mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-29 01:59:02 +00:00
3b30ff2975
4 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Jeff Kletsky
|
819e7946b0 |
ipq40xx: Add support for Linksys EA8300 (Dallas)
The Linksys EA8300 is based on QCA4019 and QCA9888 and provides three,
independent radios. NAND provides two, alternate kernel/firmware
images with fail-over provided by the OEM U-Boot.
Installation:
"Factory" images may be installed directly through the OEM GUI.
Hardware Highlights:
* IPQ4019 at 717 MHz (4 CPUs)
* 256 MB NAND (Winbond W29N02GV, 8-bit parallel)
* 256 MB RAM
* Three, fully-functional radios; `iw phy` reports (FCC/US, -CT):
* 2.4 GHz radio at 30 dBm
* 5 GHz radio on ch. 36-64 at 23 dBm
* 5 GHz radio on ch. 100-144 at 23 dBm (DFS), 149-165 at 30 dBm
#{ managed } <= 16, #{ AP, mesh point } <= 16, #{ IBSS } <= 1
* All two-stream, MCS 0-9
* 4x GigE LAN, 1x GigE Internet Ethernet jacks with port lights
* USB3, single port on rear with LED
* WPS and reset buttons
* Four status lights on top
* Serial pads internal (unpopulated)
"Linksys Dallas WiFi AP router based on Qualcomm AP DK07.1-c1"
Implementation Notes:
The OEM flash layout is preserved at this time with 3 MB kernel and
~69 MB UBIFS for each firmware version. The sysdiag (1 MB) and
syscfg (56 MB) partitions are untouched, available as read-only.
Serial Connectivity:
Serial connectivity is *not* required to flash.
Serial may be accessed by opening the device and connecting
a 3.3-V adapter using 115200, 8n1. U-Boot access is good,
including the ability to load images over TFTP and
either run or flash them.
Looking at the top of the board, from the front of the unit,
J3 can be found on the right edge of the board, near the rear
|
J3 |
|-| |
|O| | (3.3V seen, open-circuit)
|O| | TXD
|O| | RXD
|O| |
|O| | GND
|-| |
|
Unimplemented:
* serial1 "ttyQHS0" (serial0 works as console)
* Bluetooth; Qualcomm CSR8811 (potentially conected to serial1)
Other Notes:
https://wikidevi.com/wiki/Linksys_EA8300 states
FCC docs also cover the Linksys EA8250. According to the
RF Test Report BT BR+EDR, "All models are identical except
for the EA8300 supports 256QAM and the EA8250 disable 256QAM."
Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
|
||
Marius Genheimer
|
9ad3967f14 |
ipq40xx: add support for ASUS Lyra
SoC: Qualcomm IPQ4019 (Dakota) 717 MHz, 4 cores
RAM: 256 MiB (Nanya NT5CC128M16IP-DI)
FLASH: 128 MiB (Macronix NAND)
WiFi0: Qualcomm IPQ4019 b/g/n 2x2
WiFi1: Qualcomm IPQ4019 a/n/ac 2x2
WiFi2: Qualcomm Atheros QCA9886 a/n/ac
BT: Atheros AR3012
IN: WPS Button, Reset Button
OUT: RGB-LED via TI LP5523 9-channel Controller
UART: Front of Device - 115200 N-8
Pinout 3.3v - RX - TX - GND (Square is VCC)
Installation:
1. Transfer OpenWRT-initramfs image to the device via SSH to /tmp.
Login credentials are identical to the Web UI.
2. Login to the device via SSH.
3. Flash the initramfs image using
> mtd-write -d linux -i openwrt-image-file
4. Power-cycle the device and wait for OpenWRT to boot.
5. From there flash the OpenWRT-sysupgrade image.
Ethernet-Ports: Although labeled identically, the port next to
the power socket is the LAN port and the other one is WAN. This
is the same behavior as in the stock firmware.
Signed-off-by: Marius Genheimer <mail@f0wl.cc>
[Dropped setup_mac 02_network in favour of 05_set_iface_mac_ipq40xx.sh,
reorderd 02_network entries, added board.bin WA for the QCA9886 from ath79,
minor dts touchup, added rng to 4.19 dts]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
|
||
Christian Lamparter
|
82618062cf |
ipq40xx: add support for the ZyXEL NBG6617
This patch adds support for ZyXEL NBG6617
Hardware highlights:
SOC: IPQ4018 / QCA Dakota
CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7
DRAM: 256 MiB DDR3L-1600/1866 Nanya NT5CC128M16IP-DI @ 537 MHz
NOR: 32 MiB Macronix MX25L25635F
ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN)
USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC)
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
INPUT: RESET Button, WIFI/Rfkill Togglebutton, WPS Button
LEDS: Power, WAN, LAN 1-4, WLAN 2.4GHz, WLAN 5GHz, USB, WPS
Serial:
WARNING: The serial port needs a TTL/RS-232 3.3v level converter!
The Serial setting is 115200-8-N-1. The 1x4 .1" header comes
pre-soldered. Pinout:
1. 3v3 (Label printed on the PCB), 2. RX, 3. GND, 4. TX
first install / debricking / restore stock:
0. Have a PC running a tftp-server @ 192.168.1.99/24
1. connect the PC to any LAN-Ports
2. put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file
into the tftp-server root directory and rename it to just "ras.bin".
3. power-cycle the router and hold down the the WPS button (for 30sek)
4. Wait (for a long time - the serial console provides some progress
reports. The u-boot says it best: "Please be patient".
5. Once the power LED starts to flashes slowly and the USB + WPS LEDs
flashes fast at the same time. You have to reboot the device and
it should then come right up.
Installation via Web-UI:
0. Connect a PC to the powered-on router. It will assign your PC a
IP-address via DHCP
1. Access the Web-UI at 192.168.1.1 (Default Passwort: 1234)
2. Go to the "Expert Mode"
3. Under "Maintenance", select "Firmware-Upgrade"
4. Upload the OpenWRT factory image
5. Wait for the Device to finish.
It will reboot into OpenWRT without any additional actions needed.
To open the ZyXEL NBG6617:
0. remove the four rubber feet glued on the backside
1. remove the four philips screws and pry open the top cover
(by applying force between the plastic top housing from the
backside/lan-port side)
Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
|NBG6617> HELP
|ATEN x[,y] set BootExtension Debug Flag (y=password)
|ATSE x show the seed of password generator
|ATSH dump manufacturer related data in ROM
|ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO boot up whole system
|ATUR x upgrade RAS image (filename)
|NBG6617>
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
|NBG6617> ATSE NBG6617
|012345678901
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711
copy and paste the result into the shell to unlock zloader.
|NBG6617> ATEN 1,0046B0017430
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
|NBG6617> ATGU
|NBG6617#
Co-authored-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: David Bauer <mail@david-bauer.net>
|
||
Chris Blake
|
4943afd781 |
ipq40xx: add Cisco Meraki MR33 Support
This patch adds support for Cisco Meraki MR33 hardware highlights: SOC: IPQ4029 Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7 DRAM: 256 MiB DDR3L-1600 @ 627 MHz Micron MT41K128M16JT-125IT NAND: 128 MiB SLC NAND Spansion S34ML01G200TFV00 (106 MiB usable) ETH: Qualcomm Atheros AR8035 Gigabit PHY (1 x LAN/WAN) + PoE WLAN1: QCA9887 (168c:0050) PCIe 1x1:1 802.11abgn ac Dualband VHT80 WLAN2: Qualcomm Atheros QCA4029 2.4GHz 802.11bgn 2:2x2 WLAN3: Qualcomm Atheros QCA4029 5GHz 802.11a/n/ac 2:2x2 VHT80 LEDS: 1 x Programmable RGB+White Status LED (driven by Ti LP5562 on i2c-1) 1 x Orange LED Fault Indicator (shared with LP5562) 2 x LAN Activity / Speed LEDs (On the RJ45 Port) BUTTON: one Reset button MISC: Bluetooth LE Ti cc2650 PG2.3 4x4mm - BL_CONFIG at 0x0001FFD8 AT24C64 8KiB EEPROM Kensington Lock Serial: WARNING: The serial port needs a TTL/RS-232 3V3 level converter! The Serial setting is 115200-8-N-1. The board has a populated 1x4 0.1" header with half-height/low profile pins. The pinout is: VCC (little white arrow), RX, TX, GND. Flashing needs a serial adaptor, as well as patched ubootwrite utility (needs Little-Endian support). And a modified u-boot (enabled Ethernet). Meraki's original u-boot source can be found in: <https://github.com/riptidewave93/meraki-uboot/tree/mr33-20170427> Add images to do an installation via bootloader: 0. open up the MR33 and connect the serial console. 1. start the 2nd stage bootloader transfer from client pc: # ubootwrite.py --write=mr33-uboot.bin (The ubootwrite tool will interrupt the boot-process and hence it needs to listen for cues. If the connection is bad (due to the low-profile pins), the tool can fail multiple times and in weird ways. If you are not sure, just use a terminal program and see what the device is doing there. 2. power on the MR33 (with ethernet + serial cables attached) Warning: Make sure you do this in a private LAN that has no connection to the internet. - let it upload the u-boot this can take 250-300 seconds - 3. use a tftp client (in binary mode!) on your PC to upload the sysupgrade.bin (the u-boot is listening on 192.168.1.1) # tftp 192.168.1.1 binary put openwrt-ipq40xx-meraki_mr33-squashfs-sysupgrade.bin 4. wait for it to reboot 5. connect to your MR33 via ssh on 192.168.1.1 For more detailed instructions, please take a look at the: "Flashing Instructions for the MR33" PDF. This can be found on the wiki: <https://openwrt.org/toh/meraki/mr33> (A link to the mr33-uboot.bin + the modified ubootwrite is also there) Thanks to Jerome C. for sending an MR33 to Chris. Signed-off-by: Chris Blake <chrisrblake93@gmail.com> Signed-off-by: Mathias Kresin <dev@kresin.me> Signed-off-by: Christian Lamparter <chunkeey@gmail.com> |