Commit Graph

193 Commits

Author SHA1 Message Date
INAGAKI Hiroshi
2791ee79fa ath79: add support for ELECOM WAB-S600-PS
ELECOM WAB-S600-PS is a 2.4/5 GHz band 11n (Wi-Fi 4) access point, based
on QCA9557.
This device also supports 11ac (Wi-Fi 5) with the another official
firmware.

Specification:

- SoC              : Qualcomm Atheros QCA9557
- RAM              : DDR2 128 MiB (2x Winbond W9751G6KB251)
- Flash            : SPI-NOR 16 MiB (Macronix MX25L12835FMI-10G)
- WLAN             : 2.4/5 GHz 2T2R
  - 2.4 GHz        : Qualcomm Atheros QCA9557 (SoC)
  - 5 GHz          : Qualcomm Atheros QCA9882
- Ethernet         : 2x 10/100/1000 Mbps
  - phy ("PD")     : Atheros AR8035
  - phy ("PSE")    : Atheros AR8033
- LEDs/keys (GPIO) : 3x/3x
- UART             : 1x RJ-45 port
  - "SERVICE"      : TTL (3.3V)
    - port         : ttyS0
    - assignment   : 1:3.3V, 2:GND, 3:TX, 4:RX
    - settings     : 115200n8
    - note         : no compatibility with "Cisco console cable"
- Buzzer           : 1x GPIO-controlled
- USB              : 1x USB 2.0 Type-A
- Power            : DC jack or PoE
  - DC jack        : 12 VDC, 1 A (device only, rating)
  - PoE            : 802.3af/at, 48 VDC, 0.25 A (device only, rating)
  - note           : supports 802.3af supply on PSE (downstream) port
                     when powered by DC adapter or 802.3at PoE

Flash instruction using factory.bin image:

1. Boot WAB-S600-PS without no upstream connection (or PoE connection
   without DHCP)
2. Access to the WebUI ("http://192.168.3.1") on the device and open
   firmware update page
   ("ツールボックス" -> "ファームウェア更新")
3. Select the OpenWrt factory.bin image and click update
   ("アップデート") button
4. Wait ~120 seconds to complete flashing

Revert to OEM firmware:

1. Download the latest OEM firmware
2. Remove 128 bytes(0x80) header from firmware image
3. Decode by xor with a pattern "8844a2d168b45a2d" (hex val)
4. Upload the decoded firmware to the device
5. Flash to "firmware" partition by mtd command
6. Reboot

Notes:

- To use the "SERVICE" port, the connection of 3.3V line is also
  required to enable console output.
  The uart line of "SERVICE" is branched out from the internal pin
  header with 74HC126D and 3.3V line is connected to OE pin on it.

- The same PCB is used with WAB-S1167-PS.

- To supply 802.3af PoE on "PSE" port when powered by DC adapter, 12 VDC
  3.5 A adapter is recommended. (official: WAB-EX-ADP1)

MAC addresses:

Ethernet (PD, PSE): BC:5C:4C:xx:xx:7C (Config, ethaddr (text))
2.4GHz            : BC:5C:4C:xx:xx:7C (Config, ethaddr (text))
5GHz              : BC:5C:4C:xx:xx:7D

[original work of common dtsi part for WAB-I1750-PS]
Signed-off-by: Yanase Yuki <dev@zpc.st>
[adding support for WAB-S600-PS]
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2024-03-02 14:08:08 +01:00
Shiji Yang
0db4f9785c
ath79: convert ath10k calibration data to NVMEM (ASCII MAC)
This patch converts ath10k calibration data to NVMEM format for
wave 1 devices with mtd ASCII MAC address. The "calibration"
NVMEM cell size is 0x844. All unportable MAC address settings
have been moved to '10_fix_wifi_mac' scripts.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2024-02-01 17:09:03 +01:00
Shiji Yang
2f1c62e5af
ath79: convert ath10k calibration data to NVMEM (binary MAC)
This patch converts ath10k calibration data to NVMEM format for
wave 1 devices with mtd binary MAC address. The "calibration"
NVMEM cell size is 0x844. The MAC addresses are assigned via dts.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2024-02-01 17:09:02 +01:00
Shiji Yang
d07cec6b2b
ath79: convert ath10k calibration data to NVMEM (built-in MAC)
This patch converts ath10k calibration data to NVMEM format for
wave 1 devices with built-in MAC address. The "calibration"
NVMEM cell size is 0x844.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2024-02-01 17:09:02 +01:00
Shiji Yang
7e71eef5ed
ath79: convert ath10k pre-calibration data to NVMEM (ASCII MAC)
This patch converts ath10k pre-calibration data to NVMEM format for
wave 2 devices with mtd ASCII MAC address. The "pre-calibration"
NVMEM cell size is 0x2f20. All unportable MAC address settings have
been moved to '10_fix_wifi_mac' scripts.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2024-02-01 17:09:02 +01:00
Shiji Yang
348e0ee157
ath79: convert ath10k pre-calibration data to NVMEM (binary MAC)
This patch converts ath10k pre-calibration data to NVMEM format for
wave 2 devices with mtd binary MAC address. The "pre-calibration"
NVMEM cell size is 0x2f20. The MAC addresses are assigned via dts.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2024-02-01 17:09:02 +01:00
Shiji Yang
650d37a809
ath79: convert ath10k pre-calibration data to NVMEM (built-in MAC)
This patch converts ath10k pre-calibration data to NVMEM format for
wave 2 devices with built-in MAC address. The "pre-calibration"
NVMEM cell size is 0x2f20.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2024-02-01 17:09:01 +01:00
Shiji Yang
3c7ce20d5c
ath79: add back board-2.bin to COMFAST devices
The ath10k driver will load both pre-calibration data and board-2.bin
if board-2.bin exists. So it's not necessary to remove it. And this
change won't increase jffs2 image size.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2024-02-01 17:09:01 +01:00
David Bauer
bf94e0a383 ath79: add support for UniFi UK-Ultra
Hardware
--------
CPU:   Qualcomm Atheros QCA9563
RAM:   128M DDR2
FLASH: 16MB SPI-NOR
WiFi:  Qualcomm Atheros QCA9563 2x2:2 802.11n 2.4GHz
       Qualcomm Atheros QCA9880 2x2:2 802.11ac 5GHz

Antennas
--------
The device features internal antennas as well as external antenna
connectors. By default, the internal antennas are used.

Two GPIOs are exported by name, which can be used to control the
antenna-path mux. Writing a logical 0 enables the external antenna
connectors.

Installation
------------
1. Download the OpenWrt sysupgrade image to the device. You can use scp
   for this task. The default username and password are "ubnt" and the
   device is reachable at 192.168.1.20.

   $ scp -O openwrt-sysupgrade.bin ubnt@192.168.1.20:/tmp/firmware.bin

2. Connect to the device using SSH.

   $ ssh ubnt@192.168.1.20

3. Disable the write-protect

   $ echo "5edfacbf" > /proc/ubnthal/.uf

4. Verify kernel0 and kernel1 match mtd2 and mtd3

   $ cat /proc/mtd

5. Write the sysupgrade image to kernel0 and kernel1

   $ dd if=/tmp/firmware.bin of=/dev/mtdblock2
   $ dd if=/tmp/firmware.bin of=/dev/mtdblock3

6. Write the bootselect flag to boot from kernel0

   $ dd if=/dev/zero bs=1 count=1 of=/dev/mtd4

7. Reboot the device

   $ reboot

Signed-off-by: David Bauer <mail@david-bauer.net>
2024-01-07 23:06:17 +01:00
Lech Perczak
32098554d9
ath79: fortinet-fap-221-b: convert to nvmem-layout
Now that MAC address parser supports the hex format (without
delimiters), use the canonical MAC address stored in U-boot partition.
Get rid of the userspace adjustments which are no longer necessary.
While at that, move the mac-base to the common part, as it is again
exactly the same in both models.

And convert ART partition too - keep that one separate, as calibration
data length differs between the models.

Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2023-11-27 00:34:49 +01:00
Daniel Linjama
a39a49e323 ath79: add support for D-Link COVR-P2500 A1
Specifications:
* QCA9563, 16 MiB flash, 128 MiB RAM, 2T2R 802.11n
* QCA9886 2T2R 801.11ac Wave 2
* QCA7550 Homeplug AV2 1300
* AR8337, 3 Gigabit ports (1, 2: LAN; 3: WAN)

To make use of PLC functionality, firmware needs to be
provided via plchost (QCA7550 comes without SPI NOR),
patched with the Network Password and MAC.

Flashing via OEM Web Interface
* Flash 'factory.bin' using web-interface
* Wait until firmware succesfully installed and device booted
* Hold down reset button to reset factory defaults (~10 seconds)

Flashing via Recovery Web Interface:
* Hold down reset button during power-on (~10 seconds)
* Recovery Web UI is at 192.168.0.50, no DHCP.
* Flash 'recovery.bin' with
  scripts/flashing/dlink_recovery_upload.py
  (Recovery Web UI does not work with modern OSes)

Return to stock
* Hold down reset button during power-on (~10 seconds)
* Recovery Web UI is at 192.168.0.50, no DHCP.
* Flash unencrypted stock firmware with
  scripts/flashing/dlink_recovery_upload.py
  (Recovery Web UI does not work with modern OSes)

Co-developed-by: Sebastian Schaper <openwrt@sebastianschaper.net>
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
Signed-off-by: Daniel Linjama <daniel@dev.linjama.com>
2023-11-23 00:26:28 +01:00
Felix Baumann
9e86a96af5 ath79: move ubnt-xm 64M RAM boards back to generic
return ubnt_rocket-m and ubnt_powerbridge-m back to ath79-generic
They have enough RAM-ressources to not be considered as tiny.

This reverts the commit f4415f7635 partially

Signed-off-by: Felix Baumann <felix.bau@gmx.de>
2023-07-19 08:04:08 +02:00
Joao Henrique Albuquerque
935a63c59d ath79: add support for COMFAST CF-E380AC v2
COMFAST CF-E380AC v2 is a ceiling mount AP with PoE
support, based on Qualcomm/Atheros QCA9558+QCA9880+AR8035.

There are two versions of this model, with different RAM
and U-Boot mtd partition sizes:
- v1: 128 MB of RAM, 128 KB U-Boot image size
- v2: 256 MB of RAM, 256 KB U-Boot image size

Version number is available only inside vendor GUI,
hardware and markings are the same.

Short specification:

- 720/600/200 MHz (CPU/DDR/AHB)
- 1x 10/100/1000 Mbps Ethernet, with PoE support
- 128 or 256 MB of RAM (DDR2)
- 16 MB of FLASH
- 3T3R 2.4 GHz, with external PA (SE2576L), up to 28 dBm
- 3T3R 5 GHz, with external PA (SE5003L1), up to 30 dBm
- 6x internal antennas
- 1x RGB LED, 1x button
- UART (T11), LEDs/GPIO (J7) and USB (T12) headers on PCB
- external watchdog (Pericon Technology PT7A7514)

COMFAST MAC addresses :
Though the OEM firmware has four adresses in the usual locations,
it appears that the assigned addresses are just incremented in a different way:

Interface    address    location
Lan              *:00           0x0
2.4g             *:0A           n/a (0x0 + 10)
5g               *:02           0x6

Unused Addresses found in ART hexdump
address    location
*:01           0x1002
*:03           0x5006

To keep code consistency the MAC address assignments are made based on increments of the one found in 0x0;

Signed-off-by: Joao Henrique Albuquerque <joaohccalbu@gmail.com>
2023-07-01 16:11:27 +02:00
Maximilian Martin
906e2a1b99 ath79: Add support for MOXA AWK-1137C
Device specifications:
======================

* Qualcomm/Atheros AR9344
* 128 MB of RAM
* 16 MB of SPI NOR flash
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4/5 GHz Wi-Fi
* 4x GPIO-LEDs (1x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* 2x fast ethernet
  - lan1
    + builtin switch port 1
    + used as WAN interface
  - lan2
    + builtin switch port 2
    + used as LAN interface
* 9-30V DC
* external antennas

Flashing instructions:
======================

Log in to https://192.168.127.253/
   Username: admin
   Password: moxa

Open Maintenance > Firmware Upgrade and install the factory image.

Serial console access:
======================

Connect a RS232-USB converter to the maintenance port.
   Pinout: (reset button left) [GND] [NC] [RX] [TX]

Firmware Recovery:
==================

When the WLAN and SYS LEDs are flashing, the device is in recovery mode.

Serial console access is required to proceed with recovery.

Download the original image from MOXA and rename it to 'awk-1137c.rom'.
Set up a TFTP server at 192.168.127.1 and connect to a lan port.

Follow the instructions on the serial console to start the recovery.

Signed-off-by: Maximilian Martin <mm@simonwunderlich.de>
2023-06-25 12:59:26 +02:00
David Bauer
1b467a902e ath79: add support for Aruba AP-115
Hardware
========

CPU   Qualcomm Atheros QCA9558
RAM   256MB DDR2
FLASH 2x 16M SPI-NOR (Macronix MX25L12805D)
WIFI  Qualcomm Atheros QCA9558
      Atheros AR9590

Installation
============

1. Attach to the serial console of the AP-105.
   Interrupt autoboot and change the U-Boot env.

   $ setenv rb_openwrt "setenv ipaddr 192.168.1.1;
     setenv serverip 192.168.1.66;
     netget 0x80060000 ap115.bin; go 0x80060000"
   $ setenv fb_openwrt "bank 1;
     cp.b 0xbf100040 0x80060000 0x10000; go 0x80060000"
   $ setenv bootcmd "run fb_openwrt"
   $ saveenv

2. Load the OpenWrt initramfs image on the device using TFTP.
   Place the initramfs image as "ap105.bin" in the TFTP server
   root directory, connect it to the AP and make the server reachable
   at 192.168.1.66/24.

   $ run rb_openwrt

3. Once OpenWrt booted, transfer the sysupgrade image to the device
   using scp and use sysupgrade to install the firmware.

Signed-off-by: David Bauer <mail@david-bauer.net>
2023-06-23 00:20:56 +02:00
Jan Forman
2f4b6d0f89 ath79: Convert calibration data to nvmem
For D-link DIR-859 and DIR-869
Replace the mtd-cal-data by an nvmem-cell.
Add the PCIe node for the ath10k radio to the devicetree.
Thanks to DragonBlue for this patch

Signed-off-by: Jan Forman <jforman@tuta.io>
2023-05-20 13:43:09 +02:00
Edward Chow
de3d60b982 ath79: calibrate dlink dir-825 b1 with nvmem
Driver for both soc (2.4GHz Wifi) and pci (5 GHz) now pull the calibration
data from the nvmem subsystem.

This allows us to move the userspace caldata extraction for the pci-e ath9k
supported wifi into the device-tree definition of the device.

Currently, only ethernet devices uses the mac address of
"mac-address-ascii" cells, while PCI ath9k devices uses the mac address
within calibration data.

Signed-off-by: Edward Chow <equu@openmail.cc>
(restored switch configuration in 02_network, integrated caldata into
partition)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2023-03-26 16:39:37 +02:00
Michael Pratt
f545caf001 ath79: convert Engenius EPG5000 radios to nvmem-cells
Use nvmem kernel subsystem to pull radio calibration data
with the devicetree instead of userspace scripts.

Existing blocks for caldata_extract are reordered alphabetically.

MAC address is set using the hotplug script.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-02-12 18:07:31 +01:00
Michael Pratt
f9c28222c8 ath79: add support for Senao Engenius ESR1200
FCC ID: A8J-ESR900

Engenius ESR1200 is an indoor wireless router with
a gigabit ethernet switch, dual-band wireless,
internal antenna plates, and a USB 2.0 port

**Specification:**

  - QCA9557 SOC		2.4 GHz, 2x2
  - QCA9882 WLAN	PCIe mini card, 5 GHz, 2x2
  - QCA8337N SW		4 ports LAN, 1 port WAN
  - 40 MHz clock
  - 16 MB FLASH		MX25L12845EMI-10G
  - 2x 64 MB RAM
  - UART at J1		populated, RX grounded
  - 6 internal antenna plates (omni-directional)
  - 5 LEDs, 1 button (power, 2G, 5G, WAN, WPS) (reset)

**MAC addresses:**

  Base MAC address labeled as "MAC ADDRESS"
  MAC "wanaddr" is not similar to "ethaddr"

  eth0 *:c8 MAC u-boot-env ethaddr
  phy0 *:c8 MAC u-boot-env ethaddr
  phy1 *:c9 --- u-boot-env ethaddr +1
  WAN  *:66:44  u-boot-env wanaddr

**Serial Access:**

  RX on the board for UART is shorted to ground by resistor R176
  therefore it must be removed to use the console
  but it is not necessary to remove to view boot log

  optionally, R175 can be replaced with a solder bridge short

  the resistors R175 and R176 are next to the UART RX pin

**Installation:**

  Method 1: Firmware upgrade page

    OEM webpage at 192.168.0.1
    username and password "admin"
    Navigate to Settings (gear icon) --> Tools --> Firmware
    select the factory.bin image
    confirm and wait 3 minutes

  Method 2: TFTP recovery

    Follow TFTP instructions using initramfs.bin
    use sysupgrade.bin to flash using openwrt web interface

**Return to OEM:**

  MTD partitions should be backed up before flashing
  using TFTP to boot openwrt without overwriting flash

  Alternatively, it is possible to edit OEM firmware images
  to flash MTD partitions in openwrt to restore OEM firmware
  by removing the OEM header and writing the rest to "firmware"

**TFTP recovery:**

  Requires serial console, reset button does nothing at boot

  rename initramfs.bin to 'uImageESR1200'
  make available on TFTP server at 192.168.99.8
  power board, interrupt boot by pressing '4' rapidly
  execute tftpboot and bootm

**Note on ETH switch registers**

  Registers must be written to the ethernet switch
  in order to set up the switch's MAC interface.
  U-boot can write the registers on it's own
  which is needed, for example, in a TFTP transfer.

  The register bits from OEM for the QCA8337 switch
  can be read from interrupted boot (tftpboot, bootm)
  by adding print lines in the switch driver ar8327.c
  before 'qca,ar8327-initvals' is parsed from DTS and written.
  for example:

    pr_info("0x04 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD0_MODE));

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-02-12 18:07:31 +01:00
Michael Pratt
96c2119dba ath79: add support for Senao Engenius ESR1750
FCC ID: A8J-ESR1750

Engenius ESR1750 is an indoor wireless router with
a gigabit ethernet switch, dual-band wireless,
internal antenna plates, and a USB 2.0 port

**Specification:**

  - QCA9558 SOC		2.4 GHz, 3x3
  - QCA9880 WLAN	PCIe mini card, 5 GHz, 3x3
  - QCA8337N SW		4 ports LAN, 1 port WAN
  - 40 MHz clock
  - 16 MB FLASH		MX25L12845EMI-10G
  - 2x 64 MB RAM
  - UART at J1		populated, RX grounded
  - 6 internal antenna plates (omni-directional)
  - 5 LEDs, 1 button (power, 2G, 5G, WAN, WPS) (reset)

**MAC addresses:**

  Base MAC address labeled as "MAC ADDRESS"
  MAC "wanaddr" is similar to "ethaddr"

  eth0 *:58 MAC u-boot-env ethaddr
  phy0 *:58 MAC u-boot-env ethaddr
  phy1 *:59 --- u-boot-env ethaddr +1
  WAN  *:10:58  u-boot-env wanaddr

**Serial Access:**

  RX on the board for UART is shorted to ground by resistor R176
  therefore it must be removed to use the console
  but it is not necessary to remove to view boot log

  optionally, R175 can be replaced with a solder bridge short

  the resistors R175 and R176 are next to the UART RX pin

**Installation:**

  Method 1: Firmware upgrade page

    NOTE: ESR1750 might require the factory.bin
      for ESR1200 instead, OEM provides 1 image for both.

    OEM webpage at 192.168.0.1
    username and password "admin"
    Navigate to Settings (gear icon) --> Tools --> Firmware
    select the factory.bin image
    confirm and wait 3 minutes

  Method 2: TFTP recovery

    Follow TFTP instructions using initramfs.bin
    use sysupgrade.bin to flash using openwrt web interface

**Return to OEM:**

  MTD partitions should be backed up before flashing
  using TFTP to boot openwrt without overwriting flash

  Alternatively, it is possible to edit OEM firmware images
  to flash MTD partitions in openwrt to restore OEM firmware
  by removing the OEM header and writing the rest to "firmware"

**TFTP recovery:**

  Requires serial console, reset button does nothing at boot

  rename initramfs.bin to 'uImageESR1200'
  make available on TFTP server at 192.168.99.8
  power board, interrupt boot by pressing '4' rapidly
  execute tftpboot and bootm

**Note on ETH switch registers**

  Registers must be written to the ethernet switch
  in order to set up the switch's MAC interface.
  U-boot can write the registers on it's own
  which is needed, for example, in a TFTP transfer.

  The register bits from OEM for the QCA8337 switch
  can be read from interrupted boot (tftpboot, bootm)
  by adding print lines in the switch driver ar8327.c
  before 'qca,ar8327-initvals' is parsed from DTS and written.
  for example:

    pr_info("0x04 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD0_MODE));

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-02-12 18:07:31 +01:00
Michael Pratt
2f99f7e2d0 ath79: add support for Senao Engenius ESR900
FCC ID: A8J-ESR900

Engenius ESR900 is an indoor wireless router with
a gigabit ethernet switch, dual-band wireless,
internal antenna plates, and a USB 2.0 port

**Specification:**

  - QCA9558 SOC		2.4 GHz, 3x3
  - AR9580 WLAN		PCIe on board, 5 GHz, 3x3
  - AR8327N SW		4 ports LAN, 1 port WAN
  - 40 MHz clock
  - 16 MB FLASH		MX25L12845EMI-10G
  - 2x 64 MB RAM
  - UART at J1		populated, RX grounded
  - 6 internal antenna plates (omni-directional)
  - 5 LEDs, 1 button (power, 2G, 5G, WAN, WPS) (reset)

**MAC addresses:**

  Base MAC address labeled as "MAC ADDRESS"
  MAC "wanaddr" is not similar to "ethaddr"

  eth0 *:06 MAC u-boot-env ethaddr
  phy0 *:06 MAC u-boot-env ethaddr
  phy1 *:07 --- u-boot-env ethaddr +1
  WAN  *:6E:81  u-boot-env wanaddr

**Serial Access:**

  RX on the board for UART is shorted to ground by resistor R176
  therefore it must be removed to use the console
  but it is not necessary to remove to view boot log

  optionally, R175 can be replaced with a solder bridge short

  the resistors R175 and R176 are next to the UART RX pin

**Installation:**

  Method 1: Firmware upgrade page

    OEM webpage at 192.168.0.1
    username and password "admin"
    Navigate to Settings (gear icon) --> Tools --> Firmware
    select the factory.bin image
    confirm and wait 3 minutes

  Method 2: TFTP recovery

    Follow TFTP instructions using initramfs.bin
    use sysupgrade.bin to flash using openwrt web interface

**Return to OEM:**

  MTD partitions should be backed up before flashing
  using TFTP to boot openwrt without overwriting flash

  Alternatively, it is possible to edit OEM firmware images
  to flash MTD partitions in openwrt to restore OEM firmware
  by removing the OEM header and writing the rest to "firmware"

**TFTP recovery:**

  Requires serial console, reset button does nothing at boot

  rename initramfs.bin to 'uImageESR900'
  make available on TFTP server at 192.168.99.8
  power board, interrupt boot by pressing '4' rapidly
  execute tftpboot and bootm

**Note on ETH switch registers**

  Registers must be written to the ethernet switch
  in order to set up the switch's MAC interface.
  U-boot can write the registers on it's own
  which is needed, for example, in a TFTP transfer.

  The register bits from OEM for the AR8327 switch
  can be read from interrupted boot (tftpboot, bootm)
  by adding print lines in the switch driver ar8327.c
  before 'qca,ar8327-initvals' is parsed from DTS and written.
  for example:

    pr_info("0x04 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD0_MODE));

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-02-12 18:07:31 +01:00
Edward Chow
2a20dc717a ath79: calibrate dlink dir-825 c1 and dir-835 a1 with nvmem
Driver for both soc (2.4GHz Wifi) and pci (5 GHz) now pull the calibration
data from the nvmem subsystem.

This allows us to move the userspace caldata extraction for the pci-e ath9k
supported wifi into the device-tree definition of the device.

Currently, "mac-address-ascii" cells only works for ethernet and wmac devices,
so PCI ath9k device uses the old method to calibrate.

Signed-off-by: Edward Chow <equu@openmail.cc>
2023-01-28 21:28:25 +01:00
Wenli Looi
7396263680 ath79: convert Netgear EX7300 caldata to nvmem
Transition to specify caldata in the DTS.

Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
2023-01-25 00:42:52 +01:00
Wenli Looi
f0eb73a888 ath79: consolidate Netgear EX7300 series images
This change consolidates Netgear EX7300 series devices into two images
corresponding to devices that share the same manufacturer firmware
image. Similar to the manufacturer firmware, the actual device model is
detected at runtime. The logic is taken from the netgear GPL dumps in a
file called generate_board_conf.sh.

Hardware details for EX7300 v2 variants
---------------------------------------
SoC: QCN5502
Flash: 16 MiB
RAM: 128 MiB
Ethernet: 1 gigabit port
Wireless 2.4GHz (currently unsupported due to lack of ath9k support):
- EX6250 / EX6400 v2 / EX6410 / EX6420: QCN5502 3x3
- EX7300 v2 / EX7320: QCN5502 4x4
Wireless 5GHz:
- EX6250: QCA9986 3x3 (detected by ath10k as QCA9984 3x3)
- EX6400 v2 / EX6410 / EX6420 / EX7300 v2 / EX7320: QCA9984 4x4

Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
2023-01-25 00:42:52 +01:00
Stefan Kalscheuer
f193f2d1a0 ath79: convert UBNT Aircube AC WiFis to nvmem-cells
Pull the calibration data from the nvmem subsystem. This allows us to
move userspace caldata extraction into the device-tree definition.

Merge art into partition node.

Signed-off-by: Stefan Kalscheuer <stefan@stklcode.de>
2023-01-06 18:20:31 +01:00
Michael Pratt
e085812a7d ath79: add support for Fortinet FAP-221-B
FCC ID: U2M-CAP4100AG

Fortinet FAP-221-B is an indoor access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+

Hardware and board design from Senao

**Specification:**

 - AR9344 SOC		2G 2x2, 5G 2x2, 25 MHz CLK
 - AR9382 WLAN		2G 2x2 PCIe, 40 MHz CLK
 - AR8035-A PHY		RGMII, PoE+ IN, 25 MHz CLK
 - 16 MB FLASH		MX25L12845EMI-10G
 - 2x 32 MB RAM		W9725G6JB-25
 - UART at J11		populated, 9600 baud
 - 6 LEDs, 1 button	power, ethernet, wlan, reset

  Note:	ethernet LEDs are not enabled
	because a new netifd hotplug is required
	in order to operate like OEM.
	Board has 1 amber and 1 green
	for each of the 3 case viewports.

**MAC addresses:**

1 MAC Address in flash at end of uboot
ASCII encoded, no delimiters
Labeled as "MAC Address" on case
OEM firmware sets offsets 1 and 8 for wlan

  eth0 *:1e	uboot 0x3ff80
  phy0 *:1f	uboot 0x3ff80 +1
  phy1 *:26	uboot 0x3ff80 +8

**Serial Access:**

Pinout: (arrow) VCC GND RX TX

Pins are populated with a header and traces not blocked.
Bootloader is set to 9600 baud, 8 data, 1 stop.

**Console Access:**

Bootloader:

Interrupt boot with Ctrl+C
Press "k" and enter password "1"
OR
Hold reset button for 5 sec during power on
Interrupt the TFTP transfer with Ctrl+C

to print commands available, enter "help"

OEM:

default username is "admin", password blank
telnet is available at default address 192.168.1.2
serial is available with baud 9600

to print commands available, enter "help"
or tab-tab (busybox list of commands)

**Installation:**

Use factory.bin with OEM upgrade procedures
OR
Use initramfs.bin with uboot TFTP commands.
Then perform a sysupgrade with sysupgrade.bin

**TFTP Recovery:**

Using serial console, load initramfs.bin using TFTP
to boot openwrt without touching the flash.
TFTP is not reliable due to bugged bootloader,
set MTU to 600 and try many times.
If your TFTP server supports setting block size,
higher block size is better.
Splitting the file into 1 MB parts may be necessary

example:

$ tftpboot 0x80100000 image1.bin
$ tftpboot 0x80200000 image2.bin
$ tftpboot 0x80300000 image3.bin
$ tftpboot 0x80400000 image4.bin
$ tftpboot 0x80500000 image5.bin
$ tftpboot 0x80600000 image6.bin
$ bootm 0x80100000

**Return to OEM:**

The best way to return to OEM firmware
is to have a copy of the MTD partitions
before flashing Openwrt.

Backup copies should be made of partitions
"fwconcat0", "loader", and "fwconcat1"
which together is the same flash range
as OEM's "rootfs" and "uimage"
by loading an initramfs.bin
and using LuCI to download the mtdblocks.

It is also possible to extract from the
OEM firmware upgrade image by splitting it up
in parts of lengths that correspond
to the partitions in openwrt
and write them to flash,
after gzip decompression.

After writing to the firmware partitions,
erase the "reserved" partition and reboot.

**OEM firmware image format:**

Images from Fortinet for this device
ending with the suffix .out
are actually a .gz file

The gzip metadata stores the original filename
before compression, which is a special string
used to verify the image during OEM upgrade.

After gzip decompression, the resulting file
is an exact copy of the MTD partitions
"rootfs" and "uimage" combined in the same order and size
that they appear in /proc/mtd and as they are on flash.

OEM upgrade is performed by a customized busybox
with the command "upgrade".
Another binary, "restore"
is a wrapper for busybox's "tftp" and "upgrade".

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-01-06 15:34:07 +01:00
Nick Hainke
aa6c8c38ea ath79: convert Netgear WNDAP360 WiFis to nvmem-cells
Pull the calibration data from the nvmem subsystem. This allows us to
move userspace caldata extraction into the device-tree definition.

Merge art into partition node.

Signed-off-by: Nick Hainke <vincent@systemli.org>
2023-01-04 23:59:09 +01:00
Nick Hainke
a14170b6e9 ath79: fix calibration-art for some boards
"0x1000" looks suspicious. By looking at data provided
by @DragonBluep I was able to identify the correct size for
AR9380, AR9287 WiFis. Furthermore, PowerCloud Systems CAP324
has a AR9344 WiFi.

Signed-off-by: Nick Hainke <vincent@systemli.org>
2022-12-28 22:36:32 +01:00
Nick Hainke
af5306ba70 ath79: convert WiFis based on ar7241_ubnt_unifi.dtsi to nvmem-cells
Pull the calibration data from the nvmem subsystem. This allows us to
move userspace caldata extraction into the device-tree definition.

While working on it remove stale uboot partition label and merge art
into partition node.

Signed-off-by: Nick Hainke <vincent@systemli.org>
2022-12-17 20:48:57 +01:00
Nick Hainke
b7ad3c5c5d ath79: convert Buffalo WZR-HP-G302H A1A0 WiFis to nvmem-cells
Pull the calibration data from the nvmem subsystem. This allows us to
move userspace caldata extraction into the device-tree definition.

Merge art into partition node.

Signed-off-by: Nick Hainke <vincent@systemli.org>
2022-12-17 20:48:57 +01:00
Nick Hainke
d4ec4f9d0b ath79: convert OpenMesh OM2P v1 WiFis to nvmem-cells
Pull the calibration data from the nvmem subsystem. This allows us to
move userspace caldata extraction into the device-tree definition.

Merge art into partition node.

Signed-off-by: Nick Hainke <vincent@systemli.org>
2022-12-17 20:40:30 +01:00
Nick Hainke
f6ca84bf02 ath79: convert OpenMesh OM5P-AN WiFis to nvmem-cells
Pull the calibration data from the nvmem subsystem. This allows us to
move userspace caldata extraction into the device-tree definition.

Merge art into partition node.

Signed-off-by: Nick Hainke <vincent@systemli.org>
2022-12-17 20:40:30 +01:00
Nick Hainke
46077860c2 ath79: convert boards based on ar9344_openmesh_mr600.dtsi to nvmem-cells
Pull the calibration data from the nvmem subsystem. This allows us to
move userspace caldata extraction into the device-tree definition.

Merge art into partition node.

Signed-off-by: Nick Hainke <vincent@systemli.org>
2022-12-17 20:40:29 +01:00
Nick Hainke
08c114ee16 ath79: convert Winchannel WB2000 WiFis to nvmem-cells
Pull the calibration data from the nvmem subsystem. This allows us to
move userspace caldata extraction into the device-tree definition.

Signed-off-by: Nick Hainke <vincent@systemli.org>
(removed mtd-cal-data property, merged art + addr nodes back into
partition)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-12-15 15:45:47 +01:00
Nick Hainke
fd456106aa ath79: convert Ubiquiti UniFi AP Pro WiFis to nvmem-cells
Pull the calibration data from the nvmem subsystem. This allows us to
move userspace caldata extraction into the device-tree definition.

Signed-off-by: Nick Hainke <vincent@systemli.org>
(merged art node back into partition-node)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-12-15 15:45:47 +01:00
Nick Hainke
f63cf33aa7 ath79: convert OCEDO Raccoon WiFis to nvmem-cells
Pull the calibration data from the nvmem subsystem. This allows us to
move userspace caldata extraction into the device-tree definition.

Signed-off-by: Nick Hainke <vincent@systemli.org>
(merged art into partition node, removed stale uboot label)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-12-15 15:45:47 +01:00
Nick Hainke
783936c1f7 ath79: Mercury MW4530R v1 already uses nvmem-cells
Remove the caldata extraction in userspace. The board already uses
nvmem-cells since
commit e354b01baf ("ath79: calibrate all ar9344 tl-WDRxxxx with nvmem")

Signed-off-by: Nick Hainke <vincent@systemli.org>
2022-12-15 15:45:35 +01:00
Nick Hainke
4845b60525 ath79: convert boards based on senao_ap-dual.dtsi WiFis to nvmem-cells
Pull the calibration data from the nvmem subsystem. This allows us to
move userspace caldata extraction into the device-tree definition.

Signed-off-by: Nick Hainke <vincent@systemli.org>
2022-12-15 15:08:09 +01:00
Nick Hainke
21495c92dc ath79: convert Atheros DB120 WiFis to nvmem-cells
Pull the calibration data from the nvmem subsystem. This allows us to
move userspace caldata extraction into the device-tree definition.

Signed-off-by: Nick Hainke <vincent@systemli.org>
(merged art-node back into partition-node)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-12-15 15:08:09 +01:00
Nick Hainke
1b125aabf4 ath79: convert Araknis AN-300-AP-I-N WiFis to nvmem-cells
Pull the calibration data from the nvmem subsystem. This allows us to
move userspace caldata extraction into the device-tree definition.

Signed-off-by: Nick Hainke <vincent@systemli.org>
2022-12-15 15:08:08 +01:00
Michael Pratt
128947db42 ath79: use nvmem-cells for radio calibration of EAP1200H
Transition from userscript to DTS for all of ART.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2022-11-27 13:18:29 +01:00
Edward Chow
2c33fd39a5 ath79: calibrate TP-LINK TL-WR2543ND with nvmem
Driver for and pci wlan card now pull the calibration data from the nvmem
subsystem.

This allows us to move the userspace caldata extraction for the pci-e ath9k
supported wifi into the device-tree definition of the device.

The wifi mac address remains correct after these changes, because When both
"mac-address" and "calibration" are defined, the effective mac address
comes from the cell corresponding to "mac-address" and
mac-address-increment.

Test passed on my tplink tl-wr2543nd.

Signed-off-by: Edward Chow <equu@openmail.cc>
2022-11-27 13:18:29 +01:00
Edward Chow
e354b01baf ath79: calibrate all ar9344 tl-WDRxxxx with nvmem
Driver for both soc (2.4GHz Wifi) and pci (5 GHz) now pull the calibration
data from the nvmem subsystem.

This allows us to move the userspace caldata extraction for the pci-e ath9k
supported wifi into the device-tree definition of the device.

wmac's nodes are also changed over to use nvmem-cells over OpenWrt's
custom mtd-cal-data property.

The wifi mac address remains correct after these changes, because When both
"mac-address" and "calibration" are defined, the effective mac address
comes from the cell corresponding to "mac-address" and
mac-address-increment.

Test passed on my tplink tl-wdr4310.

Signed-off-by: Edward Chow <equu@openmail.cc>
2022-11-18 20:27:52 +01:00
Edward Chow
79107116d1 ath79: calibrate TL-WDR4900 v2 with nvmem-cells
Driver for both soc (2.4GHz Wifi) and pci (5 GHz) now pull the calibration
data from the nvmem subsystem.

This allows us to move the userspace caldata extraction for the pci-e ath9k
supported wifi into the device-tree definition of the device.

wmac's nodes are also changed over to use nvmem-cells over OpenWrt's
custom mtd-cal-data property.

Signed-off-by: Edward Chow <equu@openmail.cc>
2022-11-09 22:55:33 +01:00
Korey Caro
12cee86989 ath79: add support to TrendNet TEW-673GRU
Add support for the TrendNet TEW-673GRU to ath79.
This device was supported in 19.07.9 but was deprecated with ar71xx.
This is mostly a copy of D-Link DIR-825 B1.
Updates have been completed to enable factory.bin and sysupgrade.bin both.
Code improvements to DTS file and makefile.

Architecture   |  MIPS
Vendor         |  Qualcomm Atheros
bootloader     |  U-Boot
System-On-Chip |  AR7161 rev 2 (MIPS 24Kc V7.4)
CPU/Speed      |  24Kc V7.4 680 MHz
Flash-Chip     |  Macronix MX25L6405D
Flash size     |  8192 KiB
RAM Chip:      |  ProMOS V58C2256164SCI5 × 2
RAM size       |  64 MiB
Wireless       |  2 x Atheros AR922X 2.4GHz/5.0GHz 802.11abgn
Ethernet       |  RealTek RTL8366S Gigabit w/ port based vlan support
USB            |  Yes 2 x 2.0

Initial Flashing Process:
	1) Download 22.03 tew-673gru factory bin
	2) Flash 22.03 using TrendNet GUI

OpenWRT Upgrade Process
	3) Download 22.03 tew-673gru sysupgrade.bin
	4) Flash 22.03 using OpenWRT GUI

Signed-off-by: Korey Caro <korey.caro@gmail.com>
2022-11-06 00:51:58 +01:00
INAGAKI Hiroshi
961d4230f4 ath79: use NVMEM for wlan caldata on ELECOM devices
Use NVMEM "calibration" implementation for ath9k/ath10k(-ct) on ELECOM
WRC-300GHBK2-I and WRC-1750GHBK2-I/C instead of mtd-cal-data property
or user-space script.

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2022-10-19 22:58:12 +02:00
Nick French
20581ee8b5 ath79: add support for TP-Link Deco S4
Add support for TP-Link Deco S4 wifi router

The label refers to the device as S4R and the TP-Link firmware
site calls it the Deco S4 v2. (There does not appear to be a v1)

Hardware (and FCC id) are identical to the Deco M4R v2 but the
flash layout is ordered differently and the OEM firmware encrypts
some config parameters (including the label mac address) in flash

In order to set the encrypted mac address, the wlan's caldata
node is removed from the DTS so the mac can be decrypted with
the help of the uencrypt tool and patched into the wlan fw
via hotplug

Specifications:
SoC: QCA9563-AL3A
RAM: Zentel A3R1GE40JBF
Wireless 2.4GHz: QCA9563-AL3A (main SoC)
Wireless 5GHz: QCA9886
Ethernet Switch: QCA8337N-AL3C
Flash: 16 MB SPI NOR

UART serial access (115200N1) on board via solder pads:
RX = TP1 pad
TX = TP2 pad
GND = C201 (pad nearest board edge)

The device's bootloader and web gui will only accept images that
were signed using TP-Link's RSA key, however a memory safety bug
in the bootloader can be leveraged to install openwrt without
accessing the serial console. See developer forum S4 support page
for link to a "firmware" file that starts a tftp client, or you
may generate one on your own like this:
```
python - > deco_s4_faux_fw_tftp.bin <<EOF
import sys
from struct import pack

b = pack('>I', 0x00008000) + b'X'*16 + b"fw-type:" \
  + b'x'*256 + b"S000S001S002" + pack('>I', 0x80060200) \

b += b"\x00"*(0x200-len(b)) \
  + pack(">33I", *[0x3c0887fc, 0x35083ddc, 0xad000000, 0x24050000,
                   0x3c048006, 0x348402a0, 0x3c1987f9, 0x373947f4,
                   0x0320f809, 0x00000000, 0x24050000, 0x3c048006,
                   0x348402d0, 0x3c1987f9, 0x373947f4, 0x0320f809,
                   0x00000000, 0x24050000, 0x3c048006, 0x34840300,
                   0x3c1987f9, 0x373947f4, 0x0320f809, 0x00000000,
                   0x24050000, 0x3c048006, 0x34840400, 0x3c1987f9,
                   0x373947f4, 0x0320f809, 0x00000000, 0x1000fff1,
                   0x00000000])

b += b"\xff"*(0x2A0-len(b)) + b"setenv serverip 192.168.0.2\x00"
b += b"\xff"*(0x2D0-len(b)) + b"setenv ipaddr 192.168.0.1\x00"
b += b"\xff"*(0x300-len(b)) + b"tftpboot 0x81000000 initramfs-kernel.bin\x00"
b += b"\xff"*(0x400-len(b)) + b"bootm 0x81000000\x00"
b += b"\xff"*(0x8000-len(b))

sys.stdout.buffer.write(b)
EOF
```

Installation:
1. Run tftp server on pc with static ip 192.168.0.2
2. Place openwrt "initramfs-kernel.bin" image in tftp root dir
3. Connect pc to router ethernet port1
4. While holding in reset button on bottom of router, power on router
5. From pc access router webgui at http://192.168.0.1
6. Upload deco_s4_faux_fw_tftp.bin
7. Router will load and execture in-memory openwrt
8. Switch pc back to dhcp or static 192.168.1.x
9. Flash openwrt sysupgrade image via luci/ssh at 192.168.1.1

Revert to stock:
Press and hold reset button while powering device to start the
bootloader's recovery mode, where stock firmware can be uploaded
via web gui at 192.168.0.1

Please note that one additional non-github commits is also needed:
firmware-utils: add tplink-safeloader support for Deco S4

Signed-off-by: Nick French <nickfrench@gmail.com>
2022-09-11 21:54:00 +02:00
Michael Pratt
5df1b33298 ath79: add support for Senao Watchguard AP100
FCC ID: U2M-CAP2100AG

WatchGuard AP100 is an indoor wireless access point with
1 Gb ethernet port, dual-band but single-radio wireless,
internal antenna plates, and 802.3at PoE+

this board is a Senao device:
the hardware is equivalent to EnGenius EAP300 v2
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails

**Specification:**

  - AR9344 SOC          MIPS 74kc, 2.4 GHz AND 5 GHz WMAC, 2x2
  - AR8035-A EPHY       RGMII GbE with PoE+ IN
  - 25 MHz clock
  - 16 MB FLASH         mx25l12805d
  - 2x 64 MB RAM
  - UART console        J11, populated
  - GPIO watchdog       GPIO 16, 20 sec toggle
  - 2 antennas          5 dBi, internal omni-directional plates
  - 5 LEDs              power, eth0 link/data, 2G, 5G
  - 1 button            reset

**MAC addresses:**

  Label has no MAC
  Only one Vendor MAC address in flash at art 0x0

  eth0 ---- *:e5 art 0x0 -2
  phy0 ---- *:e5 art 0x0 -2

**Installation:**

  Method 1: OEM webpage

    use OEM webpage for firmware upgrade to upload factory.bin

  Method 2: root shell

    It may be necessary to use a Watchguard router to flash the image to the AP
    and / or to downgrade the software on the AP to access SSH
    For some Watchguard devices, serial console over UART is disabled.

  NOTE: DHCP is not enabled by default after flashing

**TFTP recovery:**

  reset button has no function at boot time
  only possible with modified uboot environment,
  (see commit message for Watchguard AP300)

**Return to OEM:**

  user should make backup of MTD partitions
  and write the backups back to mtd devices
  in order to revert to OEM reliably

  It may be possible to use sysupgrade
  with an OEM image as well...
  (not tested)

**OEM upgrade info:**

  The OEM upgrade script is at /etc/fwupgrade.sh

  OKLI kernel loader is required because the OEM software
  expects the kernel to be no greater than 1536k
  and the factory.bin upgrade procedure would otherwise
  overwrite part of the kernel when writing rootfs.

**Note on eth0 PLL-data:**

  The default Ethernet Configuration register values will not work
  because of the external AR8035 switch between
  the SOC and the ethernet port.

  For AR934x series, the PLL registers for eth0
  can be see in the DTSI as 0x2c.
  Therefore the PLL registers can be read from uboot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x1805002c 1`.

  The clock delay required for RGMII can be applied
  at the PHY side, using the at803x driver `phy-mode`.
  Therefore the PLL registers for GMAC0
  do not need the bits for delay on the MAC side.
  This is possible due to fixes in at803x driver
  since Linux 5.1 and 5.3

**Note on WatchGuard Magic string:**

  The OEM upgrade script is a modified version of
  the generic Senao sysupgrade script
  which is used on EnGenius devices.

  On WatchGuard boards produced by Senao,
  images are verified using a md5sum checksum of
  the upgrade image concatenated with a magic string.
  this checksum is then appended to the end of the final image.

  This variable does not apply to all the senao devices
  so set to null string as default

Tested-by: Steve Wheeler <stephenw10@gmail.com>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2022-09-11 21:54:00 +02:00
Michael Pratt
9f6e247854 ath79: add support for Senao WatchGuard AP200
FCC ID: U2M-CAP4200AG

WatchGuard AP200 is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+

this board is a Senao device:
the hardware is equivalent to EnGenius EAP600
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails

**Specification:**

  - AR9344 SOC		MIPS 74kc, 2.4 GHz WMAC, 2x2
  - AR9382 WLAN		PCI card 168c:0030, 5 GHz, 2x2, 26dBm
  - AR8035-A EPHY	RGMII GbE with PoE+ IN
  - 25 MHz clock
  - 16 MB FLASH		mx25l12805d
  - 2x 64 MB RAM
  - UART console        J11, populated
  - GPIO watchdog       GPIO 16, 20 sec toggle
  - 4 antennas          5 dBi, internal omni-directional plates
  - 5 LEDs              power, eth0 link/data, 2G, 5G
  - 1 button            reset

**MAC addresses:**

  Label has no MAC
  Only one Vendor MAC address in flash at art 0x0

  eth0 ---- *:be art 0x0 -2
  phy1 ---- *:bf art 0x0 -1
  phy0 ---- *:be art 0x0 -2

**Installation:**

  Method 1: OEM webpage

    use OEM webpage for firmware upgrade to upload factory.bin

  Method 2: root shell

    It may be necessary to use a Watchguard router to flash the image to the AP
    and / or to downgrade the software on the AP to access SSH
    For some Watchguard devices, serial console over UART is disabled.

  NOTE: DHCP is not enabled by default after flashing

**TFTP recovery:**

  reset button has no function at boot time
  only possible with modified uboot environment,
  (see commit message for Watchguard AP300)

**Return to OEM:**

  user should make backup of MTD partitions
  and write the backups back to mtd devices
  in order to revert to OEM reliably

  It may be possible to use sysupgrade
  with an OEM image as well...
  (not tested)

**OEM upgrade info:**

  The OEM upgrade script is at /etc/fwupgrade.sh

  OKLI kernel loader is required because the OEM software
  expects the kernel to be no greater than 1536k
  and the factory.bin upgrade procedure would otherwise
  overwrite part of the kernel when writing rootfs.

**Note on eth0 PLL-data:**

  The default Ethernet Configuration register values will not work
  because of the external AR8035 switch between
  the SOC and the ethernet port.

  For AR934x series, the PLL registers for eth0
  can be see in the DTSI as 0x2c.
  Therefore the PLL registers can be read from uboot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x1805002c 1`.

  The clock delay required for RGMII can be applied
  at the PHY side, using the at803x driver `phy-mode`.
  Therefore the PLL registers for GMAC0
  do not need the bits for delay on the MAC side.
  This is possible due to fixes in at803x driver
  since Linux 5.1 and 5.3

**Note on WatchGuard Magic string:**

  The OEM upgrade script is a modified version of
  the generic Senao sysupgrade script
  which is used on EnGenius devices.

  On WatchGuard boards produced by Senao,
  images are verified using a md5sum checksum of
  the upgrade image concatenated with a magic string.
  this checksum is then appended to the end of the final image.

  This variable does not apply to all the senao devices
  so set to null string as default

Tested-by: Steve Wheeler <stephenw10@gmail.com>
Tested-by: John Delaney <johnd@ankco.net>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2022-09-11 21:54:00 +02:00
Michael Pratt
146aaeafb7 ath79: add support for Senao WatchGuard AP300
FCC ID: Q6G-AP300

WatchGuard AP300 is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+

this board is a Senao device:
the hardware is equivalent to EnGenius EAP1750
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails

**Specification:**

  - QCA9558 SOC		MIPS 74kc, 2.4 GHz WMAC, 3x3
  - QCA9880 WLAN	PCI card 168c:003c, 5 GHz, 3x3, 26dBm
  - AR8035-A PHY	RGMII GbE with PoE+ IN
  - 40 MHz clock
  - 32 MB FLASH		S25FL512S
  - 2x 64 MB RAM	NT5TU32M16
  - UART console	J10, populated
  - GPIO watchdog	GPIO 16, 20 sec toggle
  - 6 antennas		5 dBi, internal omni-directional plates
  - 5 LEDs		power, eth0 link/data, 2G, 5G
  - 1 button		reset

**MAC addresses:**

  MAC address labeled as ETH
  Only one Vendor MAC address in flash at art 0x0

  eth0 ETH  *:3c art 0x0
  phy1 ---- *:3d ---
  phy0 ---- *:3e ---

**Serial console access:**

  For this board, its not certain whether UART is possible
  it is likely that software is blocking console access

  the RX line on the board for UART is shorted to ground by resistor R176
  the resistors R175 and R176 are next to the UART RX pin at J10

  however console output is garbage even after this fix

**Installation:**

  Method 1: OEM webpage

    use OEM webpage for firmware upgrade to upload factory.bin

  Method 2: root shell access

    downgrade XTM firewall to v2.0.0.1
    downgrade AP300 firmware: v1.0.1
    remove / unpair AP from controller
    perform factory reset with reset button
    connect ethernet to a computer
    login to OEM webpage with default address / pass: wgwap
    enable SSHD in OEM webpage settings
    access root shell with SSH as user 'root'
    modify uboot environment to automatically try TFTP at boot time
    (see command below)

    rename initramfs-kernel.bin to test.bin
    load test.bin over TFTP (see TFTP recovery)
    (optionally backup all mtdblocks to have flash backup)
    perform a sysupgrade with sysupgrade.bin

  NOTE: DHCP is not enabled by default after flashing

**TFTP recovery:**

  server ip: 192.168.1.101

  reset button seems to do nothing at boot time...
  only possible with modified uboot environment,
  running this command in the root shell:

  fw_setenv bootcmd 'if ping 192.168.1.101; then tftp 0x82000000 test.bin && bootm 0x82000000; else bootm 0x9f0a0000; fi'

  and verify that it is correct with

  fw_printenv

  then, before boot, the device will attempt TFTP from 192.168.1.101
  looking for file 'test.bin'

  to return uboot environment to normal:

  fw_setenv bootcmd 'bootm 0x9f0a0000'

**Return to OEM:**

  user should make backup of MTD partitions
  and write the backups back to mtd devices
  in order to revert to OEM
  (see installation method 2)

  It may be possible to use sysupgrade
  with an OEM image as well...
  (not tested)

**OEM upgrade info:**

  The OEM upgrade script is at /etc/fwupgrade.sh

  OKLI kernel loader is required because the OEM software
  expects the kernel to be no greater than 1536k
  and the factory.bin upgrade procedure would otherwise
  overwrite part of the kernel when writing rootfs.

**Note on eth0 PLL-data:**

  The default Ethernet Configuration register values will not work
  because of the external AR8035 switch between
  the SOC and the ethernet port.

  For QCA955x series, the PLL registers for eth0 and eth1
  can be see in the DTSI as 0x28 and 0x48 respectively.
  Therefore the PLL registers can be read from uboot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x18050028 1` and `md 0x18050048 1`.

  The clock delay required for RGMII can be applied
  at the PHY side, using the at803x driver `phy-mode`.
  Therefore the PLL registers for GMAC0
  do not need the bits for delay on the MAC side.
  This is possible due to fixes in at803x driver
  since Linux 5.1 and 5.3

**Note on WatchGuard Magic string:**

  The OEM upgrade script is a modified version of
  the generic Senao sysupgrade script
  which is used on EnGenius devices.

  On WatchGuard boards produced by Senao,
  images are verified using a md5sum checksum of
  the upgrade image concatenated with a magic string.
  this checksum is then appended to the end of the final image.

  This variable does not apply to all the senao devices
  so set to null string as default

Tested-by: Alessandro Kornowski <ak@wski.org>
Tested-by: John Wagner <john@wagner.us.org>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2022-09-11 21:54:00 +02:00