Hak5 LAN Turtle is an "USB Ethernet Adapter" shaped device dedicated for
sysadmins and pentesters. This device is based on Atheros AR9331 but it
lacks WiFi. Support for it was first introduced in 950b278c81 (ar71xx).
Two different versions of this device exist and it's up to the user to
install required drivers (generic image supports only common features):
- LAN Turtle 3G with Quectel UG96 3G modem
- LAN Turtle SD with microSD card reader (Alcorlink AU6435R)
Specifications:
- Atheros AR9331
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 1x RJ45 10/100 Mbps Ethernet (AR9331)
- 1x USB 2.0 to 10/100 Ethernet bridge (Realtek RTL8152B)
- 2x LED (power, system), 1x button (inside, on the PCB)
- USB 2.0 Type-A plug for power and RTL8152B
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on OpenWrt/LEDE.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
ALFA Network N5Q is a successor of previous model, the N5 (outdoor
CPE/AP, based on Atheros AR7240 + AR9280). New version is based on
Atheros AR9344.
Support for this device was first introduced in 4b0eebe9df (ar71xx
target) but users are advised to migrate from ar71xx target without
preserving settings as ath79 support includes some changes in network
and LED default configuration. They were aligned with vendor firmware
and recently added N2Q model (both Ethernet ports as LAN, labelled as
LAN1 and LAN2).
Specifications:
- Atheros AR9344
- 550/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x 10/100 Mbps Ethernet, with passive PoE support (24 V)
- 2T2R 5 GHz Wi-Fi, with ext. PA (RFPA5542) and LNA, up to 27 dBm
- 2x IPEX/U.FL or MMCX antenna connectors (for PCBA version)
- 8x LED (7 are driven by GPIO)
- 1x button (reset)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- header for optional 802.3at/af PoE module
- DC jack for main power input (optional, not installed by default)
- UART (4-pin, 2.54 mm pitch) header on PCB
- LEDs (2x 5-pin, 2.54 mm pitch) header on PCB
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on OpenWrt/LEDE. Alternatively, you can use web recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
device, wait for first blink of all LEDs (indicates network setup),
then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
ALFA Network N2Q is an outdoor N300 AP/CPE based on Qualcomm/Atheros
QCA9531 v2. This model is a successor of the old N2 which was based
on Atheros AR7240. FCC ID: 2AB8795311.
Specifications:
- Qualcomm/Atheros QCA9531 v2
- 650/400/200 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2T2R 2.4 GHz Wi-Fi with ext. PA (Skyworks SE2623L) and LNA
- 2x 10/100 Mbps Ethernet with passive PoE input in one port (24 V)
- PoE pass through in second port (controlled by GPIO)
- support for optional 802.3af/at PoE module
- 1x mini PCIe slot (PCIe bus, extra 4.2 V for high power cards)
- 2x IPEX/U.FL connectors on PCB
- 1x USB 2.0 mini Type-B (power controlled by GPIO)
- 8x LED (7 of them are driven by GPIO)
- 1x button (reset)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- UART (4-pin, 2.54 mm pitch) header on PCB
- LEDs (2x 5-pin, 2.54 mm pitch) header on PCB
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on LEDE/OpenWrt. Alternatively, you can use web recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
device, wait for first blink of all LEDs (indicates network setup),
then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
ALFA Network R36A is a successor of the previous model, the R36 (Ralink
RT3050F based). New version is based on Qualcomm/Atheros QCA9531 v2, FCC
ID: 2AB879531.
Support for this device was first introduced in af8f0629df (ar71xx
target). When updating from previous release (and/or ar71xx target),
user should only adjust the WAN LED trigger type (netdev in ar71xx,
switch port in ath79).
Specifications:
- Qualcomm/Atheros QCA9531 v2
- 650/400/200 MHz (CPU/DDR/AHB)
- 128 MB (R36AH/-U2) or 64 MB (R36A) of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x 10/100 Mbps Ethernet
- Passive PoE input support (12~36 V) in RJ45 near DC jack
- 2T2R 2.4 GHz Wi-Fi with Qorvo RFFM8228P FEM
- 2x IPEX/U.FL connectors on PCB
- 1x USB 2.0 Type-A
- 1x USB 2.0 mini Type-B in R36AH-U2 version
- USB power is controlled by GPIO
- 6/7x LED (5/6 of them are driven by GPIO)
- 2x button (reset, wifi/wps)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- DC jack with lock, for main power input (12 V)
- UART (4-pin, 2.54 mm pitch) header on PCB
Optional/additional features in R36A series (R36A was the first model):
- for R36AH: USB 2.0 hub*
- for R36AH-U2: USB 2.0 hub*, 1x USB 2.0 mini Type-B, one more LED
*) there are at least three different USB 2.0 hub in R36AH/-U2 variants:
- Terminus-Tech FE 1.1
- Genesys Logic GL852G
- Genesys Logic GL850G (used in latests revision)
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on LEDE/OpenWrt. Alternatively, you can use web recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
device, wait for first blink of all LEDs (indicates network setup),
then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Samsung WAM250 is a dual-band (selectable, not simultaneous) wireless
hub, dedicated for Samsung Shape Wireless Audio System. The device is
based on Atheros AR9344 (FCC ID: A3LWAM250). Support for this device
was first introduced in e58e49bdbe (ar71xx target).
Specifications:
- Atheros AR9344
- 560/450/225 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x 10/100 Mbps Ethernet
- 2T2R 2.4/5 GHz Wi-Fi, with ext. PA (SE2598L, SE5003L) and LNA
- 1x USB 2.0
- 4x LED (all are driven by GPIO)
- 2x button (reset, wps/speaker add)
- DC jack for main power input (14 V)
- UART header on PCB (J4, RX: 3, TX: 5)
Flash instruction:
This device uses dual-image (switched between upgrades) with a common
jffs2 config partition. Fortunately, there is a way to disable this mode
so that more flash space can be used by OpenWrt image.
You can easily access this device over telnet, using root/root
credentials (the same also work for serial console access).
1. Make sure that your device uses second (bootpart=2) image using
command: "fw_printenv bootpart".
2. If your device uses first image (bootpart=1), perform upgrade to the
latest vendor firmware (after the update, device should boot from
second partition) using web gui (default login: admin/1234567890).
3. Rename "sysupgrade" image to "firmware.bin", download it (you can use
wget, tftp or ftpget) to "/tmp" and issue below commands:
mtd_debug erase /dev/mtd3 0 $(wc -c /tmp/firmware.bin | awk -F' ' '{print $1}')
mtd_debug write /dev/mtd3 0 $(wc -c /tmp/firmware.bin)
fw_setenv bootpart
fw_setenv bootcmd "bootm 0x9f070000"
reboot
Revert to vendor firmware instruction:
1. Download vendor firmware to "/tmp" device and issue below commands:
fw_setenv bootpart 1
sysupgrade -n -F SS_BHUB_v2.2.05.bin
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Wallys DR531 is based on Qualcomm Atheros QCA9531 v2. Support for this
device was first introduced in e767980eb8 (ar71xx target).
Specifications:
- Qualcomm/Atheros QCA9531 v2
- 550/400/200 MHz (CPU/DDR/AHB)
- 2x 10/100 Mbps Ethernet
- 64 MB of RAM (DDR2)
- 8 MB of flash (SPI NOR)
- 2T2R 2.4 GHz Wi-Fi, with external PA (SE2576L), up to 30 dBm
- 2x MMCX connectors (optional IPEX/U.FL)
- mini PCIe connector (PCIe/USB buses and mini SIM slot)
- 7x LED, 1x button, 1x optional buzzer
- UART, JTAG and LED headers on PCB
Flash instruction (do it under U-Boot, using UART):
tftpb 0x80060000 openwrt-ath79-...-dr531-squashfs-sysupgrade.bin
erase 0x9f050000 +$filesize
cp.b $fileaddr 0x9f050000 $filesize
setenv bootcmd "bootm 0x9f050000"
saveenv && reset
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
The AP121FE is a slightly modified version of already supported AP121F
model (added to ar71xx in 0c6165d21a and to ath79 in 334bbc5198).
The differences in compare to AP121F:
- no micro SD card reader
- USB data lines are included in Type-A plug
- USB bus switched to device/peripheral mode (permanently, in bootstrap)
Other than that, specifications are the same:
- Atheros AR9331
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR1)
- 16 MB of flash (SPI NOR)
- 1x 10/100 Mbps Ethernet
- 1T1R 2.4 GHz Wi-Fi, up to 15 dBm
- 1x IPEX/U.FL connector, internal PCB antenna
- 3x LED, 1x button, 1x switch
- 4-pin UART header on PCB (2 mm pitch)
- USB 2.0 Type-A plug (power and data)
Flash instruction (under U-Boot web recovery mode):
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with RJ45 port, press the reset button, power up device,
wait for first blink of all LEDs (indicates network setup), then keep
button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
There are currently several variants of 'wpad' package but the 'iwinfo'
is included by default only if 'wpad', 'wpad-{basic*,mini}' or 'nas'
packages are included in {DEVICE,DEFAULT}_PACKAGES. Use 'wpad-*'
pattern to include 'iwinfo' with any 'wpad' variant.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
The ethernet setup/label MAC address for RT-AC51U and RT-AC54U are
the same, so move them into the shared DTSI.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
'setfiles' and others should be installed to $(STAGING_DIR_HOSTPKG)/bin
rather than $(...)/sbin which isn't in PATH.
Also using -Wl,-rpath to set library search location instead of setting
LD_LIBRARY_PATH when calling setfiles in image.mk.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The order of function and color in the labels in inverted for the
LAN LEDs. Fix it.
Fixes: 915966d861 ("ath79: Port PowerCloud Systems CAP324 support")
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The LED color was missing in 01_leds.
Fixes: 745dee11ac ("ath79: add support for WD My Net Wi-Fi Range
Extender")
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The "/dts-v1/;" identifier is supposed to be present once at the
top of a device tree file after the includes have been processed.
In ramips, we therefore requested to have in the DTS files so far,
and omit it in the DTSI files. However, essentially the syntax of
the parent mtxxxx/rtxxxx DTSI files already determines the DTS
version, so putting it into the DTS files is just a useless repetition.
Consequently, this patch puts the dts-v1 statement into the top-level
SoC-based DTSI files, and removes all other occurences.
Since the dts-v1 statement needs to be before any other definitions,
this also moves the includes accordingly where necessary.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The "/dts-v1/;" identifier is supposed to be present once at the
top of a device tree file after the includes have been processed.
In ath79, we therefore requested to have in the DTS files so far,
and omit it in the DTSI files. However, essentially the syntax of
the parent ath79.dtsi file already determines the DTS version, so
putting it into the DTS files is just a useless repetition.
Consequently, this patch puts the dts-v1 statement into the parent
ath79.dtsi, which is (indirectly) included by all DTS files. All
other occurences are removed.
Since the dts-v1 statement needs to be before any other definitions,
this also moves the includes to make sure the ath79.dtsi or its
descendants are always included first.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
ath79.dtsi uses ATH79_CLK_MDIO, so the include
<dt-bindings/clock/ath79-clk.h>
needs to be moved there.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The "/dts-v1/;" identifier is supposed to be present once at the
top of a device tree file after the includes have been processed.
Therefore, adding it to a DTS _and_ a DTSI file is actually wrong,
as it will be present twice then (though the compiler does not
complain about it).
In ipq40xx, the dts-v1 statement is already included in
qcom-ipq4019.dtsi, so we don't have to add it anywhere at all.
However, based on the conditions stated above, this requires
qcom-ipq4019.dtsi to be included as the first file in any DTS(I).
Consequently, this patch removes all cases of dts-v1 for the
ipq40xx target, and moves the includes accordingly where necessary.
While at it, remove a few obviously unneeded includes on the way.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Move engenius_loader_okli image recipe in front of all Engenius
devices, so adding new device entries will not have them sorted
before the shared recipe.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
First group the interfaces on the DSA switch into the
right LAN/WAN groups. Tested successfully on the
D-Link DIR-685 with the RTL8366RB DSA switch.
The RTL8366RB is DSA custom tagged and now handled
by the kernel tag parser. (Backported.)
The Vitesse switches are not capable of supporting
DSA per-port tagging. We suspect they must be handled
using some custom VLAN set-up.
Cc: Pawel Dembicki <paweldembicki@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
[sorted devices alphabetically]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
.dts:226.17-230.4: Warning (spi_bus_reg): /soc/spi@78b6000/spi@1:
SPI bus unit address format error, expected "0"
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This patch adds support for Cisco Meraki MR32.
The unit was donated by Chris Blake. Thank you!
WARNING:
Only the 1x1:1 abgn Air Marshal WIPS wifi is currently supported by b43:
b43-phy2: Found PHY: Analog 9, Type 4 (N), Revision 16
b43-phy2: Found Radio: Manuf 0x17F, ID 0x2057, Revision 9, Version 1
b43-phy2: Loading firmware version 784.2 (2012-08-15 21:35:19)
and only as 802.11ABG!
while WIFI1 and WIFI2 (both BCM4352) are not:
b43-phy0: Broadcom 4352 WLAN found (core revision 42)
b43-phy0 ERROR: FOUND UNSUPPORTED PHY (Analog 12, Type 11 (AC), Revision 1)
Hardware Highlights:
SoC: Broadcom BCM53016A1 (1 GHz, 2 cores)
RAM: 128 MiB
NAND: 128 MiB Spansion S34ML01G2 (~114 MiB useable)
ETH: 1GBit Ethernet Port - PoE
WIFI1: Broadcom BCM43520 an+ac (2x2:2 - id: 0x4352)
WIFI2: Broadcom BCM43520 bgn (2x2:2 - id: 0x4352)
WIFI3: Broadcom BCM43428 abgn (1x1:1 - id: 43428)
BLE: Broadcom BCM20732 (ttyS1)
LEDS: 1 x Programmable RGB Status LED (driven by a PWM)
1 x White LED (GPIO)
1 x Orange LED Fault Indicator (GPIO)
2 x LAN Activity / Speed LEDs (On the RJ45 Port)
BUTTON: one Reset button
MISC: AT24C64 8KiB EEPROM (i2c - stores Ethernet MAC + Serial#!)
ina219 hardware monitor (i2c)
Kensington Lock
SERIAL:
WARNING: The serial port needs a TTL/RS-232 3V3 level converter!
The Serial setting is 115200-8-N-1. The board has a populated
right angle 1x4 0.1" pinheader.
The pinout is: VCC, RX, TX, GND. (Use a multimeter)
Flashing needs a serial adaptor (due to the lack of a working dropbear on
the original firmware).
This flashing procedure for the MR32 was tested with firmware:
"r23-149867:150252-aacharya".
0. Create a seperate Ethernet LAN which does not have access to the internet.
Ideally use 192.168.1.2 for your PC. Make sure to reserve 192.168.1.1 it
will be used later on by the OpenWrt firmware. The original Meraki firmware
will likely try to setup the network via DHCP Discovery, so make sure your
PC is running a DHCP-Server (i.e.: dnsmasq)
'# dnsmasq -i eth# -F 192.168.1.5,192.168.1.50
Furthermore, the PC needs a supported ssh/http/ftp server in order to
retrieve the initramfs + dtb file
1. Disassemble the MR32 device by removing all screws (4 screws are located
under the 4 rubber feets!) and prying open the plastic covers without
breaking the plastic retention clips. Once inside, remove all the screws
on the outer metal shielding to get to the PCB. It's not necessary to
remove the antennas!
2. Connect the serial cable to the serial header.
3. Partially reassemble the outer metal shielding to ensure that the SoC
has a proper heat sink.
4. Connect the Ethernet patch cable to the device and the power cable.
5. Wait for the device to boot and enter the root shell.
(rooting is not discussed in detail here please refer to
Chris Blake - "pwning the meraki mr18" blog post:
<https://servernetworktech.com/2016/02/pwning-the-meraki-mr18/>
(The same method works with the MR32's r23-149867:150252-aacharya)
Wait for the MR32 to enter the "<Meraki>" prompt and enter:
<Meraki> odm serial_num read
(Verify that it matches what's on the S/N Sticker on the back!)
<Meraki> odm serial_num write Q2XX-XXXX-XXXV
<Meraki> odm serial_num read
(Verify that the S/N has changed - and the LED start to flash)
now to flash the firmware:
<Meraki> odm firmware part.safe "http://192.168.1.2/mr32-initramfs.bin"
Once OpenWrt booted use sysupgrade to permanently install
OpenWrt. To do this: Download the latest sysupgrade.bin file
for the MR32 to the device and use sysupgrade *sysupgrade.bin
to install it.
WARNING: DO NOT DELETE the "storage" ubi volume!
To flash later MR32 Firmwares like r25-201804051805-G885d6d78-dhow-rel
requires in-circut-i2c tools to access the I2C EEPROM AT24C64 next to
the SoC. The idea is pretty much the same as from Step 5 from above:
Change the serial number to Q2XXXXXXXXXV (should be around 0x7c), then
attach a serial cable, ethernet (but make sure the device can't reach
the internet!) hit "s" (the small s!) during boot to enter the root-shell
and add the following commands to the /storage/config there:
serial_allow_odm true
serial_access_enabled true
serial_access_check false
valid_config true
and then hit exit to let it finish booting.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
The BCM5301x SoCs do have i2c. Since this is only
being used by the Meraki MR32, this will be packaged
as a module.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
These have made their way into -next. This patch
also includes the portion of the bcm53xx kernel
patch refreshes as the hunks in
302-ARM-dts-BCM5301X-Update-Northstar-pinctrl-binding.patch
moved slightly due to the added nodes.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
The Meraki MR32 (BCM53016A1) uses the pwm to drive the
tricolor LED. The driver has been available in upstream
for a long time. Only the Device-Tree definition was
missing, but it has been queued recently.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
As the PWM has its own sub-system in the Linux kernel,
I think it should be handled in the same way as GPIO, RTC, PCI...
This patch introduces a specific feature flag "pwm" and the
"leds-pwm" kernel module as the first customer.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Some bootloaders are really keen on just one special
fdt in a multi-image fit image. This is a problem, because
currently this is fixed to "fdt@1".
This patch introduces a new device variable:
DEVICE_FDT_NUM that allows to specify the right
fdt number.
If the value is absent "1" will be chosen.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
The Linksys MR8300 is based on QCA4019 and QCA9888
and provides three, independent radios.
NAND provides two, alternate kernel/firmware images
with fail-over provided by the OEM U-Boot.
Hardware Highlights:
SoC: IPQ4019 at 717 MHz (4 CPUs)
RAM: 512MB RAM
SoC: Qualcomm IPQ4019 at 717 MHz (4 CPUs)
RAM: 512M DDR3
FLASH: 256 MB NAND (Winbond W29N02GV, 8-bit parallel)
ETH: Qualcomm QCA8075 (4x GigE LAN, 1x GigE Internet Ethernet Jacks)
BTN: Reset and WPS
USB: USB3.0, single port on rear with LED
SERIAL: Serial pads internal (unpopulated)
LED: Four status lights on top + USB LED
WIFI1: 2x2:2 QCA4019 2.4 GHz radio on ch. 1-14
WIFI2: 2x2:2 QCA4019 5 GHz radio on ch. 36-64
WIFI3: 2x2:2 QCA9888 5 GHz radio on ch. 100-165
Support is based on the already supported EA8300.
Key differences:
EA8300 has 256MB RAM where MR8300 has 512MB RAM.
MR8300 has a revised top panel LED setup.
Installation:
"Factory" images may be installed directly through the OEM GUI using
URL: https://ip-of-router/fwupdate.html (Typically 192.168.1.1)
Signed-off-by: Hans Geiblinger <cybrnook2002@yahoo.com>
[copied Hardware-highlights from EA8300. Fixed alphabetical order.
fixed commit subject, removed bogus unit-address of keys,
fixed author (used Signed-off-By to From:) ]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Luma Home WRTQ-329ACN, also known as Luma WiFi System, is a dual-band
wireless access point.
Specification
SoC: Qualcomm Atheros IPQ4018
RAM: 256 MB DDR3
Flash: 2 MB SPI NOR
128 MB SPI NAND
WIFI: 2.4 GHz 2T2R integrated
5 GHz 2T2R integrated
Ethernet: 2x 10/100/1000 Mbps QCA8075
USB: 1x 2.0
Bluetooth: 1x 4.0 CSR8510 A10, connected to USB bus
LEDS: 16x multicolor LEDs ring, controlled by MSP430G2403 MCU
Buttons: 1x GPIO controlled
EEPROM: 16 Kbit, compatible with AT24C16
UART: row of 4 holes marked on PCB as J19, starting count from the side
of J19 marking on PCB
1. GND, 2. RX, 3. TX, 4. 3.3V
baud: 115200, parity: none, flow control: none
The device supports OTA or USB flash drive updates, unfotunately they
are signed. Until the signing key is known, the UART access is mandatory
for installation. The difficult part is disassembling the casing, there
are a lot of latches holding it together.
Teardown
Prepare three thin, but sturdy, prying tools. Place the device with back
of it facing upwards. Start with the wall having a small notch. Insert
first tool, until You'll feel resistance and keep it there. Repeat the
procedure for neighbouring walls. With applying a pressure, one edge of
the back cover should pop up. Now carefully slide one of the tools to
free the rest of the latches.
There's no need to solder pins to the UART holes, You can use hook clips,
but wiring them outside the casing, will ease debuging and recovery if
problems occur.
Installation
1. Prepare TFTP server with OpenWrt initramfs image.
2. Connect to UART port (don't connect the voltage pin).
3. Connect to LAN port.
4. Power on the device, carefully observe the console output and when
asked quickly enter the failsafe mode.
5. Invoke 'mount_root'.
6. After the overlayfs is mounted run:
fw_setenv bootdelay 3
This will allow to access U-Boot shell.
7. Reboot the device and when prompted to stop autoboot, hit any key.
8. Adjust "ipaddr" and "serverip" addresses in U-Boot environment, use
'setenv' to do that, then run following commands:
tftpboot 0x84000000 <openwrt_initramfs_image_name>
bootm 0x84000000
and wait till OpenWrt boots.
9. In OpenWrt command line run following commands:
fw_setenv openwrt "setenv mtdids nand1=spi_nand; setenv mtdparts mtdparts=spi_nand:-(ubi); ubi part ubi; ubi read 0x84000000 kernel; bootm 0x84000000"
fw_setenv bootcmd "run openwrt"
10. Transfer OpenWrt sysupgrade image to /tmp directory and flash it
with:
ubirmvol /dev/ubi0 -N ubi_rootfs
sysupgrade -v -n /tmp/<openwrt_sysupgrade_image_name>
11. After flashing, the access point will reboot to OpenWrt, then it's
ready for configuration.
Reverting to OEM firmware
1. Execute installation guide steps: 1, 2, 3, 7, 8.
2. In OpenWrt command line run following commands:
ubirmvol /dev/ubi0 -N rootfs_data
ubirmvol /dev/ubi0 -N rootfs
ubirmvol /dev/ubi0 -N kernel
ubirename /dev/ubi0 kernel1 kernel ubi_rootfs1 ubi_rootfs
ubimkvol /dev/ubi0 -S 34 -N kernel1
ubimkvol /dev/ubi0 -S 320 -N ubi_rootfs1
ubimkvol /dev/ubi0 -S 264 -N rootfs_data
fw_setenv bootcmd bootipq
3. Reboot.
Known issues
The LEDs ring doesn't have any dedicated driver or application to control
it, the only available option atm is to manipulate it with 'i2cset'
command. The default action after applying power to device is spinning
blue light. This light will stay active at all time. To disable it
install 'i2c-tools' with opkg and run:
i2cset -y 2 0x48 3 1 0 0 i
The light will stay off until next cold boot.
Additional information
After completing 5. step from installation guide, one can disable asking
for root password on OEM firmware by running:
sed -e 's/root❌/root::/' -i /etc/passwd
This is useful for investigating the OEM firmware. One can look
at the communication between the stock firmware and the vendor's
cloud servers or as a way of making a backup of both flash chips.
The root password seems to be constant across all sold devices.
This is output of 'led_ctl' from OEM firmware to illustrate
possibilities of LEDs ring:
Usage: led_ctl [status | upgrade | force_upgrade | version]
led_ctl solid COLOR <brightness>
led_ctl single COLOR INDEX <brightness 0 - 15>
led_ctl spinning COLOR <period 1 - 16 (lower = faster)>
led_ctl fill COLOR <period 1 - 16 (lower = faster)>
( default is 5 )
led_ctl flashing COLOR <on dur 1 - 128> <off dur 1 - 128>
(default is 34) ( default is 34 )
led_ctl pulsing COLOR
COLOR: red, green, blue, yellow, purple, cyan, white
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
[squash "ipq-wifi: add BDFs for Luma Home WRTQ-329ACN" into commit,
changed ubi volumes for easier integration, slightly reworded
commit message, changed ubi volume layout to use standard names all
around]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
It should return false to indicate that the option should not be ignored
Fixes 064dc1e8 ("dnsmasq: abort when dnssec requested but not
available")
Reported-by: Sami Olmari <sami@olmari.fi>
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
The TFTP server provided by dnsmasq supports serving a select boot image
based on the client's MAC or IP address. This allows an administrator
to activate this feature in /etc/config/dhcp. Here is an example
/etc/config/dhcp that configures dnsmasq with --tftp-unique-root=mac:
...
config dnsmasq
option enable_tftp 1
option tftp_root /usr/libexec/tftpboot
option tftp_unique_root mac
config boot router
option serveraddress 192.168.1.1
option servername tftp.example.com
option filename openwrt-initramfs-kernel.bin
...
With this configuration, dnsmasq will serve
/usr/libexec/tftpboot/00-11-22-33-44-55/openwrt-initramfs-kernel.bin to
the client with MAC address 00:11:22:33:44:55.
Signed-off-by: W. Michael Petullo <mike@flyn.org>
All modifications made by update_kernel.sh
Build system: x86_64
Build-tested: ipq806x, lantiq/xrx200 and ath79/generic
Run-tested: ipq806x (R7800), lantiq (Easybox 904 xDSL)
No dmesg regressions, everything functional
Signed-off-by: John Audia <graysky@archlinux.us>
[add test on lantiq]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Add config options:
srcportmin/srcportmax : range of port numbers to use as UDP source ports
to communicate to the remote VXLAN tunnel endpoint
ageing : lifetime in seconds of FDB entries learnt by the kernel
maxaddress : maximum number of FDB entries
learning : enable/disable entering unknown source link layer addresses
and IP addresses into the VXLAN device FDB.
rsc : enable/disable route short circuit
proxy : enable/disable ARP proxy
l2miss : enable/disable netlink LLADDR miss notifications
l3miss : enable/disable netlink IP ADDR miss notifications
gbp : enable/disable the Group Policy extension
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
This submission relied heavily on the work of
Santiago Rodriguez-Papa <contact at rodsan.dev>
Specifications:
* SoC: MediaTek MT7621A (880 MHz 2c/4t)
* RAM: Winbond W632GG6MB-12 (256M DDR3-1600)
* Flash: Winbond W29N01HVSINA (128M NAND)
* Eth: MediaTek MT7621A (10/100/1000 Mbps x5)
* Radio: MT7603E/MT7615N (2.4 GHz & 5 GHz)
4 antennae: 1 internal and 3 non-deatachable
* USB: 3.0 (x1)
* LEDs:
White (x1 logo)
Green (x6 eth + wps)
Orange (x5, hardware-bound)
* Buttons:
Reset (x1)
WPS (x1)
Installation:
Flash factory image through GUI.
This might fail due to the A/B nature of this device. When flashing, OEM
firmware writes over the non-booted partition. If booted from 'A',
flashing over 'B' won't work. To get around this, you should flash the
OEM image over itself. This will then boot the router from 'B' and
allow you to flash OpenWRT without problems.
Reverting to factory firmware:
Hard-reset the router three times to force it to boot from 'B.' This is
where the stock firmware resides. To remove any traces of OpenWRT from
your router simply flash the OEM image at this point.
Signed-off-by: J. Scott Heppler <shep971@centurylink.net>
SPDX moved from GPL-2.0 to GPL-2.0-only and from GPL-2.0+ to
GPL-2.0-or-later. Reflect that in the SPDX license headers.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
