Commit Graph

71 Commits

Author SHA1 Message Date
JinGen Lim
b38d446ecd
ipq806x: add support for Fortinet FAP-421E
Hardware
--------

SoC:    Qualcomm IPQ8064
RAM:    235MB
Flash:  128MB NAND (Micron MT29F1G08ABBDAH4)
        32MB SPI-NOR (Spansion FL256SAIFRO)
WLAN2:  Qualcomm Atheros QCA9980
WLAN5:  Qualcomm Atheros QCA9980
ETH:    LAN1 - Atheros AR8035
        LAN2 - Atheros AR8033
USB:    USB-A, 2.0
LED:    Power (yellow/amber)
        LAN1 (yellow/amber)
        LAN2 (yellow/amber)
        WLAN2G (yellow)
        WLAN5G (yellow)
BTN:    Reset
Serial: RJ45 Port (9600 8n1) Cisco console cable, TTL voltage

MAC Address:    LAN1 (label) at APPSBL partition
                LAN2: label + 1
                WLAN2: label + 8
                WLAN5: label + 16

Installation
------------

Connect to the RJ45 console (TTL)
Connect LAN1 to host, set host ip as 192.168.1.10
Start a tftp server to serve the initramfs image
Open console connection (9600n8)
Connect power through the DC jack

`Hit any key to stop autoboot:  5`: press any key
`Enter G,Q,or H:`: press `K` to access the hidden option
`Enter password:`: `fap22b1!$` to access a limited u-boot console
`(FAP) #`: `tftpboot your_initramfs_image_name.itb`
`(FAP) #`: `bootm`

Once OpenWrt has booted, install the firmware through sysupgrade

Signed-off-by: JinGen Lim <openwrt@sn.sg>
2024-01-15 16:57:50 +01:00
Glen Lee
3aef61060e
ipq806x: add support for Extreme Networks AP3935
Extreme Networks AP3935i/e -
https://www.extremenetworks.com/support/documentation/access-points-ap3935i-e/

SoC: IPQ8068 QYY AT46279K45060I
RAM: NANYA 1527 NT5CC256M16DP-DI 515073W0EF 7 TW
FLASH: NOR - S25FL256S1 - 32MB
       NAND - Macronix MX30UF4G28AB - 512MB
LAN: Atheros AR8035-A J5150WL 1515 CN - RGMII
LAN2: Atheros AR8033-AL1A SKCSR.AJ1 1444 China - SGMII
WLAN2: QCA9990 OVV FNPV209 K451406
WLAN5: QCA9990 OVV FNPV209 K451406
SERIAL: RS232 Port (115200 8n1) Cisco console cable and
        4pin Serial Header | 3.3 | GND | RX | TX

MAC address for LAN1/LAN2/WLAN 2G/WLAN 5G in uboot env

 * Installation via either RJ45 console or on-board 4 PIN header

Install Method
--------------
1) Setup TFTP server, and place
     openwrt-ipq806x-generic-extreme_ap3935-initramfs-uImage image
     in /srv/tftp or similar
2) Connect to console on router and connect ethernet port "LAN1" to
     your LAN
3) Interupt the boot with any character
4) Login with admin/new2day for default password
     (use reset/FactoryDefault if password needs to be reset)
5) Set serverip to TFTP IP: set serverip 192.168.1.2
6) Set ipaddr to another IP: set ipaddr 192.168.1.101
7) Make uboot ping something to activate eth0 on boot:
     set bootcmd 'ping 192.168.1.1; run boot_flash'
     saveenv
8) TFTP image to RAM:
     tftpboot 0x42000000
openwrt-ipq806x-generic-extreme_ap3935i-initramfs-uImage
9) Boot image: bootm 0x42000000
     In OpenWRT, "LAN1" is LAN, "LAN2" is WAN
10) SFTP openwrt-ipq806x-generic-extreme_ap3935-squashfs-nand-sysupgrade.bin
     image to /tmp
11) sysupgrade /tmp/openwrt-*-nand-sysupgrade.bin

Signed-off-by: Glen Lee <g2lee@yahoo.com>
2023-10-05 00:56:57 +02:00
Brian Norris
7b78a19e6a ipq806x: Correct OnHub sysupgrade config logic
There's a typo in here: board_name is a function, not a variable. This
issue was pointed out on the OpenWrt forum.

Closes: #13409

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
2023-09-12 23:36:30 +02:00
Andrzej Mialkowski
f2e1d37381
ipq806x: Add support for Netgear Nighthawk Pro Gaming XR450
Motivation:
 Firmware with platform ID "XR450" required for easy installation.

Manufacturer pages:
 Product page: https://www.netgear.com/support/product/xr450
 Product Data Sheet: https://www.netgear.com/images/datasheet/networking/wifirouter/XR450.pdf
 Current firmware: https://www.downloads.netgear.com/files/GDC/XR450/XR450-V2.3.2.134.zip

Specifications:
Almost identical to Netgear XR500(https://openwrt.org/toh/hwdata/netgear/netgear_xr500)

Differences:
	Platform ID: XR450, utilized for firmware validation
	WLAN 2.4GHz: b/g/n Supports QAM64 (XR500 QAM256)

SoC: Qualcomm Atheros IPQ8065
RAM: 512 MB
Storage: 256 MiB
Wireless: Qualcomm Atheros QCA9984
Switch: Qualcomm Atheros AR8337 rev. 2
Ethernet: 5x 1000/100/10
USB: 2x 3.0

Install via WEB GUI (recommended):
1. Navigate within GUI to firmware update section
2. Select openwrt-ipq806x-netgear_xr450-squashfs-factory.img
3. Dismiss downgrade warning

Install via TFTP recovery (same as XR500/R7800):

1. Configure host PC to use static address 192.168.1.10 https://openwrt.org/toh/netgear/r7800#prerequisites_for_tftp_flashing
2. Flash openwrt-ipq806x-netgear_xr450-squashfs-factory.img using procedure https://openwrt.org/toh/netgear/r7800#tftp_flashing_process

Revert to stock firmware
1. Download current manufacturer firmware, decompress zip file to obtain img file
2. Use TFTP recovery method flash img file (currently XR450-V2.3.2.134.img)
ipq806x: add support to netgear_xr450

Signed-off-by: Andrzej Mialkowski <andrzej.mialkowski@gmail.com>
2023-05-25 23:53:00 +02:00
Michael Trinidad
ff91a12c8d base-files: fix Linksys upgrade, restore config step
It appears that the refactor of the upgrade process for NAND devices                                                                                                                            resulted in the nand_do_upgrade_success step not being called for
devices using the linksys.sh script. As a result, configuration was
not preserved over sysupgrade steps.

This corrects a typo in the call of nand_do_upgrade_failed for ipq40xx
and ipq806x devices using the linksys.sh script.

Fixes: 8634c1080d ("ipq40xx: Fix Linksys upgrade, restore config step")
Fixes: 2715aff5df ("ipq806x: Fix Linksys upgrade, restore config step")
Signed-off-by: Michael Trinidad <trinidude4@hotmail.com>
2023-04-11 12:22:35 +02:00
Jacob Aharon
2715aff5df ipq806x: Fix Linksys upgrade, restore config step
It appears that the refactor of the upgrade process for NAND devices
resulted in the nand_do_upgrade_success step not being called for
devices using the linksys.sh script. As a result, configuration
was not preserved over sysupgrade steps.

This restores the preservation of configs for ipq806x devices using the
linksys.sh script. Other devices and targets have not been examined.

This commit uses the same functionality and terminology used in commit
8634c10 ("ipq40xx: Fix Linksys upgrade, restore config step")

Fixes: e25e6d8 ("base-files: fix and clean up nand sysupgrade code")
Tested-on: EA8500

Signed-off-by: Jacob Aharon <ah.jacob@gmail.com>
2023-04-02 12:22:37 +00:00
Kristjan Krušič
f574b535eb
ipq806x: add support for Nokia Airscale AC400i
Hardware
--------

SoC:    Qualcomm IPQ8065
RAM:    512 MB DDR3
Flash:  256 MB NAND (Macronix MX30UF2G18AC) (split into 2x128MB)
        4 MB SPI-NOR (Macronix MX25U3235F)
WLAN:   Qualcomm Atheros QCA9984 - 2.4Ghz
        Qualcomm Atheros QCA9984 - 5Ghz
ETH:    eth0 - POE (100Mbps in U-Boot, 1000Mbps in OpenWrt)
        eth1 - (1000Mbps in both)
        Auto-negotiation broken on both.
USB:    USB 2.0
LED:    5G, 2.4G, ETH1, ETH2, CTRL, PWR (All support green and red)
BTN:    Reset
Other:  SD card slot (non-functional)
Serial: 115200bps, near the Ethernet transformers, labeled 9X.
        Connections from the arrow to the 9X text:
		[NC] - [TXD] - [GND] - [RXD] - [NC]

Installation
------------

0. Connect to the device
Plug your computer into LAN2 (1000Mbps connection required).
If you use the LAN1/POE port, set your computer to force a 100Mbps link.

Connect to the device via TTL (Serial) 115200n8.
Locate the header (or solder pads) labeled 9X,
near the Ethernet jacks/transformers.
There should be an arrow on the other side of the header marking.
The connections should go like this:
(from the arrow to the 9X text): NC - TXD - GND - RXD - NC

1. Prepare for installation
While the AP is powering up, interrupt the startup process.
MAKE SURE TO CHECK YOUR CURRENT PARTITION!

If you see: "Current Partition is : partB" or
"Need to switch partition from partA to partB",
you have to force the device into partA mode, before continuing.
This can be done by changing the PKRstCnt to 5 and resetting the device.

setenv PKRstCnt 5
saveenv
reset

After you interrupt the startup process again,
you should see: Need to switch partition from partB to partA

You can now continue to the next step.

If you see: "Current Partition is : partA",
you can continue to the next step.

2. Prevent partition switching.
To prevent the device from switching partitions,
we are going to modify the startup command.
set bootcmd "setenv PKRstCnt 0; saveenv; bootipq"
setenv

3. First boot
Now, we have to boot the OpenWrt intifs.
The easiest way to do this is by using Tiny PXE.
You can also use the normal U-Boot tftp method.

Run "bootp" this will get an IP from the DHCP server
and possibly the firmware image.
If it doesn't download the firmware image, run "tftpboot".

Now run "bootm" to run the image.

You might see:
"ERROR: new format image overwritten - must RESET the board to recover"
this means that the image you are trying to load is too big.
Use a smaller image for the initial boot.

4. Install OpenWrt from initfs
Once you are booted into OpenWrt,
transfer the OpenWrt upgrade image and
use sysupgrade to install OpenWrt to the device.

Signed-off-by: Kristjan Krušič <kristjan.krusic@krusic22.com>
2023-03-19 18:02:34 +01:00
Daniel Golle
e8625c89ef treewide: replace /sys/devices/virtual/ubi by /sys/class/ubi
Starting from Linux Kernel version 6.3 UBI devices will no longer be
considered virtual, but rather have an MTD device parent. Hence they
will no longer be listed under /sys/devices/virtual/ubi which is
used in multiple places in OpenWrt. Prepare for future kernels by
using /sys/class/ubi instead of /sys/devuces/virtual/ubi.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2023-02-15 03:27:59 +00:00
Brian Norris
ef649b0b14
ipq806x: Initial TP-Link and ASUS OnHub support
TP-Link and ASUS OnHub devices are very similar, sharing many of the
same characteristics and much of their Device Tree. They both run a
version of ChromeOS for their factory firmware, and so installation
instructions look very similar to Google Wifi [1].

Things I've tested, and are working:

 * Ethernet
 * WiFi (2.4 and 5 GHz)
 * LEDs
 * USB
 * eMMC
 * Serial console (if you wire it up yourself)
 * 2x CPU
 * Speaker

== Installation instructions summary ==

1. Flash *-factory.bin to a USB drive (e.g., with `dd`)
2. Insert USB drive, to boot OpenWrt from USB
3. Copy the same *-factory.bin over to device, and flash it to eMMC to
   make OpenWrt permanent

== Developer mode, booting from USB (Step 2) ==

To enter Developer Mode and boot OpenWrt from a USB stick:

1. Unplug power
2. Gain access to the "developer switch" through the bottom of the
   device
3. Hold down the "reset switch" (near the USB port / power plug)
4. Plug power back in
5. The LED on the device should turn white, then blink orange, then
   red. Release the reset switch.
6. Insert USB drive with OpenWrt factory.bin
7. Press the hidden developer switch under the device to boot to USB;
   you should see some activity lights (if you have any) on your USB
   drive
8. Depending on your configuration, the router's LED(s) should come on.
   You're now running OpenWrt off a USB stick.

These instructions are derived from:

https://www.exploitee.rs/index.php/Rooting_The_Google_OnHub#Enabling_%22Developer_Mode%22_on_the_OnHub
https://www.exploitee.rs/index.php/Asus_OnHub#Enabling_%22Developer_Mode%22_on_the_OnHub

~~Finding the developer switch:~~ for TP-Link, the developer switch is
on the bottom of the device, underneath some of the rubber padding and a
screw. For ASUS, remove the entire base, via 4 screws under the rubber
feet. See the Exploitee instructions for more info and photos.

== Making OpenWrt permanent (on eMMC) (Step 3) ==

Once you're running OpenWrt via USB:

1. Connect Ethernet to the LAN port; router's LAN address should be at
   192.168.1.1
2. Connect another system to the router's LAN, and copy the factory.bin
   image over, via SCP and SSH:

     scp -O openwrt-ipq806x-chromium-tplink_onhub-squashfs-factory.bin root@192.168.1.1:
     ssh root@192.168.1.1 -C "dd if=/dev/zero bs=512 seek=7552991 of=/dev/mmcblk0 count=33 && \
     dd if=/root/openwrt-ipq806x-chromium-tplink_onhub-squashfs-factory.bin of=/dev/mmcblk0"
3. Reboot and remove the USB drive.

== Developer mode beep ==

Note that every time you boot the OnHub in developer mode, the device
will play a loud "beep" after a few seconds. This is described in the
Chromium docs [2], and is intended to make it clear that the device is
not running Google software. It is nontrivial to completely disable this
beep, although it's possible to "acknowledge" developer mode (and skip
the beep) by using a USB keyboard to press CTRL+D every time you boot.

[1] https://openwrt.org/toh/google/wifi
[2] https://chromium.googlesource.com/chromiumos/docs/+/HEAD/developer_mode.md

Signed-off-by: Brian Norris <computersforpeace@gmail.com>
2023-01-21 01:02:25 +01:00
Rodrigo Balerdi
f8b0010dfb ipq806x: add support for Arris TR4400 v2 / RAC2V1A
Hardware specs:
  SoC: Qualcomm IPQ8065 (dual core Cortex-A15)
  RAM: 512 MB DDR3
  Flash: 256 MB NAND, 32 MB NOR
  WiFi: QCA9983 2.4 GHz, QCA9984 5 GHz
  Switch: QCA8337
  Ethernet: 5x 10/100/1000 Mbit/s
  USB: 1x USB 3.0 Type-A
  Buttons: WPS, Reset
  Power: 12 VDC, 2.5 A

Ethernet ports:
  1x WAN: connected to eth2
  4x LAN: connected via the switch to eth0 and eth1
          (eth0 is disabled in OEM firmware)

MAC addresses (OEM and OpenWrt):
  fw_env @ 0x00  d4🆎82:??:??:?a  LAN (eth1)
  fw_env @ 0x06  d4🆎82:??:??:?b  WAN (eth2)
  fw_env @ 0x0c  d4🆎82:??:??:?c  WLAN 2.4 GHz (ath1)
  fw_env @ 0x12  d4🆎82:??:??:?d  WLAN 5 GHz (ath0)
  fw_env @ 0x18  d4🆎82:??:??:?e  OEM usage unknown (eth0 in OpenWrt)

  OID d4🆎82 is registered to:
  ARRIS Group, Inc., 6450 Sequence Drive, San Diego CA 92121, US

More info:
  https://openwrt.org/inbox/toh/arris/tr4400_v2

IMPORTANT:

This port requires moving the 'fw_env' partition prior to first boot to
consolidate 70% of the usable space in flash into a contiguous partition.
'fw_env' contains factory-programmed MAC addresses, SSIDs, and passwords.
Its contents must be copied to 'rootfs_1' prior to booting via initramfs.
Note that the stock 'fw_env' partition  will be wiped during sysupgrade.

A writable 'stock_fw_env' partition pointing to the old, stock location
is included in the port to help rolling back this change if desired.

Installation:

- Requires serial access and a TFTP server.
- Fully boot stock, press ENTER, type in:
mtd erase /dev/mtd21
dd if=/dev/mtd22 bs=128K count=1 | mtd write - /dev/mtd21
umount /config && ubidetach -m 23 && mtd erase /dev/mtd23
- Reboot and interrupt U-Boot by pressing a key, type in:
set mtdids 'nand0=nand0'
set mtdparts 'mtdparts=nand0:155M@0x6500000(mtd_ubi)'
set bootcmd 'ubi part mtd_ubi && ubi read 0x44000000 kernel && bootm'
env save
- Setup TFTP server serving initramfs image as 'recovery.bin', type in:
set ipaddr 192.168.1.1
set serverip 192.168.1.2
tftpboot recovery.bin && bootm
- Use sysupgrade to install squashfs image.

This port is based on work done by AmadeusGhost <amadeus@jmu.edu.cn>.

Signed-off-by: Rodrigo Balerdi <lanchon@gmail.com>
[add 5.15 changes for 0069-arm-boot-add-dts-files.patch]
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
2022-05-05 09:19:00 +09:00
Petr Štetiar
fc317a190c ipq806x: base-files: asrock: fix bootcount include
Fixes following warning message during image building process:

 Finalizing root filesystem...
 root-ipq806x/lib/upgrade/asrock.sh: line 1: /lib/functions.sh: No such file or directory
 Enabling boot
 root-ipq806x/lib/upgrade/asrock.sh: line 1: /lib/functions.sh: No such file or directory
 Enabling bootcount

Fixes #9350

Fixes: 98b86296e6 ("ipq806x: add support for ASRock G10")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2022-02-28 15:17:11 +01:00
Rosen Penev
8cfce165a7 target/linux: replace egrep with grep -E
egrep is deprecated and replaced by grep -E. The latter is used
throughout the tree.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2022-02-07 00:03:27 +01:00
Christian Lamparter
f6a01d7f5c ipq806x: convert TP-Link Archer VR2600v to denx,uimage
The recent device-tree modification that added pre-cal
nvmem-cells pushed the device's kernel+dtb over the
allotted 3072k KERNEL_SIZE.

> WARNING: Image file tplink_vr2600v-uImage is too big: 3147214 > 3145728

There was a previous kernel partition size upgrade:
commit 0c967d92b3 ("ipq806x: increase kernel partition size for the TP-Link Archer VR2600v")
It has been seemingly upgraded from a 2048k KERNEL_SIZE in the past.
The commit talks about using the MTD_SPLIT_TPLINK_FW. But looking at
the image make recipe, there is no code that adds a TPLINK header.
So instead the board will use "denx,umimage". This requires
MTD_SPLIT_UIMAGE_FW, but this is present thanks to some NEC devices.

(Maybe the MTD_CONFIG_ARGS can be removed as well? But it could be
there because of the padding at the beginning. This needs testing.)

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-02-06 17:11:20 +01:00
Bjørn Mork
5fb51d4516 ipq806x: sysupgrade: drop unnecessary UBI to UBI logic
The purpose of this code seems to be to avoid issues caused
by partially overwriting an existing UBI partition, where some
of the erase counters would be reset but not the unmodified
ones.  This problem has been solved in a more generic way by
the UBI EOF marker. This ensures that any old PEBs after the
marker are properly initialized.  It is therefore unnecessary
to erase the whole partition before flashing a new OpenWrt
factory image.

Signed-off-by: Bjørn Mork <bjorn@mork.no>
2021-12-03 12:23:02 +01:00
Matthew Hagan
67f5201276 ipq806x: add support for Cisco Meraki MR42/MR52
The MR42 and MR52 are two similar IPQ806x based devices from the Cisco
Meraki "Cryptid" series.

  MR42 main features:
  -  IPQ8068 1.4GHz
  -  512MB RAM
  -  128MB NAND
  -  2x QCA9992 (2.4 & 5GHz)
  -  1x QCA9889 (2.4 & 5GHz)
  -  1x AR8033 PHY
  -  PoE/AC power

  MR52 main features:
  -  IPQ8068 1.4GHz
  -  512MB RAM
  -  128MB NAND
  -  2x QCA9994 (2.4 & 5GHz)
  -  1x QCA9889 (2.4 & 5GHz)
  -  2x AR8033 PHYs
  -  PoE/AC power

(MR42 Only) Installation via diagnostic mode:

If you can successfully complete step 1 then you can continue to install
via this method without having to open the device. Otherwise please use
the standard UART method. Please note that when booting via TFTP, some
Ethernet devices, in particular those on laptops, will not connect in
time, resulting in TFTP boot not succeeding. In this instance it is
advised to connect via a switch.

  1. Hold down reset at power on and keep holding, after around 10 seconds
     if the orange LED changes behaviour to begin flashing, proceed to
     release reset, then press reset two times. Ensure that the LED has
     turned blue. Note that flashing will occur on some devices, but it
     will not be possible to change the LED colour using the reset button.
     In this case it will still be possible to continue with this install
     method.

  2. Set your IP to 192.168.1.250. Set up a TFTP server serving
     mr42_u-boot.mbn and
     openwrt-ipq806x-generic-meraki_mr42-initramfs-fit-uImage.itb, obtained
     from [1].

  3. Use telnet and connect to 192.168.1.1. Run the following commands to
     install u-boot. Note that all these commands are critical, an error
     will likely render the device unusable.

     Option 3.1:
       If you are sure you have set up the TFTP server correctly you can
       run this script on the device. This will download and flash the
       u-boot image immediately:

       `/etc/update_uboot.sh 192.168.1.250 mr42_u-boot.mbn`

       Once completed successfully, power off the device.

     Option 3.2:
       If you are unsure the TFTP server is correctly set up you can
       obtain the image and flash manually:

       3.2.1. `cd /tmp`
       3.2.2. `tftp-hpa 192.168.1.250 -m binary -c get mr42_u-boot.mbn`
       3.2.3. Confirm file has downloaded correctly by comparing the
              md5sum:

            `md5sum mr42_u-boot.mbn`

       3.2.4. The following are the required commands to write the image.

            `echo 1 > /sys/devices/platform/msm_nand/boot_layout
             mtd erase /dev/mtd1
             nandwrite -pam /dev/mtd1 mr42_u-boot.mbn
             echo 0 > /sys/devices/platform/msm_nand/boot_layout`

          Important: You must observe the output of the `nandwrite`
          command. Look for the following to verify writing is occurring:

            `Writing data to block 0 at offset 0x0
             Writing data to block 1 at offset 0x20000
             Writing data to block 2 at offset 0x40000`

          If you do not see this then do not power off the device. Check
          your previous commands and that mr42_u-boot.mbn was downloaded
          correctly. Once you are sure the image has been written you
          can proceed to power off the device.

  4. Hold the reset button and power on the device. This will immediately
     begin downloading the appropriate initramfs image and boot into it.

     Note: If the device does not download the initramfs, this is likely
     due to the interface not being brought up in time. Changing Ethernet
     source to a router or switch will likely resolve this. You can also
     try manually setting the link speed to 10Mb/s Half-Duplex.

  5. Once a solid white LED is displayed on the device, continue to the
     UART installation method, step 6.

Standard installation via UART - MR42 & MR52

  1. Disassemble the device and connect a UART header. The header pinout
     is as follows:

       1 - 3.3v
       2 - TXD
       3 - RXD
       4 - GND

     Important: You should only connect TXD, RXD and GND. Connecting
     3.3v may damage the device.

  2. Set your IP to 192.168.1.250. Set up a TFTP server serving
     openwrt-ipq806x-generic-meraki_(mr42|mr52)-initramfs-fit-uImage.itb.
     Separately obtain the respective sysupgrade image.

  3. Run the following commands, preferably from a Linux host. The
     mentioned files, including ubootwrite.py and u-boot images, can be
     obtained from [1].

       `python ubootwrite.py --write=(mr42|mr52)_u-boot.bin`

     The default for "--serial" option is /dev/ttyUSB0.

  4. Power on the device. The ubootwrite script will upload the image to
     the device and launch it. The second stage u-boot will in turn load
     the initramfs image by TFTP, provided the TFTP server is running
     correctly. This process will take about 13 minutes. Once a solid
     white LED is displayed, the image has successfully finished
     loading. Note: If the image does not load via TFTP, try again with
     the Ethernet link to 10Mb/s Half-Duplex.

  5. (MR42 only) Do not connect over the network. Instead connect over
     the UART using minicom or similar tool. To replace u-boot with
     the network enabled version, please run the following commands.
     Note that in the provided initramfs images, the u-boot.mbn file
     is located in /root:

     If you have not used the provided initramfs, you must ensure you
     are using an image with "boot_layout" ECC configuration enabled in
     the Kernel. This will be version 5.10 or higher. If you do not do
     this correctly the device will be bricked.

       `insmod mtd-rw i_want_a_brick=1
        mtd erase /dev/mtd8
        nandwrite -pam /dev/mtd8 /root/mr42_u-boot.mbn`

     After running nandwrite, ensure you observe the following output:

       `Writing data to block 0 at offset 0x0
        Writing data to block 1 at offset 0x20000
        Writing data to block 2 at offset 0x40000`

  6. (Optional) If you have no further use for the Meraki OS, you can
     remove all other UBI volumes on ubi0 (mtd11), including diagnostic1,
     part.old, storage and part.safe. You must not remove the ubi1 ART
     partition (mtd12).

       `for i in diagnostic1 part.old storage part.safe ; do
        ubirmvol /dev/ubi0 -N $i
        done`

  7. Proceed to flash the sysupgrade image via luci, or else download or
     scp the image to /tmp and use the sysupgrade command.

[1] The mentioned images and ubootwrite.py script can be found in this repo:
    https://github.com/clayface/openwrt-cryptid

[2] The modified u-boot sources for the MR42 and MR52 are available:
    https://github.com/clayface/U-boot-MR52-20200629

Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
2021-11-28 17:51:52 +01:00
Adrian Schmutzler
6a27e8036e ipq806x: remove transition workarounds for qcom-smem partitions
The out-of-tree qcom-smem patches traditionally displayed mtd partition names
in upper case, starting with the new mainline qcom-smem support in kernel v5.10,
it switched to normalizing the partition names to lower case.

While both 5.4 and 5.10 were supported in the target, we carried a workaround
to support both of them. Since the target has dropped 5.4 recently, those
can be removed now.

Ref:

2db9dded0a ("ipq806x: nbg6817: case-insensitive qcom-smem partitions")
435dc2e77e ("ipq806x: ecw5410: case-insensitive qcom-smem partitions")
f70e11cd97 ("ipq806x: g10: case-insensitive qcom-smem partitions")

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-10-30 22:11:23 +02:00
Peter Geis
70c12d26ca ipq806x: add support for Netgear Nighthawk Pro Gaming XR500
This adds support for the Netgear Nighthawk Pro Gaming XR500.
It is the successor to the Netgear Nighthawk R7800 and shares almost
identical hardware to that device.
The stock firmware is a heavily modified version of OpenWRT.

Specifications:
  SoC: Qualcomm Atheros IPQ8065
  RAM: 512 MB
  Storage: 256 MiB NAND Flash
  Wireless: 2x Qualcomm Atheros QCA9984
  Ethernet: 2x 1000/100/10 dedicated interfaces
  Switch: 5x 1000/100/10 external ports
  USB: 2x 3.0 ports

More information:
Manufacturer page: https://www.netgear.com/gaming/xr500/
Almost identical to Netgear R7800
Differences (r7800 > xr500):
  Flash: 128MiB > 256MiB
  Removed esata
  swapped leds:
    usb1 (gpio 7 > 8)
    usb2 (gpio 8 > 26)
    guest/esata (gpio 26 > 7)

MAC addresses:

On the OEM firmware, the mac addresses are:

  WAN: *:50  art 0x6
  LAN: *:4f  art 0x0 (label)
  2G:  *:4f  art 0x0
  5G:  *:51  art 0xc

Installation:
Install via Web Interface (preferred):
Utilize openwrt-ipq806x-netgear_xr500-squashfs-factory.img

Install via TFTP recovery:
1.Turn off the power, push and hold the reset button (in a hole on
  backside) with a pin
2.Turn on the power and wait till power led starts flashing white
  (after it first flashes orange for a while)
3.Release the reset button and tftp the factory img in binary mode.
  The power led will stop flashing if you succeeded in transferring
  the image, and the router reboots rather quickly with the new
  firmware.
4.Try to ping the router (ping 192.168.1.1). If does not respond,
  then tftp will not work either.

Uploading the firmware image with a TFTP client
$ tftp 192.168.1.1
bin
put openwrt-ipq806x-netgear_xr500-squashfs-factory.img

Note:

The end of the last partition is at 0xee00000. This was chosen
by the initial author, but nobody was able to tell why this
particular arbitrary size was chosen. Since it's not leaving
too much empty space and it's the only issue left, let's just
keep it for now.

Based on work by Adam Hnat <adamhnat@gmail.com>
ref: https://github.com/openwrt/openwrt/pull/3215

Signed-off-by: Peter Geis <pgwipeout@gmail.com>
[squash commits, move common LEDs to DTSI, remove SPDX on old
 files, minor whitespace cleanup, commit message facelift,
 add MAC address overview, add Notes, fix MAC addresses,
 use generic name for partition nodes in DTS]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-10-26 22:30:18 +02:00
Lauro Moreno
da8428d277 ipq806x: add support for Askey RT4230W REV6
This adds support for the Askey RT4230W REV6
(Branded by Spectrum/Charter as RAC2V1K)

At this time, there's no way to reinstall the stock firmware so don't install
this on a router that's being rented.

Specifications:

    Qualcomm IPQ8065
    1 GB of RAM (DDR3)
    512 MB Flash (NAND)
    2x Wave 2 WiFi cards (QCA9984)
    5x 10/100/1000 Mbps Ethernet (Switch: QCA8337)
    1x LED (Controlled by a microcontroller that switches it between red and
        blue with different patterns)
    1x USB 3.0 Type-A
    12V DC Power Input
    UART header on PCB - pinout from top to bottom is RX, TX, GND, 5V
    Port settings are 115200n8

More information: https://forum.openwrt.org/t/askey-rac2v1k-support/15830
https://deviwiki.com/wiki/Askey_RAC2V1K

To check what revision your router is, restore one of these config backups
through the stock firmware to get ssh access then run
"cat /proc/device-tree/model".
https://forum.openwrt.org/t/askey-rac2v1k-support/15830/17
The revision number on the board doesn't seem to be very consistent so that's
why this is needed. You can also run printenv in the uboot console and if
machid is set to 177d, that means your router is rev6.

Note: Don't install this if the router is being rented from an ISP. The defined
partition layout is different from the OEM one and even if you changed the
layout to match, backing up and restoring the OEM firmware breaks /overlay so
nothing will save and the router will likely enter a bootloop.

How to install:

Method 1: Install without opening the case using SSH and tftp

    You'll need:
    RAC2V1K-SSH.zip:
https://github.com/lmore377/openwrt-rt4230w/blob/master/RAC2V1K-SSH.zip
    initramfs and sysupgrade images

    Connect to one of the router's LAN ports

    Download the RAC2V1K-SSH.zip file and restore the config file that
corresponds to your router's firmware (If you're firmware is newer than what's
in the zip file, just restore the 1.1.16 file)

    After a reboot, you should be able to ssh into the router with username:
"4230w" and password: "linuxbox" or "admin". Run the following commannds
     fw_setenv ipaddr 10.42.0.10 #IP of router, can be anything as long as
it's in the same subnet as the server
     fw_setenv serverip 10.42.0.1# #IP of tftp server that's set up in next
steps
     fw_setenv bootdelay 8
     fw_setenv bootcmd "tftpboot initramfs.bin; bootm; bootipq"

    Don't reboot the router yet.

    Install and set up a tftp server on your computer

    Set a static ip on the ethernet interface of your computer (use this for
serverip in the above commands)

    Rename the initramfs image to initramfs.bin, and host it with the tftp
server

    Reboot the router. If you set up everything right, the router led should
switch over to a slow blue glow which means openwrt is booted. If for some
reason the file doesn't get loaded into ram properly, it should still boot to
the OEM firmware.
    After openwrt boots, ssh into it and run these commands:
    fw_setenv bootcmd "setenv mtdids nand0=nand0 && setenv mtdparts
 mtdparts=nand0:0x1A000000@0x2400000(firmware) && ubi part firmware && ubi
read 0x44000000 kernel 0x6e0000 && bootm"
    fw_setenv bootdelay 2

    After openwrt boots up, figure out a way to get the sysupgrade file onto it
(scp, custom build with usb kernel module included, wget, etc.) then flash it
with sysupgrade. After it finishes flashing, it should reboot, the light should
start flashing blue, then when the light starts "breathing" blue that means
openwrt is booted.

Method 2: Install with serial access (Do this if something fails and you can't
boot after using method 1)

    You'll need:
    initramfs and sysupgrade images
    Serial access:
https://openwrt.org/inbox/toh/askey/askey_rt4230w_rev6#opening_the_case

    Install and set up a tftp server

    Set a static ip on the ethernet interface of your computer

    Download the initramfs image, rename it to initramfs.bin, and host it with
the tftp server

    Connect the wan port of the router to your computer

    Interrupt U-Boot and run these commands:
    setenv serverip 10.42.0.1 (You can use whatever ip you set for the computer)
    setenv ipaddr 10.42.0.10 (Can be any ip as long as it's in the same subnet)
    setenv bootcmd "setenv mtdids nand0=nand0 &&
set mtdparts mtdparts=nand0:0x1A000000@0x2400000(firmware) && ubi part firmware
&& ubi read 0x44000000 kernel 0x6e0000 && bootm"

    saveenv
    tftpboot initramfs.bin
    bootm

    After openwrt boots up, figure out a way to get the sysupgrade file onto it
(scp, custom build with usb kernel module included, wget, etc.) then flash it
with sysupgrade. After it finishes flashing, it should reboot, the light should
start flashing blue, then when the light starts "breathing" blue that means
openwrt is booted.

Signed-off-by: Lauro Moreno <lmore377@gmail.com>
[add entry in 5.10 patch, fix whitespace issues]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-06-05 23:39:14 +02:00
Stefan Lippers-Hollmann
f70e11cd97 ipq806x: g10: case-insensitive qcom-smem partitions
The out-of-tree qcom-smem patches traditionally displayed mtd partition names
in upper case, starting with the new mainline qcom-smem support in kernel v5.10,
it switches to normalizing the partition names to lower case.

Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
2021-05-08 18:45:42 +02:00
Stefan Lippers-Hollmann
2db9dded0a ipq806x: nbg6817: case-insensitive qcom-smem partitions
The out-of-tree qcom-smem patches traditionally displayed mtd partition names
in upper case, starting with the new mainline qcom-smem support in kernel v5.10,
it switches to normalizing the partition names to lower case.

Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
2021-05-08 18:45:42 +02:00
Gary Cooper
1a775a4fd0 ipq806x: add support for TP-Link Talon AD7200
Device hardware: https://deviwiki.com/wiki/TP-LINK_AD7200_(Talon)

The Talon AD7200 is basically an Archer C2600 with a third PCIe lane
and an 802.11ad radio. It looks like the Archers C2600/5400 but the
housing is slightly larger.

Specifications
--------------

  - IPQ8064 dual-core 1400MHz
  - QCA9988 2.4GHz WiFi
  - QCA9990 5GHz WiFi
  - QCA9500 60GHz WiFi
  - 32MB SPI Flash
  - 512MiB RAM
  - 5 GBit Ports (QCA8337)

Installation
------------

Installation is possible from the OEM web interface.
Sysupgrade is possible.
TFTP recovery is possible.
  - Image: AD7200_1.0_tp_recovery.bin

Notes
  - This will be the first 802.11ad device supported by mainline.

Signed-off-by: Gary Cooper <gaco@bitmessage.de>
2021-01-05 02:16:24 +00:00
Adrian Schmutzler
212ad91630 ipq806x: remove unneeded empty lines
This removes two unneeded empty lines in base-files.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-22 21:44:57 +01:00
Christian Lamparter
98b86296e6 ipq806x: add support for ASRock G10
The ASRock G10 is a 2.4/5 GHz band 11ac "Gaming" router,
based on Qualcomm IPQ8064.

Specifications:

SoC:	Qualcomm IPQ8064
CPU:	Dual-Core A15 @ (384 - 1,400 MHz, 2C2T)
DRAM:	512 MiB (~467 MiB available)
NAND:	128 MB (Micron MT29F1G08ABBEAH4)
WLAN0:	4T4R 5 GHz Wlan (QCA9980)
WLAN1:	4T4R 2.4 GHz Wlan (QCA9980)
ETH:    5x 10/100/1000 Mbps Ethernet (QCA8337)
INPUT:  Reset Button, WPS 2.4G and WPS 5G Button
LEDS:   1 multicolor status LED
USB:    2x USB 3.0 Type-A
POWER:  12VDC/3A AC Adapter + dedicated Power Switch
UART:   Setting is 115200-8-N-1. 1x4 .1" unpopulated header
	on the PCB (J6 - very tiny silkscreen next to TX).
        Pinout: 1. 3v3 (Square - best skipped!), 2. RX, 3. GND, 4. TX

WARNING: The serial port needs a TTL/RS-232 3.3v level converter!
	 (Depending on the serial adapter RX and TX might need to
	  be swapped).

Note about the IR-Remote:
There's a 8-Bit MCU (SONIX SN8F25E21SG) which is controlling the
IR-Remote and is fed by the IR-Photodiode. The SoC can talk to
the device via I2C. The vendor's GPL archive comes with the source
of the interface driver for this as a (character driver), the main
control software is however a blob.

Installation Instructions:
 1. Download factory image to disk
 2. Apply factory image via stock web-gui

Back to stock:
 1. Login to router via ssh
 2. run "asrock_g10_back_to_factory" script from /sbin

Notes:
 - If something goes wrong durring sysupgrade, router will go back to
   factory image.
 - Asrock G10 uses partition layout from smem. So partition layout can
   be normal or alternate.
 - 900-arm-add-cmdline-override.patch was copied from 102-powerpc-add-cmdline-override.patch
   from powerpc target.

Knowledge about BOOTCONFIG partition was based on user "jmomo" post from old
OpenWrt forum (Post #50):
https://forum.archive.openwrt.org/viewtopic.php?id=65956&p=2

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
[bump to 5.4, add factory image, fix sysupgrade, convert partition
layout to smem, remove ipq-wifi-asrock-g10 and use ART, minor fixes]
Co-Authored-by: Pawel Dembicki <paweldembicki@gmail.com>
Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
Tested-by: Lukasz Ostapiuk <palibrzuch@gmail.com>
2020-12-22 19:11:50 +01:00
Adrian Schmutzler
6e170ffb96 ipq806x: sort entries in lib/upgrade/platform.sh
Apply alphabetic sorting like in the other files.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-09-17 13:03:18 +02:00
Robert Marko
59f0a0fd83 ipq806x: add Edgecore ECW5410 support
This patch adds support for the Edgecore ECW5410 indoor AP.

Specification:
- SoC: Qualcomm Atheros IPQ8068 ARMv7 2x Cortex A-15
- RAM: 256MB(225 usable) DDR3
- NOR Flash: 16MB SPI NOR
- NAND Flash: 128MB S34MS01G2 Parallel NAND
- Ethernet: 2 x 1G via 2x AR8033 PHY-s connected directly to GMAC2 and GMAC3 via SGMII (802.3af POE IN on eth0)
- USB: 1 x USB 3.0 SuperSpeed
- WLAN: 2x QCA9994 AC Wawe 2 (1x 2GHz bgn, 1x 5GHz acn)
- CC2540 BLE
- UART console on RJ45 next to ethernet ports exposed.
Its Cisco pin compatible, 115200 8n1 baud.

Installation instructions:
Through stock firmware or initramfs.

1.Connect to console
2. Login with root account, if password is unknown then interrupt the boot with f and reset it in failsafe.
3. Transfer factory image
4. Flash the image with ubiformat /dev/mtd1 -y -f <your factory image path>

This will replace the rootfs2 with OpenWrt, if you are currently running from rootfs2 then simply change /dev/mtd1 to /dev/mtd0

Note

Initramfs:
1.  Connect to console
2.  Transfer the image from TFTP server with tftpboot,
or by using DHCP advertised image with dhcp command.
3. bootm
4. Run ubiformat /dev/mtd1

You need to interrupt the bootloader after rebooting and run:
run altbootcmd

This will switch your active rootfs partition to one you wrote to and boot from it.

So if rootfs1 is active, then it will change it to rootfs2.

This will format the rootfs2 partition, if your active partition is 2 then simply change /dev/mtd1 with /dev/mtd0
If you dont format the partition you will be writing too, then sysupgrade will find existing UBI rootfs and kernel volumes and update those.
This will result in wrong ordering and OpenWrt will panic on boot.

5. Transfer sysupgrade image
6. Flash with sysupgrade -n.

Note that sysupgrade will write the image to rootfs partition that is not currently in use.

Signed-off-by: Robert Marko <robert.marko@sartura.hr>
2020-09-17 08:42:17 +02:00
Pawel Dembicki
20c7abd4b7 ipq806x: add support for Linksys EA7500 V1
This patch adds support for the Linksys EA7500 V1 router.

Specification:
 - CPU: Qualcomm IPQ8064
 - RAM: 256MB
 - Flash: NAND 128MB
 - WiFi: QCA9982 an+ac + QCA9983 bgn
 - Ethernet: 5 GBE Ports (WAN+ 4xLAN) (QCA8337)
 - USB: 1x USB 3.0 1x USB2.0
 - Serial console: RJ-45 115200 8n1 (1V8 Voltage level)
 - 2 Buttons
 - 1 LED

Known issues:
 - Some devices won't flash via web gui

Installation:
- Newer stock images doesn't allow to install custom firmware.
- Please downgrade software to 1.1.2 version. Official firmware:
https://downloads.linksys.com/downloads/firmware/FW_EA7500_1.1.2.172843_prod.gpg.img
- Do it two times to downgrade all stored images.
- Apply factory image via web-gui.

Serial + TFTP method:
 - downgrade to 1.1.2 two times
 - connect ehternet and serial cable
 - set ip address of tftp server to 192.168.1.254
 - put openwrt factory image to tftp folder and rename it to macan.bin
 - stop device while booting in u-boot
 - run command: "run flashimg"
 - run command: "setenv boot_part 1"
 - run command "saveenv"
 - reset

Back to stock:
- Please use old non-gpg image like this 1.1.2:
https://downloads.linksys.com/downloads/firmware/FW_EA7500_1.1.2.172843_prod.img
- ssh to router and copy image to tmp
- use sysupgrade -n -F

Tested by github users: @jack338c and @grzesiczek1

Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
[removed i2c4_pins, mdio0_pins, nand_pins, rgmii2_pins from DTSI]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-07-08 16:07:05 +02:00
Adrian Schmutzler
48c1fdd046 treewide: drop shebang from non-executable target files
This drops the shebang from all target files for /lib and
/etc/uci-defaults folders, as these are sourced and the shebang
is useless.

While at it, fix the executable flag on a few of these files.

This does not touch ar71xx, as this target is just used for
backporting now and applying cosmetic changes would just complicate
things.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-06-16 14:26:33 +02:00
Samantha Collard
0f910a8c4c ipq806x: EA8500 fix boot partition detection
Remove extraneous code that disabled boot partition detection.

Fixes: b3770eaca3 ("mtd: base-files: Unify dual-firmware devices (Linksys)")
Signed-off-by: Samantha Collard <sammyrc34@gmail.com>
2020-05-31 15:44:05 +02:00
Adrian Schmutzler
c2ddc3a0c4 ipq806x: remove useless case within default case for upgrade
The default case will catch anything left, there is no need to
explicitly add any device to it.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-03-16 16:53:47 +01:00
Rafał Miłecki
641f6b6c26 treewide: use new procd sysupgrade $UPGRADE_BACKUP variable
It's a variable set by procd that should replace hardcoded
/tmp/sysupgrade.tgz.

This change requires the most recent procd with the commit 0f3c136
("sysupgrade: set UPGRADE_BACKUP env variable").

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
2019-09-05 23:33:19 +02:00
Rafał Miłecki
62dbe361a1 treewide: when copying a backup file always specify dest name
$CONF_TAR shouldn't be assumed to always point to the sysupgrade.tgz.
This change makes code more generic and allows refactoring $CONF_TAR.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
2019-09-05 14:33:20 +02:00
Rafał Miłecki
bf39047872 treewide: don't hardcode "sysupgrade.tgz" file name
1) Add BACKUP_FILE and use it when copying an archive to be restored
   after sysupgrade (on the next preinit).
2) Use CONF_TAR for copying backup prepared by the /sbin/sysupgrade

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
2019-09-05 14:33:19 +02:00
Adrian Schmutzler
d94a3f328f ipq806x: Replace backticks by $(...)
This replaces deprecated backticks by more versatile $(...) syntax.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-08-31 12:08:23 +02:00
Rafał Miłecki
1cbe0d659c treewide: sysupgrade: get rid of platform_nand_pre_upgrade()
1) nand_do_upgrade() is always called by a target code
2) nand_do_upgrade() starts with calling platform_nand_pre_upgrade()

It means there is no need for the platform_nand_pre_upgrade() callback
at all. All code that was present there could bo moved & simplly called
by a target right before the nand_do_upgrade().

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
2019-07-22 14:27:37 +02:00
Rafał Miłecki
8b4bc7abe0 treewide: sysupgrade: don't use $ARGV in platform_do_upgrade()
stage2 passes image path to platform_do_upgrade() as an argument so it
can be simply accessed using $1

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
2019-07-17 08:05:38 +02:00
Jeff Kletsky
b3770eaca3 mtd: base-files: Unify dual-firmware devices (Linksys)
Consistently handle boot-count reset and upgrade across
ipq40xx, ipq806x, kirkwood, mvebu

Dual-firmware devices often utilize a specific MTD partition
to record the number of times the boot loader has initiated boot.

Most of these devices are NAND, typically with a 2k erase size.
When this code was ported to the ipq40xx platform, the device in hand
used NOR for this partition, with a 16-byte "record" size. As the
implementation of `mtd resetbc` is by-platform, the hard-coded nature
of this change prevented proper operation of a NAND-based device.

* Unified the "NOR" variant with the rest of the Linksys variants

* Added logging to indicate success and failure

* Provided a meaningful return value for scripting

* "Protected" the use of `mtd resetbc` in start-up scripts so that
   failure does not end the boot sequence

* Moved Linksys-specific actions into common `/etc/init.d/bootcount`

For upgrade, these devices need to determine which partition to flash,
as well as set certain U-Boot envirnment variables to change the next
boot to the newly flashed version.

* Moved upgrade-related environment changes out of bootcount

* Combined multiple flashes of environment into single one

* Current-partition detection now handles absence of `boot_part`

Runtime-tested: Linksys EA8300

Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
[checkpatch.pl fixes, traded split strings for 80+ chars per line]
2019-05-18 13:43:51 +02:00
INAGAKI Hiroshi
51fe956c4f ipq806x: add support for Buffalo WXR-2533DHP
Buffalo WXR-2533DHP is a 2.4/5 GHz band 11ac router, based on Qualcomm
IPQ8064.

The U-Boot on WXR-2533DHP employs a complicated dual firmware
protection scheme against corruptions of the kernel and rootfs
images. See the notes in buffalo.sh for details.

specifications:

- Qualcomm IPQ8064 (384 - 1,400 MHz, 2C2T)
- 512 MB of RAM (DDR3)
- 256 MB of Flash (NAND)
- 4T4R 2.4/5 GHz Wlan (QCA9980)
- 5x 10/100/1000 Mbps Ethernet
- 10x LEDs, 8x keys (6x buttons, 2x slide-switches)
- 2x USB 3.0 Type-A
- 12VDC/4A AC Adapter
- UART through-hole on PCB
  - J3: Vcc, GND, TX, RX from USB port side
  - 115200n8

Boot instructions for the initramfs image:

1. Prepare the TFTP server with the initramfs image renamed to
   "wxr2300dhp-initramfs.uImage" and IP address "192.168.11.10".
2. Press the "AOSS" button while powering on the WXR-2533DHP.
3. Wait until the "Wireless" LED flashes before releasing the AOSS button.
   The WXR-2533DHP will grab the image from TFTP server and will boot it.

Flashing instructions:

To persistently write the firmware, flash an openwrt sysupgrade image
from inside the initramfs, for example transfer
via `scp <sysupgrade> root@192.168.1.1:/tmp` and flash on the device
with `sysupgrade -n /tmp/<sysupgrade>`. Then wait ~120 seconds to
let it finish the flashing process.

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com> [reworded message]
2019-01-01 16:39:59 +01:00
Ram Chandra Jangir
dc6af37544 ipq806x: Add support for IPQ8064 AP161 board
Specification:
   - SoC: Qualcomm Atheros IPQ8064 ARM-v7 Dual Core SMP CPU
   - RAM: 512MB DDR3 System Memory
   - NOR Flash: 32MB SPI NOR
   - NAND Flash: 256MB NAND
   - Ethernet: 5 x 1G via QCA8337N
   - USB: 2 x USB 3.0 SuperSpeed
   - PCIe: 3x Mini PCIe 2.0 Slots
	   Three PCIE2.0 connectors can connect two or three radio cards
           such as the CUS260 for 2.4 GHz WLAN and the CUS239 for 802.11ac WLAN

 How to flash via u-boot console:
   tftpboot 0x44000000 openwrt-ipq806x-qcom_ipq8064-ap161-squashfs-nand-factory.bin
   nand erase  0x1340000 0x4000000
   nand write  0x44000000 0x1340000 $filesize
   setenv bootargs ‘console=ttyMSM0,115200 ubi.mtd=ubi root=/dev/ubiblock0_1’
   saveenv
   bootm

 Further upgrades via sysupgrade.

 Tested on IPQ8064 AP161 Board:
   1) NAND boot
   2) Tested USB and PCIe interfaces
   3) WDOG test
   4) cpu frequency scaling
   5) ethernet, 2G and 5G WiFi
   6) ubi sysupgrade

Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
2018-11-26 12:05:46 +01:00
Mathias Kresin
56b8ac1e86 treewide: consolidate upgrade state set
Set the (sys)upgrade state when sourcing the stage2 script instead of
setting the state for each target individual.

This change fixes the, due to a missing state set, not working upgrade
led on ath79 and apm821xx.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2018-08-16 21:20:57 +02:00
INAGAKI Hiroshi
4645a6d318 ipq806x: add support for NEC Aterm WG2600HP
NEC Aterm WG2600HP is a 2.4/5 GHz band 11ac router, based on Qualcomm
IPQ8064.

Specification:

- IPQ8064 (384 - 1,400 MHz)
- 512 MB of RAM
- 32 MB of Flash (SPI)
- 4T4R 2.4/5 GHz
- 5x 10/100/1000 Mbps Ethernet
- 12x LEDs, 4x keys
- 1x USB 3.0 Type-A
- UART header on PCB
  - RX, TX, NC, GND, Vcc from power connector side
  - baudrate: 115200 bps

Flash instruction using initramfs image:
1. Connect serial cable to UART header
2. Connect power cable and turn on the router
3. When the "Press the [f] key and hit [enter] to enter failsafe mode"
message is displayed on the console, press the "f" key and Enter key
sequentially to enter the failsafe mode
4. create fw_env.config file with following contents on failsafe mode:
  /dev/mtd9 0x0 0x10000 0x10000
5. Execute following commands to add and change the environment
variables of U-Boot
  fw_setenv ipaddr "192.168.0.1"
  fw_setenv serverip "192.168.0.2"
  fw_setenv autostart "yes"
  fw_setenv bootcmd "tftpboot 0x44000000 wg2600hp-initramfs.bin;
  bootipq"
6. Set the IP address of the computer to 192.168.0.2, connect to the LAN
port of WG2600HP, and start the TFTP server on the computer
7. Rename OpenWrt initramfs image for WG2600HP to
"wg2600hp-initramfs.bin" and place it in the TFTP directory
8. Remove power cable from WG2600HP, reconnect it and restart WG2600HP
9. WG2600HP downloads initramfs image from TFTP server on the computer,
loads it and boot with initramfs image
10. On the initramfs image, execute "mtd erase firmware" to erase stock
firmware and execute sysupgrade with the sysupgrade image
11. Wait ~180 seconds to complete flashing

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2018-06-19 20:46:01 +02:00
Christian Mehlis
0c7e78930b ipq806x: add support for Compex WPQ864
Hardware highlights:
- SoC: Qualcomm Atheros IPQ8064/5 ARM Dual Core CPU
- RAM: (512MB or 1GB) DDR3 System Memory
- Storage: 32MB NOR (Cypress S25FL256S1)
           256MB NAND (Micron MT29F2G08ABBEAH4)
- Ethernet: 5 x 1G via QCA8337N
- USB: 1 x USB 2.0/3.0 + 1 x USB 2.0 on mini PCIe3 socket
- PCIe: 3x mini PCIe (third mini PCIE3 is PCIe/USB shared)
- SIM Card Slot: 2 x Slot
- Buttons: Reset Button
- LEDs: 18x, 8x GPIO controllable
- Buzzer

The correct amount of RAM will be passed by the bootloader.

In contrast to the documentation provided by Compex, the third PCIe
doesn't use GPIO16 for PERST. Instead, GPIO3 is shared and used as PERST
for PCIe0 and PCIe2.

So far, no one was able to get USB 3.0 working with the 1GB RAM version,
while it works fine for my 512MB version. Since USB 3.0 doesn't work with
the Compex firmware for the 1G variant either, it could be a hardware
issue with these boards.

OpenWrt will be installed to the NAND flash. Make sure to have a full
working image on the NOR flash. It will be the backup in case anything
goes wrong.

It has been observed that an image loaded via tftpboot might have
bitflips. Hence the extra step to create a crc32 checksum to allow to
compare the checksum with the one from the source file prior to flashing.

In all cases it is necessary to set the following u-boot parameter to an
empty (whitespace) value, to ensure that the chosen bootargs of the dts
isn't overwritten or set to bogus - not working - values:

  (IPQ) # set bootargs " "
  (IPQ) # set fsbootargs " "
  (IPQ) # saveenv

The sysupgrade image can be installed directly on flash using u-boot (put
jumper in JP13 (leave JP9 open) to boot from nand):

  (IPQ) # set serverip 192.168.1.20
  (IPQ) # set ipaddr 192.168.1.1

  (IPQ) # tftpboot 0x42000000 openwrt-ipq806x-compex_wpq864-squashfs-nand-factory.bin
  (IPQ) # crc32 0x42000000 $filesize

  (IPQ) # nand erase 0x1340000 0x4000000
  (IPQ) # nand write 0x42000000 0x1340000 $filesize

The initramfs image can be started using:

  (IPQ) # set fdt_high 0x48000000
  (IPQ) # tftpboot 0x44000000 openwrt-ipq806x-compex_wpq864-initramfs-fit-uImage.itb
  (IPQ) # bootm 0x44000000

Signed-off-by: Christian Mehlis <christian@m3hlis.de>
Signed-off-by: Mathias Kresin <dev@kresin.me>
2018-03-15 08:17:10 +01:00
John Crispin
b7f115f22a ipq806x: drop ipq40xx support
Signed-off-by: John Crispin <john@phrozen.org>
2018-03-14 19:04:50 +01:00
Stefan Lippers-Hollmann
4baffa02ce ipq806x: switch to full dual-boot for the nbg6817 sysupgrade support
Instead of writing to the currently booted partition set, this
implements full dual-boot support for sysupgrade by always writing to
the other, currently inactive, partition set and toggling the dualflag
after a successful flash.

The currently active/ booted partition set is determined by parsing
/proc/cmdline for its rootfs parameter (supplied by the DTS), instead
of reading from the 0:DUAL_FLAG mtd, in order to prevent (potentially)
bricking both partition sets.

Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
2018-02-13 12:45:00 +01:00
Stefan Lippers-Hollmann
42fe7b3bbe ipq806x: request the first free loop device dynamically for the nbg6817 sysupgrade
Instead of hardcoding /dev/loop0, it's safer to query for the first
free loop device and assign that dynamically. While /dev/loop0 is a
reasonable assumption immediately following "losetup --detach-all",
detaching the mounted overlay is no longer strictly necessary once
dual-boot support has been added for the nbg6817.

Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
2018-02-13 12:45:00 +01:00
Stefan Lippers-Hollmann
b36cf0be30 ipq806x: use absolute the device path in $kernel for the nbg6817 sysupgrade
Harmonize the variable usage for $kernel and $rootfs to always contain
the full device path, instead of just its basename.

Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
2018-02-13 12:45:00 +01:00
Mathias Kresin
b6868e2f47 ipq806x: fix ZyXEL NBG6817 sysupgrade
Use the first found directory in the tar archive instead of relying on
a directory named according to the userspace boardname.

It allows to change the boardname without adding another compatibility
layer to the zyxel sysupgrade.

Fixes: 33f09cf151 ("ipq806x: convert to dt-based board-detection")
Signed-off-by: Mathias Kresin <dev@kresin.me>
2018-01-18 07:22:37 +01:00
Sven Eckelmann
86e18f6706 ipq806x: add support for OpenMesh A42
* QCA IPQ401x
* 256 MB of RAM
* 32 MB of SPI NOR flash (s25fl256s1)
  - 2x 15 MB available; but one of the 15 MB regions is the recovery image
* 2T2R 2.4 GHz
  - QCA4019 hw1.0 (SoC)
  - requires special BDF in QCA4019/hw1.0/board-2.bin with
    bus=ahb,bmi-chip-id=0,bmi-board-id=16,variant=OM-A42
* 2T2R 5 GHz
  - QCA4019 hw1.0 (SoC)
  - requires special BDF in QCA4019/hw1.0/board-2.bin with
    bus=ahb,bmi-chip-id=0,bmi-board-id=17,variant=OM-A42
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x button (reset; kmod-input-gpio-keys compatible)
* external watchdog
  - triggered GPIO
* 1x USB (xHCI)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x gigabit ethernet
* powered only via POE
  - 802.3af POE on Ethernet 1
  - 18-24v passive POE (mode B) on Ethernet 2

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the factory image to the u-boot when the device boots up.

Signed-off-by: Sven Eckelmann <sven.eckelmann@open-mesh.com>
2018-01-13 08:00:14 +01:00
Luis Araneda
7293499f71 ipq806x: Sort occurrences of boardame alphabetically
This restores the alphabetical sort that was present
before the renaming of boardname.

Signed-off-by: Luis Araneda <luaraneda@gmail.com>
2018-01-13 07:33:03 +01:00
Luis Araneda
33f09cf151 ipq806x: convert to dt-based board-detection
Use the generic board detection method:
- Board name: First compatible string from the device tree
- Board model: Model property from the device tree

Change occurrences of board name in userspace by the compatible
string, and removed target specific board detection script

Replace the definition of SUPPORTED_DEVICES in Device/Default
to extract the dt compatible string from each device definition.
Additionally, for devices supported by lede-17.01, append
the value of BOARD_NAME to SUPPORTED_DEVICES in the device
definition.

Signed-off-by: Luis Araneda <luaraneda@gmail.com>
2018-01-13 07:33:03 +01:00
Stefan Lippers-Hollmann
9a221c6d69 ip806x: nbg6817: sysupgrade support both targets for kernel/ rootfs partitions
With this commit and the previous "nbg6817: don't hardcode the rootfs location
by using append-rootblock instead" applied, it is possible to boot- and
sysupgrade from both dual-boot sets (the primary mmcblk0p4+mmcblk0p5 or the
alternative mmcblk0p7+mmcblk0p8). However the sysupgrade support does not
toggle between both dual-boot sets between firmware upgrades so far.

The partition map of the eMMC used in the nbg6817 is:

Found valid GPT with protective MBR; using GPT.
Disk /dev/mmcblk0: 7471104 sectors, 3.6 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): XXX
Partition table holds up to 12 entries
First usable sector is 34, last usable sector is 7471070
Partitions will be aligned on 2-sector boundaries
Total free space is 1 sectors (512 bytes)

Number  Start (sector)    End (sector)  Size       Code  Name
   1              34            8225   4.0 MiB     FFFF  rootfs_data
   2            8226           16417   4.0 MiB     FFFF  romd
   3           16418           18465   1024.0 KiB  FFFF  header
   4           18466           26657   4.0 MiB     FFFF  kernel
   5           26658          157729   64.0 MiB    FFFF  rootfs
   6          157730          159777   1024.0 KiB  FFFF  header_1
   7          159778          167969   4.0 MiB     FFFF  kernel_1
   8          167970          299041   64.0 MiB    FFFF  rootfs_1
   9          299042          823329   256.0 MiB   FFFF  bu1
  10          823330         7471069   3.2 GiB     FFFF  bu2

rootfs_data is the ext4 formatted overlay of the OEM firmware, LEDE
ignores it due to its (too) small size.

romd/ bu1 are initialized with zeroes (0x00) and unused.

bu2 is formatted with ext4 and used for streamboost and other optional
functionality by the OEM firmware, it is reformatted during factory
resets of the OEM firmware.

header/ header_1 contains version information for the corresponding
vendor firmwares installed to kernel/rootfs or kernel_1/ rootfs_1, the
format hasn't been completely reverse engineered so far and remains
left untouched by LEDE:

V1.00(ABCS.2)C0:
 00000000  00 00 a7 74 01 32 f0 00  56 31 2e 30 30 28 41 42  |...t.2..V1.00(AB|
 00000010  43 53 2e 32 29 43 30 00  ff ff ff ff ff ff ff ff  |CS.2)C0.........|
 00000020  ff ff ff ff ff ff ff ff  00 00 d5 dc 4e 42 47 36  |............NBG6|
 00000030  38 31 37 00 ff ff ff ff  ff ff ff ff ff ff ff ff  |817.............|
 00000040  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
 *
 00000060  ff ff ff ff ff ff ff ff  ff ff ff ff 00 00 22 a3  |..............".|
 00000070  00 1c 70 00 ff ff ff ff  ff ff ff ff ff ff ff ff  |..p.............|
 00000080  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
 *
 00000800  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 *
 00100000

V1.00(ABCS.5)C0:
 00000000  00 00 bf 94 01 46 d8 00  56 31 2e 30 30 28 41 42  |.....F..V1.00(AB|
 00000010  43 53 2e 35 29 43 30 00  ff ff ff ff ff ff ff ff  |CS.5)C0.........|
 00000020  ff ff ff ff ff ff ff ff  00 00 d6 5a 4e 42 47 36  |...........ZNBG6|
 00000030  38 31 37 00 ff ff ff ff  ff ff ff ff ff ff ff ff  |817.............|
 00000040  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
 *
 00000060  ff ff ff ff ff ff ff ff  ff ff ff ff 00 00 c0 2c  |...............,|
 00000070  00 1c 58 00 ff ff ff ff  ff ff ff ff ff ff ff ff  |..X.............|
 00000080  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
 *
 00010000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 *
 00100000

Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
2017-10-29 03:11:51 +01:00