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := COMFAST
|
|
|
|
|
DEVICE_MODEL := CF-E110N
|
|
|
|
|
DEVICE_VARIANT := v2
|
2020-08-05 10:05:24 +00:00
|
|
|
DEVICE_PACKAGES := rssileds -swconfig -uboot-envtools
|
ath79: add support for COMFAST CF-E110N
This patch adds support for the COMFAST CF-E110N, an outdoor wireless
CPE with two Ethernet ports and a 802.11bgn radio.
Specifications:
- 650/400/216 MHz (CPU/DDR/AHB)
- 2x 10/100 Mbps Ethernet, both with PoE-in support
- 64 MB of RAM (DDR2)
- 16 MB of FLASH
- 2T2R 2.4 GHz, up to 26 dBm
- 11 dBi built-in antenna
- POWER/LAN/WAN/WLAN green LEDs
- 4x RSSI LEDs (2x red, 2x green)
- UART (115200 8N1) and GPIO (J9) headers on PCB
Flashing instructions:
The original firmware is based on OpenWrt so a sysupgrade image can be
installed via the stock web GUI. Settings from the original firmware
will be saved and restored on the new want, so a factory reset will be
needed: once the new firmware is flashed, perform the factory reset by
pushing the reset button several times during the boot process, while the
WAN LED flashes, until it starts flashing quicker.
The U-boot bootloader contains a recovery HTTP server to upload the
firmware. Push the reset button while powering the device on and keep it
pressed for >10 seconds. The recovery page will be at http://192.168.1.1
Notes:
The device is advertised, sold and labeled as "CF-E110N", but the
bootloader and the stock firmware identify it as "v2".
Acknowledgments:
Petr Štetiar <ynezz@true.cz>
Sebastian Kemper <sebastian_ml@gmx.net>
Chuanhong Guo <gch981213@gmail.com>
Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
[drop unused labels from devicetree source file]
Signed-off-by: Mathias Kresin <dev@kresin.me>
2018-12-10 14:44:56 +00:00
|
|
|
IMAGE_SIZE := 16192k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += comfast_cf-e110n-v2
|
|
|
|
|
|
ath79: add support for COMFAST CF-E120A v3
This patch adds support for the COMFAST CF-E120A v3, an outdoor wireless
CPE with two Ethernet ports and a 802.11an radio.
Specifications:
- AR9344 SoC
- 535/400/267 MHz (CPU/DDR/AHB)
- 2x 10/100 Mbps Ethernet, both with PoE-in support
- 64 MB of RAM (DDR2)
- 8 MB of FLASH
- 2T2R 5 GHz, up to 25 dBm
- 11 dBi built-in antenna
- POWER/LAN/WAN/WLAN green LEDs
- 4x RSSI LEDs (2x red, 2x green)
- UART (115200 8N1) and GPIO (J9) headers on PCB
Flashing instructions:
The original firmware is based on OpenWrt so a sysupgrade image can be
installed via the stock web GUI. Settings from the original firmware
will be saved and restored on the new one, so a factory reset will be
needed. To do so, once the new firmware is flashed, enter into failsafe
mode by pressing the reset button several times during the boot
process, while while the WAN LED flashes, until it starts flashing
faster. Once in failsafe mode, perform a factory reset as usual.
The U-boot bootloader contains a recovery HTTP server to upload the
firmware. Push the reset button while powering the device on and
keep it pressed for >10 seconds. The recovery page will be at
http://192.168.1.1
Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
2018-12-29 19:44:43 +00:00
|
|
|
define Device/comfast_cf-e120a-v3
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9344
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := COMFAST
|
|
|
|
|
DEVICE_MODEL := CF-E120A
|
|
|
|
|
DEVICE_VARIANT := v3
|
2020-08-05 10:05:24 +00:00
|
|
|
DEVICE_PACKAGES := rssileds -uboot-envtools
|
ath79: add support for COMFAST CF-E120A v3
This patch adds support for the COMFAST CF-E120A v3, an outdoor wireless
CPE with two Ethernet ports and a 802.11an radio.
Specifications:
- AR9344 SoC
- 535/400/267 MHz (CPU/DDR/AHB)
- 2x 10/100 Mbps Ethernet, both with PoE-in support
- 64 MB of RAM (DDR2)
- 8 MB of FLASH
- 2T2R 5 GHz, up to 25 dBm
- 11 dBi built-in antenna
- POWER/LAN/WAN/WLAN green LEDs
- 4x RSSI LEDs (2x red, 2x green)
- UART (115200 8N1) and GPIO (J9) headers on PCB
Flashing instructions:
The original firmware is based on OpenWrt so a sysupgrade image can be
installed via the stock web GUI. Settings from the original firmware
will be saved and restored on the new one, so a factory reset will be
needed. To do so, once the new firmware is flashed, enter into failsafe
mode by pressing the reset button several times during the boot
process, while while the WAN LED flashes, until it starts flashing
faster. Once in failsafe mode, perform a factory reset as usual.
The U-boot bootloader contains a recovery HTTP server to upload the
firmware. Push the reset button while powering the device on and
keep it pressed for >10 seconds. The recovery page will be at
http://192.168.1.1
Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
2018-12-29 19:44:43 +00:00
|
|
|
IMAGE_SIZE := 8000k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += comfast_cf-e120a-v3
|
|
|
|
|
|
2020-03-27 03:32:55 +00:00
|
|
|
define Device/comfast_cf-e130n-v2
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := COMFAST
|
|
|
|
|
DEVICE_MODEL := CF-E130N
|
|
|
|
|
DEVICE_VARIANT := v2
|
2020-08-05 10:05:24 +00:00
|
|
|
DEVICE_PACKAGES := rssileds -swconfig -uboot-envtools
|
2020-03-27 03:32:55 +00:00
|
|
|
IMAGE_SIZE := 7936k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += comfast_cf-e130n-v2
|
|
|
|
|
|
ath79: add support for COMFAST CF-E313AC
This patch adds support for the COMFAST CF-E313AC, an outdoor wireless
CPE with two Ethernet ports and a 802.11ac radio.
Specifications:
- QCA9531 SoC
- 650/400/216 MHz (CPU/DDR/AHB)
- 1x 10/100 Mbps WAN Ethernet, 48V PoE-in
- 1x 10/100 Mbps LAN Ethernet, pass-through 48V PoE-out
- 1x manual pass-through PoE switch
- 64 MB RAM (DDR2)
- 16 MB FLASH
- QCA9886 2T2R 5 GHz 802.11ac, 23 dBm
- 12 dBi built-in antenna
- POWER/LAN/WAN/WLAN green LEDs
- 4x RSSI LEDs (2x red, 2x green)
- UART (115200 8N1)
Flashing instructions:
The original firmware is based on OpenWrt so a sysupgrade image can be
installed via the stock web GUI. Settings from the original firmware
will be saved and restored on the new one, so a factory reset will be
needed. To do so, once the new firmware is flashed, enter into failsafe
mode by pressing the reset button several times during the boot
process, while the WAN LED flashes, until it starts flashing faster.
Once in failsafe mode, perform a factory reset as usual.
Alternatively, the U-boot bootloader contains a recovery HTTP server
to upload the firmware. Push the reset button while powering the
device on and keep it pressed for >10 seconds. The device's LEDs will
blink several times and the recovery page will be at
http://192.168.1.1; use it to upload the sysupgrade image.
Note:
Four MAC addresses are stored in the "art" partition (read-only):
- 0x0000: 40:A5:EF:AA:AA:A0
- 0x0006: 40:A5:EF:AA:AA:A2
- 0x1002: 40:A5:EF:AA:AA:A1
- 0x5006: 40:A5:EF:AA.AA:A3 (inside the 5 GHz calibration data)
The stock firmware assigns MAC addresses to physical and virtual
interfaces in a very particular way:
- eth0 corresponds to the physical Ethernet port labeled as WAN
- eth1 corresponds to the physical Ethernet port labeled as LAN
- eth0 belongs to the bridge interface br-wan
- eth1 belongs to the bridge interface br-lan
- eth0 is assigned the MAC from 0x0 (*:A0)
- eth1 is assigned the MAC from 0x1002 (*:A1)
- br-wan is forced to use the MAC from 0x1002 (*:A1)
- br-lan is forced to use the MAC from 0x0 (*:A0)
- radio0 uses the calibration data from 0x5000 (which contains
a valid MAC address, *:A3). However, it is overwritten by the
one at 0x6 (*:A2)
This commit preserves the LAN/WAN roles of the physical Ethernet
ports (as labeled on the router) and the MAC addresses they expose
by default (i.e., *:A0 on LAN, *:A1 on WAN), but swaps the position
of the eth0/eth1 compared to the stock firmware:
- eth0 corresponds to the physical Ethernet port labeled as LAN
- eth1 corresponds to the physical Ethernet port labeled as WAN
- eth0 belongs to the bridge interface br-lan
- eth1 is the interface at @wan
- eth0 is assigned the MAC from 0x0 (*:A0)
- eth1 is assigned the MAC from 0x1002 (*:A1)
- br-lan inherits the MAC from eth0 (*:A0)
- @wan inherits the MAC from eth1 (*:A1)
- radio0's MAC is overwritten to the one at 0x6
This way, eth0/eth1's positions differ from the stock firmware, but
the weird MAC ressignations in br-lan/br-wan are avoided while the
external behaviour of the router is maintained. Additionally, WAN
port is connected to the PHY gmac, allowing to monitor the link
status (e.g., to restart DHCP negotiation when plugging a cable).
Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
2019-03-18 12:20:47 +00:00
|
|
|
define Device/comfast_cf-e313ac
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9531
|
ath79: add support for COMFAST CF-E313AC
This patch adds support for the COMFAST CF-E313AC, an outdoor wireless
CPE with two Ethernet ports and a 802.11ac radio.
Specifications:
- QCA9531 SoC
- 650/400/216 MHz (CPU/DDR/AHB)
- 1x 10/100 Mbps WAN Ethernet, 48V PoE-in
- 1x 10/100 Mbps LAN Ethernet, pass-through 48V PoE-out
- 1x manual pass-through PoE switch
- 64 MB RAM (DDR2)
- 16 MB FLASH
- QCA9886 2T2R 5 GHz 802.11ac, 23 dBm
- 12 dBi built-in antenna
- POWER/LAN/WAN/WLAN green LEDs
- 4x RSSI LEDs (2x red, 2x green)
- UART (115200 8N1)
Flashing instructions:
The original firmware is based on OpenWrt so a sysupgrade image can be
installed via the stock web GUI. Settings from the original firmware
will be saved and restored on the new one, so a factory reset will be
needed. To do so, once the new firmware is flashed, enter into failsafe
mode by pressing the reset button several times during the boot
process, while the WAN LED flashes, until it starts flashing faster.
Once in failsafe mode, perform a factory reset as usual.
Alternatively, the U-boot bootloader contains a recovery HTTP server
to upload the firmware. Push the reset button while powering the
device on and keep it pressed for >10 seconds. The device's LEDs will
blink several times and the recovery page will be at
http://192.168.1.1; use it to upload the sysupgrade image.
Note:
Four MAC addresses are stored in the "art" partition (read-only):
- 0x0000: 40:A5:EF:AA:AA:A0
- 0x0006: 40:A5:EF:AA:AA:A2
- 0x1002: 40:A5:EF:AA:AA:A1
- 0x5006: 40:A5:EF:AA.AA:A3 (inside the 5 GHz calibration data)
The stock firmware assigns MAC addresses to physical and virtual
interfaces in a very particular way:
- eth0 corresponds to the physical Ethernet port labeled as WAN
- eth1 corresponds to the physical Ethernet port labeled as LAN
- eth0 belongs to the bridge interface br-wan
- eth1 belongs to the bridge interface br-lan
- eth0 is assigned the MAC from 0x0 (*:A0)
- eth1 is assigned the MAC from 0x1002 (*:A1)
- br-wan is forced to use the MAC from 0x1002 (*:A1)
- br-lan is forced to use the MAC from 0x0 (*:A0)
- radio0 uses the calibration data from 0x5000 (which contains
a valid MAC address, *:A3). However, it is overwritten by the
one at 0x6 (*:A2)
This commit preserves the LAN/WAN roles of the physical Ethernet
ports (as labeled on the router) and the MAC addresses they expose
by default (i.e., *:A0 on LAN, *:A1 on WAN), but swaps the position
of the eth0/eth1 compared to the stock firmware:
- eth0 corresponds to the physical Ethernet port labeled as LAN
- eth1 corresponds to the physical Ethernet port labeled as WAN
- eth0 belongs to the bridge interface br-lan
- eth1 is the interface at @wan
- eth0 is assigned the MAC from 0x0 (*:A0)
- eth1 is assigned the MAC from 0x1002 (*:A1)
- br-lan inherits the MAC from eth0 (*:A0)
- @wan inherits the MAC from eth1 (*:A1)
- radio0's MAC is overwritten to the one at 0x6
This way, eth0/eth1's positions differ from the stock firmware, but
the weird MAC ressignations in br-lan/br-wan are avoided while the
external behaviour of the router is maintained. Additionally, WAN
port is connected to the PHY gmac, allowing to monitor the link
status (e.g., to restart DHCP negotiation when plugging a cable).
Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
2019-03-18 12:20:47 +00:00
|
|
|
DEVICE_VENDOR := COMFAST
|
|
|
|
|
DEVICE_MODEL := CF-E313AC
|
2020-08-05 10:05:24 +00:00
|
|
|
DEVICE_PACKAGES := rssileds kmod-ath10k-ct-smallbuffers \
|
2019-12-19 19:42:19 +00:00
|
|
|
ath10k-firmware-qca9888-ct -swconfig -uboot-envtools
|
ath79: add support for COMFAST CF-E313AC
This patch adds support for the COMFAST CF-E313AC, an outdoor wireless
CPE with two Ethernet ports and a 802.11ac radio.
Specifications:
- QCA9531 SoC
- 650/400/216 MHz (CPU/DDR/AHB)
- 1x 10/100 Mbps WAN Ethernet, 48V PoE-in
- 1x 10/100 Mbps LAN Ethernet, pass-through 48V PoE-out
- 1x manual pass-through PoE switch
- 64 MB RAM (DDR2)
- 16 MB FLASH
- QCA9886 2T2R 5 GHz 802.11ac, 23 dBm
- 12 dBi built-in antenna
- POWER/LAN/WAN/WLAN green LEDs
- 4x RSSI LEDs (2x red, 2x green)
- UART (115200 8N1)
Flashing instructions:
The original firmware is based on OpenWrt so a sysupgrade image can be
installed via the stock web GUI. Settings from the original firmware
will be saved and restored on the new one, so a factory reset will be
needed. To do so, once the new firmware is flashed, enter into failsafe
mode by pressing the reset button several times during the boot
process, while the WAN LED flashes, until it starts flashing faster.
Once in failsafe mode, perform a factory reset as usual.
Alternatively, the U-boot bootloader contains a recovery HTTP server
to upload the firmware. Push the reset button while powering the
device on and keep it pressed for >10 seconds. The device's LEDs will
blink several times and the recovery page will be at
http://192.168.1.1; use it to upload the sysupgrade image.
Note:
Four MAC addresses are stored in the "art" partition (read-only):
- 0x0000: 40:A5:EF:AA:AA:A0
- 0x0006: 40:A5:EF:AA:AA:A2
- 0x1002: 40:A5:EF:AA:AA:A1
- 0x5006: 40:A5:EF:AA.AA:A3 (inside the 5 GHz calibration data)
The stock firmware assigns MAC addresses to physical and virtual
interfaces in a very particular way:
- eth0 corresponds to the physical Ethernet port labeled as WAN
- eth1 corresponds to the physical Ethernet port labeled as LAN
- eth0 belongs to the bridge interface br-wan
- eth1 belongs to the bridge interface br-lan
- eth0 is assigned the MAC from 0x0 (*:A0)
- eth1 is assigned the MAC from 0x1002 (*:A1)
- br-wan is forced to use the MAC from 0x1002 (*:A1)
- br-lan is forced to use the MAC from 0x0 (*:A0)
- radio0 uses the calibration data from 0x5000 (which contains
a valid MAC address, *:A3). However, it is overwritten by the
one at 0x6 (*:A2)
This commit preserves the LAN/WAN roles of the physical Ethernet
ports (as labeled on the router) and the MAC addresses they expose
by default (i.e., *:A0 on LAN, *:A1 on WAN), but swaps the position
of the eth0/eth1 compared to the stock firmware:
- eth0 corresponds to the physical Ethernet port labeled as LAN
- eth1 corresponds to the physical Ethernet port labeled as WAN
- eth0 belongs to the bridge interface br-lan
- eth1 is the interface at @wan
- eth0 is assigned the MAC from 0x0 (*:A0)
- eth1 is assigned the MAC from 0x1002 (*:A1)
- br-lan inherits the MAC from eth0 (*:A0)
- @wan inherits the MAC from eth1 (*:A1)
- radio0's MAC is overwritten to the one at 0x6
This way, eth0/eth1's positions differ from the stock firmware, but
the weird MAC ressignations in br-lan/br-wan are avoided while the
external behaviour of the router is maintained. Additionally, WAN
port is connected to the PHY gmac, allowing to monitor the link
status (e.g., to restart DHCP negotiation when plugging a cable).
Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
2019-03-18 12:20:47 +00:00
|
|
|
IMAGE_SIZE := 7936k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += comfast_cf-e313ac
|
|
|
|
|
|
2019-03-30 13:27:17 +00:00
|
|
|
define Device/comfast_cf-e314n-v2
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9531
|
2019-03-30 13:27:17 +00:00
|
|
|
DEVICE_VENDOR := COMFAST
|
|
|
|
|
DEVICE_MODEL := CF-E314N
|
|
|
|
|
DEVICE_VARIANT := v2
|
|
|
|
|
DEVICE_PACKAGES := rssileds
|
2019-08-09 11:53:49 +00:00
|
|
|
IMAGE_SIZE := 7936k
|
2019-03-30 13:27:17 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += comfast_cf-e314n-v2
|
|
|
|
|
|
ath79: add support for COMFAST CF-E375AC
COMFAST CF-E375AC is a ceiling mount AP with PoE support,
based on Qualcomm/Atheros QCA9563 + QCA9886 + QCA8337.
Short specification:
2x 10/100/1000 Mbps Ethernet, with PoE support
128MB of RAM (DDR2)
16 MB of FLASH
3T3R 2.4 GHz, 802.11b/g/n
2T2R 5 GHz, 802.11ac/n/a, wave 2
built-in 5x 3 dBi antennas
output power (max): 500 mW (27 dBm)
1x RGB LED, 1x button
built-in watchdog chipset
Flash instruction:
1) Original firmware is based on OpenWrt.
Use sysupgrade image directly in vendor GUI.
2) TFTP
2.1) Set a tftp server on your machine with a fixed IP address of
192.168.1.10. A place the sysupgrade as firmware_auto.bin.
2.2) boot the device with an ethernet connection on fixed ip route
2.3) wait a few seconds and try to login via ssh
3) TFTP trough Bootloader
3.1) open the device case and get a uart connection working
3.2) stop the autoboot process and test connection with serverip
3.3) name the sysupgrade image firmware.bin and run firmware_upg
MAC addresses:
Though the OEM firmware has four adresses in the usual locations,
it appears that the assigned addresses are just incremented in a
different way:
interface address location
LAN: *:DC 0x0
WAN *:DD 0x1002
WLAN 2.4g *:E6 n/a (0x0 + 10)
WLAN 5g *:DE 0x6
unused *:DF 0x5006
The MAC address pointed at the label is the one assign to the LAN
interface.
Signed-off-by: Joao Henrique Albuquerque <joaohccalbu@gmail.com>
[add label-mac-device, remove redundant uart status, fix whitespace
issues, fix commit message wrapping, remove x bit on DTS file]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-08-14 15:04:02 +00:00
|
|
|
define Device/comfast_cf-e375ac
|
|
|
|
|
SOC := qca9563
|
|
|
|
|
DEVICE_VENDOR := COMFAST
|
|
|
|
|
DEVICE_MODEL := CF-E375AC
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct \
|
|
|
|
|
ath10k-firmware-qca9888-ct -uboot-envtools
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += comfast_cf-e375ac
|
|
|
|
|
|
2019-03-21 11:50:01 +00:00
|
|
|
define Device/comfast_cf-e5
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9531
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := COMFAST
|
|
|
|
|
DEVICE_MODEL := CF-E5/E7
|
2020-08-05 10:03:13 +00:00
|
|
|
DEVICE_PACKAGES := rssileds kmod-usb2 kmod-usb-net-qmi-wwan -swconfig \
|
|
|
|
|
-uboot-envtools
|
2019-03-21 11:50:01 +00:00
|
|
|
IMAGE_SIZE := 16192k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += comfast_cf-e5
|
|
|
|
|
|
ath79: add support for COMFAST CF-E560AC
This commit adds support for the COMFAST CF-E560AC, an ap143 based
in-wall access point.
Specifications:
- SoC: Qualcomm Atheros QCA9531
- RAM: 128 MB DDR2 (Winbond W971GG6SB-25)
- Storage: 16 MB NOR (Winbond 25Q128JVSO)
- WAN: 1x 10/100 PoE ethernet (48v)
- LAN: 4x 10/100 ethernet
- WLAN1: QCA9531 - 802.11b/g/n - 2x SKY85303-21 FEM
- WLAN2: QCA9886 - 802.11ac/n/a - 2x SKY85735-11 FEM
- USB: one external USB2.0 port
- UART: 3.3v, 2.54mm headers already populated on board
- LED: 7x external
- Button: 1x external
- Boot: U-Boot 1.1.4 (pepe2k/u-boot_mod)
MAC addressing:
- stock
LAN *:40 (label)
WAN *:41
5G *:42
2.4G *:4a
- flash (art partition)
0x0 *:40 (label)
0x6 *:42
0x1002 *:41
0x5006 *:43
This device contains valid MAC addresses in art 0x0, 0x6, 0x1002 and
0x5006, however the vendor firmware only reads from art:0x0 for the LAN
interface and then increments in 02_network. They also jump 8 addresses
for the second wifi interface (2.4 GHz). This behavior has been duplicated
in the DTS and ath10k hotplug to align addresses with the vendor firmware
v2.6.0.
Recovery instructions:
This device contains built-in u-boot tftp recovery.
1. Configure PC with static IP 192.168.1.10/24 and tftp server.
2. Place desired image at /firmware_auto.bin at tftp root.
3. Connect device to PC, and power on.
4. Device will fetch flash from tftp, flash and reboot into new image.
Signed-off-by: August Huber <auh@google.com>
[move jtag_disable_pins, remove unnecessary statuses in DTS, remove
duplicate entry in 11-ath10k-caldata, remove hub_port0 label in DTS]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-01-26 16:55:11 +00:00
|
|
|
define Device/comfast_cf-e560ac
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := COMFAST
|
|
|
|
|
DEVICE_MODEL := CF-E560AC
|
2020-08-05 10:05:24 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca9888-ct
|
ath79: add support for COMFAST CF-E560AC
This commit adds support for the COMFAST CF-E560AC, an ap143 based
in-wall access point.
Specifications:
- SoC: Qualcomm Atheros QCA9531
- RAM: 128 MB DDR2 (Winbond W971GG6SB-25)
- Storage: 16 MB NOR (Winbond 25Q128JVSO)
- WAN: 1x 10/100 PoE ethernet (48v)
- LAN: 4x 10/100 ethernet
- WLAN1: QCA9531 - 802.11b/g/n - 2x SKY85303-21 FEM
- WLAN2: QCA9886 - 802.11ac/n/a - 2x SKY85735-11 FEM
- USB: one external USB2.0 port
- UART: 3.3v, 2.54mm headers already populated on board
- LED: 7x external
- Button: 1x external
- Boot: U-Boot 1.1.4 (pepe2k/u-boot_mod)
MAC addressing:
- stock
LAN *:40 (label)
WAN *:41
5G *:42
2.4G *:4a
- flash (art partition)
0x0 *:40 (label)
0x6 *:42
0x1002 *:41
0x5006 *:43
This device contains valid MAC addresses in art 0x0, 0x6, 0x1002 and
0x5006, however the vendor firmware only reads from art:0x0 for the LAN
interface and then increments in 02_network. They also jump 8 addresses
for the second wifi interface (2.4 GHz). This behavior has been duplicated
in the DTS and ath10k hotplug to align addresses with the vendor firmware
v2.6.0.
Recovery instructions:
This device contains built-in u-boot tftp recovery.
1. Configure PC with static IP 192.168.1.10/24 and tftp server.
2. Place desired image at /firmware_auto.bin at tftp root.
3. Connect device to PC, and power on.
4. Device will fetch flash from tftp, flash and reboot into new image.
Signed-off-by: August Huber <auh@google.com>
[move jtag_disable_pins, remove unnecessary statuses in DTS, remove
duplicate entry in 11-ath10k-caldata, remove hub_port0 label in DTS]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-01-26 16:55:11 +00:00
|
|
|
IMAGE_SIZE := 16128k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += comfast_cf-e560ac
|
|
|
|
|
|
ath79: add support for Comfast CF-EW72
Specifications:
Qualcomm/Atheros QCA9531 + QCA9886
2x 10/100 Mbps Ethernet, with 48v PoE
2T2R 2.4 GHz, 802.11b/g/n
2T2R 5 GHz, 802.11a/n/ac
128MB RAM
16MB SPI Flash
4x LED (Always On Power, LAN, WAN, WLAN)
Flashing Instructions:
Original firmware is based on OpenWRT, so flashing the sysupgrade image on
the factory firmware is sufficient.
Tested: Reset button, WAN LED, LAN LED, Power LED (always on, not much
to test), WLAN LED (one LED only for 2 interfaces, by default it gets
assigned to the first interface), MAC addresses (match factory firmware).
My LAN factory MAC address ends in F2.
use stock_mac art_loc
lan :f2 0x0
wan :f3 0x1002
5g :f4 0x6
2g :f5 0x5006
Since MAC address flash locations do not really match their use in vendor
firmware (e.g. address from 5 GHz calibration data is assigned to 2.4 GHz
WiFi), just calculate the MAC addresses with an offset based on 0x0 address.
Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
[add MAC address comment]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-03-11 21:00:42 +00:00
|
|
|
define Device/comfast_cf-ew72
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := COMFAST
|
|
|
|
|
DEVICE_MODEL := CF-EW72
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca9888-ct \
|
|
|
|
|
-uboot-envtools -swconfig
|
|
|
|
|
IMAGE_SIZE := 16192k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += comfast_cf-ew72
|
|
|
|
|
|
2019-03-31 04:26:22 +00:00
|
|
|
define Device/comfast_cf-wr650ac-v1
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9558
|
2019-03-31 04:26:22 +00:00
|
|
|
DEVICE_VENDOR := COMFAST
|
|
|
|
|
DEVICE_MODEL := CF-WR650AC
|
|
|
|
|
DEVICE_VARIANT := v1
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
2019-08-09 15:40:42 +00:00
|
|
|
IMAGE_SIZE := 16128k
|
2019-03-31 04:26:22 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += comfast_cf-wr650ac-v1
|
|
|
|
|
|
|
|
|
|
define Device/comfast_cf-wr650ac-v2
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9558
|
2019-03-31 04:26:22 +00:00
|
|
|
DEVICE_VENDOR := COMFAST
|
|
|
|
|
DEVICE_MODEL := CF-WR650AC
|
|
|
|
|
DEVICE_VARIANT := v2
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
2019-08-09 15:40:42 +00:00
|
|
|
IMAGE_SIZE := 16000k
|
2019-03-31 04:26:22 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += comfast_cf-wr650ac-v2
|
|
|
|
|
|
ath79: add support for Comfast CF-WR752AC v1
Specifications:
- Qualcomm QCA9531 + QCA9886
- dual band, antenna 2*3dBi
- Output power 50mW (17dBm)
- 1x 10/100 Mbps LAN RJ45
- 128 MB RAM / 16 MB FLASH (w25q128)
- 3 LEDs (red/green/blue)
incorporated in
"color wheel reset switch"
- UART 115200 8N1
Flashing instructions:
The U-boot bootloader contains a recovery HTTP server
to upload the firmware. Push the reset button while powering the
device on and keep it pressed for ~10 seconds. The device's LEDs will
blink several times and the recovery page will be at
http://192.168.1.1; use it to upload the sysupgrade image.
Alternatively, the original firmware is based on OpenWrt so a
sysupgrade image can be installed via the stock web GUI. Settings from
the original firmware will be saved and restored on the new one, so a
factory reset will be needed. To do so, once the new firmware is flashed,
enter into failsafe mode by pressing the reset button several times during
the boot process, until it starts flashing. Once in failsafe mode, perform
a factory reset as usual.
LED-Info:
The LEDs on the Comfast stock fw have a very proprietary behaviour,
corresponding to the user selected working mode (AP, ROUTER or REPEATER).
In the first two cases, only blue is used for status and LAN signaling. When
using the latter, blue is always off (except for sysupgrade), either red
signals bad rssi on master-link, or green good. Since the default working
mode of OpenWrt resembles that of a router/AP, the default behavior is
implemented accordingly.
MAC addresses (art partition):
location address (example) use in vendor firmware
0x0 xx:xx:xx:xx:xc:f8 -> eth0
0x6 xx:xx:xx:xx:xc:fa -> wlan5g (+2)
0x1002 xx:xx:xx:xx:xc:f9 -> not used
0x5006 xx:xx:xx:xx:xc:fb -> not used
--- xx:xx:xx:xx:xd:02 -> wlan2g (+10)
The same strange situation has already been observed and documented
for COMFAST CF-E560AC.
Signed-off-by: Roman Hampel <rhamp@arcor.de>
Co-developed-by: Joao Albuquerque <joaohccalbu@gmail.com>
Signed-off-by: Joao Albuquerque <joaohccalbu@gmail.com>
[adjust and extend commit message, rebase, minor DTS adjustments,
add correct MAC address for wmac, change RSSI LED names and behavior]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-03-20 16:32:30 +00:00
|
|
|
define Device/comfast_cf-wr752ac-v1
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := COMFAST
|
|
|
|
|
DEVICE_MODEL := CF-WR752AC
|
|
|
|
|
DEVICE_VARIANT := v1
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca9888-ct \
|
|
|
|
|
-uboot-envtools
|
|
|
|
|
IMAGE_SIZE := 16192k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += comfast_cf-wr752ac-v1
|
|
|
|
|
|
2019-07-26 18:32:55 +00:00
|
|
|
define Device/compex_wpj344-16m
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
|
|
|
|
IMAGE_SIZE := 16128k
|
|
|
|
|
DEVICE_VENDOR := Compex
|
|
|
|
|
DEVICE_MODEL := WPJ344
|
|
|
|
|
DEVICE_VARIANT := 16M
|
|
|
|
|
SUPPORTED_DEVICES += wpj344
|
|
|
|
|
IMAGES += cpximg-6a08.bin
|
|
|
|
|
IMAGE/cpximg-6a08.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | pad-rootfs | mkmylofw_16m 0x690 3
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += compex_wpj344-16m
|
|
|
|
|
|
2019-07-25 01:06:32 +00:00
|
|
|
define Device/compex_wpj531-16m
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
|
|
|
|
IMAGE_SIZE := 16128k
|
|
|
|
|
DEVICE_VENDOR := Compex
|
|
|
|
|
DEVICE_MODEL := WPJ531
|
|
|
|
|
DEVICE_VARIANT := 16M
|
|
|
|
|
SUPPORTED_DEVICES += wpj531
|
2019-07-25 09:59:56 +00:00
|
|
|
IMAGES += cpximg-7a03.bin cpximg-7a04.bin cpximg-7a06.bin cpximg-7a07.bin
|
|
|
|
|
IMAGE/cpximg-7a03.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | pad-rootfs | mkmylofw_16m 0x68a 2
|
|
|
|
|
IMAGE/cpximg-7a04.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | pad-rootfs | mkmylofw_16m 0x693 3
|
|
|
|
|
IMAGE/cpximg-7a06.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | pad-rootfs | mkmylofw_16m 0x693 3
|
|
|
|
|
IMAGE/cpximg-7a07.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | pad-rootfs | mkmylofw_16m 0x693 3
|
2019-07-25 01:06:32 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += compex_wpj531-16m
|
|
|
|
|
|
2021-06-08 09:52:18 +00:00
|
|
|
define Device/compex_wpj558-16m
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
IMAGE_SIZE := 16128k
|
|
|
|
|
DEVICE_VENDOR := Compex
|
|
|
|
|
DEVICE_MODEL := WPJ558
|
|
|
|
|
DEVICE_VARIANT := 16M
|
|
|
|
|
SUPPORTED_DEVICES += wpj558
|
|
|
|
|
IMAGES += cpximg-6a07.bin
|
|
|
|
|
IMAGE/cpximg-6a07.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | mkmylofw_16m 0x691 3
|
|
|
|
|
DEVICE_PACKAGES := kmod-gpio-beeper
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += compex_wpj558-16m
|
|
|
|
|
|
2019-07-26 18:34:01 +00:00
|
|
|
define Device/compex_wpj563
|
|
|
|
|
SOC := qca9563
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb3
|
|
|
|
|
IMAGE_SIZE := 16128k
|
|
|
|
|
DEVICE_VENDOR := Compex
|
|
|
|
|
DEVICE_MODEL := WPJ563
|
|
|
|
|
SUPPORTED_DEVICES += wpj563
|
|
|
|
|
IMAGES += cpximg-7a02.bin
|
|
|
|
|
IMAGE/cpximg-7a02.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | pad-rootfs | mkmylofw_16m 0x694 2
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += compex_wpj563
|
|
|
|
|
|
2021-02-18 22:12:01 +00:00
|
|
|
define Device/devolo_dlan-pro-1200plus-ac
|
|
|
|
|
SOC := ar9344
|
2022-11-17 16:17:54 +00:00
|
|
|
DEVICE_VENDOR := devolo
|
2021-02-18 22:12:01 +00:00
|
|
|
DEVICE_MODEL := dLAN pro 1200+ WiFi ac
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
|
|
|
|
IMAGE_SIZE := 15872k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += devolo_dlan-pro-1200plus-ac
|
|
|
|
|
|
2020-06-16 21:26:50 +00:00
|
|
|
define Device/devolo_wifi-pro
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9558
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := devolo
|
2018-12-27 01:32:38 +00:00
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
endef
|
2020-06-16 21:26:50 +00:00
|
|
|
|
|
|
|
|
define Device/devolo_dvl1200e
|
|
|
|
|
$(Device/devolo_wifi-pro)
|
|
|
|
|
DEVICE_MODEL := WiFi pro 1200e
|
|
|
|
|
endef
|
2018-12-27 01:32:38 +00:00
|
|
|
TARGET_DEVICES += devolo_dvl1200e
|
|
|
|
|
|
2019-01-01 18:17:23 +00:00
|
|
|
define Device/devolo_dvl1200i
|
2020-06-16 21:26:50 +00:00
|
|
|
$(Device/devolo_wifi-pro)
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_MODEL := WiFi pro 1200i
|
2019-01-01 18:17:23 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += devolo_dvl1200i
|
|
|
|
|
|
2018-12-27 01:32:39 +00:00
|
|
|
define Device/devolo_dvl1750c
|
2020-06-16 21:26:50 +00:00
|
|
|
$(Device/devolo_wifi-pro)
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_MODEL := WiFi pro 1750c
|
2018-12-27 01:32:39 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += devolo_dvl1750c
|
|
|
|
|
|
2019-01-20 16:46:42 +00:00
|
|
|
define Device/devolo_dvl1750e
|
2020-06-16 21:26:50 +00:00
|
|
|
$(Device/devolo_wifi-pro)
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_MODEL := WiFi pro 1750e
|
2020-06-16 21:26:50 +00:00
|
|
|
DEVICE_PACKAGES += kmod-usb2
|
2019-01-20 16:46:42 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += devolo_dvl1750e
|
|
|
|
|
|
2019-01-01 18:17:22 +00:00
|
|
|
define Device/devolo_dvl1750i
|
2020-06-16 21:26:50 +00:00
|
|
|
$(Device/devolo_wifi-pro)
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_MODEL := WiFi pro 1750i
|
2019-01-01 18:17:22 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += devolo_dvl1750i
|
|
|
|
|
|
2019-06-11 15:27:51 +00:00
|
|
|
define Device/devolo_dvl1750x
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9558
|
2019-06-11 15:27:51 +00:00
|
|
|
DEVICE_VENDOR := devolo
|
|
|
|
|
DEVICE_MODEL := WiFi pro 1750x
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += devolo_dvl1750x
|
|
|
|
|
|
ath79: add support for Devolo Magic 2 WIFI
This patch support Devolo Magic 2 WIFI, board devolo_dlan2-2400-ac.
This device is a plc wifi AC2400 router/extender with 2 Ethernet
ports, has a G.hn PLC and uses LCMP protocol from Home Grid Forum.
Hardware:
SoC: AR9344
CPU: 560 MHz
Flash: 16 MiB (W25Q128JVSIQ)
RAM: 128 MiB DDR2
Ethernet: 2xLAN 10/100/1000
PLC: 88LX5152 (MaxLinear G.hn)
PLC Flash: W25Q32JVSSIQ
PLC Uplink: 1Gbps MIMO
PLC Link: RGMII 1Gbps (WAN)
WiFi: Atheros AR9340 2.4GHz 802.11bgn
Atheros AR9882-BR4A 5GHz 802.11ac
Switch: QCA8337, Port0:CPU, Port2:PLC, Port3:LAN1, Port4:LAN2
Button: 3x Buttons (Reset, wifi and plc)
LED: 3x Leds (wifi, plc white, plc red)
GPIO Switch: 11-PLC Pairing (Active Low)
13-PLC Enable
21-WLAN power
MACs Details verified with the stock firmware:
Radio1: 2.4 GHz &wmac *:4c Art location: 0x1002
Radio0: 5.0 GHz &pcie *:4d Art location: 0x5006
Ethernet ðernet *:4e = 2.4 GHz + 2
PLC uplink --- *:4f = 2.4 GHz + 3
Label MAC address is from PLC uplink
OEM SSID: echo devolo-$(grep SerialNumber /dev/mtd1 | grep -o ...$)
OEM WiFi password: grep DlanSecurityID /dev/mtd1|tr -d -|cut -d'=' -f 2
Recommendations: Configure and link your PLC with OEM firmware
BEFORE you flash the device. PLC configuration/link should
remain in different memory and should work straight forward
after flashing.
Restrictions: PLC link detection to trigger plc red led is not
available. PLC G.hn chip is not compatible with open-plc-tools,
it uses LCMP protocol with AES-128 and requires different
software.
Notes: Pairing should be possible with gpio switch. Default
configuration will trigger wifi led with 2.4Ghz wifi traffic
and plc white led with wan traffic.
Flash instruction (TFTP):
1. Set PC to fixed ip address 192.168.0.100
2. Download the sysupgrade image and rename it to uploadfile
3. Start a tftp server with the image file in its root directory
4. Turn off the router
5. Press and hold Reset button
6. Turn on router with the reset button pressed and wait ~15 seconds
7. Release the reset button and after a short time
the firmware should be transferred from the tftp server
8. Allow 1-2 minutes for the first boot.
Signed-off-by: Manuel Giganto <mgigantoregistros@gmail.com>
2019-09-16 10:25:23 +00:00
|
|
|
define Device/devolo_magic-2-wifi
|
|
|
|
|
SOC := ar9344
|
2022-11-17 16:17:54 +00:00
|
|
|
DEVICE_VENDOR := devolo
|
ath79: add support for Devolo Magic 2 WIFI
This patch support Devolo Magic 2 WIFI, board devolo_dlan2-2400-ac.
This device is a plc wifi AC2400 router/extender with 2 Ethernet
ports, has a G.hn PLC and uses LCMP protocol from Home Grid Forum.
Hardware:
SoC: AR9344
CPU: 560 MHz
Flash: 16 MiB (W25Q128JVSIQ)
RAM: 128 MiB DDR2
Ethernet: 2xLAN 10/100/1000
PLC: 88LX5152 (MaxLinear G.hn)
PLC Flash: W25Q32JVSSIQ
PLC Uplink: 1Gbps MIMO
PLC Link: RGMII 1Gbps (WAN)
WiFi: Atheros AR9340 2.4GHz 802.11bgn
Atheros AR9882-BR4A 5GHz 802.11ac
Switch: QCA8337, Port0:CPU, Port2:PLC, Port3:LAN1, Port4:LAN2
Button: 3x Buttons (Reset, wifi and plc)
LED: 3x Leds (wifi, plc white, plc red)
GPIO Switch: 11-PLC Pairing (Active Low)
13-PLC Enable
21-WLAN power
MACs Details verified with the stock firmware:
Radio1: 2.4 GHz &wmac *:4c Art location: 0x1002
Radio0: 5.0 GHz &pcie *:4d Art location: 0x5006
Ethernet ðernet *:4e = 2.4 GHz + 2
PLC uplink --- *:4f = 2.4 GHz + 3
Label MAC address is from PLC uplink
OEM SSID: echo devolo-$(grep SerialNumber /dev/mtd1 | grep -o ...$)
OEM WiFi password: grep DlanSecurityID /dev/mtd1|tr -d -|cut -d'=' -f 2
Recommendations: Configure and link your PLC with OEM firmware
BEFORE you flash the device. PLC configuration/link should
remain in different memory and should work straight forward
after flashing.
Restrictions: PLC link detection to trigger plc red led is not
available. PLC G.hn chip is not compatible with open-plc-tools,
it uses LCMP protocol with AES-128 and requires different
software.
Notes: Pairing should be possible with gpio switch. Default
configuration will trigger wifi led with 2.4Ghz wifi traffic
and plc white led with wan traffic.
Flash instruction (TFTP):
1. Set PC to fixed ip address 192.168.0.100
2. Download the sysupgrade image and rename it to uploadfile
3. Start a tftp server with the image file in its root directory
4. Turn off the router
5. Press and hold Reset button
6. Turn on router with the reset button pressed and wait ~15 seconds
7. Release the reset button and after a short time
the firmware should be transferred from the tftp server
8. Allow 1-2 minutes for the first boot.
Signed-off-by: Manuel Giganto <mgigantoregistros@gmail.com>
2019-09-16 10:25:23 +00:00
|
|
|
DEVICE_MODEL := Magic 2 WiFi
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
|
|
|
|
IMAGE_SIZE := 15872k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += devolo_magic-2-wifi
|
|
|
|
|
|
2020-06-03 19:15:09 +00:00
|
|
|
define Device/dlink_dap-13xx
|
|
|
|
|
SOC := qca9533
|
|
|
|
|
DEVICE_VENDOR := D-Link
|
|
|
|
|
DEVICE_PACKAGES += rssileds
|
|
|
|
|
IMAGE_SIZE := 7936k
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | check-size | mkdapimg2 0xE0000
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/dlink_dap-1330-a1
|
|
|
|
|
$(Device/dlink_dap-13xx)
|
|
|
|
|
DEVICE_MODEL := DAP-1330
|
|
|
|
|
DEVICE_VARIANT := A1
|
|
|
|
|
DAP_SIGNATURE := HONEYBEE-FIRMWARE-DAP-1330
|
|
|
|
|
SUPPORTED_DEVICES += dap-1330-a1
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dap-1330-a1
|
|
|
|
|
|
|
|
|
|
define Device/dlink_dap-1365-a1
|
|
|
|
|
$(Device/dlink_dap-13xx)
|
|
|
|
|
DEVICE_MODEL := DAP-1365
|
|
|
|
|
DEVICE_VARIANT := A1
|
|
|
|
|
DAP_SIGNATURE := HONEYBEE-FIRMWARE-DAP-1365
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dap-1365-a1
|
|
|
|
|
|
ath79: add support for D-Link DAP-2660 A1
Specifications:
* QCA9557, 16 MiB Flash, 128 MiB RAM, 802.11n 2T2R
* QCA9882, 802.11ac 2T2R
* Gigabit LAN Port (AR8035), 802.11af PoE
Installation:
* Factory Web UI is at 192.168.0.50
login with 'admin' and blank password, flash factory.bin
* Recovery Web UI is at 192.168.0.50
connect network cable, hold reset button during power-on and keep it
pressed until uploading has started (only required when checksum is ok,
e.g. for reverting back to oem firmware), flash factory.bin
After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2020-09-29 18:02:17 +00:00
|
|
|
define Device/dlink_dap-2xxx
|
2020-12-27 23:41:51 +00:00
|
|
|
IMAGES += factory.img
|
ath79: add support for D-Link DAP-2660 A1
Specifications:
* QCA9557, 16 MiB Flash, 128 MiB RAM, 802.11n 2T2R
* QCA9882, 802.11ac 2T2R
* Gigabit LAN Port (AR8035), 802.11af PoE
Installation:
* Factory Web UI is at 192.168.0.50
login with 'admin' and blank password, flash factory.bin
* Recovery Web UI is at 192.168.0.50
connect network cable, hold reset button during power-on and keep it
pressed until uploading has started (only required when checksum is ok,
e.g. for reverting back to oem firmware), flash factory.bin
After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2020-09-29 18:02:17 +00:00
|
|
|
IMAGE/factory.img := append-kernel | pad-offset 6144k 160 | \
|
|
|
|
|
append-rootfs | wrgg-pad-rootfs | mkwrggimg | check-size
|
|
|
|
|
IMAGE/sysupgrade.bin := append-kernel | mkwrggimg | \
|
2022-06-22 21:38:26 +00:00
|
|
|
pad-to $$$$(BLOCKSIZE) | append-rootfs | wrgg-pad-rootfs | \
|
|
|
|
|
check-size | append-metadata
|
ath79: add support for D-Link DAP-2660 A1
Specifications:
* QCA9557, 16 MiB Flash, 128 MiB RAM, 802.11n 2T2R
* QCA9882, 802.11ac 2T2R
* Gigabit LAN Port (AR8035), 802.11af PoE
Installation:
* Factory Web UI is at 192.168.0.50
login with 'admin' and blank password, flash factory.bin
* Recovery Web UI is at 192.168.0.50
connect network cable, hold reset button during power-on and keep it
pressed until uploading has started (only required when checksum is ok,
e.g. for reverting back to oem firmware), flash factory.bin
After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2020-09-29 18:02:17 +00:00
|
|
|
KERNEL := kernel-bin | append-dtb | relocate-kernel | lzma
|
|
|
|
|
KERNEL_INITRAMFS := $$(KERNEL) | mkwrggimg
|
|
|
|
|
endef
|
ath79: add support for D-Link DAP-2230 A1
Specifications:
* QCA9533, 16 MiB Flash, 64 MiB RAM, 802.11n 2T2R
* 10/100 Ethernet Port, 802.11af PoE
Installation:
* Factory Web UI is at 192.168.0.50
login with 'admin' and blank password, flash factory.bin
* Recovery Web UI is at 192.168.0.50
connect network cable, hold reset button during power-on and keep it
pressed until uploading has started (only required when checksum is ok,
e.g. for reverting back to oem firmware), flash factory.bin
After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2020-06-16 22:11:37 +00:00
|
|
|
|
|
|
|
|
define Device/dlink_dap-2230-a1
|
|
|
|
|
$(Device/dlink_dap-2xxx)
|
|
|
|
|
SOC := qca9533
|
|
|
|
|
DEVICE_VENDOR := D-Link
|
|
|
|
|
DEVICE_MODEL := DAP-2230
|
|
|
|
|
DEVICE_VARIANT := A1
|
|
|
|
|
IMAGE_SIZE := 15232k
|
|
|
|
|
DAP_SIGNATURE := wapn31_dkbs_dap2230
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dap-2230-a1
|
ath79: add support for D-Link DAP-2660 A1
Specifications:
* QCA9557, 16 MiB Flash, 128 MiB RAM, 802.11n 2T2R
* QCA9882, 802.11ac 2T2R
* Gigabit LAN Port (AR8035), 802.11af PoE
Installation:
* Factory Web UI is at 192.168.0.50
login with 'admin' and blank password, flash factory.bin
* Recovery Web UI is at 192.168.0.50
connect network cable, hold reset button during power-on and keep it
pressed until uploading has started (only required when checksum is ok,
e.g. for reverting back to oem firmware), flash factory.bin
After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2020-09-29 18:02:17 +00:00
|
|
|
|
|
|
|
|
define Device/dlink_dap-2660-a1
|
|
|
|
|
$(Device/dlink_dap-2xxx)
|
|
|
|
|
SOC := qca9557
|
|
|
|
|
DEVICE_VENDOR := D-Link
|
|
|
|
|
DEVICE_MODEL := DAP-2660
|
|
|
|
|
DEVICE_VARIANT := A1
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
|
|
|
|
|
IMAGE_SIZE := 15232k
|
|
|
|
|
DAP_SIGNATURE := wapac09_dkbs_dap2660
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dap-2660-a1
|
|
|
|
|
|
ath79: add support for D-Link DAP-2680 A1
Specifications:
* QCA9558, 16 MiB Flash, 256 MiB RAM, 802.11n 3T3R
* QCA9984, 802.11ac Wave 2 3T3R
* Gigabit LAN Port (AR8035), 802.11at PoE
Installation:
* Factory Web UI is at 192.168.0.50
login with 'admin' and blank password, flash factory.bin
* Recovery Web UI is at 192.168.0.50
connect network cable, hold reset button during power-on and keep it
pressed until uploading has started (only required when checksum is ok,
e.g. for reverting back to oem firmware), flash factory.bin
After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2020-12-02 20:31:19 +00:00
|
|
|
define Device/dlink_dap-2680-a1
|
|
|
|
|
$(Device/dlink_dap-2xxx)
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := D-Link
|
|
|
|
|
DEVICE_MODEL := DAP-2680
|
|
|
|
|
DEVICE_VARIANT := A1
|
2022-05-21 20:59:06 +00:00
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca9984-ct kmod-ath10k-ct
|
ath79: add support for D-Link DAP-2680 A1
Specifications:
* QCA9558, 16 MiB Flash, 256 MiB RAM, 802.11n 3T3R
* QCA9984, 802.11ac Wave 2 3T3R
* Gigabit LAN Port (AR8035), 802.11at PoE
Installation:
* Factory Web UI is at 192.168.0.50
login with 'admin' and blank password, flash factory.bin
* Recovery Web UI is at 192.168.0.50
connect network cable, hold reset button during power-on and keep it
pressed until uploading has started (only required when checksum is ok,
e.g. for reverting back to oem firmware), flash factory.bin
After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2020-12-02 20:31:19 +00:00
|
|
|
IMAGE_SIZE := 15232k
|
|
|
|
|
DAP_SIGNATURE := wapac36_dkbs_dap2680
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dap-2680-a1
|
|
|
|
|
|
ath79: add support for D-Link DAP-2695-A1
Hardware:
* SoC: Qualcomm Atheros QCA9558
* RAM: 256MB
* Flash: 16MB SPI NOR
* Ethernet: 2x 10/100/1000 (1x 802.3at PoE-PD)
* WiFi 2.4GHz: Qualcomm Atheros QCA9558
* WiFi 5GHz: Qualcomm Ahteros QCA9880-2R4E
* LEDS: 1x 5GHz, 1x 2.4GHz, 1x LAN1(POE), 1x LAN2, 1x POWER
* Buttons: 1x RESET
* UART: 1x RJ45 RS-232 Console port
Installation via stock firmware:
* Install the factory image via the stock firmware web interface
Installation via bootloader Emergency Web Server:
* Connect your PC to the LAN1(PoE) port
* Configure your PC with IP address 192.168.0.90
* Open a serial console to the Console port (115200,8n1)
* Press "q" within 2s when "press 'q' to stop autoboot" appears
* Open http://192.168.0.50 in a browser
* Upload either the factory or the sysupgrade image
* Once you see "write image into flash...OK,dest addr=0x9f070000" you
can power-cycle the device. Ignore "checksum bad" messages.
Setting the MAC addresses for the ethernet interfaces via
/etc/board.d/02_network adds the following snippets to
/etc/config/network:
config device 'lan_eth0_1_dev'
option name 'eth0.1'
option macaddr 'xx:xx:xx:xx:xx:xx'
config device 'wan_eth1_2_dev'
option name 'eth1.2'
option macaddr 'xx:xx:xx:xx:xx:xx'
This would result in the proper MAC addresses being set for the VLAN
subinterfaces, but the parent interfaces would still have a random MAC
address. Using untagged VLANs could solve this, but would still leave
those extra snippets in /etc/config/network, and then the device VLAN
setup would differ from the one used in ar71xx. Therefore, the MAC
addresses of the ethernet interfaces are being set via preinit instead.
The bdcfg partition contains 4 MAC address labels:
- lanmac
- wanmac
- wlanmac
- wlanmac_a
The first 3 all contain the same MAC address, which is also the one on
the label.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-06-07 23:11:34 +00:00
|
|
|
define Device/dlink_dap-2695-a1
|
2020-11-30 17:20:18 +00:00
|
|
|
$(Device/dlink_dap-2xxx)
|
ath79: add support for D-Link DAP-2695-A1
Hardware:
* SoC: Qualcomm Atheros QCA9558
* RAM: 256MB
* Flash: 16MB SPI NOR
* Ethernet: 2x 10/100/1000 (1x 802.3at PoE-PD)
* WiFi 2.4GHz: Qualcomm Atheros QCA9558
* WiFi 5GHz: Qualcomm Ahteros QCA9880-2R4E
* LEDS: 1x 5GHz, 1x 2.4GHz, 1x LAN1(POE), 1x LAN2, 1x POWER
* Buttons: 1x RESET
* UART: 1x RJ45 RS-232 Console port
Installation via stock firmware:
* Install the factory image via the stock firmware web interface
Installation via bootloader Emergency Web Server:
* Connect your PC to the LAN1(PoE) port
* Configure your PC with IP address 192.168.0.90
* Open a serial console to the Console port (115200,8n1)
* Press "q" within 2s when "press 'q' to stop autoboot" appears
* Open http://192.168.0.50 in a browser
* Upload either the factory or the sysupgrade image
* Once you see "write image into flash...OK,dest addr=0x9f070000" you
can power-cycle the device. Ignore "checksum bad" messages.
Setting the MAC addresses for the ethernet interfaces via
/etc/board.d/02_network adds the following snippets to
/etc/config/network:
config device 'lan_eth0_1_dev'
option name 'eth0.1'
option macaddr 'xx:xx:xx:xx:xx:xx'
config device 'wan_eth1_2_dev'
option name 'eth1.2'
option macaddr 'xx:xx:xx:xx:xx:xx'
This would result in the proper MAC addresses being set for the VLAN
subinterfaces, but the parent interfaces would still have a random MAC
address. Using untagged VLANs could solve this, but would still leave
those extra snippets in /etc/config/network, and then the device VLAN
setup would differ from the one used in ar71xx. Therefore, the MAC
addresses of the ethernet interfaces are being set via preinit instead.
The bdcfg partition contains 4 MAC address labels:
- lanmac
- wanmac
- wlanmac
- wlanmac_a
The first 3 all contain the same MAC address, which is also the one on
the label.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-06-07 23:11:34 +00:00
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := D-Link
|
2021-08-23 20:34:43 +00:00
|
|
|
DEVICE_MODEL := DAP-2695
|
ath79: add support for D-Link DAP-2695-A1
Hardware:
* SoC: Qualcomm Atheros QCA9558
* RAM: 256MB
* Flash: 16MB SPI NOR
* Ethernet: 2x 10/100/1000 (1x 802.3at PoE-PD)
* WiFi 2.4GHz: Qualcomm Atheros QCA9558
* WiFi 5GHz: Qualcomm Ahteros QCA9880-2R4E
* LEDS: 1x 5GHz, 1x 2.4GHz, 1x LAN1(POE), 1x LAN2, 1x POWER
* Buttons: 1x RESET
* UART: 1x RJ45 RS-232 Console port
Installation via stock firmware:
* Install the factory image via the stock firmware web interface
Installation via bootloader Emergency Web Server:
* Connect your PC to the LAN1(PoE) port
* Configure your PC with IP address 192.168.0.90
* Open a serial console to the Console port (115200,8n1)
* Press "q" within 2s when "press 'q' to stop autoboot" appears
* Open http://192.168.0.50 in a browser
* Upload either the factory or the sysupgrade image
* Once you see "write image into flash...OK,dest addr=0x9f070000" you
can power-cycle the device. Ignore "checksum bad" messages.
Setting the MAC addresses for the ethernet interfaces via
/etc/board.d/02_network adds the following snippets to
/etc/config/network:
config device 'lan_eth0_1_dev'
option name 'eth0.1'
option macaddr 'xx:xx:xx:xx:xx:xx'
config device 'wan_eth1_2_dev'
option name 'eth1.2'
option macaddr 'xx:xx:xx:xx:xx:xx'
This would result in the proper MAC addresses being set for the VLAN
subinterfaces, but the parent interfaces would still have a random MAC
address. Using untagged VLANs could solve this, but would still leave
those extra snippets in /etc/config/network, and then the device VLAN
setup would differ from the one used in ar71xx. Therefore, the MAC
addresses of the ethernet interfaces are being set via preinit instead.
The bdcfg partition contains 4 MAC address labels:
- lanmac
- wanmac
- wlanmac
- wlanmac_a
The first 3 all contain the same MAC address, which is also the one on
the label.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-06-07 23:11:34 +00:00
|
|
|
DEVICE_VARIANT := A1
|
2020-11-30 17:20:18 +00:00
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
|
ath79: add support for D-Link DAP-2695-A1
Hardware:
* SoC: Qualcomm Atheros QCA9558
* RAM: 256MB
* Flash: 16MB SPI NOR
* Ethernet: 2x 10/100/1000 (1x 802.3at PoE-PD)
* WiFi 2.4GHz: Qualcomm Atheros QCA9558
* WiFi 5GHz: Qualcomm Ahteros QCA9880-2R4E
* LEDS: 1x 5GHz, 1x 2.4GHz, 1x LAN1(POE), 1x LAN2, 1x POWER
* Buttons: 1x RESET
* UART: 1x RJ45 RS-232 Console port
Installation via stock firmware:
* Install the factory image via the stock firmware web interface
Installation via bootloader Emergency Web Server:
* Connect your PC to the LAN1(PoE) port
* Configure your PC with IP address 192.168.0.90
* Open a serial console to the Console port (115200,8n1)
* Press "q" within 2s when "press 'q' to stop autoboot" appears
* Open http://192.168.0.50 in a browser
* Upload either the factory or the sysupgrade image
* Once you see "write image into flash...OK,dest addr=0x9f070000" you
can power-cycle the device. Ignore "checksum bad" messages.
Setting the MAC addresses for the ethernet interfaces via
/etc/board.d/02_network adds the following snippets to
/etc/config/network:
config device 'lan_eth0_1_dev'
option name 'eth0.1'
option macaddr 'xx:xx:xx:xx:xx:xx'
config device 'wan_eth1_2_dev'
option name 'eth1.2'
option macaddr 'xx:xx:xx:xx:xx:xx'
This would result in the proper MAC addresses being set for the VLAN
subinterfaces, but the parent interfaces would still have a random MAC
address. Using untagged VLANs could solve this, but would still leave
those extra snippets in /etc/config/network, and then the device VLAN
setup would differ from the one used in ar71xx. Therefore, the MAC
addresses of the ethernet interfaces are being set via preinit instead.
The bdcfg partition contains 4 MAC address labels:
- lanmac
- wanmac
- wlanmac
- wlanmac_a
The first 3 all contain the same MAC address, which is also the one on
the label.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-06-07 23:11:34 +00:00
|
|
|
IMAGE_SIZE := 15360k
|
|
|
|
|
DAP_SIGNATURE := wapac02_dkbs_dap2695
|
|
|
|
|
SUPPORTED_DEVICES += dap-2695-a1
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dap-2695-a1
|
|
|
|
|
|
ath79: add support for D-Link DAP-3320 A1
Specifications:
* QCA9533, 16 MiB Flash, 64 MiB RAM, 802.11n 2T2R
* 10/100 Ethernet Port, 802.11af PoE
* IP55 pole-mountable outdoor case
Installation:
* Factory Web UI is at 192.168.0.50
login with 'admin' and blank password, flash factory.bin
* Recovery Web UI is at 192.168.0.50
connect network cable, hold reset button during power-on and keep it
pressed until uploading has started (only required when checksum is ok,
e.g. for reverting back to oem firmware), flash factory.bin
After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2020-11-30 19:09:29 +00:00
|
|
|
define Device/dlink_dap-3320-a1
|
|
|
|
|
$(Device/dlink_dap-2xxx)
|
|
|
|
|
SOC := qca9533
|
|
|
|
|
DEVICE_VENDOR := D-Link
|
|
|
|
|
DEVICE_MODEL := DAP-3320
|
|
|
|
|
DEVICE_VARIANT := A1
|
|
|
|
|
IMAGE_SIZE := 15296k
|
|
|
|
|
DAP_SIGNATURE := wapn29_dkbs_dap3320
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dap-3320-a1
|
|
|
|
|
|
ath79: add support for D-Link DAP-3662 A1
Specifications:
* QCA9557, 16 MiB Flash, 128 MiB RAM, 802.11n 2T2R
* QCA9882, 802.11ac 2T2R
* 2x Gigabit LAN (1x 802.11af PoE)
* IP68 pole-mountable outdoor case
Installation:
* Factory Web UI is at 192.168.0.50
login with 'admin' and blank password, flash factory.bin
* Recovery Web UI is at 192.168.0.50
connect network cable, hold reset button during power-on and keep it
pressed until uploading has started (only required when checksum is ok,
e.g. for reverting back to oem firmware), flash factory.bin
After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.
Both ethernet ports are set to LAN by default, matching the labelling on
the case. However, since both GMAC Interfaces eth0 and eth1 are connected
to the switch (QCA8337), the user may create an additional 'wan' interface
as desired and override the vlan id settings to map br-lan / wan to either
the PoE or non-PoE port, depending on the individual scenario of use.
So, the LAN and WAN ports would then be connected to different GMACs, e.g.
config interface 'lan'
option ifname 'eth0.1'
...
config interface 'wan'
option ifname 'eth1.2'
...
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '1 0t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '2 6t'
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
[add configuration example]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-01 21:34:34 +00:00
|
|
|
define Device/dlink_dap-3662-a1
|
|
|
|
|
$(Device/dlink_dap-2xxx)
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := D-Link
|
|
|
|
|
DEVICE_MODEL := DAP-3662
|
|
|
|
|
DEVICE_VARIANT := A1
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
|
|
|
|
|
IMAGE_SIZE := 15296k
|
|
|
|
|
DAP_SIGNATURE := wapac11_dkbs_dap3662
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dap-3662-a1
|
|
|
|
|
|
2020-05-13 15:37:31 +00:00
|
|
|
define Device/dlink_dch-g020-a1
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := D-Link
|
|
|
|
|
DEVICE_MODEL := DCH-G020
|
|
|
|
|
DEVICE_VARIANT := A1
|
|
|
|
|
DEVICE_PACKAGES := kmod-gpio-pca953x kmod-i2c-gpio kmod-usb2 kmod-usb-acm
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE_SIZE := 14784k
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | check-size | mkdapimg2 0x20000
|
|
|
|
|
DAP_SIGNATURE := HONEYBEE-FIRMWARE-DCH-G020
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dch-g020-a1
|
|
|
|
|
|
2020-01-12 19:20:43 +00:00
|
|
|
define Device/dlink_dir-505
|
|
|
|
|
SOC := ar9330
|
|
|
|
|
DEVICE_VENDOR := D-Link
|
|
|
|
|
DEVICE_MODEL := DIR-505
|
|
|
|
|
IMAGE_SIZE := 7680k
|
2021-10-21 13:51:48 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2
|
2020-01-12 19:20:43 +00:00
|
|
|
SUPPORTED_DEVICES += dir-505-a1
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dir-505
|
|
|
|
|
|
2023-01-19 14:20:59 +00:00
|
|
|
define Device/dlink_dir-629-a1
|
|
|
|
|
$(Device/seama)
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
IMAGE_SIZE := 7616k
|
|
|
|
|
DEVICE_VENDOR := D-Link
|
|
|
|
|
DEVICE_MODEL := DIR-629
|
|
|
|
|
DEVICE_VARIANT := A1
|
|
|
|
|
DEVICE_PACKAGES := -uboot-envtools
|
|
|
|
|
SEAMA_MTDBLOCK := 6
|
|
|
|
|
SEAMA_SIGNATURE := wrgn83_dlob.hans_dir629
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dir-629-a1
|
|
|
|
|
|
2018-08-09 17:49:29 +00:00
|
|
|
define Device/dlink_dir-825-b1
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar7161
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := D-Link
|
|
|
|
|
DEVICE_MODEL := DIR-825
|
|
|
|
|
DEVICE_VARIANT := B1
|
2019-12-19 19:42:19 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2 kmod-usb-ledtrig-usbport \
|
2022-04-27 17:58:33 +00:00
|
|
|
kmod-leds-reset kmod-owl-loader kmod-switch-rtl8366s
|
2022-11-10 19:55:11 +00:00
|
|
|
IMAGE_SIZE := 7808k
|
|
|
|
|
FACTORY_SIZE := 6144k
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin = append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | \
|
|
|
|
|
pad-rootfs | check-size $$$$(FACTORY_SIZE) | pad-to $$$$(FACTORY_SIZE) | \
|
|
|
|
|
append-string 01AP94-AR7161-RT-080619-00
|
2018-08-09 17:49:29 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dir-825-b1
|
|
|
|
|
|
2018-12-01 18:41:34 +00:00
|
|
|
define Device/dlink_dir-825-c1
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9344
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := D-Link
|
|
|
|
|
DEVICE_MODEL := DIR-825
|
|
|
|
|
DEVICE_VARIANT := C1
|
2019-12-19 19:42:19 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport kmod-leds-reset \
|
|
|
|
|
kmod-owl-loader
|
2018-12-01 18:41:34 +00:00
|
|
|
SUPPORTED_DEVICES += dir-825-c1
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
IMAGES := factory.bin sysupgrade.bin
|
2019-12-19 19:42:19 +00:00
|
|
|
IMAGE/default := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | \
|
|
|
|
|
pad-rootfs
|
2018-12-17 20:56:56 +00:00
|
|
|
IMAGE/factory.bin := $$(IMAGE/default) | pad-offset $$$$(IMAGE_SIZE) 26 | \
|
2020-03-10 13:58:27 +00:00
|
|
|
append-string 00DB120AR9344-RT-101214-00 | check-size
|
2021-06-20 16:54:36 +00:00
|
|
|
IMAGE/sysupgrade.bin := $$(IMAGE/default) | check-size | append-metadata
|
2018-12-01 18:41:34 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dir-825-c1
|
|
|
|
|
|
|
|
|
|
define Device/dlink_dir-835-a1
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9344
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := D-Link
|
|
|
|
|
DEVICE_MODEL := DIR-835
|
|
|
|
|
DEVICE_VARIANT := A1
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-leds-reset kmod-owl-loader
|
2018-12-01 18:41:34 +00:00
|
|
|
SUPPORTED_DEVICES += dir-835-a1
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
IMAGES := factory.bin sysupgrade.bin
|
2019-12-19 19:42:19 +00:00
|
|
|
IMAGE/default := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | \
|
|
|
|
|
pad-rootfs
|
2018-12-17 20:56:56 +00:00
|
|
|
IMAGE/factory.bin := $$(IMAGE/default) | pad-offset $$$$(IMAGE_SIZE) 26 | \
|
2020-03-10 13:58:27 +00:00
|
|
|
append-string 00DB120AR9344-RT-101214-00 | check-size
|
2021-06-20 16:54:36 +00:00
|
|
|
IMAGE/sysupgrade.bin := $$(IMAGE/default) | check-size | append-metadata
|
2018-12-01 18:41:34 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dir-835-a1
|
|
|
|
|
|
2019-07-25 14:44:11 +00:00
|
|
|
define Device/dlink_dir-842-c
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9563
|
2019-07-20 07:37:12 +00:00
|
|
|
DEVICE_VENDOR := D-Link
|
|
|
|
|
DEVICE_MODEL := DIR-842
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | relocate-kernel | lzma
|
|
|
|
|
KERNEL_INITRAMFS := $$(KERNEL) | seama
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
SEAMA_MTDBLOCK := 5
|
|
|
|
|
SEAMA_SIGNATURE := wrgac65_dlink.2015_dir842
|
|
|
|
|
# 64 bytes offset:
|
|
|
|
|
# - 28 bytes seama_header
|
|
|
|
|
# - 36 bytes of META data (4-bytes aligned)
|
2019-12-19 19:42:19 +00:00
|
|
|
IMAGE/default := append-kernel | uImage lzma | \
|
|
|
|
|
pad-offset $$$$(BLOCKSIZE) 64 | append-rootfs
|
|
|
|
|
IMAGE/sysupgrade.bin := $$(IMAGE/default) | seama | pad-rootfs | \
|
2021-06-20 16:54:36 +00:00
|
|
|
check-size | append-metadata
|
2019-12-19 19:42:19 +00:00
|
|
|
IMAGE/factory.bin := $$(IMAGE/default) | pad-rootfs -x 64 | seama | \
|
2020-03-10 13:58:27 +00:00
|
|
|
seama-seal | check-size
|
2019-07-20 07:37:12 +00:00
|
|
|
IMAGE_SIZE := 15680k
|
2019-07-25 14:44:11 +00:00
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/dlink_dir-842-c1
|
2019-08-09 12:19:51 +00:00
|
|
|
$(Device/dlink_dir-842-c)
|
|
|
|
|
DEVICE_VARIANT := C1
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct
|
2019-07-25 14:44:11 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dir-842-c1
|
|
|
|
|
|
|
|
|
|
define Device/dlink_dir-842-c2
|
2019-08-09 12:19:51 +00:00
|
|
|
$(Device/dlink_dir-842-c)
|
|
|
|
|
DEVICE_VARIANT := C2
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca9888-ct
|
2019-07-20 07:37:12 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dir-842-c2
|
|
|
|
|
|
2019-08-07 17:25:13 +00:00
|
|
|
define Device/dlink_dir-842-c3
|
2019-08-09 12:19:51 +00:00
|
|
|
$(Device/dlink_dir-842-c)
|
|
|
|
|
DEVICE_VARIANT := C3
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct
|
2019-08-07 17:25:13 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dir-842-c3
|
|
|
|
|
|
2019-08-22 12:34:45 +00:00
|
|
|
define Device/dlink_dir-859-a1
|
|
|
|
|
$(Device/seama)
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9563
|
2019-08-22 12:34:45 +00:00
|
|
|
DEVICE_VENDOR := D-Link
|
|
|
|
|
DEVICE_MODEL := DIR-859
|
|
|
|
|
DEVICE_VARIANT := A1
|
|
|
|
|
IMAGE_SIZE := 15872k
|
2019-12-22 20:05:13 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct-smallbuffers ath10k-firmware-qca988x-ct
|
2019-08-22 12:34:45 +00:00
|
|
|
SEAMA_SIGNATURE := wrgac37_dlink.2013gui_dir859
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += dlink_dir-859-a1
|
|
|
|
|
|
2018-12-29 15:55:35 +00:00
|
|
|
define Device/elecom_wrc-1750ghbk2-i
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9563
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := ELECOM
|
|
|
|
|
DEVICE_MODEL := WRC-1750GHBK2-I/C
|
2018-12-29 15:55:35 +00:00
|
|
|
IMAGE_SIZE := 15808k
|
2022-08-01 04:40:10 +00:00
|
|
|
ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
|
|
|
|
|
ARTIFACTS := initramfs-factory.bin
|
|
|
|
|
ARTIFACT/initramfs-factory.bin := append-image initramfs-kernel.bin | \
|
|
|
|
|
pad-to 2 | edimax-header -b -s CSYS -m RN68 -f 0x70000 -S 0x01100000 | \
|
|
|
|
|
elecom-product-header WRC-1750GHBK2 | check-size
|
|
|
|
|
endif
|
2018-12-29 15:55:35 +00:00
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += elecom_wrc-1750ghbk2-i
|
|
|
|
|
|
2018-09-10 07:30:28 +00:00
|
|
|
define Device/elecom_wrc-300ghbk2-i
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9563
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := ELECOM
|
|
|
|
|
DEVICE_MODEL := WRC-300GHBK2-I
|
2018-09-10 07:30:28 +00:00
|
|
|
IMAGE_SIZE := 7616k
|
2022-08-01 04:40:10 +00:00
|
|
|
ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
|
|
|
|
|
ARTIFACTS := initramfs-factory.bin
|
|
|
|
|
ARTIFACT/initramfs-factory.bin := append-image initramfs-kernel.bin | \
|
|
|
|
|
pad-to 2 | edimax-header -b -s CSYS -m RN51 -f 0x70000 -S 0x01100000 | \
|
|
|
|
|
elecom-product-header WRC-300GHBK2-I | check-size
|
|
|
|
|
endif
|
2018-09-10 07:30:28 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += elecom_wrc-300ghbk2-i
|
|
|
|
|
|
2021-12-02 10:07:54 +00:00
|
|
|
define Device/embeddedwireless_balin
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_VENDOR := Embedded Wireless
|
|
|
|
|
DEVICE_MODEL := Balin
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += embeddedwireless_balin
|
|
|
|
|
|
2018-05-08 05:22:38 +00:00
|
|
|
define Device/embeddedwireless_dorin
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9331
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := Embedded Wireless
|
|
|
|
|
DEVICE_MODEL := Dorin
|
2018-05-06 08:20:11 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2
|
2018-05-07 19:09:44 +00:00
|
|
|
IMAGE_SIZE := 16000k
|
2018-05-06 08:20:11 +00:00
|
|
|
endef
|
2018-05-08 05:22:38 +00:00
|
|
|
TARGET_DEVICES += embeddedwireless_dorin
|
2018-05-06 08:20:11 +00:00
|
|
|
|
ath79: add support for Senao Engenius EAP1200H
FCC ID: A8J-EAP1200H
Engenius EAP1200H is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
**Specification:**
- QCA9557 SOC
- QCA9882 WLAN PCI card, 5 GHz, 2x2, 26dBm
- AR8035-A PHY RGMII GbE with PoE+ IN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16FG
- UART at J10 populated
- 4 internal antenna plates (5 dbi, omni-directional)
- 5 LEDs, 1 button (power, eth0, 2G, 5G, WPS) (reset)
**MAC addresses:**
MAC addresses are labeled as ETH, 2.4G, and 5GHz
Only one Vendor MAC address in flash
eth0 ETH *:a2 art 0x0
phy1 2.4G *:a3 ---
phy0 5GHz *:a4 ---
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin at J10
**Installation:**
2 ways to flash factory.bin from OEM:
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will brick the device
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery:**
Requires serial console, reset button does nothing
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board, interrupt boot
execute tftpboot and bootm 0x81000000
NOTE: TFTP is not reliable due to bugged bootloader
set MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of EAP1200H is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-ar71xx-generic-eap1200h-uImage-lzma.bin
openwrt-ar71xx-generic-eap1200h-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
Newer EnGenius software requires more checks but their script
includes a way to skip them, otherwise the tar must include
a text file with the version and md5sums in a deprecated format.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied
at the PHY side, using the at803x driver `phy-mode`.
Therefore the PLL registers for GMAC0
do not need the bits for delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2021-01-10 07:40:00 +00:00
|
|
|
define Device/engenius_eap1200h
|
2021-02-12 18:24:32 +00:00
|
|
|
$(Device/senao_loader_okli)
|
ath79: add support for Senao Engenius EAP1200H
FCC ID: A8J-EAP1200H
Engenius EAP1200H is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
**Specification:**
- QCA9557 SOC
- QCA9882 WLAN PCI card, 5 GHz, 2x2, 26dBm
- AR8035-A PHY RGMII GbE with PoE+ IN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16FG
- UART at J10 populated
- 4 internal antenna plates (5 dbi, omni-directional)
- 5 LEDs, 1 button (power, eth0, 2G, 5G, WPS) (reset)
**MAC addresses:**
MAC addresses are labeled as ETH, 2.4G, and 5GHz
Only one Vendor MAC address in flash
eth0 ETH *:a2 art 0x0
phy1 2.4G *:a3 ---
phy0 5GHz *:a4 ---
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin at J10
**Installation:**
2 ways to flash factory.bin from OEM:
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will brick the device
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery:**
Requires serial console, reset button does nothing
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board, interrupt boot
execute tftpboot and bootm 0x81000000
NOTE: TFTP is not reliable due to bugged bootloader
set MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of EAP1200H is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-ar71xx-generic-eap1200h-uImage-lzma.bin
openwrt-ar71xx-generic-eap1200h-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
Newer EnGenius software requires more checks but their script
includes a way to skip them, otherwise the tar must include
a text file with the version and md5sums in a deprecated format.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied
at the PHY side, using the at803x driver `phy-mode`.
Therefore the PLL registers for GMAC0
do not need the bits for delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2021-01-10 07:40:00 +00:00
|
|
|
SOC := qca9557
|
2021-02-12 18:24:32 +00:00
|
|
|
DEVICE_VENDOR := EnGenius
|
ath79: add support for Senao Engenius EAP1200H
FCC ID: A8J-EAP1200H
Engenius EAP1200H is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
**Specification:**
- QCA9557 SOC
- QCA9882 WLAN PCI card, 5 GHz, 2x2, 26dBm
- AR8035-A PHY RGMII GbE with PoE+ IN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16FG
- UART at J10 populated
- 4 internal antenna plates (5 dbi, omni-directional)
- 5 LEDs, 1 button (power, eth0, 2G, 5G, WPS) (reset)
**MAC addresses:**
MAC addresses are labeled as ETH, 2.4G, and 5GHz
Only one Vendor MAC address in flash
eth0 ETH *:a2 art 0x0
phy1 2.4G *:a3 ---
phy0 5GHz *:a4 ---
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin at J10
**Installation:**
2 ways to flash factory.bin from OEM:
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will brick the device
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery:**
Requires serial console, reset button does nothing
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board, interrupt boot
execute tftpboot and bootm 0x81000000
NOTE: TFTP is not reliable due to bugged bootloader
set MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of EAP1200H is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-ar71xx-generic-eap1200h-uImage-lzma.bin
openwrt-ar71xx-generic-eap1200h-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
Newer EnGenius software requires more checks but their script
includes a way to skip them, otherwise the tar must include
a text file with the version and md5sums in a deprecated format.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied
at the PHY side, using the at803x driver `phy-mode`.
Therefore the PLL registers for GMAC0
do not need the bits for delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2021-01-10 07:40:00 +00:00
|
|
|
DEVICE_MODEL := EAP1200H
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
|
2021-02-25 03:55:09 +00:00
|
|
|
IMAGE_SIZE := 11584k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x220000
|
2021-02-12 18:24:32 +00:00
|
|
|
SENAO_IMGNAME := ar71xx-generic-eap1200h
|
ath79: add support for Senao Engenius EAP1200H
FCC ID: A8J-EAP1200H
Engenius EAP1200H is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
**Specification:**
- QCA9557 SOC
- QCA9882 WLAN PCI card, 5 GHz, 2x2, 26dBm
- AR8035-A PHY RGMII GbE with PoE+ IN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16FG
- UART at J10 populated
- 4 internal antenna plates (5 dbi, omni-directional)
- 5 LEDs, 1 button (power, eth0, 2G, 5G, WPS) (reset)
**MAC addresses:**
MAC addresses are labeled as ETH, 2.4G, and 5GHz
Only one Vendor MAC address in flash
eth0 ETH *:a2 art 0x0
phy1 2.4G *:a3 ---
phy0 5GHz *:a4 ---
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin at J10
**Installation:**
2 ways to flash factory.bin from OEM:
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will brick the device
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery:**
Requires serial console, reset button does nothing
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board, interrupt boot
execute tftpboot and bootm 0x81000000
NOTE: TFTP is not reliable due to bugged bootloader
set MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of EAP1200H is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-ar71xx-generic-eap1200h-uImage-lzma.bin
openwrt-ar71xx-generic-eap1200h-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
Newer EnGenius software requires more checks but their script
includes a way to skip them, otherwise the tar must include
a text file with the version and md5sums in a deprecated format.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied
at the PHY side, using the at803x driver `phy-mode`.
Therefore the PLL registers for GMAC0
do not need the bits for delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2021-01-10 07:40:00 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += engenius_eap1200h
|
|
|
|
|
|
ath79: add support for Senao Engenius EAP1750H
FCC ID: A8J-EAP1750H
Engenius EAP1750H is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
**Specification:**
- QCA9558 SOC
- QCA9880 WLAN PCI card, 5 GHz, 3x3, 26dBm
- AR8035-A PHY RGMII GbE with PoE+ IN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16FG
- UART at J10 populated
- 4 internal antenna plates (5 dbi, omni-directional)
- 5 LEDs, 1 button (power, eth0, 2G, 5G, WPS) (reset)
**MAC addresses:**
MAC addresses are labeled as ETH, 2.4G, and 5GHz
Only one Vendor MAC address in flash
eth0 ETH *:fb art 0x0
phy1 2.4G *:fc ---
phy0 5GHz *:fd ---
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin at J10
**Installation:**
2 ways to flash factory.bin from OEM:
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery:**
Requires serial console, reset button does nothing
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board, interrupt boot
execute tftpboot and bootm 0x81000000
NOTE: TFTP is not reliable due to bugged bootloader
set MTU to 600 and try many times
if your TFTP server supports setting block size
higher block size is better.
**Format of OEM firmware image:**
The OEM software of EAP1750H is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-ar71xx-generic-eap1750h-uImage-lzma.bin
openwrt-ar71xx-generic-eap1750h-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
Newer EnGenius software requires more checks but their script
includes a way to skip them, otherwise the tar must include
a text file with the version and md5sums in a deprecated format.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied
at the PHY side, using the at803x driver `phy-mode`.
Therefore the PLL registers for GMAC0
do not need the bits for delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2021-03-24 06:26:11 +00:00
|
|
|
define Device/engenius_eap1750h
|
|
|
|
|
$(Device/senao_loader_okli)
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := EnGenius
|
|
|
|
|
DEVICE_MODEL := EAP1750H
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
|
|
|
|
|
IMAGE_SIZE := 11584k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x220000
|
|
|
|
|
SENAO_IMGNAME := ar71xx-generic-eap1750h
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += engenius_eap1750h
|
|
|
|
|
|
ath79: add support for Senao Engenius EAP300 v2
FCC ID: A8J-EAP300A
Engenius EAP300 v2 is an indoor wireless access point with a
100/10-BaseT ethernet port, 2.4 GHz wireless, internal antennas,
and 802.3af PoE.
**Specification:**
- AR9341
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 64 MB RAM
- UART at J1 (populated)
- Ethernet port with POE
- internal antennas
- 3 LEDs, 1 button (power, eth, wlan) (reset)
**MAC addresses:**
phy0 *:d3 art 0x1002 (label)
eth0 *:d4 art 0x0/0x6
**Installation:**
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, can cause kernel loop or halt
The easiest way to return to the OEM software is the Failsafe image
If you dont have a serial cable, you can ssh into openwrt and run
`mtd -r erase fakeroot`
Wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery** (unstable / not reliable):
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board while holding or pressing reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of EAP300 v2 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel size to be no greater than 1536k
and otherwise the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[clarify MAC address section, bump PKG_RELEASE for uboot-envtools]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-11-05 00:32:27 +00:00
|
|
|
define Device/engenius_eap300-v2
|
2021-02-12 18:24:32 +00:00
|
|
|
$(Device/senao_loader_okli)
|
ath79: add support for Senao Engenius EAP300 v2
FCC ID: A8J-EAP300A
Engenius EAP300 v2 is an indoor wireless access point with a
100/10-BaseT ethernet port, 2.4 GHz wireless, internal antennas,
and 802.3af PoE.
**Specification:**
- AR9341
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 64 MB RAM
- UART at J1 (populated)
- Ethernet port with POE
- internal antennas
- 3 LEDs, 1 button (power, eth, wlan) (reset)
**MAC addresses:**
phy0 *:d3 art 0x1002 (label)
eth0 *:d4 art 0x0/0x6
**Installation:**
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, can cause kernel loop or halt
The easiest way to return to the OEM software is the Failsafe image
If you dont have a serial cable, you can ssh into openwrt and run
`mtd -r erase fakeroot`
Wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery** (unstable / not reliable):
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board while holding or pressing reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of EAP300 v2 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel size to be no greater than 1536k
and otherwise the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[clarify MAC address section, bump PKG_RELEASE for uboot-envtools]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-11-05 00:32:27 +00:00
|
|
|
SOC := ar9341
|
2021-02-12 18:24:32 +00:00
|
|
|
DEVICE_VENDOR := EnGenius
|
ath79: add support for Senao Engenius EAP300 v2
FCC ID: A8J-EAP300A
Engenius EAP300 v2 is an indoor wireless access point with a
100/10-BaseT ethernet port, 2.4 GHz wireless, internal antennas,
and 802.3af PoE.
**Specification:**
- AR9341
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 64 MB RAM
- UART at J1 (populated)
- Ethernet port with POE
- internal antennas
- 3 LEDs, 1 button (power, eth, wlan) (reset)
**MAC addresses:**
phy0 *:d3 art 0x1002 (label)
eth0 *:d4 art 0x0/0x6
**Installation:**
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, can cause kernel loop or halt
The easiest way to return to the OEM software is the Failsafe image
If you dont have a serial cable, you can ssh into openwrt and run
`mtd -r erase fakeroot`
Wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery** (unstable / not reliable):
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board while holding or pressing reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of EAP300 v2 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel size to be no greater than 1536k
and otherwise the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[clarify MAC address section, bump PKG_RELEASE for uboot-envtools]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-11-05 00:32:27 +00:00
|
|
|
DEVICE_MODEL := EAP300
|
|
|
|
|
DEVICE_VARIANT := v2
|
2021-02-25 03:55:09 +00:00
|
|
|
IMAGE_SIZE := 12096k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x220000
|
2021-02-12 18:24:32 +00:00
|
|
|
SENAO_IMGNAME := senao-eap300v2
|
ath79: add support for Senao Engenius EAP300 v2
FCC ID: A8J-EAP300A
Engenius EAP300 v2 is an indoor wireless access point with a
100/10-BaseT ethernet port, 2.4 GHz wireless, internal antennas,
and 802.3af PoE.
**Specification:**
- AR9341
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 64 MB RAM
- UART at J1 (populated)
- Ethernet port with POE
- internal antennas
- 3 LEDs, 1 button (power, eth, wlan) (reset)
**MAC addresses:**
phy0 *:d3 art 0x1002 (label)
eth0 *:d4 art 0x0/0x6
**Installation:**
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, can cause kernel loop or halt
The easiest way to return to the OEM software is the Failsafe image
If you dont have a serial cable, you can ssh into openwrt and run
`mtd -r erase fakeroot`
Wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery** (unstable / not reliable):
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board while holding or pressing reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of EAP300 v2 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel size to be no greater than 1536k
and otherwise the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[clarify MAC address section, bump PKG_RELEASE for uboot-envtools]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-11-05 00:32:27 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += engenius_eap300-v2
|
|
|
|
|
|
ath79: add support for Senao Engenius EAP600
FCC ID: A8J-EAP600
Engenius EAP600 is a wireless access point with 1 gigabit ethernet port,
dual-band wireless, external ethernet switch, 4 internal antennas
and 802.3af PoE.
Specification:
- AR9344 SOC (5 GHz, 2x2, WMAC)
- AR9382 WLAN (2.4 GHz, 2x2, PCIe on-board)
- AR8035-A switch (GbE with 802.3af PoE)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16DG
- UART at H1 (populated)
- 5 LEDs, 1 button (power, eth, 2.4 GHz, 5 GHz, wps) (reset)
- 4 internal antennas
MAC addresses:
MAC addresses are labeled MAC1 and MAC2
The MAC address in flash is not on the label
The OEM software reports these MACs for the ifconfig
eth0 MAC 1 *:5e ---
phy1 MAC 2 *:5f --- (2.4 GHz)
phy0 ----- *:60 art 0x0 (5 GHz)
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Upgrade Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
Format of OEM firmware image:
The OEM software of EAP600 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-eap600-uImage-lzma.bin
openwrt-senao-eap600-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh
Later models in the EAP series likely have a different platform
and the upgrade and image verification process differs.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035-A switch between
the SOC and the ethernet PHY chips.
For AR934x series, the PLL register for GMAC0
can be seen in the DTSI as 0x2c.
Therefore the PLL register can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
Unfortunately uboot did not have the best values
so they were taken from other similar DTS files.
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2020-10-09 16:28:11 +00:00
|
|
|
define Device/engenius_eap600
|
2021-02-12 18:24:32 +00:00
|
|
|
$(Device/senao_loader_okli)
|
ath79: add support for Senao Engenius EAP600
FCC ID: A8J-EAP600
Engenius EAP600 is a wireless access point with 1 gigabit ethernet port,
dual-band wireless, external ethernet switch, 4 internal antennas
and 802.3af PoE.
Specification:
- AR9344 SOC (5 GHz, 2x2, WMAC)
- AR9382 WLAN (2.4 GHz, 2x2, PCIe on-board)
- AR8035-A switch (GbE with 802.3af PoE)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16DG
- UART at H1 (populated)
- 5 LEDs, 1 button (power, eth, 2.4 GHz, 5 GHz, wps) (reset)
- 4 internal antennas
MAC addresses:
MAC addresses are labeled MAC1 and MAC2
The MAC address in flash is not on the label
The OEM software reports these MACs for the ifconfig
eth0 MAC 1 *:5e ---
phy1 MAC 2 *:5f --- (2.4 GHz)
phy0 ----- *:60 art 0x0 (5 GHz)
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Upgrade Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
Format of OEM firmware image:
The OEM software of EAP600 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-eap600-uImage-lzma.bin
openwrt-senao-eap600-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh
Later models in the EAP series likely have a different platform
and the upgrade and image verification process differs.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035-A switch between
the SOC and the ethernet PHY chips.
For AR934x series, the PLL register for GMAC0
can be seen in the DTSI as 0x2c.
Therefore the PLL register can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
Unfortunately uboot did not have the best values
so they were taken from other similar DTS files.
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2020-10-09 16:28:11 +00:00
|
|
|
SOC := ar9344
|
2021-02-12 18:24:32 +00:00
|
|
|
DEVICE_VENDOR := EnGenius
|
ath79: add support for Senao Engenius EAP600
FCC ID: A8J-EAP600
Engenius EAP600 is a wireless access point with 1 gigabit ethernet port,
dual-band wireless, external ethernet switch, 4 internal antennas
and 802.3af PoE.
Specification:
- AR9344 SOC (5 GHz, 2x2, WMAC)
- AR9382 WLAN (2.4 GHz, 2x2, PCIe on-board)
- AR8035-A switch (GbE with 802.3af PoE)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16DG
- UART at H1 (populated)
- 5 LEDs, 1 button (power, eth, 2.4 GHz, 5 GHz, wps) (reset)
- 4 internal antennas
MAC addresses:
MAC addresses are labeled MAC1 and MAC2
The MAC address in flash is not on the label
The OEM software reports these MACs for the ifconfig
eth0 MAC 1 *:5e ---
phy1 MAC 2 *:5f --- (2.4 GHz)
phy0 ----- *:60 art 0x0 (5 GHz)
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Upgrade Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
Format of OEM firmware image:
The OEM software of EAP600 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-eap600-uImage-lzma.bin
openwrt-senao-eap600-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh
Later models in the EAP series likely have a different platform
and the upgrade and image verification process differs.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035-A switch between
the SOC and the ethernet PHY chips.
For AR934x series, the PLL register for GMAC0
can be seen in the DTSI as 0x2c.
Therefore the PLL register can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
Unfortunately uboot did not have the best values
so they were taken from other similar DTS files.
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2020-10-09 16:28:11 +00:00
|
|
|
DEVICE_MODEL := EAP600
|
2021-02-25 03:55:09 +00:00
|
|
|
IMAGE_SIZE := 12096k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x220000
|
2021-02-12 18:24:32 +00:00
|
|
|
SENAO_IMGNAME := senao-eap600
|
ath79: add support for Senao Engenius EAP600
FCC ID: A8J-EAP600
Engenius EAP600 is a wireless access point with 1 gigabit ethernet port,
dual-band wireless, external ethernet switch, 4 internal antennas
and 802.3af PoE.
Specification:
- AR9344 SOC (5 GHz, 2x2, WMAC)
- AR9382 WLAN (2.4 GHz, 2x2, PCIe on-board)
- AR8035-A switch (GbE with 802.3af PoE)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16DG
- UART at H1 (populated)
- 5 LEDs, 1 button (power, eth, 2.4 GHz, 5 GHz, wps) (reset)
- 4 internal antennas
MAC addresses:
MAC addresses are labeled MAC1 and MAC2
The MAC address in flash is not on the label
The OEM software reports these MACs for the ifconfig
eth0 MAC 1 *:5e ---
phy1 MAC 2 *:5f --- (2.4 GHz)
phy0 ----- *:60 art 0x0 (5 GHz)
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Upgrade Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
Format of OEM firmware image:
The OEM software of EAP600 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-eap600-uImage-lzma.bin
openwrt-senao-eap600-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh
Later models in the EAP series likely have a different platform
and the upgrade and image verification process differs.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035-A switch between
the SOC and the ethernet PHY chips.
For AR934x series, the PLL register for GMAC0
can be seen in the DTSI as 0x2c.
Therefore the PLL register can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
Unfortunately uboot did not have the best values
so they were taken from other similar DTS files.
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2020-10-09 16:28:11 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += engenius_eap600
|
|
|
|
|
|
ath79: add support for Senao Engenius ECB1200
FCC ID: A8J-ECB1200
Engenius ECB1200 is an indoor wireless access point with a GbE port,
2.4 GHz and 5 GHz wireless, external antennas, and 802.3af PoE.
**Specification:**
- QCA9557 SOC MIPS, 2.4 GHz (2x2)
- QCA9882 WLAN PCIe card, 5 GHz (2x2)
- AR8035-A switch RGMII, GbE with 802.3af PoE, 25 MHz clock
- 40 MHz reference clock
- 16 MB FLASH 25L12845EMI-10G
- 2x 64 MB RAM 1538ZFZ V59C1512164QEJ25
- UART at JP1 (unpopulated, RX shorted to ground)
- 4 external antennas
- 4 LEDs, 1 button (power, eth, wifi2g, wifi5g) (reset)
**MAC addresses:**
MAC Addresses are labeled as ETH and 5GHZ
U-boot environment has the vendor MAC addresses
MAC addresses in ART do not match vendor
eth0 ETH *:5c u-boot-env ethaddr
phy0 5GHZ *:5d u-boot-env athaddr
---- ---- ???? art 0x0/0x6
**Installation:**
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
(see TFTP recovery)
perform a sysupgrade
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART pinout at JP1
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
Unlike most Engenius boards, this does not have a 'failsafe' image
the only way to return to OEM is TFTP or serial access to u-boot
**TFTP recovery:**
Unlike most Engenius boards, TFTP is reliable here
rename initramfs-kernel.bin to 'ap.bin'
make the file available on a TFTP server at 192.168.1.10
power board while holding or pressing reset button repeatedly
or with serial access:
run `tftpboot` or `run factory_boot` with initramfs-kernel.bin
then `bootm` with the load address
**Format of OEM firmware image:**
The OEM software of ECB1200 is a heavily modified version
of Openwrt Altitude Adjustment 12.09.
This Engenius board, like ECB1750, uses a proprietary header
with a unique Product ID. The header for factory.bin is
generated by the mksenaofw program included in openwrt.
**Note on PLL-data cells:**
The default PLL register values will not work
because of the AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
However the registers that u-boot sets are not ideal and sometimes wrong...
the at803x driver supports setting the RGMII clock/data delay on the PHY side.
This way the pll-data register only needs to handle invert and phase.
for this board clock invert is needed on the MAC side
all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2020-11-01 01:23:33 +00:00
|
|
|
define Device/engenius_ecb1200
|
|
|
|
|
SOC := qca9557
|
|
|
|
|
DEVICE_VENDOR := EnGenius
|
|
|
|
|
DEVICE_MODEL := ECB1200
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
|
|
|
|
|
IMAGE_SIZE := 15680k
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | check-size | \
|
|
|
|
|
senao-header -r 0x101 -p 0x6e -t 2
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += engenius_ecb1200
|
|
|
|
|
|
2020-09-25 18:04:54 +00:00
|
|
|
define Device/engenius_ecb1750
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := EnGenius
|
|
|
|
|
DEVICE_MODEL := ECB1750
|
2020-11-27 00:11:15 +00:00
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
|
2020-09-25 18:04:54 +00:00
|
|
|
IMAGE_SIZE := 15680k
|
2020-11-27 00:11:15 +00:00
|
|
|
IMAGES += factory.bin
|
2020-09-25 18:04:54 +00:00
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | check-size | \
|
|
|
|
|
senao-header -r 0x101 -p 0x6d -t 2
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += engenius_ecb1750
|
|
|
|
|
|
ath79: add support for Senao Engenius ECB600
FCC ID: A8J-ECB600
Engenius ECB600 is a wireless access point with 1 gigabit PoE ethernet port,
dual-band wireless, external ethernet switch, and 4 external antennas.
Specification:
- AR9344 SOC (5 GHz, 2x2, WMAC)
- AR9382 WLAN (2.4 GHz, 2x2, PCIe on-board)
- AR8035-A switch (GbE with 802.3af PoE)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16DG
- UART at H1 (populated)
- 4 LEDs, 1 button (power, eth, 2.4 GHz, 5 GHz) (reset)
- 4 external antennas
MAC addresses:
MAC addresses are labeled MAC1 and MAC2
The MAC address in flash is not on the label
The OEM software reports these MACs for the ifconfig
phy1 MAC 1 *:52 --- (2.4 GHz)
phy0 MAC 2 *:53 --- (5 GHz)
eth0 ----- *:54 art 0x0
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Upgrade Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
Format of OEM firmware image:
The OEM software of ECB600 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-ecb600-uImage-lzma.bin
openwrt-senao-ecb600-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh
Later models in the ECB series likely have a different platform
and the upgrade and image verification process differs.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035-A switch between
the SOC and the ethernet PHY chips.
For AR934x series, the PLL register for GMAC0
can be seen in the DTSI as 0x2c.
Therefore the PLL register can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
Unfortunately uboot did not have the best values
so they were taken from other similar DTS files.
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2020-09-15 17:44:39 +00:00
|
|
|
define Device/engenius_ecb600
|
2021-02-12 18:24:32 +00:00
|
|
|
$(Device/senao_loader_okli)
|
ath79: add support for Senao Engenius ECB600
FCC ID: A8J-ECB600
Engenius ECB600 is a wireless access point with 1 gigabit PoE ethernet port,
dual-band wireless, external ethernet switch, and 4 external antennas.
Specification:
- AR9344 SOC (5 GHz, 2x2, WMAC)
- AR9382 WLAN (2.4 GHz, 2x2, PCIe on-board)
- AR8035-A switch (GbE with 802.3af PoE)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16DG
- UART at H1 (populated)
- 4 LEDs, 1 button (power, eth, 2.4 GHz, 5 GHz) (reset)
- 4 external antennas
MAC addresses:
MAC addresses are labeled MAC1 and MAC2
The MAC address in flash is not on the label
The OEM software reports these MACs for the ifconfig
phy1 MAC 1 *:52 --- (2.4 GHz)
phy0 MAC 2 *:53 --- (5 GHz)
eth0 ----- *:54 art 0x0
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Upgrade Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
Format of OEM firmware image:
The OEM software of ECB600 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-ecb600-uImage-lzma.bin
openwrt-senao-ecb600-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh
Later models in the ECB series likely have a different platform
and the upgrade and image verification process differs.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035-A switch between
the SOC and the ethernet PHY chips.
For AR934x series, the PLL register for GMAC0
can be seen in the DTSI as 0x2c.
Therefore the PLL register can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
Unfortunately uboot did not have the best values
so they were taken from other similar DTS files.
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2020-09-15 17:44:39 +00:00
|
|
|
SOC := ar9344
|
2021-02-12 18:24:32 +00:00
|
|
|
DEVICE_VENDOR := EnGenius
|
ath79: add support for Senao Engenius ECB600
FCC ID: A8J-ECB600
Engenius ECB600 is a wireless access point with 1 gigabit PoE ethernet port,
dual-band wireless, external ethernet switch, and 4 external antennas.
Specification:
- AR9344 SOC (5 GHz, 2x2, WMAC)
- AR9382 WLAN (2.4 GHz, 2x2, PCIe on-board)
- AR8035-A switch (GbE with 802.3af PoE)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16DG
- UART at H1 (populated)
- 4 LEDs, 1 button (power, eth, 2.4 GHz, 5 GHz) (reset)
- 4 external antennas
MAC addresses:
MAC addresses are labeled MAC1 and MAC2
The MAC address in flash is not on the label
The OEM software reports these MACs for the ifconfig
phy1 MAC 1 *:52 --- (2.4 GHz)
phy0 MAC 2 *:53 --- (5 GHz)
eth0 ----- *:54 art 0x0
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Upgrade Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
Format of OEM firmware image:
The OEM software of ECB600 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-ecb600-uImage-lzma.bin
openwrt-senao-ecb600-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh
Later models in the ECB series likely have a different platform
and the upgrade and image verification process differs.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035-A switch between
the SOC and the ethernet PHY chips.
For AR934x series, the PLL register for GMAC0
can be seen in the DTSI as 0x2c.
Therefore the PLL register can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
Unfortunately uboot did not have the best values
so they were taken from other similar DTS files.
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2020-09-15 17:44:39 +00:00
|
|
|
DEVICE_MODEL := ECB600
|
2021-02-25 03:55:09 +00:00
|
|
|
IMAGE_SIZE := 12096k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x220000
|
2021-02-12 18:24:32 +00:00
|
|
|
SENAO_IMGNAME := senao-ecb600
|
ath79: add support for Senao Engenius ECB600
FCC ID: A8J-ECB600
Engenius ECB600 is a wireless access point with 1 gigabit PoE ethernet port,
dual-band wireless, external ethernet switch, and 4 external antennas.
Specification:
- AR9344 SOC (5 GHz, 2x2, WMAC)
- AR9382 WLAN (2.4 GHz, 2x2, PCIe on-board)
- AR8035-A switch (GbE with 802.3af PoE)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16DG
- UART at H1 (populated)
- 4 LEDs, 1 button (power, eth, 2.4 GHz, 5 GHz) (reset)
- 4 external antennas
MAC addresses:
MAC addresses are labeled MAC1 and MAC2
The MAC address in flash is not on the label
The OEM software reports these MACs for the ifconfig
phy1 MAC 1 *:52 --- (2.4 GHz)
phy0 MAC 2 *:53 --- (5 GHz)
eth0 ----- *:54 art 0x0
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Upgrade Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
Format of OEM firmware image:
The OEM software of ECB600 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-ecb600-uImage-lzma.bin
openwrt-senao-ecb600-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh
Later models in the ECB series likely have a different platform
and the upgrade and image verification process differs.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035-A switch between
the SOC and the ethernet PHY chips.
For AR934x series, the PLL register for GMAC0
can be seen in the DTSI as 0x2c.
Therefore the PLL register can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
Unfortunately uboot did not have the best values
so they were taken from other similar DTS files.
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2020-09-15 17:44:39 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += engenius_ecb600
|
|
|
|
|
|
ath79: add support for Senao Engenius ENS202EXT v1
Engenius ENS202EXT v1 is an outdoor wireless access point with 2 10/100 ports,
with built-in ethernet switch, detachable antennas and proprietery PoE.
FCC ID: A8J-ENS202
Specification:
- Qualcomm/Atheros AR9341 v1
- 535/400/200/40 MHz (CPU/DDR/AHB/REF)
- 64 MB of RAM
- 16 MB of FLASH MX25L12835F(MI-10G)
- UART (J1) header on PCB (unpopulated)
- 2x 10/100 Mbps Ethernet (built-in switch Atheros AR8229)
- 2.4 GHz, up to 27dBm (Atheros AR9340)
- 2x external, detachable antennas
- 7x LED (5 programmable in ath79), 1x GPIO button (Reset)
Known Issues:
- Sysupgrade from ar71xx no longer possible
- Ethernet LEDs stay on solid when connected, not programmable
MAC addresses:
eth0/eth1 *:7b art 0x0/0x6
wlan *:7a art 0x1002
The device label lists both addresses, WLAN MAC and ETH MAC,
in that order.
Since 0x0 and 0x6 have the same content, it cannot be
determined which is eth0 and eth1, so we chose 0x0 for both.
Installation:
2 ways to flash factory.bin from OEM:
- Connect ethernet directly to board (the non POE port)
this is LAN for all images
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
In upper right select Reset
"Restore to factory default settings"
Wait for reboot and login again
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt boot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
*If you are unable to get network/LuCI after flashing*
You must perform another factory reset:
After waiting 3 minutes or when Power LED stop blinking:
Hold Reset button for 15 seconds while powered on
or until Power LED blinks very fast
release and wait 2 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
*DISCLAIMER*
The Failsafe image is unique to this model.
The following directions are unique to this model.
DO NOT downgrade to ar71xx this way, can cause kernel loop
The easiest way to return to the OEM software is the Failsafe image
If you dont have a serial cable, you can ssh into openwrt and run
`mtd -r erase fakeroot`
Wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
TFTP Recovery:
For some reason, TFTP is not reliable on this board.
Takes many attempts, many timeouts before it fully transfers.
Starting with an initramfs.bin:
Connect to ethernet
set IP address and TFTP server to 192.168.1.101
set up infinite ping to 192.168.1.1
rename the initramfs.bin to "vmlinux-art-ramdisk" and host on TFTP server
disconnect power to the board
hold reset button while powering on board for 8 seconds
Wait a minute, power LED should blink eventually if successful
and a minute after that the pings should get replies
You have now loaded a temporary Openwrt with default settings temporarily.
You can use that image to sysupgrade another image to overwrite flash.
Format of OEM firmware image:
The OEM software of ENS202EXT is a heavily modified version
of Openwrt Kamikaze bleeding-edge. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-ens202ext-uImage-lzma.bin
openwrt-senao-ens202ext-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring, and by swapping headers to see
what the OEM upgrade utility accepts and rejects.
Note on the factory.bin:
The newest kernel is too large to be in the kernel partition
the new ath79 kernel is beyond 1592k
Even ath79-tiny is 1580k
Checksum fails at boot because the bootloader (modified uboot)
expects kernel to be 1536k. If the kernel is larger, it gets
overwritten when rootfs is flashed, causing a broken image.
The mtdparts variable is part of the build and saving a new
uboot environment will not persist after flashing.
OEM version might interact with uboot or with the custom
OEM partition at 0x9f050000.
Failed checksums at boot cause failsafe image to launch,
allowing any image to be flashed again.
HOWEVER: one should not install older Openwrt from failsafe
because it can cause rootfs to be unmountable,
causing kernel loop after successful checksum.
The only way to rescue after that is with a serial cable.
For these reasons, a fake kernel (OKLI kernel loader)
and fake squashfs rootfs is implemented to take care of
the OEM firmware image verification and checksums at boot.
The OEM only verifies the checksum of the first image
of each partition respectively, which is the loader
and the fake squashfs. This completely frees
the "firmware" partition from all checks.
virtual_flash is implemented to make use of the wasted space.
this leaves only 2 erase blocks actually wasted.
The loader and fakeroot partitions must remain intact, otherwise
the next boot will fail, redirecting to the Failsafe image.
Because the partition table required is so different
than the OEM partition table and ar71xx partition table,
sysupgrades are not possible until one switches to ath79 kernel.
Note on sysupgrade.tgz:
To make things even more complicated, another change is needed to
fix an issue where network does not work after flashing from either
OEM software or Failsafe image, which implants the OEM (Openwrt Kamikaze)
configuration into the jffs2 /overlay when writing rootfs from factory.bin.
The upgrade script has this:
mtd -j "/tmp/_sys/sysupgrade.tgz" write "${rootfs}" "rootfs"
However, it also accepts scripts before and after:
before_local="/etc/before-upgradelocal.sh"
after_local="/etc/after-upgradelocal.sh"
before="before-upgrade.sh"
after="after-upgrade.sh"
Thus, we can solve the issue by making the .tgz an empty file
by making a before-upgrade.sh in the factory.bin
Note on built-in switch:
There is two ports on the board, POE through the power supply brick,
the other is on the board. For whatever reason, in the ar71xx target,
both ports were on the built-in switch on eth1. In order to make use
of a port for WAN or a different LAN, one has to set up VLANs.
In ath79, eth0 and eth1 is defined in the DTS so that the
built-in switch is seen as eth0, but only for 1 port
the other port is on eth1 without a built-in switch.
eth0: switch0
CPU is port 0
board port is port 1
eth1: POE port on the power brick
Since there is two physical ports,
it can be configured as a full router,
with LAN for both wired and wireless.
According to the Datasheet, the port that is not on the switch
is connected to gmac0. It is preferred that gmac0 is chosen as WAN
over a port on an internal switch, so that link status can pass
to the kernel immediately which is more important for WAN connections.
Signed-off-by: Michael Pratt <mpratt51@gmail.com>
[apply sorting in 01_leds, make factory recipe more generic, create common
device node, move label-mac to 02_network, add MAC addresses to commit
message, remove kmod-leds-gpio, use gzip directly]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-05-11 20:58:02 +00:00
|
|
|
define Device/engenius_ens202ext-v1
|
2021-02-12 18:24:32 +00:00
|
|
|
$(Device/senao_loader_okli)
|
ath79: add support for Senao Engenius ENS202EXT v1
Engenius ENS202EXT v1 is an outdoor wireless access point with 2 10/100 ports,
with built-in ethernet switch, detachable antennas and proprietery PoE.
FCC ID: A8J-ENS202
Specification:
- Qualcomm/Atheros AR9341 v1
- 535/400/200/40 MHz (CPU/DDR/AHB/REF)
- 64 MB of RAM
- 16 MB of FLASH MX25L12835F(MI-10G)
- UART (J1) header on PCB (unpopulated)
- 2x 10/100 Mbps Ethernet (built-in switch Atheros AR8229)
- 2.4 GHz, up to 27dBm (Atheros AR9340)
- 2x external, detachable antennas
- 7x LED (5 programmable in ath79), 1x GPIO button (Reset)
Known Issues:
- Sysupgrade from ar71xx no longer possible
- Ethernet LEDs stay on solid when connected, not programmable
MAC addresses:
eth0/eth1 *:7b art 0x0/0x6
wlan *:7a art 0x1002
The device label lists both addresses, WLAN MAC and ETH MAC,
in that order.
Since 0x0 and 0x6 have the same content, it cannot be
determined which is eth0 and eth1, so we chose 0x0 for both.
Installation:
2 ways to flash factory.bin from OEM:
- Connect ethernet directly to board (the non POE port)
this is LAN for all images
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
In upper right select Reset
"Restore to factory default settings"
Wait for reboot and login again
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt boot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
*If you are unable to get network/LuCI after flashing*
You must perform another factory reset:
After waiting 3 minutes or when Power LED stop blinking:
Hold Reset button for 15 seconds while powered on
or until Power LED blinks very fast
release and wait 2 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
*DISCLAIMER*
The Failsafe image is unique to this model.
The following directions are unique to this model.
DO NOT downgrade to ar71xx this way, can cause kernel loop
The easiest way to return to the OEM software is the Failsafe image
If you dont have a serial cable, you can ssh into openwrt and run
`mtd -r erase fakeroot`
Wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
TFTP Recovery:
For some reason, TFTP is not reliable on this board.
Takes many attempts, many timeouts before it fully transfers.
Starting with an initramfs.bin:
Connect to ethernet
set IP address and TFTP server to 192.168.1.101
set up infinite ping to 192.168.1.1
rename the initramfs.bin to "vmlinux-art-ramdisk" and host on TFTP server
disconnect power to the board
hold reset button while powering on board for 8 seconds
Wait a minute, power LED should blink eventually if successful
and a minute after that the pings should get replies
You have now loaded a temporary Openwrt with default settings temporarily.
You can use that image to sysupgrade another image to overwrite flash.
Format of OEM firmware image:
The OEM software of ENS202EXT is a heavily modified version
of Openwrt Kamikaze bleeding-edge. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-ens202ext-uImage-lzma.bin
openwrt-senao-ens202ext-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring, and by swapping headers to see
what the OEM upgrade utility accepts and rejects.
Note on the factory.bin:
The newest kernel is too large to be in the kernel partition
the new ath79 kernel is beyond 1592k
Even ath79-tiny is 1580k
Checksum fails at boot because the bootloader (modified uboot)
expects kernel to be 1536k. If the kernel is larger, it gets
overwritten when rootfs is flashed, causing a broken image.
The mtdparts variable is part of the build and saving a new
uboot environment will not persist after flashing.
OEM version might interact with uboot or with the custom
OEM partition at 0x9f050000.
Failed checksums at boot cause failsafe image to launch,
allowing any image to be flashed again.
HOWEVER: one should not install older Openwrt from failsafe
because it can cause rootfs to be unmountable,
causing kernel loop after successful checksum.
The only way to rescue after that is with a serial cable.
For these reasons, a fake kernel (OKLI kernel loader)
and fake squashfs rootfs is implemented to take care of
the OEM firmware image verification and checksums at boot.
The OEM only verifies the checksum of the first image
of each partition respectively, which is the loader
and the fake squashfs. This completely frees
the "firmware" partition from all checks.
virtual_flash is implemented to make use of the wasted space.
this leaves only 2 erase blocks actually wasted.
The loader and fakeroot partitions must remain intact, otherwise
the next boot will fail, redirecting to the Failsafe image.
Because the partition table required is so different
than the OEM partition table and ar71xx partition table,
sysupgrades are not possible until one switches to ath79 kernel.
Note on sysupgrade.tgz:
To make things even more complicated, another change is needed to
fix an issue where network does not work after flashing from either
OEM software or Failsafe image, which implants the OEM (Openwrt Kamikaze)
configuration into the jffs2 /overlay when writing rootfs from factory.bin.
The upgrade script has this:
mtd -j "/tmp/_sys/sysupgrade.tgz" write "${rootfs}" "rootfs"
However, it also accepts scripts before and after:
before_local="/etc/before-upgradelocal.sh"
after_local="/etc/after-upgradelocal.sh"
before="before-upgrade.sh"
after="after-upgrade.sh"
Thus, we can solve the issue by making the .tgz an empty file
by making a before-upgrade.sh in the factory.bin
Note on built-in switch:
There is two ports on the board, POE through the power supply brick,
the other is on the board. For whatever reason, in the ar71xx target,
both ports were on the built-in switch on eth1. In order to make use
of a port for WAN or a different LAN, one has to set up VLANs.
In ath79, eth0 and eth1 is defined in the DTS so that the
built-in switch is seen as eth0, but only for 1 port
the other port is on eth1 without a built-in switch.
eth0: switch0
CPU is port 0
board port is port 1
eth1: POE port on the power brick
Since there is two physical ports,
it can be configured as a full router,
with LAN for both wired and wireless.
According to the Datasheet, the port that is not on the switch
is connected to gmac0. It is preferred that gmac0 is chosen as WAN
over a port on an internal switch, so that link status can pass
to the kernel immediately which is more important for WAN connections.
Signed-off-by: Michael Pratt <mpratt51@gmail.com>
[apply sorting in 01_leds, make factory recipe more generic, create common
device node, move label-mac to 02_network, add MAC addresses to commit
message, remove kmod-leds-gpio, use gzip directly]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-05-11 20:58:02 +00:00
|
|
|
SOC := ar9341
|
2021-02-12 18:24:32 +00:00
|
|
|
DEVICE_VENDOR := EnGenius
|
ath79: add support for Senao Engenius ENS202EXT v1
Engenius ENS202EXT v1 is an outdoor wireless access point with 2 10/100 ports,
with built-in ethernet switch, detachable antennas and proprietery PoE.
FCC ID: A8J-ENS202
Specification:
- Qualcomm/Atheros AR9341 v1
- 535/400/200/40 MHz (CPU/DDR/AHB/REF)
- 64 MB of RAM
- 16 MB of FLASH MX25L12835F(MI-10G)
- UART (J1) header on PCB (unpopulated)
- 2x 10/100 Mbps Ethernet (built-in switch Atheros AR8229)
- 2.4 GHz, up to 27dBm (Atheros AR9340)
- 2x external, detachable antennas
- 7x LED (5 programmable in ath79), 1x GPIO button (Reset)
Known Issues:
- Sysupgrade from ar71xx no longer possible
- Ethernet LEDs stay on solid when connected, not programmable
MAC addresses:
eth0/eth1 *:7b art 0x0/0x6
wlan *:7a art 0x1002
The device label lists both addresses, WLAN MAC and ETH MAC,
in that order.
Since 0x0 and 0x6 have the same content, it cannot be
determined which is eth0 and eth1, so we chose 0x0 for both.
Installation:
2 ways to flash factory.bin from OEM:
- Connect ethernet directly to board (the non POE port)
this is LAN for all images
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
In upper right select Reset
"Restore to factory default settings"
Wait for reboot and login again
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt boot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
*If you are unable to get network/LuCI after flashing*
You must perform another factory reset:
After waiting 3 minutes or when Power LED stop blinking:
Hold Reset button for 15 seconds while powered on
or until Power LED blinks very fast
release and wait 2 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
*DISCLAIMER*
The Failsafe image is unique to this model.
The following directions are unique to this model.
DO NOT downgrade to ar71xx this way, can cause kernel loop
The easiest way to return to the OEM software is the Failsafe image
If you dont have a serial cable, you can ssh into openwrt and run
`mtd -r erase fakeroot`
Wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
TFTP Recovery:
For some reason, TFTP is not reliable on this board.
Takes many attempts, many timeouts before it fully transfers.
Starting with an initramfs.bin:
Connect to ethernet
set IP address and TFTP server to 192.168.1.101
set up infinite ping to 192.168.1.1
rename the initramfs.bin to "vmlinux-art-ramdisk" and host on TFTP server
disconnect power to the board
hold reset button while powering on board for 8 seconds
Wait a minute, power LED should blink eventually if successful
and a minute after that the pings should get replies
You have now loaded a temporary Openwrt with default settings temporarily.
You can use that image to sysupgrade another image to overwrite flash.
Format of OEM firmware image:
The OEM software of ENS202EXT is a heavily modified version
of Openwrt Kamikaze bleeding-edge. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-ens202ext-uImage-lzma.bin
openwrt-senao-ens202ext-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring, and by swapping headers to see
what the OEM upgrade utility accepts and rejects.
Note on the factory.bin:
The newest kernel is too large to be in the kernel partition
the new ath79 kernel is beyond 1592k
Even ath79-tiny is 1580k
Checksum fails at boot because the bootloader (modified uboot)
expects kernel to be 1536k. If the kernel is larger, it gets
overwritten when rootfs is flashed, causing a broken image.
The mtdparts variable is part of the build and saving a new
uboot environment will not persist after flashing.
OEM version might interact with uboot or with the custom
OEM partition at 0x9f050000.
Failed checksums at boot cause failsafe image to launch,
allowing any image to be flashed again.
HOWEVER: one should not install older Openwrt from failsafe
because it can cause rootfs to be unmountable,
causing kernel loop after successful checksum.
The only way to rescue after that is with a serial cable.
For these reasons, a fake kernel (OKLI kernel loader)
and fake squashfs rootfs is implemented to take care of
the OEM firmware image verification and checksums at boot.
The OEM only verifies the checksum of the first image
of each partition respectively, which is the loader
and the fake squashfs. This completely frees
the "firmware" partition from all checks.
virtual_flash is implemented to make use of the wasted space.
this leaves only 2 erase blocks actually wasted.
The loader and fakeroot partitions must remain intact, otherwise
the next boot will fail, redirecting to the Failsafe image.
Because the partition table required is so different
than the OEM partition table and ar71xx partition table,
sysupgrades are not possible until one switches to ath79 kernel.
Note on sysupgrade.tgz:
To make things even more complicated, another change is needed to
fix an issue where network does not work after flashing from either
OEM software or Failsafe image, which implants the OEM (Openwrt Kamikaze)
configuration into the jffs2 /overlay when writing rootfs from factory.bin.
The upgrade script has this:
mtd -j "/tmp/_sys/sysupgrade.tgz" write "${rootfs}" "rootfs"
However, it also accepts scripts before and after:
before_local="/etc/before-upgradelocal.sh"
after_local="/etc/after-upgradelocal.sh"
before="before-upgrade.sh"
after="after-upgrade.sh"
Thus, we can solve the issue by making the .tgz an empty file
by making a before-upgrade.sh in the factory.bin
Note on built-in switch:
There is two ports on the board, POE through the power supply brick,
the other is on the board. For whatever reason, in the ar71xx target,
both ports were on the built-in switch on eth1. In order to make use
of a port for WAN or a different LAN, one has to set up VLANs.
In ath79, eth0 and eth1 is defined in the DTS so that the
built-in switch is seen as eth0, but only for 1 port
the other port is on eth1 without a built-in switch.
eth0: switch0
CPU is port 0
board port is port 1
eth1: POE port on the power brick
Since there is two physical ports,
it can be configured as a full router,
with LAN for both wired and wireless.
According to the Datasheet, the port that is not on the switch
is connected to gmac0. It is preferred that gmac0 is chosen as WAN
over a port on an internal switch, so that link status can pass
to the kernel immediately which is more important for WAN connections.
Signed-off-by: Michael Pratt <mpratt51@gmail.com>
[apply sorting in 01_leds, make factory recipe more generic, create common
device node, move label-mac to 02_network, add MAC addresses to commit
message, remove kmod-leds-gpio, use gzip directly]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-05-11 20:58:02 +00:00
|
|
|
DEVICE_MODEL := ENS202EXT
|
|
|
|
|
DEVICE_VARIANT := v1
|
|
|
|
|
DEVICE_PACKAGES := rssileds
|
2021-02-25 03:55:09 +00:00
|
|
|
IMAGE_SIZE := 12096k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x220000
|
2021-02-12 18:24:32 +00:00
|
|
|
SENAO_IMGNAME := senao-ens202ext
|
ath79: add support for Senao Engenius ENS202EXT v1
Engenius ENS202EXT v1 is an outdoor wireless access point with 2 10/100 ports,
with built-in ethernet switch, detachable antennas and proprietery PoE.
FCC ID: A8J-ENS202
Specification:
- Qualcomm/Atheros AR9341 v1
- 535/400/200/40 MHz (CPU/DDR/AHB/REF)
- 64 MB of RAM
- 16 MB of FLASH MX25L12835F(MI-10G)
- UART (J1) header on PCB (unpopulated)
- 2x 10/100 Mbps Ethernet (built-in switch Atheros AR8229)
- 2.4 GHz, up to 27dBm (Atheros AR9340)
- 2x external, detachable antennas
- 7x LED (5 programmable in ath79), 1x GPIO button (Reset)
Known Issues:
- Sysupgrade from ar71xx no longer possible
- Ethernet LEDs stay on solid when connected, not programmable
MAC addresses:
eth0/eth1 *:7b art 0x0/0x6
wlan *:7a art 0x1002
The device label lists both addresses, WLAN MAC and ETH MAC,
in that order.
Since 0x0 and 0x6 have the same content, it cannot be
determined which is eth0 and eth1, so we chose 0x0 for both.
Installation:
2 ways to flash factory.bin from OEM:
- Connect ethernet directly to board (the non POE port)
this is LAN for all images
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
In upper right select Reset
"Restore to factory default settings"
Wait for reboot and login again
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt boot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
*If you are unable to get network/LuCI after flashing*
You must perform another factory reset:
After waiting 3 minutes or when Power LED stop blinking:
Hold Reset button for 15 seconds while powered on
or until Power LED blinks very fast
release and wait 2 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
*DISCLAIMER*
The Failsafe image is unique to this model.
The following directions are unique to this model.
DO NOT downgrade to ar71xx this way, can cause kernel loop
The easiest way to return to the OEM software is the Failsafe image
If you dont have a serial cable, you can ssh into openwrt and run
`mtd -r erase fakeroot`
Wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
TFTP Recovery:
For some reason, TFTP is not reliable on this board.
Takes many attempts, many timeouts before it fully transfers.
Starting with an initramfs.bin:
Connect to ethernet
set IP address and TFTP server to 192.168.1.101
set up infinite ping to 192.168.1.1
rename the initramfs.bin to "vmlinux-art-ramdisk" and host on TFTP server
disconnect power to the board
hold reset button while powering on board for 8 seconds
Wait a minute, power LED should blink eventually if successful
and a minute after that the pings should get replies
You have now loaded a temporary Openwrt with default settings temporarily.
You can use that image to sysupgrade another image to overwrite flash.
Format of OEM firmware image:
The OEM software of ENS202EXT is a heavily modified version
of Openwrt Kamikaze bleeding-edge. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-ens202ext-uImage-lzma.bin
openwrt-senao-ens202ext-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring, and by swapping headers to see
what the OEM upgrade utility accepts and rejects.
Note on the factory.bin:
The newest kernel is too large to be in the kernel partition
the new ath79 kernel is beyond 1592k
Even ath79-tiny is 1580k
Checksum fails at boot because the bootloader (modified uboot)
expects kernel to be 1536k. If the kernel is larger, it gets
overwritten when rootfs is flashed, causing a broken image.
The mtdparts variable is part of the build and saving a new
uboot environment will not persist after flashing.
OEM version might interact with uboot or with the custom
OEM partition at 0x9f050000.
Failed checksums at boot cause failsafe image to launch,
allowing any image to be flashed again.
HOWEVER: one should not install older Openwrt from failsafe
because it can cause rootfs to be unmountable,
causing kernel loop after successful checksum.
The only way to rescue after that is with a serial cable.
For these reasons, a fake kernel (OKLI kernel loader)
and fake squashfs rootfs is implemented to take care of
the OEM firmware image verification and checksums at boot.
The OEM only verifies the checksum of the first image
of each partition respectively, which is the loader
and the fake squashfs. This completely frees
the "firmware" partition from all checks.
virtual_flash is implemented to make use of the wasted space.
this leaves only 2 erase blocks actually wasted.
The loader and fakeroot partitions must remain intact, otherwise
the next boot will fail, redirecting to the Failsafe image.
Because the partition table required is so different
than the OEM partition table and ar71xx partition table,
sysupgrades are not possible until one switches to ath79 kernel.
Note on sysupgrade.tgz:
To make things even more complicated, another change is needed to
fix an issue where network does not work after flashing from either
OEM software or Failsafe image, which implants the OEM (Openwrt Kamikaze)
configuration into the jffs2 /overlay when writing rootfs from factory.bin.
The upgrade script has this:
mtd -j "/tmp/_sys/sysupgrade.tgz" write "${rootfs}" "rootfs"
However, it also accepts scripts before and after:
before_local="/etc/before-upgradelocal.sh"
after_local="/etc/after-upgradelocal.sh"
before="before-upgrade.sh"
after="after-upgrade.sh"
Thus, we can solve the issue by making the .tgz an empty file
by making a before-upgrade.sh in the factory.bin
Note on built-in switch:
There is two ports on the board, POE through the power supply brick,
the other is on the board. For whatever reason, in the ar71xx target,
both ports were on the built-in switch on eth1. In order to make use
of a port for WAN or a different LAN, one has to set up VLANs.
In ath79, eth0 and eth1 is defined in the DTS so that the
built-in switch is seen as eth0, but only for 1 port
the other port is on eth1 without a built-in switch.
eth0: switch0
CPU is port 0
board port is port 1
eth1: POE port on the power brick
Since there is two physical ports,
it can be configured as a full router,
with LAN for both wired and wireless.
According to the Datasheet, the port that is not on the switch
is connected to gmac0. It is preferred that gmac0 is chosen as WAN
over a port on an internal switch, so that link status can pass
to the kernel immediately which is more important for WAN connections.
Signed-off-by: Michael Pratt <mpratt51@gmail.com>
[apply sorting in 01_leds, make factory recipe more generic, create common
device node, move label-mac to 02_network, add MAC addresses to commit
message, remove kmod-leds-gpio, use gzip directly]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-05-11 20:58:02 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += engenius_ens202ext-v1
|
|
|
|
|
|
ath79: add support for Senao Engenius EnStationAC v1
FCC ID: A8J-ENSTAC
Engenius EnStationAC v1 is an outdoor wireless access point/bridge with
2 gigabit ethernet ports on 2 external ethernet switches,
5 GHz only wireless, internal antenna plates, and proprietery PoE.
Specification:
- QCA9557 SOC
- QCA9882 WLAN (PCI card, 5 GHz, 2x2, 26dBm)
- AR8035-A switch (RGMII GbE with PoE+ IN)
- AR8031 switch (SGMII GbE with PoE OUT)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16FG
- UART at J10 (unpopulated)
- internal antenna plates (19 dbi, directional)
- 7 LEDs, 1 button (power, eth, wlan, RSSI) (reset)
MAC addresses:
MAC addresses are labeled as ETH and 5GHz
Vendor MAC addresses in flash are duplicate
eth0 ETH *:d3 art 0x0/0x6
eth1 ---- *:d4 ---
phy0 5GHz *:d5 ---
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
TFTP recovery:
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board
hold or press reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
Format of OEM firmware image:
The OEM software of EnStationAC is a heavily modified version
of Openwrt Altitude Adjustment 12.09. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-ar71xx-enstationac-uImage-lzma.bin
openwrt-ar71xx-enstationac-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
Newer EnGenius software requires more checks but their script
includes a way to skip them, otherwise the tar must include
a text file with the version and md5sums in a deprecated format.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8033 switch between
the SOC and the ethernet PHY chips.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
For eth0 at 1000 speed, the value returned was
ae000000 but that didn't work, so following
the logical pattern from the rest of the values,
the guessed value of a3000000 works better.
later discovered that delay can be placed on the PHY end only
with phy-mode as 'rgmii-id' and set register to 0x82...
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[fixed SoB to match From:]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2020-08-25 04:17:28 +00:00
|
|
|
define Device/engenius_enstationac-v1
|
2021-02-12 18:24:32 +00:00
|
|
|
$(Device/senao_loader_okli)
|
ath79: add support for Senao Engenius EnStationAC v1
FCC ID: A8J-ENSTAC
Engenius EnStationAC v1 is an outdoor wireless access point/bridge with
2 gigabit ethernet ports on 2 external ethernet switches,
5 GHz only wireless, internal antenna plates, and proprietery PoE.
Specification:
- QCA9557 SOC
- QCA9882 WLAN (PCI card, 5 GHz, 2x2, 26dBm)
- AR8035-A switch (RGMII GbE with PoE+ IN)
- AR8031 switch (SGMII GbE with PoE OUT)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16FG
- UART at J10 (unpopulated)
- internal antenna plates (19 dbi, directional)
- 7 LEDs, 1 button (power, eth, wlan, RSSI) (reset)
MAC addresses:
MAC addresses are labeled as ETH and 5GHz
Vendor MAC addresses in flash are duplicate
eth0 ETH *:d3 art 0x0/0x6
eth1 ---- *:d4 ---
phy0 5GHz *:d5 ---
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
TFTP recovery:
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board
hold or press reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
Format of OEM firmware image:
The OEM software of EnStationAC is a heavily modified version
of Openwrt Altitude Adjustment 12.09. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-ar71xx-enstationac-uImage-lzma.bin
openwrt-ar71xx-enstationac-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
Newer EnGenius software requires more checks but their script
includes a way to skip them, otherwise the tar must include
a text file with the version and md5sums in a deprecated format.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8033 switch between
the SOC and the ethernet PHY chips.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
For eth0 at 1000 speed, the value returned was
ae000000 but that didn't work, so following
the logical pattern from the rest of the values,
the guessed value of a3000000 works better.
later discovered that delay can be placed on the PHY end only
with phy-mode as 'rgmii-id' and set register to 0x82...
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[fixed SoB to match From:]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2020-08-25 04:17:28 +00:00
|
|
|
SOC := qca9557
|
2021-02-12 18:24:32 +00:00
|
|
|
DEVICE_VENDOR := EnGenius
|
ath79: add support for Senao Engenius EnStationAC v1
FCC ID: A8J-ENSTAC
Engenius EnStationAC v1 is an outdoor wireless access point/bridge with
2 gigabit ethernet ports on 2 external ethernet switches,
5 GHz only wireless, internal antenna plates, and proprietery PoE.
Specification:
- QCA9557 SOC
- QCA9882 WLAN (PCI card, 5 GHz, 2x2, 26dBm)
- AR8035-A switch (RGMII GbE with PoE+ IN)
- AR8031 switch (SGMII GbE with PoE OUT)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16FG
- UART at J10 (unpopulated)
- internal antenna plates (19 dbi, directional)
- 7 LEDs, 1 button (power, eth, wlan, RSSI) (reset)
MAC addresses:
MAC addresses are labeled as ETH and 5GHz
Vendor MAC addresses in flash are duplicate
eth0 ETH *:d3 art 0x0/0x6
eth1 ---- *:d4 ---
phy0 5GHz *:d5 ---
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
TFTP recovery:
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board
hold or press reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
Format of OEM firmware image:
The OEM software of EnStationAC is a heavily modified version
of Openwrt Altitude Adjustment 12.09. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-ar71xx-enstationac-uImage-lzma.bin
openwrt-ar71xx-enstationac-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
Newer EnGenius software requires more checks but their script
includes a way to skip them, otherwise the tar must include
a text file with the version and md5sums in a deprecated format.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8033 switch between
the SOC and the ethernet PHY chips.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
For eth0 at 1000 speed, the value returned was
ae000000 but that didn't work, so following
the logical pattern from the rest of the values,
the guessed value of a3000000 works better.
later discovered that delay can be placed on the PHY end only
with phy-mode as 'rgmii-id' and set register to 0x82...
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[fixed SoB to match From:]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2020-08-25 04:17:28 +00:00
|
|
|
DEVICE_MODEL := EnStationAC
|
|
|
|
|
DEVICE_VARIANT := v1
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct rssileds
|
2021-02-25 03:55:09 +00:00
|
|
|
IMAGE_SIZE := 11584k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x220000
|
2021-02-12 18:24:32 +00:00
|
|
|
SENAO_IMGNAME := ar71xx-generic-enstationac
|
ath79: add support for Senao Engenius EnStationAC v1
FCC ID: A8J-ENSTAC
Engenius EnStationAC v1 is an outdoor wireless access point/bridge with
2 gigabit ethernet ports on 2 external ethernet switches,
5 GHz only wireless, internal antenna plates, and proprietery PoE.
Specification:
- QCA9557 SOC
- QCA9882 WLAN (PCI card, 5 GHz, 2x2, 26dBm)
- AR8035-A switch (RGMII GbE with PoE+ IN)
- AR8031 switch (SGMII GbE with PoE OUT)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16FG
- UART at J10 (unpopulated)
- internal antenna plates (19 dbi, directional)
- 7 LEDs, 1 button (power, eth, wlan, RSSI) (reset)
MAC addresses:
MAC addresses are labeled as ETH and 5GHz
Vendor MAC addresses in flash are duplicate
eth0 ETH *:d3 art 0x0/0x6
eth1 ---- *:d4 ---
phy0 5GHz *:d5 ---
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
TFTP recovery:
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board
hold or press reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
Format of OEM firmware image:
The OEM software of EnStationAC is a heavily modified version
of Openwrt Altitude Adjustment 12.09. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-ar71xx-enstationac-uImage-lzma.bin
openwrt-ar71xx-enstationac-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
Newer EnGenius software requires more checks but their script
includes a way to skip them, otherwise the tar must include
a text file with the version and md5sums in a deprecated format.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8033 switch between
the SOC and the ethernet PHY chips.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
For eth0 at 1000 speed, the value returned was
ae000000 but that didn't work, so following
the logical pattern from the rest of the values,
the guessed value of a3000000 works better.
later discovered that delay can be placed on the PHY end only
with phy-mode as 'rgmii-id' and set register to 0x82...
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[fixed SoB to match From:]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2020-08-25 04:17:28 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += engenius_enstationac-v1
|
|
|
|
|
|
ath79: add suport for EnGenius EPG5000
EnGenius EPG5000 (v1.0.0, marketed as IoT Gateway) is a dual band
wireless router.
Specification
SoC: Qualcomm Atheros QCA9558
RAM: 256 MB DDR2
Flash: 16 MB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
5 GHz 3T3R QCA9880 Mini PCIe card
Ethernet: 5x 10/100/1000 Mbps QCA8337N
USB: 1x 2.0
LEDS: 4x GPIO controlled
Buttons: 2x GPIO controlled
UART: 4 pin header, starting count from white triangle on PCB
1. VCC 3.3V, 2. GND, 3. TX, 4. RX
baud: 115200, parity: none, flow control: none
Installation
1. Connect to one of LAN (yellow) ethernet ports,
2. Open router configuration interface,
3. Go to Tools > Firmware,
4. Select OpenWrt factory image with dlf extension and hit Apply,
5. Wait few minutes, after the Power LED will stop blinking, the router
is ready for configuration.
Alternative installation
1. Prepare TFTP server with OpenWrt sysupgrade image,
2. Connect to one of LAN (yellow) ethernet ports,
3. Connect to UART port (leaving out VCC pin!),
4. Power on router,
5. When asked to enter a number 1 or 3 hit 2, this will select flashing
image from TFTP server option,
6. You'll be prompted to enter TFTP server ip (default is 192.168.99.8),
then router ip (default is 192.168.99.9) and for last, image name
downloaded from TFTP server (default is uImageESR1200_1750),
7. After providing all information U-Boot will start flashing the image,
You can observe progress on console, it'll take few minutes and when
the Power LED will stop blinking, router is ready for configuration.
Additional information
If connected to UART, when prompted for number on boot, one can enter
number 4 to open bootloader (U-Boot) command line.
OEM firmware shell password is: aigo3d0a0tdagr
useful for creating backup of original firmware.
When doing upgrade from OpenWrt ar71xx image, it is recomended to not keep
the old configuration.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
2019-03-04 14:18:53 +00:00
|
|
|
define Device/engenius_epg5000
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9558
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := EnGenius
|
|
|
|
|
DEVICE_MODEL := EPG5000
|
ath79: add suport for EnGenius EPG5000
EnGenius EPG5000 (v1.0.0, marketed as IoT Gateway) is a dual band
wireless router.
Specification
SoC: Qualcomm Atheros QCA9558
RAM: 256 MB DDR2
Flash: 16 MB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
5 GHz 3T3R QCA9880 Mini PCIe card
Ethernet: 5x 10/100/1000 Mbps QCA8337N
USB: 1x 2.0
LEDS: 4x GPIO controlled
Buttons: 2x GPIO controlled
UART: 4 pin header, starting count from white triangle on PCB
1. VCC 3.3V, 2. GND, 3. TX, 4. RX
baud: 115200, parity: none, flow control: none
Installation
1. Connect to one of LAN (yellow) ethernet ports,
2. Open router configuration interface,
3. Go to Tools > Firmware,
4. Select OpenWrt factory image with dlf extension and hit Apply,
5. Wait few minutes, after the Power LED will stop blinking, the router
is ready for configuration.
Alternative installation
1. Prepare TFTP server with OpenWrt sysupgrade image,
2. Connect to one of LAN (yellow) ethernet ports,
3. Connect to UART port (leaving out VCC pin!),
4. Power on router,
5. When asked to enter a number 1 or 3 hit 2, this will select flashing
image from TFTP server option,
6. You'll be prompted to enter TFTP server ip (default is 192.168.99.8),
then router ip (default is 192.168.99.9) and for last, image name
downloaded from TFTP server (default is uImageESR1200_1750),
7. After providing all information U-Boot will start flashing the image,
You can observe progress on console, it'll take few minutes and when
the Power LED will stop blinking, router is ready for configuration.
Additional information
If connected to UART, when prompted for number on boot, one can enter
number 4 to open bootloader (U-Boot) command line.
OEM firmware shell password is: aigo3d0a0tdagr
useful for creating backup of original firmware.
When doing upgrade from OpenWrt ar71xx image, it is recomended to not keep
the old configuration.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
2019-03-04 14:18:53 +00:00
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct kmod-usb2
|
|
|
|
|
IMAGE_SIZE := 14656k
|
|
|
|
|
IMAGES += factory.dlf
|
|
|
|
|
IMAGE/factory.dlf := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
2020-03-10 13:58:27 +00:00
|
|
|
append-rootfs | pad-rootfs | check-size | \
|
ath79: add suport for EnGenius EPG5000
EnGenius EPG5000 (v1.0.0, marketed as IoT Gateway) is a dual band
wireless router.
Specification
SoC: Qualcomm Atheros QCA9558
RAM: 256 MB DDR2
Flash: 16 MB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
5 GHz 3T3R QCA9880 Mini PCIe card
Ethernet: 5x 10/100/1000 Mbps QCA8337N
USB: 1x 2.0
LEDS: 4x GPIO controlled
Buttons: 2x GPIO controlled
UART: 4 pin header, starting count from white triangle on PCB
1. VCC 3.3V, 2. GND, 3. TX, 4. RX
baud: 115200, parity: none, flow control: none
Installation
1. Connect to one of LAN (yellow) ethernet ports,
2. Open router configuration interface,
3. Go to Tools > Firmware,
4. Select OpenWrt factory image with dlf extension and hit Apply,
5. Wait few minutes, after the Power LED will stop blinking, the router
is ready for configuration.
Alternative installation
1. Prepare TFTP server with OpenWrt sysupgrade image,
2. Connect to one of LAN (yellow) ethernet ports,
3. Connect to UART port (leaving out VCC pin!),
4. Power on router,
5. When asked to enter a number 1 or 3 hit 2, this will select flashing
image from TFTP server option,
6. You'll be prompted to enter TFTP server ip (default is 192.168.99.8),
then router ip (default is 192.168.99.9) and for last, image name
downloaded from TFTP server (default is uImageESR1200_1750),
7. After providing all information U-Boot will start flashing the image,
You can observe progress on console, it'll take few minutes and when
the Power LED will stop blinking, router is ready for configuration.
Additional information
If connected to UART, when prompted for number on boot, one can enter
number 4 to open bootloader (U-Boot) command line.
OEM firmware shell password is: aigo3d0a0tdagr
useful for creating backup of original firmware.
When doing upgrade from OpenWrt ar71xx image, it is recomended to not keep
the old configuration.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
2019-03-04 14:18:53 +00:00
|
|
|
senao-header -r 0x101 -p 0x71 -t 2
|
|
|
|
|
SUPPORTED_DEVICES += epg5000
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += engenius_epg5000
|
|
|
|
|
|
ath79: add support for Senao Engenius ESR1200
FCC ID: A8J-ESR900
Engenius ESR1200 is an indoor wireless router with
a gigabit ethernet switch, dual-band wireless,
internal antenna plates, and a USB 2.0 port
**Specification:**
- QCA9557 SOC 2.4 GHz, 2x2
- QCA9882 WLAN PCIe mini card, 5 GHz, 2x2
- QCA8337N SW 4 ports LAN, 1 port WAN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM
- UART at J1 populated, RX grounded
- 6 internal antenna plates (omni-directional)
- 5 LEDs, 1 button (power, 2G, 5G, WAN, WPS) (reset)
**MAC addresses:**
Base MAC address labeled as "MAC ADDRESS"
MAC "wanaddr" is not similar to "ethaddr"
eth0 *:c8 MAC u-boot-env ethaddr
phy0 *:c8 MAC u-boot-env ethaddr
phy1 *:c9 --- u-boot-env ethaddr +1
WAN *:66:44 u-boot-env wanaddr
**Serial Access:**
RX on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin
**Installation:**
Method 1: Firmware upgrade page
OEM webpage at 192.168.0.1
username and password "admin"
Navigate to Settings (gear icon) --> Tools --> Firmware
select the factory.bin image
confirm and wait 3 minutes
Method 2: TFTP recovery
Follow TFTP instructions using initramfs.bin
use sysupgrade.bin to flash using openwrt web interface
**Return to OEM:**
MTD partitions should be backed up before flashing
using TFTP to boot openwrt without overwriting flash
Alternatively, it is possible to edit OEM firmware images
to flash MTD partitions in openwrt to restore OEM firmware
by removing the OEM header and writing the rest to "firmware"
**TFTP recovery:**
Requires serial console, reset button does nothing at boot
rename initramfs.bin to 'uImageESR1200'
make available on TFTP server at 192.168.99.8
power board, interrupt boot by pressing '4' rapidly
execute tftpboot and bootm
**Note on ETH switch registers**
Registers must be written to the ethernet switch
in order to set up the switch's MAC interface.
U-boot can write the registers on it's own
which is needed, for example, in a TFTP transfer.
The register bits from OEM for the QCA8337 switch
can be read from interrupted boot (tftpboot, bootm)
by adding print lines in the switch driver ar8327.c
before 'qca,ar8327-initvals' is parsed from DTS and written.
for example:
pr_info("0x04 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD0_MODE));
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-01-25 16:24:00 +00:00
|
|
|
define Device/engenius_esr1200
|
|
|
|
|
SOC := qca9557
|
|
|
|
|
DEVICE_VENDOR := EnGenius
|
|
|
|
|
DEVICE_MODEL := ESR1200
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct kmod-usb2
|
|
|
|
|
IMAGE_SIZE := 14656k
|
|
|
|
|
IMAGES += factory.dlf
|
|
|
|
|
IMAGE/factory.dlf := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | check-size | \
|
|
|
|
|
senao-header -r 0x101 -p 0x61 -t 2
|
|
|
|
|
SUPPORTED_DEVICES += esr1200 esr1750 engenius,esr1750
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += engenius_esr1200
|
|
|
|
|
|
ath79: add support for Senao Engenius ESR1750
FCC ID: A8J-ESR1750
Engenius ESR1750 is an indoor wireless router with
a gigabit ethernet switch, dual-band wireless,
internal antenna plates, and a USB 2.0 port
**Specification:**
- QCA9558 SOC 2.4 GHz, 3x3
- QCA9880 WLAN PCIe mini card, 5 GHz, 3x3
- QCA8337N SW 4 ports LAN, 1 port WAN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM
- UART at J1 populated, RX grounded
- 6 internal antenna plates (omni-directional)
- 5 LEDs, 1 button (power, 2G, 5G, WAN, WPS) (reset)
**MAC addresses:**
Base MAC address labeled as "MAC ADDRESS"
MAC "wanaddr" is similar to "ethaddr"
eth0 *:58 MAC u-boot-env ethaddr
phy0 *:58 MAC u-boot-env ethaddr
phy1 *:59 --- u-boot-env ethaddr +1
WAN *:10:58 u-boot-env wanaddr
**Serial Access:**
RX on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin
**Installation:**
Method 1: Firmware upgrade page
NOTE: ESR1750 might require the factory.bin
for ESR1200 instead, OEM provides 1 image for both.
OEM webpage at 192.168.0.1
username and password "admin"
Navigate to Settings (gear icon) --> Tools --> Firmware
select the factory.bin image
confirm and wait 3 minutes
Method 2: TFTP recovery
Follow TFTP instructions using initramfs.bin
use sysupgrade.bin to flash using openwrt web interface
**Return to OEM:**
MTD partitions should be backed up before flashing
using TFTP to boot openwrt without overwriting flash
Alternatively, it is possible to edit OEM firmware images
to flash MTD partitions in openwrt to restore OEM firmware
by removing the OEM header and writing the rest to "firmware"
**TFTP recovery:**
Requires serial console, reset button does nothing at boot
rename initramfs.bin to 'uImageESR1200'
make available on TFTP server at 192.168.99.8
power board, interrupt boot by pressing '4' rapidly
execute tftpboot and bootm
**Note on ETH switch registers**
Registers must be written to the ethernet switch
in order to set up the switch's MAC interface.
U-boot can write the registers on it's own
which is needed, for example, in a TFTP transfer.
The register bits from OEM for the QCA8337 switch
can be read from interrupted boot (tftpboot, bootm)
by adding print lines in the switch driver ar8327.c
before 'qca,ar8327-initvals' is parsed from DTS and written.
for example:
pr_info("0x04 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD0_MODE));
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-01-22 08:21:53 +00:00
|
|
|
define Device/engenius_esr1750
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := EnGenius
|
|
|
|
|
DEVICE_MODEL := ESR1750
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct kmod-usb2
|
|
|
|
|
IMAGE_SIZE := 14656k
|
|
|
|
|
IMAGES += factory.dlf
|
|
|
|
|
IMAGE/factory.dlf := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | check-size | \
|
|
|
|
|
senao-header -r 0x101 -p 0x62 -t 2
|
|
|
|
|
SUPPORTED_DEVICES += esr1750 esr1200 engenius,esr1200
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += engenius_esr1750
|
|
|
|
|
|
ath79: add support for Senao Engenius ESR900
FCC ID: A8J-ESR900
Engenius ESR900 is an indoor wireless router with
a gigabit ethernet switch, dual-band wireless,
internal antenna plates, and a USB 2.0 port
**Specification:**
- QCA9558 SOC 2.4 GHz, 3x3
- AR9580 WLAN PCIe on board, 5 GHz, 3x3
- AR8327N SW 4 ports LAN, 1 port WAN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM
- UART at J1 populated, RX grounded
- 6 internal antenna plates (omni-directional)
- 5 LEDs, 1 button (power, 2G, 5G, WAN, WPS) (reset)
**MAC addresses:**
Base MAC address labeled as "MAC ADDRESS"
MAC "wanaddr" is not similar to "ethaddr"
eth0 *:06 MAC u-boot-env ethaddr
phy0 *:06 MAC u-boot-env ethaddr
phy1 *:07 --- u-boot-env ethaddr +1
WAN *:6E:81 u-boot-env wanaddr
**Serial Access:**
RX on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin
**Installation:**
Method 1: Firmware upgrade page
OEM webpage at 192.168.0.1
username and password "admin"
Navigate to Settings (gear icon) --> Tools --> Firmware
select the factory.bin image
confirm and wait 3 minutes
Method 2: TFTP recovery
Follow TFTP instructions using initramfs.bin
use sysupgrade.bin to flash using openwrt web interface
**Return to OEM:**
MTD partitions should be backed up before flashing
using TFTP to boot openwrt without overwriting flash
Alternatively, it is possible to edit OEM firmware images
to flash MTD partitions in openwrt to restore OEM firmware
by removing the OEM header and writing the rest to "firmware"
**TFTP recovery:**
Requires serial console, reset button does nothing at boot
rename initramfs.bin to 'uImageESR900'
make available on TFTP server at 192.168.99.8
power board, interrupt boot by pressing '4' rapidly
execute tftpboot and bootm
**Note on ETH switch registers**
Registers must be written to the ethernet switch
in order to set up the switch's MAC interface.
U-boot can write the registers on it's own
which is needed, for example, in a TFTP transfer.
The register bits from OEM for the AR8327 switch
can be read from interrupted boot (tftpboot, bootm)
by adding print lines in the switch driver ar8327.c
before 'qca,ar8327-initvals' is parsed from DTS and written.
for example:
pr_info("0x04 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD0_MODE));
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-01-30 18:51:36 +00:00
|
|
|
define Device/engenius_esr900
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := EnGenius
|
|
|
|
|
DEVICE_MODEL := ESR900
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
|
|
|
|
IMAGE_SIZE := 14656k
|
|
|
|
|
IMAGES += factory.dlf
|
|
|
|
|
IMAGE/factory.dlf := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | check-size | \
|
|
|
|
|
senao-header -r 0x101 -p 0x4e -t 2
|
|
|
|
|
SUPPORTED_DEVICES += esr900
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += engenius_esr900
|
|
|
|
|
|
2018-12-18 08:35:30 +00:00
|
|
|
define Device/engenius_ews511ap
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9531
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := EnGenius
|
|
|
|
|
DEVICE_MODEL := EWS511AP
|
2018-12-18 08:35:30 +00:00
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9887-ct
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += engenius_ews511ap
|
|
|
|
|
|
ath79: add support for Senao Engenius EWS660AP
FCC ID: A8J-EWS660AP
Engenius EWS660AP is an outdoor wireless access point with
2 gigabit ethernet ports, dual-band wireless,
internal antenna plates, and 802.3at PoE+
**Specification:**
- QCA9558 SOC 2.4 GHz, 3x3
- QCA9880 WLAN mini PCIe card, 5 GHz, 3x3, 26dBm
- AR8035-A PHY RGMII GbE with PoE+ IN
- AR8033 PHY SGMII GbE with PoE+ OUT
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM
- UART at J1 populated, RX grounded
- 6 internal antenna plates (5 dbi, omni-directional)
- 5 LEDs, 1 button (power, eth0, eth1, 2G, 5G) (reset)
**MAC addresses:**
Base MAC addressed labeled as "MAC"
Only one Vendor MAC address in flash
eth0 *:d4 MAC art 0x0
eth1 *:d5 --- art 0x0 +1
phy1 *:d6 --- art 0x0 +2
phy0 *:d7 --- art 0x0 +3
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin
**Installation:**
2 ways to flash factory.bin from OEM:
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery:**
Requires serial console, reset button does nothing
rename initramfs.bin to '0101A8C0.img'
make available on TFTP server at 192.168.1.101
power board, interrupt boot
execute tftpboot and bootm 0x81000000
**Format of OEM firmware image:**
The OEM software of EWS660AP is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-ar71xx-generic-ews660ap-uImage-lzma.bin
openwrt-ar71xx-generic-ews660ap-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
Newer EnGenius software requires more checks but their script
includes a way to skip them, otherwise the tar must include
a text file with the version and md5sums in a deprecated format.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied
at the PHY side, using the at803x driver `phy-mode`.
Therefore the PLL registers for GMAC0
do not need the bits for delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
Tested-by: Niklas Arnitz <openwrt@arnitz.email>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-01-13 05:37:10 +00:00
|
|
|
define Device/engenius_ews660ap
|
|
|
|
|
$(Device/senao_loader_okli)
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := EnGenius
|
|
|
|
|
DEVICE_MODEL := EWS660AP
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
|
|
|
|
|
IMAGE_SIZE := 11584k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x220000
|
|
|
|
|
SENAO_IMGNAME := ar71xx-generic-ews660ap
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += engenius_ews660ap
|
|
|
|
|
|
2020-05-19 20:49:35 +00:00
|
|
|
define Device/enterasys_ws-ap3705i
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_VENDOR := Enterasys
|
|
|
|
|
DEVICE_MODEL := WS-AP3705i
|
|
|
|
|
IMAGE_SIZE := 30528k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += enterasys_ws-ap3705i
|
|
|
|
|
|
2018-08-02 07:14:10 +00:00
|
|
|
define Device/etactica_eg200
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9331
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := eTactica
|
|
|
|
|
DEVICE_MODEL := EG200
|
2018-05-07 16:08:00 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2 kmod-ledtrig-oneshot \
|
2021-02-25 10:54:43 +00:00
|
|
|
kmod-usb-serial-ftdi kmod-usb-storage kmod-fs-ext4
|
2019-07-04 11:54:18 +00:00
|
|
|
IMAGE_SIZE := 16000k
|
2018-08-02 07:14:10 +00:00
|
|
|
SUPPORTED_DEVICES += rme-eg200
|
2018-05-07 16:08:00 +00:00
|
|
|
endef
|
2018-08-02 07:14:10 +00:00
|
|
|
TARGET_DEVICES += etactica_eg200
|
2018-05-07 16:08:00 +00:00
|
|
|
|
2021-01-07 21:51:06 +00:00
|
|
|
define Device/extreme-networks_ws-ap3805i
|
|
|
|
|
SOC := qca9557
|
|
|
|
|
BLOCKSIZE := 256k
|
|
|
|
|
DEVICE_VENDOR := Extreme Networks
|
|
|
|
|
DEVICE_MODEL := WS-AP3805i
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
|
|
|
|
|
IMAGE_SIZE := 29440k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += extreme-networks_ws-ap3805i
|
|
|
|
|
|
ath79: add support for Fortinet FAP-221-B
FCC ID: U2M-CAP4100AG
Fortinet FAP-221-B is an indoor access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
Hardware and board design from Senao
**Specification:**
- AR9344 SOC 2G 2x2, 5G 2x2, 25 MHz CLK
- AR9382 WLAN 2G 2x2 PCIe, 40 MHz CLK
- AR8035-A PHY RGMII, PoE+ IN, 25 MHz CLK
- 16 MB FLASH MX25L12845EMI-10G
- 2x 32 MB RAM W9725G6JB-25
- UART at J11 populated, 9600 baud
- 6 LEDs, 1 button power, ethernet, wlan, reset
Note: ethernet LEDs are not enabled
because a new netifd hotplug is required
in order to operate like OEM.
Board has 1 amber and 1 green
for each of the 3 case viewports.
**MAC addresses:**
1 MAC Address in flash at end of uboot
ASCII encoded, no delimiters
Labeled as "MAC Address" on case
OEM firmware sets offsets 1 and 8 for wlan
eth0 *:1e uboot 0x3ff80
phy0 *:1f uboot 0x3ff80 +1
phy1 *:26 uboot 0x3ff80 +8
**Serial Access:**
Pinout: (arrow) VCC GND RX TX
Pins are populated with a header and traces not blocked.
Bootloader is set to 9600 baud, 8 data, 1 stop.
**Console Access:**
Bootloader:
Interrupt boot with Ctrl+C
Press "k" and enter password "1"
OR
Hold reset button for 5 sec during power on
Interrupt the TFTP transfer with Ctrl+C
to print commands available, enter "help"
OEM:
default username is "admin", password blank
telnet is available at default address 192.168.1.2
serial is available with baud 9600
to print commands available, enter "help"
or tab-tab (busybox list of commands)
**Installation:**
Use factory.bin with OEM upgrade procedures
OR
Use initramfs.bin with uboot TFTP commands.
Then perform a sysupgrade with sysupgrade.bin
**TFTP Recovery:**
Using serial console, load initramfs.bin using TFTP
to boot openwrt without touching the flash.
TFTP is not reliable due to bugged bootloader,
set MTU to 600 and try many times.
If your TFTP server supports setting block size,
higher block size is better.
Splitting the file into 1 MB parts may be necessary
example:
$ tftpboot 0x80100000 image1.bin
$ tftpboot 0x80200000 image2.bin
$ tftpboot 0x80300000 image3.bin
$ tftpboot 0x80400000 image4.bin
$ tftpboot 0x80500000 image5.bin
$ tftpboot 0x80600000 image6.bin
$ bootm 0x80100000
**Return to OEM:**
The best way to return to OEM firmware
is to have a copy of the MTD partitions
before flashing Openwrt.
Backup copies should be made of partitions
"fwconcat0", "loader", and "fwconcat1"
which together is the same flash range
as OEM's "rootfs" and "uimage"
by loading an initramfs.bin
and using LuCI to download the mtdblocks.
It is also possible to extract from the
OEM firmware upgrade image by splitting it up
in parts of lengths that correspond
to the partitions in openwrt
and write them to flash,
after gzip decompression.
After writing to the firmware partitions,
erase the "reserved" partition and reboot.
**OEM firmware image format:**
Images from Fortinet for this device
ending with the suffix .out
are actually a .gz file
The gzip metadata stores the original filename
before compression, which is a special string
used to verify the image during OEM upgrade.
After gzip decompression, the resulting file
is an exact copy of the MTD partitions
"rootfs" and "uimage" combined in the same order and size
that they appear in /proc/mtd and as they are on flash.
OEM upgrade is performed by a customized busybox
with the command "upgrade".
Another binary, "restore"
is a wrapper for busybox's "tftp" and "upgrade".
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2022-12-12 09:55:34 +00:00
|
|
|
define Device/fortinet_fap-221-b
|
|
|
|
|
$(Device/senao_loader_okli)
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_VENDOR := Fortinet
|
|
|
|
|
DEVICE_MODEL := FAP-221-B
|
|
|
|
|
FACTORY_IMG_NAME := FP221B-9.99-AP-build999-999999-patch99
|
|
|
|
|
IMAGE_SIZE := 9216k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x040000
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | \
|
|
|
|
|
check-size | pad-to $$$$(IMAGE_SIZE) | \
|
|
|
|
|
append-loader-okli-uimage $(1) | pad-to 10944k | \
|
|
|
|
|
gzip-filename $$$$(FACTORY_IMG_NAME)
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += fortinet_fap-221-b
|
|
|
|
|
|
2019-12-08 19:18:58 +00:00
|
|
|
define Device/glinet_6408
|
|
|
|
|
$(Device/tplink-8mlzma)
|
|
|
|
|
SOC := ar9331
|
|
|
|
|
DEVICE_VENDOR := GL.iNet
|
|
|
|
|
DEVICE_MODEL := 6408
|
2022-02-21 21:15:45 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2
|
2019-12-08 19:18:58 +00:00
|
|
|
IMAGE_SIZE := 8000k
|
|
|
|
|
TPLINK_HWID := 0x08000001
|
|
|
|
|
IMAGES := sysupgrade.bin
|
|
|
|
|
SUPPORTED_DEVICES += gl-inet
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += glinet_6408
|
|
|
|
|
|
|
|
|
|
define Device/glinet_6416
|
|
|
|
|
$(Device/tplink-16mlzma)
|
|
|
|
|
SOC := ar9331
|
|
|
|
|
DEVICE_VENDOR := GL.iNet
|
|
|
|
|
DEVICE_MODEL := 6416
|
2022-02-21 21:15:45 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2
|
2019-12-08 19:18:58 +00:00
|
|
|
IMAGE_SIZE := 16192k
|
|
|
|
|
TPLINK_HWID := 0x08000001
|
|
|
|
|
IMAGES := sysupgrade.bin
|
|
|
|
|
SUPPORTED_DEVICES += gl-inet
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += glinet_6416
|
|
|
|
|
|
2018-12-30 20:37:50 +00:00
|
|
|
define Device/glinet_gl-ar150
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9330
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := GL.iNet
|
|
|
|
|
DEVICE_MODEL := GL-AR150
|
2018-05-06 08:20:11 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2
|
|
|
|
|
IMAGE_SIZE := 16000k
|
2018-05-07 20:41:04 +00:00
|
|
|
SUPPORTED_DEVICES += gl-ar150
|
2018-05-06 08:20:11 +00:00
|
|
|
endef
|
2018-12-30 20:37:50 +00:00
|
|
|
TARGET_DEVICES += glinet_gl-ar150
|
2018-05-06 08:20:11 +00:00
|
|
|
|
2019-03-07 04:44:33 +00:00
|
|
|
define Device/glinet_gl-ar300m-common-nor
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9531
|
2019-10-23 16:56:47 +00:00
|
|
|
DEVICE_VENDOR := GL.iNet
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
2018-05-27 05:37:22 +00:00
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
SUPPORTED_DEVICES += gl-ar300m
|
|
|
|
|
endef
|
2019-03-07 04:44:33 +00:00
|
|
|
|
|
|
|
|
define Device/glinet_gl-ar300m-lite
|
|
|
|
|
$(Device/glinet_gl-ar300m-common-nor)
|
2019-10-23 16:56:47 +00:00
|
|
|
DEVICE_MODEL := GL-AR300M
|
|
|
|
|
DEVICE_VARIANT := Lite
|
2019-03-07 04:44:33 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += glinet_gl-ar300m-lite
|
|
|
|
|
|
2019-06-02 13:43:00 +00:00
|
|
|
define Device/glinet_gl-ar300m16
|
|
|
|
|
$(Device/glinet_gl-ar300m-common-nor)
|
|
|
|
|
DEVICE_MODEL := GL-AR300M16
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += glinet_gl-ar300m16
|
|
|
|
|
|
2019-08-23 09:05:57 +00:00
|
|
|
define Device/glinet_gl-ar750
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9531
|
2019-08-23 09:05:57 +00:00
|
|
|
DEVICE_VENDOR := GL.iNet
|
|
|
|
|
DEVICE_MODEL := GL-AR750
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca9887-ct
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
SUPPORTED_DEVICES += gl-ar750
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += glinet_gl-ar750
|
|
|
|
|
|
2020-07-02 07:53:02 +00:00
|
|
|
define Device/glinet_gl-mifi
|
|
|
|
|
SOC := ar9331
|
|
|
|
|
DEVICE_VENDOR := GL.iNET
|
|
|
|
|
DEVICE_MODEL := GL-MiFi
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
SUPPORTED_DEVICES += gl-mifi
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += glinet_gl-mifi
|
|
|
|
|
|
2020-11-24 17:53:39 +00:00
|
|
|
define Device/glinet_gl-usb150
|
|
|
|
|
SOC := ar9331
|
|
|
|
|
DEVICE_VENDOR := GL.iNET
|
|
|
|
|
DEVICE_MODEL := GL-USB150
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
SUPPORTED_DEVICES += gl-usb150
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += glinet_gl-usb150
|
|
|
|
|
|
2021-06-08 16:57:28 +00:00
|
|
|
define Device/glinet_gl-x300b
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := GL.iNet
|
|
|
|
|
DEVICE_MODEL := GL-X300B
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += glinet_gl-x300b
|
|
|
|
|
|
2018-11-26 14:39:25 +00:00
|
|
|
define Device/glinet_gl-x750
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9531
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := GL.iNet
|
|
|
|
|
DEVICE_MODEL := GL-X750
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca9887-ct
|
2018-11-05 02:03:05 +00:00
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
endef
|
2018-11-26 14:39:25 +00:00
|
|
|
TARGET_DEVICES += glinet_gl-x750
|
2018-11-05 02:03:05 +00:00
|
|
|
|
2020-08-19 12:20:54 +00:00
|
|
|
define Device/hak5_lan-turtle
|
|
|
|
|
$(Device/tplink-16mlzma)
|
|
|
|
|
SOC := ar9331
|
|
|
|
|
DEVICE_VENDOR := Hak5
|
|
|
|
|
DEVICE_MODEL := LAN Turtle
|
|
|
|
|
TPLINK_HWID := 0x5348334c
|
|
|
|
|
IMAGES := sysupgrade.bin
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2 -iwinfo -kmod-ath9k -swconfig \
|
2022-12-28 04:44:11 +00:00
|
|
|
-uboot-envtools -wpad-basic-mbedtls
|
2020-08-19 12:20:54 +00:00
|
|
|
SUPPORTED_DEVICES += lan-turtle
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += hak5_lan-turtle
|
|
|
|
|
|
2020-08-19 13:10:04 +00:00
|
|
|
define Device/hak5_packet-squirrel
|
|
|
|
|
$(Device/tplink-16mlzma)
|
|
|
|
|
SOC := ar9331
|
|
|
|
|
DEVICE_VENDOR := Hak5
|
|
|
|
|
DEVICE_MODEL := Packet Squirrel
|
|
|
|
|
TPLINK_HWID := 0x5351524c
|
|
|
|
|
IMAGES := sysupgrade.bin
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2 -iwinfo -kmod-ath9k -swconfig \
|
2022-12-28 04:44:11 +00:00
|
|
|
-uboot-envtools -wpad-basic-mbedtls
|
2020-08-19 13:10:04 +00:00
|
|
|
SUPPORTED_DEVICES += packet-squirrel
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += hak5_packet-squirrel
|
|
|
|
|
|
2020-08-19 14:01:25 +00:00
|
|
|
define Device/hak5_wifi-pineapple-nano
|
|
|
|
|
$(Device/tplink-16mlzma)
|
|
|
|
|
SOC := ar9331
|
|
|
|
|
DEVICE_VENDOR := Hak5
|
|
|
|
|
DEVICE_MODEL := WiFi Pineapple NANO
|
|
|
|
|
TPLINK_HWID := 0x4e414e4f
|
|
|
|
|
IMAGES := sysupgrade.bin
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath9k-htc kmod-usb-chipidea2 kmod-usb-storage \
|
|
|
|
|
-swconfig -uboot-envtools
|
|
|
|
|
SUPPORTED_DEVICES += wifi-pineapple-nano
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += hak5_wifi-pineapple-nano
|
|
|
|
|
|
2022-04-16 00:23:52 +00:00
|
|
|
define Device/hiwifi_hc6361
|
|
|
|
|
SOC := ar9331
|
|
|
|
|
DEVICE_VENDOR := HiWiFi
|
|
|
|
|
DEVICE_MODEL := HC6361
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-chipidea2 kmod-usb-storage \
|
|
|
|
|
kmod-fs-ext4 kmod-nls-iso8859-1 e2fsprogs
|
|
|
|
|
BOARDNAME := HiWiFi-HC6361
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | uImage lzma | pad-to $$(BLOCKSIZE)
|
|
|
|
|
IMAGE_SIZE := 16128k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += hiwifi_hc6361
|
|
|
|
|
|
2018-08-20 07:32:42 +00:00
|
|
|
define Device/iodata_etg3-r
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9342
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := I-O DATA
|
|
|
|
|
DEVICE_MODEL := ETG3-R
|
2018-08-20 07:32:42 +00:00
|
|
|
IMAGE_SIZE := 7680k
|
2022-12-28 04:44:11 +00:00
|
|
|
DEVICE_PACKAGES := -iwinfo -kmod-ath9k -wpad-basic-mbedtls
|
2018-08-20 07:32:42 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += iodata_etg3-r
|
|
|
|
|
|
2018-08-16 08:08:28 +00:00
|
|
|
define Device/iodata_wn-ac1167dgr
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9557
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := I-O DATA
|
|
|
|
|
DEVICE_MODEL := WN-AC1167DGR
|
2018-08-16 08:08:28 +00:00
|
|
|
IMAGE_SIZE := 14656k
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
2020-03-10 13:58:27 +00:00
|
|
|
append-rootfs | pad-rootfs | check-size | \
|
2019-12-19 19:42:19 +00:00
|
|
|
senao-header -r 0x30a -p 0x61 -t 2
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
2018-08-16 08:08:28 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += iodata_wn-ac1167dgr
|
|
|
|
|
|
2019-02-05 08:23:58 +00:00
|
|
|
define Device/iodata_wn-ac1600dgr
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9557
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := I-O DATA
|
|
|
|
|
DEVICE_MODEL := WN-AC1600DGR
|
2019-02-05 08:23:58 +00:00
|
|
|
IMAGE_SIZE := 14656k
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
2020-03-10 13:58:27 +00:00
|
|
|
append-rootfs | pad-rootfs | check-size | \
|
2019-12-19 19:42:19 +00:00
|
|
|
senao-header -r 0x30a -p 0x60 -t 2 -v 200
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
2019-02-05 08:23:58 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += iodata_wn-ac1600dgr
|
|
|
|
|
|
2018-08-10 00:07:53 +00:00
|
|
|
define Device/iodata_wn-ac1600dgr2
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9557
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := I-O DATA
|
2019-06-16 16:23:32 +00:00
|
|
|
DEVICE_MODEL := WN-AC1600DGR2/DGR3
|
2018-08-10 00:07:53 +00:00
|
|
|
IMAGE_SIZE := 14656k
|
2019-06-16 16:23:32 +00:00
|
|
|
IMAGES += dgr2-dgr3-factory.bin
|
2019-12-19 19:42:19 +00:00
|
|
|
IMAGE/dgr2-dgr3-factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
2020-03-10 13:58:27 +00:00
|
|
|
append-rootfs | pad-rootfs | check-size | \
|
2019-12-19 19:42:19 +00:00
|
|
|
senao-header -r 0x30a -p 0x60 -t 2 -v 200
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
2018-08-10 00:07:53 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += iodata_wn-ac1600dgr2
|
|
|
|
|
|
2018-11-30 10:04:23 +00:00
|
|
|
define Device/iodata_wn-ag300dgr
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar1022
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := I-O DATA
|
|
|
|
|
DEVICE_MODEL := WN-AG300DGR
|
2018-11-30 10:04:23 +00:00
|
|
|
IMAGE_SIZE := 15424k
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
2020-03-10 13:58:27 +00:00
|
|
|
append-rootfs | pad-rootfs | check-size | \
|
2019-12-19 19:42:19 +00:00
|
|
|
senao-header -r 0x30a -p 0x47 -t 2
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
2018-11-30 10:04:23 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += iodata_wn-ag300dgr
|
|
|
|
|
|
ath79: add support for jjPlus JA76PF2
jjPlus JA76PF2 (marketed as IntellusPro2) is a network embedded board.
Specification
SoC: Atheros AR7161
RAM: 64 MB DDR
Flash: 16 MB SPI NOR
Ethernet: 2x 10/100/1000 Mbps AR8316
LAN (CN11), WAN/PoE (CN6 - close to power barrel
connector, 48 V)
MiniPCI: 2x
LEDS: 4x, which 3 are GPIO controlled
Buttons: 2x GPIO controlled
Reset (SW1, closer to ethernet ports), WPS (SW2)
Serial: 1x (only RX and TX are wired)
baud: 115200, parity: none, flow control: none
Currently there is one caveat compared to ar71xx target images as the
MAC addresses are random on every reboot. To remedy this one needs to
store the WAN MAC address in RedBoot configuration. OpenWrt on first
boot, after flashing, will read out the address and assign proper ones
to both WAN and LAN ports. It is iportant to NOT keep the old
configuration when doing sysupgrade from ar71xx.
Upgrading from OpenWrt ar71xx image
1. Connect to serial port,
2. Download OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade -n <openwrt_sysupgrade_image_name>
3. After writing new image OpenWrt will reboot, now interrupt boot
process and enter RedBoot (bootloader) command line by pressing
Ctrl+C,
4. Enter following commands (replace variable accordingly),
set_mac (to view MAC addresses)
alias ethaddr <wan_port_mac_adress>
(confirm storing the value by inputting y and pressing Enter)
reset
5. Now board should restart and boot OpenWrt with proper MAC addresses.
Installation
1. Prepare TFTP server with OpenWrt initramfs image,
2. Connect to WAN ethernet port,
3. Connect to serial port,
4. Power on the board and enter RedBoot (bootloader) command line by
pressing Ctrl+C,
5. Enter following commands (replace variables accordingly):
set_mac (to view MAC addresses)
alias ethaddr <wan_port_mac_address>
(confirm storing the value by inputting y and pressing Enter)
ip_adress -l <board_ip_adress>/24 -h <tftp_server_ip_adress>
load -r -b 0x80060000 <openwrt_initramfs_image_name>
exec -c ""
6. Now board should boot OpenWrt initramfs image,
7. Download OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade <openwrt_sysupgrade_image_name>
8. Wait few minutes, after the D2 LED will stop blinking, the board
is ready for configuration.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
2019-03-06 19:15:19 +00:00
|
|
|
define Device/jjplus_ja76pf2
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar7161
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := jjPlus
|
|
|
|
|
DEVICE_MODEL := JA76PF2
|
2022-12-28 04:44:11 +00:00
|
|
|
DEVICE_PACKAGES += -kmod-ath9k -swconfig -wpad-basic-mbedtls -uboot-envtools fconfig kmod-hwmon-lm75
|
ath79: switch some RedBoot based devices to OKLI loader
After the kernel has switched version to 5.10, JA76PF2 and
RouterStations lost the capability to sysupgrade the OpenWrt version.
The cause is the lack of porting the patches responsible for partial
flash erase block writing and these boards FIS directory and RedBoot
config partitions share the same erase block. Because of that the FIS
directory can't be updated to accommodate kernel/rootfs partition size
changes. This could be remedied by bootloader update, but it is very
intrusive and could potentially lead to non-trivial recovery procedure,
if something went wrong. The less difficult option is to use OpenWrt
kernel loader, which will let us use static partition sizes and employ
mtd splitter to dynamically adjust kernel and rootfs partition sizes.
On sysupgrade from ath79 19.07 or 21.02 image, which still let to modify
FIS directory, the loader will be written to kernel partition, while the
kernel+rootfs to rootfs partition.
The caveats are:
* image format changes, no possible upgrade from ar71xx target images
* downgrade to any older OpenWrt version will require TFTP recovery or
usage of bootloader command line interface
To downgrade to 19.07 or 21.02, or to upgrade if one is already on
OpenWrt with kernel 5.10, for RouterStations use TFTP recovery
procedure. For JA76PF2 use instructions from this commit message:
commit 0cc87b3bacee ("ath79: image: disable sysupgrade images for routerstations and ja76pf2"),
replacing kernel image with loader (loader.bin suffix) and rootfs
image with firmware (firmware.bin suffix).
Fixes: b10d6044599d ("kernel: add linux 5.10 support")
Fixes: 15aa53d7ee65 ("ath79: switch to Kernel 5.10")
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
(mkubntimage was moved to generic-ubnt.mk)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-06-07 13:58:27 +00:00
|
|
|
LOADER_TYPE := bin
|
|
|
|
|
LOADER_FLASH_OFFS := 0x60000
|
|
|
|
|
COMPILE := loader-$(1).bin
|
|
|
|
|
COMPILE/loader-$(1).bin := loader-okli-compile | lzma | pad-to 128k
|
|
|
|
|
ARTIFACTS := loader.bin
|
|
|
|
|
ARTIFACT/loader.bin := append-loader-okli $(1)
|
|
|
|
|
IMAGES += firmware.bin
|
|
|
|
|
IMAGE/firmware.bin := append-kernel | uImage lzma -M 0x4f4b4c49 | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | pad-to $$$$(BLOCKSIZE) | check-size
|
|
|
|
|
IMAGE/sysupgrade.bin := $$(IMAGE/firmware.bin) | \
|
|
|
|
|
sysupgrade-tar kernel=$$$$(KDIR)/loader-$(1).bin rootfs=$$$$@ | append-metadata
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma
|
ath79: add support for jjPlus JA76PF2
jjPlus JA76PF2 (marketed as IntellusPro2) is a network embedded board.
Specification
SoC: Atheros AR7161
RAM: 64 MB DDR
Flash: 16 MB SPI NOR
Ethernet: 2x 10/100/1000 Mbps AR8316
LAN (CN11), WAN/PoE (CN6 - close to power barrel
connector, 48 V)
MiniPCI: 2x
LEDS: 4x, which 3 are GPIO controlled
Buttons: 2x GPIO controlled
Reset (SW1, closer to ethernet ports), WPS (SW2)
Serial: 1x (only RX and TX are wired)
baud: 115200, parity: none, flow control: none
Currently there is one caveat compared to ar71xx target images as the
MAC addresses are random on every reboot. To remedy this one needs to
store the WAN MAC address in RedBoot configuration. OpenWrt on first
boot, after flashing, will read out the address and assign proper ones
to both WAN and LAN ports. It is iportant to NOT keep the old
configuration when doing sysupgrade from ar71xx.
Upgrading from OpenWrt ar71xx image
1. Connect to serial port,
2. Download OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade -n <openwrt_sysupgrade_image_name>
3. After writing new image OpenWrt will reboot, now interrupt boot
process and enter RedBoot (bootloader) command line by pressing
Ctrl+C,
4. Enter following commands (replace variable accordingly),
set_mac (to view MAC addresses)
alias ethaddr <wan_port_mac_adress>
(confirm storing the value by inputting y and pressing Enter)
reset
5. Now board should restart and boot OpenWrt with proper MAC addresses.
Installation
1. Prepare TFTP server with OpenWrt initramfs image,
2. Connect to WAN ethernet port,
3. Connect to serial port,
4. Power on the board and enter RedBoot (bootloader) command line by
pressing Ctrl+C,
5. Enter following commands (replace variables accordingly):
set_mac (to view MAC addresses)
alias ethaddr <wan_port_mac_address>
(confirm storing the value by inputting y and pressing Enter)
ip_adress -l <board_ip_adress>/24 -h <tftp_server_ip_adress>
load -r -b 0x80060000 <openwrt_initramfs_image_name>
exec -c ""
6. Now board should boot OpenWrt initramfs image,
7. Download OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade <openwrt_sysupgrade_image_name>
8. Wait few minutes, after the D2 LED will stop blinking, the board
is ready for configuration.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
2019-03-06 19:15:19 +00:00
|
|
|
KERNEL_INITRAMFS := kernel-bin | append-dtb
|
ath79: switch some RedBoot based devices to OKLI loader
After the kernel has switched version to 5.10, JA76PF2 and
RouterStations lost the capability to sysupgrade the OpenWrt version.
The cause is the lack of porting the patches responsible for partial
flash erase block writing and these boards FIS directory and RedBoot
config partitions share the same erase block. Because of that the FIS
directory can't be updated to accommodate kernel/rootfs partition size
changes. This could be remedied by bootloader update, but it is very
intrusive and could potentially lead to non-trivial recovery procedure,
if something went wrong. The less difficult option is to use OpenWrt
kernel loader, which will let us use static partition sizes and employ
mtd splitter to dynamically adjust kernel and rootfs partition sizes.
On sysupgrade from ath79 19.07 or 21.02 image, which still let to modify
FIS directory, the loader will be written to kernel partition, while the
kernel+rootfs to rootfs partition.
The caveats are:
* image format changes, no possible upgrade from ar71xx target images
* downgrade to any older OpenWrt version will require TFTP recovery or
usage of bootloader command line interface
To downgrade to 19.07 or 21.02, or to upgrade if one is already on
OpenWrt with kernel 5.10, for RouterStations use TFTP recovery
procedure. For JA76PF2 use instructions from this commit message:
commit 0cc87b3bacee ("ath79: image: disable sysupgrade images for routerstations and ja76pf2"),
replacing kernel image with loader (loader.bin suffix) and rootfs
image with firmware (firmware.bin suffix).
Fixes: b10d6044599d ("kernel: add linux 5.10 support")
Fixes: 15aa53d7ee65 ("ath79: switch to Kernel 5.10")
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
(mkubntimage was moved to generic-ubnt.mk)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-06-07 13:58:27 +00:00
|
|
|
IMAGE_SIZE := 15872k
|
|
|
|
|
DEVICE_COMPAT_VERSION := 2.0
|
|
|
|
|
DEVICE_COMPAT_MESSAGE := Partition design has changed compared to older versions (19.07 and 21.02) \
|
|
|
|
|
due to kernel drivers restrictions. Upgrade via sysupgrade mechanism is one way operation. \
|
|
|
|
|
Downgrading OpenWrt version will involve usage of bootloader command line interface.
|
ath79: add support for jjPlus JA76PF2
jjPlus JA76PF2 (marketed as IntellusPro2) is a network embedded board.
Specification
SoC: Atheros AR7161
RAM: 64 MB DDR
Flash: 16 MB SPI NOR
Ethernet: 2x 10/100/1000 Mbps AR8316
LAN (CN11), WAN/PoE (CN6 - close to power barrel
connector, 48 V)
MiniPCI: 2x
LEDS: 4x, which 3 are GPIO controlled
Buttons: 2x GPIO controlled
Reset (SW1, closer to ethernet ports), WPS (SW2)
Serial: 1x (only RX and TX are wired)
baud: 115200, parity: none, flow control: none
Currently there is one caveat compared to ar71xx target images as the
MAC addresses are random on every reboot. To remedy this one needs to
store the WAN MAC address in RedBoot configuration. OpenWrt on first
boot, after flashing, will read out the address and assign proper ones
to both WAN and LAN ports. It is iportant to NOT keep the old
configuration when doing sysupgrade from ar71xx.
Upgrading from OpenWrt ar71xx image
1. Connect to serial port,
2. Download OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade -n <openwrt_sysupgrade_image_name>
3. After writing new image OpenWrt will reboot, now interrupt boot
process and enter RedBoot (bootloader) command line by pressing
Ctrl+C,
4. Enter following commands (replace variable accordingly),
set_mac (to view MAC addresses)
alias ethaddr <wan_port_mac_adress>
(confirm storing the value by inputting y and pressing Enter)
reset
5. Now board should restart and boot OpenWrt with proper MAC addresses.
Installation
1. Prepare TFTP server with OpenWrt initramfs image,
2. Connect to WAN ethernet port,
3. Connect to serial port,
4. Power on the board and enter RedBoot (bootloader) command line by
pressing Ctrl+C,
5. Enter following commands (replace variables accordingly):
set_mac (to view MAC addresses)
alias ethaddr <wan_port_mac_address>
(confirm storing the value by inputting y and pressing Enter)
ip_adress -l <board_ip_adress>/24 -h <tftp_server_ip_adress>
load -r -b 0x80060000 <openwrt_initramfs_image_name>
exec -c ""
6. Now board should boot OpenWrt initramfs image,
7. Download OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade <openwrt_sysupgrade_image_name>
8. Wait few minutes, after the D2 LED will stop blinking, the board
is ready for configuration.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
2019-03-06 19:15:19 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += jjplus_ja76pf2
|
|
|
|
|
|
2021-12-02 16:05:18 +00:00
|
|
|
define Device/jjplus_jwap230
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := jjPlus
|
|
|
|
|
DEVICE_MODEL := JWAP230
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += jjplus_jwap230
|
|
|
|
|
|
2021-06-20 14:56:21 +00:00
|
|
|
define Device/joyit_jt-or750i
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := Joy-IT
|
|
|
|
|
DEVICE_MODEL := JT-OR750i
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9887-ct
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += joyit_jt-or750i
|
|
|
|
|
|
ath79: add support for KuWFi C910
KuWFi C910 is an 802.11n (300N) indoor router with LTE support.
I can't find anywhere the OEM firmware. So if you want to restore the
original firmware you must do a dump before the OpenWrt flash.
According to the U-Boot, the board name is Iyunlink MINI_V2.
Hardware
--------
SoC: Qualcomm QCA9533 650/400/200/25/25 MHz (CPU/RAM/AHB/SPI/REF)
RAM: 128 MB DDR2 16-bit CL3-4-4-10 (Nanya NT5TU64M16HG-AC)
FLASH: 16 MB Winbond W25Q128
ETH:
- 2x 100M LAN (QCA9533 internal AR8229 switch, eth0)
- 1x 100M WAN (QCA9533 internal PHY, eth1)
WIFI:
- 2.4GHz: 1x QCA9533 2T2R (b/g/n)
- 2 external non detachable antennas (near the power barrel side)
LTE:
- Quectel EC200T-EU (or -CN or -AU depending on markets)
- 2 external non detachable antennas (near the sim slot side)
BTN:
- 1x Reset button
LEDS:
- 5x White leds (Power, Wifi, Wan, Lan1, Lan2)
- 1x RGB led (Internet)
UART: 115200-8-N-1 (Starting from lan ports in order: GND, RX, TX, VCC)
Everything works correctly.
MAC Addresses
-------------
LAN XX:XX:XX:XX:XX:48 (art@0x1002)
WAN XX:XX:XX:XX:XX:49 (art@0x1002 + 1)
WIFI XX:XX:XX:XX:XX:48
LABEL XX:XX:XX:XX:XX:48
Installation
------------
Turn the router on while pressing the reset button for 4 seconds.
You can simply count the flashes of the first lan led. (See notes)
If done correctly you should see the first lan led glowing slowly and
you should be able to enter the U-Boot web interface.
Click on the second tab ("固件") and select the -factory.bin firmware
then click "Update firmware".
A screen "Update in progress" should appear.
After few minutes the flash should be completed.
This procedure can be used also to recover the router in case of soft
brick.
Backup the original firmware
----------------------------
The following steps are intended for a linux pc. However using the
right software this guide should also work for Windows and MacOS.
1) Install a tftp server on your pc. For example tftpd-hpa.
2) Create two empty files in your tftp folder called:
kuwfi_c910_all_nor.bin
kuwfi_c910_firmware_only.bin
3) Give global write permissions to these files:
chmod 666 kuwfi_c910_all_nor.bin
chmod 666 kuwfi_c910_firmware_only.bin
4) Start a netcat session on your pc with this command:
nc -u -p 6666 192.168.1.1 6666
5) Set the static address on your pc: 192.168.1.2. Connect the router
to your pc.
6) Turn the router on while pressing the reset button for 8-9 seconds.
You can simply count the flashes of the first lan led. If you
press the reset button for too many seconds it will continue
the normal boot, so you have to restart the router. (See notes)
7) If done correctly you should see the U-Boot network console and you
should see the following lines on the netcat session:
Version and build date:
U-Boot 1.1.4-55f1bca8-dirty, 2020-05-07
Modification by:
Piotr Dymacz <piotr@dymacz.pl>
https://github.com/pepe2k/u-boot_mod
u-boot>
8) Start the transfer of the whole NOR:
tftpput 0x9f000000 0x1000000 kuwfi_c910_all_nor.bin
9) The router should start the transfer and it should end with a
message like this (pay attention to the bytes transferred):
TFTP transfer complete!
Bytes transferred: 16777216 (0x1000000)
10) Repeat the same transfer for the firmware:
tftpput 0x9f050000 0xfa0000 kuwfi_c910_firmware_only.bin
11) The router should start the transfer and it should end with a
message like this (pay attention to the bytes transferred):
TFTP transfer complete!
Bytes transferred: 16384000 (0xfa0000)
12) Now you have the backup for the whole nor and for the firmware
partition. If you want to restore the OEM firmware from OpenWrt
you have to flash the kuwfi_c910_firmware_only.bin from the
U-Boot web interface.
WARNING: Don't use the kuwfi_c910_all_nor.bin file. This file
is only useful if you manage to hard brick the router or you
damage the art partition (ask on the forum)
Notes
-----
This router (or at least my unit) has the pepe2k's U-Boot. It's a
modded U-Boot version with a lot of cool features. You can read more
here: https://github.com/pepe2k/u-boot_mod
With this version of U-Boot, pushing the reset button while turning on
the router starts different tools:
- 3-5 seconds: U-Boot web interface that can be used to replace the
firmware, the art or the U-Boot itself
- 5-7 seconds: U-Boot uart console
- 7-10 seconds: U-Boot network console
- 11+ seconds: Normal boot
The LTE modem can be used in cdc_ether (ECM) or RNDIS mode.
The default mode is ECM and in this commit only the ECM software is
included. In order to set RNDIS mode you must use this AT command:
AT+QCFG="usbnet",3
In order to use again the ECM mode you must use this AT command:
AT+QCFG="usbnet",1
Look for "Quectel_EC200T_Linux_USB_Driver_User_Guide_V1.0.pdf" for
other AT commands
Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
2022-12-13 22:28:08 +00:00
|
|
|
define Device/kuwfi_c910
|
|
|
|
|
$(Device/loader-okli-uimage)
|
|
|
|
|
SOC := qca9533
|
|
|
|
|
DEVICE_VENDOR := KuWFi
|
|
|
|
|
DEVICE_MODEL := C910
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-net-cdc-ether comgt-ncm
|
|
|
|
|
LOADER_FLASH_OFFS := 0x50000
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x4f4b4c49
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | check-size | pad-to 14528k | \
|
|
|
|
|
append-loader-okli-uimage $(1) | pad-to 64k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += kuwfi_c910
|
|
|
|
|
|
2021-09-28 16:25:01 +00:00
|
|
|
define Device/letv_lba-047-ch
|
|
|
|
|
$(Device/loader-okli-uimage)
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := Letv
|
|
|
|
|
DEVICE_MODEL := LBA-047-CH
|
2023-01-20 03:16:33 +00:00
|
|
|
DEVICE_PACKAGES := -uboot-envtools
|
|
|
|
|
FACTORY_SIZE := 14528k
|
2021-09-28 16:25:01 +00:00
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x50000
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x4f4b4c49
|
2023-01-20 03:16:33 +00:00
|
|
|
IMAGES += kernel.bin rootfs.bin
|
|
|
|
|
IMAGE/kernel.bin := append-loader-okli-uimage $(1) | pad-to 64k
|
|
|
|
|
IMAGE/rootfs.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | check-size $$$$(FACTORY_SIZE)
|
2021-09-28 16:25:01 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += letv_lba-047-ch
|
|
|
|
|
|
2019-03-09 01:10:25 +00:00
|
|
|
define Device/librerouter_librerouter-v1
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9558
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := Librerouter
|
|
|
|
|
DEVICE_MODEL := LibreRouter
|
|
|
|
|
DEVICE_VARIANT := v1
|
2019-03-09 01:10:25 +00:00
|
|
|
IMAGE_SIZE := 7936k
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
2019-03-09 01:10:25 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += librerouter_librerouter-v1
|
|
|
|
|
|
ath79: add support for Meraki MR12
Port device support for Meraki MR12 from the ar71xx target to ath79.
Specifications:
- SoC: AR7242-AH1A CPU
- RAM: 64MiB (NANYA NT5DS32M16DS-5T)
- NOR Flash: 16MiB (MXIC MX25L12845EMI-10G)
- Ethernet: 1 x PoE Gigabit Ethernet Port (SoC MAC + AR8021-BL1E PHY)
- Ethernet: 1 x 100Mbit port (SoC MAC+PHY)
- Wi-Fi: Atheros AR9283-AL1A (2T2R, 11n)
Installation:
1. Requires TFTP server at 192.168.1.101, w/ initramfs & sysupgrade .bins
2. Open shell case
3. Connect a USB->TTL cable to headers furthest from the RF shield
4. Power on the router; connect to U-boot over 115200-baud connection
5. Interrupt U-boot process to boot Openwrt by running:
setenv bootcmd bootm 0xbf0a0000; saveenv;
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin;
bootm 0c00000;
6. Copy sysupgrade image to /tmp on MR12
7. sysupgrade /tmp/<filename-of-sysupgrade>.bin
Notes:
- kmod-owl-loader is still required to load the ART partition into the
driver.
- The manner of storing MAC addresses is updated from ar71xx; it is
at 0x66 of the 'config' partition, where it was discovered that the
OEM firmware stores it. This is set as read-only. If you are
migrating from ar71xx and used the method mentioned above to
upgrade, use kmod-mtd-rw or UCI to add the MAC back in. One more
method for doing this is described below.
- Migrating directly from ar71xx has not been thoroughly tested, but
one method has been used a couple of times with good success,
migrating 18.06.2 to a full image produced as of this commit. Please
note that these instructions are only for experienced users, and/or
those still able to open their device up to flash it via the serial
headers should anything go wrong.
1) Install kmod-mtd-rw and uboot-envtools
2) Run `insmod mtd-rw.ko i_want_a_brick=1`
3) Modify /etc/fw_env.config to point to the u-boot-env partition.
The file /etc/fw_env.config should contain:
# MTD device env offset env size sector size
/dev/mtd1 0x00000 0x10000 0x10000
See https://openwrt.org/docs/techref/bootloader/uboot.config
for more details.
4) Run `fw_printenv` to verify everything is correct, as per the
link above.
5) Run `fw_setenv bootcmd bootm 0xbf0a0000` to set a new boot address.
6) Manually modify /lib/upgrade/common.sh's get_image function:
Change ...
cat "$from" 2>/dev/null | $cmd
... into ...
(
dd if=/dev/zero bs=1 count=$((0x66)) ; # Pad the first 102 bytes
echo -ne '\x00\x18\x0a\x12\x34\x56' ; # Add in MAC address
dd if=/dev/zero bs=1 count=$((0x20000-0x66-0x6)) ; # Pad the rest
cat "$from" 2>/dev/null
) | $cmd
... which, during the upgrade process, will pad the image by
128K of zeroes-plus-MAC-address, in order for the ar71xx's
firmware partition -- which starts at 0xbf080000 -- to be
instead aligned with the ath79 firmware partition, which
starts 128K later at 0xbf0a0000.
7) Copy the sysupgrade image into /tmp, as above
8) Run `sysupgrade -F /tmp/<sysupgrade>.bin`, then wait
Again, this may BRICK YOUR DEVICE, so make *sure* to have your
serial cable handy.
Signed-off-by: Martin Kennedy <hurricos@gmail.com>
[add LED migration and extend compat message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-11-28 02:03:32 +00:00
|
|
|
define Device/meraki_mr12
|
|
|
|
|
SOC := ar7242
|
|
|
|
|
DEVICE_VENDOR := Meraki
|
|
|
|
|
DEVICE_MODEL := MR12
|
|
|
|
|
IMAGE_SIZE := 15616k
|
|
|
|
|
DEVICE_PACKAGES := kmod-owl-loader rssileds
|
|
|
|
|
SUPPORTED_DEVICES += mr12
|
|
|
|
|
DEVICE_COMPAT_VERSION := 2.0
|
|
|
|
|
DEVICE_COMPAT_MESSAGE := Partitions differ from ar71xx version of MR12. Image format is incompatible. \
|
|
|
|
|
To use sysupgrade, you must change /lib/update/common.sh::get_image to prepend 128K zeroes to this image, \
|
|
|
|
|
and change the bootcmd in u-boot to "bootm 0xbf0a0000". After that, you can use "sysupgrade -F -n". \
|
|
|
|
|
Make sure you do not keep your old config, as ethernet setup is not compatible either. \
|
|
|
|
|
For more details, see the OpenWrt Wiki: https://openwrt.org/toh/meraki/MR12, \
|
|
|
|
|
or the commit message of the MR12 ath79 port on git.openwrt.org.
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += meraki_mr12
|
|
|
|
|
|
ath79: add support for Meraki MR16
Port device support for Meraki MR16 from the ar71xx target to ath79.
Specifications:
* AR7161 CPU, 16 MiB Flash, 64 MiB RAM
* One PoE-capable Gigabit Ethernet Port
* AR9220 / AR9223 (2x2 11an / 11n) WLAN
Installation:
* Requires TFTP server at 192.168.1.101, w/ initramfs & sysupgrade .bins
* Open shell case and connect a USB to TTL cable to upper serial headers
* Power on the router; connect to U-boot over 115200-baud connection
* Interrupt U-boot process to boot Openwrt by running:
setenv bootcmd bootm 0xbf0a0000; saveenv;
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin;
bootm 0c00000;
* Copy sysupgrade image to /tmp on MR16
* sysupgrade /tmp/<filename-of-sysupgrade>.bin
Notes:
- There are two separate ARTs in the partition (offset 0x1000/0x5000 and
0x11000/0x15000) in the OEM device. I suspect this is an OEM artifact;
possibly used to configure the radios for different regions,
circumstances or RF frontends. Since the ar71xx target uses the
second offsets, use that second set (0x11000 and 0x15000) for the ART.
- kmod-owl-loader is still required to load the ART partition into the
driver.
- The manner of storing MAC addresses is updated from ar71xx; it is
at 0x66 of the 'config' partition, where it was discovered that the
OEM firmware stores it. This is set as read-only. If you are
migrating from ar71xx and used the method mentioned above to
upgrade, use kmod-mtd-rw or UCI to add the MAC back in. One more
method for doing this is described below.
- Migrating directly from ar71xx has not been thoroughly tested, but
one method has been used a couple of times with good success,
migrating 18.06.2 to a full image produced as of this commit. Please
note that these instructions are only for experienced users, and/or
those still able to open their device up to flash it via the serial
headers should anything go wrong.
1) Install kmod-mtd-rw and uboot-envtools
2) Run `insmod mtd-rw.ko i_want_a_brick=1`
3) Modify /etc/fw_env.config to point to the u-boot-env partition.
The file /etc/fw_env.config should contain:
# MTD device env offset env size sector size
/dev/mtd1 0x00000 0x10000 0x10000
See https://openwrt.org/docs/techref/bootloader/uboot.config
for more details.
4) Run `fw_printenv` to verify everything is correct, as per the
link above.
5) Run `fw_setenv bootcmd bootm 0xbf0a0000` to set a new boot address.
6) Manually modify /lib/upgrade/common.sh's get_image function:
Change ...
cat "$from" 2>/dev/null | $cmd
... into ...
(
dd if=/dev/zero bs=1 count=$((0x66)) ; # Pad the first 102 bytes
echo -ne '\x00\x18\x0a\x12\x34\x56' ; # Add in MAC address
dd if=/dev/zero bs=1 count=$((0x20000-0x66-0x6)) ; # Pad the rest
cat "$from" 2>/dev/null | $cmd
)
... which, during the upgrade process, will pad the image by
128K of zeroes-plus-MAC-address, in order for the ar71xx's
firmware partition -- which starts at 0xbf080000 -- to be
instead aligned with the ath79 firmware partition, which
starts 128K later at 0xbf0a0000.
7) Copy the sysupgrade image into /tmp, as above
8) Run `sysupgrade -F /tmp/<sysupgrade>.bin`, then wait
Again, this may BRICK YOUR DEVICE, so make *sure* to have your
serial cable handy.
Addenda:
- The MR12 should be able to be migrated in a nearly identical manner as
it shares much of its hardware with the MR16.
- Thank-you Chris B for copious help with this port.
Signed-off-by: Martin Kennedy <hurricos@gmail.com>
[fix typo in compat message, drop art DT label,
move 05_fix-compat-version to subtarget]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-08-29 04:22:53 +00:00
|
|
|
define Device/meraki_mr16
|
|
|
|
|
SOC := ar7161
|
|
|
|
|
DEVICE_VENDOR := Meraki
|
|
|
|
|
DEVICE_MODEL := MR16
|
|
|
|
|
IMAGE_SIZE := 15616k
|
|
|
|
|
DEVICE_PACKAGES := kmod-owl-loader
|
|
|
|
|
SUPPORTED_DEVICES += mr16
|
|
|
|
|
DEVICE_COMPAT_VERSION := 2.0
|
|
|
|
|
DEVICE_COMPAT_MESSAGE := Partitions differ from ar71xx version of MR16. Image format is incompatible. \
|
|
|
|
|
To use sysupgrade, you must change /lib/update/common.sh::get_image to prepend 128K zeroes to this image, \
|
|
|
|
|
and change the bootcmd in u-boot to "bootm 0xbf0a0000". After that, you can use "sysupgrade -F". \
|
|
|
|
|
For more details, see the OpenWrt Wiki: https://openwrt.org/toh/meraki/mr16, \
|
|
|
|
|
or the commit message of the MR16 ath79 port on git.openwrt.org.
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += meraki_mr16
|
|
|
|
|
|
2020-09-05 11:03:09 +00:00
|
|
|
define Device/mercury_mw4530r-v1
|
|
|
|
|
$(Device/tplink-8mlzma)
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_VENDOR := Mercury
|
|
|
|
|
DEVICE_MODEL := MW4530R
|
|
|
|
|
DEVICE_VARIANT := v1
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport
|
|
|
|
|
TPLINK_HWID := 0x45300001
|
|
|
|
|
SUPPORTED_DEVICES += tl-wdr4300
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += mercury_mw4530r-v1
|
|
|
|
|
|
ath79: add support for NEC Aterm WF1200CR
NEC Aterm WF1200CR is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on
QCA9561.
Specification:
- SoC : Qualcomm Atheros QCA9561
- RAM : DDR2 128 MiB (W971GG6SB-25)
- Flash : SPI-NOR 8 MiB (MX25L6433FM2I-08G)
- WLAN : 2.4/5 GHz 2T2R
- 2.4 GHz : QCA9561 (SoC)
- 5 GHz : QCA9888
- Ethernet : 2x 10/100 Mbps
- Switch : QCA9561 (SoC)
- LEDs/Keys : 8x/3x (2x buttons, 1x slide-switch)
- UART : through-hole on PCB
- JP1: Vcc, GND, NC, TX, RX from "JP1" marking
- 115200n8
- Power : 12 VDC, 0.9 A
Flash instruction using factory image (stock: < v1.3.2):
1. Boot WF1200CR normally with "Router" mode
2. Access to "http://192.168.10.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt factory image and click update ("更新") button to
perform firmware update
4. Wait ~150 seconds to complete flashing
Alternate flash instruction using initramfs image (stock: >= v1.3.2):
1. Prepare the TFTP server with the IP address 192.168.1.10 and place
the OpenWrt initramfs image to the TFTP directory with the name
"0101A8C0.img"
2. Connect serial console to WF1200CR
3. Boot WF1200CR and interrupt with any key after the message
"Hit any key to stop autoboot: 2", the U-Boot starts telnetd after
the message "starting telnetd server from server 192.168.1.1"
4. login the telnet (address: 192.168.1.1)
5. Perform the following commands to modify "bootcmd" variable
temporary and check the value
(to ignore the limitation of available commands, "tp; " command at
the first is required as dummy, and the output of "printenv" is
printed on the serial console)
tp; set bootcmd 'set autostart yes; tftpboot'
tp; printenv
6. Save the modified variable with the following command and reset
device
tp; saveenv
tp; reset
7. The U-Boot downloads initramfs image from TFTP server and boots it
8. On initramfs image, download the sysupgrade image to the device and
perform the following commands to erase stock firmware and sysupgrade
mtd erase firmware
sysupgrade <sysupgrade image>
9. After the rebooting by completion of sysupgrade, start U-Boot telnetd
and login with the same way above (3, 4)
10. Perform the following commands to reset "bootcmd" variable to the
default and reset the device
tp; run seattle
tp; reset
(the contents of "seattle":
setenv bootcmd 'bootm 0x9f070040' && saveenv)
11. Wait booting-up the device
Known issues:
- the following 6x LEDs are connected to the gpio controller on QCA9888
chip and the implementation of control via the controller is missing in
ath10k/ath10k-ct
- "ACTIVE" (Red/Green)
- "2.4GHz" (Red/Green)
- "5GHz" (Red/Green)
Note:
- after the version v1.3.2 of stock firmware, "offline update" by
uploading image by user is deleted and the factory image cannot be
used
- the U-Boot on WF1200CR doesn't configure the port-side LEDs on WAN/LAN
and the configuration is required on OpenWrt
- gpio-hog: set the direction of GPIO 14(WAN)/19(LAN) to output
- pinmux: set GPIO 14/19 as switch-controlled LEDs
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2021-03-24 15:19:59 +00:00
|
|
|
define Device/nec_wx1200cr
|
|
|
|
|
DEVICE_VENDOR := NEC
|
|
|
|
|
IMAGE/default := append-kernel | pad-offset $$$$(BLOCKSIZE) 64 | append-rootfs
|
|
|
|
|
IMAGE/sysupgrade.bin := $$(IMAGE/default) | seama | pad-rootfs | \
|
2021-06-20 16:54:36 +00:00
|
|
|
check-size | append-metadata
|
ath79: add support for NEC Aterm WF1200CR
NEC Aterm WF1200CR is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on
QCA9561.
Specification:
- SoC : Qualcomm Atheros QCA9561
- RAM : DDR2 128 MiB (W971GG6SB-25)
- Flash : SPI-NOR 8 MiB (MX25L6433FM2I-08G)
- WLAN : 2.4/5 GHz 2T2R
- 2.4 GHz : QCA9561 (SoC)
- 5 GHz : QCA9888
- Ethernet : 2x 10/100 Mbps
- Switch : QCA9561 (SoC)
- LEDs/Keys : 8x/3x (2x buttons, 1x slide-switch)
- UART : through-hole on PCB
- JP1: Vcc, GND, NC, TX, RX from "JP1" marking
- 115200n8
- Power : 12 VDC, 0.9 A
Flash instruction using factory image (stock: < v1.3.2):
1. Boot WF1200CR normally with "Router" mode
2. Access to "http://192.168.10.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt factory image and click update ("更新") button to
perform firmware update
4. Wait ~150 seconds to complete flashing
Alternate flash instruction using initramfs image (stock: >= v1.3.2):
1. Prepare the TFTP server with the IP address 192.168.1.10 and place
the OpenWrt initramfs image to the TFTP directory with the name
"0101A8C0.img"
2. Connect serial console to WF1200CR
3. Boot WF1200CR and interrupt with any key after the message
"Hit any key to stop autoboot: 2", the U-Boot starts telnetd after
the message "starting telnetd server from server 192.168.1.1"
4. login the telnet (address: 192.168.1.1)
5. Perform the following commands to modify "bootcmd" variable
temporary and check the value
(to ignore the limitation of available commands, "tp; " command at
the first is required as dummy, and the output of "printenv" is
printed on the serial console)
tp; set bootcmd 'set autostart yes; tftpboot'
tp; printenv
6. Save the modified variable with the following command and reset
device
tp; saveenv
tp; reset
7. The U-Boot downloads initramfs image from TFTP server and boots it
8. On initramfs image, download the sysupgrade image to the device and
perform the following commands to erase stock firmware and sysupgrade
mtd erase firmware
sysupgrade <sysupgrade image>
9. After the rebooting by completion of sysupgrade, start U-Boot telnetd
and login with the same way above (3, 4)
10. Perform the following commands to reset "bootcmd" variable to the
default and reset the device
tp; run seattle
tp; reset
(the contents of "seattle":
setenv bootcmd 'bootm 0x9f070040' && saveenv)
11. Wait booting-up the device
Known issues:
- the following 6x LEDs are connected to the gpio controller on QCA9888
chip and the implementation of control via the controller is missing in
ath10k/ath10k-ct
- "ACTIVE" (Red/Green)
- "2.4GHz" (Red/Green)
- "5GHz" (Red/Green)
Note:
- after the version v1.3.2 of stock firmware, "offline update" by
uploading image by user is deleted and the factory image cannot be
used
- the U-Boot on WF1200CR doesn't configure the port-side LEDs on WAN/LAN
and the configuration is required on OpenWrt
- gpio-hog: set the direction of GPIO 14(WAN)/19(LAN) to output
- pinmux: set GPIO 14/19 as switch-controlled LEDs
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2021-03-24 15:19:59 +00:00
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/nec_wf1200cr
|
|
|
|
|
$(Device/nec_wx1200cr)
|
|
|
|
|
SOC := qca9561
|
|
|
|
|
DEVICE_MODEL := Aterm WF1200CR
|
|
|
|
|
IMAGE_SIZE := 7680k
|
|
|
|
|
SEAMA_MTDBLOCK := 5
|
|
|
|
|
SEAMA_SIGNATURE := wrgac62_necpf.2016gui_wf1200cr
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := $$(IMAGE/default) | pad-rootfs -x 64 | seama | \
|
|
|
|
|
seama-seal | nec-enc ryztfyutcrqqo69d | check-size
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += nec_wf1200cr
|
|
|
|
|
|
2019-03-16 04:27:32 +00:00
|
|
|
define Device/nec_wg1200cr
|
ath79: add support for NEC Aterm WF1200CR
NEC Aterm WF1200CR is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on
QCA9561.
Specification:
- SoC : Qualcomm Atheros QCA9561
- RAM : DDR2 128 MiB (W971GG6SB-25)
- Flash : SPI-NOR 8 MiB (MX25L6433FM2I-08G)
- WLAN : 2.4/5 GHz 2T2R
- 2.4 GHz : QCA9561 (SoC)
- 5 GHz : QCA9888
- Ethernet : 2x 10/100 Mbps
- Switch : QCA9561 (SoC)
- LEDs/Keys : 8x/3x (2x buttons, 1x slide-switch)
- UART : through-hole on PCB
- JP1: Vcc, GND, NC, TX, RX from "JP1" marking
- 115200n8
- Power : 12 VDC, 0.9 A
Flash instruction using factory image (stock: < v1.3.2):
1. Boot WF1200CR normally with "Router" mode
2. Access to "http://192.168.10.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt factory image and click update ("更新") button to
perform firmware update
4. Wait ~150 seconds to complete flashing
Alternate flash instruction using initramfs image (stock: >= v1.3.2):
1. Prepare the TFTP server with the IP address 192.168.1.10 and place
the OpenWrt initramfs image to the TFTP directory with the name
"0101A8C0.img"
2. Connect serial console to WF1200CR
3. Boot WF1200CR and interrupt with any key after the message
"Hit any key to stop autoboot: 2", the U-Boot starts telnetd after
the message "starting telnetd server from server 192.168.1.1"
4. login the telnet (address: 192.168.1.1)
5. Perform the following commands to modify "bootcmd" variable
temporary and check the value
(to ignore the limitation of available commands, "tp; " command at
the first is required as dummy, and the output of "printenv" is
printed on the serial console)
tp; set bootcmd 'set autostart yes; tftpboot'
tp; printenv
6. Save the modified variable with the following command and reset
device
tp; saveenv
tp; reset
7. The U-Boot downloads initramfs image from TFTP server and boots it
8. On initramfs image, download the sysupgrade image to the device and
perform the following commands to erase stock firmware and sysupgrade
mtd erase firmware
sysupgrade <sysupgrade image>
9. After the rebooting by completion of sysupgrade, start U-Boot telnetd
and login with the same way above (3, 4)
10. Perform the following commands to reset "bootcmd" variable to the
default and reset the device
tp; run seattle
tp; reset
(the contents of "seattle":
setenv bootcmd 'bootm 0x9f070040' && saveenv)
11. Wait booting-up the device
Known issues:
- the following 6x LEDs are connected to the gpio controller on QCA9888
chip and the implementation of control via the controller is missing in
ath10k/ath10k-ct
- "ACTIVE" (Red/Green)
- "2.4GHz" (Red/Green)
- "5GHz" (Red/Green)
Note:
- after the version v1.3.2 of stock firmware, "offline update" by
uploading image by user is deleted and the factory image cannot be
used
- the U-Boot on WF1200CR doesn't configure the port-side LEDs on WAN/LAN
and the configuration is required on OpenWrt
- gpio-hog: set the direction of GPIO 14(WAN)/19(LAN) to output
- pinmux: set GPIO 14/19 as switch-controlled LEDs
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2021-03-24 15:19:59 +00:00
|
|
|
$(Device/nec_wx1200cr)
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9563
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_MODEL := Aterm WG1200CR
|
2019-03-16 04:27:32 +00:00
|
|
|
IMAGE_SIZE := 7616k
|
|
|
|
|
SEAMA_MTDBLOCK := 6
|
|
|
|
|
SEAMA_SIGNATURE := wrgac72_necpf.2016gui_wg1200cr
|
|
|
|
|
IMAGES += factory.bin
|
2019-12-19 19:42:19 +00:00
|
|
|
IMAGE/factory.bin := $$(IMAGE/default) | pad-rootfs -x 64 | seama | \
|
2020-03-10 13:58:27 +00:00
|
|
|
seama-seal | nec-enc 9gsiy9nzep452pad | check-size
|
2019-03-16 04:27:32 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += nec_wg1200cr
|
|
|
|
|
|
2018-12-08 06:18:17 +00:00
|
|
|
define Device/nec_wg800hp
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9563
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := NEC
|
|
|
|
|
DEVICE_MODEL := Aterm WG800HP
|
2018-12-08 06:18:17 +00:00
|
|
|
IMAGE_SIZE := 7104k
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
2020-03-10 13:58:27 +00:00
|
|
|
append-rootfs | pad-rootfs | check-size | \
|
2019-12-19 19:42:19 +00:00
|
|
|
xor-image -p 6A57190601121E4C004C1E1201061957 -x | nec-fw LASER_ATERM
|
2020-04-26 19:30:16 +00:00
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct-smallbuffers ath10k-firmware-qca9887-ct-full-htt
|
2018-12-08 06:18:17 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += nec_wg800hp
|
|
|
|
|
|
2022-11-22 18:34:37 +00:00
|
|
|
define Device/netgear_ex7300
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9558
|
2022-11-22 18:34:37 +00:00
|
|
|
DEVICE_VENDOR := NETGEAR
|
|
|
|
|
DEVICE_MODEL := EX7300
|
|
|
|
|
DEVICE_ALT0_VENDOR := NETGEAR
|
|
|
|
|
DEVICE_ALT0_MODEL := EX6400
|
2019-08-22 12:34:45 +00:00
|
|
|
NETGEAR_BOARD_ID := EX7300series
|
|
|
|
|
NETGEAR_HW_ID := 29765104+16+0+128
|
|
|
|
|
IMAGE_SIZE := 15552k
|
2022-11-22 18:34:37 +00:00
|
|
|
IMAGES += factory.img
|
2019-12-19 19:42:19 +00:00
|
|
|
IMAGE/default := append-kernel | pad-offset $$$$(BLOCKSIZE) 64 | \
|
|
|
|
|
netgear-rootfs | pad-rootfs
|
2021-06-20 16:54:36 +00:00
|
|
|
IMAGE/sysupgrade.bin := $$(IMAGE/default) | check-size | append-metadata
|
|
|
|
|
IMAGE/factory.img := $$(IMAGE/default) | netgear-dni | check-size
|
2019-08-22 12:34:45 +00:00
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca99x0-ct
|
2022-11-22 18:34:37 +00:00
|
|
|
SUPPORTED_DEVICES += netgear,ex6400
|
2019-08-22 12:34:45 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += netgear_ex7300
|
|
|
|
|
|
2021-06-12 23:32:33 +00:00
|
|
|
define Device/netgear_ex7300-v2
|
|
|
|
|
SOC := qcn5502
|
2022-11-22 18:34:37 +00:00
|
|
|
DEVICE_VENDOR := NETGEAR
|
2021-06-12 23:32:33 +00:00
|
|
|
DEVICE_MODEL := EX7300
|
|
|
|
|
DEVICE_VARIANT := v2
|
2022-11-22 18:34:37 +00:00
|
|
|
DEVICE_ALT0_VENDOR := NETGEAR
|
|
|
|
|
DEVICE_ALT0_MODEL := EX6250
|
|
|
|
|
DEVICE_ALT1_VENDOR := NETGEAR
|
|
|
|
|
DEVICE_ALT1_MODEL := EX6400
|
|
|
|
|
DEVICE_ALT1_VARIANT := v2
|
|
|
|
|
DEVICE_ALT2_VENDOR := NETGEAR
|
|
|
|
|
DEVICE_ALT2_MODEL := EX6410
|
|
|
|
|
DEVICE_ALT3_VENDOR := NETGEAR
|
|
|
|
|
DEVICE_ALT3_MODEL := EX6420
|
|
|
|
|
DEVICE_ALT4_VENDOR := NETGEAR
|
|
|
|
|
DEVICE_ALT4_MODEL := EX7320
|
2021-06-12 23:32:33 +00:00
|
|
|
NETGEAR_BOARD_ID := EX7300v2series
|
|
|
|
|
NETGEAR_HW_ID := 29765907+16+0+128
|
|
|
|
|
IMAGE_SIZE := 14528k
|
2022-11-22 18:34:37 +00:00
|
|
|
IMAGES += factory.img
|
2021-06-12 23:32:33 +00:00
|
|
|
IMAGE/default := append-kernel | pad-offset $$$$(BLOCKSIZE) 64 | \
|
|
|
|
|
netgear-rootfs | pad-rootfs
|
|
|
|
|
IMAGE/sysupgrade.bin := $$(IMAGE/default) | check-size | append-metadata
|
|
|
|
|
IMAGE/factory.img := $$(IMAGE/default) | check-size | netgear-dni
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9984-ct
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += netgear_ex7300-v2
|
|
|
|
|
|
ath79: add Netgear WNDAP360
SoC: Atheros AR7161
RAM: DDR 128 MiB (hynix h5dU5162ETR-E3C)
Flash: SPI-NOR 8 MiB (mx25l6406em2i-12g)
WLAN: 2.4/5 GHz
2.4 GHz: Atheros AR9220
5 GHz: Atheros AR9223
Ethernet: 4x 10/100/1000 Mbps (Atheros AR8021)
LEDs/Keys: 2/2 (Internet + System LED, Mesh button + Reset pin)
UART: RJ45 9600,8N1
Power: 12 VDC, 1.0 A
Installation instruction:
0. Make sure you have latest original firmware (3.7.11.4)
1. Connect to the Serial Port with a Serial Cable RJ45 to DB9/RS232
(9600,8N1)
screen /dev/ttyUSB0 9600,cs8,-parenb,-cstopb,-hupcl,-crtscts,clocal
2. Configure your IP-Address to 192.168.1.42
3. When device boots hit spacebar
3. Configure the device for tftpboot
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.42
saveenv
4. Reset the device
reset
5. Hit again the spacebar
6. Now load the image via tftp:
tftpboot 0x81000000 INITRAMFS.bin
7. Boot the image:
bootm 0x81000000
8. Copy the squashfs-image to the device.
9. Do a sysupgrade.
https://openwrt.org/toh/netgear/wndap360
The device should be converted from kmod-owl-loader to nvmem-cells in the
future. Nvmem cells were not working. Maybe ATH9K_PCI_NO_EEPROM is missing.
That is why this commit is still using kmod-owl-loader. In the future
the device tree may look like this:
&ath9k0 {
nvmem-cells = <&macaddr_art_120c>, <&cal_art_1000>;
nvmem-cell-names = "mac-address", "calibration";
};
&ath9k1 {
nvmem-cells = <&macaddr_art_520c>, <&cal_art_5000>;
nvmem-cell-names = "mac-address", "calibration";
};
&art {
...
cal_art_1000: cal@1000 {
reg = <0x1000 0xeb8>;
};
cal_art_5000: cal@5000 {
reg = <0x5000 0xeb8>;
};
};
Signed-off-by: Nick Hainke <vincent@systemli.org>
2022-03-20 16:57:22 +00:00
|
|
|
define Device/netgear_wndap360
|
|
|
|
|
$(Device/netgear_generic)
|
|
|
|
|
SOC := ar7161
|
|
|
|
|
DEVICE_MODEL := WNDAP360
|
2022-12-22 22:51:16 +00:00
|
|
|
DEVICE_PACKAGES := kmod-leds-reset
|
ath79: add Netgear WNDAP360
SoC: Atheros AR7161
RAM: DDR 128 MiB (hynix h5dU5162ETR-E3C)
Flash: SPI-NOR 8 MiB (mx25l6406em2i-12g)
WLAN: 2.4/5 GHz
2.4 GHz: Atheros AR9220
5 GHz: Atheros AR9223
Ethernet: 4x 10/100/1000 Mbps (Atheros AR8021)
LEDs/Keys: 2/2 (Internet + System LED, Mesh button + Reset pin)
UART: RJ45 9600,8N1
Power: 12 VDC, 1.0 A
Installation instruction:
0. Make sure you have latest original firmware (3.7.11.4)
1. Connect to the Serial Port with a Serial Cable RJ45 to DB9/RS232
(9600,8N1)
screen /dev/ttyUSB0 9600,cs8,-parenb,-cstopb,-hupcl,-crtscts,clocal
2. Configure your IP-Address to 192.168.1.42
3. When device boots hit spacebar
3. Configure the device for tftpboot
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.42
saveenv
4. Reset the device
reset
5. Hit again the spacebar
6. Now load the image via tftp:
tftpboot 0x81000000 INITRAMFS.bin
7. Boot the image:
bootm 0x81000000
8. Copy the squashfs-image to the device.
9. Do a sysupgrade.
https://openwrt.org/toh/netgear/wndap360
The device should be converted from kmod-owl-loader to nvmem-cells in the
future. Nvmem cells were not working. Maybe ATH9K_PCI_NO_EEPROM is missing.
That is why this commit is still using kmod-owl-loader. In the future
the device tree may look like this:
&ath9k0 {
nvmem-cells = <&macaddr_art_120c>, <&cal_art_1000>;
nvmem-cell-names = "mac-address", "calibration";
};
&ath9k1 {
nvmem-cells = <&macaddr_art_520c>, <&cal_art_5000>;
nvmem-cell-names = "mac-address", "calibration";
};
&art {
...
cal_art_1000: cal@1000 {
reg = <0x1000 0xeb8>;
};
cal_art_5000: cal@5000 {
reg = <0x5000 0xeb8>;
};
};
Signed-off-by: Nick Hainke <vincent@systemli.org>
2022-03-20 16:57:22 +00:00
|
|
|
IMAGE_SIZE := 7744k
|
|
|
|
|
BLOCKSIZE := 256k
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | gzip | uImage gzip
|
|
|
|
|
KERNEL_INITRAMFS := kernel-bin | append-dtb | uImage none
|
|
|
|
|
IMAGES := sysupgrade.bin
|
|
|
|
|
IMAGE/sysupgrade.bin := append-kernel | pad-to 64k | append-rootfs | pad-rootfs | \
|
|
|
|
|
check-size | append-metadata
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += netgear_wndap360
|
|
|
|
|
|
2019-08-22 12:34:45 +00:00
|
|
|
define Device/netgear_wndr3x00
|
2020-07-25 18:29:12 +00:00
|
|
|
$(Device/netgear_generic)
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar7161
|
2019-12-19 19:42:19 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb-ohci kmod-usb2 kmod-usb-ledtrig-usbport \
|
2022-04-27 17:58:33 +00:00
|
|
|
kmod-leds-reset kmod-owl-loader kmod-switch-rtl8366s
|
2019-08-22 12:34:45 +00:00
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/netgear_wndr3700
|
|
|
|
|
$(Device/netgear_wndr3x00)
|
|
|
|
|
DEVICE_MODEL := WNDR3700
|
|
|
|
|
DEVICE_VARIANT := v1
|
2020-11-04 09:21:16 +00:00
|
|
|
UIMAGE_MAGIC := 0x33373030
|
2019-08-22 12:34:45 +00:00
|
|
|
NETGEAR_BOARD_ID := WNDR3700
|
|
|
|
|
IMAGE_SIZE := 7680k
|
|
|
|
|
IMAGES += factory-NA.img
|
2019-12-19 19:42:19 +00:00
|
|
|
IMAGE/factory-NA.img := $$(IMAGE/default) | netgear-dni NA | \
|
2020-03-10 13:58:27 +00:00
|
|
|
check-size
|
2019-08-22 12:34:45 +00:00
|
|
|
SUPPORTED_DEVICES += wndr3700
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += netgear_wndr3700
|
|
|
|
|
|
2020-01-20 20:19:29 +00:00
|
|
|
define Device/netgear_wndr3700-v2
|
2019-08-22 12:34:45 +00:00
|
|
|
$(Device/netgear_wndr3x00)
|
|
|
|
|
DEVICE_MODEL := WNDR3700
|
|
|
|
|
DEVICE_VARIANT := v2
|
2020-11-04 09:21:16 +00:00
|
|
|
UIMAGE_MAGIC := 0x33373031
|
2019-08-22 12:34:45 +00:00
|
|
|
NETGEAR_BOARD_ID := WNDR3700v2
|
|
|
|
|
NETGEAR_HW_ID := 29763654+16+64
|
|
|
|
|
IMAGE_SIZE := 15872k
|
2020-01-20 20:19:29 +00:00
|
|
|
SUPPORTED_DEVICES += wndr3700 netgear,wndr3700v2
|
2019-08-22 12:34:45 +00:00
|
|
|
endef
|
2020-01-20 20:19:29 +00:00
|
|
|
TARGET_DEVICES += netgear_wndr3700-v2
|
2019-08-22 12:34:45 +00:00
|
|
|
|
|
|
|
|
define Device/netgear_wndr3800
|
|
|
|
|
$(Device/netgear_wndr3x00)
|
|
|
|
|
DEVICE_MODEL := WNDR3800
|
2020-11-04 09:21:16 +00:00
|
|
|
UIMAGE_MAGIC := 0x33373031
|
2019-08-22 12:34:45 +00:00
|
|
|
NETGEAR_BOARD_ID := WNDR3800
|
|
|
|
|
NETGEAR_HW_ID := 29763654+16+128
|
|
|
|
|
IMAGE_SIZE := 15872k
|
2019-11-14 16:26:44 +00:00
|
|
|
SUPPORTED_DEVICES += wndr3700
|
2019-08-22 12:34:45 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += netgear_wndr3800
|
|
|
|
|
|
2019-08-07 20:07:33 +00:00
|
|
|
define Device/netgear_wndr3800ch
|
|
|
|
|
$(Device/netgear_wndr3x00)
|
|
|
|
|
DEVICE_MODEL := WNDR3800CH
|
2020-11-04 09:21:16 +00:00
|
|
|
UIMAGE_MAGIC := 0x33373031
|
2019-08-07 20:07:33 +00:00
|
|
|
NETGEAR_BOARD_ID := WNDR3800CH
|
|
|
|
|
NETGEAR_HW_ID := 29763654+16+128
|
|
|
|
|
IMAGE_SIZE := 15872k
|
2019-11-14 16:26:44 +00:00
|
|
|
SUPPORTED_DEVICES += wndr3700
|
2019-08-07 20:07:33 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += netgear_wndr3800ch
|
|
|
|
|
|
2020-05-10 22:10:20 +00:00
|
|
|
define Device/netgear_wndrmac-v1
|
|
|
|
|
$(Device/netgear_wndr3x00)
|
|
|
|
|
DEVICE_MODEL := WNDRMAC
|
|
|
|
|
DEVICE_VARIANT := v1
|
2020-11-04 09:21:16 +00:00
|
|
|
UIMAGE_MAGIC := 0x33373031
|
2020-05-10 22:10:20 +00:00
|
|
|
NETGEAR_BOARD_ID := WNDRMAC
|
|
|
|
|
NETGEAR_HW_ID := 29763654+16+64
|
|
|
|
|
IMAGE_SIZE := 15872k
|
|
|
|
|
SUPPORTED_DEVICES += wndr3700
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += netgear_wndrmac-v1
|
|
|
|
|
|
2020-05-10 23:05:20 +00:00
|
|
|
define Device/netgear_wndrmac-v2
|
|
|
|
|
$(Device/netgear_wndr3x00)
|
|
|
|
|
DEVICE_MODEL := WNDRMAC
|
|
|
|
|
DEVICE_VARIANT := v2
|
2020-11-04 09:21:16 +00:00
|
|
|
UIMAGE_MAGIC := 0x33373031
|
2020-05-10 23:05:20 +00:00
|
|
|
NETGEAR_BOARD_ID := WNDRMACv2
|
|
|
|
|
NETGEAR_HW_ID := 29763654+16+128
|
|
|
|
|
IMAGE_SIZE := 15872k
|
|
|
|
|
SUPPORTED_DEVICES += wndr3700
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += netgear_wndrmac-v2
|
|
|
|
|
|
2019-10-30 09:07:27 +00:00
|
|
|
define Device/netgear_wnr2200_common
|
2020-07-25 18:29:12 +00:00
|
|
|
$(Device/netgear_generic)
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar7241
|
2019-10-30 09:07:27 +00:00
|
|
|
DEVICE_MODEL := WNR2200
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport
|
2020-11-04 09:21:16 +00:00
|
|
|
UIMAGE_MAGIC := 0x32323030
|
2019-10-30 09:07:27 +00:00
|
|
|
NETGEAR_BOARD_ID := wnr2200
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/netgear_wnr2200-8m
|
|
|
|
|
$(Device/netgear_wnr2200_common)
|
|
|
|
|
DEVICE_VARIANT := 8M
|
|
|
|
|
NETGEAR_HW_ID := 29763600+08+64
|
|
|
|
|
IMAGE_SIZE := 7808k
|
|
|
|
|
IMAGES += factory-NA.img
|
|
|
|
|
IMAGE/factory-NA.img := $$(IMAGE/default) | netgear-dni NA | \
|
2020-03-10 13:58:27 +00:00
|
|
|
check-size
|
2019-10-30 09:07:27 +00:00
|
|
|
SUPPORTED_DEVICES += wnr2200
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += netgear_wnr2200-8m
|
|
|
|
|
|
|
|
|
|
define Device/netgear_wnr2200-16m
|
|
|
|
|
$(Device/netgear_wnr2200_common)
|
|
|
|
|
DEVICE_VARIANT := 16M
|
|
|
|
|
DEVICE_ALT0_VENDOR := NETGEAR
|
|
|
|
|
DEVICE_ALT0_MODEL := WNR2200
|
|
|
|
|
DEVICE_ALT0_VARIANT := CN/RU
|
|
|
|
|
NETGEAR_HW_ID :=
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += netgear_wnr2200-16m
|
|
|
|
|
|
2018-08-08 20:13:44 +00:00
|
|
|
define Device/ocedo_koala
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9558
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := Ocedo
|
|
|
|
|
DEVICE_MODEL := Koala
|
2018-09-05 12:51:44 +00:00
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
2018-08-08 20:13:44 +00:00
|
|
|
SUPPORTED_DEVICES += koala
|
2022-11-15 14:25:40 +00:00
|
|
|
IMAGE_SIZE := 14848k
|
2018-08-08 20:13:44 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += ocedo_koala
|
|
|
|
|
|
2018-07-06 16:23:31 +00:00
|
|
|
define Device/ocedo_raccoon
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9344
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := Ocedo
|
|
|
|
|
DEVICE_MODEL := Raccoon
|
2022-11-15 14:25:40 +00:00
|
|
|
IMAGE_SIZE := 14848k
|
2018-07-06 16:23:31 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += ocedo_raccoon
|
|
|
|
|
|
2019-03-21 15:43:27 +00:00
|
|
|
define Device/ocedo_ursus
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9558
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := Ocedo
|
|
|
|
|
DEVICE_MODEL := Ursus
|
2019-03-21 15:43:27 +00:00
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
2022-11-15 14:25:40 +00:00
|
|
|
IMAGE_SIZE := 14848k
|
2019-03-21 15:43:27 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += ocedo_ursus
|
|
|
|
|
|
2021-08-23 13:07:38 +00:00
|
|
|
define Device/onion_omega
|
|
|
|
|
$(Device/tplink-16mlzma)
|
|
|
|
|
SOC := ar9331
|
|
|
|
|
DEVICE_VENDOR := Onion
|
|
|
|
|
DEVICE_MODEL := Omega
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2
|
|
|
|
|
SUPPORTED_DEVICES += onion-omega
|
|
|
|
|
KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | uImage lzma
|
|
|
|
|
IMAGE_SIZE := 16192k
|
|
|
|
|
TPLINK_HWID := 0x04700001
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += onion_omega
|
|
|
|
|
|
2021-01-19 13:28:05 +00:00
|
|
|
define Device/openmesh_common_64k
|
2020-11-23 12:41:34 +00:00
|
|
|
DEVICE_VENDOR := OpenMesh
|
|
|
|
|
DEVICE_PACKAGES := uboot-envtools
|
|
|
|
|
IMAGE_SIZE := 7808k
|
2021-01-19 13:28:05 +00:00
|
|
|
OPENMESH_CE_TYPE :=
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | uImage lzma | \
|
|
|
|
|
pad-to $$(BLOCKSIZE)
|
|
|
|
|
IMAGE/sysupgrade.bin := append-rootfs | pad-rootfs | \
|
|
|
|
|
openmesh-image ce_type=$$$$(OPENMESH_CE_TYPE) | append-metadata
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/openmesh_common_256k
|
|
|
|
|
DEVICE_VENDOR := OpenMesh
|
|
|
|
|
DEVICE_PACKAGES := uboot-envtools
|
|
|
|
|
IMAGE_SIZE := 7168k
|
|
|
|
|
BLOCKSIZE := 256k
|
|
|
|
|
OPENMESH_CE_TYPE :=
|
2020-11-23 12:41:34 +00:00
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | uImage lzma | \
|
|
|
|
|
pad-to $$(BLOCKSIZE)
|
|
|
|
|
IMAGE/sysupgrade.bin := append-rootfs | pad-rootfs | \
|
2021-01-19 13:28:05 +00:00
|
|
|
openmesh-image ce_type=$$$$(OPENMESH_CE_TYPE) | append-metadata
|
2020-11-23 12:41:34 +00:00
|
|
|
endef
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_a40
|
|
|
|
|
$(Device/openmesh_common_64k)
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_MODEL := A40
|
|
|
|
|
DEVICE_PACKAGES += kmod-ath10k-ct ath10k-firmware-qca988x-ct kmod-usb2
|
|
|
|
|
OPENMESH_CE_TYPE := A60
|
|
|
|
|
SUPPORTED_DEVICES += a40
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_a40
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_a60
|
|
|
|
|
$(Device/openmesh_common_64k)
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_MODEL := A60
|
|
|
|
|
DEVICE_PACKAGES += kmod-ath10k-ct ath10k-firmware-qca988x-ct kmod-usb2
|
|
|
|
|
OPENMESH_CE_TYPE := A60
|
|
|
|
|
SUPPORTED_DEVICES += a60
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_a60
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_mr600-v1
|
2021-01-19 13:28:05 +00:00
|
|
|
$(Device/openmesh_common_64k)
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_MODEL := MR600
|
2020-11-23 12:41:34 +00:00
|
|
|
DEVICE_VARIANT := v1
|
2021-01-19 13:28:05 +00:00
|
|
|
OPENMESH_CE_TYPE := MR600
|
2020-11-23 12:41:34 +00:00
|
|
|
SUPPORTED_DEVICES += mr600
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_mr600-v1
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_mr600-v2
|
2021-01-19 13:28:05 +00:00
|
|
|
$(Device/openmesh_common_64k)
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_MODEL := MR600
|
2020-11-23 12:41:34 +00:00
|
|
|
DEVICE_VARIANT := v2
|
2021-01-19 13:28:05 +00:00
|
|
|
OPENMESH_CE_TYPE := MR600
|
2020-11-23 12:41:34 +00:00
|
|
|
SUPPORTED_DEVICES += mr600v2
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_mr600-v2
|
|
|
|
|
|
2021-01-19 13:28:05 +00:00
|
|
|
define Device/openmesh_mr900-v1
|
|
|
|
|
$(Device/openmesh_common_64k)
|
2020-11-23 12:41:34 +00:00
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_MODEL := MR900
|
|
|
|
|
DEVICE_VARIANT := v1
|
2021-01-19 13:28:05 +00:00
|
|
|
OPENMESH_CE_TYPE := MR900
|
2020-11-23 12:41:34 +00:00
|
|
|
SUPPORTED_DEVICES += mr900
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_mr900-v1
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_mr900-v2
|
2021-01-19 13:28:05 +00:00
|
|
|
$(Device/openmesh_common_64k)
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_MODEL := MR900
|
2020-11-23 12:41:34 +00:00
|
|
|
DEVICE_VARIANT := v2
|
2021-01-19 13:28:05 +00:00
|
|
|
OPENMESH_CE_TYPE := MR900
|
2020-11-23 12:41:34 +00:00
|
|
|
SUPPORTED_DEVICES += mr900v2
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_mr900-v2
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_mr1750-v1
|
|
|
|
|
$(Device/openmesh_common_64k)
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_MODEL := MR1750
|
|
|
|
|
DEVICE_VARIANT := v1
|
|
|
|
|
DEVICE_PACKAGES += kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
|
|
|
|
OPENMESH_CE_TYPE := MR1750
|
|
|
|
|
SUPPORTED_DEVICES += mr1750
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_mr1750-v1
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_mr1750-v2
|
|
|
|
|
$(Device/openmesh_common_64k)
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_MODEL := MR1750
|
|
|
|
|
DEVICE_VARIANT := v2
|
|
|
|
|
DEVICE_PACKAGES += kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
|
|
|
|
OPENMESH_CE_TYPE := MR1750
|
|
|
|
|
SUPPORTED_DEVICES += mr1750v2
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_mr1750-v2
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_om2p-v1
|
|
|
|
|
$(Device/openmesh_common_256k)
|
|
|
|
|
SOC := ar7240
|
|
|
|
|
DEVICE_MODEL := OM2P
|
|
|
|
|
DEVICE_VARIANT := v1
|
|
|
|
|
OPENMESH_CE_TYPE := OM2P
|
|
|
|
|
SUPPORTED_DEVICES += om2p
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_om2p-v1
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_om2p-v2
|
2021-01-19 13:28:05 +00:00
|
|
|
$(Device/openmesh_common_256k)
|
2020-11-23 12:41:34 +00:00
|
|
|
SOC := ar9330
|
|
|
|
|
DEVICE_MODEL := OM2P
|
|
|
|
|
DEVICE_VARIANT := v2
|
2021-01-19 13:28:05 +00:00
|
|
|
OPENMESH_CE_TYPE := OM2P
|
2020-11-23 12:41:34 +00:00
|
|
|
SUPPORTED_DEVICES += om2pv2
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_om2p-v2
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_om2p-v4
|
2021-01-19 13:28:05 +00:00
|
|
|
$(Device/openmesh_common_256k)
|
2020-11-23 12:41:34 +00:00
|
|
|
SOC := qca9533
|
|
|
|
|
DEVICE_MODEL := OM2P
|
|
|
|
|
DEVICE_VARIANT := v4
|
2021-01-19 13:28:05 +00:00
|
|
|
OPENMESH_CE_TYPE := OM2P
|
2020-11-23 12:41:34 +00:00
|
|
|
SUPPORTED_DEVICES += om2pv4
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_om2p-v4
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_om2p-hs-v1
|
2021-01-19 13:28:05 +00:00
|
|
|
$(Device/openmesh_common_256k)
|
2020-11-23 12:41:34 +00:00
|
|
|
SOC := ar9341
|
|
|
|
|
DEVICE_MODEL := OM2P-HS
|
|
|
|
|
DEVICE_VARIANT := v1
|
2021-01-19 13:28:05 +00:00
|
|
|
OPENMESH_CE_TYPE := OM2P
|
2020-11-23 12:41:34 +00:00
|
|
|
SUPPORTED_DEVICES += om2p-hs
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_om2p-hs-v1
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_om2p-hs-v2
|
2021-01-19 13:28:05 +00:00
|
|
|
$(Device/openmesh_common_256k)
|
2020-11-23 12:41:34 +00:00
|
|
|
SOC := ar9341
|
|
|
|
|
DEVICE_MODEL := OM2P-HS
|
|
|
|
|
DEVICE_VARIANT := v2
|
2021-01-19 13:28:05 +00:00
|
|
|
OPENMESH_CE_TYPE := OM2P
|
2020-11-23 12:41:34 +00:00
|
|
|
SUPPORTED_DEVICES += om2p-hsv2
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_om2p-hs-v2
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_om2p-hs-v3
|
2021-01-19 13:28:05 +00:00
|
|
|
$(Device/openmesh_common_256k)
|
2020-11-23 12:41:34 +00:00
|
|
|
SOC := ar9341
|
|
|
|
|
DEVICE_MODEL := OM2P-HS
|
|
|
|
|
DEVICE_VARIANT := v3
|
2021-01-19 13:28:05 +00:00
|
|
|
OPENMESH_CE_TYPE := OM2P
|
2020-11-23 12:41:34 +00:00
|
|
|
SUPPORTED_DEVICES += om2p-hsv3
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_om2p-hs-v3
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_om2p-hs-v4
|
2021-01-19 13:28:05 +00:00
|
|
|
$(Device/openmesh_common_256k)
|
2020-11-23 12:41:34 +00:00
|
|
|
SOC := qca9533
|
|
|
|
|
DEVICE_MODEL := OM2P-HS
|
|
|
|
|
DEVICE_VARIANT := v4
|
2021-01-19 13:28:05 +00:00
|
|
|
OPENMESH_CE_TYPE := OM2P
|
2020-11-23 12:41:34 +00:00
|
|
|
SUPPORTED_DEVICES += om2p-hsv4
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_om2p-hs-v4
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_om2p-lc
|
2021-01-19 13:28:05 +00:00
|
|
|
$(Device/openmesh_common_256k)
|
2020-11-23 12:41:34 +00:00
|
|
|
SOC := ar9330
|
|
|
|
|
DEVICE_MODEL := OM2P-LC
|
2021-01-19 13:28:05 +00:00
|
|
|
OPENMESH_CE_TYPE := OM2P
|
2020-11-23 12:41:34 +00:00
|
|
|
SUPPORTED_DEVICES += om2p-lc
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_om2p-lc
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_om5p
|
2021-01-19 13:28:05 +00:00
|
|
|
$(Device/openmesh_common_64k)
|
|
|
|
|
SOC := ar9344
|
2020-11-23 12:41:34 +00:00
|
|
|
DEVICE_MODEL := OM5P
|
2021-01-19 13:28:05 +00:00
|
|
|
OPENMESH_CE_TYPE := OM5P
|
2020-11-23 12:41:34 +00:00
|
|
|
SUPPORTED_DEVICES += om5p
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_om5p
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_om5p-ac-v1
|
|
|
|
|
$(Device/openmesh_common_64k)
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_MODEL := OM5P-AC
|
|
|
|
|
DEVICE_VARIANT := v1
|
|
|
|
|
DEVICE_PACKAGES += kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
|
|
|
|
OPENMESH_CE_TYPE := OM5PAC
|
|
|
|
|
SUPPORTED_DEVICES += om5p-ac
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_om5p-ac-v1
|
|
|
|
|
|
2018-05-08 05:22:38 +00:00
|
|
|
define Device/openmesh_om5p-ac-v2
|
2020-11-23 12:41:34 +00:00
|
|
|
$(Device/openmesh_common_64k)
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9558
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_MODEL := OM5P-AC
|
|
|
|
|
DEVICE_VARIANT := v2
|
2020-11-23 12:41:34 +00:00
|
|
|
DEVICE_PACKAGES += kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
|
|
|
|
OPENMESH_CE_TYPE := OM5PAC
|
2018-05-07 20:41:04 +00:00
|
|
|
SUPPORTED_DEVICES += om5p-acv2
|
2018-05-06 08:20:11 +00:00
|
|
|
endef
|
2018-05-08 05:22:38 +00:00
|
|
|
TARGET_DEVICES += openmesh_om5p-ac-v2
|
2018-05-06 08:20:11 +00:00
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/openmesh_om5p-an
|
|
|
|
|
$(Device/openmesh_common_64k)
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_MODEL := OM5P-AN
|
|
|
|
|
OPENMESH_CE_TYPE := OM5P
|
|
|
|
|
SUPPORTED_DEVICES += om5p-an
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += openmesh_om5p-an
|
|
|
|
|
|
2018-07-28 12:52:39 +00:00
|
|
|
define Device/pcs_cap324
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9344
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := PowerCloud Systems
|
|
|
|
|
DEVICE_MODEL := CAP324
|
2018-07-28 12:52:39 +00:00
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
SUPPORTED_DEVICES += cap324
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += pcs_cap324
|
|
|
|
|
|
2018-07-28 12:57:22 +00:00
|
|
|
define Device/pcs_cr3000
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9341
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := PowerCloud Systems
|
|
|
|
|
DEVICE_MODEL := CR3000
|
2018-07-28 12:57:22 +00:00
|
|
|
IMAGE_SIZE := 7808k
|
|
|
|
|
SUPPORTED_DEVICES += cr3000
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += pcs_cr3000
|
|
|
|
|
|
2018-07-20 20:52:46 +00:00
|
|
|
define Device/pcs_cr5000
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9344
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := PowerCloud Systems
|
|
|
|
|
DEVICE_MODEL := CR5000
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
2018-07-20 20:52:46 +00:00
|
|
|
IMAGE_SIZE := 7808k
|
|
|
|
|
SUPPORTED_DEVICES += cr5000
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += pcs_cr5000
|
|
|
|
|
|
2019-08-22 12:34:45 +00:00
|
|
|
define Device/phicomm_k2t
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9563
|
2019-08-22 12:34:45 +00:00
|
|
|
DEVICE_VENDOR := Phicomm
|
|
|
|
|
DEVICE_MODEL := K2T
|
|
|
|
|
IMAGE_SIZE := 15744k
|
2019-12-19 19:42:19 +00:00
|
|
|
IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | \
|
2021-06-20 16:54:36 +00:00
|
|
|
check-size | append-metadata
|
2019-12-22 20:05:13 +00:00
|
|
|
DEVICE_PACKAGES := kmod-leds-reset kmod-ath10k-ct-smallbuffers ath10k-firmware-qca9888-ct
|
2018-08-11 22:18:53 +00:00
|
|
|
endef
|
2019-08-22 12:34:45 +00:00
|
|
|
TARGET_DEVICES += phicomm_k2t
|
2018-08-11 22:18:53 +00:00
|
|
|
|
2019-06-25 08:32:58 +00:00
|
|
|
define Device/pisen_ts-d084
|
|
|
|
|
$(Device/tplink-8mlzma)
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9331
|
2019-06-25 08:32:58 +00:00
|
|
|
DEVICE_VENDOR := PISEN
|
|
|
|
|
DEVICE_MODEL := TS-D084
|
2020-09-18 11:56:53 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2
|
2019-06-25 08:32:58 +00:00
|
|
|
TPLINK_HWID := 0x07030101
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += pisen_ts-d084
|
|
|
|
|
|
2019-08-04 14:13:45 +00:00
|
|
|
define Device/pisen_wmb001n
|
2021-09-26 14:07:44 +00:00
|
|
|
$(Device/loader-okli-uimage)
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9341
|
2019-08-04 14:13:45 +00:00
|
|
|
DEVICE_VENDOR := PISEN
|
|
|
|
|
DEVICE_MODEL := WMB001N
|
|
|
|
|
IMAGE_SIZE := 14080k
|
2020-03-05 14:42:18 +00:00
|
|
|
DEVICE_PACKAGES := kmod-i2c-gpio kmod-usb2
|
2019-08-04 14:13:45 +00:00
|
|
|
LOADER_FLASH_OFFS := 0x20000
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x4f4b4c49
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := $$(IMAGE/sysupgrade.bin) | pisen_wmb001n-factory $(1)
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += pisen_wmb001n
|
|
|
|
|
|
2018-08-12 14:32:01 +00:00
|
|
|
define Device/pisen_wmm003n
|
|
|
|
|
$(Device/tplink-8mlzma)
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9331
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := PISEN
|
|
|
|
|
DEVICE_MODEL := Cloud Easy Power (WMM003N)
|
2020-09-18 11:56:53 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2
|
2018-08-12 14:32:01 +00:00
|
|
|
TPLINK_HWID := 0x07030101
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += pisen_wmm003n
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/plasmacloud_pa300-common
|
|
|
|
|
SOC := qca9533
|
|
|
|
|
DEVICE_VENDOR := Plasma Cloud
|
|
|
|
|
DEVICE_PACKAGES := uboot-envtools
|
|
|
|
|
IMAGE_SIZE := 7168k
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | uImage lzma | pad-to $$(BLOCKSIZE)
|
|
|
|
|
IMAGE/factory.bin := append-rootfs | pad-rootfs | openmesh-image ce_type=PA300
|
2020-12-24 20:20:53 +00:00
|
|
|
IMAGE/sysupgrade.bin := append-rootfs | pad-rootfs | sysupgrade-tar rootfs=$$$$@ | append-metadata
|
2020-11-23 12:41:34 +00:00
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/plasmacloud_pa300
|
|
|
|
|
$(Device/plasmacloud_pa300-common)
|
|
|
|
|
DEVICE_MODEL := PA300
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += plasmacloud_pa300
|
|
|
|
|
|
2020-11-23 12:41:34 +00:00
|
|
|
define Device/plasmacloud_pa300e
|
|
|
|
|
$(Device/plasmacloud_pa300-common)
|
|
|
|
|
DEVICE_MODEL := PA300E
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += plasmacloud_pa300e
|
|
|
|
|
|
2020-08-03 21:07:21 +00:00
|
|
|
define Device/qca_ap143
|
2021-09-26 14:07:44 +00:00
|
|
|
$(Device/loader-okli-uimage)
|
2020-08-03 21:07:21 +00:00
|
|
|
SOC := qca9533
|
|
|
|
|
DEVICE_VENDOR := Qualcomm Atheros
|
|
|
|
|
DEVICE_MODEL := AP143
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
|
|
|
|
SUPPORTED_DEVICES += ap143
|
|
|
|
|
LOADER_FLASH_OFFS := 0x50000
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x4f4b4c49
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/qca_ap143-8m
|
|
|
|
|
$(Device/qca_ap143)
|
|
|
|
|
DEVICE_VARIANT := (8M)
|
|
|
|
|
IMAGE_SIZE := 7744k
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | check-size | pad-to 6336k | \
|
|
|
|
|
append-loader-okli-uimage $(1) | pad-to 64k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += qca_ap143-8m
|
|
|
|
|
|
|
|
|
|
define Device/qca_ap143-16m
|
|
|
|
|
$(Device/qca_ap143)
|
|
|
|
|
DEVICE_VARIANT := (16M)
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | check-size | pad-to 14528k | \
|
|
|
|
|
append-loader-okli-uimage $(1) | pad-to 64k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += qca_ap143-16m
|
|
|
|
|
|
2019-07-15 11:43:31 +00:00
|
|
|
define Device/qihoo_c301
|
|
|
|
|
$(Device/seama)
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9344
|
2019-07-15 11:43:31 +00:00
|
|
|
DEVICE_VENDOR := Qihoo
|
|
|
|
|
DEVICE_MODEL := C301
|
2019-12-19 19:42:19 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca988x-ct \
|
|
|
|
|
uboot-envtools
|
2019-07-15 11:43:31 +00:00
|
|
|
IMAGE_SIZE := 15744k
|
|
|
|
|
SEAMA_SIGNATURE := wrgac26_qihoo360_360rg
|
|
|
|
|
SUPPORTED_DEVICES += qihoo-c301
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += qihoo_c301
|
|
|
|
|
|
ath79: add support for Qxwlan E1700AC v2
E1700AC v2 based on Qualcomm/Atheros QCA9563 + QCA9880.
Specification:
- 750/400/250 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 3T3R 5 GHz
- 2 x 10/1000M Mbps Ethernet (RJ45)
- 1 x MiniPCI-e
- 1 x SIM (3G/4G)
- 1 x USB 2.0 Port
- 5 x LED , 2 x Button(S8-Reset Buttun), 1 x power input
- UART (J5) header on PCB (115200 8N1)
Flash instruction:
1.Using tftp mode with UART connection and original LEDE image
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "openwrt-ar71xx-generic-xxx-squashfs-sysupgrade.bin"
to "firmware.bin" and place it in tftp server directory.
- Connect PC with one of LAN ports, power up the router and press
key "Enter" to access U-Boot CLI.
- Use the following commands to update the device to LEDE:
run lfw
- After that the device will reboot and boot to LEDE.
- Wait until all LEDs stops flashing and use the router.
2.Using httpd mode with Web UI connection and original LEDE image
- Configure PC with static IP 192.168.1.xxx(2-255) and tftp server.
- Connect PC with one of LAN ports,press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
leds flashing.
- Open your browser and enter 192.168.1.1,You will see the upgrade
interface, select "openwrt-ar71xx-generic-xxx-squashfs-
sysupgrade.bin" and click the upgrade button.
- After that the device will reboot and boot to LEDE.
- Wait until all LEDs stops flashing and use the router.
Signed-off-by: 张鹏 <sd20@qxwlan.com>
[cut out of bigger patch, keep swconfig, whitespace fixes]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-10-16 10:53:51 +00:00
|
|
|
define Device/qxwlan_e1700ac-v2
|
|
|
|
|
SOC := qca9563
|
|
|
|
|
DEVICE_VENDOR := Qxwlan
|
|
|
|
|
DEVICE_MODEL := E1700AC
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
2020-10-17 12:00:54 +00:00
|
|
|
SUPPORTED_DEVICES += e1700ac-v2
|
ath79: add support for Qxwlan E1700AC v2
E1700AC v2 based on Qualcomm/Atheros QCA9563 + QCA9880.
Specification:
- 750/400/250 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 3T3R 5 GHz
- 2 x 10/1000M Mbps Ethernet (RJ45)
- 1 x MiniPCI-e
- 1 x SIM (3G/4G)
- 1 x USB 2.0 Port
- 5 x LED , 2 x Button(S8-Reset Buttun), 1 x power input
- UART (J5) header on PCB (115200 8N1)
Flash instruction:
1.Using tftp mode with UART connection and original LEDE image
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "openwrt-ar71xx-generic-xxx-squashfs-sysupgrade.bin"
to "firmware.bin" and place it in tftp server directory.
- Connect PC with one of LAN ports, power up the router and press
key "Enter" to access U-Boot CLI.
- Use the following commands to update the device to LEDE:
run lfw
- After that the device will reboot and boot to LEDE.
- Wait until all LEDs stops flashing and use the router.
2.Using httpd mode with Web UI connection and original LEDE image
- Configure PC with static IP 192.168.1.xxx(2-255) and tftp server.
- Connect PC with one of LAN ports,press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
leds flashing.
- Open your browser and enter 192.168.1.1,You will see the upgrade
interface, select "openwrt-ar71xx-generic-xxx-squashfs-
sysupgrade.bin" and click the upgrade button.
- After that the device will reboot and boot to LEDE.
- Wait until all LEDs stops flashing and use the router.
Signed-off-by: 张鹏 <sd20@qxwlan.com>
[cut out of bigger patch, keep swconfig, whitespace fixes]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-10-16 10:53:51 +00:00
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/qxwlan_e1700ac-v2-16m
|
|
|
|
|
$(Device/qxwlan_e1700ac-v2)
|
|
|
|
|
DEVICE_VARIANT := v2 (16M)
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += qxwlan_e1700ac-v2-16m
|
|
|
|
|
|
|
|
|
|
define Device/qxwlan_e1700ac-v2-8m
|
|
|
|
|
$(Device/qxwlan_e1700ac-v2)
|
|
|
|
|
DEVICE_VARIANT := v2 (8M)
|
|
|
|
|
IMAGE_SIZE := 7744k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += qxwlan_e1700ac-v2-8m
|
|
|
|
|
|
2020-10-16 10:42:15 +00:00
|
|
|
define Device/qxwlan_e558-v2
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := Qxwlan
|
|
|
|
|
DEVICE_MODEL := E558
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
2020-10-17 12:00:54 +00:00
|
|
|
SUPPORTED_DEVICES += e558-v2
|
2020-10-16 10:42:15 +00:00
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/qxwlan_e558-v2-16m
|
|
|
|
|
$(Device/qxwlan_e558-v2)
|
|
|
|
|
DEVICE_VARIANT := v2 (16M)
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += qxwlan_e558-v2-16m
|
|
|
|
|
|
|
|
|
|
define Device/qxwlan_e558-v2-8m
|
|
|
|
|
$(Device/qxwlan_e558-v2)
|
|
|
|
|
DEVICE_VARIANT := v2 (8M)
|
|
|
|
|
IMAGE_SIZE := 7744k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += qxwlan_e558-v2-8m
|
|
|
|
|
|
ath79: add support for Qxwlan E600G v2 / E600GAC v2
E600G v2 based on Qualcomm/Atheros QCA9531
Specification:
- 650/600/200 MHz (CPU/DDR/AHB)
- 128/64 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 2T2R 2.4 GHz
- 2 x 10/100 Mbps Ethernet(RJ45)
- 1 x MiniPCI-e
- 1 x SIM (3G/4G)
- 5 x LED , 1 x Button(SW2-Reset Buttun), 1 x power input
- UART(J100) header on PCB(115200 8N1)
E600GAC v2 based on Qualcomm/Atheros QCA9531 + QCA9887
Specification:
- 650/600/200 MHz (CPU/DDR/AHB)
- 128/64 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 2T2R 2.4 GHz
- 1T1R 5 GHz
- 2 x 10/100 Mbps Ethernet(RJ45)
- 6 x LED (one three-color led), 2 x Button(SW2-Reset Buttun),1 x power input
- UART (J100)header on PCB(115200 8N1)
Flash instruction:
1.Using tftp mode with UART connection and original OpenWrt image
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "openwrt-ath79-generic-xxx-squashfs-sysupgrade.bin"
to "firmware.bin" and place it in tftp server directory.
- Connect PC with one of LAN ports, power up the router and press
key "Enter" to access U-Boot CLI.
- Use the following commands to update the device to OpenWrt:
run lfw
- After that the device will reboot and boot to OpenWrt.
- Wait until all LEDs stops flashing and use the router.
2.Using httpd mode with Web UI connection and original OpenWrt image
- Configure PC with static IP 192.168.1.xxx(2-255) and tftp server.
- Connect PC with one of LAN ports,press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
leds flashing.
- Open your browser and enter 192.168.1.1,You will see the upgrade
interface, select "openwrt-ath79-generic-xxx-squashfs-
sysupgrade.bin" and click the upgrade button.
- After that the device will reboot and boot to OpenWrt.
- Wait until all LEDs stops flashing and use the router.
Signed-off-by: 张鹏 <sd20@qxwlan.com>
[rearrange in generic.mk, fix one case in 04_led_migration, update
commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-10-31 01:35:21 +00:00
|
|
|
define Device/qxwlan_e600g-v2
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := Qxwlan
|
|
|
|
|
DEVICE_MODEL := E600G
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
|
|
|
|
SUPPORTED_DEVICES += e600g-v2
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/qxwlan_e600g-v2-16m
|
|
|
|
|
$(Device/qxwlan_e600g-v2)
|
|
|
|
|
DEVICE_VARIANT := v2 (16M)
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += qxwlan_e600g-v2-16m
|
|
|
|
|
|
|
|
|
|
define Device/qxwlan_e600g-v2-8m
|
|
|
|
|
$(Device/qxwlan_e600g-v2)
|
|
|
|
|
DEVICE_VARIANT := v2 (8M)
|
|
|
|
|
IMAGE_SIZE := 7744k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += qxwlan_e600g-v2-8m
|
|
|
|
|
|
|
|
|
|
define Device/qxwlan_e600gac-v2
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := Qxwlan
|
|
|
|
|
DEVICE_MODEL := E600GAC
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9887-ct
|
|
|
|
|
SUPPORTED_DEVICES += e600gac-v2
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/qxwlan_e600gac-v2-16m
|
|
|
|
|
$(Device/qxwlan_e600gac-v2)
|
|
|
|
|
DEVICE_VARIANT := v2 (16M)
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += qxwlan_e600gac-v2-16m
|
|
|
|
|
|
|
|
|
|
define Device/qxwlan_e600gac-v2-8m
|
|
|
|
|
$(Device/qxwlan_e600gac-v2)
|
|
|
|
|
DEVICE_VARIANT := v2 (8M)
|
|
|
|
|
IMAGE_SIZE := 7744k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += qxwlan_e600gac-v2-8m
|
|
|
|
|
|
2020-10-14 07:47:35 +00:00
|
|
|
define Device/qxwlan_e750a-v4
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_VENDOR := Qxwlan
|
|
|
|
|
DEVICE_MODEL := E750A
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
2020-10-17 12:00:54 +00:00
|
|
|
SUPPORTED_DEVICES += e750a-v4
|
2020-10-14 07:47:35 +00:00
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/qxwlan_e750a-v4-16m
|
|
|
|
|
$(Device/qxwlan_e750a-v4)
|
|
|
|
|
DEVICE_VARIANT := v4 (16M)
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += qxwlan_e750a-v4-16m
|
|
|
|
|
|
|
|
|
|
define Device/qxwlan_e750a-v4-8m
|
|
|
|
|
$(Device/qxwlan_e750a-v4)
|
|
|
|
|
DEVICE_VARIANT := v4 (8M)
|
|
|
|
|
IMAGE_SIZE := 7744k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += qxwlan_e750a-v4-8m
|
|
|
|
|
|
2020-10-14 07:47:35 +00:00
|
|
|
define Device/qxwlan_e750g-v8
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_VENDOR := Qxwlan
|
|
|
|
|
DEVICE_MODEL := E750G
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
2020-10-17 12:00:54 +00:00
|
|
|
SUPPORTED_DEVICES += e750g-v8
|
2020-10-14 07:47:35 +00:00
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/qxwlan_e750g-v8-16m
|
|
|
|
|
$(Device/qxwlan_e750g-v8)
|
|
|
|
|
DEVICE_VARIANT := v8 (16M)
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += qxwlan_e750g-v8-16m
|
|
|
|
|
|
|
|
|
|
define Device/qxwlan_e750g-v8-8m
|
|
|
|
|
$(Device/qxwlan_e750g-v8)
|
|
|
|
|
DEVICE_VARIANT := v8 (8M)
|
|
|
|
|
IMAGE_SIZE := 7744k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += qxwlan_e750g-v8-8m
|
|
|
|
|
|
ath79: add support for ROSINSON WR818 board
This commit adds support for the ROSINSON WR818 WiFi-Router
SoC: Qualcomm Atheros QCA9563,
FLASH: Winbond W25Q128FV 16MBytes,
WiFi: QCA9563 b/g/n 3x3 450Mbit/s,
USB: 1x USB 2.0 Type A, 1x USB2.0 Type C,
IN: WPS/Reset button GPIO1,
OUT: Power LED red, Internet LED red, WLAN LED red,
LAN1 LED red, LAN2 LED red, System LED red,
UART: RX-GPIO18, TX-GPIO22,
Tested and working:
- Ethernet (LAN + WAN)
- WiFi
- OpenWRT sysupgrade
- Button
- LEDs
Installation of OpenWRT from vendor firmware:
- Connect to the Web-interface at http://192.168.1.1
- Go to "Administration" -> "Firmware Upgrade"
- Upload the OpenWrt sysupgrade image
Signed-off-by: Rosy Song <rosysong@rosinson.com>
2018-10-07 04:04:54 +00:00
|
|
|
define Device/rosinson_wr818
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9563
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := Rosinson
|
|
|
|
|
DEVICE_MODEL := WR818
|
ath79: add support for ROSINSON WR818 board
This commit adds support for the ROSINSON WR818 WiFi-Router
SoC: Qualcomm Atheros QCA9563,
FLASH: Winbond W25Q128FV 16MBytes,
WiFi: QCA9563 b/g/n 3x3 450Mbit/s,
USB: 1x USB 2.0 Type A, 1x USB2.0 Type C,
IN: WPS/Reset button GPIO1,
OUT: Power LED red, Internet LED red, WLAN LED red,
LAN1 LED red, LAN2 LED red, System LED red,
UART: RX-GPIO18, TX-GPIO22,
Tested and working:
- Ethernet (LAN + WAN)
- WiFi
- OpenWRT sysupgrade
- Button
- LEDs
Installation of OpenWRT from vendor firmware:
- Connect to the Web-interface at http://192.168.1.1
- Go to "Administration" -> "Firmware Upgrade"
- Upload the OpenWrt sysupgrade image
Signed-off-by: Rosy Song <rosysong@rosinson.com>
2018-10-07 04:04:54 +00:00
|
|
|
IMAGE_SIZE := 15872k
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport
|
ath79: add support for ROSINSON WR818 board
This commit adds support for the ROSINSON WR818 WiFi-Router
SoC: Qualcomm Atheros QCA9563,
FLASH: Winbond W25Q128FV 16MBytes,
WiFi: QCA9563 b/g/n 3x3 450Mbit/s,
USB: 1x USB 2.0 Type A, 1x USB2.0 Type C,
IN: WPS/Reset button GPIO1,
OUT: Power LED red, Internet LED red, WLAN LED red,
LAN1 LED red, LAN2 LED red, System LED red,
UART: RX-GPIO18, TX-GPIO22,
Tested and working:
- Ethernet (LAN + WAN)
- WiFi
- OpenWRT sysupgrade
- Button
- LEDs
Installation of OpenWRT from vendor firmware:
- Connect to the Web-interface at http://192.168.1.1
- Go to "Administration" -> "Firmware Upgrade"
- Upload the OpenWrt sysupgrade image
Signed-off-by: Rosy Song <rosysong@rosinson.com>
2018-10-07 04:04:54 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += rosinson_wr818
|
|
|
|
|
|
ath79: support Ruckus ZoneFlex 7025
Ruckus ZoneFlex 7025 is a single 2.4GHz radio 802.11n 1x1 enterprise
access point with built-in Ethernet switch, in an electrical outlet form factor.
Hardware highligts:
- CPU: Atheros AR7240 SoC at 400 MHz
- RAM: 64MB DDR2
- Flash: 16MB SPI-NOR
- Wi-Fi: AR9285 built-in 2.4GHz 1x1 radio
- Ethernet: single Fast Ethernet port inside the electrical enclosure,
coupled with internal LSA connector for direct wiring,
four external Fast Ethernet ports on the lower side of the device.
- PoE: 802.3af PD input inside the electrical box.
802.3af PSE output on the LAN4 port, capable of sourcing
class 0 or class 2 devices, depending on power supply capacity.
- External 8P8C pass-through connectors on the back and right side of the device
- Standalone 48V power input on the side, through 2/1mm micro DC barrel jack
Serial console: 115200-8-N-1 on internal JP1 header.
Pinout:
---------- JP1
|5|4|3|2|1|
----------
Pin 1 is near the "H1" marking.
1 - RX
2 - n/c
3 - VCC (3.3V)
4 - GND
5 - TX
Installation:
There are two methods of installation:
- Using serial console [1] - requires some disassembly, 3.3V USB-Serial
adapter, TFTP server, and removing a single T10 screw,
but with much less manual steps, and is generally recommended, being
safer.
- Using stock firmware root shell exploit, SSH and TFTP [2]. Does not
work on some rare versions of stock firmware. A more involved, and
requires installing `mkenvimage` from u-boot-tools package if you
choose to rebuild your own environment, but can be used without
disassembly or removal from installation point, if you have the
credentials.
If for some reason, size of your sysupgrade image exceeds 13312kB,
proceed with method [1]. For official images this is not likely to
happen ever.
[1] Using serial console:
0. Connect serial console to H1 header. Ensure the serial converter
does not back-power the board, otherwise it will fail to boot.
1. Power-on the board. Then quickly connect serial converter to PC and
hit Ctrl+C in the terminal to break boot sequence. If you're lucky,
you'll enter U-boot shell. Then skip to point 3.
Connection parameters are 115200-8-N-1.
2. Allow the board to boot. Press the reset button, so the board
reboots into U-boot again and go back to point 1.
3. Set the "bootcmd" variable to disable the dual-boot feature of the
system and ensure that uImage is loaded. This is critical step, and
needs to be done only on initial installation.
> setenv bootcmd "bootm 0x9f040000"
> saveenv
4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed:
> setenv serverip 192.168.1.2
> setenv ipaddr 192.168.1.1
> tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7025-initramfs-kernel.bin
> bootm 0x81000000
5. Optional, but highly recommended: back up contents of "firmware" partition:
$ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7025_fw1_backup.bin
6. Copy over sysupgrade image, and perform actual installation. OpenWrt
shall boot from flash afterwards:
$ ssh root@192.168.1.1
# sysupgrade -n openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin
[2] Using stock root shell:
0. Reset the device to factory defaullts. Power-on the device and after
it boots, hold the reset button near Ethernet connectors for 5
seconds.
1. Connect the device to the network. It will acquire address over DHCP,
so either find its address using list of DHCP leases by looking for
label MAC address, or try finding it by scanning for SSH port:
$ nmap 10.42.0.0/24 -p22
From now on, we assume your computer has address 10.42.0.1 and the device
has address 10.42.0.254.
2. Set up a TFTP server on your computer. We assume that TFTP server
root is at /srv/tftp.
3. Obtain root shell. Connect to the device over SSH. The SSHD ond the
frmware is pretty ancient and requires enabling HMAC-MD5.
$ ssh 10.42.0.254 \
-o UserKnownHostsFile=/dev/null \
-o StrictHostKeyCheking=no \
-o MACs=hmac-md5
Login. User is "super", password is "sp-admin".
Now execute a hidden command:
Ruckus
It is case-sensitive. Copy and paste the following string,
including quotes. There will be no output on the console for that.
";/bin/sh;"
Hit "enter". The AP will respond with:
grrrr
OK
Now execute another hidden command:
!v54!
At "What's your chow?" prompt just hit "enter".
Congratulations, you should now be dropped to Busybox shell with root
permissions.
4. Optional, but highly recommended: backup the flash contents before
installation. At your PC ensure the device can write the firmware
over TFTP:
$ sudo touch /srv/tftp/ruckus_zf7025_firmware{1,2}.bin
$ sudo chmod 666 /srv/tftp/ruckus_zf7025_firmware{1,2}.bin
Locate partitions for primary and secondary firmware image.
NEVER blindly copy over MTD nodes, because MTD indices change
depending on the currently active firmware, and all partitions are
writable!
# grep rcks_wlan /proc/mtd
Copy over both images using TFTP, this will be useful in case you'd
like to return to stock FW in future. Make sure to backup both, as
OpenWrt uses bot firmwre partitions for storage!
# tftp -l /dev/<rcks_wlan.main_mtd> -r ruckus_zf7025_firmware1.bin -p 10.42.0.1
# tftp -l /dev/<rcks_wlan.bkup_mtd> -r ruckus_zf7025_firmware2.bin -p 10.42.0.1
When the command finishes, copy over the dump to a safe place for
storage.
$ cp /srv/tftp/ruckus_zf7025_firmware{1,2}.bin ~/
5. Ensure the system is running from the BACKUP image, i.e. from
rcks_wlan.bkup partition or "image 2". Otherwise the installation
WILL fail, and you will need to access mtd0 device to write image
which risks overwriting the bootloader, and so is not covered here
and not supported.
Switching to backup firmware can be achieved by executing a few
consecutive reboots of the device, or by updating the stock firmware. The
system will boot from the image it was not running from previously.
Stock firmware available to update was conveniently dumped in point 4 :-)
6. Prepare U-boot environment image.
Install u-boot-tools package. Alternatively, if you build your own
images, OpenWrt provides mkenvimage in host staging directory as well.
It is recommended to extract environment from the device, and modify
it, rather then relying on defaults:
$ sudo touch /srv/tftp/u-boot-env.bin
$ sudo chmod 666 /srv/tftp/u-boot-env.bin
On the device, find the MTD partition on which environment resides.
Beware, it may change depending on currently active firmware image!
# grep u-boot-env /proc/mtd
Now, copy over the partition
# tftp -l /dev/mtd<N> -r u-boot-env.bin -p 10.42.0.1
Store the stock environment in a safe place:
$ cp /srv/tftp/u-boot-env.bin ~/
Extract the values from the dump:
$ strings u-boot-env.bin | tee u-boot-env.txt
Now clean up the debris at the end of output, you should end up with
each variable defined once. After that, set the bootcmd variable like
this:
bootcmd=bootm 0x9f040000
You should end up with something like this:
bootcmd=bootm 0x9f040000
bootargs=console=ttyS0,115200 rootfstype=squashfs init=/sbin/init
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
mtdparts=mtdparts=ar7100-nor0:256k(u-boot),7168k(rcks_wlan.main),7168k(rcks_wlan.bkup),1280k(datafs),256k(u-boot-env)
mtdids=nor0=ar7100-nor0
bootdelay=2
filesize=52e000
fileaddr=81000000
ethact=eth0
stdin=serial
stdout=serial
stderr=serial
partition=nor0,0
mtddevnum=0
mtddevname=u-boot
ipaddr=192.168.0.1
serverip=192.168.0.2
stderr=serial
ethact=eth0
These are the defaults, you can use most likely just this as input to
mkenvimage.
Now, create environment image and copy it over to TFTP root:
$ mkenvimage -s 0x40000 -b -o u-boot-env.bin u-boot-env.txt
$ sudo cp u-boot-env.bin /srv/tftp
This is the same image, gzipped and base64-encoded:
H4sICOLMEGMAA3UtYm9vdC1lbnYtbmV3LmJpbgDt0E1u00AUAGDfgm2XDUrTsUV/pTkFSxZoEk+o
lcQJtlNaLsURwU4FikDiBN+3eDNvLL/3Zt5/+vFuud8Pq10dp3V3EV4e1uFDGBXTQeq+9HG1b/v9
NsdheP0Y5mV5U4Vw0Y1f1/3wesix/3pM/dO6v2jaZojX/bJpr6dtsUzHuktDjm//FHl4SnXdxfAS
wmN4SWkMy+UYVqsx1PUYci52Q31I3dDHP5vU3ZUhXLX7LjxWN7eby+PVNNxsflfe3m8uu9Wm//xt
m9rFLjXtv6fLzfEwm5fVfdhc1mlI6342Pytzldvn2dS1qfs49Tjvd3qFOm/Ta6yKdbPNffM9x5sq
Ty805acL3Zfh5HTD1RDHJRT9WLGNfe6atJ2S/XE4y3LX/c6mSzZDs29P3edhmqXOz+1xF//s0y7H
t3GL5nDqWT5Ui/Gii7Aoi7HQ81jrcHZY/dXkfLLiJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8
xy8jb4zOAAAEAA==
7. Perform actual installation. Copy over OpenWrt sysupgrade image to
TFTP root:
$ sudo cp openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin /srv/tftp
Now load both to the device over TFTP:
# tftp -l /tmp/u-boot-env.bin -r u-boot-env.bin -g 10.42.0.1
# tftp -l /tmp/openwrt.bin -r openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin -g 10.42.0.1
Verify checksums of both images to ensure the transfer over TFTP
was completed:
# sha256sum /tmp/u-boot-env.bin /tmp/openwrt.bin
And compare it against source images:
$ sha256sum /srv/tftp/u-boot-env.bin /srv/tftp/openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin
Locate MTD partition of the primary image:
# grep rcks_wlan.main /proc/mtd
Now, write the images in place. Write U-boot environment last, so
unit still can boot from backup image, should power failure occur during
this. Replace MTD placeholders with real MTD nodes:
# flashcp /tmp/openwrt.bin /dev/<rcks_wlan.main_mtd>
# flashcp /tmp/u-boot-env.bin /dev/<u-boot-env_mtd>
Finally, reboot the device. The device should directly boot into
OpenWrt. Look for the characteristic power LED blinking pattern.
# reboot -f
After unit boots, it should be available at the usual 192.168.1.1/24.
Return to factory firmware:
1. Boot into OpenWrt initramfs as for initial installation. To do that
without disassembly, you can write an initramfs image to the device
using 'sysupgrade -F' first.
2. Unset the "bootcmd" variable:
fw_setenv bootcmd ""
3. Concatenate the firmware backups, if you took them during installation using method 2:
$ cat ruckus_zf7025_fw1_backup.bin ruckus_zf7025_fw2_backup.bin > ruckus_zf7025_backup.bin
3. Write factory images downloaded from manufacturer website into
fwconcat0 and fwconcat1 MTD partitions, or restore backup you took
before installation:
# mtd write ruckus_zf7025_backup.bin /dev/mtd1
4. Reboot the system, it should load into factory firmware again.
Quirks and known issues:
- Flash layout is changed from the factory, to use both firmware image
partitions for storage using mtd-concat, and uImage format is used to
actually boot the system, which rules out the dual-boot capability.
- The 2.4 GHz radio has its own EEPROM on board, not connected to CPU.
- The stock firmware has dual-boot capability, which is not supported in
OpenWrt by choice.
It is controlled by data in the top 64kB of RAM which is unmapped,
to avoid the interference in the boot process and accidental
switch to the inactive image, although boot script presence in
form of "bootcmd" variable should prevent this entirely.
- On some versions of stock firmware, it is possible to obtain root shell,
however not much is available in terms of debugging facitilies.
1. Login to the rkscli
2. Execute hidden command "Ruckus"
3. Copy and paste ";/bin/sh;" including quotes. This is required only
once, the payload will be stored in writable filesystem.
4. Execute hidden command "!v54!". Press Enter leaving empty reply for
"What's your chow?" prompt.
5. Busybox shell shall open.
Source: https://alephsecurity.com/vulns/aleph-2019014
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2022-09-01 21:00:02 +00:00
|
|
|
define Device/ruckus_common
|
ath79: support Ruckus ZoneFlex 7372
Ruckus ZoneFlex 7372 is a dual-band, dual-radio 802.11n 2x2 MIMO enterprise
access point.
Ruckus ZoneFlex 7352 is also supported, lacking the 5GHz radio part.
Hardware highligts:
- CPU: Atheros AR9344 SoC at 560 MHz
- RAM: 128MB DDR2
- Flash: 32MB SPI-NOR
- Wi-Fi 2.4GHz: AR9344 built-in 2x2 MIMO radio
- Wi-Fi 5Ghz: AR9582 2x2 MIMO radio (Only in ZF7372)
- Antennas:
- Separate internal active antennas with beamforming support on both
bands with 7 elements per band, each controlled by 74LV164 GPIO
expanders, attached to GPIOs of each radio.
- Two dual-band external RP-SMA antenna connections on "7372-E"
variant.
- Ethernet 1: single Gigabit Ethernet port through AR8035 gigabit PHY
- Ethernet 2: single Fast Ethernet port through AR9344 built-in switch
- PoE: input through Gigabit port
- Standalone 12V/1A power input
- USB: optional single USB 2.0 host port on "-U" variants.
The same image should support:
- ZoneFlex 7372E (variant with external antennas, without beamforming
capability)
- ZoneFlex 7352 (single-band, 2.4GHz-only variant).
which are based on same baseboard (codename St. Bernard),
with different populated components.
Serial console: 115200-8-N-1 on internal H1 header.
Pinout:
H1
---
|5|
---
|4|
---
|3|
---
|x|
---
|1|
---
Pin 5 is near the "H1" marking.
1 - RX
x - no pin
3 - VCC (3.3V)
4 - GND
5 - TX
JTAG: Connector H2, similar to MIPS eJTAG, standard,
but without the key in pin 12 and not every pin routed:
------- H2
|1 |2 |
-------
|3 |4 |
-------
|5 |6 |
-------
|7 |8 |
-------
|9 |10|
-------
|11|12|
-------
|13|14|
-------
3 - TDI
5 - TDO
7 - TMS
9 - TCK
2,4,6,8,10 - GND
14 - Vref
1,11,12,13 - Not connected
Installation:
There are two methods of installation:
- Using serial console [1] - requires some disassembly, 3.3V USB-Serial
adapter, TFTP server, and removing a single T10 screw,
but with much less manual steps, and is generally recommended, being
safer.
- Using stock firmware root shell exploit, SSH and TFTP [2]. Does not
work on some rare versions of stock firmware. A more involved, and
requires installing `mkenvimage` from u-boot-tools package if you
choose to rebuild your own environment, but can be used without
disassembly or removal from installation point, if you have the
credentials.
If for some reason, size of your sysupgrade image exceeds 13312kB,
proceed with method [1]. For official images this is not likely to
happen ever.
[1] Using serial console:
0. Connect serial console to H1 header. Ensure the serial converter
does not back-power the board, otherwise it will fail to boot.
1. Power-on the board. Then quickly connect serial converter to PC and
hit Ctrl+C in the terminal to break boot sequence. If you're lucky,
you'll enter U-boot shell. Then skip to point 3.
Connection parameters are 115200-8-N-1.
2. Allow the board to boot. Press the reset button, so the board
reboots into U-boot again and go back to point 1.
3. Set the "bootcmd" variable to disable the dual-boot feature of the
system and ensure that uImage is loaded. This is critical step, and
needs to be done only on initial installation.
> setenv bootcmd "bootm 0x9f040000"
> saveenv
4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed:
> setenv serverip 192.168.1.2
> setenv ipaddr 192.168.1.1
> tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7372-initramfs-kernel.bin
> bootm 0x81000000
5. Optional, but highly recommended: back up contents of "firmware" partition:
$ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7372_fw1_backup.bin
$ ssh root@192.168.1.1 cat /dev/mtd5 > ruckus_zf7372_fw2_backup.bin
6. Copy over sysupgrade image, and perform actual installation. OpenWrt
shall boot from flash afterwards:
$ ssh root@192.168.1.1
# sysupgrade -n openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin
[2] Using stock root shell:
0. Reset the device to factory defaullts. Power-on the device and after
it boots, hold the reset button near Ethernet connectors for 5
seconds.
1. Connect the device to the network. It will acquire address over DHCP,
so either find its address using list of DHCP leases by looking for
label MAC address, or try finding it by scanning for SSH port:
$ nmap 10.42.0.0/24 -p22
From now on, we assume your computer has address 10.42.0.1 and the device
has address 10.42.0.254.
2. Set up a TFTP server on your computer. We assume that TFTP server
root is at /srv/tftp.
3. Obtain root shell. Connect to the device over SSH. The SSHD ond the
frmware is pretty ancient and requires enabling HMAC-MD5.
$ ssh 10.42.0.254 \
-o UserKnownHostsFile=/dev/null \
-o StrictHostKeyCheking=no \
-o MACs=hmac-md5
Login. User is "super", password is "sp-admin".
Now execute a hidden command:
Ruckus
It is case-sensitive. Copy and paste the following string,
including quotes. There will be no output on the console for that.
";/bin/sh;"
Hit "enter". The AP will respond with:
grrrr
OK
Now execute another hidden command:
!v54!
At "What's your chow?" prompt just hit "enter".
Congratulations, you should now be dropped to Busybox shell with root
permissions.
4. Optional, but highly recommended: backup the flash contents before
installation. At your PC ensure the device can write the firmware
over TFTP:
$ sudo touch /srv/tftp/ruckus_zf7372_firmware{1,2}.bin
$ sudo chmod 666 /srv/tftp/ruckus_zf7372_firmware{1,2}.bin
Locate partitions for primary and secondary firmware image.
NEVER blindly copy over MTD nodes, because MTD indices change
depending on the currently active firmware, and all partitions are
writable!
# grep rcks_wlan /proc/mtd
Copy over both images using TFTP, this will be useful in case you'd
like to return to stock FW in future. Make sure to backup both, as
OpenWrt uses bot firmwre partitions for storage!
# tftp -l /dev/<rcks_wlan.main_mtd> -r ruckus_zf7372_firmware1.bin -p 10.42.0.1
# tftp -l /dev/<rcks_wlan.bkup_mtd> -r ruckus_zf7372_firmware2.bin -p 10.42.0.1
When the command finishes, copy over the dump to a safe place for
storage.
$ cp /srv/tftp/ruckus_zf7372_firmware{1,2}.bin ~/
5. Ensure the system is running from the BACKUP image, i.e. from
rcks_wlan.bkup partition or "image 2". Otherwise the installation
WILL fail, and you will need to access mtd0 device to write image
which risks overwriting the bootloader, and so is not covered here
and not supported.
Switching to backup firmware can be achieved by executing a few
consecutive reboots of the device, or by updating the stock firmware. The
system will boot from the image it was not running from previously.
Stock firmware available to update was conveniently dumped in point 4 :-)
6. Prepare U-boot environment image.
Install u-boot-tools package. Alternatively, if you build your own
images, OpenWrt provides mkenvimage in host staging directory as well.
It is recommended to extract environment from the device, and modify
it, rather then relying on defaults:
$ sudo touch /srv/tftp/u-boot-env.bin
$ sudo chmod 666 /srv/tftp/u-boot-env.bin
On the device, find the MTD partition on which environment resides.
Beware, it may change depending on currently active firmware image!
# grep u-boot-env /proc/mtd
Now, copy over the partition
# tftp -l /dev/mtd<N> -r u-boot-env.bin -p 10.42.0.1
Store the stock environment in a safe place:
$ cp /srv/tftp/u-boot-env.bin ~/
Extract the values from the dump:
$ strings u-boot-env.bin | tee u-boot-env.txt
Now clean up the debris at the end of output, you should end up with
each variable defined once. After that, set the bootcmd variable like
this:
bootcmd=bootm 0x9f040000
You should end up with something like this:
bootcmd=bootm 0x9f040000
bootargs=console=ttyS0,115200 rootfstype=squashfs init=/sbin/init
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
bootdelay=2
mtdids=nor0=ar7100-nor0
mtdparts=mtdparts=ar7100-nor0:256k(u-boot),13312k(rcks_wlan.main),2048k(datafs),256k(u-boot-env),512k(Board Data),13312k(rcks_wlan.bkup)
ethact=eth0
filesize=1000000
fileaddr=81000000
ipaddr=192.168.0.7
serverip=192.168.0.51
partition=nor0,0
mtddevnum=0
mtddevname=u-boot
stdin=serial
stdout=serial
stderr=serial
These are the defaults, you can use most likely just this as input to
mkenvimage.
Now, create environment image and copy it over to TFTP root:
$ mkenvimage -s 0x40000 -b -o u-boot-env.bin u-boot-env.txt
$ sudo cp u-boot-env.bin /srv/tftp
This is the same image, gzipped and base64-encoded:
H4sIAAAAAAAAA+3QTW7TQBQAYB+AQ2TZSGk6Tpv+SbNBrNhyADSJHWolsYPtlJaDcAWOCXaqQhdIXOD7
Fm/ee+MZ+/nHu58fV03Tr/dFHNf9JDzdbcJVGGRjI7Vfurhu6q7ZlbHvnz+FWZ4vFyFM2mF30/XPhzJ2
X4+pe9h0k6qu+njRrar6YkyzVToWberL+HImK/uHVBRtDE8h3IenlIawWg1hvR5CUQyhLE/vLcpdeo6L
bN8XVdHFumlDTO1NHsL5mI/9Q2r7Lv5J3uzeL5bX27Pj+XjRdJZfXuaL7Vm73nafv+1SPd+nqp7OFuHq
dntWpD5tuqH6e+K8rB+ns+V45n2T2mLyYXjmH9estsfD9DTSuo/DErJNtSu76vswbjg5NU4D3752qsOp
zu8W8/z6dh7mN1lXto9lWx3eNJd5Ng5V9VVTn2afnSYuysf6uI9/8rQv48s3Z93wn+o4XFWl3Vg0x/5N
Vbbta5X9AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAID/+Q2Z/B7cAAAEAA==
7. Perform actual installation. Copy over OpenWrt sysupgrade image to
TFTP root:
$ sudo cp openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin /srv/tftp
Now load both to the device over TFTP:
# tftp -l /tmp/u-boot-env.bin -r u-boot-env.bin -g 10.42.0.1
# tftp -l /tmp/openwrt.bin -r openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin -g 10.42.0.1
Verify checksums of both images to ensure the transfer over TFTP
was completed:
# sha256sum /tmp/u-boot-env.bin /tmp/openwrt.bin
And compare it against source images:
$ sha256sum /srv/tftp/u-boot-env.bin /srv/tftp/openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin
Locate MTD partition of the primary image:
# grep rcks_wlan.main /proc/mtd
Now, write the images in place. Write U-boot environment last, so
unit still can boot from backup image, should power failure occur during
this. Replace MTD placeholders with real MTD nodes:
# flashcp /tmp/openwrt.bin /dev/<rcks_wlan.main_mtd>
# flashcp /tmp/u-boot-env.bin /dev/<u-boot-env_mtd>
Finally, reboot the device. The device should directly boot into
OpenWrt. Look for the characteristic power LED blinking pattern.
# reboot -f
After unit boots, it should be available at the usual 192.168.1.1/24.
Return to factory firmware:
1. Boot into OpenWrt initramfs as for initial installation. To do that
without disassembly, you can write an initramfs image to the device
using 'sysupgrade -F' first.
2. Unset the "bootcmd" variable:
fw_setenv bootcmd ""
3. Write factory images downloaded from manufacturer website into
fwconcat0 and fwconcat1 MTD partitions, or restore backup you took
before installation:
mtd write ruckus_zf7372_fw1_backup.bin /dev/mtd1
mtd write ruckus_zf7372_fw2_backup.bin /dev/mtd5
4. Reboot the system, it should load into factory firmware again.
Quirks and known issues:
- This is first device in ath79 target to support link state reporting
on FE port attached trough the built-in switch.
- Flash layout is changed from the factory, to use both firmware image
partitions for storage using mtd-concat, and uImage format is used to
actually boot the system, which rules out the dual-boot capability.
The 5GHz radio has its own EEPROM on board, not connected to CPU.
- The stock firmware has dual-boot capability, which is not supported in
OpenWrt by choice.
It is controlled by data in the top 64kB of RAM which is unmapped,
to avoid the interference in the boot process and accidental
switch to the inactive image, although boot script presence in
form of "bootcmd" variable should prevent this entirely.
- U-boot disables JTAG when starting. To re-enable it, you need to
execute the following command before booting:
mw.l 1804006c 40
And also you need to disable the reset button in device tree if you
intend to debug Linux, because reset button on GPIO0 shares the TCK
pin.
- On some versions of stock firmware, it is possible to obtain root shell,
however not much is available in terms of debugging facitilies.
1. Login to the rkscli
2. Execute hidden command "Ruckus"
3. Copy and paste ";/bin/sh;" including quotes. This is required only
once, the payload will be stored in writable filesystem.
4. Execute hidden command "!v54!". Press Enter leaving empty reply for
"What's your chow?" prompt.
5. Busybox shell shall open.
Source: https://alephsecurity.com/vulns/aleph-2019014
- Stock firmware has beamforming functionality, known as BeamFlex,
using active multi-segment antennas on both bands - controlled by
RF analog switches, driven by a pair of 74LV164 shift registers.
Shift registers used for each radio are connected to GPIO14 (clock)
and GPIO15 of the respective chip.
They are mapped as generic GPIOs in OpenWrt - in stock firmware,
they were most likely handled directly by radio firmware,
given the real-time nature of their control.
Lack of this support in OpenWrt causes the antennas to behave as
ordinary omnidirectional antennas, and does not affect throughput in
normal conditions, but GPIOs are available to tinker with nonetheless.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2022-05-22 15:46:28 +00:00
|
|
|
DEVICE_VENDOR := Ruckus
|
|
|
|
|
LOADER_TYPE := bin
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
|
|
|
|
|
KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
|
|
|
|
|
endef
|
|
|
|
|
|
ath79: support Ruckus ZoneFlex 7025
Ruckus ZoneFlex 7025 is a single 2.4GHz radio 802.11n 1x1 enterprise
access point with built-in Ethernet switch, in an electrical outlet form factor.
Hardware highligts:
- CPU: Atheros AR7240 SoC at 400 MHz
- RAM: 64MB DDR2
- Flash: 16MB SPI-NOR
- Wi-Fi: AR9285 built-in 2.4GHz 1x1 radio
- Ethernet: single Fast Ethernet port inside the electrical enclosure,
coupled with internal LSA connector for direct wiring,
four external Fast Ethernet ports on the lower side of the device.
- PoE: 802.3af PD input inside the electrical box.
802.3af PSE output on the LAN4 port, capable of sourcing
class 0 or class 2 devices, depending on power supply capacity.
- External 8P8C pass-through connectors on the back and right side of the device
- Standalone 48V power input on the side, through 2/1mm micro DC barrel jack
Serial console: 115200-8-N-1 on internal JP1 header.
Pinout:
---------- JP1
|5|4|3|2|1|
----------
Pin 1 is near the "H1" marking.
1 - RX
2 - n/c
3 - VCC (3.3V)
4 - GND
5 - TX
Installation:
There are two methods of installation:
- Using serial console [1] - requires some disassembly, 3.3V USB-Serial
adapter, TFTP server, and removing a single T10 screw,
but with much less manual steps, and is generally recommended, being
safer.
- Using stock firmware root shell exploit, SSH and TFTP [2]. Does not
work on some rare versions of stock firmware. A more involved, and
requires installing `mkenvimage` from u-boot-tools package if you
choose to rebuild your own environment, but can be used without
disassembly or removal from installation point, if you have the
credentials.
If for some reason, size of your sysupgrade image exceeds 13312kB,
proceed with method [1]. For official images this is not likely to
happen ever.
[1] Using serial console:
0. Connect serial console to H1 header. Ensure the serial converter
does not back-power the board, otherwise it will fail to boot.
1. Power-on the board. Then quickly connect serial converter to PC and
hit Ctrl+C in the terminal to break boot sequence. If you're lucky,
you'll enter U-boot shell. Then skip to point 3.
Connection parameters are 115200-8-N-1.
2. Allow the board to boot. Press the reset button, so the board
reboots into U-boot again and go back to point 1.
3. Set the "bootcmd" variable to disable the dual-boot feature of the
system and ensure that uImage is loaded. This is critical step, and
needs to be done only on initial installation.
> setenv bootcmd "bootm 0x9f040000"
> saveenv
4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed:
> setenv serverip 192.168.1.2
> setenv ipaddr 192.168.1.1
> tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7025-initramfs-kernel.bin
> bootm 0x81000000
5. Optional, but highly recommended: back up contents of "firmware" partition:
$ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7025_fw1_backup.bin
6. Copy over sysupgrade image, and perform actual installation. OpenWrt
shall boot from flash afterwards:
$ ssh root@192.168.1.1
# sysupgrade -n openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin
[2] Using stock root shell:
0. Reset the device to factory defaullts. Power-on the device and after
it boots, hold the reset button near Ethernet connectors for 5
seconds.
1. Connect the device to the network. It will acquire address over DHCP,
so either find its address using list of DHCP leases by looking for
label MAC address, or try finding it by scanning for SSH port:
$ nmap 10.42.0.0/24 -p22
From now on, we assume your computer has address 10.42.0.1 and the device
has address 10.42.0.254.
2. Set up a TFTP server on your computer. We assume that TFTP server
root is at /srv/tftp.
3. Obtain root shell. Connect to the device over SSH. The SSHD ond the
frmware is pretty ancient and requires enabling HMAC-MD5.
$ ssh 10.42.0.254 \
-o UserKnownHostsFile=/dev/null \
-o StrictHostKeyCheking=no \
-o MACs=hmac-md5
Login. User is "super", password is "sp-admin".
Now execute a hidden command:
Ruckus
It is case-sensitive. Copy and paste the following string,
including quotes. There will be no output on the console for that.
";/bin/sh;"
Hit "enter". The AP will respond with:
grrrr
OK
Now execute another hidden command:
!v54!
At "What's your chow?" prompt just hit "enter".
Congratulations, you should now be dropped to Busybox shell with root
permissions.
4. Optional, but highly recommended: backup the flash contents before
installation. At your PC ensure the device can write the firmware
over TFTP:
$ sudo touch /srv/tftp/ruckus_zf7025_firmware{1,2}.bin
$ sudo chmod 666 /srv/tftp/ruckus_zf7025_firmware{1,2}.bin
Locate partitions for primary and secondary firmware image.
NEVER blindly copy over MTD nodes, because MTD indices change
depending on the currently active firmware, and all partitions are
writable!
# grep rcks_wlan /proc/mtd
Copy over both images using TFTP, this will be useful in case you'd
like to return to stock FW in future. Make sure to backup both, as
OpenWrt uses bot firmwre partitions for storage!
# tftp -l /dev/<rcks_wlan.main_mtd> -r ruckus_zf7025_firmware1.bin -p 10.42.0.1
# tftp -l /dev/<rcks_wlan.bkup_mtd> -r ruckus_zf7025_firmware2.bin -p 10.42.0.1
When the command finishes, copy over the dump to a safe place for
storage.
$ cp /srv/tftp/ruckus_zf7025_firmware{1,2}.bin ~/
5. Ensure the system is running from the BACKUP image, i.e. from
rcks_wlan.bkup partition or "image 2". Otherwise the installation
WILL fail, and you will need to access mtd0 device to write image
which risks overwriting the bootloader, and so is not covered here
and not supported.
Switching to backup firmware can be achieved by executing a few
consecutive reboots of the device, or by updating the stock firmware. The
system will boot from the image it was not running from previously.
Stock firmware available to update was conveniently dumped in point 4 :-)
6. Prepare U-boot environment image.
Install u-boot-tools package. Alternatively, if you build your own
images, OpenWrt provides mkenvimage in host staging directory as well.
It is recommended to extract environment from the device, and modify
it, rather then relying on defaults:
$ sudo touch /srv/tftp/u-boot-env.bin
$ sudo chmod 666 /srv/tftp/u-boot-env.bin
On the device, find the MTD partition on which environment resides.
Beware, it may change depending on currently active firmware image!
# grep u-boot-env /proc/mtd
Now, copy over the partition
# tftp -l /dev/mtd<N> -r u-boot-env.bin -p 10.42.0.1
Store the stock environment in a safe place:
$ cp /srv/tftp/u-boot-env.bin ~/
Extract the values from the dump:
$ strings u-boot-env.bin | tee u-boot-env.txt
Now clean up the debris at the end of output, you should end up with
each variable defined once. After that, set the bootcmd variable like
this:
bootcmd=bootm 0x9f040000
You should end up with something like this:
bootcmd=bootm 0x9f040000
bootargs=console=ttyS0,115200 rootfstype=squashfs init=/sbin/init
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
mtdparts=mtdparts=ar7100-nor0:256k(u-boot),7168k(rcks_wlan.main),7168k(rcks_wlan.bkup),1280k(datafs),256k(u-boot-env)
mtdids=nor0=ar7100-nor0
bootdelay=2
filesize=52e000
fileaddr=81000000
ethact=eth0
stdin=serial
stdout=serial
stderr=serial
partition=nor0,0
mtddevnum=0
mtddevname=u-boot
ipaddr=192.168.0.1
serverip=192.168.0.2
stderr=serial
ethact=eth0
These are the defaults, you can use most likely just this as input to
mkenvimage.
Now, create environment image and copy it over to TFTP root:
$ mkenvimage -s 0x40000 -b -o u-boot-env.bin u-boot-env.txt
$ sudo cp u-boot-env.bin /srv/tftp
This is the same image, gzipped and base64-encoded:
H4sICOLMEGMAA3UtYm9vdC1lbnYtbmV3LmJpbgDt0E1u00AUAGDfgm2XDUrTsUV/pTkFSxZoEk+o
lcQJtlNaLsURwU4FikDiBN+3eDNvLL/3Zt5/+vFuud8Pq10dp3V3EV4e1uFDGBXTQeq+9HG1b/v9
NsdheP0Y5mV5U4Vw0Y1f1/3wesix/3pM/dO6v2jaZojX/bJpr6dtsUzHuktDjm//FHl4SnXdxfAS
wmN4SWkMy+UYVqsx1PUYci52Q31I3dDHP5vU3ZUhXLX7LjxWN7eby+PVNNxsflfe3m8uu9Wm//xt
m9rFLjXtv6fLzfEwm5fVfdhc1mlI6342Pytzldvn2dS1qfs49Tjvd3qFOm/Ta6yKdbPNffM9x5sq
Ty805acL3Zfh5HTD1RDHJRT9WLGNfe6atJ2S/XE4y3LX/c6mSzZDs29P3edhmqXOz+1xF//s0y7H
t3GL5nDqWT5Ui/Gii7Aoi7HQ81jrcHZY/dXkfLLiJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8
xy8jb4zOAAAEAA==
7. Perform actual installation. Copy over OpenWrt sysupgrade image to
TFTP root:
$ sudo cp openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin /srv/tftp
Now load both to the device over TFTP:
# tftp -l /tmp/u-boot-env.bin -r u-boot-env.bin -g 10.42.0.1
# tftp -l /tmp/openwrt.bin -r openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin -g 10.42.0.1
Verify checksums of both images to ensure the transfer over TFTP
was completed:
# sha256sum /tmp/u-boot-env.bin /tmp/openwrt.bin
And compare it against source images:
$ sha256sum /srv/tftp/u-boot-env.bin /srv/tftp/openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin
Locate MTD partition of the primary image:
# grep rcks_wlan.main /proc/mtd
Now, write the images in place. Write U-boot environment last, so
unit still can boot from backup image, should power failure occur during
this. Replace MTD placeholders with real MTD nodes:
# flashcp /tmp/openwrt.bin /dev/<rcks_wlan.main_mtd>
# flashcp /tmp/u-boot-env.bin /dev/<u-boot-env_mtd>
Finally, reboot the device. The device should directly boot into
OpenWrt. Look for the characteristic power LED blinking pattern.
# reboot -f
After unit boots, it should be available at the usual 192.168.1.1/24.
Return to factory firmware:
1. Boot into OpenWrt initramfs as for initial installation. To do that
without disassembly, you can write an initramfs image to the device
using 'sysupgrade -F' first.
2. Unset the "bootcmd" variable:
fw_setenv bootcmd ""
3. Concatenate the firmware backups, if you took them during installation using method 2:
$ cat ruckus_zf7025_fw1_backup.bin ruckus_zf7025_fw2_backup.bin > ruckus_zf7025_backup.bin
3. Write factory images downloaded from manufacturer website into
fwconcat0 and fwconcat1 MTD partitions, or restore backup you took
before installation:
# mtd write ruckus_zf7025_backup.bin /dev/mtd1
4. Reboot the system, it should load into factory firmware again.
Quirks and known issues:
- Flash layout is changed from the factory, to use both firmware image
partitions for storage using mtd-concat, and uImage format is used to
actually boot the system, which rules out the dual-boot capability.
- The 2.4 GHz radio has its own EEPROM on board, not connected to CPU.
- The stock firmware has dual-boot capability, which is not supported in
OpenWrt by choice.
It is controlled by data in the top 64kB of RAM which is unmapped,
to avoid the interference in the boot process and accidental
switch to the inactive image, although boot script presence in
form of "bootcmd" variable should prevent this entirely.
- On some versions of stock firmware, it is possible to obtain root shell,
however not much is available in terms of debugging facitilies.
1. Login to the rkscli
2. Execute hidden command "Ruckus"
3. Copy and paste ";/bin/sh;" including quotes. This is required only
once, the payload will be stored in writable filesystem.
4. Execute hidden command "!v54!". Press Enter leaving empty reply for
"What's your chow?" prompt.
5. Busybox shell shall open.
Source: https://alephsecurity.com/vulns/aleph-2019014
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2022-09-01 21:00:02 +00:00
|
|
|
define Device/ruckus_zf7025
|
|
|
|
|
$(Device/ruckus_common)
|
|
|
|
|
SOC := ar7240
|
|
|
|
|
DEVICE_MODEL := ZoneFlex 7025
|
|
|
|
|
IMAGE_SIZE := 15616k
|
|
|
|
|
BLOCKSIZE := 256k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += ruckus_zf7025
|
|
|
|
|
|
ath79: support Ruckus ZoneFlex 7351
Ruckus ZoneFlex 7351 is a dual-band, dual-radio 802.11n 2x2 MIMO enterprise
access point.
Hardware highligts:
- CPU: Atheros AR7161 SoC at 680 MHz
- RAM: 64MB DDR
- Flash: 16MB SPI-NOR
- Wi-Fi 2.4GHz: AR9280 PCI 2x2 MIMO radio with external beamforming
- Wi-Fi 5GHz: AR9280 PCI 2x2 MIMO radio with external beamforming
- Ethernet: single Gigabit Ethernet port through Marvell 88E1116R gigabit PHY
- Standalone 12V/1A power input
- USB: optional single USB 2.0 host port on the 7351-U variant.
Serial console: 115200-8-N-1 on internal H1 header.
Pinout:
H1 ----------
|1|x3|4|5|
----------
Pin 1 is near the "H1" marking.
1 - RX
x - no pin
3 - VCC (3.3V)
4 - GND
5 - TX
Installation:
- Using serial console - requires some disassembly, 3.3V USB-Serial
adapter, TFTP server, and removing a single T10 screw.
0. Connect serial console to H1 header. Ensure the serial converter
does not back-power the board, otherwise it will fail to boot.
1. Power-on the board. Then quickly connect serial converter to PC and
hit Ctrl+C in the terminal to break boot sequence. If you're lucky,
you'll enter U-boot shell. Then skip to point 3.
Connection parameters are 115200-8-N-1.
2. Allow the board to boot. Press the reset button, so the board
reboots into U-boot again and go back to point 1.
3. Set the "bootcmd" variable to disable the dual-boot feature of the
system and ensure that uImage is loaded. This is critical step, and
needs to be done only on initial installation.
> setenv bootcmd "bootm 0xbf040000"
> saveenv
4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed:
> setenv serverip 192.168.1.2
> setenv ipaddr 192.168.1.1
> tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7351-initramfs-kernel.bin
> bootm 0x81000000
5. Optional, but highly recommended: back up contents of "firmware" partition:
$ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7351_fw_backup.bin
6. Copy over sysupgrade image, and perform actual installation. OpenWrt
shall boot from flash afterwards:
$ ssh root@192.168.1.1
# sysupgrade -n openwrt-ath79-generic-ruckus_zf7351-squashfs-sysupgrade.bin
After unit boots, it should be available at the usual 192.168.1.1/24.
Return to factory firmware:
1. Copy over the backup to /tmp, for example using scp
2. Unset the "bootcmd" variable:
fw_setenv bootcmd ""
3. Use sysupgrade with force to restore the backup:
sysupgrade -F ruckus_zf7351_backup.bin
4. System will reboot.
Quirks and known issues:
- Flash layout is changed from the factory, to use both firmware image
partitions for storage using mtd-concat, and uImage format is used to
actually boot the system, which rules out the dual-boot capability.
- Both radio has its own EEPROM on board, not connected to CPU.
- The stock firmware has dual-boot capability, which is not supported in
OpenWrt by choice.
It is controlled by data in the top 64kB of RAM which is unmapped,
to avoid the interference in the boot process and accidental
switch to the inactive image, although boot script presence in
form of "bootcmd" variable should prevent this entirely.
- On some versions of stock firmware, it is possible to obtain root shell,
however not much is available in terms of debugging facitilies.
1. Login to the rkscli
2. Execute hidden command "Ruckus"
3. Copy and paste ";/bin/sh;" including quotes. This is required only
once, the payload will be stored in writable filesystem.
4. Execute hidden command "!v54!". Press Enter leaving empty reply for
"What's your chow?" prompt.
5. Busybox shell shall open.
Source: https://alephsecurity.com/vulns/aleph-2019014
- There is second method to achieve root shell, using command injection
in the web interface:
1. Login to web administration interface
2. Go to Administration > Diagnostics
3. Enter |telnetd${IFS}-p${IFS}204${IFS}-l${IFS}/bin/sh into "ping"
field
4. Press "Run test"
5. Telnet to the device IP at port 204
6. Busybox shell shall open.
Source: https://github.com/chk-jxcn/ruckusremoteshell
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2022-12-30 23:15:48 +00:00
|
|
|
define Device/ruckus_gd11_common
|
|
|
|
|
$(Device/ruckus_common)
|
|
|
|
|
SOC := ar7161
|
|
|
|
|
IMAGE_SIZE := 15616k
|
|
|
|
|
BLOCKSIZE := 256k
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-chipidea2
|
|
|
|
|
endef
|
|
|
|
|
|
ath79: support Ruckus ZoneFlex 7341/7343/7363
Ruckus ZoneFlex 7363 is a dual-band, dual-radio 802.11n 2x2 MIMO enterprise
access point. ZoneFlex 7343 is the single band variant of 7363
restricted to 2.4GHz, and ZoneFlex 7341 is 7343 minus two Fast Ethernet
ports.
Hardware highligts:
- CPU: Atheros AR7161 SoC at 680 MHz
- RAM: 64MB DDR
- Flash: 16MB SPI-NOR
- Wi-Fi 2.4GHz: AR9280 PCI 2x2 MIMO radio with external beamforming
- Wi-Fi 5GHz: AR9280 PCI 2x2 MIMO radio with external beamforming
- Ethernet 1: single Gigabit Ethernet port through Marvell 88E1116R gigabit PHY
- Ethernet 2: two Fast Ethernet ports through Realtek RTL8363S switch,
connected with Fast Ethernet link to CPU.
- PoE: input through Gigabit port
- Standalone 12V/1A power input
- USB: optional single USB 2.0 host port on the -U variants.
Serial console: 115200-8-N-1 on internal H1 header.
Pinout:
H1 ----------
|1|x3|4|5|
----------
Pin 1 is near the "H1" marking.
1 - RX
x - no pin
3 - VCC (3.3V)
4 - GND
5 - TX
Installation:
- Using serial console - requires some disassembly, 3.3V USB-Serial
adapter, TFTP server, and removing a single PH1 screw.
0. Connect serial console to H1 header. Ensure the serial converter
does not back-power the board, otherwise it will fail to boot.
1. Power-on the board. Then quickly connect serial converter to PC and
hit Ctrl+C in the terminal to break boot sequence. If you're lucky,
you'll enter U-boot shell. Then skip to point 3.
Connection parameters are 115200-8-N-1.
2. Allow the board to boot. Press the reset button, so the board
reboots into U-boot again and go back to point 1.
3. Set the "bootcmd" variable to disable the dual-boot feature of the
system and ensure that uImage is loaded. This is critical step, and
needs to be done only on initial installation.
> setenv bootcmd "bootm 0xbf040000"
> saveenv
4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed.
Use the Gigabit interface, Fast Ethernet ports are not supported
under U-boot:
> setenv serverip 192.168.1.2
> setenv ipaddr 192.168.1.1
> tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7363-initramfs-kernel.bin
> bootm 0x81000000
5. Optional, but highly recommended: back up contents of "firmware" partition:
$ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7363_fw_backup.bin
6. Copy over sysupgrade image, and perform actual installation. OpenWrt
shall boot from flash afterwards:
$ ssh root@192.168.1.1
# sysupgrade -n openwrt-ath79-generic-ruckus_zf7363-squashfs-sysupgrade.bin
After unit boots, it should be available at the usual 192.168.1.1/24.
Return to factory firmware:
1. Copy over the backup to /tmp, for example using scp
2. Unset the "bootcmd" variable:
fw_setenv bootcmd ""
3. Use sysupgrade with force to restore the backup:
sysupgrade -F ruckus_zf7363_backup.bin
4. System will reboot.
Quirks and known issues:
- Fast Ethernet ports on ZF7363 and ZF7343 are supported, but management
features of the RTL8363S switch aren't implemented yet, though the
switch is visible over MDIO0 bus. This is a gigabit-capable switch, so
link establishment with a gigabit link partner may take a longer time
because RTL8363S advertises gigabit, and the port magnetics don't
support it, so a downshift needs to occur. Both ports are accessible
at eth1 interface, which - strangely - runs only at 100Mbps itself.
- Flash layout is changed from the factory, to use both firmware image
partitions for storage using mtd-concat, and uImage format is used to
actually boot the system, which rules out the dual-boot capability.
- Both radio has its own EEPROM on board, not connected to CPU.
- The stock firmware has dual-boot capability, which is not supported in
OpenWrt by choice.
It is controlled by data in the top 64kB of RAM which is unmapped,
to avoid the interference in the boot process and accidental
switch to the inactive image, although boot script presence in
form of "bootcmd" variable should prevent this entirely.
- On some versions of stock firmware, it is possible to obtain root shell,
however not much is available in terms of debugging facitilies.
1. Login to the rkscli
2. Execute hidden command "Ruckus"
3. Copy and paste ";/bin/sh;" including quotes. This is required only
once, the payload will be stored in writable filesystem.
4. Execute hidden command "!v54!". Press Enter leaving empty reply for
"What's your chow?" prompt.
5. Busybox shell shall open.
Source: https://alephsecurity.com/vulns/aleph-2019014
- There is second method to achieve root shell, using command injection
in the web interface:
1. Login to web administration interface
2. Go to Administration > Diagnostics
3. Enter |telnetd${IFS}-p${IFS}204${IFS}-l${IFS}/bin/sh into "ping"
field
4. Press "Run test"
5. Telnet to the device IP at port 204
6. Busybox shell shall open.
Source: https://github.com/chk-jxcn/ruckusremoteshell
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2023-03-07 20:25:59 +00:00
|
|
|
define Device/ruckus_zf7341
|
|
|
|
|
$(Device/ruckus_gd11_common)
|
|
|
|
|
DEVICE_MODEL := ZoneFlex 7341[-U]
|
|
|
|
|
DEVICE_PACKAGES += -swconfig
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += ruckus_zf7341
|
|
|
|
|
|
ath79: support Ruckus ZoneFlex 7351
Ruckus ZoneFlex 7351 is a dual-band, dual-radio 802.11n 2x2 MIMO enterprise
access point.
Hardware highligts:
- CPU: Atheros AR7161 SoC at 680 MHz
- RAM: 64MB DDR
- Flash: 16MB SPI-NOR
- Wi-Fi 2.4GHz: AR9280 PCI 2x2 MIMO radio with external beamforming
- Wi-Fi 5GHz: AR9280 PCI 2x2 MIMO radio with external beamforming
- Ethernet: single Gigabit Ethernet port through Marvell 88E1116R gigabit PHY
- Standalone 12V/1A power input
- USB: optional single USB 2.0 host port on the 7351-U variant.
Serial console: 115200-8-N-1 on internal H1 header.
Pinout:
H1 ----------
|1|x3|4|5|
----------
Pin 1 is near the "H1" marking.
1 - RX
x - no pin
3 - VCC (3.3V)
4 - GND
5 - TX
Installation:
- Using serial console - requires some disassembly, 3.3V USB-Serial
adapter, TFTP server, and removing a single T10 screw.
0. Connect serial console to H1 header. Ensure the serial converter
does not back-power the board, otherwise it will fail to boot.
1. Power-on the board. Then quickly connect serial converter to PC and
hit Ctrl+C in the terminal to break boot sequence. If you're lucky,
you'll enter U-boot shell. Then skip to point 3.
Connection parameters are 115200-8-N-1.
2. Allow the board to boot. Press the reset button, so the board
reboots into U-boot again and go back to point 1.
3. Set the "bootcmd" variable to disable the dual-boot feature of the
system and ensure that uImage is loaded. This is critical step, and
needs to be done only on initial installation.
> setenv bootcmd "bootm 0xbf040000"
> saveenv
4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed:
> setenv serverip 192.168.1.2
> setenv ipaddr 192.168.1.1
> tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7351-initramfs-kernel.bin
> bootm 0x81000000
5. Optional, but highly recommended: back up contents of "firmware" partition:
$ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7351_fw_backup.bin
6. Copy over sysupgrade image, and perform actual installation. OpenWrt
shall boot from flash afterwards:
$ ssh root@192.168.1.1
# sysupgrade -n openwrt-ath79-generic-ruckus_zf7351-squashfs-sysupgrade.bin
After unit boots, it should be available at the usual 192.168.1.1/24.
Return to factory firmware:
1. Copy over the backup to /tmp, for example using scp
2. Unset the "bootcmd" variable:
fw_setenv bootcmd ""
3. Use sysupgrade with force to restore the backup:
sysupgrade -F ruckus_zf7351_backup.bin
4. System will reboot.
Quirks and known issues:
- Flash layout is changed from the factory, to use both firmware image
partitions for storage using mtd-concat, and uImage format is used to
actually boot the system, which rules out the dual-boot capability.
- Both radio has its own EEPROM on board, not connected to CPU.
- The stock firmware has dual-boot capability, which is not supported in
OpenWrt by choice.
It is controlled by data in the top 64kB of RAM which is unmapped,
to avoid the interference in the boot process and accidental
switch to the inactive image, although boot script presence in
form of "bootcmd" variable should prevent this entirely.
- On some versions of stock firmware, it is possible to obtain root shell,
however not much is available in terms of debugging facitilies.
1. Login to the rkscli
2. Execute hidden command "Ruckus"
3. Copy and paste ";/bin/sh;" including quotes. This is required only
once, the payload will be stored in writable filesystem.
4. Execute hidden command "!v54!". Press Enter leaving empty reply for
"What's your chow?" prompt.
5. Busybox shell shall open.
Source: https://alephsecurity.com/vulns/aleph-2019014
- There is second method to achieve root shell, using command injection
in the web interface:
1. Login to web administration interface
2. Go to Administration > Diagnostics
3. Enter |telnetd${IFS}-p${IFS}204${IFS}-l${IFS}/bin/sh into "ping"
field
4. Press "Run test"
5. Telnet to the device IP at port 204
6. Busybox shell shall open.
Source: https://github.com/chk-jxcn/ruckusremoteshell
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2022-12-30 23:15:48 +00:00
|
|
|
define Device/ruckus_zf7351
|
|
|
|
|
$(Device/ruckus_gd11_common)
|
|
|
|
|
DEVICE_MODEL := ZoneFlex 7351[-U]
|
|
|
|
|
DEVICE_PACKAGES += -swconfig
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += ruckus_zf7351
|
|
|
|
|
|
ath79: support Ruckus ZoneFlex 7341/7343/7363
Ruckus ZoneFlex 7363 is a dual-band, dual-radio 802.11n 2x2 MIMO enterprise
access point. ZoneFlex 7343 is the single band variant of 7363
restricted to 2.4GHz, and ZoneFlex 7341 is 7343 minus two Fast Ethernet
ports.
Hardware highligts:
- CPU: Atheros AR7161 SoC at 680 MHz
- RAM: 64MB DDR
- Flash: 16MB SPI-NOR
- Wi-Fi 2.4GHz: AR9280 PCI 2x2 MIMO radio with external beamforming
- Wi-Fi 5GHz: AR9280 PCI 2x2 MIMO radio with external beamforming
- Ethernet 1: single Gigabit Ethernet port through Marvell 88E1116R gigabit PHY
- Ethernet 2: two Fast Ethernet ports through Realtek RTL8363S switch,
connected with Fast Ethernet link to CPU.
- PoE: input through Gigabit port
- Standalone 12V/1A power input
- USB: optional single USB 2.0 host port on the -U variants.
Serial console: 115200-8-N-1 on internal H1 header.
Pinout:
H1 ----------
|1|x3|4|5|
----------
Pin 1 is near the "H1" marking.
1 - RX
x - no pin
3 - VCC (3.3V)
4 - GND
5 - TX
Installation:
- Using serial console - requires some disassembly, 3.3V USB-Serial
adapter, TFTP server, and removing a single PH1 screw.
0. Connect serial console to H1 header. Ensure the serial converter
does not back-power the board, otherwise it will fail to boot.
1. Power-on the board. Then quickly connect serial converter to PC and
hit Ctrl+C in the terminal to break boot sequence. If you're lucky,
you'll enter U-boot shell. Then skip to point 3.
Connection parameters are 115200-8-N-1.
2. Allow the board to boot. Press the reset button, so the board
reboots into U-boot again and go back to point 1.
3. Set the "bootcmd" variable to disable the dual-boot feature of the
system and ensure that uImage is loaded. This is critical step, and
needs to be done only on initial installation.
> setenv bootcmd "bootm 0xbf040000"
> saveenv
4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed.
Use the Gigabit interface, Fast Ethernet ports are not supported
under U-boot:
> setenv serverip 192.168.1.2
> setenv ipaddr 192.168.1.1
> tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7363-initramfs-kernel.bin
> bootm 0x81000000
5. Optional, but highly recommended: back up contents of "firmware" partition:
$ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7363_fw_backup.bin
6. Copy over sysupgrade image, and perform actual installation. OpenWrt
shall boot from flash afterwards:
$ ssh root@192.168.1.1
# sysupgrade -n openwrt-ath79-generic-ruckus_zf7363-squashfs-sysupgrade.bin
After unit boots, it should be available at the usual 192.168.1.1/24.
Return to factory firmware:
1. Copy over the backup to /tmp, for example using scp
2. Unset the "bootcmd" variable:
fw_setenv bootcmd ""
3. Use sysupgrade with force to restore the backup:
sysupgrade -F ruckus_zf7363_backup.bin
4. System will reboot.
Quirks and known issues:
- Fast Ethernet ports on ZF7363 and ZF7343 are supported, but management
features of the RTL8363S switch aren't implemented yet, though the
switch is visible over MDIO0 bus. This is a gigabit-capable switch, so
link establishment with a gigabit link partner may take a longer time
because RTL8363S advertises gigabit, and the port magnetics don't
support it, so a downshift needs to occur. Both ports are accessible
at eth1 interface, which - strangely - runs only at 100Mbps itself.
- Flash layout is changed from the factory, to use both firmware image
partitions for storage using mtd-concat, and uImage format is used to
actually boot the system, which rules out the dual-boot capability.
- Both radio has its own EEPROM on board, not connected to CPU.
- The stock firmware has dual-boot capability, which is not supported in
OpenWrt by choice.
It is controlled by data in the top 64kB of RAM which is unmapped,
to avoid the interference in the boot process and accidental
switch to the inactive image, although boot script presence in
form of "bootcmd" variable should prevent this entirely.
- On some versions of stock firmware, it is possible to obtain root shell,
however not much is available in terms of debugging facitilies.
1. Login to the rkscli
2. Execute hidden command "Ruckus"
3. Copy and paste ";/bin/sh;" including quotes. This is required only
once, the payload will be stored in writable filesystem.
4. Execute hidden command "!v54!". Press Enter leaving empty reply for
"What's your chow?" prompt.
5. Busybox shell shall open.
Source: https://alephsecurity.com/vulns/aleph-2019014
- There is second method to achieve root shell, using command injection
in the web interface:
1. Login to web administration interface
2. Go to Administration > Diagnostics
3. Enter |telnetd${IFS}-p${IFS}204${IFS}-l${IFS}/bin/sh into "ping"
field
4. Press "Run test"
5. Telnet to the device IP at port 204
6. Busybox shell shall open.
Source: https://github.com/chk-jxcn/ruckusremoteshell
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2023-03-07 20:25:59 +00:00
|
|
|
define Device/ruckus_zf7363
|
|
|
|
|
$(Device/ruckus_gd11_common)
|
|
|
|
|
DEVICE_MODEL := ZoneFlex 7363[-U]
|
|
|
|
|
DEVICE_ALT0_VENDOR := Ruckus
|
|
|
|
|
DEVICE_ALT0_MODEL := ZoneFlex 7343[-U]
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += ruckus_zf7363
|
|
|
|
|
|
ath79: support Ruckus ZoneFlex 7025
Ruckus ZoneFlex 7025 is a single 2.4GHz radio 802.11n 1x1 enterprise
access point with built-in Ethernet switch, in an electrical outlet form factor.
Hardware highligts:
- CPU: Atheros AR7240 SoC at 400 MHz
- RAM: 64MB DDR2
- Flash: 16MB SPI-NOR
- Wi-Fi: AR9285 built-in 2.4GHz 1x1 radio
- Ethernet: single Fast Ethernet port inside the electrical enclosure,
coupled with internal LSA connector for direct wiring,
four external Fast Ethernet ports on the lower side of the device.
- PoE: 802.3af PD input inside the electrical box.
802.3af PSE output on the LAN4 port, capable of sourcing
class 0 or class 2 devices, depending on power supply capacity.
- External 8P8C pass-through connectors on the back and right side of the device
- Standalone 48V power input on the side, through 2/1mm micro DC barrel jack
Serial console: 115200-8-N-1 on internal JP1 header.
Pinout:
---------- JP1
|5|4|3|2|1|
----------
Pin 1 is near the "H1" marking.
1 - RX
2 - n/c
3 - VCC (3.3V)
4 - GND
5 - TX
Installation:
There are two methods of installation:
- Using serial console [1] - requires some disassembly, 3.3V USB-Serial
adapter, TFTP server, and removing a single T10 screw,
but with much less manual steps, and is generally recommended, being
safer.
- Using stock firmware root shell exploit, SSH and TFTP [2]. Does not
work on some rare versions of stock firmware. A more involved, and
requires installing `mkenvimage` from u-boot-tools package if you
choose to rebuild your own environment, but can be used without
disassembly or removal from installation point, if you have the
credentials.
If for some reason, size of your sysupgrade image exceeds 13312kB,
proceed with method [1]. For official images this is not likely to
happen ever.
[1] Using serial console:
0. Connect serial console to H1 header. Ensure the serial converter
does not back-power the board, otherwise it will fail to boot.
1. Power-on the board. Then quickly connect serial converter to PC and
hit Ctrl+C in the terminal to break boot sequence. If you're lucky,
you'll enter U-boot shell. Then skip to point 3.
Connection parameters are 115200-8-N-1.
2. Allow the board to boot. Press the reset button, so the board
reboots into U-boot again and go back to point 1.
3. Set the "bootcmd" variable to disable the dual-boot feature of the
system and ensure that uImage is loaded. This is critical step, and
needs to be done only on initial installation.
> setenv bootcmd "bootm 0x9f040000"
> saveenv
4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed:
> setenv serverip 192.168.1.2
> setenv ipaddr 192.168.1.1
> tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7025-initramfs-kernel.bin
> bootm 0x81000000
5. Optional, but highly recommended: back up contents of "firmware" partition:
$ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7025_fw1_backup.bin
6. Copy over sysupgrade image, and perform actual installation. OpenWrt
shall boot from flash afterwards:
$ ssh root@192.168.1.1
# sysupgrade -n openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin
[2] Using stock root shell:
0. Reset the device to factory defaullts. Power-on the device and after
it boots, hold the reset button near Ethernet connectors for 5
seconds.
1. Connect the device to the network. It will acquire address over DHCP,
so either find its address using list of DHCP leases by looking for
label MAC address, or try finding it by scanning for SSH port:
$ nmap 10.42.0.0/24 -p22
From now on, we assume your computer has address 10.42.0.1 and the device
has address 10.42.0.254.
2. Set up a TFTP server on your computer. We assume that TFTP server
root is at /srv/tftp.
3. Obtain root shell. Connect to the device over SSH. The SSHD ond the
frmware is pretty ancient and requires enabling HMAC-MD5.
$ ssh 10.42.0.254 \
-o UserKnownHostsFile=/dev/null \
-o StrictHostKeyCheking=no \
-o MACs=hmac-md5
Login. User is "super", password is "sp-admin".
Now execute a hidden command:
Ruckus
It is case-sensitive. Copy and paste the following string,
including quotes. There will be no output on the console for that.
";/bin/sh;"
Hit "enter". The AP will respond with:
grrrr
OK
Now execute another hidden command:
!v54!
At "What's your chow?" prompt just hit "enter".
Congratulations, you should now be dropped to Busybox shell with root
permissions.
4. Optional, but highly recommended: backup the flash contents before
installation. At your PC ensure the device can write the firmware
over TFTP:
$ sudo touch /srv/tftp/ruckus_zf7025_firmware{1,2}.bin
$ sudo chmod 666 /srv/tftp/ruckus_zf7025_firmware{1,2}.bin
Locate partitions for primary and secondary firmware image.
NEVER blindly copy over MTD nodes, because MTD indices change
depending on the currently active firmware, and all partitions are
writable!
# grep rcks_wlan /proc/mtd
Copy over both images using TFTP, this will be useful in case you'd
like to return to stock FW in future. Make sure to backup both, as
OpenWrt uses bot firmwre partitions for storage!
# tftp -l /dev/<rcks_wlan.main_mtd> -r ruckus_zf7025_firmware1.bin -p 10.42.0.1
# tftp -l /dev/<rcks_wlan.bkup_mtd> -r ruckus_zf7025_firmware2.bin -p 10.42.0.1
When the command finishes, copy over the dump to a safe place for
storage.
$ cp /srv/tftp/ruckus_zf7025_firmware{1,2}.bin ~/
5. Ensure the system is running from the BACKUP image, i.e. from
rcks_wlan.bkup partition or "image 2". Otherwise the installation
WILL fail, and you will need to access mtd0 device to write image
which risks overwriting the bootloader, and so is not covered here
and not supported.
Switching to backup firmware can be achieved by executing a few
consecutive reboots of the device, or by updating the stock firmware. The
system will boot from the image it was not running from previously.
Stock firmware available to update was conveniently dumped in point 4 :-)
6. Prepare U-boot environment image.
Install u-boot-tools package. Alternatively, if you build your own
images, OpenWrt provides mkenvimage in host staging directory as well.
It is recommended to extract environment from the device, and modify
it, rather then relying on defaults:
$ sudo touch /srv/tftp/u-boot-env.bin
$ sudo chmod 666 /srv/tftp/u-boot-env.bin
On the device, find the MTD partition on which environment resides.
Beware, it may change depending on currently active firmware image!
# grep u-boot-env /proc/mtd
Now, copy over the partition
# tftp -l /dev/mtd<N> -r u-boot-env.bin -p 10.42.0.1
Store the stock environment in a safe place:
$ cp /srv/tftp/u-boot-env.bin ~/
Extract the values from the dump:
$ strings u-boot-env.bin | tee u-boot-env.txt
Now clean up the debris at the end of output, you should end up with
each variable defined once. After that, set the bootcmd variable like
this:
bootcmd=bootm 0x9f040000
You should end up with something like this:
bootcmd=bootm 0x9f040000
bootargs=console=ttyS0,115200 rootfstype=squashfs init=/sbin/init
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
mtdparts=mtdparts=ar7100-nor0:256k(u-boot),7168k(rcks_wlan.main),7168k(rcks_wlan.bkup),1280k(datafs),256k(u-boot-env)
mtdids=nor0=ar7100-nor0
bootdelay=2
filesize=52e000
fileaddr=81000000
ethact=eth0
stdin=serial
stdout=serial
stderr=serial
partition=nor0,0
mtddevnum=0
mtddevname=u-boot
ipaddr=192.168.0.1
serverip=192.168.0.2
stderr=serial
ethact=eth0
These are the defaults, you can use most likely just this as input to
mkenvimage.
Now, create environment image and copy it over to TFTP root:
$ mkenvimage -s 0x40000 -b -o u-boot-env.bin u-boot-env.txt
$ sudo cp u-boot-env.bin /srv/tftp
This is the same image, gzipped and base64-encoded:
H4sICOLMEGMAA3UtYm9vdC1lbnYtbmV3LmJpbgDt0E1u00AUAGDfgm2XDUrTsUV/pTkFSxZoEk+o
lcQJtlNaLsURwU4FikDiBN+3eDNvLL/3Zt5/+vFuud8Pq10dp3V3EV4e1uFDGBXTQeq+9HG1b/v9
NsdheP0Y5mV5U4Vw0Y1f1/3wesix/3pM/dO6v2jaZojX/bJpr6dtsUzHuktDjm//FHl4SnXdxfAS
wmN4SWkMy+UYVqsx1PUYci52Q31I3dDHP5vU3ZUhXLX7LjxWN7eby+PVNNxsflfe3m8uu9Wm//xt
m9rFLjXtv6fLzfEwm5fVfdhc1mlI6342Pytzldvn2dS1qfs49Tjvd3qFOm/Ta6yKdbPNffM9x5sq
Ty805acL3Zfh5HTD1RDHJRT9WLGNfe6atJ2S/XE4y3LX/c6mSzZDs29P3edhmqXOz+1xF//s0y7H
t3GL5nDqWT5Ui/Gii7Aoi7HQ81jrcHZY/dXkfLLiJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8
xy8jb4zOAAAEAA==
7. Perform actual installation. Copy over OpenWrt sysupgrade image to
TFTP root:
$ sudo cp openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin /srv/tftp
Now load both to the device over TFTP:
# tftp -l /tmp/u-boot-env.bin -r u-boot-env.bin -g 10.42.0.1
# tftp -l /tmp/openwrt.bin -r openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin -g 10.42.0.1
Verify checksums of both images to ensure the transfer over TFTP
was completed:
# sha256sum /tmp/u-boot-env.bin /tmp/openwrt.bin
And compare it against source images:
$ sha256sum /srv/tftp/u-boot-env.bin /srv/tftp/openwrt-ath79-generic-ruckus_zf7025-squashfs-sysupgrade.bin
Locate MTD partition of the primary image:
# grep rcks_wlan.main /proc/mtd
Now, write the images in place. Write U-boot environment last, so
unit still can boot from backup image, should power failure occur during
this. Replace MTD placeholders with real MTD nodes:
# flashcp /tmp/openwrt.bin /dev/<rcks_wlan.main_mtd>
# flashcp /tmp/u-boot-env.bin /dev/<u-boot-env_mtd>
Finally, reboot the device. The device should directly boot into
OpenWrt. Look for the characteristic power LED blinking pattern.
# reboot -f
After unit boots, it should be available at the usual 192.168.1.1/24.
Return to factory firmware:
1. Boot into OpenWrt initramfs as for initial installation. To do that
without disassembly, you can write an initramfs image to the device
using 'sysupgrade -F' first.
2. Unset the "bootcmd" variable:
fw_setenv bootcmd ""
3. Concatenate the firmware backups, if you took them during installation using method 2:
$ cat ruckus_zf7025_fw1_backup.bin ruckus_zf7025_fw2_backup.bin > ruckus_zf7025_backup.bin
3. Write factory images downloaded from manufacturer website into
fwconcat0 and fwconcat1 MTD partitions, or restore backup you took
before installation:
# mtd write ruckus_zf7025_backup.bin /dev/mtd1
4. Reboot the system, it should load into factory firmware again.
Quirks and known issues:
- Flash layout is changed from the factory, to use both firmware image
partitions for storage using mtd-concat, and uImage format is used to
actually boot the system, which rules out the dual-boot capability.
- The 2.4 GHz radio has its own EEPROM on board, not connected to CPU.
- The stock firmware has dual-boot capability, which is not supported in
OpenWrt by choice.
It is controlled by data in the top 64kB of RAM which is unmapped,
to avoid the interference in the boot process and accidental
switch to the inactive image, although boot script presence in
form of "bootcmd" variable should prevent this entirely.
- On some versions of stock firmware, it is possible to obtain root shell,
however not much is available in terms of debugging facitilies.
1. Login to the rkscli
2. Execute hidden command "Ruckus"
3. Copy and paste ";/bin/sh;" including quotes. This is required only
once, the payload will be stored in writable filesystem.
4. Execute hidden command "!v54!". Press Enter leaving empty reply for
"What's your chow?" prompt.
5. Busybox shell shall open.
Source: https://alephsecurity.com/vulns/aleph-2019014
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2022-09-01 21:00:02 +00:00
|
|
|
define Device/ruckus_zf73xx_common
|
|
|
|
|
$(Device/ruckus_common)
|
|
|
|
|
DEVICE_PACKAGES := -swconfig kmod-usb2 kmod-usb-chipidea2
|
|
|
|
|
IMAGE_SIZE := 31744k
|
|
|
|
|
endef
|
|
|
|
|
|
ath79: support Ruckus ZoneFlex 7321
Ruckus ZoneFlex 7321 is a dual-band, single radio 802.11n 2x2 MIMO enterprise
access point. It is very similar to its bigger brother, ZoneFlex 7372.
Hardware highligts:
- CPU: Atheros AR9342 SoC at 533 MHz
- RAM: 64MB DDR2
- Flash: 32MB SPI-NOR
- Wi-Fi: AR9342 built-in dual-band 2x2 MIMO radio
- Ethernet: single Gigabit Ethernet port through AR8035 gigabit PHY
- PoE: input through Gigabit port
- Standalone 12V/1A power input
- USB: optional single USB 2.0 host port on the 7321-U variant.
Serial console: 115200-8-N-1 on internal H1 header.
Pinout:
H1 ----------
|1|x3|4|5|
----------
Pin 1 is near the "H1" marking.
1 - RX
x - no pin
3 - VCC (3.3V)
4 - GND
5 - TX
JTAG: Connector H5, unpopulated, similar to MIPS eJTAG, standard,
but without the key in pin 12 and not every pin routed:
------- H5
|1 |2 |
-------
|3 |4 |
-------
|5 |6 |
-------
|7 |8 |
-------
|9 |10|
-------
|11|12|
-------
|13|14|
-------
3 - TDI
5 - TDO
7 - TMS
9 - TCK
2,4,6,8,10 - GND
14 - Vref
1,11,12,13 - Not connected
Installation:
There are two methods of installation:
- Using serial console [1] - requires some disassembly, 3.3V USB-Serial
adapter, TFTP server, and removing a single T10 screw,
but with much less manual steps, and is generally recommended, being
safer.
- Using stock firmware root shell exploit, SSH and TFTP [2]. Does not
work on some rare versions of stock firmware. A more involved, and
requires installing `mkenvimage` from u-boot-tools package if you
choose to rebuild your own environment, but can be used without
disassembly or removal from installation point, if you have the
credentials.
If for some reason, size of your sysupgrade image exceeds 13312kB,
proceed with method [1]. For official images this is not likely to
happen ever.
[1] Using serial console:
0. Connect serial console to H1 header. Ensure the serial converter
does not back-power the board, otherwise it will fail to boot.
1. Power-on the board. Then quickly connect serial converter to PC and
hit Ctrl+C in the terminal to break boot sequence. If you're lucky,
you'll enter U-boot shell. Then skip to point 3.
Connection parameters are 115200-8-N-1.
2. Allow the board to boot. Press the reset button, so the board
reboots into U-boot again and go back to point 1.
3. Set the "bootcmd" variable to disable the dual-boot feature of the
system and ensure that uImage is loaded. This is critical step, and
needs to be done only on initial installation.
> setenv bootcmd "bootm 0x9f040000"
> saveenv
4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed:
> setenv serverip 192.168.1.2
> setenv ipaddr 192.168.1.1
> tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7321-initramfs-kernel.bin
> bootm 0x81000000
5. Optional, but highly recommended: back up contents of "firmware" partition:
$ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7321_fw1_backup.bin
$ ssh root@192.168.1.1 cat /dev/mtd5 > ruckus_zf7321_fw2_backup.bin
6. Copy over sysupgrade image, and perform actual installation. OpenWrt
shall boot from flash afterwards:
$ ssh root@192.168.1.1
# sysupgrade -n openwrt-ath79-generic-ruckus_zf7321-squashfs-sysupgrade.bin
[2] Using stock root shell:
0. Reset the device to factory defaullts. Power-on the device and after
it boots, hold the reset button near Ethernet connectors for 5
seconds.
1. Connect the device to the network. It will acquire address over DHCP,
so either find its address using list of DHCP leases by looking for
label MAC address, or try finding it by scanning for SSH port:
$ nmap 10.42.0.0/24 -p22
From now on, we assume your computer has address 10.42.0.1 and the device
has address 10.42.0.254.
2. Set up a TFTP server on your computer. We assume that TFTP server
root is at /srv/tftp.
3. Obtain root shell. Connect to the device over SSH. The SSHD ond the
frmware is pretty ancient and requires enabling HMAC-MD5.
$ ssh 10.42.0.254 \
-o UserKnownHostsFile=/dev/null \
-o StrictHostKeyCheking=no \
-o MACs=hmac-md5
Login. User is "super", password is "sp-admin".
Now execute a hidden command:
Ruckus
It is case-sensitive. Copy and paste the following string,
including quotes. There will be no output on the console for that.
";/bin/sh;"
Hit "enter". The AP will respond with:
grrrr
OK
Now execute another hidden command:
!v54!
At "What's your chow?" prompt just hit "enter".
Congratulations, you should now be dropped to Busybox shell with root
permissions.
4. Optional, but highly recommended: backup the flash contents before
installation. At your PC ensure the device can write the firmware
over TFTP:
$ sudo touch /srv/tftp/ruckus_zf7321_firmware{1,2}.bin
$ sudo chmod 666 /srv/tftp/ruckus_zf7321_firmware{1,2}.bin
Locate partitions for primary and secondary firmware image.
NEVER blindly copy over MTD nodes, because MTD indices change
depending on the currently active firmware, and all partitions are
writable!
# grep rcks_wlan /proc/mtd
Copy over both images using TFTP, this will be useful in case you'd
like to return to stock FW in future. Make sure to backup both, as
OpenWrt uses bot firmwre partitions for storage!
# tftp -l /dev/<rcks_wlan.main_mtd> -r ruckus_zf7321_firmware1.bin -p 10.42.0.1
# tftp -l /dev/<rcks_wlan.bkup_mtd> -r ruckus_zf7321_firmware2.bin -p 10.42.0.1
When the command finishes, copy over the dump to a safe place for
storage.
$ cp /srv/tftp/ruckus_zf7321_firmware{1,2}.bin ~/
5. Ensure the system is running from the BACKUP image, i.e. from
rcks_wlan.bkup partition or "image 2". Otherwise the installation
WILL fail, and you will need to access mtd0 device to write image
which risks overwriting the bootloader, and so is not covered here
and not supported.
Switching to backup firmware can be achieved by executing a few
consecutive reboots of the device, or by updating the stock firmware. The
system will boot from the image it was not running from previously.
Stock firmware available to update was conveniently dumped in point 4 :-)
6. Prepare U-boot environment image.
Install u-boot-tools package. Alternatively, if you build your own
images, OpenWrt provides mkenvimage in host staging directory as well.
It is recommended to extract environment from the device, and modify
it, rather then relying on defaults:
$ sudo touch /srv/tftp/u-boot-env.bin
$ sudo chmod 666 /srv/tftp/u-boot-env.bin
On the device, find the MTD partition on which environment resides.
Beware, it may change depending on currently active firmware image!
# grep u-boot-env /proc/mtd
Now, copy over the partition
# tftp -l /dev/mtd<N> -r u-boot-env.bin -p 10.42.0.1
Store the stock environment in a safe place:
$ cp /srv/tftp/u-boot-env.bin ~/
Extract the values from the dump:
$ strings u-boot-env.bin | tee u-boot-env.txt
Now clean up the debris at the end of output, you should end up with
each variable defined once. After that, set the bootcmd variable like
this:
bootcmd=bootm 0x9f040000
You should end up with something like this:
bootcmd=bootm 0x9f040000
bootargs=console=ttyS0,115200 rootfstype=squashfs init=/sbin/init
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
mtdparts=mtdparts=ar7100-nor0:256k(u-boot),13312k(rcks_wlan.main),2048k(datafs),256k(u-boot-env),512k(Board Data),13312k(rcks_wlan.bkup)
mtdids=nor0=ar7100-nor0
bootdelay=2
ethact=eth0
filesize=78a000
fileaddr=81000000
partition=nor0,0
mtddevnum=0
mtddevname=u-boot
ipaddr=10.0.0.1
serverip=10.0.0.5
stdin=serial
stdout=serial
stderr=serial
These are the defaults, you can use most likely just this as input to
mkenvimage.
Now, create environment image and copy it over to TFTP root:
$ mkenvimage -s 0x40000 -b -o u-boot-env.bin u-boot-env.txt
$ sudo cp u-boot-env.bin /srv/tftp
This is the same image, gzipped and base64-encoded:
H4sIAAAAAAAAA+3QQW7TQBQAUF8EKRtQI6XtJDS0VJoN4gYcAE3iCbWS2MF2Sss1ORDYqVq6YMEB3rP0
Z/7Yf+aP3/56827VNP16X8Zx3E/Cw8dNuAqDYlxI7bcurpu6a3Y59v3jlzCbz5eLECbt8HbT9Y+HHLvv
x9TdbbpJVVd9vOxWVX05TotVOpZt6nN8qilyf5fKso3hIYTb8JDSEFarIazXQyjLIeRc7PvykNq+iy+T
1F7PQzivmzbcLpYftmfH87G56Wz+/v18sT1r19vu649dqi/2qaqns0W4utmelalPm27I/lac5/p+OluO
NZ+a1JaTz8M3/9hmtT0epmMjVdnF8djXLZx+TJl36TEuTlda93EYQrGpdrmrfuZ4fZPGHzjmp/vezMNJ
MV6n6qumPm06C+MRZb6vj/v4Mk/7HJ+6LarDqXweLsZnXnS5vc9tdXheWRbd0GIdh/Uq7cakOfavsty2
z1nxGwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAD+1x9eTkHLAAAEAA==
7. Perform actual installation. Copy over OpenWrt sysupgrade image to
TFTP root:
$ sudo cp openwrt-ath79-generic-ruckus_zf7321-squashfs-sysupgrade.bin /srv/tftp
Now load both to the device over TFTP:
# tftp -l /tmp/u-boot-env.bin -r u-boot-env.bin -g 10.42.0.1
# tftp -l /tmp/openwrt.bin -r openwrt-ath79-generic-ruckus_zf7321-squashfs-sysupgrade.bin -g 10.42.0.1
Vverify checksums of both images to ensure the transfer over TFTP
was completed:
# sha256sum /tmp/u-boot-env.bin /tmp/openwrt.bin
And compare it against source images:
$ sha256sum /srv/tftp/u-boot-env.bin /srv/tftp/openwrt-ath79-generic-ruckus_zf7321-squashfs-sysupgrade.bin
Locate MTD partition of the primary image:
# grep rcks_wlan.main /proc/mtd
Now, write the images in place. Write U-boot environment last, so
unit still can boot from backup image, should power failure occur during
this. Replace MTD placeholders with real MTD nodes:
# flashcp /tmp/openwrt.bin /dev/<rcks_wlan.main_mtd>
# flashcp /tmp/u-boot-env.bin /dev/<u-boot-env_mtd>
Finally, reboot the device. The device should directly boot into
OpenWrt. Look for the characteristic power LED blinking pattern.
# reboot -f
After unit boots, it should be available at the usual 192.168.1.1/24.
Return to factory firmware:
1. Boot into OpenWrt initramfs as for initial installation. To do that
without disassembly, you can write an initramfs image to the device
using 'sysupgrade -F' first.
2. Unset the "bootcmd" variable:
fw_setenv bootcmd ""
3. Write factory images downloaded from manufacturer website into
fwconcat0 and fwconcat1 MTD partitions, or restore backup you took
before installation:
mtd write ruckus_zf7321_fw1_backup.bin /dev/mtd1
mtd write ruckus_zf7321_fw2_backup.bin /dev/mtd5
4. Reboot the system, it should load into factory firmware again.
Quirks and known issues:
- Flash layout is changed from the factory, to use both firmware image
partitions for storage using mtd-concat, and uImage format is used to
actually boot the system, which rules out the dual-boot capability.
- The 5GHz radio has its own EEPROM on board, not connected to CPU.
- The stock firmware has dual-boot capability, which is not supported in
OpenWrt by choice.
It is controlled by data in the top 64kB of RAM which is unmapped,
to avoid the interference in the boot process and accidental
switch to the inactive image, although boot script presence in
form of "bootcmd" variable should prevent this entirely.
- U-boot disables JTAG when starting. To re-enable it, you need to
execute the following command before booting:
mw.l 1804006c 40
And also you need to disable the reset button in device tree if you
intend to debug Linux, because reset button on GPIO0 shares the TCK
pin.
- On some versions of stock firmware, it is possible to obtain root shell,
however not much is available in terms of debugging facitilies.
1. Login to the rkscli
2. Execute hidden command "Ruckus"
3. Copy and paste ";/bin/sh;" including quotes. This is required only
once, the payload will be stored in writable filesystem.
4. Execute hidden command "!v54!". Press Enter leaving empty reply for
"What's your chow?" prompt.
5. Busybox shell shall open.
Source: https://alephsecurity.com/vulns/aleph-2019014
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2022-06-14 20:49:40 +00:00
|
|
|
define Device/ruckus_zf7321
|
|
|
|
|
$(Device/ruckus_zf73xx_common)
|
|
|
|
|
SOC := ar9342
|
|
|
|
|
DEVICE_MODEL := ZoneFlex 7321[-U]
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += ruckus_zf7321
|
|
|
|
|
|
ath79: support Ruckus ZoneFlex 7372
Ruckus ZoneFlex 7372 is a dual-band, dual-radio 802.11n 2x2 MIMO enterprise
access point.
Ruckus ZoneFlex 7352 is also supported, lacking the 5GHz radio part.
Hardware highligts:
- CPU: Atheros AR9344 SoC at 560 MHz
- RAM: 128MB DDR2
- Flash: 32MB SPI-NOR
- Wi-Fi 2.4GHz: AR9344 built-in 2x2 MIMO radio
- Wi-Fi 5Ghz: AR9582 2x2 MIMO radio (Only in ZF7372)
- Antennas:
- Separate internal active antennas with beamforming support on both
bands with 7 elements per band, each controlled by 74LV164 GPIO
expanders, attached to GPIOs of each radio.
- Two dual-band external RP-SMA antenna connections on "7372-E"
variant.
- Ethernet 1: single Gigabit Ethernet port through AR8035 gigabit PHY
- Ethernet 2: single Fast Ethernet port through AR9344 built-in switch
- PoE: input through Gigabit port
- Standalone 12V/1A power input
- USB: optional single USB 2.0 host port on "-U" variants.
The same image should support:
- ZoneFlex 7372E (variant with external antennas, without beamforming
capability)
- ZoneFlex 7352 (single-band, 2.4GHz-only variant).
which are based on same baseboard (codename St. Bernard),
with different populated components.
Serial console: 115200-8-N-1 on internal H1 header.
Pinout:
H1
---
|5|
---
|4|
---
|3|
---
|x|
---
|1|
---
Pin 5 is near the "H1" marking.
1 - RX
x - no pin
3 - VCC (3.3V)
4 - GND
5 - TX
JTAG: Connector H2, similar to MIPS eJTAG, standard,
but without the key in pin 12 and not every pin routed:
------- H2
|1 |2 |
-------
|3 |4 |
-------
|5 |6 |
-------
|7 |8 |
-------
|9 |10|
-------
|11|12|
-------
|13|14|
-------
3 - TDI
5 - TDO
7 - TMS
9 - TCK
2,4,6,8,10 - GND
14 - Vref
1,11,12,13 - Not connected
Installation:
There are two methods of installation:
- Using serial console [1] - requires some disassembly, 3.3V USB-Serial
adapter, TFTP server, and removing a single T10 screw,
but with much less manual steps, and is generally recommended, being
safer.
- Using stock firmware root shell exploit, SSH and TFTP [2]. Does not
work on some rare versions of stock firmware. A more involved, and
requires installing `mkenvimage` from u-boot-tools package if you
choose to rebuild your own environment, but can be used without
disassembly or removal from installation point, if you have the
credentials.
If for some reason, size of your sysupgrade image exceeds 13312kB,
proceed with method [1]. For official images this is not likely to
happen ever.
[1] Using serial console:
0. Connect serial console to H1 header. Ensure the serial converter
does not back-power the board, otherwise it will fail to boot.
1. Power-on the board. Then quickly connect serial converter to PC and
hit Ctrl+C in the terminal to break boot sequence. If you're lucky,
you'll enter U-boot shell. Then skip to point 3.
Connection parameters are 115200-8-N-1.
2. Allow the board to boot. Press the reset button, so the board
reboots into U-boot again and go back to point 1.
3. Set the "bootcmd" variable to disable the dual-boot feature of the
system and ensure that uImage is loaded. This is critical step, and
needs to be done only on initial installation.
> setenv bootcmd "bootm 0x9f040000"
> saveenv
4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed:
> setenv serverip 192.168.1.2
> setenv ipaddr 192.168.1.1
> tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7372-initramfs-kernel.bin
> bootm 0x81000000
5. Optional, but highly recommended: back up contents of "firmware" partition:
$ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7372_fw1_backup.bin
$ ssh root@192.168.1.1 cat /dev/mtd5 > ruckus_zf7372_fw2_backup.bin
6. Copy over sysupgrade image, and perform actual installation. OpenWrt
shall boot from flash afterwards:
$ ssh root@192.168.1.1
# sysupgrade -n openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin
[2] Using stock root shell:
0. Reset the device to factory defaullts. Power-on the device and after
it boots, hold the reset button near Ethernet connectors for 5
seconds.
1. Connect the device to the network. It will acquire address over DHCP,
so either find its address using list of DHCP leases by looking for
label MAC address, or try finding it by scanning for SSH port:
$ nmap 10.42.0.0/24 -p22
From now on, we assume your computer has address 10.42.0.1 and the device
has address 10.42.0.254.
2. Set up a TFTP server on your computer. We assume that TFTP server
root is at /srv/tftp.
3. Obtain root shell. Connect to the device over SSH. The SSHD ond the
frmware is pretty ancient and requires enabling HMAC-MD5.
$ ssh 10.42.0.254 \
-o UserKnownHostsFile=/dev/null \
-o StrictHostKeyCheking=no \
-o MACs=hmac-md5
Login. User is "super", password is "sp-admin".
Now execute a hidden command:
Ruckus
It is case-sensitive. Copy and paste the following string,
including quotes. There will be no output on the console for that.
";/bin/sh;"
Hit "enter". The AP will respond with:
grrrr
OK
Now execute another hidden command:
!v54!
At "What's your chow?" prompt just hit "enter".
Congratulations, you should now be dropped to Busybox shell with root
permissions.
4. Optional, but highly recommended: backup the flash contents before
installation. At your PC ensure the device can write the firmware
over TFTP:
$ sudo touch /srv/tftp/ruckus_zf7372_firmware{1,2}.bin
$ sudo chmod 666 /srv/tftp/ruckus_zf7372_firmware{1,2}.bin
Locate partitions for primary and secondary firmware image.
NEVER blindly copy over MTD nodes, because MTD indices change
depending on the currently active firmware, and all partitions are
writable!
# grep rcks_wlan /proc/mtd
Copy over both images using TFTP, this will be useful in case you'd
like to return to stock FW in future. Make sure to backup both, as
OpenWrt uses bot firmwre partitions for storage!
# tftp -l /dev/<rcks_wlan.main_mtd> -r ruckus_zf7372_firmware1.bin -p 10.42.0.1
# tftp -l /dev/<rcks_wlan.bkup_mtd> -r ruckus_zf7372_firmware2.bin -p 10.42.0.1
When the command finishes, copy over the dump to a safe place for
storage.
$ cp /srv/tftp/ruckus_zf7372_firmware{1,2}.bin ~/
5. Ensure the system is running from the BACKUP image, i.e. from
rcks_wlan.bkup partition or "image 2". Otherwise the installation
WILL fail, and you will need to access mtd0 device to write image
which risks overwriting the bootloader, and so is not covered here
and not supported.
Switching to backup firmware can be achieved by executing a few
consecutive reboots of the device, or by updating the stock firmware. The
system will boot from the image it was not running from previously.
Stock firmware available to update was conveniently dumped in point 4 :-)
6. Prepare U-boot environment image.
Install u-boot-tools package. Alternatively, if you build your own
images, OpenWrt provides mkenvimage in host staging directory as well.
It is recommended to extract environment from the device, and modify
it, rather then relying on defaults:
$ sudo touch /srv/tftp/u-boot-env.bin
$ sudo chmod 666 /srv/tftp/u-boot-env.bin
On the device, find the MTD partition on which environment resides.
Beware, it may change depending on currently active firmware image!
# grep u-boot-env /proc/mtd
Now, copy over the partition
# tftp -l /dev/mtd<N> -r u-boot-env.bin -p 10.42.0.1
Store the stock environment in a safe place:
$ cp /srv/tftp/u-boot-env.bin ~/
Extract the values from the dump:
$ strings u-boot-env.bin | tee u-boot-env.txt
Now clean up the debris at the end of output, you should end up with
each variable defined once. After that, set the bootcmd variable like
this:
bootcmd=bootm 0x9f040000
You should end up with something like this:
bootcmd=bootm 0x9f040000
bootargs=console=ttyS0,115200 rootfstype=squashfs init=/sbin/init
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
bootdelay=2
mtdids=nor0=ar7100-nor0
mtdparts=mtdparts=ar7100-nor0:256k(u-boot),13312k(rcks_wlan.main),2048k(datafs),256k(u-boot-env),512k(Board Data),13312k(rcks_wlan.bkup)
ethact=eth0
filesize=1000000
fileaddr=81000000
ipaddr=192.168.0.7
serverip=192.168.0.51
partition=nor0,0
mtddevnum=0
mtddevname=u-boot
stdin=serial
stdout=serial
stderr=serial
These are the defaults, you can use most likely just this as input to
mkenvimage.
Now, create environment image and copy it over to TFTP root:
$ mkenvimage -s 0x40000 -b -o u-boot-env.bin u-boot-env.txt
$ sudo cp u-boot-env.bin /srv/tftp
This is the same image, gzipped and base64-encoded:
H4sIAAAAAAAAA+3QTW7TQBQAYB+AQ2TZSGk6Tpv+SbNBrNhyADSJHWolsYPtlJaDcAWOCXaqQhdIXOD7
Fm/ee+MZ+/nHu58fV03Tr/dFHNf9JDzdbcJVGGRjI7Vfurhu6q7ZlbHvnz+FWZ4vFyFM2mF30/XPhzJ2
X4+pe9h0k6qu+njRrar6YkyzVToWberL+HImK/uHVBRtDE8h3IenlIawWg1hvR5CUQyhLE/vLcpdeo6L
bN8XVdHFumlDTO1NHsL5mI/9Q2r7Lv5J3uzeL5bX27Pj+XjRdJZfXuaL7Vm73nafv+1SPd+nqp7OFuHq
dntWpD5tuqH6e+K8rB+ns+V45n2T2mLyYXjmH9estsfD9DTSuo/DErJNtSu76vswbjg5NU4D3752qsOp
zu8W8/z6dh7mN1lXto9lWx3eNJd5Ng5V9VVTn2afnSYuysf6uI9/8rQv48s3Z93wn+o4XFWl3Vg0x/5N
Vbbta5X9AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAID/+Q2Z/B7cAAAEAA==
7. Perform actual installation. Copy over OpenWrt sysupgrade image to
TFTP root:
$ sudo cp openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin /srv/tftp
Now load both to the device over TFTP:
# tftp -l /tmp/u-boot-env.bin -r u-boot-env.bin -g 10.42.0.1
# tftp -l /tmp/openwrt.bin -r openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin -g 10.42.0.1
Verify checksums of both images to ensure the transfer over TFTP
was completed:
# sha256sum /tmp/u-boot-env.bin /tmp/openwrt.bin
And compare it against source images:
$ sha256sum /srv/tftp/u-boot-env.bin /srv/tftp/openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin
Locate MTD partition of the primary image:
# grep rcks_wlan.main /proc/mtd
Now, write the images in place. Write U-boot environment last, so
unit still can boot from backup image, should power failure occur during
this. Replace MTD placeholders with real MTD nodes:
# flashcp /tmp/openwrt.bin /dev/<rcks_wlan.main_mtd>
# flashcp /tmp/u-boot-env.bin /dev/<u-boot-env_mtd>
Finally, reboot the device. The device should directly boot into
OpenWrt. Look for the characteristic power LED blinking pattern.
# reboot -f
After unit boots, it should be available at the usual 192.168.1.1/24.
Return to factory firmware:
1. Boot into OpenWrt initramfs as for initial installation. To do that
without disassembly, you can write an initramfs image to the device
using 'sysupgrade -F' first.
2. Unset the "bootcmd" variable:
fw_setenv bootcmd ""
3. Write factory images downloaded from manufacturer website into
fwconcat0 and fwconcat1 MTD partitions, or restore backup you took
before installation:
mtd write ruckus_zf7372_fw1_backup.bin /dev/mtd1
mtd write ruckus_zf7372_fw2_backup.bin /dev/mtd5
4. Reboot the system, it should load into factory firmware again.
Quirks and known issues:
- This is first device in ath79 target to support link state reporting
on FE port attached trough the built-in switch.
- Flash layout is changed from the factory, to use both firmware image
partitions for storage using mtd-concat, and uImage format is used to
actually boot the system, which rules out the dual-boot capability.
The 5GHz radio has its own EEPROM on board, not connected to CPU.
- The stock firmware has dual-boot capability, which is not supported in
OpenWrt by choice.
It is controlled by data in the top 64kB of RAM which is unmapped,
to avoid the interference in the boot process and accidental
switch to the inactive image, although boot script presence in
form of "bootcmd" variable should prevent this entirely.
- U-boot disables JTAG when starting. To re-enable it, you need to
execute the following command before booting:
mw.l 1804006c 40
And also you need to disable the reset button in device tree if you
intend to debug Linux, because reset button on GPIO0 shares the TCK
pin.
- On some versions of stock firmware, it is possible to obtain root shell,
however not much is available in terms of debugging facitilies.
1. Login to the rkscli
2. Execute hidden command "Ruckus"
3. Copy and paste ";/bin/sh;" including quotes. This is required only
once, the payload will be stored in writable filesystem.
4. Execute hidden command "!v54!". Press Enter leaving empty reply for
"What's your chow?" prompt.
5. Busybox shell shall open.
Source: https://alephsecurity.com/vulns/aleph-2019014
- Stock firmware has beamforming functionality, known as BeamFlex,
using active multi-segment antennas on both bands - controlled by
RF analog switches, driven by a pair of 74LV164 shift registers.
Shift registers used for each radio are connected to GPIO14 (clock)
and GPIO15 of the respective chip.
They are mapped as generic GPIOs in OpenWrt - in stock firmware,
they were most likely handled directly by radio firmware,
given the real-time nature of their control.
Lack of this support in OpenWrt causes the antennas to behave as
ordinary omnidirectional antennas, and does not affect throughput in
normal conditions, but GPIOs are available to tinker with nonetheless.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2022-05-22 15:46:28 +00:00
|
|
|
define Device/ruckus_zf7372
|
|
|
|
|
$(Device/ruckus_zf73xx_common)
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_MODEL := ZoneFlex 7352/7372[-E/-U]
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += ruckus_zf7372
|
|
|
|
|
|
ath79: add support for Samsung WAM250
Samsung WAM250 is a dual-band (selectable, not simultaneous) wireless
hub, dedicated for Samsung Shape Wireless Audio System. The device is
based on Atheros AR9344 (FCC ID: A3LWAM250). Support for this device
was first introduced in e58e49bdbe (ar71xx target).
Specifications:
- Atheros AR9344
- 560/450/225 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x 10/100 Mbps Ethernet
- 2T2R 2.4/5 GHz Wi-Fi, with ext. PA (SE2598L, SE5003L) and LNA
- 1x USB 2.0
- 4x LED (all are driven by GPIO)
- 2x button (reset, wps/speaker add)
- DC jack for main power input (14 V)
- UART header on PCB (J4, RX: 3, TX: 5)
Flash instruction:
This device uses dual-image (switched between upgrades) with a common
jffs2 config partition. Fortunately, there is a way to disable this mode
so that more flash space can be used by OpenWrt image.
You can easily access this device over telnet, using root/root
credentials (the same also work for serial console access).
1. Make sure that your device uses second (bootpart=2) image using
command: "fw_printenv bootpart".
2. If your device uses first image (bootpart=1), perform upgrade to the
latest vendor firmware (after the update, device should boot from
second partition) using web gui (default login: admin/1234567890).
3. Rename "sysupgrade" image to "firmware.bin", download it (you can use
wget, tftp or ftpget) to "/tmp" and issue below commands:
mtd_debug erase /dev/mtd3 0 $(wc -c /tmp/firmware.bin | awk -F' ' '{print $1}')
mtd_debug write /dev/mtd3 0 $(wc -c /tmp/firmware.bin)
fw_setenv bootpart
fw_setenv bootcmd "bootm 0x9f070000"
reboot
Revert to vendor firmware instruction:
1. Download vendor firmware to "/tmp" device and issue below commands:
fw_setenv bootpart 1
sysupgrade -n -F SS_BHUB_v2.2.05.bin
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-09-18 12:11:13 +00:00
|
|
|
define Device/samsung_wam250
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_VENDOR := Samsung
|
|
|
|
|
DEVICE_MODEL := WAM250
|
|
|
|
|
IMAGE_SIZE := 15872k
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
|
|
|
|
SUPPORTED_DEVICES += wam250
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += samsung_wam250
|
|
|
|
|
|
2020-02-08 11:58:25 +00:00
|
|
|
define Device/siemens_ws-ap3610
|
|
|
|
|
SOC := ar7161
|
|
|
|
|
DEVICE_VENDOR := Siemens
|
|
|
|
|
DEVICE_MODEL := WS-AP3610
|
|
|
|
|
IMAGE_SIZE := 14336k
|
2020-02-20 09:29:09 +00:00
|
|
|
BLOCKSIZE := 256k
|
2020-02-08 11:58:25 +00:00
|
|
|
LOADER_TYPE := bin
|
|
|
|
|
LOADER_FLASH_OFFS := 0x82000
|
|
|
|
|
COMPILE := loader-$(1).bin
|
|
|
|
|
COMPILE/loader-$(1).bin := loader-okli-compile
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x4f4b4c49 | loader-okli $(1) 8128 | uImage none
|
|
|
|
|
KERNEL_INITRAMFS := kernel-bin | append-dtb | uImage none
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += siemens_ws-ap3610
|
|
|
|
|
|
ath79: add support for Sitecom WLR-7100
Sitecom WLR-7100 v1 002 (marketed as X7 AC1200) is a dual band wireless
router.
Specification
SoC: Atheros AR1022
RAM: 64 MB DDR2
Flash: 8 MB SPI NOR
WIFI: 2.4 GHz 2T2R integrated
5 GHz 2T2R QCA9882 integrated (connected to PCIe lane)
Ethernet: 5x 10/100/1000 Mbps QCA8337N
USB: 1x 2.0
LEDS: 4x GPIO controlled, 5x switch
Buttons: 2x GPIO controlled
UART: row of 4 unpopulated holes near USB port, starting count from
white triangle on PCB
1. VCC 3.3V, 2. GND, 3. TX, 4. RX
baud: 115200, parity: none, flow control: none
Installation
1. Connect to one of LAN (yellow) ethernet ports,
2. Open router configuration interface,
3. Go to Toolbox > Firmware,
4. Browse for OpenWrt factory image with dlf extension and hit Apply,
5. Wait few minutes, after the Power LED will stop blinking, the router
is ready for configuration.
Known issues
5GHz LED doesn't work
Additional information
When TX line on UART is connected, and board is switched on from power
off state, the DDR memory training may fail.
If connected to UART, when prompted for number on boot, one can enter
number 4 to open bootloader (U-Boot) command line.
OEM firmware shell password is: SitecomSenao
useful for creating backup of original firmware.
There is also another revision of this device (v1 001), which may or may
not work with introduced images.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
2019-10-15 12:56:12 +00:00
|
|
|
define Device/sitecom_wlr-7100
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar1022
|
ath79: add support for Sitecom WLR-7100
Sitecom WLR-7100 v1 002 (marketed as X7 AC1200) is a dual band wireless
router.
Specification
SoC: Atheros AR1022
RAM: 64 MB DDR2
Flash: 8 MB SPI NOR
WIFI: 2.4 GHz 2T2R integrated
5 GHz 2T2R QCA9882 integrated (connected to PCIe lane)
Ethernet: 5x 10/100/1000 Mbps QCA8337N
USB: 1x 2.0
LEDS: 4x GPIO controlled, 5x switch
Buttons: 2x GPIO controlled
UART: row of 4 unpopulated holes near USB port, starting count from
white triangle on PCB
1. VCC 3.3V, 2. GND, 3. TX, 4. RX
baud: 115200, parity: none, flow control: none
Installation
1. Connect to one of LAN (yellow) ethernet ports,
2. Open router configuration interface,
3. Go to Toolbox > Firmware,
4. Browse for OpenWrt factory image with dlf extension and hit Apply,
5. Wait few minutes, after the Power LED will stop blinking, the router
is ready for configuration.
Known issues
5GHz LED doesn't work
Additional information
When TX line on UART is connected, and board is switched on from power
off state, the DDR memory training may fail.
If connected to UART, when prompted for number on boot, one can enter
number 4 to open bootloader (U-Boot) command line.
OEM firmware shell password is: SitecomSenao
useful for creating backup of original firmware.
There is also another revision of this device (v1 001), which may or may
not work with introduced images.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
2019-10-15 12:56:12 +00:00
|
|
|
DEVICE_VENDOR := Sitecom
|
|
|
|
|
DEVICE_MODEL := WLR-7100
|
2020-01-14 16:40:04 +00:00
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct-smallbuffers kmod-usb2
|
ath79: add support for Sitecom WLR-7100
Sitecom WLR-7100 v1 002 (marketed as X7 AC1200) is a dual band wireless
router.
Specification
SoC: Atheros AR1022
RAM: 64 MB DDR2
Flash: 8 MB SPI NOR
WIFI: 2.4 GHz 2T2R integrated
5 GHz 2T2R QCA9882 integrated (connected to PCIe lane)
Ethernet: 5x 10/100/1000 Mbps QCA8337N
USB: 1x 2.0
LEDS: 4x GPIO controlled, 5x switch
Buttons: 2x GPIO controlled
UART: row of 4 unpopulated holes near USB port, starting count from
white triangle on PCB
1. VCC 3.3V, 2. GND, 3. TX, 4. RX
baud: 115200, parity: none, flow control: none
Installation
1. Connect to one of LAN (yellow) ethernet ports,
2. Open router configuration interface,
3. Go to Toolbox > Firmware,
4. Browse for OpenWrt factory image with dlf extension and hit Apply,
5. Wait few minutes, after the Power LED will stop blinking, the router
is ready for configuration.
Known issues
5GHz LED doesn't work
Additional information
When TX line on UART is connected, and board is switched on from power
off state, the DDR memory training may fail.
If connected to UART, when prompted for number on boot, one can enter
number 4 to open bootloader (U-Boot) command line.
OEM firmware shell password is: SitecomSenao
useful for creating backup of original firmware.
There is also another revision of this device (v1 001), which may or may
not work with introduced images.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
2019-10-15 12:56:12 +00:00
|
|
|
IMAGES += factory.dlf
|
|
|
|
|
IMAGE/factory.dlf := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
2020-03-10 13:58:27 +00:00
|
|
|
append-rootfs | pad-rootfs | check-size | \
|
ath79: add support for Sitecom WLR-7100
Sitecom WLR-7100 v1 002 (marketed as X7 AC1200) is a dual band wireless
router.
Specification
SoC: Atheros AR1022
RAM: 64 MB DDR2
Flash: 8 MB SPI NOR
WIFI: 2.4 GHz 2T2R integrated
5 GHz 2T2R QCA9882 integrated (connected to PCIe lane)
Ethernet: 5x 10/100/1000 Mbps QCA8337N
USB: 1x 2.0
LEDS: 4x GPIO controlled, 5x switch
Buttons: 2x GPIO controlled
UART: row of 4 unpopulated holes near USB port, starting count from
white triangle on PCB
1. VCC 3.3V, 2. GND, 3. TX, 4. RX
baud: 115200, parity: none, flow control: none
Installation
1. Connect to one of LAN (yellow) ethernet ports,
2. Open router configuration interface,
3. Go to Toolbox > Firmware,
4. Browse for OpenWrt factory image with dlf extension and hit Apply,
5. Wait few minutes, after the Power LED will stop blinking, the router
is ready for configuration.
Known issues
5GHz LED doesn't work
Additional information
When TX line on UART is connected, and board is switched on from power
off state, the DDR memory training may fail.
If connected to UART, when prompted for number on boot, one can enter
number 4 to open bootloader (U-Boot) command line.
OEM firmware shell password is: SitecomSenao
useful for creating backup of original firmware.
There is also another revision of this device (v1 001), which may or may
not work with introduced images.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
2019-10-15 12:56:12 +00:00
|
|
|
senao-header -r 0x222 -p 0x53 -t 2
|
|
|
|
|
IMAGE_SIZE := 7488k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += sitecom_wlr-7100
|
|
|
|
|
|
2019-11-04 17:05:38 +00:00
|
|
|
define Device/sitecom_wlr-8100
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := Sitecom
|
|
|
|
|
DEVICE_MODEL := WLR-8100
|
|
|
|
|
DEVICE_ALT0_VENDOR := Sitecom
|
|
|
|
|
DEVICE_ALT0_MODEL := X8 AC1750
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct kmod-usb2 kmod-usb3
|
|
|
|
|
SUPPORTED_DEVICES += wlr8100
|
|
|
|
|
IMAGES += factory.dlf
|
|
|
|
|
IMAGE/factory.dlf := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
2020-03-10 13:58:27 +00:00
|
|
|
append-rootfs | pad-rootfs | check-size | \
|
2019-11-04 17:05:38 +00:00
|
|
|
senao-header -r 0x222 -p 0x56 -t 2
|
|
|
|
|
IMAGE_SIZE := 15424k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += sitecom_wlr-8100
|
|
|
|
|
|
2022-06-22 20:56:29 +00:00
|
|
|
define Device/sophos_ap15
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := Sophos
|
|
|
|
|
DEVICE_MODEL := AP15
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += sophos_ap15
|
|
|
|
|
|
ath79: add support for Sophos AP100/AP55 family
The Sophos AP100, AP100C, AP55, and AP55C are dual-band 802.11ac access
points based on the Qualcomm QCA9558 SoC. They share PCB designs with
several devices that already have partial or full support, most notably the
Devolo DVL1750i/e.
The AP100 and AP100C are hardware-identical to the AP55 and AP55C, however
the 55 models' ART does not contain calibration data for their third chain
despite it being present on the PCB.
Specifications common to all models:
- Qualcomm QCA9558 SoC @ 720 MHz (MIPS 74Kc Big-endian processor)
- 128 MB RAM
- 16 MB SPI flash
- 1x 10/100/1000 Mbps Ethernet port, 802.3af PoE-in
- Green and Red status LEDs sharing a single external light-pipe
- Reset button on PCB[1]
- Piezo beeper on PCB[2]
- Serial UART header on PCB
- Alternate power supply via 5.5x2.1mm DC jack @ 12 VDC
Unique to AP100 and AP100C:
- 3T3R 2.4GHz 802.11b/g/n via SoC WMAC
- 3T3R 5.8GHz 802.11a/n/ac via QCA9880 (PCI Express)
AP55 and AP55C:
- 2T2R 2.4GHz 802.11b/g/n via SoC WMAC
- 2T2R 5.8GHz 802.11a/n/ac via QCA9880 (PCI Express)
AP100 and AP55:
- External RJ45 serial console port[3]
- USB 2.0 Type A port, power controlled via GPIO 11
Flashing instructions:
This firmware can be flashed either via a compatible Sophos SG or XG
firewall appliance, which does not require disassembling the device, or via
the U-Boot console available on the internal UART header.
To flash via XG appliance:
- Register on Sophos' website for a no-cost Home Use XG firewall license
- Download and install the XG software on a compatible PC or virtual
machine, complete initial appliance setup, and enable SSH console access
- Connect the target AP device to the XG appliance's LAN interface
- Approve the AP from the XG Web UI and wait until it shows as Active
(this can take 3-5 minutes)
- Connect to the XG appliance over SSH and access the Advanced Console
(Menu option 5, then menu option 3)
- Run `sudo awetool` and select the menu option to connect to an AP via
SSH. When prompted to enable SSH on the target AP, select Yes.
- Wait 2-3 minutes, then select the AP from the awetool menu again. This
will connect you to a root shell on the target AP.
- Copy the firmware to /tmp/openwrt.bin on the target AP via SCP/TFTP/etc
- Run `mtd -r write /tmp/openwrt.bin astaro_image`
- When complete, the access point will reboot to OpenWRT.
To flash via U-Boot serial console:
- Configure a TFTP server on your PC, and set IP address 192.168.99.8 with
netmask 255.255.255.0
- Copy the firmware .bin to the TFTP server and rename to 'uImage_AP100C'
- Open the target AP's enclosure and locate the 4-pin 3.3V UART header [4]
- Connect the AP ethernet to your PC's ethernet port
- Connect a terminal to the UART at 115200 8/N/1 as usual
- Power on the AP and press a key to cancel autoboot when prompted
- Run the following commands at the U-Boot console:
- `tftpboot`
- `cp.b $fileaddr 0x9f070000 $filesize`
- `boot`
- The access point will boot to OpenWRT.
MAC addresses as verified by OEM firmware:
use address source
LAN label config 0x201a (label)
2g label + 1 art 0x1002 (also found at config 0x2004)
5g label + 9 art 0x5006
Increments confirmed across three AP55C, two AP55, and one AP100C.
These changes have been tested to function on both current master and
21.02.0 without any obvious issues.
[1] Button is present but does not alter state of any GPIO on SoC
[2] Buzzer and driver circuitry is present on PCB but is not connected to
any GPIO. Shorting an unpopulated resistor next to the driver circuitry
should connect the buzzer to GPIO 4, but this is unconfirmed.
[3] This external RJ45 serial port is disabled in the OEM firmware, but
works in OpenWRT without additional configuration, at least on my
three test units.
[4] On AP100/AP55 models the UART header is accessible after removing
the device's top cover. On AP100C/AP55C models, the PCB must be removed
for access; three screws secure it to the case.
Pin 1 is marked on the silkscreen. Pins from 1-4 are 3.3V, GND, TX, RX
Signed-off-by: Andrew Powers-Holmes <andrew@omnom.net>
2021-09-03 13:53:57 +00:00
|
|
|
define Device/sophos_ap55
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := Sophos
|
|
|
|
|
DEVICE_MODEL := AP55
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct kmod-usb2
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += sophos_ap55
|
|
|
|
|
|
|
|
|
|
define Device/sophos_ap55c
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := Sophos
|
|
|
|
|
DEVICE_MODEL := AP55C
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += sophos_ap55c
|
|
|
|
|
|
|
|
|
|
define Device/sophos_ap100
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := Sophos
|
|
|
|
|
DEVICE_MODEL := AP100
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct kmod-usb2
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += sophos_ap100
|
|
|
|
|
|
|
|
|
|
define Device/sophos_ap100c
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := Sophos
|
|
|
|
|
DEVICE_MODEL := AP100C
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
|
|
|
|
IMAGE_SIZE := 15936k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += sophos_ap100c
|
|
|
|
|
|
2020-07-03 23:09:08 +00:00
|
|
|
define Device/telco_t1
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := Telco
|
|
|
|
|
DEVICE_MODEL := T1
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-net-qmi-wwan \
|
|
|
|
|
kmod-usb-serial-option uqmi -swconfig -uboot-envtools
|
|
|
|
|
IMAGE_SIZE := 16192k
|
|
|
|
|
SUPPORTED_DEVICES += telco_electronics,tel-t1
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += telco_t1
|
|
|
|
|
|
2021-06-21 21:27:56 +00:00
|
|
|
define Device/teltonika_rut230-v1
|
|
|
|
|
SOC := ar9331
|
|
|
|
|
DEVICE_VENDOR := Teltonika
|
|
|
|
|
DEVICE_MODEL := RUT230
|
|
|
|
|
DEVICE_VARIANT := v1
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb-chipidea2 kmod-usb-acm kmod-usb-net-qmi-wwan \
|
|
|
|
|
uqmi -uboot-envtools
|
|
|
|
|
IMAGE_SIZE := 15552k
|
|
|
|
|
TPLINK_HWID := 0x32200002
|
|
|
|
|
TPLINK_HWREV := 0x1
|
|
|
|
|
TPLINK_HEADER_VERSION := 1
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | teltonika-v1-header
|
|
|
|
|
KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | uImage lzma
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs |\
|
|
|
|
|
pad-rootfs | pad-extra 64 | teltonika-fw-fake-checksum 54 | check-size
|
|
|
|
|
IMAGE/sysupgrade.bin := append-kernel | pad-to $$$$(BLOCKSIZE) |\
|
|
|
|
|
append-rootfs | pad-rootfs | append-metadata |\
|
|
|
|
|
check-size
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += teltonika_rut230-v1
|
|
|
|
|
|
2022-11-10 14:16:32 +00:00
|
|
|
define Device/teltonika_rut300
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := Teltonika
|
|
|
|
|
DEVICE_MODEL := RUT300
|
|
|
|
|
SUPPORTED_TELTONIKA_DEVICES := teltonika,rut30x
|
2022-12-28 04:44:11 +00:00
|
|
|
DEVICE_PACKAGES := -kmod-ath9k -uboot-envtools -wpad-basic-mbedtls kmod-usb2
|
2022-11-10 14:16:32 +00:00
|
|
|
IMAGE_SIZE := 15552k
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin = append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | append-metadata-teltonika | \
|
|
|
|
|
check-size $$$$(IMAGE_SIZE)
|
|
|
|
|
IMAGE/sysupgrade.bin = append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | append-metadata | \
|
|
|
|
|
check-size $$$$(IMAGE_SIZE)
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += teltonika_rut300
|
|
|
|
|
|
2020-02-02 16:09:50 +00:00
|
|
|
define Device/teltonika_rut955
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_VENDOR := Teltonika
|
|
|
|
|
DEVICE_MODEL := RUT955
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-acm kmod-usb-net-qmi-wwan \
|
|
|
|
|
kmod-usb-serial-option kmod-hwmon-mcp3021 uqmi -uboot-envtools
|
|
|
|
|
IMAGE_SIZE := 15552k
|
|
|
|
|
TPLINK_HWID := 0x35000001
|
|
|
|
|
TPLINK_HWREV := 0x1
|
|
|
|
|
TPLINK_HEADER_VERSION := 1
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | tplink-v1-header
|
|
|
|
|
KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | uImage lzma
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs |\
|
2021-06-21 21:27:56 +00:00
|
|
|
pad-rootfs | teltonika-fw-fake-checksum 20 | append-string master |\
|
2020-03-10 13:58:27 +00:00
|
|
|
append-md5sum-bin | check-size
|
2020-02-02 16:09:50 +00:00
|
|
|
IMAGE/sysupgrade.bin := append-kernel | pad-to $$$$(BLOCKSIZE) |\
|
2021-06-20 16:54:36 +00:00
|
|
|
append-rootfs | pad-rootfs | check-size | append-metadata
|
2020-02-02 16:09:50 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += teltonika_rut955
|
|
|
|
|
|
ath79: add support for Teltonika RUT955 H7V3C0
This board was previously supported in ar71xx as 'RUT9XX'. The
difference between that and the other RUT955 board already supported in
ath79 is that instead of the SPI shift registers driving the LEDs and
digital outputs that model got an I2C GPIO expander instead.
To support LEDs during early boot and interrupt-driven digital inputs,
I2C support as well as support for PCA953x has to be built-in and
cannot be kernel modules, hence select those symbols for ath79/generic.
Specification:
- 550/400/200 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 4x 10/100 Mbps Ethernet, with passive PoE support on LAN1
- 2T2R 2,4 GHz (AR9344)
- built-in 4G/3G module (example: Quectel EC-25EU)
- internal microSD slot (spi-mmc, buggy and disabled for now)
- RS232 on D-Sub9 port (Cypress ACM via USB, /dev/ttyACM0)
- RS422/RS485 (AR934x high speed UART, /dev/ttyATH1)
- analog 0-24V input (MCP3221)
- various digital inputs and outputs incl. a relay
- 11x LED (4 are driven by AR9344, 7 by PCA9539)
- 2x miniSIM slot (can be swapped via GPIO)
- 2x RP-SMA/F (Wi-Fi), 3x SMA/F (2x WWAN, GPS)
- 1x button (reset)
- DC jack for main power input (9-30 V)
- debugging UART available on PCB edge connector
Serial console (/dev/ttyS0) pinout:
- RX: pin1 (square) on top side of the main PCB (AR9344 is on top)
- TX: pin1 (square) on bottom side
Flash instruction:
Vendor firmware is based on OpenWrt CC release. Use the "factory" image
directly in GUI (make sure to uncheck "keep settings") or in U-Boot web
based recovery. To avoid any problems, make sure to first update vendor
firmware to latest version - "factory" image was successfully tested on
device running "RUT9XX_R_00.06.051" firmware and U-Boot "3.0.1".
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2020-04-29 19:59:04 +00:00
|
|
|
define Device/teltonika_rut955-h7v3c0
|
|
|
|
|
$(Device/teltonika_rut955)
|
|
|
|
|
DEVICE_VARIANT := H7V3C0
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += teltonika_rut955-h7v3c0
|
|
|
|
|
|
2022-03-13 04:36:30 +00:00
|
|
|
define Device/trendnet_tew-673gru
|
|
|
|
|
SOC := ar7161
|
|
|
|
|
DEVICE_VENDOR := Trendnet
|
|
|
|
|
DEVICE_MODEL := TEW-673GRU
|
|
|
|
|
DEVICE_VARIANT := v1.0R
|
|
|
|
|
DEVICE_PACKAGES := -uboot-envtools kmod-usb-ohci kmod-usb2 \
|
|
|
|
|
kmod-owl-loader kmod-switch-rtl8366s
|
|
|
|
|
IMAGE_SIZE := 7808k
|
|
|
|
|
FACTORY_SIZE := 6144k
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin = append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | \
|
|
|
|
|
pad-rootfs | check-size $$$$(FACTORY_SIZE) | pad-to $$$$(FACTORY_SIZE) | \
|
|
|
|
|
append-string AP94-AR7161-RT-080619-01
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += trendnet_tew-673gru
|
|
|
|
|
|
2019-07-05 17:45:19 +00:00
|
|
|
define Device/trendnet_tew-823dru
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9558
|
2019-07-05 17:45:19 +00:00
|
|
|
DEVICE_VENDOR := Trendnet
|
|
|
|
|
DEVICE_MODEL := TEW-823DRU
|
|
|
|
|
DEVICE_VARIANT := v1.0R
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
2019-07-05 17:45:19 +00:00
|
|
|
SUPPORTED_DEVICES += tew-823dru
|
|
|
|
|
IMAGE_SIZE := 15296k
|
|
|
|
|
IMAGES := factory.bin sysupgrade.bin
|
2019-12-19 19:42:19 +00:00
|
|
|
IMAGE/default := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | \
|
|
|
|
|
pad-rootfs
|
2019-07-05 17:45:19 +00:00
|
|
|
IMAGE/factory.bin := $$(IMAGE/default) | pad-offset $$$$(IMAGE_SIZE) 26 | \
|
2020-03-10 13:58:27 +00:00
|
|
|
append-string 00AP135AR9558-RT-131129-00 | check-size
|
2021-06-20 16:54:36 +00:00
|
|
|
IMAGE/sysupgrade.bin := $$(IMAGE/default) | check-size | append-metadata
|
2019-07-05 17:45:19 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += trendnet_tew-823dru
|
|
|
|
|
|
2020-09-06 07:52:43 +00:00
|
|
|
define Device/wallys_dr531
|
|
|
|
|
SOC := qca9531
|
|
|
|
|
DEVICE_VENDOR := Wallys
|
|
|
|
|
DEVICE_MODEL := DR531
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 rssileds
|
|
|
|
|
IMAGE_SIZE := 7808k
|
|
|
|
|
SUPPORTED_DEVICES += dr531
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += wallys_dr531
|
|
|
|
|
|
ath79: add support for Senao Watchguard AP100
FCC ID: U2M-CAP2100AG
WatchGuard AP100 is an indoor wireless access point with
1 Gb ethernet port, dual-band but single-radio wireless,
internal antenna plates, and 802.3at PoE+
this board is a Senao device:
the hardware is equivalent to EnGenius EAP300 v2
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails
**Specification:**
- AR9344 SOC MIPS 74kc, 2.4 GHz AND 5 GHz WMAC, 2x2
- AR8035-A EPHY RGMII GbE with PoE+ IN
- 25 MHz clock
- 16 MB FLASH mx25l12805d
- 2x 64 MB RAM
- UART console J11, populated
- GPIO watchdog GPIO 16, 20 sec toggle
- 2 antennas 5 dBi, internal omni-directional plates
- 5 LEDs power, eth0 link/data, 2G, 5G
- 1 button reset
**MAC addresses:**
Label has no MAC
Only one Vendor MAC address in flash at art 0x0
eth0 ---- *:e5 art 0x0 -2
phy0 ---- *:e5 art 0x0 -2
**Installation:**
Method 1: OEM webpage
use OEM webpage for firmware upgrade to upload factory.bin
Method 2: root shell
It may be necessary to use a Watchguard router to flash the image to the AP
and / or to downgrade the software on the AP to access SSH
For some Watchguard devices, serial console over UART is disabled.
NOTE: DHCP is not enabled by default after flashing
**TFTP recovery:**
reset button has no function at boot time
only possible with modified uboot environment,
(see commit message for Watchguard AP300)
**Return to OEM:**
user should make backup of MTD partitions
and write the backups back to mtd devices
in order to revert to OEM reliably
It may be possible to use sysupgrade
with an OEM image as well...
(not tested)
**OEM upgrade info:**
The OEM upgrade script is at /etc/fwupgrade.sh
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
**Note on eth0 PLL-data:**
The default Ethernet Configuration register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For AR934x series, the PLL registers for eth0
can be see in the DTSI as 0x2c.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
The clock delay required for RGMII can be applied
at the PHY side, using the at803x driver `phy-mode`.
Therefore the PLL registers for GMAC0
do not need the bits for delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
**Note on WatchGuard Magic string:**
The OEM upgrade script is a modified version of
the generic Senao sysupgrade script
which is used on EnGenius devices.
On WatchGuard boards produced by Senao,
images are verified using a md5sum checksum of
the upgrade image concatenated with a magic string.
this checksum is then appended to the end of the final image.
This variable does not apply to all the senao devices
so set to null string as default
Tested-by: Steve Wheeler <stephenw10@gmail.com>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2021-11-02 17:41:41 +00:00
|
|
|
define Device/watchguard_ap100
|
|
|
|
|
$(Device/senao_loader_okli)
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_VENDOR := WatchGuard
|
|
|
|
|
DEVICE_MODEL := AP100
|
|
|
|
|
IMAGE_SIZE := 12096k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x220000
|
|
|
|
|
SENAO_IMGNAME := senao-ap100
|
|
|
|
|
WATCHGUARD_MAGIC := 82kdlzk2
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | pad-rootfs | \
|
|
|
|
|
check-size | senao-tar-gz $$$$(SENAO_IMGNAME) | watchguard-cksum $$$$(WATCHGUARD_MAGIC)
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += watchguard_ap100
|
|
|
|
|
|
ath79: add support for Senao WatchGuard AP200
FCC ID: U2M-CAP4200AG
WatchGuard AP200 is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
this board is a Senao device:
the hardware is equivalent to EnGenius EAP600
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails
**Specification:**
- AR9344 SOC MIPS 74kc, 2.4 GHz WMAC, 2x2
- AR9382 WLAN PCI card 168c:0030, 5 GHz, 2x2, 26dBm
- AR8035-A EPHY RGMII GbE with PoE+ IN
- 25 MHz clock
- 16 MB FLASH mx25l12805d
- 2x 64 MB RAM
- UART console J11, populated
- GPIO watchdog GPIO 16, 20 sec toggle
- 4 antennas 5 dBi, internal omni-directional plates
- 5 LEDs power, eth0 link/data, 2G, 5G
- 1 button reset
**MAC addresses:**
Label has no MAC
Only one Vendor MAC address in flash at art 0x0
eth0 ---- *:be art 0x0 -2
phy1 ---- *:bf art 0x0 -1
phy0 ---- *:be art 0x0 -2
**Installation:**
Method 1: OEM webpage
use OEM webpage for firmware upgrade to upload factory.bin
Method 2: root shell
It may be necessary to use a Watchguard router to flash the image to the AP
and / or to downgrade the software on the AP to access SSH
For some Watchguard devices, serial console over UART is disabled.
NOTE: DHCP is not enabled by default after flashing
**TFTP recovery:**
reset button has no function at boot time
only possible with modified uboot environment,
(see commit message for Watchguard AP300)
**Return to OEM:**
user should make backup of MTD partitions
and write the backups back to mtd devices
in order to revert to OEM reliably
It may be possible to use sysupgrade
with an OEM image as well...
(not tested)
**OEM upgrade info:**
The OEM upgrade script is at /etc/fwupgrade.sh
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
**Note on eth0 PLL-data:**
The default Ethernet Configuration register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For AR934x series, the PLL registers for eth0
can be see in the DTSI as 0x2c.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
The clock delay required for RGMII can be applied
at the PHY side, using the at803x driver `phy-mode`.
Therefore the PLL registers for GMAC0
do not need the bits for delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
**Note on WatchGuard Magic string:**
The OEM upgrade script is a modified version of
the generic Senao sysupgrade script
which is used on EnGenius devices.
On WatchGuard boards produced by Senao,
images are verified using a md5sum checksum of
the upgrade image concatenated with a magic string.
this checksum is then appended to the end of the final image.
This variable does not apply to all the senao devices
so set to null string as default
Tested-by: Steve Wheeler <stephenw10@gmail.com>
Tested-by: John Delaney <johnd@ankco.net>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2021-06-12 19:08:18 +00:00
|
|
|
define Device/watchguard_ap200
|
|
|
|
|
$(Device/senao_loader_okli)
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_VENDOR := WatchGuard
|
|
|
|
|
DEVICE_MODEL := AP200
|
|
|
|
|
IMAGE_SIZE := 12096k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x220000
|
|
|
|
|
SENAO_IMGNAME := senao-ap200
|
|
|
|
|
WATCHGUARD_MAGIC := 82kdlzk2
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | pad-rootfs | \
|
|
|
|
|
check-size | senao-tar-gz $$$$(SENAO_IMGNAME) | watchguard-cksum $$$$(WATCHGUARD_MAGIC)
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += watchguard_ap200
|
|
|
|
|
|
ath79: add support for Senao WatchGuard AP300
FCC ID: Q6G-AP300
WatchGuard AP300 is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
this board is a Senao device:
the hardware is equivalent to EnGenius EAP1750
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails
**Specification:**
- QCA9558 SOC MIPS 74kc, 2.4 GHz WMAC, 3x3
- QCA9880 WLAN PCI card 168c:003c, 5 GHz, 3x3, 26dBm
- AR8035-A PHY RGMII GbE with PoE+ IN
- 40 MHz clock
- 32 MB FLASH S25FL512S
- 2x 64 MB RAM NT5TU32M16
- UART console J10, populated
- GPIO watchdog GPIO 16, 20 sec toggle
- 6 antennas 5 dBi, internal omni-directional plates
- 5 LEDs power, eth0 link/data, 2G, 5G
- 1 button reset
**MAC addresses:**
MAC address labeled as ETH
Only one Vendor MAC address in flash at art 0x0
eth0 ETH *:3c art 0x0
phy1 ---- *:3d ---
phy0 ---- *:3e ---
**Serial console access:**
For this board, its not certain whether UART is possible
it is likely that software is blocking console access
the RX line on the board for UART is shorted to ground by resistor R176
the resistors R175 and R176 are next to the UART RX pin at J10
however console output is garbage even after this fix
**Installation:**
Method 1: OEM webpage
use OEM webpage for firmware upgrade to upload factory.bin
Method 2: root shell access
downgrade XTM firewall to v2.0.0.1
downgrade AP300 firmware: v1.0.1
remove / unpair AP from controller
perform factory reset with reset button
connect ethernet to a computer
login to OEM webpage with default address / pass: wgwap
enable SSHD in OEM webpage settings
access root shell with SSH as user 'root'
modify uboot environment to automatically try TFTP at boot time
(see command below)
rename initramfs-kernel.bin to test.bin
load test.bin over TFTP (see TFTP recovery)
(optionally backup all mtdblocks to have flash backup)
perform a sysupgrade with sysupgrade.bin
NOTE: DHCP is not enabled by default after flashing
**TFTP recovery:**
server ip: 192.168.1.101
reset button seems to do nothing at boot time...
only possible with modified uboot environment,
running this command in the root shell:
fw_setenv bootcmd 'if ping 192.168.1.101; then tftp 0x82000000 test.bin && bootm 0x82000000; else bootm 0x9f0a0000; fi'
and verify that it is correct with
fw_printenv
then, before boot, the device will attempt TFTP from 192.168.1.101
looking for file 'test.bin'
to return uboot environment to normal:
fw_setenv bootcmd 'bootm 0x9f0a0000'
**Return to OEM:**
user should make backup of MTD partitions
and write the backups back to mtd devices
in order to revert to OEM
(see installation method 2)
It may be possible to use sysupgrade
with an OEM image as well...
(not tested)
**OEM upgrade info:**
The OEM upgrade script is at /etc/fwupgrade.sh
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
**Note on eth0 PLL-data:**
The default Ethernet Configuration register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied
at the PHY side, using the at803x driver `phy-mode`.
Therefore the PLL registers for GMAC0
do not need the bits for delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
**Note on WatchGuard Magic string:**
The OEM upgrade script is a modified version of
the generic Senao sysupgrade script
which is used on EnGenius devices.
On WatchGuard boards produced by Senao,
images are verified using a md5sum checksum of
the upgrade image concatenated with a magic string.
this checksum is then appended to the end of the final image.
This variable does not apply to all the senao devices
so set to null string as default
Tested-by: Alessandro Kornowski <ak@wski.org>
Tested-by: John Wagner <john@wagner.us.org>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2021-02-11 04:28:49 +00:00
|
|
|
define Device/watchguard_ap300
|
|
|
|
|
$(Device/senao_loader_okli)
|
|
|
|
|
SOC := qca9558
|
|
|
|
|
DEVICE_VENDOR := WatchGuard
|
|
|
|
|
DEVICE_MODEL := AP300
|
|
|
|
|
DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
|
|
|
|
|
IMAGE_SIZE := 11584k
|
|
|
|
|
LOADER_FLASH_OFFS := 0x220000
|
|
|
|
|
SENAO_IMGNAME := senao-ap300
|
|
|
|
|
WATCHGUARD_MAGIC := 82kdlzk2
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | pad-rootfs | \
|
|
|
|
|
check-size | senao-tar-gz $$$$(SENAO_IMGNAME) | watchguard-cksum $$$$(WATCHGUARD_MAGIC)
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += watchguard_ap300
|
|
|
|
|
|
2021-11-16 11:25:19 +00:00
|
|
|
define Device/wd_mynet-n600
|
|
|
|
|
$(Device/seama)
|
|
|
|
|
SOC := ar9344
|
|
|
|
|
DEVICE_VENDOR := Western Digital
|
|
|
|
|
DEVICE_MODEL := My Net N600
|
|
|
|
|
IMAGE_SIZE := 15872k
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
|
|
|
|
SEAMA_SIGNATURE := wrgnd16_wd_db600
|
|
|
|
|
SUPPORTED_DEVICES += mynet-n600
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += wd_mynet-n600
|
|
|
|
|
|
2019-05-25 12:36:05 +00:00
|
|
|
define Device/wd_mynet-n750
|
|
|
|
|
$(Device/seama)
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9344
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := Western Digital
|
|
|
|
|
DEVICE_MODEL := My Net N750
|
2019-05-25 12:36:05 +00:00
|
|
|
IMAGE_SIZE := 15872k
|
2019-09-22 10:06:25 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2
|
2019-05-25 12:36:05 +00:00
|
|
|
SEAMA_SIGNATURE := wrgnd13_wd_av
|
|
|
|
|
SUPPORTED_DEVICES += mynet-n750
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += wd_mynet-n750
|
|
|
|
|
|
2018-09-04 21:27:02 +00:00
|
|
|
define Device/wd_mynet-wifi-rangeextender
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9344
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := Western Digital
|
|
|
|
|
DEVICE_MODEL := My Net Wi-Fi Range Extender
|
2018-09-04 21:27:02 +00:00
|
|
|
DEVICE_PACKAGES := rssileds nvram -swconfig
|
|
|
|
|
IMAGE_SIZE := 7808k
|
|
|
|
|
ADDPATTERN_ID := mynet-rext
|
|
|
|
|
ADDPATTERN_VERSION := 1.00.01
|
|
|
|
|
IMAGE/sysupgrade.bin := append-rootfs | pad-rootfs | cybertan-trx | \
|
|
|
|
|
addpattern | append-metadata
|
|
|
|
|
SUPPORTED_DEVICES += mynet-rext
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += wd_mynet-wifi-rangeextender
|
2018-10-30 16:05:43 +00:00
|
|
|
|
|
|
|
|
define Device/winchannel_wb2000
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9344
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := Winchannel
|
|
|
|
|
DEVICE_MODEL := WB2000
|
2018-10-30 16:05:43 +00:00
|
|
|
IMAGE_SIZE := 15872k
|
2020-03-05 14:42:18 +00:00
|
|
|
DEVICE_PACKAGES := kmod-i2c-gpio kmod-rtc-ds1307 kmod-usb2 \
|
2019-12-19 19:42:19 +00:00
|
|
|
kmod-usb-ledtrig-usbport
|
2018-10-30 16:05:43 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += winchannel_wb2000
|
2019-02-01 19:48:41 +00:00
|
|
|
|
ath79: add support for Xiaomi AIoT Router AC2350
Device specifications
* SoC: QCA9563 @ 775MHz (MIPS 74Kc)
* RAM: 128MiB DDR2
* Flash: 16MiB SPI-NOR (EN25QH128)
* Wireless 2.4GHz (SoC): b/g/n, 3x3
* Wireless 5Ghz (QCA9988): a/n/ac, 4x4 MU-MIMO
* IoT Wireless 2.4GHz (QCA6006): currently unusable
* Ethernet (AR8327): 3 LAN × 1GbE, 1 WAN × 1GbE
* LEDs: Internet (blue/orange), System (blue/orange)
* Buttons: Reset
* UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1)
* Power: 12VDC, 1,5A
MAC addresses map (like in OEM firmware)
art@0x0 88:C3:97:*:57 wan/label
art@0x1002 88:C3:97:*:2D lan/wlan2g
art@0x5006 88:C3:97:*:2C wlan5g
Obtain SSH Access
1. Download and flash the firmware version 1.3.8 (China).
2. Login to the router web interface and get the value of `stok=` from the
URL
3. Open a new tab and go to the following URL (replace <STOK> with the stok
value gained above; line breaks are only for easier handling, please put
together all four lines into a single URL without any spaces):
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev
?bssid=any&user_id=any&ssid=-h%0Anvram%20set%20ssh_en%3D1%0Anvram%20commit
%0Ased%20-i%20%27s%2Fchannel%3D.%2A%2Fchannel%3D%5C%5C%22debug%5C%5C%22%2F
g%27%20%2Fetc%2Finit.d%2Fdropbear%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A
4. Wait 30-60 seconds (this is the time required to generate keys for the
SSH server on the router).
Create Full Backup
1. Obtain SSH Access.
2. Create backup of all flash (on router):
dd if=/dev/mtd0 of=/tmp/ALL.backup
3. Copy backup to PC (on PC):
scp root@192.168.31.1:/tmp/ALL.backup ./
Tip: backup of the original firmware, taken three times, increases the
chances of recovery :)
Calculate The Password
* Locally using shell (replace "12345/E0QM98765" with your router's serial
number):
On Linux
printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | \
md5sum - | head -c8 && echo
On macOS
printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | \
md5 | head -c8
* Locally using python script (replace "12345/E0QM98765" with your
router's serial number):
wget https://raw.githubusercontent.com/eisaev/ax3600-files/master/scripts/calc_passwd.py
python3.7 -c 'from calc_passwd import calc_passwd; print(calc_passwd("12345/E0QM98765"))'
* Online
https://www.oxygen7.cn/miwifi/
Debricking (lite)
If you have a healthy bootloader, you can use recovery via TFTP using
programs like TinyPXE on Windows or dnsmasq on Linux. To switch the router
to TFTP recovery mode, hold down the reset button, connect the power
supply, and release the button after about 10 seconds. The router must be
connected directly to the PC via the LAN port.
Debricking
You will need a full dump of your flash, a CH341 programmer, and a clip
for in-circuit programming.
Install OpenWRT
1. Obtain SSH Access.
2. Create script (on router):
echo '#!/bin/sh' > /tmp/flash_fw.sh
echo >> /tmp/flash_fw.sh
echo '. /bin/boardupgrade.sh' >> /tmp/flash_fw.sh
echo >> /tmp/flash_fw.sh
echo 'board_prepare_upgrade' >> /tmp/flash_fw.sh
echo 'mtd erase rootfs_data' >> /tmp/flash_fw.sh
echo 'mtd write /tmp/openwrt.bin firmware' >> /tmp/flash_fw.sh
echo 'sleep 3' >> /tmp/flash_fw.sh
echo 'reboot' >> /tmp/flash_fw.sh
echo >> /tmp/flash_fw.sh
chmod +x /tmp/flash_fw.sh
3. Copy `openwrt-ath79-generic-xiaomi_aiot-ac2350-squashfs-sysupgrade.bin`
to the router (on PC):
scp openwrt-ath79-generic-xiaomi_aiot-ac2350-squashfs-sysupgrade.bin \
root@192.168.31.1:/tmp/openwrt.bin
4. Flash OpenWRT (on router):
/bin/ash /tmp/flash_fw.sh &
5. SSH connection will be interrupted - this is normal.
6. Wait for the indicator to turn blue.
Signed-off-by: Evgeniy Isaev <isaev.evgeniy@gmail.com>
[improve commit message formatting slightly]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-05-11 08:45:51 +00:00
|
|
|
define Device/xiaomi_aiot-ac2350
|
|
|
|
|
SOC := qca9563
|
|
|
|
|
DEVICE_VENDOR := Xiaomi
|
|
|
|
|
DEVICE_MODEL := AIoT AC2350
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9984-ct
|
|
|
|
|
IMAGE_SIZE := 14336k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += xiaomi_aiot-ac2350
|
|
|
|
|
|
2019-02-01 19:48:41 +00:00
|
|
|
define Device/xiaomi_mi-router-4q
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9561
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := Xiaomi
|
|
|
|
|
DEVICE_MODEL := Mi Router 4Q
|
2019-02-01 19:48:41 +00:00
|
|
|
IMAGE_SIZE := 14336k
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += xiaomi_mi-router-4q
|
ath79: add support for YunCore A770
YunCore A770 is a ceiling AC750 AP with 2 Fast Ethernet ports, PoE
(802.3at) support, based on QCA9531 + QCA9887.
Specification:
- 650/597/216 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x 10/100 Mbps Ethernet (PoE 802.3at support in WAN port)
- 2T2R 2.4 GHz (QCA9531), with ext. PA and LNA
- 1T1R 5 GHz (QCA9887), with ext. FEM (SKY85728-11)
- 2x regular LED, 1x RGB LED (all driven by GPIO)
- 1x button (reset)
- DC jack for main power input (12 V)
- UART header on PCB
Flash instruction:
1. First, gain root access to the device, following below steps:
- Login into web gui (default password/IP: admin/192.168.188.253).
- Go to 'Advanced' -> 'Management' -> 'System' and download backup of
configuration (bakfile.bin).
- Open the file as tar.gz archive, edit/update 'shadow' file and change
hash of root password to something known.
- Repack the archive, rename it back to 'bakfile.bin' and use to
restore configuration of the device.
- After that, device will reboot and can be accessed over SSH.
2. Then, install OpenWrt:
- Login over SSH and issue command:
fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
- Upload 'sysupgrade' image and install it (only if previous command
succeeded) with command: 'sysupgrade -n -F openwrt-...'.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2019-03-09 15:31:17 +00:00
|
|
|
|
|
|
|
|
define Device/yuncore_a770
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9531
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := YunCore
|
|
|
|
|
DEVICE_MODEL := A770
|
ath79: add support for YunCore A770
YunCore A770 is a ceiling AC750 AP with 2 Fast Ethernet ports, PoE
(802.3at) support, based on QCA9531 + QCA9887.
Specification:
- 650/597/216 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x 10/100 Mbps Ethernet (PoE 802.3at support in WAN port)
- 2T2R 2.4 GHz (QCA9531), with ext. PA and LNA
- 1T1R 5 GHz (QCA9887), with ext. FEM (SKY85728-11)
- 2x regular LED, 1x RGB LED (all driven by GPIO)
- 1x button (reset)
- DC jack for main power input (12 V)
- UART header on PCB
Flash instruction:
1. First, gain root access to the device, following below steps:
- Login into web gui (default password/IP: admin/192.168.188.253).
- Go to 'Advanced' -> 'Management' -> 'System' and download backup of
configuration (bakfile.bin).
- Open the file as tar.gz archive, edit/update 'shadow' file and change
hash of root password to something known.
- Repack the archive, rename it back to 'bakfile.bin' and use to
restore configuration of the device.
- After that, device will reboot and can be accessed over SSH.
2. Then, install OpenWrt:
- Login over SSH and issue command:
fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
- Upload 'sysupgrade' image and install it (only if previous command
succeeded) with command: 'sysupgrade -n -F openwrt-...'.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2019-03-09 15:31:17 +00:00
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9887-ct
|
|
|
|
|
IMAGE_SIZE := 16000k
|
2019-08-12 23:26:45 +00:00
|
|
|
IMAGES += tftp.bin
|
|
|
|
|
IMAGE/tftp.bin := $$(IMAGE/sysupgrade.bin) | yuncore-tftp-header-16m
|
ath79: add support for YunCore A770
YunCore A770 is a ceiling AC750 AP with 2 Fast Ethernet ports, PoE
(802.3at) support, based on QCA9531 + QCA9887.
Specification:
- 650/597/216 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x 10/100 Mbps Ethernet (PoE 802.3at support in WAN port)
- 2T2R 2.4 GHz (QCA9531), with ext. PA and LNA
- 1T1R 5 GHz (QCA9887), with ext. FEM (SKY85728-11)
- 2x regular LED, 1x RGB LED (all driven by GPIO)
- 1x button (reset)
- DC jack for main power input (12 V)
- UART header on PCB
Flash instruction:
1. First, gain root access to the device, following below steps:
- Login into web gui (default password/IP: admin/192.168.188.253).
- Go to 'Advanced' -> 'Management' -> 'System' and download backup of
configuration (bakfile.bin).
- Open the file as tar.gz archive, edit/update 'shadow' file and change
hash of root password to something known.
- Repack the archive, rename it back to 'bakfile.bin' and use to
restore configuration of the device.
- After that, device will reboot and can be accessed over SSH.
2. Then, install OpenWrt:
- Login over SSH and issue command:
fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
- Upload 'sysupgrade' image and install it (only if previous command
succeeded) with command: 'sysupgrade -n -F openwrt-...'.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2019-03-09 15:31:17 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += yuncore_a770
|
ath79: Add support for ZBT-WD323
ZBT-WD323 is a dual-LTE router based on AR9344. The detailed
specifications are:
* AR9344 560MHz/450MHz/225MHz (CPU/DDR/AHN).
* 128 MB RAM
* 16MB of flash(SPI-NOR, 22MHz)
* 1x 2.4GHz wifi (Atheros AR9340)
* 3x 10/100Mbos Ethernet (AR8229)
* 1x USB2.0 port
* 2x miniPCIe-slots (USB2.0 only)
* 2x SIM slots (standard size)
* 4x LEDs (1 gpio controlled)
* 1x reset button
* 1x 10 pin terminal block (RS232, RS485, 4x GPIO)
* 2x CP210x UART bridge controllers (used for RS232 and RS485)
* 1x 2 pin 5mm industrial interface (input voltage 12V~36V)
* 1x DC jack
* 1x RTC (PCF8563)
Tested:
- Ethernet switch
- Wifi
- USB port
- MiniPCIe-slots (+ SIM slots)
- Sysupgrade
- Reset button
- RS232
Intallation and recovery:
The board ships with OpenWRT, but sysupgrade does not work as a
different firmware format than what is expected is generated. The
easiest way to install (and recover) the router, is to use the
web-interface provided by the bootloader (Breed).
While the interface is in Chinese, it is easy to use. First, in order to
access the interface, you need to hold down the reset button for around
five seconds. Then, go to 192.168.1.1 in your browser. Click on the
second item in the list on the left to access the recovery page. The
second item on the next page is where you select the firmware. Select
the menu item containing "Atheros SDK" and "16MB" in the dropdown close
to the buttom, and click on the button at the bottom to start
installation/recovery.
Notes:
* RS232 is available on /dev/ttyUSB0 and RS485 on /dev/ttyUSB1
Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
[removed unused poll-interval from gpio-keys, i2c-gpio 4.19 compat]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2019-05-31 13:43:14 +00:00
|
|
|
|
ath79: add support for YunCore XD4200 and A782
YunCore XD4200 ('XD4200_W6.0' marking on PCB) is Qualcomm/Atheros based
(QCA9563, QCA9886, QCA8334) dual-band, Wave-2 AC1200 ceiling AP with PoE
(802.3at) support. A782 model ('T750_V5.1' marking on PCB) is a smaller
version of the XD4200, with similar specification but lower TX power.
Specification:
- QCA9563 (775 MHz)
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 2x 10/100/1000 Mbps Ethernet (QCA8334), with 802.3at PoE support (WAN)
- Wi-Fi 2.4 GHz:
- XD4200: 2T2R (QCA9563), with ext. PA (SKY65174-21) and LNA
- A782: 2T2R (QCA9563), with ext. FEM (SKY85329-11)
- Wi-Fi 5 GHz:
- XD4200: 2T2R (QCA9886), with ext. FEM (SKY85728-11)
- A782: 2T2R (QCA9886), with ext. FEM (SKY85735-11)
- LEDs:
- XD4200: 5x (2x driven by SOC, 1x driven by AC radio, 2x Ethernet)
- A782: 3x (1x RGB, driven by SOC and radio, 2x Ethernet)
- 1x button (reset)
- 1x UART (4-pin, 2.54 mm pitch) header on PCB
- 1x DC jack (12 V)
Flash instructions:
If your device comes with generic QSDK based firmware, you can login
over telnet (login: root, empty password, default IP: 192.168.188.253),
issue first (important!) 'fw_setenv' command and then perform regular
upgrade, using 'sysupgrade -n -F ...' (you can use 'wget' to download
image to the device, SSH server is not available):
fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
sysupgrade -n -F openwrt-...-yuncore_...-squashfs-sysupgrade.bin
In case your device runs firmware with YunCore custom GUI, you can use
U-Boot recovery mode:
1. Set a static IP 192.168.0.141/24 on PC and start TFTP server with
'tftp' image renamed to 'upgrade.bin'
2. Power the device with reset button pressed and release it after 5-7
seconds, recovery mode should start downloading image from server
(unfortunately, there is no visible indication that recovery got
enabled - in case of problems check TFTP server logs)
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2019-11-12 21:36:28 +00:00
|
|
|
define Device/yuncore_a782
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9563
|
ath79: add support for YunCore XD4200 and A782
YunCore XD4200 ('XD4200_W6.0' marking on PCB) is Qualcomm/Atheros based
(QCA9563, QCA9886, QCA8334) dual-band, Wave-2 AC1200 ceiling AP with PoE
(802.3at) support. A782 model ('T750_V5.1' marking on PCB) is a smaller
version of the XD4200, with similar specification but lower TX power.
Specification:
- QCA9563 (775 MHz)
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 2x 10/100/1000 Mbps Ethernet (QCA8334), with 802.3at PoE support (WAN)
- Wi-Fi 2.4 GHz:
- XD4200: 2T2R (QCA9563), with ext. PA (SKY65174-21) and LNA
- A782: 2T2R (QCA9563), with ext. FEM (SKY85329-11)
- Wi-Fi 5 GHz:
- XD4200: 2T2R (QCA9886), with ext. FEM (SKY85728-11)
- A782: 2T2R (QCA9886), with ext. FEM (SKY85735-11)
- LEDs:
- XD4200: 5x (2x driven by SOC, 1x driven by AC radio, 2x Ethernet)
- A782: 3x (1x RGB, driven by SOC and radio, 2x Ethernet)
- 1x button (reset)
- 1x UART (4-pin, 2.54 mm pitch) header on PCB
- 1x DC jack (12 V)
Flash instructions:
If your device comes with generic QSDK based firmware, you can login
over telnet (login: root, empty password, default IP: 192.168.188.253),
issue first (important!) 'fw_setenv' command and then perform regular
upgrade, using 'sysupgrade -n -F ...' (you can use 'wget' to download
image to the device, SSH server is not available):
fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
sysupgrade -n -F openwrt-...-yuncore_...-squashfs-sysupgrade.bin
In case your device runs firmware with YunCore custom GUI, you can use
U-Boot recovery mode:
1. Set a static IP 192.168.0.141/24 on PC and start TFTP server with
'tftp' image renamed to 'upgrade.bin'
2. Power the device with reset button pressed and release it after 5-7
seconds, recovery mode should start downloading image from server
(unfortunately, there is no visible indication that recovery got
enabled - in case of problems check TFTP server logs)
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2019-11-12 21:36:28 +00:00
|
|
|
DEVICE_VENDOR := YunCore
|
|
|
|
|
DEVICE_MODEL := A782
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
IMAGES += tftp.bin
|
|
|
|
|
IMAGE/tftp.bin := $$(IMAGE/sysupgrade.bin) | yuncore-tftp-header-16m
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += yuncore_a782
|
|
|
|
|
|
ath79: add support for Yuncore A930
Specification:
- QCA9533 (650 MHz), 64 or 128MB RAM, 16MB SPI NOR
- 2x 10/100 Mbps Ethernet, with 802.3at PoE support (WAN)
- 2T2R 802.11b/g/n 2.4GHz
Flash instructions:
If your device comes with generic QSDK based firmware, you can login
over telnet (login: root, empty password, default IP: 192.168.188.253),
issue first (important!) 'fw_setenv' command and then perform regular
upgrade, using 'sysupgrade -n -F ...' (you can use 'wget' to download
image to the device, SSH server is not available):
fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
sysupgrade -n -F openwrt-...-yuncore_...-squashfs-sysupgrade.bin
In case your device runs firmware with YunCore custom GUI, you can use
U-Boot recovery mode:
1. Set a static IP 192.168.0.141/24 on PC and start TFTP server with
'tftp' image renamed to 'upgrade.bin'
2. Power the device with reset button pressed and release it after 5-7
seconds, recovery mode should start downloading image from server
(unfortunately, there is no visible indication that recovery got
enabled - in case of problems check TFTP server logs)
Signed-off-by: Clemens Hopfer <openwrt@wireloss.net>
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
2022-04-14 10:39:05 +00:00
|
|
|
define Device/yuncore_a930
|
|
|
|
|
SOC := qca9533
|
|
|
|
|
DEVICE_VENDOR := YunCore
|
|
|
|
|
DEVICE_MODEL := A930
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
IMAGES += tftp.bin
|
|
|
|
|
IMAGE/tftp.bin := $$(IMAGE/sysupgrade.bin) | yuncore-tftp-header-16m
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += yuncore_a930
|
|
|
|
|
|
ath79: add support for Yuncore XD3200
Specification:
- QCA9563 (775MHz), 128MB RAM, 16MB SPI NOR
- 2T2R 802.11b/g/n 2.4GHz
- 2T2R 802.11n/ac 5GHz
- 2x 10/100/1000 Mbps Ethernet, with 802.3at PoE support (WAN port)
LED for 5 GHz WLAN is currently not supported as it is connected directly
to the QCA9882 radio chip.
Flash instructions:
If your device comes with generic QSDK based firmware, you can login
over telnet (login: root, empty password, default IP: 192.168.188.253),
issue first (important!) 'fw_setenv' command and then perform regular
upgrade, using 'sysupgrade -n -F ...' (you can use 'wget' to download
image to the device, SSH server is not available):
fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
sysupgrade -n -F openwrt-...-yuncore_...-squashfs-sysupgrade.bin
In case your device runs firmware with YunCore custom GUI, you can use
U-Boot recovery mode:
1. Set a static IP 192.168.0.141/24 on PC and start TFTP server with
'tftp' image renamed to 'upgrade.bin'
2. Power the device with reset button pressed and release it after 5-7
seconds, recovery mode should start downloading image from server
(unfortunately, there is no visible indication that recovery got
enabled - in case of problems check TFTP server logs)
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
2022-04-14 10:39:03 +00:00
|
|
|
define Device/yuncore_xd3200
|
|
|
|
|
SOC := qca9563
|
|
|
|
|
DEVICE_VENDOR := YunCore
|
|
|
|
|
DEVICE_MODEL := XD3200
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
IMAGES += tftp.bin
|
|
|
|
|
IMAGE/tftp.bin := $$(IMAGE/sysupgrade.bin) | yuncore-tftp-header-16m
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += yuncore_xd3200
|
|
|
|
|
|
ath79: add support for YunCore XD4200 and A782
YunCore XD4200 ('XD4200_W6.0' marking on PCB) is Qualcomm/Atheros based
(QCA9563, QCA9886, QCA8334) dual-band, Wave-2 AC1200 ceiling AP with PoE
(802.3at) support. A782 model ('T750_V5.1' marking on PCB) is a smaller
version of the XD4200, with similar specification but lower TX power.
Specification:
- QCA9563 (775 MHz)
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 2x 10/100/1000 Mbps Ethernet (QCA8334), with 802.3at PoE support (WAN)
- Wi-Fi 2.4 GHz:
- XD4200: 2T2R (QCA9563), with ext. PA (SKY65174-21) and LNA
- A782: 2T2R (QCA9563), with ext. FEM (SKY85329-11)
- Wi-Fi 5 GHz:
- XD4200: 2T2R (QCA9886), with ext. FEM (SKY85728-11)
- A782: 2T2R (QCA9886), with ext. FEM (SKY85735-11)
- LEDs:
- XD4200: 5x (2x driven by SOC, 1x driven by AC radio, 2x Ethernet)
- A782: 3x (1x RGB, driven by SOC and radio, 2x Ethernet)
- 1x button (reset)
- 1x UART (4-pin, 2.54 mm pitch) header on PCB
- 1x DC jack (12 V)
Flash instructions:
If your device comes with generic QSDK based firmware, you can login
over telnet (login: root, empty password, default IP: 192.168.188.253),
issue first (important!) 'fw_setenv' command and then perform regular
upgrade, using 'sysupgrade -n -F ...' (you can use 'wget' to download
image to the device, SSH server is not available):
fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
sysupgrade -n -F openwrt-...-yuncore_...-squashfs-sysupgrade.bin
In case your device runs firmware with YunCore custom GUI, you can use
U-Boot recovery mode:
1. Set a static IP 192.168.0.141/24 on PC and start TFTP server with
'tftp' image renamed to 'upgrade.bin'
2. Power the device with reset button pressed and release it after 5-7
seconds, recovery mode should start downloading image from server
(unfortunately, there is no visible indication that recovery got
enabled - in case of problems check TFTP server logs)
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2019-11-12 21:36:28 +00:00
|
|
|
define Device/yuncore_xd4200
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := qca9563
|
ath79: add support for YunCore XD4200 and A782
YunCore XD4200 ('XD4200_W6.0' marking on PCB) is Qualcomm/Atheros based
(QCA9563, QCA9886, QCA8334) dual-band, Wave-2 AC1200 ceiling AP with PoE
(802.3at) support. A782 model ('T750_V5.1' marking on PCB) is a smaller
version of the XD4200, with similar specification but lower TX power.
Specification:
- QCA9563 (775 MHz)
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 2x 10/100/1000 Mbps Ethernet (QCA8334), with 802.3at PoE support (WAN)
- Wi-Fi 2.4 GHz:
- XD4200: 2T2R (QCA9563), with ext. PA (SKY65174-21) and LNA
- A782: 2T2R (QCA9563), with ext. FEM (SKY85329-11)
- Wi-Fi 5 GHz:
- XD4200: 2T2R (QCA9886), with ext. FEM (SKY85728-11)
- A782: 2T2R (QCA9886), with ext. FEM (SKY85735-11)
- LEDs:
- XD4200: 5x (2x driven by SOC, 1x driven by AC radio, 2x Ethernet)
- A782: 3x (1x RGB, driven by SOC and radio, 2x Ethernet)
- 1x button (reset)
- 1x UART (4-pin, 2.54 mm pitch) header on PCB
- 1x DC jack (12 V)
Flash instructions:
If your device comes with generic QSDK based firmware, you can login
over telnet (login: root, empty password, default IP: 192.168.188.253),
issue first (important!) 'fw_setenv' command and then perform regular
upgrade, using 'sysupgrade -n -F ...' (you can use 'wget' to download
image to the device, SSH server is not available):
fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
sysupgrade -n -F openwrt-...-yuncore_...-squashfs-sysupgrade.bin
In case your device runs firmware with YunCore custom GUI, you can use
U-Boot recovery mode:
1. Set a static IP 192.168.0.141/24 on PC and start TFTP server with
'tftp' image renamed to 'upgrade.bin'
2. Power the device with reset button pressed and release it after 5-7
seconds, recovery mode should start downloading image from server
(unfortunately, there is no visible indication that recovery got
enabled - in case of problems check TFTP server logs)
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2019-11-12 21:36:28 +00:00
|
|
|
DEVICE_VENDOR := YunCore
|
|
|
|
|
DEVICE_MODEL := XD4200
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct
|
|
|
|
|
IMAGE_SIZE := 16000k
|
|
|
|
|
IMAGES += tftp.bin
|
|
|
|
|
IMAGE/tftp.bin := $$(IMAGE/sysupgrade.bin) | yuncore-tftp-header-16m
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += yuncore_xd4200
|
|
|
|
|
|
2020-10-06 12:14:31 +00:00
|
|
|
define Device/ziking_cpe46b
|
|
|
|
|
SOC := ar9330
|
|
|
|
|
DEVICE_VENDOR := ZiKing
|
|
|
|
|
DEVICE_MODEL := CPE46B
|
|
|
|
|
IMAGE_SIZE := 8000k
|
|
|
|
|
DEVICE_PACKAGES := kmod-i2c-gpio
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += ziking_cpe46b
|
|
|
|
|
|
ath79: Add support for ZBT-WD323
ZBT-WD323 is a dual-LTE router based on AR9344. The detailed
specifications are:
* AR9344 560MHz/450MHz/225MHz (CPU/DDR/AHN).
* 128 MB RAM
* 16MB of flash(SPI-NOR, 22MHz)
* 1x 2.4GHz wifi (Atheros AR9340)
* 3x 10/100Mbos Ethernet (AR8229)
* 1x USB2.0 port
* 2x miniPCIe-slots (USB2.0 only)
* 2x SIM slots (standard size)
* 4x LEDs (1 gpio controlled)
* 1x reset button
* 1x 10 pin terminal block (RS232, RS485, 4x GPIO)
* 2x CP210x UART bridge controllers (used for RS232 and RS485)
* 1x 2 pin 5mm industrial interface (input voltage 12V~36V)
* 1x DC jack
* 1x RTC (PCF8563)
Tested:
- Ethernet switch
- Wifi
- USB port
- MiniPCIe-slots (+ SIM slots)
- Sysupgrade
- Reset button
- RS232
Intallation and recovery:
The board ships with OpenWRT, but sysupgrade does not work as a
different firmware format than what is expected is generated. The
easiest way to install (and recover) the router, is to use the
web-interface provided by the bootloader (Breed).
While the interface is in Chinese, it is easy to use. First, in order to
access the interface, you need to hold down the reset button for around
five seconds. Then, go to 192.168.1.1 in your browser. Click on the
second item in the list on the left to access the recovery page. The
second item on the next page is where you select the firmware. Select
the menu item containing "Atheros SDK" and "16MB" in the dropdown close
to the buttom, and click on the button at the bottom to start
installation/recovery.
Notes:
* RS232 is available on /dev/ttyUSB0 and RS485 on /dev/ttyUSB1
Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
[removed unused poll-interval from gpio-keys, i2c-gpio 4.19 compat]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2019-05-31 13:43:14 +00:00
|
|
|
define Device/zbtlink_zbt-wd323
|
2019-12-20 00:12:42 +00:00
|
|
|
SOC := ar9344
|
2019-06-16 19:34:46 +00:00
|
|
|
DEVICE_VENDOR := ZBT
|
|
|
|
|
DEVICE_MODEL := WD323
|
ath79: Add support for ZBT-WD323
ZBT-WD323 is a dual-LTE router based on AR9344. The detailed
specifications are:
* AR9344 560MHz/450MHz/225MHz (CPU/DDR/AHN).
* 128 MB RAM
* 16MB of flash(SPI-NOR, 22MHz)
* 1x 2.4GHz wifi (Atheros AR9340)
* 3x 10/100Mbos Ethernet (AR8229)
* 1x USB2.0 port
* 2x miniPCIe-slots (USB2.0 only)
* 2x SIM slots (standard size)
* 4x LEDs (1 gpio controlled)
* 1x reset button
* 1x 10 pin terminal block (RS232, RS485, 4x GPIO)
* 2x CP210x UART bridge controllers (used for RS232 and RS485)
* 1x 2 pin 5mm industrial interface (input voltage 12V~36V)
* 1x DC jack
* 1x RTC (PCF8563)
Tested:
- Ethernet switch
- Wifi
- USB port
- MiniPCIe-slots (+ SIM slots)
- Sysupgrade
- Reset button
- RS232
Intallation and recovery:
The board ships with OpenWRT, but sysupgrade does not work as a
different firmware format than what is expected is generated. The
easiest way to install (and recover) the router, is to use the
web-interface provided by the bootloader (Breed).
While the interface is in Chinese, it is easy to use. First, in order to
access the interface, you need to hold down the reset button for around
five seconds. Then, go to 192.168.1.1 in your browser. Click on the
second item in the list on the left to access the recovery page. The
second item on the next page is where you select the firmware. Select
the menu item containing "Atheros SDK" and "16MB" in the dropdown close
to the buttom, and click on the button at the bottom to start
installation/recovery.
Notes:
* RS232 is available on /dev/ttyUSB0 and RS485 on /dev/ttyUSB1
Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
[removed unused poll-interval from gpio-keys, i2c-gpio 4.19 compat]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2019-05-31 13:43:14 +00:00
|
|
|
IMAGE_SIZE := 16000k
|
2020-03-05 14:42:18 +00:00
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-i2c-gpio kmod-rtc-pcf8563 \
|
2021-02-25 10:54:43 +00:00
|
|
|
kmod-usb-serial-cp210x uqmi
|
ath79: Add support for ZBT-WD323
ZBT-WD323 is a dual-LTE router based on AR9344. The detailed
specifications are:
* AR9344 560MHz/450MHz/225MHz (CPU/DDR/AHN).
* 128 MB RAM
* 16MB of flash(SPI-NOR, 22MHz)
* 1x 2.4GHz wifi (Atheros AR9340)
* 3x 10/100Mbos Ethernet (AR8229)
* 1x USB2.0 port
* 2x miniPCIe-slots (USB2.0 only)
* 2x SIM slots (standard size)
* 4x LEDs (1 gpio controlled)
* 1x reset button
* 1x 10 pin terminal block (RS232, RS485, 4x GPIO)
* 2x CP210x UART bridge controllers (used for RS232 and RS485)
* 1x 2 pin 5mm industrial interface (input voltage 12V~36V)
* 1x DC jack
* 1x RTC (PCF8563)
Tested:
- Ethernet switch
- Wifi
- USB port
- MiniPCIe-slots (+ SIM slots)
- Sysupgrade
- Reset button
- RS232
Intallation and recovery:
The board ships with OpenWRT, but sysupgrade does not work as a
different firmware format than what is expected is generated. The
easiest way to install (and recover) the router, is to use the
web-interface provided by the bootloader (Breed).
While the interface is in Chinese, it is easy to use. First, in order to
access the interface, you need to hold down the reset button for around
five seconds. Then, go to 192.168.1.1 in your browser. Click on the
second item in the list on the left to access the recovery page. The
second item on the next page is where you select the firmware. Select
the menu item containing "Atheros SDK" and "16MB" in the dropdown close
to the buttom, and click on the button at the bottom to start
installation/recovery.
Notes:
* RS232 is available on /dev/ttyUSB0 and RS485 on /dev/ttyUSB1
Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
[removed unused poll-interval from gpio-keys, i2c-gpio 4.19 compat]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2019-05-31 13:43:14 +00:00
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += zbtlink_zbt-wd323
|
ath79: add support for ZyXEL NBG6616
Specifications:
SoC: Qualcomm Atheros QCA9557
RAM: 128 MB (Nanya NT5TU32M16EG-AC)
Flash: 16 MB (Macronix MX25L12845EMI-10G)
Ethernet: 5x 10/100/1000 (1x WAN, 4x LAN)
Wireless: QCA9557 2.4GHz (nbg), QCA9882 5GHz (ac)
USB: 2x USB 2.0 port
Buttons: 1x Reset
Switches: 1x Wifi
LEDs: 11 (Pwr, WAN, 4x LAN, 2x Wifi, 2x USB, WPS)
MAC addresses:
WAN *:3f uboot-env ethaddr + 3
LAN *:3e uboot-env ethaddr + 2
2.4GHz *:3c uboot-env ethaddr
5GHz *:3d uboot-env ethaddr + 1
The label contains all four MAC addresses, however the one without
increment is first, so this one is taken for label MAC address.
Notes:
The Wifi is controlled by an on/off button, i.e. has to be implemented
by a switch (EV_SW). Despite, it appears that GPIO_ACTIVE_HIGH needs
to be used, just like recently fixed for the NBG6716.
Both parameters have been wrong at ar71xx.
Flash Instructions:
At first the U-Boot variables need to be changed in order to boot the
new combined image format. ZyXEL uses a split kernel + root setup and
the current kernel is too large to fit into the partition. As resizing
didnt do the trick, I've decided to use the prefered combined image
approach to be future-kernel-enlargement-proof (thanks to blocktrron for
the assistance).
First add a new variable called boot_openwrt:
setenv boot_openwrt bootm 0x9F120000
After that overwrite the bootcmd and save the environment:
setenv bootcmd run boot_openwrt
saveenv
After that you can flash the openwrt factory image via TFTP. The servers
IP has to be 192.168.1.33. Connect to one of the LAN ports and hold the
WPS Button while booting. After a few seconds the NBG6616 will look for
a image file called 'ras.bin' and flash it.
Return to vendor firmware is possible by resetting the bootcmd:
setenv bootcmd run boot_flash
saveenv
and flashing the vendor image via the TFTP method as described above.
Accessing the U-Boot Shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
| NBG6616> ?
| ATEN x,(y) set BootExtension Debug Flag (y=password)
| ATSE x show the seed of password generator
| ATSH dump manufacturer related data in ROM
| ATRT (x,y,z,u) ATRT RAM read/write test (x=level, y=start addr, z=end addr, u=iterations
| ATGO boot up whole system
| ATUR x upgrade RAS image (filename)
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
| NBG6616> ATSE NBG6616
| 00C91D7EAC3C
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
| # bash ./tool.sh 00C91D7EAC3C
| ATEN 1,10FDFF5
Copy and paste the result into the shell to unlock zloader.
| NBG6616> ATEN 1,10FDFF5
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
| NBG6616> ATGU
| NBG6616#
Signed-off-by: Christoph Krapp <achterin@googlemail.com>
[move keys to DTSI, adjust usb_power DT label, remove kernel config
change, extend commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-08-09 11:00:05 +00:00
|
|
|
|
ath79: add support for ZyXEL NWA1121-NI
Specifications:
* AR9342, 16 MiB Flash, 64 MiB RAM, 802.11n 2T2R, 2.4 GHz
* 1x Gigabit Ethernet (AR8035), 802.3af PoE
Installation:
* OEM Web UI is at 192.168.1.2
login as `admin` with password `1234`
* Flash factory-AABJ.bin
The string `AABJ` needs to be present within the file name of the uploaded
image to be accepted by the OEM Web-based updater, the factory image is
named accordingly to save the user from the hassle of manual renaming.
TFTP Recovery:
* Open the case, connect to TTL UART port (this is the official method
described by Zyxel, the reset button is useless during power-on)
* Extract factory image (.tar.bz2), serve `vmlinux_mi124_f1e.lzma.uImage`
and `mi124_f1e-jffs2` via tftp at 192.168.1.10
* Interrupt uboot countdown, execute commands
`run lk`
`run lf`
to flash the kernel / filesystem accordingly
MAC addresses as verified by OEM firmware:
use address source
LAN *:cc mib0 0x30 ('eth0mac'), art 0x1002 (label)
2g *:cd mib0 0x4b ('wifi0mac')
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2020-09-09 18:42:53 +00:00
|
|
|
define Device/zyxel_nwa11xx
|
|
|
|
|
$(Device/loader-okli-uimage)
|
|
|
|
|
SOC := ar9342
|
|
|
|
|
DEVICE_VENDOR := ZyXEL
|
|
|
|
|
LOADER_FLASH_OFFS := 0x050000
|
|
|
|
|
KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x4f4b4c49
|
|
|
|
|
IMAGE_SIZE := 8192k
|
|
|
|
|
IMAGES += factory-$$$$(ZYXEL_MODEL_STRING).bin
|
|
|
|
|
IMAGE/factory-$$$$(ZYXEL_MODEL_STRING).bin := \
|
|
|
|
|
append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | \
|
|
|
|
|
pad-rootfs | pad-to 8192k | check-size | zyxel-tar-bz2 \
|
|
|
|
|
vmlinux_mi124_f1e mi124_f1e-jffs2 | append-md5sum-bin
|
|
|
|
|
endef
|
|
|
|
|
|
ath79: add support for ZyXEL NWA1100-NH
Specifications:
* AR9342, 16 MiB Flash, 64 MiB RAM, 802.11n 2T2R, 2.4 GHz
* 1x Gigabit Ethernet (AR8035), 802.3af PoE
Installation:
* OEM Web UI is at 192.168.1.2
login as `admin` with password `1234`
* Flash factory-AASI.bin
The string `AASI` needs to be present within the file name of the uploaded
image to be accepted by the OEM Web-based updater, the factory image is
named accordingly to save the user from the hassle of manual renaming.
TFTP Recovery:
* Open the case, connect to TTL UART port (this is the official method
described by Zyxel, the reset button is useless during power-on)
* Extract factory image (.tar.bz2), serve `vmlinux_mi124_f1e.lzma.uImage`
and `mi124_f1e-jffs2` via tftp at 192.168.1.10
* Interrupt uboot countdown, execute commands
`run lk`
`run lf`
to flash the kernel / filesystem accordingly
MAC addresses as verified by OEM firmware:
use address source
LAN *:cc mib0 0x30 ('eth0mac'), art 0x1002 (label)
2g *:cd mib0 0x4b ('wifi0mac')
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2022-08-06 22:59:06 +00:00
|
|
|
define Device/zyxel_nwa1100-nh
|
|
|
|
|
$(Device/zyxel_nwa11xx)
|
|
|
|
|
DEVICE_MODEL := NWA1100
|
|
|
|
|
DEVICE_VARIANT := NH
|
|
|
|
|
ZYXEL_MODEL_STRING := AASI
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += zyxel_nwa1100-nh
|
|
|
|
|
|
ath79: add support for ZyXEL NWA1121-NI
Specifications:
* AR9342, 16 MiB Flash, 64 MiB RAM, 802.11n 2T2R, 2.4 GHz
* 1x Gigabit Ethernet (AR8035), 802.3af PoE
Installation:
* OEM Web UI is at 192.168.1.2
login as `admin` with password `1234`
* Flash factory-AABJ.bin
The string `AABJ` needs to be present within the file name of the uploaded
image to be accepted by the OEM Web-based updater, the factory image is
named accordingly to save the user from the hassle of manual renaming.
TFTP Recovery:
* Open the case, connect to TTL UART port (this is the official method
described by Zyxel, the reset button is useless during power-on)
* Extract factory image (.tar.bz2), serve `vmlinux_mi124_f1e.lzma.uImage`
and `mi124_f1e-jffs2` via tftp at 192.168.1.10
* Interrupt uboot countdown, execute commands
`run lk`
`run lf`
to flash the kernel / filesystem accordingly
MAC addresses as verified by OEM firmware:
use address source
LAN *:cc mib0 0x30 ('eth0mac'), art 0x1002 (label)
2g *:cd mib0 0x4b ('wifi0mac')
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2020-09-09 18:42:53 +00:00
|
|
|
define Device/zyxel_nwa1121-ni
|
|
|
|
|
$(Device/zyxel_nwa11xx)
|
|
|
|
|
DEVICE_MODEL := NWA1121
|
|
|
|
|
DEVICE_VARIANT := NI
|
|
|
|
|
ZYXEL_MODEL_STRING := AABJ
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += zyxel_nwa1121-ni
|
|
|
|
|
|
ath79: add support for ZyXEL NWA1123-AC
Specifications:
* AR9342, 16 MiB Flash, 64 MiB RAM, 802.11n 2T2R, 2.4 GHz
* QCA9882 PCIe card, 802.11ac 2T2R
* 1x Gigabit Ethernet (AR8035), 802.3af PoE
Installation:
* OEM Web UI is at 192.168.1.2
login as `admin` with password `1234`
* Flash factory-AAOX.bin
The string `AAOX` needs to be present within the file name of the uploaded
image to be accepted by the OEM Web-based updater, the factory image is
named accordingly to save the user from the hassle of manual renaming.
TFTP Recovery:
* Open the case, connect to TTL UART port (this is the official method
described by Zyxel, the reset button is useless during power-on)
* Extract factory image (.tar.bz2), serve `vmlinux_mi124_f1e.lzma.uImage`
and `mi124_f1e-jffs2` via tftp at 192.168.1.10
* Interrupt uboot countdown, execute commands
`run lk`
`run lf`
to flash the kernel / filesystem accordingly
MAC addresses as verified by OEM firmware:
use address source
LAN *:1c mib0 0x30 ('eth0mac'), art 0x1002 (label)
2g *:1c mib0 0x4b ('wifi0mac')
5g *:1e mib0 0x66 ('wifi1mac')
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2021-03-27 23:33:45 +00:00
|
|
|
define Device/zyxel_nwa1123-ac
|
|
|
|
|
$(Device/zyxel_nwa11xx)
|
|
|
|
|
DEVICE_MODEL := NWA1123
|
|
|
|
|
DEVICE_VARIANT := AC
|
|
|
|
|
ZYXEL_MODEL_STRING := AAOX
|
|
|
|
|
DEVICE_PACKAGES := kmod-ath10k-ct-smallbuffers \
|
|
|
|
|
ath10k-firmware-qca988x-ct
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += zyxel_nwa1123-ac
|
|
|
|
|
|
ath79: add support for ZyXEL NWA1123-NI
Specifications:
* AR9342, 16 MiB Flash, 64 MiB RAM, 802.11n 2T2R, 2.4 GHz
* AR9382 PCIe card, 802.11n 2T2R, 5 GHz
* 1x Gigabit Ethernet (AR8035), 802.3af PoE
Installation:
* OEM Web UI is at 192.168.1.2
login as `admin` with password `1234`
* Flash factory-AAEO.bin
The string `AAEO` needs to be present within the file name of the uploaded
image to be accepted by the OEM Web-based updater, the factory image is
named accordingly to save the user from the hassle of manual renaming.
TFTP Recovery:
* Open the case, connect to TTL UART port (this is the official method
described by Zyxel, the reset button is useless during power-on)
* Extract factory image (.tar.bz2), serve `vmlinux_mi124_f1e.lzma.uImage`
and `mi124_f1e-jffs2` via tftp at 192.168.1.10
* Interrupt uboot countdown, execute commands
`run lk`
`run lf`
to flash the kernel / filesystem accordingly
MAC addresses as verified by OEM firmware:
use address source
LAN *:fb mib0 0x30 ('eth0mac'), art 0x1002 (label)
2g *:fc mib0 0x4b ('wifi0mac')
5g *:fd mib0 0x66 ('wifi1mac')
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2021-03-27 23:32:46 +00:00
|
|
|
define Device/zyxel_nwa1123-ni
|
|
|
|
|
$(Device/zyxel_nwa11xx)
|
|
|
|
|
DEVICE_MODEL := NWA1123
|
|
|
|
|
DEVICE_VARIANT := NI
|
|
|
|
|
ZYXEL_MODEL_STRING := AAEO
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += zyxel_nwa1123-ni
|
|
|
|
|
|
ath79: add support for ZyXEL NBG6616
Specifications:
SoC: Qualcomm Atheros QCA9557
RAM: 128 MB (Nanya NT5TU32M16EG-AC)
Flash: 16 MB (Macronix MX25L12845EMI-10G)
Ethernet: 5x 10/100/1000 (1x WAN, 4x LAN)
Wireless: QCA9557 2.4GHz (nbg), QCA9882 5GHz (ac)
USB: 2x USB 2.0 port
Buttons: 1x Reset
Switches: 1x Wifi
LEDs: 11 (Pwr, WAN, 4x LAN, 2x Wifi, 2x USB, WPS)
MAC addresses:
WAN *:3f uboot-env ethaddr + 3
LAN *:3e uboot-env ethaddr + 2
2.4GHz *:3c uboot-env ethaddr
5GHz *:3d uboot-env ethaddr + 1
The label contains all four MAC addresses, however the one without
increment is first, so this one is taken for label MAC address.
Notes:
The Wifi is controlled by an on/off button, i.e. has to be implemented
by a switch (EV_SW). Despite, it appears that GPIO_ACTIVE_HIGH needs
to be used, just like recently fixed for the NBG6716.
Both parameters have been wrong at ar71xx.
Flash Instructions:
At first the U-Boot variables need to be changed in order to boot the
new combined image format. ZyXEL uses a split kernel + root setup and
the current kernel is too large to fit into the partition. As resizing
didnt do the trick, I've decided to use the prefered combined image
approach to be future-kernel-enlargement-proof (thanks to blocktrron for
the assistance).
First add a new variable called boot_openwrt:
setenv boot_openwrt bootm 0x9F120000
After that overwrite the bootcmd and save the environment:
setenv bootcmd run boot_openwrt
saveenv
After that you can flash the openwrt factory image via TFTP. The servers
IP has to be 192.168.1.33. Connect to one of the LAN ports and hold the
WPS Button while booting. After a few seconds the NBG6616 will look for
a image file called 'ras.bin' and flash it.
Return to vendor firmware is possible by resetting the bootcmd:
setenv bootcmd run boot_flash
saveenv
and flashing the vendor image via the TFTP method as described above.
Accessing the U-Boot Shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
| NBG6616> ?
| ATEN x,(y) set BootExtension Debug Flag (y=password)
| ATSE x show the seed of password generator
| ATSH dump manufacturer related data in ROM
| ATRT (x,y,z,u) ATRT RAM read/write test (x=level, y=start addr, z=end addr, u=iterations
| ATGO boot up whole system
| ATUR x upgrade RAS image (filename)
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
| NBG6616> ATSE NBG6616
| 00C91D7EAC3C
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
| # bash ./tool.sh 00C91D7EAC3C
| ATEN 1,10FDFF5
Copy and paste the result into the shell to unlock zloader.
| NBG6616> ATEN 1,10FDFF5
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
| NBG6616> ATGU
| NBG6616#
Signed-off-by: Christoph Krapp <achterin@googlemail.com>
[move keys to DTSI, adjust usb_power DT label, remove kernel config
change, extend commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-08-09 11:00:05 +00:00
|
|
|
define Device/zyxel_nbg6616
|
|
|
|
|
SOC := qca9557
|
|
|
|
|
DEVICE_VENDOR := ZyXEL
|
|
|
|
|
DEVICE_MODEL := NBG6616
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport kmod-rtc-pcf8563 \
|
|
|
|
|
kmod-ath10k-ct ath10k-firmware-qca988x-ct
|
|
|
|
|
IMAGE_SIZE := 15232k
|
|
|
|
|
RAS_BOARD := NBG6616
|
|
|
|
|
RAS_ROOTFS_SIZE := 14464k
|
|
|
|
|
RAS_VERSION := "OpenWrt Linux-$(LINUX_VERSION)"
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
|
|
|
|
|
append-rootfs | pad-rootfs | pad-to 64k | check-size | zyxel-ras-image
|
|
|
|
|
SUPPORTED_DEVICES += nbg6616
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += zyxel_nbg6616
|
