ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2024-12-29 10:08:59 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity
62,572 Commits 10 Branches 76 Tags 896 MiB
2d3ad35537
Commit Graph

52 Commits

Author SHA1 Message Date
Edward Chow
983a753f38 ath79: linksys_ea4500-v3: take over the space for user data 
The last "syscfg" partition of the OEM firmware turns out to be a
UBIFS used to store user data, just as the "rootfs_data" of OpenWrt,
so it should be reasonable to absorb it into the "ubi" partition.

Factory installations via either OEM firmware or tftp, or by forcibly
flashing factory image to mtd5 (firmware) partition with mtd tool are
confirmed working, but the UBI remaining inside "syscfg" partition
could break upgrade. Fortunately, installing kmod-mtd-rw and erasing
"syscfg" partition before upgrade is confirmed working, in which case,
"ubi" will automatically expand to the blank space once occupied by
the former mtd8 (syscfg), with the total block number increased, but
the UBIFS for rootfs_data will not automatically claim the newly
available space (since it is created when mtd8 still exists, and
sysupgrade does not set "autoresize" flag to rootfs_data). These space
will be claimed during the next upgrade, when rootfs_data is removed
and created again.

Fixes: 50f727b773 ("ath79: add support for Linksys EA4500 v3")

Signed-off-by: Edward Chow <equu@openmail.cc>
Link: https://github.com/openwrt/openwrt/pull/14791
Signed-off-by: Robert Marko <robimarko@gmail.com>
 2024-11-07 14:57:37 +01:00
Shiji Yang
ee01666cd3 ath79: suppress GPIO static base allocation warning 
Silence ath79 GPIO driver warning by setting GPIO numberspace base
dynamically. This patch also reorganize and fix the GPIO numbers on
6.6 kernel. The new gpio chip base number algorithm:

gpiochip    ath79-SOC    ath9k-0       ath9k-1
base           512      512+ngpios   512+ngpios+10

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/15784
Signed-off-by: Robert Marko <robimarko@gmail.com>
 2024-07-04 19:30:37 +02:00
Rosen Penev
dd6bbbabd3 ath79: 8dev: remove wmac userspace handling 
Before the nvmem rework, this was already handled in dts with
mtd-cal-data instead of qca,no-eeprom. No need to duplicate. Also, the
800 size value seems nonsensical. 440 is the standard.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
 2024-06-09 12:24:15 +02:00
Weiping Yang
d0bcb496cf ath79: Modify GL.iNer GL-S200 lan wan interface 
Specifications:
lan: eth0
wan: eth1

Problem Description:
The lan wan port is reversed with the current machine.

Use eth0 as LAN port and eth1 as WAN port.

Signed-off-by: Weiping Yang <weiping.yang@gl-inet.com>
 2024-02-02 11:42:42 +01:00
Jan Fuchs
f61fc8ed79 ath79: add WAN definition for GL.iNET GL-E750 (Mudi) 
Add the default WAN interface to use QMI, to have WAN configured
right from the start.

Signed-off-by: Jan Fuchs <jf@simonwunderlich.de>
 2024-02-02 11:29:52 +01:00
Shiji Yang
0db4f9785c
ath79: convert ath10k calibration data to NVMEM (ASCII MAC) 
This patch converts ath10k calibration data to NVMEM format for
wave 1 devices with mtd ASCII MAC address. The "calibration"
NVMEM cell size is 0x844. All unportable MAC address settings
have been moved to '10_fix_wifi_mac' scripts.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
 2024-02-01 17:09:03 +01:00
Shiji Yang
2f1c62e5af
ath79: convert ath10k calibration data to NVMEM (binary MAC) 
This patch converts ath10k calibration data to NVMEM format for
wave 1 devices with mtd binary MAC address. The "calibration"
NVMEM cell size is 0x844. The MAC addresses are assigned via dts.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
 2024-02-01 17:09:02 +01:00
Eric J. Anderson
807acbce66 ath79: make boot-leds service executable 
This service was unfunctional due to not having its executable bit
set.

Fixes #13500.

Signed-off-by: Eric J. Anderson <eric.j.ason256@gmail.com>
 2023-12-12 19:35:03 +01:00
Weiping Yang
c7baca3bb6 ath79: add support for GL.iNet GL-S200 
Specifications:
SoC: QCA9531(650MHz)
RAM: DDR2 128M
Flash: SPI NOR 16M + SPI NAND 128M
WiFi: 2.4GHz with 2 antennas(WiFi/Thread)
Ethernet:
    1xLAN(10/100M)
    2xWAN(10/100M)
Button: 1x Reset Button
Switch: 1x Mode switch
LED: 1x Blue LED + 1x White LED + 1x Orange LED
IOT: Thread + ZigBee/Zwave

By uboot web failsafe:
Push the reset button for 5 seconds util the power led flash faster,
then use broswer to access http://192.168.1.1

Afterwards upgrade can use sysupgrade image.

Signed-off-by: Weiping Yang <weiping.yang@gl-inet.com>
 2023-10-31 13:53:11 +01:00
Shiji Yang
12f53724c6 ath79: fix first reboot issue on Netgear WNDR4300 v2 and WNDR4500 v3 
From the Netgear u-boot GPL code[1]. Bootloader always unconditionally
marks block 768, 1020 - 1023 as bad blocks on each boot. This may lead
to conflicts with the OpenWrt nand driver since these blocks may be good
blocks. In this case, U-boot will override the oob of these blocks so
that break the ubi volume. The system will be damaged after first reboot.
To avoid this issue, manually skip these blocks by using "mtd-concat".

[1] https://www.downloads.netgear.com/files/GPL/EX7300v2series-V1.0.0.146_gpl_src.tar.bz2.zip

Fixes: https://github.com/openwrt/openwrt/issues/8878
Tested-by: Yousaf <yousaf465@gmail.com>
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
 2023-08-24 00:04:38 +02:00
Christian Lamparter
1d49310fdb ath79: add Cisco Meraki MR18 
Specifications:

SOC:    Atheros/Qualcomm QCA9557-AT4A @ 720MHz
RAM:    2x Winbond W9751G6KB-25 (128 MiB)
FLASH:  Hynix H27U1G8F2BTR-BC TSOP48 ONFI NAND (128 MiB)
WIFI1:  Atheros AR9550 5.0GHz (SoC)
WIFI2:  Atheros AR9582-AR1A 2.4GHz
WIFI2:  Atheros AR9582-AR1A 2.4GHz + 5GHz
PHYETH: Atheros AR8035-A, 802.3af PoE capable Atheros (1x Gigabit LAN)
LED:    1x Power-LED, 1 x RGB Tricolor-LED
INPUT:  One Reset Button
UART:   JP1 on PCB (Labeled UART), 3.3v-Level, 115200n8
        (VCC, RX, TX, GND - VCC is closest to the boot set jumper
	 under the console pins.)

Flashing instructions:

Depending on the installed firmware, there are vastly different
methods to flash a MR18. These have been documented on:
<https://openwrt.org/toh/meraki/mr18>

Tip:
Use an initramfs from a previous release and then use sysupgrade
to get to the later releases. This is because the initramfs can
no longer be built by the build-bots due to its size (>8 MiB).

Note on that:
Upgrades from AR71XX releases are possible, but they will
require the force sysupgrade option ( -F ).

Please backup your MR18's configuration before starting the
update. The reason here is that a lot of development happend
since AR71XX got removed, so I do advise to use the ( -n )
option for sysupgrade as well. This will cause the device
to drop the old AR71xx configuration and make a new
configurations from scratch.

Note on LEDs:
The LEDs has changed since AR71XX. The white LED is now used during
the boot and when upgrading instead of the green tricolor LED. The
technical reason is that currently the RGB-LED is brought up later
by a userspace daemon.

(added warning note about odm-caldata partition. remove initramfs -
it's too big to be built by the bots. MerakiNAND -> meraki-header.
sort nu801's targets)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
 2023-05-14 00:08:35 +02:00
Andreas Böhler
590d1fd0e6 ath79: add support for ZTE MF282 
The ZTE MF282 is a LTE router used (exclusively?) by the network operator
"3".

Specifications
==============

SoC: QCA9563 (775MHz)
RAM: 128MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 1x GBit LAN
LTE: ZTE MF270 (Cat4), detected as P685M
WiFi: QCA9880ac + QCA9560bgn

MAC addresses
=============

LAN: from config
WiFi 1: from config
WiFi 2: +1

Installation
============

TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:

  setenv serverip 192.168.1.100
  setenv ipaddr 192.168.1.1
  tftpboot 0x82000000 openwrt.bin
  bootm 0x82000000

From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download.

Once booted, transfer the sysupgrade image and run sysupgrade.

LTE Modem
=========

The LTE modem is probably the same as in the MF283+, all instructions
apply.

Configuring the connection using modemmanager works properly, the modem
provides three serial ports and a QMI CDC ethernet interface.

Signed-off-by: Andreas Böhler <dev@aboehler.at>
 2023-05-06 20:59:46 +02:00
Xinfa Deng
dd8a4a8c34 ath79: add support for GL.iNet GL-X1200 
This patch adds supports for GL-X1200.

Specification:
	- SOC: QCA9563 (775MHz)
	- Flash: 16 MiB
	- RAM: 128 MiB DDR2
	- Ethernet: 4x 1Gbps LAN + 1x 1Gbps WAN
	- Wireless: QCA9563(2.4GHz) and QCA9886(5GHz)
	- SIM: 2x SIM card slots
	- MicroSD: 1x microSD slot
	- Antenna: 2x external 5dBi antennas
	- USB: 1x USB 2.0 port
	- Button: 1x reset button
	- LED: 16x LEDs (3x GPIO controllable)
	- UART: 1x UART on PCB (JP1: 3.3V, RX, TX, GND)
	- OEM U-Boot supplies HTTP/GUI access

Implementation Notes
====================

Both the NOR and NAND variants boot off a NOR-based kernel,
consistent with the OEM's firmware.

The mode LEDs are
    * Boot, Running   system
    * Failsafe        2G
    * Upgrade         5G

Installation
============

Using sysupgrade
----------------

sysupgrade may be used to install a NAND image on a device running
a NAND image or a NOR image on a device running a NOR image. It is
recommended to *not* preserve config when upgrading from OEM firmware
or previous versions of OpenWrt. No supported sysupgrade path should
require "force". Transitioning from NOR to NAND can be accomplished

Using U-Boot
------------

The OEM U-Boot can be put into a graphical, firmware-upload mode by
holding down the button on the side of the router while applying power
and for a bit more than five seconds following with the current OEM
U-Boot. The power LED will come on, then the 5G LED will flash five
times, about once a second.  When the 5G LED stops flashing and the
2G LED lights solid, the router's U-Boot will provide an upload page
at http://192.168.1.1/ Either a browser may be used to upload an image,
or a utility such as curl may be used:

curl -X POST -F gl_firmware=\@*-nand-squashfs-factory.img \
         http://192.168.1.1/index.html
or
    curl -X POST -F gl_firmware=\@*-nor-squashfs-sysupgrade.bin \
         http://192.168.1.1/index.html

Note that NOR vs. NAND is based on the file name extension.

Signed-off-by: Xinfa Deng <xinfa.deng@gl-inet.com>
 2023-02-25 14:31:42 +01:00
Shiji Yang
58088ff457 ath79: convert Netgear R6100 radio calibration to nvmem-cells 
use nvmem-cells implementation to avoid copying art calibration data
to rootfs.

Tested on Netgear R6100
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
 2022-12-06 23:11:23 +01:00
Edward Chow
3d343ca713 ath79: calibrate nand netgear wndrxxxx with nvmem 
Driver for both soc (2.4GHz Wifi) and pci (5 GHz) now pull the calibration
data from the nvmem subsystem.

This allows us to move the userspace caldata extraction for the pci-e ath9k
supported wifi into the device-tree definition of the device.

wmac's nodes are also changed over to use nvmem-cells over OpenWrt's
custom mtd-cal-data property.

The wifi mac address remains correct after these changes, because When both
"mac-address" and "calibration" are defined, the effective mac address
comes from the cell corresponding to "mac-address" and
mac-address-increment.

Test passed on my wndr3700v4 and wndr4500v3.
Signed-off-by: Edward Chow <equu@openmail.cc>
 2022-11-20 16:13:48 +01:00
Edward Chow
50f727b773 ath79: add support for Linksys EA4500 v3 
Add support for the Linksys EA4500 v3 wireless router

Hardware
--------
SoC:    Qualcomm Atheros QCA9558
RAM:    128M DDR2 (Winbond W971GG6KB-25)
FLASH:  128M SPI-NAND (Spansion S34ML01G100TFI00)
WLAN:   QCA9558 3T3R 802.11 bgn
        QCA9580 3T3R 802.11 an
ETH:    Qualcomm Atheros QCA8337
UART:   115200 8n1, same as ea4500 v2
USB:	1 single USB 2.0 host port
BUTTON: Reset - WPS
LED:    1x system-LED
        LEDs besides the ethernet ports are controlled
        by the ethernet switch

MAC Address:
 use        address(sample 1)    source
 label      94:10:3e:xx:xx:6f   caldata@cal_macaddr
 lan        94:10:3e:xx:xx:6f   $label
 wan        94:10:3e:xx:xx:6f   $label
 WiFi4_2G   94:10:3e:xx:xx:70   caldata@cal_ath9k_soc
 WiFi4_5G   94:10:3e:xx:xx:71   caldata@cal_ath9k_pci

Installation from Serial Console
------------

1. Connect to the serial console. Power up the device and interrupt
   autoboot when prompted

2. Connect a TFTP server reachable at 192.168.1.0/24
   (e.g. 192.168.1.66) to the ethernet port. Serve the OpenWrt
   initramfs image as "openwrt.bin"

3. To test OpenWrt only, go to step 4 and never execute step 5;
   To install, auto_recovery should be disabled first, and boot_part
   should be set to 1 if its current value is not.

   ath> setenv auto_recovery no
   ath> setenv boot_part 1
   ath> saveenv

4. Boot the initramfs image using U-Boot

   ath> setenv serverip 192.168.1.66
   ath> tftpboot 0x84000000 openwrt.bin
   ath> bootm

5. Copy the OpenWrt sysupgrade image to the device using scp and
   install it like a normal upgrade (with no need to keeping config
   since no config from "previous OpenWRT installation" could be kept
   at all)

   # sysupgrade -n /path/to/openwrt/sysupgrade.bin

Note: Like many other routers produced by Linksys, it has a dual
      firmware flash layout, but because I do not know how to handle
      it, I decide to disable it for more usable space. (That is why
      the "auto_recovery" above should be disabled before installing
      OpenWRT.) If someone is interested in generating factory
      firmware image capable to flash from stock firmware, as well as
      restoring the dual firmware layout, commented-out layout for the
      original secondary partitions left in the device tree may be a
      useful hint.

Installation from Web Interface
------------

1. Login to the router via its web interface (default password: admin)

2. Find the firmware update interface under "Connectivity/Basic"

3. Choose the OpenWrt factory image and click "Start"

4. If the router still boots into the stock firmware, it means that
   the OpenWrt factory image has been installed to the secondary
   partitions and failed to boot (since OpenWrt on EA4500 v3 does not
   support dual boot yet), and the router switched back to the stock
   firmware on the primary partitions. You have to install a stock
   firmware (e.g. 3.1.6.172023, downloadable from
   https://www.linksys.com/support-article?articleNum=148385 ) first
   (to the secondary partitions) , and after that, install OpenWrt
   factory image (to the primary partitions). After successful
   installation of OpenWrt, auto_recovery will be automatically
   disabled and router will only boot from the primary partitions.

Signed-off-by: Edward Chow <equu@openmail.cc>
 2022-10-30 23:14:45 +01:00
David Bauer
1e1695f959 ath79: add support for ZTE MF281 
Add support for the ZTE MF281 battery-powered WiFi router.

Hardware
--------
SoC:    Qualcomm Atheros QCA9563
RAM:    128M DDR2
FLASH:  2M SPI-NOR (GigaDevice GD25Q16)
        128M SPI-NAND (GigaDevice)
WLAN:   QCA9563 2T2R 802.11 abgn
        QCA9886 2T2R 802.11 nac
WWAN:   ASRMicro ASR1826
ETH:    Qualcomm Atheros QCA8337
UART:   115200 8n1
        Unpopulated connector next to SIM slot
        (SIM) GND - RX - TX - 3V3
        Don't connect 3V3
BUTTON: Reset - WPS
LED:    1x debug-LED (internal)
        LEDs on front of the device are controlled
        using the modem CPU and can not be controlled
        by OpenWrt

Installation
------------

1. Connect to the serial console. Power up the device and interrupt
   autoboot when prompted

2. Connect a TFTP server reachable at 192.168.1.66 to the ethernet port.
   Serve the OpenWrt initramfs image as "speedbox-2.bin"

3. Boot the initramfs image using U-Boot

   $ setenv serverip 192.168.1.66
   $ setenv ipaddr 192.168.1.154
   $ tftpboot 0x84000000 speedbox-2.bin
   $ bootm

4. Copy the OpenWrt factory image to the device using scp and write to
   the NAND flash

   $ mtd write /path/to/openwrt/factory.bin firmware

WWAN
----

The WWAN card can be used with OpenWrt. Example configuration for
connection with a unauthenticated dual-stack APN:

network.lte=interface
network.lte.proto='ncm'
network.lte.device='/dev/ttyACM0'
network.lte.pdptype='IPV4V6'
network.lte.apn='internet.telekom'
network.lte.ipv6='auto'
network.lte.delay='10'

The WWAN card is running a modified version of OpenWrt and handles
power-management as well as the LED controller (AW9523). A root shell
can be acquired by installing adb using opkg and executing "adb shell".

Signed-off-by: David Bauer <mail@david-bauer.net>
 2022-09-08 13:57:18 +02:00
Leo Soares
35a0f2b00c ath79: add LTE led for GL.iNet GL-XE300 
This commit adds the LTE led for GL.iNet GL-XE300
to the default leds config.

Signed-off-by: Leo Soares <leo@hyper.ag>
 2022-08-05 14:10:42 +02:00
Chris Blake
949e8ba521 ath79: add support for Netgear PGZNG1 
This adds support for the Netgear PGZNG1, also known as the ADT Pulse
Gateway.

Hardware:
CPU: Atheros AR9344
Memory: 256MB
Storage: 256MB NAND Hynix H27U2G8F2CTR-BC
USB: 1x USB 2.0
Ethernet: 2x 100Mb/s
WiFi: Atheros AR9340 2.4GHz 2T2R
Leds: 8 LEDs
Button: 1x Reset Button
UART:
Header marked JPE1. Pinout is VCC, TX, RX, GND. The marked pin, closest
to the JPE1 marking, is VCC. Note VCC isn't required to be connected
for UART to work.

Enable Stock Firmware Shell Access:
1. Interrupt u-boot and run the following commands
setenv console_mode 1
saveenv
reset

This will enable a UART shell in the firmware. You can then login using
the root password of `icontrol`. If that doesn't work, the device is
running a firmware based on OpenWRT where you can drop into failsafe to
mount the FS and then modify /etc/passwd.

Installation Instructions:
1. Interupt u-boot and run the following commands
setenv active_image 0
setenv stock_bootcmd nboot 0x81000000 0 \${kernel_offset}
setenv openwrt_bootcmd nboot 0x82000000 0 \${kernel_offset}
setenv bootcmd run openwrt_bootcmd
saveenv

2. boot initramfs image via TFTP u-boot
tftpboot 0x82000000 openwrt-ath79-nand-netgear_pgzng1-initramfs-kernel.bin; bootm 0x82000000

3. Once booted, use LuCI sysupgrade to
flash openwrt-ath79-nand-netgear_pgzng1-squashfs-sysupgrade.bin

MAC Table:
WAN (eth0): xx:xa - caldata 0x0
LAN (eth1): xx:xb - caldata 0x6
WLAN (phy0): xx:xc - burned into ath9k caldata

Not Working:
Z-Wave
RS422

Signed-off-by: Chris Blake <chrisrblake93@gmail.com>
(added more hw-info, fixed file permissions)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
 2022-06-19 12:31:02 +02:00
Lech Perczak
1fabeeb799 ath79: ZTE MF286[A,R]: add "Power button blocker" GPIO switch 
ZTE MF286A and MF286R feature a "power switch override" GPIO in stock
firmware as means to prevent power interruption during firmware update,
especially when used with internal battery.
To ensure that this GPIO is
properly driven as in stock firmware, configure it with userspace GPIO
switch.

It was observed that on some units, the modem would not be
restarted together with the board itself on reboot, this should help
with that as well.

Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
 2022-05-15 16:32:40 +02:00
Pascal Coudurier
0905b07139 ath79: improve support for GL.iNet GL-XE300 
- fix eth0 eth1 sharing same mac so it conforms to the behavior stated
  in the original commit and the way it is in vendor firmware :
  WAN is label, LAN is label +1 and WLAN is label +2
- add default leds config
- add default network config

Signed-off-by: Pascal Coudurier <coudu@wanadoo.fr>
 2022-03-17 21:55:10 +01:00
Lech Perczak
7ac8da0060 ath79: support ZTE MF286A/R 
ZTE MF286A and MF286R are indoor LTE category 6/7 CPE router with simultaneous
dual-band 802.11ac plus 802.11n Wi-Fi radios and quad-port gigabit
Ethernet switch, FXS and external USB 2.0 port.

Hardware highlights:
- CPU: QCA9563 SoC at 775MHz,
- RAM: 128MB DDR2,
- NOR Flash: MX25L1606E 2MB SPI Flash, for U-boot only,
- NAND Flash: W25N01GV 128MB SPI NAND-Flash, for all other data,
- Wi-Fi 5GHz: QCA9886 2x2 MIMO 802.11ac Wave2 radio,
- WI-Fi 2.4GHz: QCA9563 3x3 MIMO 802.11n radio,
- Switch: QCA8337v2 4-port gigabit Ethernet, with single SGMII CPU port,
- WWAN:
  [MF286A] MDM9230-based category 6 internal LTE modem
  [MF286R] PXA1826-based category 7 internal LTE modem
  in extended  mini-PCIE form factor, with 3 internal antennas and
  2 external antenna connections, single mini-SIM slot.
- FXS: one external ATA port (handled entirely by modem part) with two
  physical connections in parallel,
- USB: Single external USB 2.0 port,
- Switches: power switch, WPS, Wi-Fi and reset buttons,
- LEDs: Wi-Fi, Test (internal). Rest of LEDs (Phone, WWAN, Battery,
  Signal state) handled entirely by modem. 4 link status LEDs handled by
  the switch on the backside.
- Battery: 3Ah 1-cell Li-Ion replaceable battery, with charging and
  monitoring handled by modem.
- Label MAC device: eth0

The device shares many components with previous model, MF286, differing
mostly by a Wave2 5GHz radio, flash layout and internal LED color.
In case of MF286A, the modem is the same as in MF286. MF286R uses a
different modem based on Marvell PXA1826 chip.

Internal modem of MF286A is supported via uqmi, MF286R modem isn't fully
supported, but it is expected to use comgt-ncm for connection, as it
uses standard 3GPP AT commands for connection establishment.

Console connection: connector X2 is the console port, with the following
pinout, starting from pin 1, which is the topmost pin when the board is
upright:
- VCC (3.3V). Do not use unless you need to source power for the
  converer from it.
- TX
- RX
- GND
Default port configuration in U-boot as well as in stock firmware is
115200-8-N-1.

Installation:
Due to different flash layout from stock firmware, sysupgrade from
within stock firmware is impossible, despite it's based on QSDK which
itself is based on OpenWrt.

STEP 0: Stock firmware update:
As installing OpenWrt cuts you off from official firmware updates for
the modem part, it is recommended to update the stock firmware to latest
version before installation, to have built-in modem at the latest firmware
version.

STEP 1: gaining root shell:

Method 1:
This works if busybox has telnetd compiled in the binary.
If this does not work, try method 2.

Using well-known exploit to start telnetd on your router - works
only if Busybox on stock firmware has telnetd included:
- Open stock firmware web interface
- Navigate to "URL filtering" section by going to "Advanced settings",
  then "Firewall" and finally "URL filter".
- Add an entry ending with "&&telnetd&&", for example
  "http://hostname/&&telnetd&&".
- telnetd will immediately listen on port 4719.
- After connecting to telnetd use "admin/admin" as credentials.

Method 2:
This works if busybox does not have telnetd compiled in. Notably, this
is the case in DNA.fi firmware.
If this does not work, try method 3.

- Set IP of your computer to 192.168.0.22. (or appropriate subnet if
  changed)
- Have a TFTP server running at that address
- Download MIPS build of busybox including telnetd, for example from:
  https://busybox.net/downloads/binaries/1.21.1/busybox-mips
  and put it in it's root directory. Rename it as "telnetd".
- As previously, login to router's web UI and navigate to "URL
  filtering"
- Using "Inspect" feature, extend "maxlength" property of the input
  field named "addURLFilter", so it looks like this:
  <input type="text" name="addURLFilter" id="addURLFilter" maxlength="332"
    class="required form-control">
- Stay on the page - do not navigate anywhere
- Enter "http://aa&zte_debug.sh 192.168.0.22 telnetd" as a filter.
- Save the settings. This will download the telnetd binary over tftp and
  execute it. You should be able to log in at port 23, using
  "admin/admin" as credentials.

Method 3:
If the above doesn't work, use the serial console - it exposes root shell
directly without need for login. Some stock firmwares, notably one from
finnish DNA operator lack telnetd in their builds.

STEP 2: Backing up original software:
As the stock firmware may be customized by the carrier and is not
officially available in the Internet, IT IS IMPERATIVE to back up the
stock firmware, if you ever plan to returning to stock firmware.
It is highly recommended to perform backup using both methods, to avoid
hassle of reassembling firmware images in future, if a restore is
needed.

Method 1: after booting OpenWrt initramfs image via TFTP:
PLEASE NOTE: YOU CANNOT DO THIS IF USING INTERMEDIATE FIRMWARE FOR INSTALLATION.
- Dump stock firmware located on stock kernel and ubi partitions:

  ssh root@192.168.1.1: cat /dev/mtd4 > mtd4_kernel.bin
  ssh root@192.168.1.1: cat /dev/mtd9 > mtd9_ubi.bin

And keep them in a safe place, should a restore be needed in future.

Method 2: using stock firmware:
- Connect an external USB drive formatted with FAT or ext4 to the USB
  port.
- The drive will be auto-mounted to /var/usb_disk
- Check the flash layout of the device:

  cat /proc/mtd

  It should show the following:
  mtd0: 000a0000 00010000 "u-boot"
  mtd1: 00020000 00010000 "u-boot-env"
  mtd2: 00140000 00010000 "reserved1"
  mtd3: 000a0000 00020000 "fota-flag"
  mtd4: 00080000 00020000 "art"
  mtd5: 00080000 00020000 "mac"
  mtd6: 000c0000 00020000 "reserved2"
  mtd7: 00400000 00020000 "cfg-param"
  mtd8: 00400000 00020000 "log"
  mtd9: 000a0000 00020000 "oops"
  mtd10: 00500000 00020000 "reserved3"
  mtd11: 00800000 00020000 "web"
  mtd12: 00300000 00020000 "kernel"
  mtd13: 01a00000 00020000 "rootfs"
  mtd14: 01900000 00020000 "data"
  mtd15: 03200000 00020000 "fota"
  mtd16: 01d00000 00020000 "firmware"

  Differences might indicate that this is NOT a MF286A device but
  one of other variants.
- Copy over all MTD partitions, for example by executing the following:

  for i in 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do cat /dev/mtd$i > \
  /var/usb_disk/mtd$i; done

  "Firmware" partition can be skipped, it is a concatenation
  of "kernel" and "rootfs".

- If the count of MTD partitions is different, this might indicate that
  this is not a MF286A device, but one of its other variants.
- (optionally) rename the files according to MTD partition names from
  /proc/mtd
- Unmount the filesystem:

  umount /var/usb_disk; sync

  and then remove the drive.
- Store the files in safe place if you ever plan to return to stock
  firmware. This is especially important, because stock firmware for
  this device is not available officially, and is usually customized by
  the mobile providers.

STEP 3: Booting initramfs image:

Method 1: using serial console (RECOMMENDED):
- Have TFTP server running, exposing the OpenWrt initramfs image, and
  set your computer's IP address as 192.168.0.22. This is the default
  expected by U-boot. You may wish to change that, and alter later
  commands accordingly.
- Connect the serial console if you haven't done so already,
- Interrupt boot sequence by pressing any key in U-boot when prompted
- Use the following commands to boot OpenWrt initramfs through TFTP:

  setenv serverip 192.168.0.22
  setenv ipaddr 192.168.0.1
  tftpboot 0x81000000 openwrt-ath79-nand-zte_mf286a-initramfs-kernel.bin
  bootm 0x81000000

  (Replace server IP and router IP as needed). There is no  emergency
  TFTP boot sequence triggered by buttons, contrary to MF283+.
- When OpenWrt initramfs finishes booting, proceed to actual
  installation.

Method 2: using initramfs image as temporary boot kernel
This exploits the fact, that kernel and rootfs MTD devices are
consecutive on NAND flash, so from within stock image, an initramfs can
be written to this area and booted by U-boot on next reboot, because it
uses "nboot" command which isn't limited by kernel partition size.
- Download the initramfs-kernel.bin image
- After backing up the previous MTD contents, write the images to the
  "firmware" MTD device, which conveniently concatenates "kernel" and
  "rootfs" partitions that can fit the initramfs image:

  nandwrite -p /dev/<firmware-mtd> \
  /var/usb_disk/openwrt-ath79-zte_mf286a-initramfs-kernel.bin

- If write is OK, reboot the device, it will reboot to OpenWrt
  initramfs:

  reboot -f

- After rebooting, SSH into the device and use sysupgrade to perform
  proper installation.

Method 3: using built-in TFTP recovery (LAST RESORT):
- With that method, ensure you have complete backup of system's NAND
  flash first. It involves deliberately erasing the kernel.
- Download "-initramfs-kernel.bin" image for the device.
- Prepare the recovery image by prepending 8MB of zeroes to the image,
  and name it root_uImage:

  dd if=/dev/zero of=padding.bin bs=8M count=1

  cat padding.bin openwrt-ath79-nand-zte_mf286a-initramfs-kernel.bin >
  root_uImage

- Set up a TFTP server at 192.0.0.1/8. Router will use random address
  from that range.
- Put the previously generated "root_uImage" into TFTP server root
  directory.
- Deliberately erase "kernel" partition" using stock firmware after
  taking backup. THIS IS POINT OF NO RETURN.
- Restart the device. U-boot will attempt flashing the recovery
  initramfs image, which will let you perform actual installation using
  sysupgrade. This might take a considerable time, sometimes the router
  doesn't establish Ethernet link properly right after booting. Be
  patient.
- After U-boot finishes flashing, the LEDs of switch ports will all
  light up. At this moment, perform power-on reset, and wait for OpenWrt
  initramfs to finish booting. Then proceed to actual installation.

STEP 4: Actual installation:
- Set your computer IP to 192.168.1.22/24
- scp the sysupgrade image to the device:

  scp openwrt-ath79-nand-zte_mf286a-squashfs-sysupgrade.bin \
  root@192.168.1.1:/tmp/

- ssh into the device and execute sysupgrade:

  sysupgrade -n /tmp/openwrt-ath79-nand-zte_mf286a-squashfs-sysupgrade.bin

- Wait for router to reboot to full OpenWrt.

STEP 5: WAN connection establishment
Since the router is equipped with LTE modem as its main WAN interface, it
might be useful to connect to the Internet right away after
installation. To do so, please put the following entries in
/etc/config/network, replacing the specific configuration entries with
one needed for your ISP:

config interface 'wan'
        option proto 'qmi'
        option device '/dev/cdc-wdm0'
        option auth '<auth>' # As required, usually 'none'
        option pincode '<pin>' # If required by SIM
        option apn '<apn>' # As required by ISP
        option pdptype '<pdp>' # Typically 'ipv4', or 'ipv4v6' or 'ipv6'

For example, the following works for most polish ISPs
config interface 'wan'
        option proto 'qmi'
        option device '/dev/cdc-wdm0'
        option auth 'none'
        option apn 'internet'
        option pdptype 'ipv4'

The required minimum is:
config interface 'wan'
        option proto 'qmi'
        option device '/dev/cdc-wdm0'
In this case, the modem will use last configured APN from stock
firmware - this should work out of the box, unless your SIM requires
PIN which can't be switched off.

If you have build with LuCI, installing luci-proto-qmi helps with this
task.

Restoring the stock firmware:

Preparation:
If you took your backup using stock firmware, you will need to
reassemble the partitions into images to be restored onto the flash. The
layout might differ from ISP to ISP, this example is based on generic stock
firmware
The only partitions you really care about are "web", "kernel", and
"rootfs". These are required to restore the stock firmware through
factory TFTP recovery.

Because kernel partition was enlarged, compared to stock
firmware, the kernel and rootfs MTDs don't align anymore, and you need
to carve out required data if you only have backup from stock FW:
- Prepare kernel image
  cat mtd12_kernel.bin mtd13_rootfs.bin > owrt_kernel.bin
  truncate -s 4M owrt_kernel_restore.bin
- Cut off first 1MB from rootfs
  dd if=mtd13_rootfs.bin of=owrt_rootfs.bin bs=1M skip=1
- Prepare image to write to "ubi" meta-partition:
  cat mtd6_reserved2.bi mtd7_cfg-param.bin mtd8_log.bin mtd9_oops.bin \
  mtd10_reserved3.bin mtd11_web.bin owrt_rootfs.bin > \
  owrt_ubi_ubi_restore.bin

You can skip the "fota" partition altogether,
it is used only for stock firmware update purposes and can be overwritten
safely anyway. The same is true for "data" partition which on my device
was found to be unused at all. Restoring mtd5_cfg-param.bin will restore
the stock firmware configuration you had before.

Method 1: Using initramfs:
This method is recmmended if you took your backup from within OpenWrt
initramfs, as the reassembly is not needed.
- Boot to initramfs as in step 3:
- Completely detach ubi0 partition using ubidetach /dev/ubi0_0
- Look up the kernel and ubi partitions in /proc/mtd
- Copy over the stock kernel image using scp to /tmp
- Erase kernel and restore stock kernel:
  (scp mtd4_kernel.bin root@192.168.1.1:/tmp/)
  mtd write <kernel_mtd> mtd4_kernel.bin
  rm mtd4_kernel.bin
- Copy over the stock partition backups one-by-one using scp to /tmp, and
  restore them individually. Otherwise you might run out of space in
  tmpfs:

  (scp mtd3_ubiconcat0.bin root@192.168.1.1:/tmp/)

  mtd write <ubiconcat0_mtd> mtd3_ubiconcat0.bin
  rm mtd3_ubiconcat0.bin

  (scp mtd5_ubiconcat1.bin root@192.168.1.1:/tmp/)

  mtd write <ubiconcat1_mtd> mtd5_ubiconcat1.bin
  rm mtd5_ubiconcat1.bin

- If the write was correct, force a device reboot with

  reboot -f

Method 2: Using live OpenWrt system (NOT RECOMMENDED):
- Prepare a USB flash drive contatining MTD backup files
- Ensure you have kmod-usb-storage and filesystem driver installed for
  your drive
- Mount your flash drive

  mkdir /tmp/usb

  mount /dev/sda1 /tmp/usb

- Remount your UBI volume at /overlay to R/O

  mount -o remount,ro /overlay

- Write back the kernel and ubi partitions from USB drive

  cd /tmp/usb
  mtd write mtd4_kernel.bin /dev/<kernel_mtd>

  mtd write mtd9_ubi.bin /dev/<kernel_ubi>

- If everything went well, force a device reboot with
  reboot -f

Last image may be truncated a bit due to lack of space in RAM, but this will happen over "fota"
MTD partition which may be safely erased after reboot anyway.

Method 3: using built-in TFTP recovery:
This method is recommended if you took backups using stock firmware.
- Assemble a recovery rootfs image from backup of stock partitions by
  concatenating "web", "kernel", "rootfs" images dumped from the device,
  as "root_uImage"
- Use it in place of "root_uImage" recovery initramfs image as in the
  TFTP pre-installation method.

Quirks and known issuesa
- It was observed, that CH340-based USB-UART converters output garbage
  during U-boot phase of system boot. At least CP2102 is known to work
  properly.
- Kernel partition size is increased to 4MB compared to stock 3MB, to
  accomodate future kernel updates - at this moment OpenWrt 5.10 kernel
  image is at 2.5MB which is dangerously close to the limit. This has no
  effect on booting the system - but keep that in mind when reassembling
  an image to restore stock firmware.
- uqmi seems to be unable to change APN manually, so please use the one
  you used before in stock firmware first. If you need to change it,
  please use protocok '3g' to establish connection once, or use the
  following command to change APN (and optionally IP type) manually:
  echo -ne 'AT+CGDCONT=1,"IP","<apn>' > /dev/ttyUSB0
- The only usable LED as a "system LED" is the blue debug LED hidden
  inside the case. All other LEDs are controlled by modem, on which the
  router part has some influence only on Wi-Fi LED.
- Wi-Fi LED currently doesn't work while under OpenWrt, despite having
  correct GPIO mapping. All other LEDs are controlled by modem,
  including this one in stock firmware. GPIO19, mapped there only acts
  as a gate, while the actual signal source seems to be 5GHz Wi-Fi
  radio, however it seems it is not the LED exposed by ath10k as
  ath10k-phy0.
- GPIO5 used for modem reset is a suicide switch, causing a hardware
  reset of whole board, not only the modem. It is attached to
  gpio-restart driver, to restart the modem on reboot as well, to ensure
  QMI connectivity after reboot, which tends to fail otherwise.
- Modem, as in MF283+, exposes root shell over ADB - while not needed
  for OpenWrt operation at all - have fun lurking around.
  The same modem module is used as in older MF286.

Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
 2022-02-26 17:46:10 +01:00
Alex Henrie
fe1ecf1fcb ath79: add Zyxel EMG2926-Q10A 
The Zyxel EMG2926-Q10A is 99% the Zyxel NBG6716, but the bootloader
expects a different product name when flashing over TFTP. Also, the
EMG2926-Q10A always has 128 MiB of NAND flash whereas the NBG6716
reportedly can have either 128 MiB or 256 MiB.

Signed-off-by: Alex Henrie <alexhenrie24@gmail.com>
 2022-02-26 13:36:30 +01:00
Graham Cole
e282e50d44 ath79: fix wndr4500v3 lan port order to match case 
The LED and LAN port numbering on the case of wndr4500v3 devices are
reversed relative to the wndr4300v2. I created this patch to so that the
ordering in OpenWRT will be consistent with that.

Signed-off-by: Graham Cole <diakka@gmail.com>
 2022-02-20 13:54:12 +09:00
Lech Perczak
8c78a13bfc ath79: support ZTE MF286 
ZTE MF286 is an indoor LTE category 6 CPE router with simultaneous
dual-band 802.11ac plus 802.11n Wi-Fi radios and quad-port gigabit
Ethernet switch, FXS and external USB 2.0 port.

Hardware highlights:
- CPU: QCA9563 SoC at 775MHz,
- RAM: 128MB DDR2,
- NOR Flash: MX25L1606E 2MB SPI Flash, for U-boot only,
- NAND Flash: GD5F1G04UBYIG 128MB SPI NAND-Flash, for all other data,
- Wi-Fi 5GHz: QCA9882 2x2 MIMO 802.11ac radio,
- WI-Fi 2.4GHz: QCA9563 3x3 MIMO 802.11n radio,
- Switch: QCA8337v2 4-port gigabit Ethernet, with single SGMII CPU port,
- WWAN: MDM9230-based category 6 internal LTE modem in extended
  mini-PCIE form factor, with 3 internal antennas and 2 external antenna
  connections, single mini-SIM slot. Modem model identified as MF270,
- FXS: one external ATA port (handled entirely by modem part) with two
  physical connections in parallel,
- USB: Single external USB 2.0 port,
- Switches: power switch, WPS, Wi-Fi and reset buttons,
- LEDs: Wi-Fi, Test (internal). Rest of LEDs (Phone, WWAN, Battery,
  Signal state) handled entirely by modem. 4 link status LEDs handled by
  the switch on the backside.
- Battery: 3Ah 1-cell Li-Ion replaceable battery, with charging and
  monitoring handled by modem.
- Label MAC device: eth0

Console connection: connector X2 is the console port, with the following
pinout, starting from pin 1, which is the topmost pin when the board is
upright:
- VCC (3.3V). Do not use unless you need to source power for the
  converer from it.
- TX
- RX
- GND
Default port configuration in U-boot as well as in stock firmware is
115200-8-N-1.

Installation:
Due to different flash layout from stock firmware, sysupgrade from
within stock firmware is impossible, despite it's based on QSDK which
itself is based on OpenWrt.

STEP 0: Stock firmware update:
As installing OpenWrt cuts you off from official firmware updates for
the modem part, it is recommended to update the stock firmware to latest
version before installation, to have built-in modem at the latest firmware
version.

STEP 1: gaining root shell:

Method 1:
This works if busybox has telnetd compiled in the binary.
If this does not work, try method 2.

Using well-known exploit to start telnetd on your router - works
only if Busybox on stock firmware has telnetd included:
- Open stock firmware web interface
- Navigate to "URL filtering" section by going to "Advanced settings",
  then "Firewall" and finally "URL filter".
- Add an entry ending with "&&telnetd&&", for example
  "http://hostname/&&telnetd&&".
- telnetd will immediately listen on port 4719.
- After connecting to telnetd use "admin/admin" as credentials.

Method 2:
This works if busybox does not have telnetd compiled in. Notably, this
is the case in DNA.fi firmware.
If this does not work, try method 3.

- Set IP of your computer to 192.168.1.22.
- Have a TFTP server running at that address
- Download MIPS build of busybox including telnetd, for example from:
  https://busybox.net/downloads/binaries/1.21.1/busybox-mips
  and put it in it's root directory. Rename it as "telnetd".
- As previously, login to router's web UI and navigate to "URL
  filtering"
- Using "Inspect" feature, extend "maxlength" property of the input
  field named "addURLFilter", so it looks like this:
  <input type="text" name="addURLFilter" id="addURLFilter" maxlength="332"
    class="required form-control">
- Stay on the page - do not navigate anywhere
- Enter "http://aa&zte_debug.sh 192.168.1.22 telnetd" as a filter.
- Save the settings. This will download the telnetd binary over tftp and
  execute it. You should be able to log in at port 23, using
  "admin/admin" as credentials.

Method 3:
If the above doesn't work, use the serial console - it exposes root shell
directly without need for login. Some stock firmwares, notably one from
finnish DNA operator lack telnetd in their builds.

STEP 2: Backing up original software:
As the stock firmware may be customized by the carrier and is not
officially available in the Internet, IT IS IMPERATIVE to back up the
stock firmware, if you ever plan to returning to stock firmware.

Method 1: after booting OpenWrt initramfs image via TFTP:
PLEASE NOTE: YOU CANNOT DO THIS IF USING INTERMEDIATE FIRMWARE FOR INSTALLATION.
- Dump stock firmware located on stock kernel and ubi partitions:

  ssh root@192.168.1.1: cat /dev/mtd4 > mtd4_kernel.bin
  ssh root@192.168.1.1: cat /dev/mtd8 > mtd8_ubi.bin

And keep them in a safe place, should a restore be needed in future.

Method 2: using stock firmware:
- Connect an external USB drive formatted with FAT or ext4 to the USB
  port.
- The drive will be auto-mounted to /var/usb_disk
- Check the flash layout of the device:

  cat /proc/mtd

  It should show the following:
  mtd0: 00080000 00010000 "uboot"
  mtd1: 00020000 00010000 "uboot-env"
  mtd2: 00140000 00020000 "fota-flag"
  mtd3: 00140000 00020000 "caldata"
  mtd4: 00140000 00020000 "mac"
  mtd5: 00600000 00020000 "cfg-param"
  mtd6: 00140000 00020000 "oops"
  mtd7: 00800000 00020000 "web"
  mtd8: 00300000 00020000 "kernel"
  mtd9: 01f00000 00020000 "rootfs"
  mtd10: 01900000 00020000 "data"
  mtd11: 03200000 00020000 "fota"

  Differences might indicate that this is NOT a vanilla MF286 device but
  one of its later derivatives.
- Copy over all MTD partitions, for example by executing the following:

  for i in 0 1 2 3 4 5 6 7 8 9 10 11; do cat /dev/mtd$i > \
  /var/usb_disk/mtd$i; done

- If the count of MTD partitions is different, this might indicate that
  this is not a standard MF286 device, but one of its later derivatives.
- (optionally) rename the files according to MTD partition names from
  /proc/mtd
- Unmount the filesystem:

  umount /var/usb_disk; sync

  and then remove the drive.
- Store the files in safe place if you ever plan to return to stock
  firmware. This is especially important, because stock firmware for
  this device is not available officially, and is usually customized by
  the mobile providers.

STEP 3: Booting initramfs image:

Method 1: using serial console (RECOMMENDED):
- Have TFTP server running, exposing the OpenWrt initramfs image, and
  set your computer's IP address as 192.168.1.22. This is the default
  expected by U-boot. You may wish to change that, and alter later
  commands accordingly.
- Connect the serial console if you haven't done so already,
- Interrupt boot sequence by pressing any key in U-boot when prompted
- Use the following commands to boot OpenWrt initramfs through TFTP:

  setenv serverip 192.168.1.22
  setenv ipaddr 192.168.1.1
  tftpboot 0x81000000 openwrt-ath79-nand-zte_mf286-initramfs-kernel.bin
  bootm 0x81000000

  (Replace server IP and router IP as needed). There is no  emergency
  TFTP boot sequence triggered by buttons, contrary to MF283+.
- When OpenWrt initramfs finishes booting, proceed to actual
  installation.

Method 2: using initramfs image as temporary boot kernel
This exploits the fact, that kernel and rootfs MTD devices are
consecutive on NAND flash, so from within stock image, an initramfs can
be written to this area and booted by U-boot on next reboot, because it
uses "nboot" command which isn't limited by kernel partition size.
- Download the initramfs-kernel.bin image
- Split the image into two parts on 3MB partition size boundary, which
  is the size of kernel partition. Pad the output of second file to
  eraseblock size:

  dd if=openwrt-ath79-nand-zte_mf286-initramfs-kernel.bin \
  bs=128k count=24 \
  of=openwrt-ath79-zte_mf286-intermediate-kernel.bin

  dd if=openwrt-ath79-nand-zte_mf286-initramfs-kernel.bin \
  bs=128k skip=24 conv=sync \
  of=openwrt-ath79-zte_mf286-intermediate-rootfs.bin

- Copy over /usr/bin/flash_eraseall and /usr/bin/nandwrite utilities to
  /tmp. This is CRITICAL for installation, as erasing rootfs will cut
  you off from those tools on flash!

- After backing up the previous MTD contents, write the images to the
  respective MTD devices:

  /tmp/flash_eraseall /dev/<kernel-mtd>

  /tmp/nandwrite /dev/<kernel-mtd> \
  /var/usb_disk/openwrt-ath79-zte_mf286-intermediate-kernel.bin

  /tmp/flash_eraseall /dev/<kernel-mtd>

  /tmp/nandwrite /dev/<rootfs-mtd> \
  /var/usb_disk/openwrt-ath79-zte_mf286-intermediate-rootfs.bin

- Ensure that no bad blocks were present on the devices while writing.
  If they were present, you may need to vary the split  between
  kernel and rootfs parts, so U-boot reads a valid uImage after skipping
  the bad blocks. If it fails, you will be left with method 3 (below).
- If write is OK, reboot the device, it will reboot to OpenWrt
  initramfs:

  reboot -f

- After rebooting, SSH into the device and use sysupgrade to perform
  proper installation.

Method 3: using built-in TFTP recovery (LAST RESORT):
- With that method, ensure you have complete backup of system's NAND
  flash first. It involves deliberately erasing the kernel.
- Download "-initramfs-kernel.bin" image for the device.
- Prepare the recovery image by prepending 8MB of zeroes to the image,
  and name it root_uImage:

  dd if=/dev/zero of=padding.bin bs=8M count=1

  cat padding.bin openwrt-ath79-nand-zte_mf286-initramfs-kernel.bin >
  root_uImage

- Set up a TFTP server at 192.0.0.1/8. Router will use random address
  from that range.
- Put the previously generated "root_uImage" into TFTP server root
  directory.
- Deliberately erase "kernel" partition" using stock firmware after
  taking backup. THIS IS POINT OF NO RETURN.
- Restart the device. U-boot will attempt flashing the recovery
  initramfs image, which will let you perform actual installation using
  sysupgrade. This might take a considerable time, sometimes the router
  doesn't establish Ethernet link properly right after booting. Be
  patient.
- After U-boot finishes flashing, the LEDs of switch ports will all
  light up. At this moment, perform power-on reset, and wait for OpenWrt
  initramfs to finish booting. Then proceed to actual installation.

STEP 4: Actual installation:
- scp the sysupgrade image to the device:

  scp openwrt-ath79-nand-zte_mf286-squashfs-sysupgrade.bin \
  root@192.168.1.1:/tmp/

- ssh into the device and execute sysupgrade:

  sysupgrade -n /tmp/openwrt-ath79-nand-zte_mf286-squashfs-sysupgrade.bin

- Wait for router to reboot to full OpenWrt.

STEP 5: WAN connection establishment
Since the router is equipped with LTE modem as its main WAN interface, it
might be useful to connect to the Internet right away after
installation. To do so, please put the following entries in
/etc/config/network, replacing the specific configuration entries with
one needed for your ISP:

config interface 'wan'
        option proto 'qmi'
        option device '/dev/cdc-wdm0'
        option auth '<auth>' # As required, usually 'none'
        option pincode '<pin>' # If required by SIM
        option apn '<apn>' # As required by ISP
        option pdptype '<pdp>' # Typically 'ipv4', or 'ipv4v6' or 'ipv6'

For example, the following works for most polish ISPs
config interface 'wan'
        option proto 'qmi'
        option device '/dev/cdc-wdm0'
        option auth 'none'
        option apn 'internet'
        option pdptype 'ipv4'

If you have build with LuCI, installing luci-proto-qmi helps with this
task.

Restoring the stock firmware:

Preparation:
If you took your backup using stock firmware, you will need to
reassemble the partitions into images to be restored onto the flash. The
layout might differ from ISP to ISP, this example is based on generic stock
firmware.
The only partitions you really care about are "web", "kernel", and
"rootfs". For easy padding and possibly restoring configuration, you can
concatenate most of them into images written into "ubi" meta-partition
in OpenWrt. To do so, execute something like:

cat mtd5_cfg-param.bin mtd6-oops.bin mtd7-web.bin mtd9-rootfs.bin > \
mtd8-ubi_restore.bin

You can skip the "fota" partition altogether,
it is used only for stock firmware update purposes and can be overwritten
safely anyway. The same is true for "data" partition which on my device
was found to be unused at all. Restoring mtd5_cfg-param.bin will restore
the stock firmware configuration you had before.

Method 1: Using initramfs:
- Boot to initramfs as in step 3:
- Completely detach ubi0 partition using ubidetach /dev/ubi0_0
- Look up the kernel and ubi partitions in /proc/mtd
- Copy over the stock kernel image using scp to /tmp
- Erase kernel and restore stock kernel:
  (scp mtd4_kernel.bin root@192.168.1.1:/tmp/)
  mtd write <kernel_mtd> mtd4_kernel.bin
  rm mtd4_kernel.bin
- Copy over the stock partition backups one-by-one using scp to /tmp, and
  restore them individually. Otherwise you might run out of space in
  tmpfs:

  (scp mtd3_ubiconcat0.bin root@192.168.1.1:/tmp/)

  mtd write <ubiconcat0_mtd> mtd3_ubiconcat0.bin
  rm mtd3_ubiconcat0.bin

  (scp mtd5_ubiconcat1.bin root@192.168.1.1:/tmp/)

  mtd write <ubiconcat1_mtd> mtd5_ubiconcat1.bin
  rm mtd5_ubiconcat1.bin

- If the write was correct, force a device reboot with

  reboot -f

Method 2: Using live OpenWrt system (NOT RECOMMENDED):
- Prepare a USB flash drive contatining MTD backup files
- Ensure you have kmod-usb-storage and filesystem driver installed for
  your drive
- Mount your flash drive

  mkdir /tmp/usb

  mount /dev/sda1 /tmp/usb

- Remount your UBI volume at /overlay to R/O

  mount -o remount,ro /overlay

- Write back the kernel and ubi partitions from USB drive

  cd /tmp/usb
  mtd write mtd4_kernel.bin /dev/<kernel_mtd>

  mtd write mtd8_ubi.bin /dev/<kernel_ubi>

- If everything went well, force a device reboot with
  reboot -f

Last image may be truncated a bit due to lack of space in RAM, but this will happen over "fota"
MTD partition which may be safely erased after reboot anyway.

Method 3: using built-in TFTP recovery (LAST RESORT):
- Assemble a recovery rootfs image from backup of stock partitions by
  concatenating "web", "kernel", "rootfs" images dumped from the device,
  as "root_uImage"
- Use it in place of "root_uImage" recovery initramfs image as in the
  TFTP pre-installation method.

Quirks and known issues
- Kernel partition size is increased to 4MB compared to stock 3MB, to
  accomodate future kernel updates - at this moment OpenWrt 5.10 kernel
  image is at 2.5MB which is dangerously close to the limit. This has no
  effect on booting the system - but keep that in mind when reassembling
  an image to restore stock firmware.
- uqmi seems to be unable to change APN manually, so please use the one
  you used before in stock firmware first. If you need to change it,
  please use protocok '3g' to establish connection once, or use the
  following command to change APN (and optionally IP type) manually:
  echo -ne 'AT+CGDCONT=1,"IP","<apn>' > /dev/ttyUSB0
- The only usable LED as a "system LED" is the green debug LED hidden
  inside the case. All other LEDs are controlled by modem, on which the
  router part has some influence only on Wi-Fi LED.
- Wi-Fi LED currently doesn't work while under OpenWrt, despite having
  correct GPIO mapping. All other LEDs are controlled by modem,
  including this one in stock firmware. GPIO19, mapped there only acts
  as a gate, while the actual signal source seems to be 5GHz Wi-Fi
  radio, however it seems it is not the LED exposed by ath10k as
  ath10k-phy0.
- GPIO5 used for modem reset is a suicide switch, causing a hardware
  reset of whole board, not only the modem. It is attached to
  gpio-restart driver, to restart the modem on reboot as well, to ensure
  QMI connectivity after reboot, which tends to fail otherwise.
- Modem, as in MF283+, exposes root shell over ADB - while not needed
  for OpenWrt operation at all - have fun lurking around.
- MAC address shift for 5GHz Wi-Fi used in stock firmware is
  0x320000000000, which is impossible to encode in the device tree, so I
  took the liberty of using MAC address increment of 1 for it, to ensure
  different BSSID for both Wi-Fi interfaces.

Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
 2022-02-05 12:14:08 +01:00
Sungbo Eo
c7a559980a ath79: improve support for Dongwon T&I DW02-412H 
* Move &nand node to DTSI
* Utilize nvmem for fetching caldata
* Rename build recipe, clean before build
* Simplify KERNEL definition

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
 2022-02-01 14:54:16 +09:00
Piotr Dymacz
5dfa89be99 ath79: add support for Netgear R6100 
Netgear R6100 is a dual-band Wi-Fi 5 (AC1200) router based on Qualcomm
Atheros (AR9344 + QCA9882) platform. Support for this device was first
introduced in 15f6f67d18 (ar71xx). FCC ID: PY312400225.

Specifications:

- Atheros AR9344 (560 MHz)
- 128 MB of RAM (DDR2)
- 128 MB of flash (parallel NAND)
- 2T2R 2.4 GHz Wi-Fi (AR9344)
- 2T2R 5 GHz Wi-Fi (QCA9882)
- 5x 10/100 Mbps Ethernet (AR9344)
- 4x internal antenna
- 1x USB 2.0 (GPIO-controlled power)
- 6x LED, 3x button (reset, Wi-Fi, WPS)
- UART (4-pin, 2.54 mm pitch) header on PCB
- 1x mechanical power switch
- DC jack for main power input (12 V)

WARNING: sysupgrade from older stable releases is not possible, fresh
installation (via vendor's GUI or TFTP based recovery) is required.
Reason for that is increased kernel partition size.

Installation:

Use the 'factory' image under vendor's GUI or via TFTP U-Boot recovery.
You can use the 'nmrpflash' tool at a boot time, before kernel is loaded
or start it manually by pressing the 'reset' button for ~20 seconds from
powering up the device (U-Boot will start TFTP server on 192.168.1.1,
use TFTP client to send the image).

Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com>
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
 2021-11-03 12:45:40 +01:00
Jihoon Han
84451173f0 ath79: add support for Dongwon T&I DW02-412H 
Dongwon T&I DW02-412H is a 2.4/5GHz band 11ac (WiFi-5) router, based on
Qualcomm Atheros QCA9557.

Specifications
--------------

- SoC: Qualcomm Atheros QCA9557-AT4A
- RAM: DDR2 128MB
- Flash: SPI NOR 2MB (Winbond W25Q16DVSSIG / ESMT F25L16PA(2S)) +
         NAND 64/128MB
- WiFi:
  - 2.4GHz: QCA9557 WMAC
  - 5GHz: QCA9882-BR4A
- Ethernet: 5x 10/100/1000Mbps
  - Switch: QCA8337N-AL3C
- USB: 1x USB 2.0
- UART:
  - JP2: 3.3V, TX, RX, GND (3.3V is the square pad) / 115200 8N1

Installation
--------------

1.  Connect a serial interface to UART header and
    interrupt the autostart of kernel.
2.  Transfer the factory image via TFTP and write it to the NAND flash.
3.  Update U-Boot environment variable.
    > tftpboot 0x81000000 <your image>-factory.img
    > nand erase 0x1000000
    > nand write 0x81000000 0x1000000 ${filesize}
    > setenv bootpart 2
    > saveenv

Revert to stock firmware
--------------

1.  Revert to stock U-Boot environment variable.
    > setenv bootpart 1
    > saveenv

MAC addresses as verified by OEM firmware
--------------

   WAN: *:XX (label)
   LAN: *:XX + 1
  2.4G: *:XX + 3
    5G: *:XX + 4

The label MAC address was found in art 0x0.

Credits
--------------

Credit goes to the @manatails who first developed how to port OpenWRT
to this device and had a significant impact on this patch.

And thanks to @adschm and @mans0n for guiding me to revise the code
in many ways.

Signed-off-by: Jihoon Han <rapid_renard@renard.ga>
Reviewed-by: Sungbo Eo <mans0n@gorani.run>
Tested-by: Sungbo Eo <mans0n@gorani.run>
 2021-10-31 21:58:28 +01:00
Adrian Schmutzler
6f648ed7e6 treewide: remove "+" sign for increment with macaddr_add 
Many people appear to use an unneeded "+" prefix for the increment
when calculating a MAC address with macaddr_add. Since this is not
required and used inconsistently [*], just remove it.

[*] As a funny side-fact, copy-pasting has led to almost all
    hotplug.d files using the "+", while nearly all of the
    02_network files are not using it.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
 2021-06-05 23:54:37 +02:00
Adrian Schmutzler
85b1f4d8ca treewide: remove execute bit and shebang from board.d files 
So far, board.d files were having execute bit set and contained a
shebang. However, they are just sourced in board_detect, with an
apparantly unnecessary check for execute permission beforehand.

Replace this check by one for existance and make the board.d files
"normal" files, as would be expected in /etc anyway.

Note:

This removes an apparantly unused '#!/bin/sh /etc/rc.common' in
target/linux/bcm47xx/base-files/etc/board.d/01_network

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
 2021-03-06 11:30:06 +01:00
Adrian Schmutzler
63e1ce3e09 ath79: fix position of SPDX license identifier 
Strictly, the identifier needs to be in the line directly after the
shebang.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
 2021-02-19 13:53:22 +01:00
Adrian Schmutzler
6f96a4d043 ath79: remove model name from LED labels 
Currently, we request LED labels in OpenWrt to follow the scheme

  modelname:color:function

However, specifying the modelname at the beginning is actually
entirely useless for the devices we support in OpenWrt. On the
contrary, having this part actually introduces inconvenience in
several aspects:

  - We need to ensure/check consistency with the DTS compatible
  - We have various exceptions where not the model name is used,
    but the vendor name (like tp-link), which is hard to track
    and justify even for core-developers
  - Having model-based components will not allow to share
    identical LED definitions in DTSI files
  - The inconsistency in what's used for the model part complicates
    several scripts, e.g. board.d/01_leds or LED migrations from
    ar71xx where this was even more messy

Apart from our needs, upstream has deprecated the label property
entirely and introduced new properties to specify color and
function properties separately. However, the implementation does
not appear to be ready and probably won't become ready and/or
match our requirements in the foreseeable future.

However, the limitation of generic LEDs to color and function
properties follows the same idea pointed out above. Generic LEDs
will get names like "green:status" or "red:indicator" then, and
if a "devicename" is prepended, it will be the one of an internal
device, like "phy1:amber:status".

With this patch, we move into the same direction, and just drop
the boardname from the LED labels. This allows to consolidate
a few definitions in DTSI files (will be much more on ramips),
and to drop a few migrations compared to ar71xx that just changed
the boardname. But mainly, it will liberate us from a completely
useless subject to take care of for device support review and
maintenance.
To also drop the boardname from existing configurations, a simple
migration routine is added unconditionally.

Although this seems unfamiliar at first look, a quick check in kernel
for the arm/arm64 dts files revealed that while 1033 lines have
labels with three parts *:*:*, still 284 actually use a two-part
labelling *:*, and thus is also acceptable and not even rare there.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
 2020-10-02 13:51:39 +02:00
Adrian Schmutzler
0cfdc7d446 target: update SPDX license names 
SPDX moved from GPL-2.0 to GPL-2.0-only and from GPL-2.0+ to
GPL-2.0-or-later. Reflect that in the SPDX license headers.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
 2020-09-22 20:58:26 +02:00
Davy Hollevoet
394f54ee62 ath79/nand: add support for Netgear WNDR4300TN 
This patch adds support for the WNDR4300TN, marketed by Belgian ISP
Telenet. The hardware is the same as the WNDR4300 v1, without the
fifth ethernet port (WAN) and the USB port. The circuit board has
the traces, but the components are missing.

Specifications:
* SoC: Atheros AR9344
* RAM: 128 MB
* Flash: 128 MB NAND flash
* WiFi: Atheros AR9580 (5 GHz) and AR9344 (2.4 GHz)
* Ethernet: 4x 1000Base-T
* LED: Power, LAN, WiFi 2.4GHz, WiFi 5GHz, WPS
* UART: on board, to the right of the RF shield at the top of the board

Installation:

* Flashing through the OEM web interface:
  + Connect your computer to the router with an ethernet cable and browse
    to http://192.168.0.51/
  + Log in with the default credentials are admin:password
  + Browse to Advanced > Administration > Firmware Upgrade in the Telenet
    interface
  + Upload the Openwrt firmware: openwrt-ath79-nand-netgear_wndr4300tn-squashfs-factory.img
  + Proceed with the firmware installation and give the device a few
    minutes to finish and reboot.

* Flashing through TFTP:
  + Configure your wired client with a static IP in the 192.168.1.x range,
    e.g. 192.168.1.10 and netmask 255.255.255.0.
  + Power off the router.
  + Press and hold the RESET button (the factory reset button on the bottom
    of the device, with the gray circle around it, next to the Telenet logo)
    and turn the router on while keeping the button pressed.
  + The power LED will start flashing orange. You can release the button
    once it switches to flashing green.
  + Transfer the image over TFTP:
    $ tftp 192.168.1.1 -m binary -c put openwrt-ath79-nand-netgear_wndr4300tn-squashfs-factory.img

Signed-off-by: Davy Hollevoet <github@natox.be>
[use DT label reference for adding LEDs in DTSI files]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
 2020-08-06 16:56:07 +02:00
Luochongjun
68ac3f2cdd ath79: add support for gl-e750 
The gl-e750 is a portable travel router that gives you safe access to
the internet while traveling.

Specifications:
- SoC: Qualcomm Atheros AR9531 (650MHz)
- RAM: 128 MB DDR2
- Flash: 16 MB SPI NOR (W25Q128FVSG) + 128 MB SPI NAND (GD5F1GQ4UFYIG)
- Ethernet: 10/100: 1xLAN
- Wireless: QCA9531 2.4GHz (bgn) + QCA9887 5GHz (ac)
- USB: 1x USB 2.0 port
- Switch: 1x switch
- Button: 1x reset button
- OLED Screen: 128*64 px

MAC addresses based on vendor firmware:
LAN *:a0 art 0x0
2.4GHz *:a1 art 0x1002
5GHz *:a2 art calculated from art 0x0 + 2

Flash firmware:
Since openwrt's kernel already exceeds 2MB, upgrading from the official
version of GL-inet (v3.100) using the sysupgrade command will break the
kernel image. Users who are using version 3.100 can only upgrade via
uboot. The official guidance for GL-inet is as follows:
https://docs.gl-inet.com/en/3/troubleshooting/debrick/

In the future, GL-inet will modify the firmware to support the sysupgrade
command, so users will be able to upgrade directly with the sysupgrade
command in future releases.

OLED screen control:
OLED controller is connected to QCA9531 through serial port, and can send
instructions to OLED controller directly through serial port.
Refer to the links below for a list of supported instructions:
https://github.com/gl-inet/GL-E750-MCU-instruction

Signed-off-by: Luochongjun <luochongjun@gl-inet.com>
[fix alphabetic sorting in 10-fix-wifi-mac, drop check-kernel-size]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
 2020-07-29 20:49:48 +02:00
Andrey Bondar
326e488c7b ath79: add support for 8devices Rambutan board 
Rambutan is a Wifi module based on QCA9550/9557
http://www.8devices.com/products/rambutan

Specification:

- 720/600/200 MHz (CPU/DDR/AHB)
- 128 MB of DDR2 RAM
- 128 MB of NAND Flash
- 1x 100Mbps Ethernet
- 1x 1000Mbps Ethernet (PHY on dev-kit)
- 1x Wifi radio 2x2 MIMO, dualband 2.4 and 5 GHz
- 2x U.FL connectors on module, chip antennas on dev-kit
- 1x miniPCIe slot
- 2x USB2.0 host
- 2x UART
- SPI, I2C, GPIO

Flash instructions:

Upgrade from ar71xx target:
 sysupgrade -F /tmp/openwrt-ath79-nand-8dev_rambutan-squashfs-sysupgrade.tar
or upgrade from GUI (don't save config)

Use factory image to flash from U-Boot:
 tftpboot 80060000 openwrt-ath79-nand-8dev_rambutan-squashfs-factory.ubi
 nand erase.part ubi
 nand write 80060000 ubi ${filesize}

Signed-off-by: Petr Štetiar <ynezz@true.cz> [copy&pasted missing commit description]
Signed-off-by: Andrey Bondar <a.bondar@8devices.com>
 2020-07-07 19:47:24 +02:00
Stijn Segers
9a1f4b2f83 ath79/nand: add support for Netgear WNDR4300SW 
This patch adds support for the WNDR4300SW, marketed by California ISP
SureWest (hence the 'SW' suffix). Hardware wise, it's identical to the
WNDR4300 v1.

Specifications:
* SoC: Atheros AR9344
* RAM: 128 MB
* Flash: 128 MB NAND flash
* WiFi: Atheros AR9580 (5 GHz) and AR9344 (2,4 GHz)
* Ethernet: 5x 1000Base-T
* LED: Power, WAN, LAN, WiFi, USB, WPS
* UART: on board, to the right of the RF shield at the top of the board

Installation:

* Flashing through the OEM web interface:
  + Connect your computer to the router with an ethernet cable and browse
    to http://192.168.1.1/
  + Log in with the default credentials are admin:password
  + Browse to Advanced > Administration > Firmware Upgrade in the Netgear
    interface
  + Upload the Openwrt firmware: openwrt-ath79-nand-netgear_wndr4300sw-squashfs-factory.img
  + Proceed with the firmware installation and give the device a few
    minutes to finish and reboot.

* Flashing through TFTP:
  + Configure your wired client with a static IP in the 192.168.1.x range,
    e.g. 192.168.1.10 and netmask 255.255.255.0.
  + Power off the router.
  + Press and hold the RESET button (the factory reset button on the bottom
    of the device, with the red circle around it) and turn the router on
    while keeping the button pressed.
  + The power LED will start flashing orange. You can release the button
    once it switches to flashing green.
  + Transfer the image over TFTP:
    $ tftp 192.168.1.1 -m binary -c put openwrt-ath79-nand-netgear_wndr4300sw-squashfs-factory.img

Signed-off-by: Stijn Segers <foss@volatilesystems.org>
 2020-05-24 14:44:00 +02:00
Guillaume Lefebvre
f5a9181d6e ath79: fix wmac initialization for Zyxel NBG6716 
2.4 GHz Wifi on ath79 is set up in 10-ath9k-eeprom, but in ar71xx
it was done with ath79_register_wmac.

Thus, the following errors are observed on the device:
ath: phy1: Unable to initialize hardware; initialization status: -5
ath9k 18100000.wmac: failed to initialize device
ath9k: probe of 18100000.wmac failed with error -5

This patch changes the ath79 support to properly use wmac as well.
This will also require fixing the MAC address in a different way.

Signed-off-by: Guillaume Lefebvre <guillaume@zelig.ch>
[several adjustments to 10-fix-wifi-mac, use correct MAC address,
rewrite commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
 2020-04-13 19:21:56 +02:00
Adrian Schmutzler
85aef6f627 ath79: fix MAC addresses for ethernet on ZyXEL NBG6716 
MAC addresses of the ethernet devices (eth0 & eth1) are randomly set at
boot time by the ag71xx driver, because it is currently not possible to
retrieve MAC addresses in ASCII format within the DTS file.
This commit works around this behaviour by setting the MAC addresses
during the preinit phase.

The same has been implemented recently for the Siemens WS-AP3610 in
d2b8ccb1c0 ("ath79: add support for Siemens WS-AP3610").

MAC assignment in vendor firmware is as follows:

use   vendor   address     OpenWrt
2g    wifi0    ethaddr     -> wlan1
5g    wifi1    ethaddr +1  -> wlan0
lan   eth1     ethaddr +2  -> eth0
wan   eth0     ethaddr +3  -> eth1

ethaddr is retrieved by $(mtd_get_mac_ascii u-boot-env ethaddr)

Note that both Wifi and ethernet indexing is swapped in OpenWrt
compared to vendor firmware.

Suggested-by: Guillaume Lefebvre <guillaume@zelig.ch>
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Tested-by: Kevin Gagnon <kevin_gagnon@videotron.ca>
 2020-04-08 16:59:14 +02:00
Roger Pueyo Centelles
a66eee6336 ath79: add mikrotik subtarget 
This commit creates the ath79/mikrotik subtarget in order to support
MikroTik devices based on Qualcomm Atheros MIPS SoCs.

MikroTik devices need a couple of specific features: the split MiNOR
firmware MTD format, which is not used by other devices, and the 4k
sector erase size on SPI NOR storage, which can not be added to the
ath79/generic and ath79/nand subtargets now.

Additionally, the commit moves the two MikroTik devices already in
the generic and nand subtargets to this new one.

Tested on the RB922 board and the wAP AC router.

Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
 2020-03-17 11:50:47 +01:00
WeiDong Jia
643cab4f31 ath79: add support for DomyWifi DW33D 
This commit ports the device from ar71xx to the ath79 target and
modifies the partition layout.
1. Firmware is installed to nand flash.
2. Modify the uboot-env parameter to boot from the nand flash.
3. The kernel size is extended to 5M.
4.nor flash retains the oem firmware.

oem partition layout
dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00e30000 00010000 "rootfs"
mtd3: 00170000 00010000 "kernel"
mtd4: 00010000 00010000 "art"
mtd5: 00f90000 00010000 "firmware"
mtd6: 06000000 00020000 "rootfs_data"
mtd7: 02000000 00020000 "backup"

new partition layout
dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00fa0000 00010000 "oem-firmware"
mtd3: 00010000 00010000 "art"
mtd4: 00500000 00020000 "kernel"
mtd5: 05b00000 00020000 "ubi"
mtd6: 02000000 00020000 "oem-backup"

MAC address overview:
All mac addresses are stored in the art partition.
eth0: 0x0
eth1: 0x6
ath9k: 0xc
ath10k: 0x12
No valid addresses in 0x1002 and 0x5006. All addresses match the OEM
firmware.

Install from oem firmware.
Enable ssh service:
Connect to the router web, click professional, click system-startup,
and add dropbear in the local startup input box. Click
system-administration, delete ssh-key, and replace your ssh pub key.
Restart the router.
1.Upload openwrt firmware to the device
scp openwrt-snapshot-r11365-df60a0852c-ath79-nand-domywifi_dw33d-\
squashfs-factory.bin root@192.168.10.1:/tmp
2.modify uboot-env.
ssh login to the device:
fw_setenv bootcmd 'nboot 0x8050000 0;bootm || bootm 0x9fe80000'
Run the fw_printenv command to check if the settings are correct.
3.Write openwrt firmware.
ssh login to the device:
mtd -r write /tmp/openwrt-snapshot-r11365-df60a0852c-ath79-nand-\
domywifi_dw33d-squashfs-factory.bin /dev/mtd6
The device will restart automatically and the openwrt firmware
installation is complete.

Restore oem firmware.just erase the kernel partition and the ubi
partition.
ssh login to the device:
mtd erase /dev/mtd4
mtd -r erase /dev/mtd5
Reboot the device

Signed-off-by: WeiDong Jia <jwdsccd@gmail.com>
[alter flash instruction in commit message]
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
 2020-03-07 11:02:13 +08:00
Roger Pueyo Centelles
8f93c05a59 ath79: add support for MikroTik RouterBOARD 922UAGS-5HPacD 
This patch ports support for the MikroTik RouterBOARD 922UAGS-5HPacD
with a built-in 802.11ac High-Power radio (31dBm), which was already
available in the ar71xx target.

See https://mikrotik.com/product/RB922UAGS-5HPacD for more info.

Specifications:
- SoC: Qualcomm Atheros QCA9558 (720 MHz)
- RAM: 128 MB
- Storage: 128 MB NAND
- Wireless: external QCA9882 802.11a/ac 2x2:2
- Ethernet: 1x 1000/100/10 Mbps, integrated, via AR8031 PHY, passive PoE-in 24V
- SFP: 1x host
- USB: 1x 2.0 type A
- PCIe: 1x Mini slot (also contains USB 2.0 for 3G/LTE modems)
- SIM slot: 1x mini-SIM

Working:
- Board/system detection
- SPI and NAND storage
- PCIe
- USB type A host
- Wireless
- Ethernet
- LEDs (user, phy0)
- Reset button
- Sysupgrade to/from ar71xx

Not supported:
- RSSI LEDs
- SFP cage

Installation methods:
- Sysupgrade from ar71xx (it is advisable to use the -n option to
wipe any previous settings), or
- Boot the initramfs image via TFTP and then flash the sysupgrade
image using "sysupgrade -n"

Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
 2020-02-26 14:46:46 +01:00
Michal Cieslakiewicz
a736f39432 ath79: add support for Netgear WNDR4500 v3 
This patch introduces support for Netgear WNDR4500v3. Router
is very similar to WNDR4300v2 and is based on the same PCB.

Information gathered from various Internet sources (including
https://patchwork.ozlabs.org/patch/809227/) shows following
differences to WNDR4300v2:

 * two USB 2.0 ports with separate LEDs
 * USB LEDs soldered to secondary pads
 * WPS and RFKILL buttons soldered to secondary pads
 * described as N900 device with 3x3:3 MIMO for 2.4GHz radio
 * power supply requirement is DC 12V 2.5A
 * vendor HW ID suffix differs in one digit
 * bigger chassis

Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
 2020-01-15 20:56:05 +01:00
Michal Cieslakiewicz
37a36a588a ath79: add support for Netgear WNDR4300 v2 
This patch introduces support for Netgear WNDR4300v2.

Specification
=============
  * Description: Netgear WNDR4300 v2
  * Loader: U-boot
  * SOC: Qualcomm Atheros QCA9563 (775 MHz)
  * RAM: 128 MiB
  * Flash: 2 MiB SPI-NOR + 128 MiB SPI-NAND
	- NOR: U-boot binary: 256 KiB
	- NOR: U-boot environment: 64 KiB
	- NOR: ART Backup: 64 KiB
 	- NOR: Config: 64 KiB
	- NOR: Traffic Meter: 64 KiB
	- NOR: POT: 64 KiB
	- NOR: Reserved: 1408 KiB
	- NOR: ART: 64 KiB
	- NAND: Firmware: 25600 KiB (see notes for OpenWrt)
	- NAND: Language: 2048 KiB
	- NAND: mtdoops Crash Dump: 128 KiB
	- NAND: Reserved: 103296 KiB
  * Ethernet: 5 x 10/100/1000 (4 x LAN, 1 x WAN) (AR8337)
  * Wireless:
	- 2.4 GHz b/g/n (internal)
	- 5 GHz a/n (AR9580)
  * USB: yes, 1 x USB 2.0
  * Buttons:
	- Reset
	- WiFi (rfkill)
	- WPS
  * LEDs:
	- Power (amber/green)
	- WAN (amber/green)
	- WLAN 2G (green)
	- WLAN 5G (blue)
	- 4 x LAN (amber/green)
	- USB (green)
	- WPS (green)
  * UART: 4-pin connector JP1, 3.3V (Vcc, TX, RX, GND), 115200 8N1
  * Power supply: DC 12V 1.5A
  * MAC addresses: LAN=WLAN2G on case label, WAN +1, WLAN5G +2

Important Notes
===============
0. NOR Flash (2 MiB) is not touched by OpenWrt installation.
1. NAND Flash (128 MiB) layout under OpenWrt is changed as follows:
   all space is split between 4 MiB kernel and 124 MiB UBI areas;
   vendor partitions (language and mtdoops) are removed; kernel space
   size can be further expanded if needed; maximum image size is set
   to 25600k for compatibility reasons and can also be increased.
2. CPU clock is 775 MHz, not 750 MHz.
3. 5 GHz wireless radio chip is Atheros AR9580-AR1A with bogus PCI
   device ID 0xabcd. For ath9k driver to load successfully, this is
   overriden in DTS with correct value for this chip, 0x0033.
4. RFKILL button is wired to AR9580 pin 9 which is normally disabled
   by chip definition in ath9k code (0x0000F4FF gpio mask). Therefore
   'qca,gpio-mask=<0xf6ff>' hack must be used for button to work
   properly.
5. USB port is always on, no GPIO for 5V power control has been
   identified.

Installation
============
  * TFTP recovery
  * TFTP via U-boot prompt
  * sysupgrade
  * Web interface

Test build configuration
========================
CONFIG_TARGET_ath79=y
CONFIG_TARGET_ath79_nand=y
CONFIG_TARGET_ath79_nand_DEVICE_netgear_wndr4300-v2=y
CONFIG_ALL_KMODS=y
CONFIG_DEVEL=y
CONFIG_CCACHE=y
CONFIG_COLLECT_KERNEL_DEBUG=y
CONFIG_IMAGEOPT=y

Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
 2020-01-15 20:55:56 +01:00
Paul Blazejowski
7e623c3128 ath79: add support for Netgear WNDR3700v4 
This patch adds ath79 support for Netgear WNDR3700v4.
Router was previously supported by ar71xx target only.
Note: device requires 'ar934x-nand' driver in kernel.

Specification
=============
  * Description: Netgear WNDR3700v4
  * Loader: U-boot
  * SOC: Atheros AR9344 (560 MHz)
  * RAM: 128 MiB
  * Flash: 128 MiB (NAND)
    - U-boot binary: 256 KiB
    - U-boot environment: 256 KiB
    - ART: 256 KiB
    - POT: 512 KiB
    - Language: 2 MiB
    - Config: 512 KiB
    - Traffic Meter: 3 MiB
    - Firmware: 25 MiB
    - ART Backup: 256 KiB
    - Reserved: 96 MiB
  * Ethernet: 5 x 10/100/1000 (4 x LAN, 1 x WAN) (AR8327)
  * Wireless:
    - 2.4 GHz b/g/n (internal)
    - 5 GHz a/n (AR9580)
  * USB: yes, 1 x USB 2.0
  * Buttons:
    - Reset
    - WiFi (rfkill)
    - WPS
  * LEDs:
    - Power (amber/green)
    - WAN (amber/green)
    - WLAN 2G (green)
    - WLAN 5G (blue)
    - 4 x LAN (amber/green)
    - USB (green)
    - WPS (amber/green)
  * UART: 4-pin connector JP1, 3.3V (Vcc, TX, RX, GND), 115200 8N1
  * Power supply: DC 12V 2.5A
  * MAC addresses: LAN=WLAN2G on case label, WAN +1, WLAN5G +2

Installation
============
  * TFTP recovery
  * TFTP via U-boot prompt
  * sysupgrade
  * Web interface

Note about partitioning: firmware partition offset (0x6c0000) is
hardcoded into vendor's u-boot, so this partition cannot be moved
and resized to include Netgear-specific flash areas (pot, language,
config, traffic_meter) not used by OpenWrt.

Test build configuration
========================
CONFIG_TARGET_ath79=y
CONFIG_TARGET_ath79_nand=y
CONFIG_TARGET_ath79_nand_DEVICE_netgear_wndr3700-v4=y
CONFIG_ALL_KMODS=y
CONFIG_DEVEL=y
CONFIG_CCACHE=y
CONFIG_COLLECT_KERNEL_DEBUG=y
CONFIG_IMAGEOPT=y

Signed-off-by: Paul Blazejowski <paulb@blazebox.homeip.net>
 2019-11-14 23:14:15 +01:00
Jeff Kletsky
b496a2294c ath79: GL-AR750S: provide NAND support; increase kernel to 4 MB 
The GL.iNet GL-AR750S has been supported by the ar71xx and ath79
platforms with access to its 16 MB NOR flash, but not its 128 MB
SPI NAND flash.

This commit provides support for the NAND through the upstream
SPI-NAND framework.

At this time, the OEM U-Boot appears to only support loading the
kernel from NOR. This configuration is preserved as this time,
with the glinet,gl-ar750s-nand name reserved for a potential,
future, NAND-only boot.

The family of GL-AR750S devices on the ath79 platform now includes:

  * glinet,gl-ar750m-nor-nand   "nand" target
  * glinet,gl-ar750m-nor        "nand" target (NAND-aware)

NB: This commit increases the kernel size from 2 MB to 4 MB

"Force-less" sysupgrade is presently supported from the current
versions of following NOR-based firmwre images to the version of
glinet,gl-ar750s-nor firmware produced by this commit:

  * glinet,gl-ar750s     -- OpenWrt 19.07 ar71xx
  * glinet,gl-ar750s     -- OpenWrt 19.07 ath79

Users who have sucessfully upgraded to glinet,gl-ar750m-nor may then
flash glinet,gl-ar750m-nor-nand with sysupgrade to transtion to the
NAND-based variant.

Other upgrades to these images, including directly to the NAND-based
glinet,gl-ar750s-nor-nand firmware, can be accomplished through U-Boot.

NB: See "ath79: restrict GL-AR750S kernel build-size to 2 MB" which
enables flashing of NAND factory.img with the current GL-iNet U-Boot,
"U-Boot 1.1.4-gcf378d80-dirty (Aug 16 2018 - 07:51:15)"

The GL-AR750S OEM U-Boot allows upload and flashing of either NOR
firmware (sysupgrade.bin) or NAND firmware (factory.img) through its
HTTP-based GUI. Serial connectivity is not required.

The glinet,gl-ar750s-nor and glinet,gl-ar750s-nor-nand images
generated after this commit flash each other directly.

This commit changes the control of the USB VBUS to gpio-hog from
regulator-fixed introduced by commit 0f6b944c92. This reduces the
compressed kernel size by ~14 kB, with no apparent loss of
functionality. No other ath79-nand boards are using regulator-fixed
at this time.

Note: mtd_get_mac_binary art 0x5006 does not return the proper MAC
and the GL.iNet source indicates that only the 0x0 offset is valid

The ar71xx targets are unmodified.

Cc: Alexander Wördekemper <alexwoerde@web.de>

Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
 2019-11-14 14:38:58 +08:00
Jeff Kletsky
55e6c903ae ath79: GL-AR300M: provide NAND support; increase to 4 MB kernel 
The GL.iNet GL-AR300M has been supported by the ar71xx and ath79
platforms with access to its 16 MB NOR flash, but not its 128 MB
SPI NAND flash.

This commit provides support for the NAND through the upstream
SPI-NAND framework. Devices with both NOR and NAND flash can support
independent firmware on each, with U-Boot able to boot from either.
The OEM U-Boot will fall back to the NOR firmware after three
"unsuccessful" boots.

The family of GL-AR300M devices on the ath79 platform now includes:

  * glinet,gl-ar300m-lite       "generic" target, NOR-only board
  * glinet,gl-ar300m-nand       "nand" target
  * glinet,gl-ar300m-nor        "nand" target (NAND-aware)

NB: This commit increases the kernel size from 2 MB to 4 MB

"Force-less" sysupgrade is presently supported from the current
versions of following NOR-based firmwre images to the version of
glinet,gl-ar300m-nor firmware produced by this commit:

  * gl-ar300m            -- OEM v3 NOR    ar71xx (openwrt-ar300m16-*.bin)
  * gl-ar300m            -- OpenWrt 18.06 ar71xx
  * gl-ar300m            -- OpenWrt 19.07 ar71xx

Other upgrades to these images should be performed through U-Boot.

The GL-AR300M OEM U-Boot allows upload and flashing of either NOR
firmware (sysupgrade.bin) or NAND firmware (factory.img) through its
HTTP-based GUI. Serial connectivity is not required.

The glinet,gl-ar300m-nand and glinet,gl-ar300m-nor images generated
after this commit should safely flash each other using sysupgrade.

The boot counter is implemented by the OEM using u-boot-env. At this
time, it does not appear that the switch on the side of the unit can
be used to select NOR vs. NAND boot and the fail-over is only from
NAND to NOR. To save flash wear, it is only reset when running the
glinet,gl-ar300m-nand firmware.

NAND-specific base-files are used to remove impact on existing
generic and tiny targets.

As there is now no "generic" build appropriate for the GL-AR300M16,
(or for users of the GL-AR300M that do not need access to NAND)
it will be introduced in a subsequent commit.

Note: `mtd_get_mac_binary art 0x6` does not return the proper MAC
and the GL.iNet source indicates that only the 0x0 offset is valid

The ar71xx targets are unmodified.

Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
 2019-11-14 14:38:58 +08:00
Adrian Schmutzler
6d00e6fc7b ath79: fix several issues for ZyXEL NBG6716 
This fixes several issues introduced with ZyXEL NBG6716 support:
- Inhomogeneous indent
- Wrong ath10k MAC patching function
- Wrong brackets for pad-to in nand.mk
- Add missing DEVICE_MODEL
- Remove k2t.sh include (copy/paste leftover)

Fixes: 99835e0999 ("ath79: add support for ZyXEL NBG6716")

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
 2019-11-02 20:51:56 +01:00
Michal Cieslakiewicz
9b6f89c37f ath79: add support for Netgear WNDR4300 
This patch adds ath79 support for Netgear WNDR4300.
Router was previously supported by ar71xx target only.
Note: device requires 'ar934x-nand' driver in kernel.

Specification
=============
  * Description: Netgear WNDR4300
  * Loader: U-boot
  * SOC: Atheros AR9344 (560 MHz)
  * RAM: 128 MiB
  * Flash: 128 MiB (NAND)
	- U-boot binary: 256 KiB
	- U-boot environment: 256 KiB
	- ART: 256 KiB
	- POT: 512 KiB
	- Language: 2 MiB
	- Config: 512 KiB
	- Traffic Meter: 3 MiB
	- Firmware: 25 MiB
	- ART Backup: 256 KiB
	- Reserved: 96 MiB
  * Ethernet: 5 x 10/100/1000 (4 x LAN, 1 x WAN) (AR8327)
  * Wireless:
	- 2.4 GHz b/g/n (internal)
	- 5 GHz a/n (AR9580)
  * USB: yes, 1 x USB 2.0
  * Buttons:
	- Reset
	- WiFi (rfkill)
	- WPS
  * LEDs:
	- Power (amber/green)
	- WAN (amber/green)
	- WLAN 2G (green)
	- WLAN 5G (blue)
	- 4 x LAN (amber/green)
	- USB (green)
	- WPS (amber/green)
  * UART: 4-pin connector JP1, 3.3V (Vcc, TX, RX, GND), 115200 8N1
  * Power supply: DC 12V 2.5A
  * MAC addresses: LAN=WLAN2G on case label, WAN +1, WLAN5G +2

Installation
============
  * TFTP recovery
  * TFTP via U-boot prompt
  * sysupgrade
  * Web interface

Note about partitioning: firmware partition offset (0x6c0000) is
hardcoded into vendor's u-boot, so this partition cannot be moved
and resized to include Netgear-specific flash areas (pot, language,
config, traffic_meter) not used by OpenWrt.

Test build configuration
========================
CONFIG_TARGET_ath79=y
CONFIG_TARGET_ath79_nand=y
CONFIG_TARGET_ath79_nand_DEVICE_netgear_wndr4300=y
CONFIG_ALL_KMODS=y
CONFIG_DEVEL=y
CONFIG_CCACHE=y
CONFIG_COLLECT_KERNEL_DEBUG=y
CONFIG_IMAGEOPT=y

Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
 2019-11-02 19:29:30 +01:00
Adrian Schmutzler
b288c56e1e ath79: move base-files for ZyXEL NBG6716 
Due to rebase of the base-files split patch after adding support
for the ZyXEL NBG6716, its base-files were added to the generic
subtarget, although the device belongs to the nand subtarget.

This moves the definitions to their proper locations.

Fixes: 0130022bae ("ath79: split base-files into subtargets")

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
[improve commit message, rebase]
Signed-off-by: David Bauer <mail@david-bauer.net>
 2019-10-27 18:03:56 +01:00