The boards have equivalent hardware except for LEDs
and equivalent device config except for MACs
also use naming convention for mtd-concat partitions
to prepare for upcoming patch
"treewide: use more descriptive names for concatenated partitions"
Signed-off-by: Michael Pratt <mcpratt@pm.me>
FCC ID: A8J-ECB600
Engenius ECB600 is a wireless access point with 1 gigabit PoE ethernet port,
dual-band wireless, external ethernet switch, and 4 external antennas.
Specification:
- AR9344 SOC (5 GHz, 2x2, WMAC)
- AR9382 WLAN (2.4 GHz, 2x2, PCIe on-board)
- AR8035-A switch (GbE with 802.3af PoE)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16DG
- UART at H1 (populated)
- 4 LEDs, 1 button (power, eth, 2.4 GHz, 5 GHz) (reset)
- 4 external antennas
MAC addresses:
MAC addresses are labeled MAC1 and MAC2
The MAC address in flash is not on the label
The OEM software reports these MACs for the ifconfig
phy1 MAC 1 *:52 --- (2.4 GHz)
phy0 MAC 2 *:53 --- (5 GHz)
eth0 ----- *:54 art 0x0
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Upgrade Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
Format of OEM firmware image:
The OEM software of ECB600 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-ecb600-uImage-lzma.bin
openwrt-senao-ecb600-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh
Later models in the ECB series likely have a different platform
and the upgrade and image verification process differs.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035-A switch between
the SOC and the ethernet PHY chips.
For AR934x series, the PLL register for GMAC0
can be seen in the DTSI as 0x2c.
Therefore the PLL register can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
Unfortunately uboot did not have the best values
so they were taken from other similar DTS files.
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Commit 5fc28ef479 ("ath79: Add support for Plasma Cloud PA300")
added the IMAGE/sysupgrade.bin/squashfs definition, which leaks into
other devices, resulting in sysupgrade.bin images that are actually
tarballs and do not boot when directly written to flash.
We can use the normal sysupgrade.bin command variable for this device.
Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
[fix format, spelling]
Signed-off-by: David Bauer <mail@david-bauer.net>
Newer EnGenius software that still uses the tar.gz platform
instead of the custom header requires more checks for upgrading,
but their script includes a way to skip them...
the existence of a file in the tar.gz called failsafe.bin
Their upgrade script has these lines:
\#pass check when upload with full image file
[ "${errcode}" -eq "1" ] && [ -f failsafe.bin ] && errcode="0"
This overrides the script's "errcode" variable
which can be set if any of the following actions/checks fail:
- untarring of the upload
- magic number for kernel: "2705"
- magic num for rootfs: "7371" or "6873"
- md5sums for each file in the format
filename:md5
- existence of a file matching FWINFO*
that it has boardname in the name somewhere (grep)
that the 4th field of separator "-" is at least 3 (version)
Otherwise we would need to generate md5sums in this strange format
and touch a file with specific requirements in the name.
This does not effect boards where the advanced checks do not apply.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[fixed SoB to match From:]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
FCC ID: A8J-ENSTAC
Engenius EnStationAC v1 is an outdoor wireless access point/bridge with
2 gigabit ethernet ports on 2 external ethernet switches,
5 GHz only wireless, internal antenna plates, and proprietery PoE.
Specification:
- QCA9557 SOC
- QCA9882 WLAN (PCI card, 5 GHz, 2x2, 26dBm)
- AR8035-A switch (RGMII GbE with PoE+ IN)
- AR8031 switch (SGMII GbE with PoE OUT)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16FG
- UART at J10 (unpopulated)
- internal antenna plates (19 dbi, directional)
- 7 LEDs, 1 button (power, eth, wlan, RSSI) (reset)
MAC addresses:
MAC addresses are labeled as ETH and 5GHz
Vendor MAC addresses in flash are duplicate
eth0 ETH *:d3 art 0x0/0x6
eth1 ---- *:d4 ---
phy0 5GHz *:d5 ---
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
TFTP recovery:
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board
hold or press reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
Format of OEM firmware image:
The OEM software of EnStationAC is a heavily modified version
of Openwrt Altitude Adjustment 12.09. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-ar71xx-enstationac-uImage-lzma.bin
openwrt-ar71xx-enstationac-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
Newer EnGenius software requires more checks but their script
includes a way to skip them, otherwise the tar must include
a text file with the version and md5sums in a deprecated format.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8033 switch between
the SOC and the ethernet PHY chips.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
For eth0 at 1000 speed, the value returned was
ae000000 but that didn't work, so following
the logical pattern from the rest of the values,
the guessed value of a3000000 works better.
later discovered that delay can be placed on the PHY end only
with phy-mode as 'rgmii-id' and set register to 0x82...
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[fixed SoB to match From:]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Specifications:
* QCA9557, 16 MiB Flash, 128 MiB RAM, 802.11n 2T2R
* QCA9882, 802.11ac 2T2R
* Gigabit LAN Port (AR8035), 802.11af PoE
Installation:
* Factory Web UI is at 192.168.0.50
login with 'admin' and blank password, flash factory.bin
* Recovery Web UI is at 192.168.0.50
connect network cable, hold reset button during power-on and keep it
pressed until uploading has started (only required when checksum is ok,
e.g. for reverting back to oem firmware), flash factory.bin
After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
The Ubiquiti Network airCube AC is a cube shaped device supporting
2.4 GHz and 5 GHz with internal 2x2 MIMO antennas.
It can be powered with either one of:
- 24v power supply with 3.0mm x 1.0mm barrel plug
- 24v passive PoE on first LAN port
There are four 10/100/1000 Mbps ports (1 * WAN + 3 * LAN).
First LAN port have optional PoE passthrough to the WAN port.
SoC: Qualcomm / Atheros AR9342
RAM: 64 MB DDR2
Flash: 16 MB SPI NOR
Ethernet: 4x 10/100/1000 Mbps (1 WAN + 3 LAN)
LEDS: 1x via a SPI controller (not yet supported)
Buttons: 1x Reset
Serial: 1x (only RX and TX); 115200 baud, 8N1
Missing features:
- LED control is not supported
Physical to internal switch port mapping:
- physical port #1 (poe in) = switchport 2
- physical port #2 = switchport 3
- physical port #3 = switchport 5
- physical port #4 (wan/poe out) = switchport 4
Factory update is tested and is the same as for Ubiquiti AirCube ISP
hence the shared configuration between that devices.
Signed-off-by: Roman Kuzmitskii <damex.pp@icloud.com>
This patch adds support for the MikroTik RouterBOARD wAPR-2nD (wAP R)
router, a weatherproof 2.4 GHz access point with a miniPCI-e slot and
a SIM card slot.
Specifications:
- SoC: Qualcomm Atheros QCA9533
- Flash: 16 MB (SPI)
- RAM: 64 MB
- Ethernet: 1x 10/100 Mbps (PoE in)
- WiFi: AR9531 2T2R 2.4 GHz (SoC)
- miniPCI-e slot
- 4x green LEDs (1x WiFi, 3x RSSI)
- 1x reset button
See https://mikrotik.com/product/RBwAPR-2nD for more details.
Flashing:
TFTP boot initramfs image and then perform sysupgrade. Follow common
MikroTik procedure as in https://openwrt.org/toh/mikrotik/common.
Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
Device specifications:
* Qualcomm/Atheros QCA9533 v2
* 650/600/217 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash (mx25l12805d)
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
- eth0
+ Label: Ethernet 1
+ 24V passive POE (mode B)
+ used as WAN interface
- eth1
+ Label: Ethernet 2
+ 802.3af POE
+ builtin switch port 2
+ used as LAN interface
* 12-24V 1A DC
* external antennas
Flashing instructions:
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the factory image to the u-boot when the device boots up.
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Device specifications:
* Qualcomm/Atheros QCA9533 v2
* 650/600/217 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash (mx25l12805d)
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
- eth0
+ Label: Ethernet 1
+ 24V passive POE (mode B)
+ used as WAN interface
- eth1
+ Label: Ethernet 2
+ 802.3af POE
+ builtin switch port 2
+ used as LAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the factory image to the u-boot when the device boots up.
Signed-off-by: Sven Eckelmann <sven@narfation.org>
The MIPS code is supposed to fall back to u-boots bootargs whenever the
/chosen/bootargs property is missing. But this feature was accidentally
disabled when the boot_command_line was initialized with an empty space
just to work around problems with early_init_dt_scan_chosen.
But this feature is necessary for some boards which have a dualboot
mechanism and whose u-boot is calculating the correct partition at runtime
without writing this information back to the u-boot-env.
Signed-off-by: Sven Eckelmann <sven@narfation.org>
FCC ID: A8J-ECB350
Engenius ECB350 v1 is an indoor wireless access point with a gigabit ethernet port,
2.4 GHz wireless, external antennas, and PoE.
**Specification:**
- AR7242 SOC
- AR9283 WLAN 2.4 GHz (2x2), PCIe on-board
- AR8035-A switch RGMII, GbE with 802.3af PoE
- 40 MHz reference clock
- 8 MB FLASH 25L6406EM2I-12G
- 32 MB RAM
- UART at J2 (populated)
- 2 external antennas
- 3 LEDs, 1 button (power, lan, wlan) (reset)
**MAC addresses:**
MACs are labeled as WLAN and WAN
vendor MAC addresses in flash are duplicate
phy0 WLAN *:b8 ---
eth0 WAN *:b9 art 0x0/0x6
**Installation:**
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9f670000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery** (unstable / not reliable):
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board while holding or pressing reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of ECB350 v1 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel size to be no greater than 1536k
and otherwise the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
The factory upgrade script follows the original mtd partitions.
**Note on PLL-data cells:**
The default PLL register values will not work
because of the AR8035 switch between
the SOC and the ethernet port.
For AR724x series, the PLL register for GMAC0
can be seen in the DTSI as 0x2c.
Therefore the PLL register can be read from u-boot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`
However the registers that u-boot sets are not ideal and sometimes wrong...
the at803x driver supports setting the RGMII clock/data delay on the PHY side.
This way the pll-data register only needs to handle invert and phase.
for this board no extra adjustements are needed on the MAC side
all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Add support for the ar71xx supported GL.iNet GL-USB150 to ath79.
GL.iNet GL-USB150 is an USB dongle WiFi router, based on Atheros AR9331.
Specification:
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- Realtek RTL8152B USB to Ethernet bridge (connected with AR9331 PHY4)
- 1T1R 2.4 GHz
- 2x LED, 1x button
- UART header on PCB
Flash instruction:
Vendor software is based on openwrt so you can flash the sysupgrade
image via the vendor GUI or using command line sysupgrade utility.
Make sure to not save configuration over reflash as uci settings
differ between versions.
Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
factory.bin was not tested for ECB1750...
but it was tested on it's sister board ECB1200
The product ID for the header can be verified by inspecting
the header of OEM images, or in the u-boot environment.
Also:
- the LAN LED is controlled directly by the AR8035 switch
- the labelled (first increment) MAC for both is ethaddr (eth0)
- list packages in alphabetical order
- use default sysupgrade.bin recipe
Signed-off-by: Michael Pratt <mcpratt@pm.me>
These boards are sister boards
exactly the same hardware except that ECB1200 has:
- QCA9557
- 2 RF circuits/antennas per band instead of 3
- a resistor blocking UART RX line
Tested-by: sven friedmann <sf.openwrt@okay.ms>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
FCC ID: A8J-ECB1200
Engenius ECB1200 is an indoor wireless access point with a GbE port,
2.4 GHz and 5 GHz wireless, external antennas, and 802.3af PoE.
**Specification:**
- QCA9557 SOC MIPS, 2.4 GHz (2x2)
- QCA9882 WLAN PCIe card, 5 GHz (2x2)
- AR8035-A switch RGMII, GbE with 802.3af PoE, 25 MHz clock
- 40 MHz reference clock
- 16 MB FLASH 25L12845EMI-10G
- 2x 64 MB RAM 1538ZFZ V59C1512164QEJ25
- UART at JP1 (unpopulated, RX shorted to ground)
- 4 external antennas
- 4 LEDs, 1 button (power, eth, wifi2g, wifi5g) (reset)
**MAC addresses:**
MAC Addresses are labeled as ETH and 5GHZ
U-boot environment has the vendor MAC addresses
MAC addresses in ART do not match vendor
eth0 ETH *:5c u-boot-env ethaddr
phy0 5GHZ *:5d u-boot-env athaddr
---- ---- ???? art 0x0/0x6
**Installation:**
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
(see TFTP recovery)
perform a sysupgrade
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART pinout at JP1
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
Unlike most Engenius boards, this does not have a 'failsafe' image
the only way to return to OEM is TFTP or serial access to u-boot
**TFTP recovery:**
Unlike most Engenius boards, TFTP is reliable here
rename initramfs-kernel.bin to 'ap.bin'
make the file available on a TFTP server at 192.168.1.10
power board while holding or pressing reset button repeatedly
or with serial access:
run `tftpboot` or `run factory_boot` with initramfs-kernel.bin
then `bootm` with the load address
**Format of OEM firmware image:**
The OEM software of ECB1200 is a heavily modified version
of Openwrt Altitude Adjustment 12.09.
This Engenius board, like ECB1750, uses a proprietary header
with a unique Product ID. The header for factory.bin is
generated by the mksenaofw program included in openwrt.
**Note on PLL-data cells:**
The default PLL register values will not work
because of the AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
However the registers that u-boot sets are not ideal and sometimes wrong...
the at803x driver supports setting the RGMII clock/data delay on the PHY side.
This way the pll-data register only needs to handle invert and phase.
for this board clock invert is needed on the MAC side
all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Incorrect values were used for the switch initialization causing the
lan port leds to not light up in case of 10Mb or 100Mb connections.
This commit fixes this problem and removes unused values.
Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
All modifications made by update_kernel.sh run in a fresh clone
without any existing toolchains.
Build system: x86_64
Build-tested: ipq806x/R7800, ath79/generic, bcm27xx/bcm2711
Run-tested: ipq806x/R7800
No dmesg regressions, everything functional
Signed-off-by: John Audia <graysky@archlinux.us>
Commit "initramfs: switch to tmpfs to fix ujail" switched initramfs to
now use tmpfs, it causes $(rootfs_type) to now return tmpfs when
running initramfs image instead of being empty.
This broke initramfs detection which is required so that when installing
on MikroTik devices firmware partition would first get erased fully
before writing.
So, lets test for $(rootfs_type) returning "tmpfs" instead.
Fixes: 7fd3c68 ("initramfs: switch to tmpfs to fix ujail)
Signed-off-by: Robert Marko <robimarko@gmail.com>
The flash capacity is divided in two flash chips and currently only
first is used. Increase available space for OpenWrt by additional 16 MiB
using mtd-concat driver. Because U-Boot might not be able to load kernel
image spanned through two flash chips, the size of kernel is limited
to space available on first first chip.
Cc: Vladimir Georgievsky <vladimir.georgievsky@yahoo.com>
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
AirTight Networks (later renamed to Mojo Networks) C-75 is a dual-band
access point, also sold by WatchGuard under name AP320.
Specification
SoC: Qualcomm Atheros QCA9550
RAM: 128 MiB DDR2
Flash: 2x 16 MiB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
5 GHz 3T3R QCA9890 oversized Mini PCIe card
Ethernet: 2x 10/100/1000 Mbps QCA8334
port labeled LAN1 is PoE capable (802.3at)
USB: 1x 2.0
LEDs: 7x which two are GPIO controlled, four switch controlled, one
controlled by wireless driver
Buttons: 1x GPIO controlled
Serial: RJ-45 port, Cisco pinout
baud: 115200, parity: none, flow control: none
JTAG: Yes, pins marked J1 on PCB
Installation
1. Prepare TFTP server with OpenWrt initramfs-kernel image.
2. Connect to one of LAN ports.
3. Connect to serial port.
4. Power on the device and when prompted to stop autoboot, hit any key.
5. Adjust "ipaddr" and "serverip" addresses in U-Boot environment, use
'setenv' to do that, then run following commands:
tftpboot 0x81000000 <openwrt_initramfs-kernel_image_name>
bootm 0x81000000
6. Wait about 1 minute for OpenWrt to boot.
7. Transfer OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade -n /tmp/<openwrt_sysupgrade_image_name>
8. After flashing, the access point will reboot to OpenWrt. Wait few
minutes, until the Power LED stops blinking, then it's ready for
configuration.
Known issues
Green power LED does not work.
Additional information
The U-Boot fails to initialise ethernet ports correctly when a UART
adapter is attached to UART pins (marked J3 on PCB).
Cc: Vladimir Georgievsky <vladimir.georgievsky@yahoo.com>
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
phy-mode is already set to rgmii for eth0 and sgmii for eth1 in
qca955x.dtsi, no need to do that again in the device DTS files.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This device has (almost?) identical hardware to the F9J1108 v2 but uses
a different firmware magic and model number.
Specifications:
SoC: QCA9558
CPU: 720 MHz
Flash: 16 MiB NOR
RAM: 128 MiB
WiFi 2.4 GHz: QCA9558-AT4A 3x3 MIMO 802.11b/g/n
WiFi 5 GHz: QCA9880-2R4E 3x3 MIMO 802.11a/n/ac
Ethernet: 4x LAN and 1x WAN (all 1Gbit/s ports)
USB: 1 x USB 2.0 (lower), 1 x USB 3.0 (upper)
MAC addresses based on OEM firmware:
Interface Address Location
--------- ------- --------
lan *:5A sometimes in 0x6
wan *:5B 0x0
2.4Ghz *:5A 0x1002
5Ghz As per mini PCIe EEPROM
Flashing instructions:
The factory.bin can be flashed via the Belkin web UI or via the uboot
HTTP upgrade page (which is by default listening on 192.168.2.1). Once
the factory.bin has been written, sysupgrade.bin will work as usual.
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Belkin F9J1108 v2 and F9K1115 v2 are (seemingly) identical hardware
with different model numbers. Extract all non-device specific code to a
common .dtsi so it can be re-used when adding support for the
F9K1115 v2.
Similar to the .dtsi most of the image building recipe code can be
re-used. Move everything except the device model, edimax header magic
and edimax header model into a shared build recipe.
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
[drop duplicate TARGET_DEVICES, add EDIMAX_* to DEVICE_VARS, edit title]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This device is the non-US build of the F9K1115 v2, with a different
firmware magic.
Specifications:
SoC: QCA9558
CPU: 720 MHz
Flash: 16 MiB NOR
RAM: 128 MiB
WiFi 2.4 GHz: QCA9558-AT4A 3x3 MIMO 802.11b/g/n
WiFi 5 GHz: QCA9880-2R4E 3x3 MIMO 802.11a/n/ac
Ethernet: 4x LAN and 1x WAN (all 1gbps)
USB: 1 x USB 2.0 (lower), 1 x USB 3.0 (upper)
MAC addresses based on OEM firmware:
Interface Address Location
--------- ------- --------
lan *:5A sometimes in 0x6
wan *:5B 0x0
2.4Ghz *:5A 0x1002
5Ghz As per mini PCIe EEPROM
Flashing instructions:
The factory.bin can be flashed via the Belkin web UI or via the uboot
http upgrade page.
Once the factory.bin has been written, sysupgrade.bin will work as usual.
Signed-off-by: Damien Mascord <tusker@tusker.org>
Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
[wrap commit message/code, adjust label-mac-device, whitespace fixes,
merge block in 02_network]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This ports support for the TP-Link TL-WDR7500 v3 from ar71xx to ath79.
The basic features appear to be identical to the Archer C7 v1, however
it has the (supported) QCA9880-BR4A chip of the C7 v2.
Specifications:
SoC: QCA9558
CPU: 720 MHz
Flash: 8 MiB
RAM: 128 MiB
WLAN: 2.4 GHz b/g/n, 5 GHz a/n/ac
Qualcomm Atheros QCA9880-BR4A
Ethernet: 5x Gbit ports
USB: 2x 2.0 ports
Flashing instructions:
Upload the factory image via the OEM firmware GUI.
TFTP recovery appears to be available as well.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
None of the spi drivers on ath79 uses the num-cs property.
Cc: Chuanhong Guo <gch981213@gmail.com>
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Acked-by: Chuanhong Guo <gch981213@gmail.com>
Remove the MDIO reset from the MAC mode for the AR934x SoC family.
The reset is currently also defined for the MDIO node, where the reset
is acquired exclusively.
In case the ethernet node is enabled, this triggers a warning, as the
reset is already acquired by the MAC.
Signed-off-by: David Bauer <mail@david-bauer.net>
The TPLink CPE devices CPE210/CPE510 based on ar9344 have a build-in
Low Noise Amplifier on both of the 2x2 mimo rx chains.
This patch activates those two LNAs in the respective receiving chains
and hence improves the RX sensitivity by about 20dB.
Tested on CPE510 v2 & v3.
Signed-off-by: Thomas Huehn <thomas.huehn@hs-nordhausen.de>
Acked-by: Robert Marko <robimarko@gmail.com>
Because the bug described in FS#2428 has been fixed with bf2870c1d9
("kernel: fix mtd partition erase < parent_erasesize writes") these
devices can now safely do sysupgrade.
Restore sysupgrade support disabled in:
0cc87b3bac ("ath79: image: disable sysupgrade images for routerstations
and ja76pf2")
cc5256a8bf ("ath79: base-files: disable sysupgrade for routerstations
and ja76pf2")
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
[move Build block, remove check-size argument, wrap sysupgrade line,
make commit message easier to read]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Recent kernel bumps & target patch refactors have left some patch fuzz
around. Refreshed kernel patches using update_kernel script.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Replace NETGEAR_KERNEL_MAGIC by UIMAGE_MAGIC to better match the
variable's purpose. This allows to drop the custom
Build/netgear-uImage.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
[keep UIMAGE_MAGIC definitions even for default value]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
FCC ID: A8J-EAP300A
Engenius EAP300 v2 is an indoor wireless access point with a
100/10-BaseT ethernet port, 2.4 GHz wireless, internal antennas,
and 802.3af PoE.
**Specification:**
- AR9341
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 64 MB RAM
- UART at J1 (populated)
- Ethernet port with POE
- internal antennas
- 3 LEDs, 1 button (power, eth, wlan) (reset)
**MAC addresses:**
phy0 *:d3 art 0x1002 (label)
eth0 *:d4 art 0x0/0x6
**Installation:**
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, can cause kernel loop or halt
The easiest way to return to the OEM software is the Failsafe image
If you dont have a serial cable, you can ssh into openwrt and run
`mtd -r erase fakeroot`
Wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery** (unstable / not reliable):
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board while holding or pressing reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of EAP300 v2 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel size to be no greater than 1536k
and otherwise the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[clarify MAC address section, bump PKG_RELEASE for uboot-envtools]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Manually rebased patches:
ath79/patches-5.4/910-unaligned_access_hacks.patch
bcm27xx/patches-5.4/950-0135-spi-spi-bcm2835-Disable-forced-software-CS.patch
bcm27xx/patches-5.4/950-0414-SQUASH-Fix-spi-driver-compiler-warnings.patch
ipq806x/patches-5.4/093-4-v5.8-ipq806x-PCI-qcom-Use-bulk-clk-api-and-assert-on-error.patch
Removed since could be reverse-applied by quilt and found to be included upstream:
ipq806x/patches-5.4/096-PCI-qcom-Make-sure-PCIe-is-reset-before-init-for-rev.patch
All modifications made by update_kernel.sh
Build system: x86_64
Build-tested: ipq806x/R7800, ath79/generic, bcm27xx/bcm2711
Run-tested: ipq806x/R7800
No dmesg regressions, everything functional
Signed-off-by: John Audia <graysky@archlinux.us>
[refresh altered targets after rebase]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
qca9558_devolo_dvl1xxx.dtsi contains device specific nodes which
are inherited for some DTS files and overwritten for others.
This is considered confusing, so move the relevant nodes/properties
to the devices and only keep the shared stuff in the DTSI.
Signed-off-by: Yanase Yuki <dev@zpc.sakura.ne.jp>
[clarify commit title/message, move &gmac_config in DTS]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
TP-Link EAP225 v3 is an AC1350 (802.11ac Wave-2) ceiling mount access
point. Serial port access for debricking requires fine soldering.
Device specifications:
* SoC: QCA9563 @ 775MHz
* RAM: 128MiB DDR2
* Flash: 16MiB SPI-NOR
* Wireless 2.4GHz (SoC): b/g/n, 3x3
* Wireless 5Ghz (QCA9886): a/n/ac, 2x2 MU-MINO
* Ethernet (AR8033): 1× 1GbE, 802.3at PoE
Flashing instructions:
* ssh into target device and run `cliclientd stopcs`
* Upgrade with factory image via web interface
Debricking:
* Serial port can be soldered on PCB J3 (1: TXD, 2: RXD, 3: GND, 4: VCC)
* Bridge unpopulated resistors R225 (TXD) and R237 (RXD).
Do NOT bridge R230.
* Use 3.3V, 115200 baud, 8n1
* Interrupt bootloader by holding CTRL+B during boot
* tftp initramfs to flash via LuCI web interface
setenv ipaddr 192.168.1.1 # default, change as required
setenv serverip 192.168.1.10 # default, change as required
tftp 0x80800000 initramfs.bin
bootelf $fileaddr
MAC addresses:
MAC address (as on device label) is stored in device info partition at
an offset of 8 bytes. ath9k device has same address as ethernet, ath10k
uses address incremented by 1.
From OEM boot log:
Using interface ath0 with hwaddr b0:...:3e and ssid "..."
Using interface ath10 with hwaddr b0:...:3f and ssid "..."
Tested by forum user blinkstar88
Signed-off-by: Sander Vanheule <sander@svanheule.net>
TP-Link EAP225-Outdoor v1 is an AC1200 (802.11ac Wave-2) pole or wall
mount access point. Debricking requires access to the serial port, which
is non-trivial.
Device specifications:
* SoC: QCA9563 @ 775MHz
* Memory: 128MiB DDR2
* Flash: 16MiB SPI-NOR
* Wireless 2.4GHz (SoC): b/g/n 2x2
* Wireless 5GHz (QCA9886): a/n/ac 2x2 MU-MIMO
* Ethernet (AR8033): 1× 1GbE, PoE
Flashing instructions:
* ssh into target device with recent (>= v1.6.0) firmware
* run `cliclientd stopcs` on target device
* upload factory image via web interface
Debricking:
To recover the device, you need access to the serial port. This requires
fine soldering to test points, or the use of probe pins.
* Open the case and solder wires to the test points: RXD, TXD and TPGND4
* Use a 3.3V UART, 115200 baud, 8n1
* Interrupt bootloader by holding ctrl+B during boot
* upload initramfs via built-in tftp client and perform sysupgrade
setenv ipaddr 192.168.1.1 # default, change as required
setenv serverip 192.168.1.10 # default, change as required
tftp 0x80800000 initramfs.bin
bootelf $fileaddr
MAC addresses:
MAC address (as on device label) is stored in device info partition at
an offset of 8 bytes. ath9k device has same address as ethernet, ath10k
uses address incremented by 1.
From stock ifconfig:
ath0 Link encap:Ethernet HWaddr D8:...:2E
ath10 Link encap:Ethernet HWaddr D8:...:2F
br0 Link encap:Ethernet HWaddr D8:...:2E
eth0 Link encap:Ethernet HWaddr D8:...:2E
Tested by forum user PolynomialDivision on firmware v1.7.0.
UART access tested by forum user arinc9.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
TP-Link EAP245 v1 is an AC1750 (802.11ac Wave-1) ceiling mount access point.
Device specifications:
* SoC: QCA9563 @ 775MHz
* RAM: 128MiB DDR2
* Flash: 16MiB SPI-NOR
* Wireless 2.4GHz (SoC): b/g/n, 3x3
* Wireless 5Ghz (QCA9880): a/n/ac, 3x3
* Ethernet (AR8033): 1× 1GbE, 802.3at PoE
Flashing instructions:
* Upgrade the device to firmware v1.4.0 if necessary
* Exploit the user management page in the web interface to start telnetd
by changing the username to `;/usr/sbin/telnetd -l/bin/sh&`.
* Immediately change the malformed username back to something valid
(e.g. 'admin') to make ssh work again.
* Use the root shell via telnet to make /tmp world writeable (chmod 777)
* Extract /usr/bin/uclited from the device via ssh and apply the binary
patch listed below. The patch is required to prevent `uclited -u` in
the last step from crashing.
* Copy the patched uclited programme back to the device at /tmp/uclited
(via ssh)
* Upload the factory image to /tmp/upgrade.bin (via ssh)
* Run `chmod +x /tmp/uclited && /tmp/uclited -u` to install OpenWrt.
--- xxd uclited
+++ xxd uclited-patched
@@ -53796,7 +53796,7 @@
000d2240: 8c44 0000 0320 f809 0000 0000 8fbc 0010 .D... ..........
000d2250: 8fa6 0a4c 02c0 2821 8f82 87b8 0000 0000 ...L..(!........
-000d2260: 8c44 0000 0c13 45e0 27a7 0018 8fbc 0010 .D....E.'.......
+000d2260: 8c44 0000 2402 0000 0000 0000 8fbc 0010 .D..$...........
000d2270: 1040 001d 0000 1821 8f99 8374 3c04 0058 .@.....!...t<..X
000d2280: 3c05 0056 2484 a898 24a5 9a30 0320 f809 <..V$...$..0. ..
Debricking:
* Serial port can be soldered on PCB J3 (1: TXD, 2: RXD, 3: GND, 4: VCC)
* Bridge unpopulated resistors R225 (TXD) and R237 (RXD).
Do NOT bridge R230.
* Use 3.3V, 115200 baud, 8n1
* Interrupt bootloader by holding CTRL+B during boot
* tftp initramfs to flash via the LuCI web interface
setenv ipaddr 192.168.1.1 # default, change as required
setenv serverip 192.168.1.10 # default, change as required
tftp 0x80800000 initramfs.bin
bootelf $fileaddr
Tested on the EAP245 v1 running the latest firmware (v1.4.0). The binary
patch might not apply to uclited from other firmware versions.
EAP245 v1 device support was originally developed and maintained by
Julien Dusser out-of-tree. This patch and "ath79: prepare for 1-port
TP-Link EAP2x5 devices" are based on that work.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
TP-Link has developed a number of access points based on the AP152
reference board. In the EAP-series of 802.11ac access points, this
includes the following devices with one ethernet port:
* EAP225 v1/v2
* EAP225 v3
* EAP225-Outdoor v1
* EAP245 v1
Since the only differences between these devices are the ath10k wireless
radios and LEDs, a common base is provided for the overlapping support
requirements.
Hardware commonalities:
* SoC: QCA9563-AL3A MIPS 74kc v5.0 @ 775MHz, AHB @ 258MHz
* RAM: 128MiB DDR2 @ 650MHz
* Flash: 16MiB SPI NOR
* Wi-Fi 2.4GHz: provided by SoC
* Wi-Fi 5Ghz: ath10k chip on PCIe
* Ethernet: AR8033-AL1A, one 1GbE port (802.3at PoE)
Signed-off-by: Sander Vanheule <sander@svanheule.net>
This commit add a workaround for non working SGMII link observed on some
QCA956x SoCs. The workaround originates part from the U-Boot source code
from QCA, part from the implementation from TP-Link found in the GPL
tarball for the EAP245v1.
Extends commit 0d416a8d3b for QCA956x.
Note that reset is the same on QCA955x and QCA956x, same register offset
and values.
Auto calibration is done on u-boot, but always fall back to default value
0x7. Add a DTS entry serdes-cal in case a device require another value.
Signed-off-by: Julien Dusser <julien.dusser@free.fr>
[Sander Vanheule:
Minor code style fixes,
Remove hunk adding qca956x-serdes-fixup to a missing DTS,
Remove variable err that was only assigned,
Rename function to sgmii_serdes_init,
Lower priority of serdes call message to pr_debug]
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Some bootloaders do not set up gmac0 properly, leaving it disconnected
from the sgmii interface. If the user specificies phy-mode sgmii, then
use the gmac-config/device node to ensure the mux is configured
correctly.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
New batches of the R36A board series might no longer keep separated
Ethernet MAC addresses stored in flash. Use same approach as on the
N2Q and calculate Ethernet MACs from WLAN one which is kept in ART.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
ALFA Network Pi-WiFi4 is a Qualcomm QCA9531 v2 based, high-power 802.11n
WiFi board in Raspberry Pi 3B shape, equipped with 1x FE and 4x USB 2.0.
Specifications:
- Qualcomm/Atheros QCA9531 v2
- 650/400/200 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16+ MB of flash (SPI NOR)
- 1x 10/100 Mbps Ethernet
- 2T2R 2.4 GHz Wi-Fi with Qorvo RFFM8228P FEM
- 2x IPEX/U.FL connectors on PCB
- 4x USB 2.0 Type-A
- Genesys Logic GL850G 4-port USB HUB
- USB power is controlled by GPIO
- 5x LED (3x on PCB, 2x in RJ45, 4x driven by GPIO)
- 1x button (reset)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- 1x micro USB Type-B for power and system console (Holtek HT42B534)
- UART and GPIO (8-pin, 1.27 mm pitch) header on PCB
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on LEDE/OpenWrt. Alternatively, you can use web recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
device, wait for first blink of all LEDs (indicates network setup),
then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
CPU: Atheros AR9342 rev 3 SoC
RAM: 64 MB DDR2
Flash: 16 MB NOR SPI
WLAN 2.4GHz: Atheros AR9342 v3 (ath9k)
WLAN 5.0GHz: QCA988X
Ports: 2x GbE
Flashing procedure is identical to other ubnt devices.
https://openwrt.org/toh/ubiquiti/common
Flashing through factory firmware
1. Ensure firmware version v8.7.0 is installed.
Up/downgrade to this exact version.
2. Patch fwupdate.real binary using
`hexdump -Cv /bin/ubntbox | sed 's/14 40 fe 27/00 00 00 00/g' | \
hexdump -R > /tmp/fwupdate.real`
3. Make the patched fwupdate.real binary executable using
`chmod +x /tmp/fwupdate.real`
4. Copy the squashfs factory image to /tmp on the device
5. Flash OpenWrt using `/tmp/fwupdate.real -m <squashfs-factory image>`
6. Wait for the device to reboot
(copied from Ubiquiti NanoBeam AC and modified)
To keep it consistent, we will add the gen1 variant to
the nanobeam ac gen1.
Signed-off-by: Nick Hainke <vincent@systemli.org>
