Commit Graph

354 Commits

Author SHA1 Message Date
Sebastian Schaper
4bed263af7 ath79: fix label MAC address for D-Link DIR-825B1
The label MAC address for DIR-825 Rev. B1 is the WAN address located
at 0xffb4 in `caldata`, which equals LAN MAC at 0xffa0 incremented by 1.

Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2022-05-29 00:00:52 +02:00
Nick Hainke
88527294cd ath79: add Netgear WNDAP360
SoC: Atheros AR7161
RAM: DDR 128 MiB (hynix h5dU5162ETR-E3C)
Flash: SPI-NOR 8 MiB (mx25l6406em2i-12g)
WLAN: 2.4/5 GHz
2.4 GHz: Atheros AR9220
5 GHz: Atheros AR9223
Ethernet: 4x 10/100/1000 Mbps (Atheros AR8021)
LEDs/Keys: 2/2 (Internet + System LED, Mesh button + Reset pin)
UART: RJ45 9600,8N1
Power: 12 VDC, 1.0 A

Installation instruction:
0. Make sure you have latest original firmware (3.7.11.4)
1. Connect to the Serial Port with a Serial Cable RJ45 to DB9/RS232
   (9600,8N1)
   screen  /dev/ttyUSB0 9600,cs8,-parenb,-cstopb,-hupcl,-crtscts,clocal
2. Configure your IP-Address to 192.168.1.42
3. When device boots hit spacebar
3. Configure the device for tftpboot
   setenv ipaddr 192.168.1.1
   setenv serverip 192.168.1.42
   saveenv
4. Reset the device
   reset
5. Hit again the spacebar
6. Now load the image via tftp:
   tftpboot 0x81000000 INITRAMFS.bin
7. Boot the image:
   bootm 0x81000000
8. Copy the squashfs-image to the device.
9. Do a sysupgrade.

https://openwrt.org/toh/netgear/wndap360

The device should be converted from kmod-owl-loader to nvmem-cells in the
future. Nvmem cells were not working. Maybe ATH9K_PCI_NO_EEPROM is missing.
That is why this commit is still using kmod-owl-loader. In the future
the device tree may look like this:

&ath9k0 {
       nvmem-cells = <&macaddr_art_120c>, <&cal_art_1000>;
       nvmem-cell-names = "mac-address", "calibration";
};

&ath9k1 {
       nvmem-cells = <&macaddr_art_520c>, <&cal_art_5000>;
       nvmem-cell-names = "mac-address", "calibration";
};

&art {
	...
	cal_art_1000: cal@1000 {
		reg = <0x1000 0xeb8>;
	};

	cal_art_5000: cal@5000 {
		reg = <0x5000 0xeb8>;
	};
};

Signed-off-by: Nick Hainke <vincent@systemli.org>
2022-04-30 23:56:47 +02:00
Foica David
063e9047cc ath79: add support for TP-Link Deco M4R v1 and v2
This commit adds support for the TP-Link Deco M4R (it can also be M4,
TP-Link uses both names) v1 and v2. It is similar hardware-wise to the
Archer C6 v2. Software-wise it is very different. V2 has a bit different
layout from V1 but the chips are the same and the OEM firmware is the same
for both versions.

Specifications:
SoC: QCA9563-AL3A
RAM: Zentel A3R1GE40JBF
Wireless 2.4GHz: QCA9563-AL3A (main SoC)
Wireless 5GHz: QCA9886
Ethernet Switch: QCA8337N-AL3C
Flash: 16 MB SPI NOR

Flashing:

The device's bootloader only accepts images that are signed using
TP-Link's RSA key, therefore this way of flashing is not possible. The
device has a web GUI that should be accessible after setting up the device
using the app (it requires the app to set it up first because the web GUI
asks for the TP-Link account password) but for unknown reasons, the web
GUI also refuses custom images.

There is a debug firmware image that has been shared on the device's
OpenWrt forum thread that has telnet unlocked, which the bootloader will
accept because it is signed. It can be used to transfer an OpenWrt image
file over to the device and then be used with mtd to flash the device.

Pre-requisites:

- Debug firmware.
- A way of transferring the file to the router, you can use an FTP server
  as an example.
- Set a static IP of 192.168.0.2/255.255.255.0 on your computer.
- OpenWrt image.

Installation:

- Unplug your router and turn it upside down. Using a long and thin object
  like a SIM unlock tool, press and hold the reset button on the router and
  replug it. Keep holding it until the LED flashes yellow.
- Open 192.168.0.1. You should see the bootloader recovery's webpage.
  Choose the debug firmware that you downloaded and flash it. Wait until the
  router reboots (at this stage you can remove the static IP).

- Open a terminal window and connect to the router via telnet (the primary
  router should have a 192.168.0.1 IP address, secondary routers are
  different).
- Transfer the file over to the router, you can use curl to download it
  from the internet (use the insecure flag and make sure your source accepts
  insecure downloads) or from an FTP server.
- The router's default mtd partition scheme has kernel and rootfs
  separated. We can use dd to split the OpenWrt image file and flash it with
  mtd:

   dd if=openwrt.bin of=kernel.bin skip=0 count=8192 bs=256
   dd if=openwrt.bin of=rootfs.bin skip=8192 bs=256

- Once the images are ready, you have to flash the device using mtd
  (make sure to flash the correct partitions or you may be left with a
  hard bricked router):

   mtd write kernel.bin kernel
   mtd write rootfs.bin rootfs

- Flashing is done, reboot the device now.

Signed-off-by: Foica David <superh552@gmail.com>
2022-04-30 23:56:47 +02:00
Andrew Powers-Holmes
6f1efb2898 ath79: add support for Sophos AP100/AP55 family
The Sophos AP100, AP100C, AP55, and AP55C are dual-band 802.11ac access
points based on the Qualcomm QCA9558 SoC. They share PCB designs with
several devices that already have partial or full support, most notably the
Devolo DVL1750i/e.

The AP100 and AP100C are hardware-identical to the AP55 and AP55C, however
the 55 models' ART does not contain calibration data for their third chain
despite it being present on the PCB.

Specifications common to all models:
 - Qualcomm QCA9558 SoC @ 720 MHz (MIPS 74Kc Big-endian processor)
 - 128 MB RAM
 - 16 MB SPI flash
 - 1x 10/100/1000 Mbps Ethernet port, 802.3af PoE-in
 - Green and Red status LEDs sharing a single external light-pipe
 - Reset button on PCB[1]
 - Piezo beeper on PCB[2]
 - Serial UART header on PCB
 - Alternate power supply via 5.5x2.1mm DC jack @ 12 VDC

Unique to AP100 and AP100C:
 - 3T3R 2.4GHz 802.11b/g/n via SoC WMAC
 - 3T3R 5.8GHz 802.11a/n/ac via QCA9880 (PCI Express)

AP55 and AP55C:
 - 2T2R 2.4GHz 802.11b/g/n via SoC WMAC
 - 2T2R 5.8GHz 802.11a/n/ac via QCA9880 (PCI Express)

AP100 and AP55:
 - External RJ45 serial console port[3]
 - USB 2.0 Type A port, power controlled via GPIO 11

Flashing instructions:

This firmware can be flashed either via a compatible Sophos SG or XG
firewall appliance, which does not require disassembling the device, or via
the U-Boot console available on the internal UART header.

To flash via XG appliance:
 - Register on Sophos' website for a no-cost Home Use XG firewall license
 - Download and install the XG software on a compatible PC or virtual
   machine, complete initial appliance setup, and enable SSH console access
 - Connect the target AP device to the XG appliance's LAN interface
 - Approve the AP from the XG Web UI and wait until it shows as Active
   (this can take 3-5 minutes)
 - Connect to the XG appliance over SSH and access the Advanced Console
   (Menu option 5, then menu option 3)
 - Run `sudo awetool` and select the menu option to connect to an AP via
   SSH. When prompted to enable SSH on the target AP, select Yes.
 - Wait 2-3 minutes, then select the AP from the awetool menu again. This
   will connect you to a root shell on the target AP.
 - Copy the firmware to /tmp/openwrt.bin on the target AP via SCP/TFTP/etc
 - Run `mtd -r write /tmp/openwrt.bin astaro_image`
 - When complete, the access point will reboot to OpenWRT.

To flash via U-Boot serial console:
 - Configure a TFTP server on your PC, and set IP address 192.168.99.8 with
   netmask 255.255.255.0
 - Copy the firmware .bin to the TFTP server and rename to 'uImage_AP100C'
 - Open the target AP's enclosure and locate the 4-pin 3.3V UART header [4]
 - Connect the AP ethernet to your PC's ethernet port
 - Connect a terminal to the UART at 115200 8/N/1 as usual
 - Power on the AP and press a key to cancel autoboot when prompted
 - Run the following commands at the U-Boot console:
    - `tftpboot`
    - `cp.b $fileaddr 0x9f070000 $filesize`
    - `boot`
 - The access point will boot to OpenWRT.

MAC addresses as verified by OEM firmware:

use   address     source
LAN   label       config 0x201a (label)
2g    label + 1   art 0x1002    (also found at config 0x2004)
5g    label + 9   art 0x5006

Increments confirmed across three AP55C, two AP55, and one AP100C.

These changes have been tested to function on both current master and
21.02.0 without any obvious issues.

[1] Button is present but does not alter state of any GPIO on SoC
[2] Buzzer and driver circuitry is present on PCB but is not connected to
    any GPIO. Shorting an unpopulated resistor next to the driver circuitry
    should connect the buzzer to GPIO 4, but this is unconfirmed.
[3] This external RJ45 serial port is disabled in the OEM firmware, but
    works in OpenWRT without additional configuration, at least on my
    three test units.
[4] On AP100/AP55 models the UART header is accessible after removing
    the device's top cover. On AP100C/AP55C models, the PCB must be removed
    for access; three screws secure it to the case.
    Pin 1 is marked on the silkscreen. Pins from 1-4 are 3.3V, GND, TX, RX

Signed-off-by: Andrew Powers-Holmes <andrew@omnom.net>
2022-04-16 16:59:29 +02:00
Yousong Zhou
5c147d36ba ath79: port HiWiFi HC6361 from ar71xx
The device was added for ar71xx target and dropped during the ath79
transition, mainly because of the ascii mac address stored in bdinfo
partition

Device page, http://wiki.openwrt.org/toh/hiwifi/hc6361

The vendor u-boot image accepts sysupgrade.bin image with specific
requirements, including having squashfs signature "hsqs" at file offset
0x140000.  This is not possible now that OpenWrt kernel image is at
least 2MB with the signature at offset 0x240000.

Installation of current build of OpenWrt now requires a bootstrap step
of installing an earlier version first.

 - If the vendor u-boot accepts sysupgrade image, hc6361 image of LEDE
   release should work
 - If the vendor u-boot accepts only verified flashsmt image, install
   the one in the above device page.  The image is based on Barrier
   Breaker

   SHA256SUM of the flashsmt image

	81b193b95ea5f8e5c30cd62fa9facf275f39233be4fdeed7038f3deed2736156

After the bootstrap step, current build of OpenWrt can be installed
there fine.

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
2022-04-16 01:27:09 +00:00
Thibaut VARÈNE
c91df224f5 ath79: add support for Yuncore XD3200
Specification:

- QCA9563 (775MHz), 128MB RAM, 16MB SPI NOR
- 2T2R 802.11b/g/n 2.4GHz
- 2T2R 802.11n/ac 5GHz
- 2x 10/100/1000 Mbps Ethernet, with 802.3at PoE support (WAN port)

LED for 5 GHz WLAN is currently not supported as it is connected directly
to the QCA9882 radio chip.

Flash instructions:

If your device comes with generic QSDK based firmware, you can login
over telnet (login: root, empty password, default IP: 192.168.188.253),
issue first (important!) 'fw_setenv' command and then perform regular
upgrade, using 'sysupgrade -n -F ...' (you can use 'wget' to download
image to the device, SSH server is not available):

  fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
  sysupgrade -n -F openwrt-...-yuncore_...-squashfs-sysupgrade.bin

In case your device runs firmware with YunCore custom GUI, you can use
U-Boot recovery mode:

1. Set a static IP 192.168.0.141/24 on PC and start TFTP server with
   'tftp' image renamed to 'upgrade.bin'
2. Power the device with reset button pressed and release it after 5-7
   seconds, recovery mode should start downloading image from server
   (unfortunately, there is no visible indication that recovery got
   enabled - in case of problems check TFTP server logs)

Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
2022-04-15 07:11:18 +02:00
Joe Mullally
44e1e5d153 ath79: Move TPLink WPA8630Pv2 to ath79-tiny target
These devices only have 6MiB available for firmware, which is not
enough for recent release images, so move these to the tiny target.

Note for users sysupgrading from the previous ath79-generic snapshot
images:

The tiny target kernel has a 4Kb flash erase block size instead
of the generic target's 64kb. This means the JFFS2 overlay partition
containing settings must be reformatted with the new block size or else
there will be data corruption.

To do this, backup your settings before upgrading, then during the
sysupgrade, de-select "Keep Settings". On the CLI, use "sysupgrade -n".

If you forget to do this and your system becomes unstable after
upgrading, you can do this to format the partition and recover:

* Reboot
* Press RESET when Power LED blinks during boot to enter Failsafe mode
* SSH to 192.168.1.1
* Run "firstboot" and reboot

Signed-off-by: Joe Mullally <jwmullally@gmail.com>
Tested-by: Robert Högberg <robert.hogberg@gmail.com>
2022-04-09 19:31:46 +02:00
David Bauer
9a0155bc4f ath79: add 5.15 support for generic subtarget
Add Kernel 5.15 patches + config. This is currently only available for
the generic subtarget, as it was exclusively tested with this target.

Tested-on: Siemens WS-AP3610, Enterasys WS-AP3705i

Signed-off-by: David Bauer <mail@david-bauer.net>
2022-03-30 17:28:39 +02:00
Michael Pratt
41be1a2de2 ath79: add support for Araknis AN-700-AP-I-AC
FCC ID: 2AG6R-AN700APIAC

Araknis AN-700-AP-I-AC is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+

this board is a Senao device:
the hardware is equivalent to EnGenius EAP1750
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails

**Specification:**

  - QCA9558 SOC		MIPS 74kc, 2.4 GHz WMAC, 3x3
  - QCA9880 WLAN	PCI card, 5 GHz, 3x3, 26dBm
  - AR8035-A PHY	RGMII GbE with PoE+ IN
  - 40 MHz clock
  - 16 MB FLASH		MX25L12845EMI-10G
  - 2x 64 MB RAM	NT5TU32M16
  - UART console	J10, populated, RX shorted to ground
  - 4 antennas		5 dBi, internal omni-directional plates
  - 4 LEDs		power, 2G, 5G, wps
  - 1 button		reset

  NOTE: all 4 gpio controlled LEDS are viewed through the same lightguide
	therefore, the power LED is off for default state

**MAC addresses:**

  MAC address labeled as ETH
  Only one Vendor MAC address in flash at art 0x0

  eth0 ETH  *:xb art 0x0
  phy1 2.4G *:xc ---
  phy0 5GHz *:xd ---

**Serial Access:**

  the RX line on the board for UART is shorted to ground by resistor R176
  therefore it must be removed to use the console
  but it is not necessary to remove to view boot log

  optionally, R175 can be replaced with a solder bridge short

  the resistors R175 and R176 are next to the UART RX pin at J10

**Installation:**

  Method 1: Firmware upgrade page:

    (if you cannot access the APs webpage)
    factory reset with the reset button
    connect ethernet to a computer
    OEM webpage at 192.168.20.253
    username and password 'araknis'
    make a new password, login again...

    Navigate to 'File Management' page from left pane
    Click Browse and select the factory.bin image
    Upload and verify checksum
    Click Continue to confirm
    wait about 3 minutes

  Method 2: Serial to load Failsafe webpage:

    After connecting to serial console and rebooting...
    Interrupt uboot with any key pressed rapidly
    execute `run failsafe_boot` OR `bootm 0x9fd70000`
    wait a minute
    connect to ethernet and navigate to
    192.168.20.253
    Select the factory.bin image and upload
    wait about 3 minutes

**Return to OEM:**

  Method 1: Serial to load Failsafe webpage (above)

  Method 2: delete a checksum from uboot-env
  this will make uboot load the failsafe image at next boot
  because it will fail the checksum verification of the image

    ssh into openwrt and run
    `fw_setenv rootfs_checksum 0`
    reboot, wait a minute
    connect to ethernet and navigate to
    192.168.20.253
    select OEM firmware image and click upgrade

  Method 3: backup mtd partitions before upgrade

**TFTP recovery:**

  Requires serial console, reset button does nothing

  rename initramfs-kernel.bin to '0101A8C0.img'
  make available on TFTP server at 192.168.1.101
  power board, interrupt boot with serial console
  execute `tftpboot` and `bootm 0x81000000`

  NOTE: TFTP may not be reliable due to bugged bootloader
	set MTU to 600 and try many times

**Format of OEM firmware image:**

  The OEM software is built using SDKs from Senao
  which is based on a heavily modified version
  of Openwrt Kamikaze or Altitude Adjustment.
  One of the many modifications is sysupgrade being performed by a custom script.
  Images are verified through successful unpackaging, correct filenames
  and size requirements for both kernel and rootfs files, and that they
  start with the correct magic numbers (first 2 bytes) for the respective headers.

  Newer Senao software requires more checks but their script
  includes a way to skip them.

  The OEM upgrade script is at
  /etc/fwupgrade.sh

  OKLI kernel loader is required because the OEM software
  expects the kernel to be less than 1536k
  and the OEM upgrade procedure would otherwise
  overwrite part of the kernel when writing rootfs.

Note on PLL-data cells:

  The default PLL register values will not work
  because of the external AR8035 switch between
  the SOC and the ethernet port.

  For QCA955x series, the PLL registers for eth0 and eth1
  can be see in the DTSI as 0x28 and 0x48 respectively.
  Therefore the PLL registers can be read from uboot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x18050028 1` and `md 0x18050048 1`.

  The clock delay required for RGMII can be applied at the PHY side,
  using the at803x driver `phy-mode` setting through the DTS.
  Therefore, the Ethernet Configuration registers for GMAC0
  do not need the bits for RGMII delay on the MAC side.
  This is possible due to fixes in at803x driver
  since Linux 5.1 and 5.3

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2022-03-13 19:54:58 +01:00
Michael Pratt
56716b578e ath79: add support for Araknis AN-500-AP-I-AC
FCC ID: 2AG6R-AN500APIAC

Araknis AN-500-AP-I-AC is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+

this board is a Senao device:
the hardware is equivalent to EnGenius EAP1200
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails

**Specification:**

  - QCA9557 SOC		MIPS 74kc, 2.4 GHz WMAC, 2x2
  - QCA9882 WLAN	PCI card 168c:003c, 5 GHz, 2x2, 26dBm
  - AR8035-A PHY	RGMII GbE with PoE+ IN
  - 40 MHz clock
  - 16 MB FLASH		MX25L12845EMI-10G
  - 2x 64 MB RAM	NT5TU32M16
  - UART console	J10, populated, RX shorted to ground
  - 4 antennas		5 dBi, internal omni-directional plates
  - 4 LEDs		power, 2G, 5G, wps
  - 1 button		reset

  NOTE: all 4 gpio controlled LEDS are viewed through the same lightguide
	therefore, the power LED is off for default state

**MAC addresses:**

  MAC address labeled as ETH
  Only one Vendor MAC address in flash at art 0x0

  eth0 ETH  *:e1 art 0x0
  phy1 2.4G *:e2 ---
  phy0 5GHz *:e3 ---

**Serial Access:**

  the RX line on the board for UART is shorted to ground by resistor R176
  therefore it must be removed to use the console
  but it is not necessary to remove to view boot log

  optionally, R175 can be replaced with a solder bridge short

  the resistors R175 and R176 are next to the UART RX pin at J10

**Installation:**

  Method 1: Firmware upgrade page:

    (if you cannot access the APs webpage)
    factory reset with the reset button
    connect ethernet to a computer
    OEM webpage at 192.168.20.253
    username and password 'araknis'
    make a new password, login again...

    Navigate to 'File Management' page from left pane
    Click Browse and select the factory.bin image
    Upload and verify checksum
    Click Continue to confirm
    wait about 3 minutes

  Method 2: Serial to load Failsafe webpage:

    After connecting to serial console and rebooting...
    Interrupt uboot with any key pressed rapidly
    execute `run failsafe_boot` OR `bootm 0x9fd70000`
    wait a minute
    connect to ethernet and navigate to
    192.168.20.253
    Select the factory.bin image and upload
    wait about 3 minutes

**Return to OEM:**

  Method 1: Serial to load Failsafe webpage (above)

  Method 2: delete a checksum from uboot-env
  this will make uboot load the failsafe image at next boot
  because it will fail the checksum verification of the image

    ssh into openwrt and run
    `fw_setenv rootfs_checksum 0`
    reboot, wait a minute
    connect to ethernet and navigate to
    192.168.20.253
    select OEM firmware image and click upgrade

  Method 3: backup mtd partitions before upgrade

**TFTP recovery:**

  Requires serial console, reset button does nothing

  rename initramfs-kernel.bin to '0101A8C0.img'
  make available on TFTP server at 192.168.1.101
  power board, interrupt boot with serial console
  execute `tftpboot` and `bootm 0x81000000`

  NOTE: TFTP may not be reliable due to bugged bootloader
	set MTU to 600 and try many times

**Format of OEM firmware image:**

  The OEM software is built using SDKs from Senao
  which is based on a heavily modified version
  of Openwrt Kamikaze or Altitude Adjustment.
  One of the many modifications is sysupgrade being performed by a custom script.
  Images are verified through successful unpackaging, correct filenames
  and size requirements for both kernel and rootfs files, and that they
  start with the correct magic numbers (first 2 bytes) for the respective headers.

  Newer Senao software requires more checks but their script
  includes a way to skip them.

  The OEM upgrade script is at
  /etc/fwupgrade.sh

  OKLI kernel loader is required because the OEM software
  expects the kernel to be less than 1536k
  and the OEM upgrade procedure would otherwise
  overwrite part of the kernel when writing rootfs.

Note on PLL-data cells:

  The default PLL register values will not work
  because of the external AR8035 switch between
  the SOC and the ethernet port.

  For QCA955x series, the PLL registers for eth0 and eth1
  can be see in the DTSI as 0x28 and 0x48 respectively.
  Therefore the PLL registers can be read from uboot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x18050028 1` and `md 0x18050048 1`.

  The clock delay required for RGMII can be applied at the PHY side,
  using the at803x driver `phy-mode` setting through the DTS.
  Therefore, the Ethernet Configuration registers for GMAC0
  do not need the bits for RGMII delay on the MAC side.
  This is possible due to fixes in at803x driver
  since Linux 5.1 and 5.3

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2022-03-13 19:54:57 +01:00
Michael Pratt
561f46bd02 ath79: add support for Araknis AN-300-AP-I-N
FCC ID: U2M-AN300APIN

Araknis AN-300-AP-I-N is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+

this board is a Senao device:
the hardware is equivalent to EnGenius EWS310AP
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails

**Specification:**

  - AR9344 SOC		MIPS 74kc, 2.4 GHz WMAC, 2x2
  - AR9382 WLAN		PCI on-board 168c:0030, 5 GHz, 2x2
  - AR8035-A PHY	RGMII GbE with PoE+ IN
  - 40 MHz clock
  - 16 MB FLASH		MX25L12845EMI-10G
  - 2x 64 MB RAM	1839ZFG V59C1512164QFJ25
  - UART console	J10, populated, RX shorted to ground
  - 4 antennas		5 dBi, internal omni-directional plates
  - 4 LEDs		power, 2G, 5G, wps
  - 1 button		reset

  NOTE: all 4 gpio controlled LEDS are viewed through the same lightguide
	therefore, the power LED is off for default state

**MAC addresses:**

  MAC address labeled as ETH
  Only one Vendor MAC address in flash at art 0x0

  eth0 ETH  *:7d art 0x0
  phy1 2.4G *:7e ---
  phy0 5GHz *:7f ---

**Serial Access:**

  the RX line on the board for UART is shorted to ground by resistor R176
  therefore it must be removed to use the console
  but it is not necessary to remove to view boot log

  optionally, R175 can be replaced with a solder bridge short

  the resistors R175 and R176 are next to the UART RX pin at J10

**Installation:**

  Method 1: Firmware upgrade page:

    (if you cannot access the APs webpage)
    factory reset with the reset button
    connect ethernet to a computer
    OEM webpage at 192.168.20.253
    username and password 'araknis'
    make a new password, login again...

    Navigate to 'File Management' page from left pane
    Click Browse and select the factory.bin image
    Upload and verify checksum
    Click Continue to confirm
    wait about 3 minutes

  Method 2: Serial to load Failsafe webpage:

    After connecting to serial console and rebooting...
    Interrupt uboot with any key pressed rapidly
    execute `run failsafe_boot` OR `bootm 0x9fd70000`
    wait a minute
    connect to ethernet and navigate to
    192.168.20.253
    Select the factory.bin image and upload
    wait about 3 minutes

**Return to OEM:**

  Method 1: Serial to load Failsafe webpage (above)

  Method 2: delete a checksum from uboot-env
  this will make uboot load the failsafe image at next boot
  because it will fail the checksum verification of the image

    ssh into openwrt and run
    `fw_setenv rootfs_checksum 0`
    reboot, wait a minute
    connect to ethernet and navigate to
    192.168.20.253
    select OEM firmware image and click upgrade

  Method 3: backup mtd partitions before upgrade

**TFTP recovery:**

  Requires serial console, reset button does nothing

  rename initramfs-kernel.bin to '0101A8C0.img'
  make available on TFTP server at 192.168.1.101
  power board, interrupt boot with serial console
  execute `tftpboot` and `bootm 0x81000000`

  NOTE: TFTP may not be reliable due to bugged bootloader
	set MTU to 600 and try many times

**Format of OEM firmware image:**

  The OEM software is built using SDKs from Senao
  which is based on a heavily modified version
  of Openwrt Kamikaze or Altitude Adjustment.
  One of the many modifications is sysupgrade being performed by a custom script.
  Images are verified through successful unpackaging, correct filenames
  and size requirements for both kernel and rootfs files, and that they
  start with the correct magic numbers (first 2 bytes) for the respective headers.

  Newer Senao software requires more checks but their script
  includes a way to skip them.

  The OEM upgrade script is at
  /etc/fwupgrade.sh

  OKLI kernel loader is required because the OEM software
  expects the kernel to be less than 1536k
  and the OEM upgrade procedure would otherwise
  overwrite part of the kernel when writing rootfs.

Note on PLL-data cells:

  The default PLL register values will not work
  because of the external AR8035 switch between
  the SOC and the ethernet port.

  For QCA955x series, the PLL registers for eth0 and eth1
  can be see in the DTSI as 0x28 and 0x48 respectively.
  Therefore the PLL registers can be read from uboot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x18050028 1` and `md 0x18050048 1`.

  The clock delay required for RGMII can be applied at the PHY side,
  using the at803x driver `phy-mode` setting through the DTS.
  Therefore, the Ethernet Configuration registers for GMAC0
  do not need the bits for RGMII delay on the MAC side.
  This is possible due to fixes in at803x driver
  since Linux 5.1 and 5.3

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2022-03-13 19:54:57 +01:00
Piotr Dymacz
9c335accfe ath79: add support for TP-Link Archer A9 v6
TP-Link Archer A9 v6 (FCCID: TE7A9V6) is an AC1900 Wave-2 gigabit home
router based on a combination of Qualcomm QCN5502 (most likely a 4x4:4
version of the QCA9563 WiSOC), QCA9984 and QCA8337N.

The vendor's firmware content reveals that the same device might be
available on the US market under name 'Archer C90 v6'. Due to lack of
access to such hardware, support introduced in this commit was tested
only on the EU version (sold under 'Archer A9 v6' name).

Based on the information on the PL version of the vendor website, this
device has been already phased out and is no longer available.

Specifications:

- Qualcomm QCN5502 (775 MHz)
- 128 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 5x Gbps Ethernet (Qualcomm QCA8337N over SGMII)
- Wi-Fi:
  - 802.11b/g/n on 2.4 GHz: Qualcomm QCN5502* in 4x4:4 mode
  - 802.11a/n/ac on 5 GHz: Qualcomm QCA9984 in 3x3:3 mode
  - 3x non-detachable, dual-band external antennas (~3.5 dBi for 5 GHz,
    ~2.2 dBi for 2.4 GHz, IPEX/U.FL connectors)
  - 1x internal PCB antenna for 2.4 GHz (~1.8 dBi)
- 1x USB 2.0 Type-A
- 11x LED (4x connected to QCA8337N, 7x connected to QCN5502)
- 2x button (reset, WPS)
- UART (4-pin, 2.54 mm pitch) header on PCB (not populated)
- 1x mechanical power switch
- 1x DC jack (12 V)

  *) unsupported due to missing support for QCN550x in ath9k

UART system serial console notice:

The RX signal of the main SOC's UART on this device is shared with the
WPS button's GPIO. The first-stage U-Boot by default disables the RX,
resulting in a non-functional UART input.
If you press and keep 'ENTER' on the serial console during early
boot-up, the first-stage U-Boot will enable RX input.

Vendor firmware allows password-less access to the system over serial.

Flash instruction (vendor GUI):

1. It is recommended to first upgrade vendor firmware to the latest
   version (1.1.1 Build 20210315 rel.40637 at the time of writing).
2. Use the 'factory' image directly in the vendor's GUI.

Flash instruction (TFTP based recovery in second-stage U-Boot):

1. Rename 'factory' image to 'ArcherA9v6_tp_recovery.bin'
2. Setup a TFTP server on your PC with IP 192.168.0.66/24.
3. Press and hold the reset button for ~5 sec while turning on power.
4. The device will download image, flash it and reboot.

Flash instruction (web based recovery in first-stage U-Boot):

1. Use 'CTRL+C' during power-up to enable CLI in first-stage U-Boot.
2. Connect a PC with IP set to 192.168.0.1 to one of the LAN ports.
3. Issue 'httpd' command and visit http://192.168.0.1 in browser.
4. Use the 'factory' image.

If you would like to restore vendor's firmware, follow one of the
recovery methods described above.

Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2022-02-27 16:54:55 +01:00
Piotr Dymacz
131671bc54 ath79: add support for ALFA Network Tube-2HQ
ALFA Network Tube-2HQ is a successor of the Tube-2H/P series (EOL) which
was based on the Atheros AR9331. The new version uses Qualcomm QCA9531.

Specifications:

- Qualcomm/Atheros QCA9531 v2
- 650/400/200 MHz (CPU/DDR/AHB)
- 64 or 128 MB of RAM (DDR2)
- 16+ MB of flash (SPI NOR)
- 1x 10/100 Mbps Ethernet with passive PoE input (24 V)
  (802.3at/af PoE support with optional module)
- 1T1R 2.4 GHz Wi-Fi with external PA (SE2623L, up to 27 dBm) and LNA
- 1x Type-N (male) antenna connector
- 6x LED (5x driven by GPIO)
- 1x button (reset)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- UART (4-pin, 2.00 mm pitch) header on PCB

Flash instruction:

You can use sysupgrade image directly in vendor firmware which is based
on LEDE/OpenWrt. Alternatively, you can use web recovery mode in U-Boot:

1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
   device, wait for first blink of all LEDs (indicates network setup),
   then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.

Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2022-02-27 16:54:54 +01:00
Sungbo Eo
3e3e78de11 ath79: utilize nvmem on Netgear EX7300 v2
mtd-mac-address should no longer be used after commit 5ae2e78639
("kernel: drop support for mtd-mac-address"). Convert it to nvmem-cells.

While at it, also convert OpenWrt's custom mtd-cal-data property and
userspace pre-calibration data extraction to the nvmem implementation.

Note: nvmem-cells in QCN5502 wmac has not been tested.

Fixes: c32008a37b ("ath79: add partial support for Netgear EX7300v2")
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
2022-02-20 13:45:06 +09:00
Daniel González Cabanelas
73ea763c0d ath79: Add support for Ubiquiti NanoBeam AC Gen1 XC
The Ubiquiti NanoBeam AC Gen1 XC (NBE-5AC-19) is an outdoor 802.11ac CPE
with a waterproof casing (ultrasonically welded) and bulb shaped.

Hardware:
 - SoC: Qualcomm Atheros QCA9558
 - RAM: 128 MB DDR2
 - Flash: 16 MB SPI NOR
 - Ethernet: 1x GbE, AR8033 phy connected via SGMII
 - PSU: 24 Vdc passive PoE
 - WiFi 5 GHz: Qualcomm Atheros QCA988X
 - Buttons: 1x reset
 - LEDs: 1x power, 1x Ethernet, 4x RSSI, all blue
 - Internal antenna: 19 dBi planar

Installation from stock airOS firmware:
 - Follow instructions for XC-type Ubiquiti devices on OpenWrt wiki at
   https://openwrt.org/toh/ubiquiti/common

Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com>
2022-02-19 13:10:01 +01:00
Wenli Looi
c32008a37b ath79: add partial support for Netgear EX7300v2
Hardware
--------
SoC: QCN5502
Flash: 16 MiB
RAM: 128 MiB
Ethernet: 1 gigabit port
Wireless No1: QCN5502 on-chip 2.4GHz 4x4
Wireless No2: QCA9984 pcie 5GHz 4x4
USB: none

Installation
------------
Flash the factory image using the stock web interface or TFTP the
factory image to the bootloader.

What works
----------
- LEDs
- Ethernet port
- 5GHz wifi (QCA9984 pcie)

What doesn't work
-----------------
- 2.4GHz wifi (QCN5502 on-chip)
  (I was not able to make this work, probably because ath9k requires
  some changes to support QCN5502.)

Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
2022-02-07 00:03:27 +01:00
Saiful Islam
43ec6d64bb ath79: add support for TP-Link TL-WR841HP v2
Specifications:
- AR9344 SoC, 8 MB nor flash, 64 MB DDR2 RAM
- 2x2 9dBi antenna, wifi 2.4Ghz 300Mbps
- 4x Ethernet LAN 10/100, 1x Ethernet WAN 10/100
- 1x WAN, 4x LAN, Wifi, PWR, WPS, SYSTEM Leds
- Reset/WPS button
- Serial UART at J4 onboard: 3.3v GND RX TX, 1152008N1

MAC addresses as verified by OEM firmware:

vendor   OpenWrt   address
LAN      eth0      label
WAN      eth1      label + 1
WLAN     phy0      label

The label MAC address was found in u-boot 0x1fc00.

Installation:
To install openwrt,
- set the device's SSID to each of the following lines,
  making sure to include the backticks.
- set the ssid and click save between each line.

`echo "httpd -k"> /tmp/s`
`echo "sleep 10">> /tmp/s`
`echo "httpd -r&">> /tmp/s`
`echo "sleep 10">> /tmp/s`
`echo "httpd -k">> /tmp/s`
`echo "sleep 10">> /tmp/s`
`echo "httpd -f">> /tmp/s`
`sh /tmp/s`

- Now, wait 60 sec.
- After the reboot sequence, the router may have fallen back to
  its default IP address with the default credentials (admin:admin).
- Log in to the web interface and go the the firmware upload page.
  Select "openwrt-ath79-generic-tplink_tl-wr841hp-v2-squashfs-factory.bin"
  and you're done : the system now accepts the openwrt.

Forum support topic:
https://forum.openwrt.org/t/support-for-tplink-tl-wr841hp-v2/69445/

Signed-off-by: Saiful Islam <si87868@gmail.com>
2022-02-07 00:03:27 +01:00
Sven Eckelmann
8143709c90 ath79: Add support for OpenMesh OM2P v1
Device specifications:
======================

* Qualcomm/Atheros AR7240 rev 2
* 350/350/175 MHz (CPU/DDR/AHB)
* 32 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 1T1R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
  - eth0
    + 18-24V passive POE (mode B)
    + used as WAN interface
  - eth1
    + builtin switch port 4
    + used as LAN interface
* 12-24V 1A DC
* external antenna

The device itself requires the mtdparts from the uboot arguments to
properly boot the flashed image and to support dual-boot (primary +
recovery image). Unfortunately, the name of the mtd device in mtdparts is
still using the legacy name "ar7240-nor0" which must be supplied using the
Linux-specfic DT parameter linux,mtd-name to overwrite the generic name
"spi0.0".

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to the
device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
2022-01-16 21:42:19 +01:00
Sven Eckelmann
1699c1dc7f ath79: Add support for OpenMesh OM5P-AC v2
Device specifications:
======================

* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/200 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2T2R 2.4 GHz Wi-Fi (11n)
* 2T2R 5 GHz Wi-Fi (11ac)
* 4x GPIO-LEDs (3x wifi, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* TI tmp423 (package kmod-hwmon-tmp421) for temperature monitoring
* 2x ethernet
  - eth0
    + AR8035 ethernet PHY (RGMII)
    + 10/100/1000 Mbps Ethernet
    + 802.3af POE
    + used as LAN interface
  - eth1
    + AR8031 ethernet PHY (RGMII)
    + 10/100/1000 Mbps Ethernet
    + 18-24V passive POE (mode B)
    + used as WAN interface
* 12-24V 1A DC
* internal antennas

This device support is based on the partially working stub from commit
53c474abbd ("ath79: add new OF only target for QCA MIPS silicon").

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to the
device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
2022-01-16 20:51:14 +01:00
Tamas Balogh
872b65ecc8 ath79: patch Asus RP-AC66 clean up and fix for sysupgrade image
- clean up leftovers regarding MAC configure in dts
- fix alphabetical order in caldata
- IMAGE_SIZE for sysupgrade image

Signed-off-by: Tamas Balogh <tamasbalogh@hotmail.com>
2022-01-15 17:41:19 +01:00
Sven Eckelmann
97f5617259 ath79: Add support for OpenMesh OM5P-AC v1
Device specifications:
======================

* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2T2R 2.4 GHz Wi-Fi (11n)
* 2T2R 5 GHz Wi-Fi (11ac)
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* TI tmp423 (package kmod-hwmon-tmp421) for temperature monitoring
* 2x ethernet
  - eth0
    + AR8035 ethernet PHY (RGMII)
    + 10/100/1000 Mbps Ethernet
    + 802.3af POE
    + used as LAN interface
  - eth1
    + AR8035 ethernet PHY (SGMII)
    + 10/100/1000 Mbps Ethernet
    + 18-24V passive POE (mode B)
    + used as WAN interface
* 12-24V 1A DC
* internal antennas

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to the
device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
2022-01-09 21:12:28 +01:00
Sven Eckelmann
72ef594550 ath79: Add support for OpenMesh OM5P-AN
Device specifications:
======================

* Qualcomm/Atheros AR9344 rev 2
* 560/450/225 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 1T1R 2.4 GHz Wi-Fi
* 2T2R 5 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* TI tmp423 (package kmod-hwmon-tmp421) for temperature monitoring
* 2x ethernet
  - eth0
    + AR8035 ethernet PHY
    + 10/100/1000 Mbps Ethernet
    + 802.3af POE
    + used as LAN interface
  - eth1
    + 10/100 Mbps Ethernet
    + builtin switch port 1
    + 18-24V passive POE (mode B)
    + used as WAN interface
* 12-24V 1A DC
* internal antennas

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to the
device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
2022-01-09 21:12:28 +01:00
Tamas Balogh
b29f4cf34c ath79: add support for ASUS RP-AC66
Asus RP-AC66 Repeater

Hardware specifications:
Board: AP152
SoC: QCA9563
DRAM: 64MB DDR2
Flash: 25l128 16MB SPI-NOR
LAN/WAN: 1x1000M QCA8033
WiFi 5GHz: QCA9880
Clocks: CPU:775.000MHz, DDR:650.000MHz, AHB:258.333MHz, Ref:25.000MHz

MAC addresses as verified by OEM firmware:
use            address   source
Lan/Wan   *:24         art 0x1002 (label)
2G             *:24         art 0x1002
5G             *:26         art 0x5006

Installation:

Asus windows recovery tool:
 - install the Asus firmware restoration utility
 - unplug the router, hold the reset button while powering it on
 - release when the power LED flashes slowly
 - specify a static IP on your computer:
     IP address: 192.168.1.75
     Subnet mask 255.255.255.0
 - Start the Asus firmware restoration utility, specify the factory image
    and press upload
 - Do not power off the device after OpenWrt has booted until the LED flashing.

TFTP Recovery method:
 - set computer to a static ip, 192.168.1.75
 - connect computer to the LAN 1 port of the router
 - hold the reset button while powering on the router for a few seconds
 - send firmware image using a tftp client; i.e from linux:
 $ tftp
 tftp> binary
 tftp> connect 192.168.1.1
 tftp> put factory.bin
 tftp> quit

Signed-off-by: Tamas Balogh <tamasbalogh@hotmail.com>
2022-01-09 20:32:41 +01:00
Ryan Mounce
35aecc9d4a ath79: add support for WD My Net N600
SoC: AR9344
RAM: 128MB
Flash: 16MiB SPI NOR
5GHz WiFi: AR9382 PCIe 2x2:2 802.11n
2.4GHz WiFi: AR9344 (SoC) AHB 2x2:2 802.11n

5x Fast ethernet via SoC switch (green LEDs)
1x USB 2.0
4x front LEDs from SoC GPIO
1x front WPS button from SoC GPIO
1x bottom reset button from SoC GPIO

UART header JP1, 115200 no parity 1 stop
TX
GND
VCC
(N/P)
RX

Flash factory image via "emergency room" recovery:
- Configure your computer with a static IP 192.168.1.123/24
- Connect to LAN port on the N600 switch
- Hold reset putton
- Power on, holding reset until the power LED blinks slowly
- Visit http://192.168.1.1/ and upload OpenWrt factory image
- Wait at least 5 minutes for flashing, reboot and key generation
- Visit http://192.168.1.1/ (OpenWrt LuCI) and upload OpenWrt sysupgrade image

Signed-off-by: Ryan Mounce <ryan@mounce.com.au>
[dt leds preparations]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2021-12-11 00:50:02 +01:00
Olivier Valentin
7853453950 ath79: add support for jjPlus JWAP230
The jjPlus JWAP230 is an access point board built around the QCA9558,
with built-in 2.4GHz 3x3 N WiFi (28dBm). It can be expanded with 2
mini-PCIe boards, and has an USB2 root port.

Specifications:
- SOC: Qualcomm Atheros QCA9558
- CPU: 720MHz
- H/W switch: QCA8327 rev 2
- Flash: 16 MiB SPI NOR (en25qh128)
- RAM: 128 MiB DDR2
- WLAN: AR9550 built-in SoC bgn 3T3R (ath9k)
- PCI: 2x mini-PCIe (optional 5V)
- LEDs: 6x LEDs (3 are currently available)
- Button: 1x Reset (not yet defined)
- USB2:
  - 1x Type A root port
  - 1x combined mini-PCIe
- Ethernet:
  - 2x 10/100/1000 (1x PoE 802.3af (36-57 V))

Notes:
 The device used to be supported in the ar71xx target.
 For upgrades: Please use "sysupgrade --force -n <image>".
 This will restore the device back to OpenWrt defaults!

MAC address assignment:
    use   source
    LAN   art 0x0
    WAN   art 0x6
    WLAN  art 0x1002 (as part of the calibration data)

Flash instructions:
- install from u-boot with tftp (requires serial access)
  > setenv ipaddr a.b.c.d
  > setenv serverip e.f.g.h
  > tftp 0x80060000 \
      openwrt-ath79-generic-jjplus_jwap230-squashfs-sysupgrade.bin
  > erase 0x9f050000 +${filesize}
  > cp.b $fileaddr 0x9f050000 $filesize
  > setenv bootcmd bootm 0x9f050000
  > saveenv

Signed-off-by: Olivier Valentin <valentio@free.fr>
[Added DT-Leds (based on ar71xx), Added more notes about sysupgrade,
fixed "qca9550" to match SoC in commit and dts file name]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2021-12-11 00:50:02 +01:00
Sander Vanheule
0f6b6aab2b ath79: add support for TP-Link EAP225 v1
TP-Link EAP225 v1 is an AC1200 (802.11ac Wave-1) ceiling mount access point.

Device specifications:
* SoC: QCA9563 @ 775MHz
* RAM: 128MiB DDR2
* Flash: 16MiB SPI-NOR
* Wireless 2.4GHz (SoC): b/g/n, 2x2
* Wireless 5Ghz (QCA9882): a/n/ac, 2x2
* Ethernet (AR8033): 1× 1GbE, 802.3at PoE

Flashing instructions:
* Ensure the device is upgraded to firmware v1.4.0
* Exploit the user management page in the web interface to start telnetd
  by changing the username to `;/usr/sbin/telnetd -l/bin/sh&`.
* Immediately change the malformed username back to something valid
  (e.g. 'admin') to make ssh work again.
* Use the root shell via telnet to make /tmp world writeable (chmod 777)
* Extract /usr/bin/uclited from the device via ssh and apply the binary
  patch listed below. The patch is required to prevent `uclited -u` in
  the last step from crashing.
* Copy the patched uclited binary back to the device at /tmp/uclited
  (via ssh)
* Upload the factory image to /tmp/upgrade.bin (via ssh)
* Run `chmod +x /tmp/uclited && /tmp/uclited -u` to install OpenWrt.

uclited patching:
    --- xxd uclited
    +++ xxd uclited-patched
    @@ -53811,7 +53811,7 @@
     000d2330: 8c44 0000 0320 f809 0000 0000 8fbc 0010  .D... ..........
     000d2340: 8fa6 0a4c 02c0 2821 8f82 87c4 0000 0000  ...L..(!........
    -000d2350: 8c44 0000 0c13 461c 27a7 0018 8fbc 0010  .D....F.'.......
    +000d2350: 8c44 0000 2402 0000 0000 0000 8fbc 0010  .D..$...........
     000d2360: 1040 001d 0000 1821 8f99 8378 3c04 0058  .@.....!...x<..X
     000d2370: 3c05 0056 2484 ad68 24a5 9f00 0320 f809  <..V$..h$.... ..

To make sure the correct file is patched, the following MD5 checksums
should match the unpatched and patched files:
    4bd74183c23859c897ed77e8566b84de  uclited
    4107104024a2e0aeaf6395ed30adccae  uclited-patched

Debricking:
* Serial port can be soldered on unpopulated 4-pin header
  (1: TXD, 2: RXD, 3: GND, 4: VCC)
    * Bridge unpopulated resistors running from pins 1 (TXD) and 2 (RXD).
      Do NOT bridge the pull-down for pin 2, running parallel to the
      header.
    * Use 3.3V, 115200 baud, 8n1
* Interrupt bootloader by holding CTRL+B during boot
* tftp initramfs to flash via the LuCI web interface
    setenv ipaddr 192.168.1.1 # default, change as required
    setenv serverip 192.168.1.10 # default, change as required
    tftp 0x80800000 initramfs.bin
    bootelf $fileaddr

Tested by forum user KernelMaker.

Link: https://forum.openwrt.org/t/eap225-v1-firmware/87116
Signed-off-by: Sander Vanheule <sander@svanheule.net>
2021-12-05 18:49:14 +01:00
Catrinel Catrinescu
24d455d1d0 ath79: add Embedded Wireless Balin Platform
Add the Embedded Wireless "Balin" platform, it is in ar71xx too
 SoC: QCA AR9344 or AR9350
 RAM: DDR2-RAM 64MBytes
 Flash: SPI-NOR 16MBytes
 WLAN: 2 x 2 MIMO 2.4 & 5 GHz IEEE802.11 a/b/g/n
 Ethernet: 3 x 10/100 Mb/s
 USB: 1 x USB2.0 Host/Device bootstrap-pin at power-up
 PCIe: MiniPCIe - 1 x lane PCIe 1.2
 Button: 1 x Reset-Button
 UART: 1 x Normal, 1 x High-Speed
 JTAG: 1 x EJTAG
 LED: 1 x Green Power/Status LED
 GPIO: 10 x Input/Output multiplexed

The module comes already with the current vanilla OpenWrt firmware.
To update, use "sysupgrade -n --force <image>" image directly in
vendor firmware. This resets the existing configurations back to
default!

Signed-off-by: Catrinel Catrinescu <cc@80211.de>
[indent, led function+color properties, fix partition unit-address,
re-enable pcie port, mention button+led in commit message]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2021-12-03 12:30:08 +01:00
Christian Lamparter
297bceeecf ath79: convert TP-Link Archer C7v1/2 Wifis to nvmem-cells
For v2, both ath9k (2.4GHz Wifi) and ath10k (5 GHz) driver now
pull the (pre-)calibration data from the nvmem subsystem. v1
is slightly different as only the ath9k Wifi is supported.

This allows us to move the userspace caldata extraction
and mac-address patching for the 5GHZ ath10k supported
wifi into the device-tree definition of the device.

ath9k's nodes are also changed over to use nvmem-cells
over OpenWrt's custom mtd-cal-data property.

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2021-11-28 01:13:08 +01:00
Sebastian Schaper
be88f416db ath79: move cal-data extraction to dts for DAP-2695
This device can be merged with the existing dtsi, which declares
the location of ath9k cal-data via devicetree, correcting the 2.4G
mac address in `10_fix_wifi_mac` rather than `10-ath9k-eeprom`.

To make these changes more visible, apply before merging with dtsi.

Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2021-11-20 21:08:25 +01:00
Christian Lamparter
217571b6ab ath79: WNDR3700/3800/MAC: utilize nvmem for caldata fetching
converts the still popular WNDR3700 Series to fetch the
caldata through nvmem. As the "MAC with NVMEM" has shown,
there could pitfalls along the way.

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2021-11-06 22:18:45 +01:00
Nicolò Veronese
3f96743459 ath79: fix UBNT Aircube AC gpios
GPIOs on the Aircube AC are wrong:
 - Reset GPIO moved from 17 to 12
 - PoE Pass Through GPIO for Aircube AC is 3

Fixes: 491ae3357e ("ath79: add support for Ubiquiti airCube AC")

Signed-off-by: Nicolò Veronese <nicveronese@gmail.com>
2021-11-01 00:43:18 +01:00
Shiji Yang
184dc6e32a ath79: add support for Letv LBA-047-CH
Specifications:
SOC: QCA9531 650 MHz
ROM: 16 MiB Flash (Winbond W25Q128FV)
RAM: 128 MiB DDR2 (Winbond W971GG6SB)
LAN: 10/100M *2
WAN: 10/100M *1
LED: BGR color *1

Mac address:
label	C8:0E:77:xx:xx:68	art@0x0
lan	C8:0E:77:xx:xx:62	art@0x6
wan	C8:0E:77:xx:xx:68	art@0x0    (same as the label)
wlan	C8:0E:77:xx:xx:B2	art@0x1002 (load automatically)

TFTP installation:
* Set local IP to 192.168.67.100 and open tftpd64, link lan
  port to computer.
  Rename "xxxx-factory.bin" to
  "openwrt-ar71xx-generic-ap147-16M-rootfs-squashfs.bin".
* Make sure firmware file is in the tftpd's directory, push
  reset button and plug in, hold it for 5 seconds, and then
  it will download firmware from tftp server automatically.

More information:
* This device boot from flash@0xe80000 so we need a okli
  loader to deal with small kernel partition issue. In order
  to make full use of the storage space, connect a part of the
  previous kernel partition to the firmware.

  Stock                          Modify
  0x000000-0x040000(u-boot)      0x000000-0x040000(u-boot)
  0x040000-0x050000(u-boot-env)  0x000000-0x050000(u-boot-env)
  0x050000-0xe80000(rootfs)      0x050000-0xe80000(firmware part1)
  0xe80000-0xff0000(kernel)      0xe80000-0xe90000(okli-loader)
                                 0xe90000-0xff0000(firmware part2)
  0xff0000-0x1000000(art)        0xff0000-0x1000000(art)

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2021-11-01 00:15:09 +01:00
Andrew Cameron
ac03e24635 ath79: add support for TP-Link CPE710-v1
TP-Link CPE710-v1 is an outdoor wireless CPE for 5 GHz with
one Ethernet port based on the AP152 reference board

Specifications:
- SoC: QCA9563-AL3A MIPS 74kc @ 775MHz, AHB @ 258MHz
- RAM: 128MiB DDR2 @ 650MHz
- Flash: 16MiB SPI NOR Based on the GD25Q128
- Wi-Fi 5Ghz: ath10k chip (802.11ac for up to 867Mbps on 5GHz wireless
  data rate) Based on the QCA9896
- Ethernet: one 1GbE port
- 23dBi high-gain directional 2×2 MIMO antenna and a dedicated metal
  reflector
- Power, LAN, WLAN5G Blue LEDs
- 3x Blue LEDs

Flashing instructions:
Flash factory image through stock firmware WEB UI or through TFTP
To get to TFTP recovery just hold reset button while powering on for
around 30-40 seconds and release.
Rename factory image to recovery.bin
Stock TFTP server IP:192.168.0.100
Stock device TFTP address:192.168.0.254

Signed-off-by: Andrew Cameron <apcameron@softhome.net>
[convert to nvmem, fix MAC assignment in 11-ath10k-caldata]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-09-25 19:28:54 +02:00
Robert Balas
baacdd53df ath79: add support for TP-Link TL-WA1201 v2
This device is a wireless access point working on the 2.4 GHz and 5 GHz
band, based on Qualcomm/Atheros QCA9563 + QCA9886.

Specification
- 775 MHz CPU
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- QCA9563: 2.4 GHz 3x3
- QCA9886: 5 GHz
- AR8033: 1x 1 Gbs Ethernet
- 4x LED, WPS factory reset and power button
- bare UART on PCB (accessible through testpoints)

Methods for Flashing:
- Apply factory image in OEM firmware web-gui. Wait a minute after the
  progress bar completes and restart the device.
- Sysupgrade on top of existing OpenWRT image
- Solder wires onto UART testpoints and attach a terminal.
  Boot the device and press enter to enter u-boot's menu. Then issue the
  following commands
  1. setenv serverip your-server-ip
     setenv ipaddr your-device-ip
  2. tftp 0x80060000 openwrt-squashfs.bin (Rembember output of size in
    hex, henceforth "sizeinhex")
  3. erase 0x9f030000 +"sizeinhex"
  4. cp.b 0x80060000 0x9f030000 0x"sizeinhex"
  5. reboot

Recover:
- U-boot serial console

Signed-off-by: Robert Balas <balasr@iis.ee.ethz.ch>
[convert to nvmem]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-09-05 23:52:35 +02:00
Jan-Niklas Burfeind
d98738b5c1 ath79: add support for onion omega
The Onion Omega is a hardware development platform with built-in WiFi.

https://onioniot.github.io/wiki/

Specifications:
 - QCA9331 @ 400 MHz (MIPS 24Kc Big-Endian Processor)
 - 64MB of DDR2 RAM running at 400 MHz
 - 16MB of on-board flash storage
 - Support for USB 2.0
 - Support for Ethernet at 100 Mbps
 - 802.11b/g/n WiFi at 150 Mbps
 - 18 digital GPIOs
 - A single Serial UART
 - Support for SPI
 - Support for I2S

Flash instructions:
The device is running OpenWrt upon release using the ar71xx target.
Both a sysupgrade
and uploading the factory image using u-boots web-UI do work fine.

Depending on the ssh client, it might be necessary to enable outdated
KeyExchange methods e.g. in the clients ssh-config:

Host 192.168.1.1
        KexAlgorithms +diffie-hellman-group1-sha1

The stock credentials are: root onioneer

For u-boots web-UI manually configure `192.168.1.2/24` on your computer,
connect to `192.168.1.1`.

MAC addresses as verified by OEM firmware:
2G       phy0      label
LAN      eth0      label - 1

LAN is only available in combination with an optional expansion dock.

Based on vendor acked commit:
commit 5cd49bb067 ("ar71xx: add support for Onion Omega")

Partly reverts:
commit fc553c7e4c ("ath79: drop unused/incomplete dts")

Signed-off-by: Jan-Niklas Burfeind <git@aiyionpri.me>
2021-08-26 15:07:18 +02:00
Romain Mahoux
e2d08084c3 ath79: add support for Compex WPJ558 (16M)
Specifications:
- SoC: QCA9558
- DRAM: 128MB DDR2
- Flash: 16MB SPI-NOR
- Wireless: on-board abgn 2×2 2.4GHz radio
- Ethernet: 2x 10/100/1000 Mbps (1x 802.11af PoE)
- miniPCIe slot

Flash instruction:
- From u-boot

tftpboot 0x80500000 openwrt-ath79-generic-compex_wpj558-16m-squashfs-sysupgrade.bin
erase 0x9f030000 +$filesize
cp.b $fileaddr 0x9f030000 $filesize
boot

- From cpximg loader

The cpximg loader can be started either by holding the reset button
during power up. Once it's running, a TFTP-server under 192.168.1.1 will accept
the image appropriate for the board revision that is etched on the board.

For example, if the board is labelled '6A07':

tftp -v -m binary 192.168.1.1 -c put openwrt-ath79-generic-compex_wpj558-16m-squashfs-cpximg-6a07.bin

Signed-off-by: Romain Mahoux <romain@mahoux.fr>
[convert to nvmem, remove redundant lan_mac in 02_network]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-08-25 01:42:17 +02:00
Zoltan HERPAI
98eb95dd00 ath79: add support for Atheros DB120 reference board
Atheros DB120 reference board.

Specifications:

SoC:    QCA9344
DRAM:   128Mb DDR2
Flash:  8Mb SPI-NOR, 128Mb NAND flash
Switch: 5x 10/100Mbps via AR8229 switch (integrated into SoC),
        5x 10/100/1000Mbps via QCA8237 via RGMII
WLAN:   AR9300 (SoC, 2.4G+5G) + AR9340 (PCIe, 5G-only)
USB:    1x 2.0
UART:   standard QCA UART header
JTAG:   yes
Button: 1x reset
LEDs:   a lot
Slots:  2x mPCIe + 1x mini-PCI, but using them requires
        additional undocumented changes.
Misc:   The board allows to boot off NAND, and there is
        I2S audio support as well - also requiring
        additional undocumented changes.

Installation:

1. Original bootloader

   Connect the board to ethernet
   Set up a server with an IP address of 192.168.1.10
   Make the openwrt-ath79-generic-atheros_db120-squashfs-factory.bin
   available via TFTP

   tftpboot 0x80060000 openwrt-ath79-generic-atheros_db120-squashfs-factory.bin
   erase 0x9f050000 +$filesize
   cp.b $fileaddr 0x9f050000 $filesize

2. pepe2k's u-boot_mod

   Connect the board to ethernet
   Set up a server with an IP address of 192.168.1.10
   Make the openwrt-ath79-generic-atheros_db120-squashfs-factory.bin
   available via TFTP, as "firmware.bin"

   run fw_upg

   Reboot the board.

Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
[explicit factory recipe in generic.mk, sorting in 10-ath9k-eeprom,
 convert to nvmem, use fwconcat* names in DTS, remove unneeded DT
 labels, remove redundant uart node]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-08-22 23:02:08 +02:00
Russell Senior
61b49cd3f8 ath79: add support for Ubiquiti PowerBeam M2 (XW)
This patch adds support for the Ubiquiti PowerBeam M2 (XW), e.g. PBE-M2-400,
a 802.11n wireless with a feed+dish form factor. This device was previously
supported by the ar71xx loco-m-xw firmware.

Specifications:
 - Atheros AR9342 SoC
 - 64 MB RAM
 - 8 MB SPI flash
 - 1x 10/100 Mbps Ethernet port, 24 Vdc PoE-in
 - Power and LAN green LEDs
 - 4x RSSI LEDs (red, orange, green, green)
 - UART (115200 8N1)

Flashing via stock GUI:
 - Downgrade to AirOS v5.5.x (latest available is 5.5.10-u2) first (see
   https://openwrt.org/toh/ubiquiti/powerbeam installation instructions)
 - Upload the factory image via AirOS web GUI.

Flashing via TFTP:
 - Use a pointy tool (e.g., unbent paperclip) to keep the
   reset button pressed.
 - Power on the device (keep reset button pressed).
 - Keep pressing until LEDs flash alternatively LED1+LED3 =>
   LED2+LED4 => LED1+LED3, etc.
 - Release reset button.
 - The device starts a TFTP server at 192.168.1.20.
 - Set a static IP on the computer (e.g., 192.168.1.21/24).
 - Upload via tftp the factory image:
    $ tftp 192.168.1.20
    tftp> bin
    tftp> trace
    tftp> put openwrt-ath79-generic-ubnt_powerbeam-m2-xw-squashfs-factory.bin

WARNING: so far, no non-destructive method has been discovered for
opening the enclosure to reach the serial console. Internal photos
are available here: https://fcc.io/SWX-NBM2HP

Signed-off-by: Russell Senior <russell@personaltelco.net>
2021-08-22 22:41:52 +02:00
Russell Senior
96db7d2a73 ath79: rename Ubiquiti PowerBeam M (XW) to PowerBeam M5 (XW)
The commit [1] added support for Ubiquiti PowerBeam M (XW), tested
on the PBE-M5-400. But, it turns out the PBE-M2-400 has a different
ethernet configuration, so make the support specific to the m5 version
in anticipation of adding specific support for the m2 in a separate
commit.

[1] 12eb5b2384 ("ath79: add support for Ubiquiti PowerBeam M (XW)")

Signed-off-by: Russell Senior <russell@personaltelco.net>
[fix model name in DTS, format commit reference in commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-08-22 22:41:41 +02:00
John Marrett
252466a0ce ath79: add support for GL.iNet GL-X300B
The GL-X300B is a industrial 4G LTE router based on the Qualcomm
QCA9531 SoC.

Specifications:
 - Qualcomm QCA9531 @ 650 MHz
 - 128 MB of RAM
 - 16 MB of SPI NOR FLASH
 - 2x 10/100 Mbps Ethernet
 - 2.4GHz 802.11b/g/n
 - 1x USB 2.0 (vbus driven by GPIO)
 - 4x LED, driven by GPIO
 - 1x button (reset)
 - 1x mini pci-e slot (vcc driven by GPIO)
 - RS-485 Serial Port (untested)

Flash instructions:

This firmware can be flashed using either sysupgrade from the GL.iNet
firmware or the recovery console as follows:

 - Press and hold the reset button
 - Connect power to the router, wait five seconds
 - Manually configure 192.168.1.2/24 on your computer, connect to
   192.168.1.1
 - Upload the firmware image using the web interface

RS-485 serial port is untested and may depend on the following commit in
the GL.iNet repo:

202e83a32a

MAC addresses as verified by OEM firmware:

vendor   OpenWrt   address
WAN      eth0      label
LAN      eth1      label + 1
2g       phy0      label + 2

The label MAC address was found in the art partition at 0x0

Based on vendor commit:

16c5708b20

Signed-off-by: John Marrett <johnf@zioncluster.ca>
2021-08-05 01:48:17 +02:00
Vincent Wiemann
55b4b36552 ath79: add support for Joy-IT JT-OR750i
Specifications:
 * QCA9531, 16 MiB flash (Winbond W25Q128JVSQ), 128 MiB RAM
 * 802.11n 2T2R (external antennas)
 * QCA9887, 802.11ac 1T1R (connected with diplexer to one of the antennas)
 * 3x 10/100 LAN, 1x 10/100 WAN
 * UART header with pinout printed on PCB

Installation:
 * The device comes with a bootloader installed only
 * The bootloader offers DHCP and is reachable at http://10.123.123.1
 * Accept the agreement and flash sysupgrade.bin
 * Use Firefox if flashing does not work

TFTP recovery with static IP:
 * Rename sysupgrade.bin to jt-or750i_firmware.bin
 * Offer it via TFTP server at 192.168.0.66
 * Keep the reset button pressed for 4 seconds after connecting power

TFTP recovery with dynamic IP:
 * Rename sysupgrade.bin to jt-or750i_firmware.bin
 * Offer it via TFTP server with a DHCP server running at the same address
 * Keep the reset button pressed for 6 seconds after connecting power

Co-authored-by: Sebastian Schaper <openwrt@sebastianschaper.net>
Signed-off-by: Vincent Wiemann <vincent.wiemann@ironai.com>
2021-07-28 13:48:15 +02:00
Roberto Valentini
af56075a8f ath79: add support for TP-Link RE455 v1
TP-Link RE455 v1 is a dual band router/range-extender based on
Qualcomm/Atheros QCA9563 + QCA9880.

This device is nearly identical to RE450 v3

Specification:

- 775 MHz CPU
- 64 MB of RAM (DDR2)
- 8 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 3T3R 5 GHz
- 1x 10/100/1000 Mbps Ethernet (AR8033 PHY)
- 7x LED, 4x button
- UART header on PCB[1]

Flash instruction:
Apply factory image in OEM firmware web-gui.

[1] Didn't work, probably need to short unpopulated resistor R64
    and R69 as RE450v3

Signed-off-by: Roberto Valentini <valantin89@gmail.com>
2021-07-11 16:58:12 +02:00
Petr Štetiar
bb2a9af6f1 ath79: base-files: fix broken network config
Fix bash syntax error introduced in commit cce2e8db56 ("ath79: add
support for TP-Link TL-WR941HP v1") which resulted in broken default
network configuration.

 In target/linux/ath79/generic/base-files/etc/board.d/02_network line 402:
	tplink,tl-wr842n-v2)\
        ^-- SC1073: Couldn't parse this case item. Fix to allow more checks.

References: https://gitlab.com/ynezz/openwrt-device-runtime-testing/-/jobs/1398837698/artifacts/file/cram-result-archer-c7-v5-initramfs.txt
Fixes: cce2e8db56 ("ath79: add support for TP-Link TL-WR941HP v1")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2021-07-05 08:53:38 +02:00
Evgeniy Isaev
6c148116f7 ath79: add support for Xiaomi AIoT Router AC2350
Device specifications
* SoC: QCA9563 @ 775MHz (MIPS 74Kc)
* RAM: 128MiB DDR2
* Flash: 16MiB SPI-NOR (EN25QH128)
* Wireless 2.4GHz (SoC): b/g/n, 3x3
* Wireless 5Ghz (QCA9988): a/n/ac, 4x4 MU-MIMO
* IoT Wireless 2.4GHz (QCA6006): currently unusable
* Ethernet (AR8327): 3 LAN × 1GbE, 1 WAN × 1GbE
* LEDs: Internet (blue/orange), System (blue/orange)
* Buttons: Reset
* UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1)
* Power: 12VDC, 1,5A

MAC addresses map (like in OEM firmware)
  art@0x0     88:C3:97:*:57  wan/label
  art@0x1002  88:C3:97:*:2D  lan/wlan2g
  art@0x5006  88:C3:97:*:2C  wlan5g

Obtain SSH Access
1. Download and flash the firmware version 1.3.8 (China).
2. Login to the router web interface and get the value of `stok=` from the
   URL
3. Open a new tab and go to the following URL (replace <STOK> with the stok
   value gained above; line breaks are only for easier handling, please put
   together all four lines into a single URL without any spaces):
     http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev
       ?bssid=any&user_id=any&ssid=-h%0Anvram%20set%20ssh_en%3D1%0Anvram%20commit
       %0Ased%20-i%20%27s%2Fchannel%3D.%2A%2Fchannel%3D%5C%5C%22debug%5C%5C%22%2F
       g%27%20%2Fetc%2Finit.d%2Fdropbear%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A
4. Wait 30-60 seconds (this is the time required to generate keys for the
   SSH server on the router).

Create Full Backup
1. Obtain SSH Access.
2. Create backup of all flash (on router):
    dd if=/dev/mtd0 of=/tmp/ALL.backup
3. Copy backup to PC (on PC):
    scp root@192.168.31.1:/tmp/ALL.backup ./
Tip: backup of the original firmware, taken three times, increases the
chances of recovery :)

Calculate The Password
* Locally using shell (replace "12345/E0QM98765" with your router's serial
  number):
  On Linux
    printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | \
    md5sum - | head -c8 && echo
  On macOS
    printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | \
    md5 | head -c8
* Locally using python script (replace "12345/E0QM98765" with your
  router's serial number):
    wget https://raw.githubusercontent.com/eisaev/ax3600-files/master/scripts/calc_passwd.py
    python3.7 -c 'from calc_passwd import calc_passwd; print(calc_passwd("12345/E0QM98765"))'
* Online
    https://www.oxygen7.cn/miwifi/

Debricking (lite)
If you have a healthy bootloader, you can use recovery via TFTP using
programs like TinyPXE on Windows or dnsmasq on Linux. To switch the router
to TFTP recovery mode, hold down the reset button, connect the power
supply, and release the button after about 10 seconds. The router must be
connected directly to the PC via the LAN port.

Debricking
You will need a full dump of your flash, a CH341 programmer, and a clip
for in-circuit programming.

Install OpenWRT
1. Obtain SSH Access.
2. Create script (on router):
    echo '#!/bin/sh' > /tmp/flash_fw.sh
    echo >> /tmp/flash_fw.sh
    echo '. /bin/boardupgrade.sh' >> /tmp/flash_fw.sh
    echo >> /tmp/flash_fw.sh
    echo 'board_prepare_upgrade' >> /tmp/flash_fw.sh
    echo 'mtd erase rootfs_data' >> /tmp/flash_fw.sh
    echo 'mtd write /tmp/openwrt.bin firmware' >> /tmp/flash_fw.sh
    echo 'sleep 3' >> /tmp/flash_fw.sh
    echo 'reboot' >> /tmp/flash_fw.sh
    echo >> /tmp/flash_fw.sh
    chmod +x /tmp/flash_fw.sh
3. Copy `openwrt-ath79-generic-xiaomi_aiot-ac2350-squashfs-sysupgrade.bin`
   to the router (on PC):
    scp openwrt-ath79-generic-xiaomi_aiot-ac2350-squashfs-sysupgrade.bin \
    root@192.168.31.1:/tmp/openwrt.bin
4. Flash OpenWRT (on router):
    /bin/ash /tmp/flash_fw.sh &
5. SSH connection will be interrupted - this is normal.
6. Wait for the indicator to turn blue.

Signed-off-by: Evgeniy Isaev <isaev.evgeniy@gmail.com>
[improve commit message formatting slightly]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-07-05 00:28:04 +02:00
Diogenes Rengo
cce2e8db56 ath79: add support for TP-Link TL-WR941HP v1
Specifications:
    SOC:        Qualcomm Atheros TP9343 (750 MHz)
    Flash:      8 Mb (GigaDevice GD25Q64CSIG)
    RAM:        64 Mb (Zentel A3R12E40DBF-8E)
    Serial:     yes, 4-pin header
    Wlan:       Qualcomm Atheros TP9343, antenna: MIM0 3x3:3 RP-SMA
                3 x 2.4GHz power amp module Skyworks (SiGe) SE2576L
    Ethernet:   Qualcomm Atheros TP9343
    Lan speed:  100M ports: 4
    Lan speed:  100M ports: 1
    Other info: same case, ram and flash that TP-Link TL-WR841HP,
                different SOC

    https://forum.openwrt.org/t/adding-device-support-tp-link-wr941hp/

Label MAC addresses based on vendor firmware:
    LAN   *:ee  label
    WAN   *:ef  label +1
    WLAN  *:ee  label

    The label MAC address found in "config" partition at 0x8

Flash instruction:
    Upload the generated factory firmware on web interface.

Signed-off-by: Diogenes Rengo <rengocbx250@gmail.com>
[remove various whitespace issues, squash commits, use short 0x0]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-07-04 18:07:35 +02:00
Russell Senior
12eb5b2384 ath79: add support for Ubiquiti PowerBeam M (XW)
This patch adds support for the Ubiquiti PowerBeam M (XW), e.g. PBE-M5-400,
a 802.11n wireless with a feed+dish form factor. This device was previously
supported by the ar71xx loco-m-xw firmware.

Specifications:
 - Atheros AR9342 SoC
 - 64 MB RAM
 - 8 MB SPI flash
 - 1x 10/100 Mbps Ethernet port, 24 Vdc PoE-in
 - Power and LAN green LEDs
 - 4x RSSI LEDs (red, orange, green, green)
 - UART (115200 8N1)

Flashing via stock GUI:
 - Downgrade to AirOS v5.5.x (latest available is 5.5.10-u2) first (see
   https://openwrt.org/toh/ubiquiti/powerbeam installation instructions)
 - Upload the factory image via AirOS web GUI.

Flashing via TFTP:
 - Use a pointy tool (e.g., unbent paperclip) to keep the
   reset button pressed.
 - Power on the device (keep reset button pressed).
 - Keep pressing until LEDs flash alternatively LED1+LED3 =>
   LED2+LED4 => LED1+LED3, etc.
 - Release reset button.
 - The device starts a TFTP server at 192.168.1.20.
 - Set a static IP on the computer (e.g., 192.168.1.21/24).
 - Upload via tftp the factory image:
    $ tftp 192.168.1.20
    tftp> bin
    tftp> trace
    tftp> put openwrt-ath79-generic-xxxxx-ubnt_powerbeam-m-xw-squashfs-factory.bin

WARNING: so far, no non-destructive method has been discovered for
opening the enclosure to reach the serial console. Internal photos
are available here: https://fcc.io/SWX-NBM5HP

Signed-off-by: Russell Senior <russell@personaltelco.net>
2021-07-04 14:42:08 +02:00
David Bauer
6cf1dfd7e1 ath79: add support for Teltonika RUT230 v1
This commit adds support for the Teltonika RUT230 v1, a Atheros AR9331
based router with a Quectel UC20 UMTS modem.

Hardware
--------
Atheros AR9331
16 MB SPI-NOR XTX XT25F128B
64M DDR2 memory
Atheros AR9331 1T1R 802.11bgn Wireless
Boootloader: pepe2k U-Boot mod

Hardware-Revision
-----------------
There are two board revisions of the RUT230, a v0 and v1.

A HW version is silkscreened on the top of the PCBs front side as well
as shown in the Teltonika UI. However, this looks to be a different
identifier, as the GPl dump shows this silkscreened / UI shown version
are internally treated identically.

Th following mapping has been obtained from the latest GPl dump.

HW Ver   01 - 04 --> v0
HW Ver > 05      --> v1

My board was a HW Ver 09 and is treated as a v1.

Installation
------------
While attaching power, hold down the reset button and release it after
the signal LEDs flashed 3 times.

Attach your Computer with the devices LAN port and assign yourself the
IPv4 address 192.168.1.10/24. Open a web browser, navigate to
192.168.1.1. Upload the OpenWrt factory image.

The device will install OpenWrt and automatically reboots afterwards.

You can use the smae procedure with the stock firmware to return back to
the vendor firmware.

Signed-off-by: David Bauer <mail@david-bauer.net>
2021-06-30 21:39:59 +02:00
Andy Lee
c5235f6b24 ath79: add support for TP-Link TL-WR841HP v3
Specifications:
- QCA9533 SoC, 8 MB nor flash, 64 MB DDR2 RAM
- 2x2 9dBi antenna, wifi 2.4Ghz 300Mbps
- 4x Ethernet LAN 10/100, 1x Ethernet WAN 10/100
- 1x WAN, LAN, Wifi, PWR, WPS, RE Leds
- Reset, Wifi on/off, WPS, RE buttons
- Serial UART at J4 onboard: 3.3v GND RX TX, 1152008N1

Label MAC addresses based on vendor firmware:
LAN      *:ea    label
WAN      *:eb    label +1
2.4 GHz  *:ea    label
The label MAC address in found in u-boot 0x1fc00

Installation:
Upload openwrt-ath79-generic-tplink_tl-wr841hp-v3-squashfs-factory.bin
from stock firmware webgui.
Maybe we need rename to shorten file name due to stock webgui error.

Revert back to stock firmware instructions:
- set your PC to static IP address 192.168.0.66 netmask 255.255.255.0
- download stock firmware from Tp-link website
- put it in the root directory of tftp server software
- rename it to wr841hpv3_tp_recovery.bin
- power on while pressing Reset button until any Led is lighting up
- wait for the router to reboot. done

Forum support topic:
https://forum.openwrt.org/t/support-for-tp-link-tl-wr841hp-v3-router

Signed-off-by: Andy Lee <congquynh284@yahoo.com>
[rebase and squash]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-06-13 23:30:05 +02:00
Nick Hainke
3e0387b3db ath79: Support for Ubiquiti Rocket 5AC Lite
The Ubiquiti Rocket 5AC Lite (R5AC-Lite) is an outdoor router.

Specifications:
 - SoC: Qualcomm Atheros QCA9558
 - RAM: 128 MB
 - Flash: 16 MB SPI
 - Ethernet: 1x 10/100/1000 Mbps
 - WiFi 5 GHz: QCA988x
 - Buttons: 1x (reset)
 - LEDs: 1x power, 1x Ethernet, 4x RSSI

Installation:
- Instructions for XC-type Ubiquiti:
  https://openwrt.org/toh/ubiquiti/common

Signed-off-by: Nick Hainke <vincent@systemli.org>
2021-06-07 00:23:51 +02:00
INAGAKI Hiroshi
a4e2766a5b ath79: add support for NEC Aterm WF1200CR
NEC Aterm WF1200CR is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on
QCA9561.

Specification:

- SoC		: Qualcomm Atheros QCA9561
- RAM		: DDR2 128 MiB (W971GG6SB-25)
- Flash		: SPI-NOR 8 MiB (MX25L6433FM2I-08G)
- WLAN		: 2.4/5 GHz 2T2R
  - 2.4 GHz	: QCA9561 (SoC)
  - 5 GHz	: QCA9888
- Ethernet	: 2x 10/100 Mbps
  - Switch	: QCA9561 (SoC)
- LEDs/Keys	: 8x/3x (2x buttons, 1x slide-switch)
- UART		: through-hole on PCB
  - JP1: Vcc, GND, NC, TX, RX from "JP1" marking
  - 115200n8
- Power		: 12 VDC, 0.9 A

Flash instruction using factory image (stock: < v1.3.2):

1. Boot WF1200CR normally with "Router" mode
2. Access to "http://192.168.10.1/" and open firmware update page
   ("ファームウェア更新")
3. Select the OpenWrt factory image and click update ("更新") button to
   perform firmware update
4. Wait ~150 seconds to complete flashing

Alternate flash instruction using initramfs image (stock: >= v1.3.2):

1. Prepare the TFTP server with the IP address 192.168.1.10 and place
   the OpenWrt initramfs image to the TFTP directory with the name
   "0101A8C0.img"
2. Connect serial console to WF1200CR
3. Boot WF1200CR and interrupt with any key after the message
   "Hit any key to stop autoboot:  2", the U-Boot starts telnetd after
   the message "starting telnetd server from server 192.168.1.1"
4. login the telnet (address: 192.168.1.1)
5. Perform the following commands to modify "bootcmd" variable
   temporary and check the value
   (to ignore the limitation of available commands, "tp; " command at
   the first is required as dummy, and the output of "printenv" is
   printed on the serial console)

   tp; set bootcmd 'set autostart yes; tftpboot'
   tp; printenv

6. Save the modified variable with the following command and reset
   device

   tp; saveenv
   tp; reset

7. The U-Boot downloads initramfs image from TFTP server and boots it
8. On initramfs image, download the sysupgrade image to the device and
   perform the following commands to erase stock firmware and sysupgrade

   mtd erase firmware
   sysupgrade <sysupgrade image>

9. After the rebooting by completion of sysupgrade, start U-Boot telnetd
   and login with the same way above (3, 4)
10. Perform the following commands to reset "bootcmd" variable to the
    default and reset the device

    tp; run seattle
    tp; reset

    (the contents of "seattle":
     setenv bootcmd 'bootm 0x9f070040' && saveenv)
11. Wait booting-up the device

Known issues:

- the following 6x LEDs are connected to the gpio controller on QCA9888
  chip and the implementation of control via the controller is missing in
  ath10k/ath10k-ct

  - "ACTIVE" (Red/Green)
  - "2.4GHz" (Red/Green)
  - "5GHz"   (Red/Green)

Note:

- after the version v1.3.2 of stock firmware, "offline update" by
  uploading image by user is deleted and the factory image cannot be
  used

- the U-Boot on WF1200CR doesn't configure the port-side LEDs on WAN/LAN
  and the configuration is required on OpenWrt

  - gpio-hog: set the direction of GPIO 14(WAN)/19(LAN) to output
  - pinmux: set GPIO 14/19 as switch-controlled LEDs

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2021-06-06 21:21:51 +02:00
Felix Matouschek
624b85e646 ath79: add support for Devolo dLAN pro 1200+ WiFi ac
This patch adds support for the Devolo dLAN pro 1200+ WiFi ac.
This device is a plc wifi AC2400 router/extender with 2 Ethernet ports,
has a QCA7500 PLC and uses the HomePlug AV2 standard.

Other than the PLC the hardware is identical to the Devolo Magic 2 WIFI.
Therefore it uses the same dts, which was moved to a dtsi to be included
by both boards.

This is a board that was previously included in the ar71xx tree.

Hardware:
   SoC:         AR9344
   CPU:         560 MHz
   Flash:       16 MiB (W25Q128JVSIQ)
   RAM:         128 MiB DDR2
   Ethernet:    2xLAN 10/100/1000
   PLC:         QCA75000 (Qualcomm HPAV2)
   PLC Uplink:  1Gbps MIMO
   PLC Link:    RGMII 1Gbps (WAN)
   WiFi:        Atheros AR9340 2.4GHz 802.11bgn
                Atheros AR9882-BR4A 5GHz 802.11ac
   Switch:      QCA8337, Port0:CPU, Port2:PLC, Port3:LAN1, Port4:LAN2
   Button:      3x Buttons (Reset, wifi and plc)
   LED:         3x Leds (wifi, plc white, plc red)
   GPIO Switch: 11-PLC Pairing (Active Low)
                13-PLC Enable
                21-WLAN power

MACs Details verified with the stock firmware:
   Radio1: 2.4 GHz &wmac     *:4c Art location: 0x1002
   Radio0: 5.0 GHz &pcie     *:4d Art location: 0x5006
   Ethernet        &ethernet *:4e = 2.4 GHz + 2
   PLC uplink      ---       *:4f = 2.4 GHz + 3
Label MAC address is from PLC uplink

The Powerline (PLC) interface of the dLAN pro 1200+ WiFi ac requires 3rd
party firmware which is not available from standard OpenWrt package
feeds. There is a package feed on github which you must add to
OpenWrt buildroot so you can build a firmware image which supports the
plc interface.

See: https://github.com/0xFelix/dlan-openwrt (forked from Devolo and
added compatibility for OpenWrt 21.02)

Flash instruction (TFTP):
 1. Set PC to fixed ip address 192.168.0.100
 2. Download the sysupgrade image and rename it to uploadfile
 3. Start a tftp server with the image file in its root directory
 4. Turn off the router
 5. Press and hold Reset button
 6. Turn on router with the reset button pressed and wait ~15 seconds
 7. Release the reset button and after a short time
    the firmware should be transferred from the tftp server
 8. Allow 1-2 minutes for the first boot.

Signed-off-by: Felix Matouschek <felix@matouschek.org>
[add "plus" to compatible and device name]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-06-06 18:56:45 +02:00
Adrian Schmutzler
6f648ed7e6 treewide: remove "+" sign for increment with macaddr_add
Many people appear to use an unneeded "+" prefix for the increment
when calculating a MAC address with macaddr_add. Since this is not
required and used inconsistently [*], just remove it.

[*] As a funny side-fact, copy-pasting has led to almost all
    hotplug.d files using the "+", while nearly all of the
    02_network files are not using it.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-06-05 23:54:37 +02:00
Zoltan HERPAI
1eb481206d ath79: add support for Qualcomm AP143 reference boards
Specifications:

SoC:    QCA9533
DRAM:   32Mb DDR1
Flash:  8/16Mb SPI-NOR
LAN:    4x 10/100Mbps via AR8229 switch (integrated into SoC)
        on GMII
WAN:    1x 10/100Mbps via MII
WLAN:   QCA9530
USB:    1x 2.0
UART:   standard QCA UART header
JTAG:   yes
Button: 1x WPS, 1x reset
LEDs:   8x LEDs

A version with 4Mb flash is also available, but due to lack of
enough space it's not supported.

As the original flash layout does not provide enough space for
the kernel (1472k), the firmware uses OKLI and concat flash to
overcome the limitation without changing the boot address of the
bootloaders.

Installation:

1. Original bootloader

  Connect the board to ethernet
  Set up a server with an IP address of 192.168.1.10
  Make the openwrt-ath79-generic-qca_ap143-8m-squashfs-factory.bin
  available via TFTP

  tftpboot 0x80060000 openwrt-ath79-generic-qca_ap143-8m-squashfs-factory.bin
  erase 0x9f050000 +$filesize
  cp.b $fileaddr 0x9f050000 $filesize

  Reboot the board.

2. pepe2k's u-boot_mod

  Connect the board to ethernet
  Set up a server with an IP address of 192.168.1.10
  Make the openwrt-ath79-generic-qca_ap143-8m-squashfs-factory.bin
  available via TFTP, as "firmware.bin"

  run fw_upg

  Reboot the board.

For the 16M version of the board, please use
openwrt-ath79-generic-qca_ap143-16m-squashfs-factory.bin

Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
[use fwconcatX names, drop redundant uart status, fix IMAGE_SIZE,
set up IMAGE/factory.bin without metadata]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-06-05 01:17:11 +02:00
Sven Eckelmann
9a172797e5 ath79: Add support for OpenMesh A40
Device specifications:
======================

* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2T2R 2.4 GHz Wi-Fi (11n)
* 2T2R 5 GHz Wi-Fi (11ac)
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x ethernet
  - eth0
    + Label: Ethernet 1
    + AR8035 ethernet PHY (RGMII)
    + 10/100/1000 Mbps Ethernet
    + 802.3af POE
    + used as WAN interface
  - eth1
    + Label: Ethernet 2
    + AR8035 ethernet PHY (SGMII)
    + 10/100/1000 Mbps Ethernet
    + used as LAN interface
* 1x USB
* internal antennas

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to the
device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
2021-06-05 01:17:11 +02:00
Sven Eckelmann
eaf2e32c12 ath79: Add support for OpenMesh A60
Device specifications:
======================

* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 3T3R 2.4 GHz Wi-Fi (11n)
* 3T3R 5 GHz Wi-Fi (11ac)
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x ethernet
  - eth0
    + Label: Ethernet 1
    + AR8035 ethernet PHY (RGMII)
    + 10/100/1000 Mbps Ethernet
    + 802.3af POE
    + used as WAN interface
  - eth1
    + Label: Ethernet 2
    + AR8031 ethernet PHY (SGMII)
    + 10/100/1000 Mbps Ethernet
    + used as LAN interface
* 1x USB
* internal antennas

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to the
device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
2021-06-05 01:17:11 +02:00
Adrian Schmutzler
3dd9f82fec ath79: fix leading whitespaces in generic 01_leds
Use tabs consistently.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-05-17 01:01:32 +02:00
Joao Henrique Albuquerque
4f07966696 ath79: add support for COMFAST CF-E375AC
COMFAST CF-E375AC is a ceiling mount AP with PoE support,
based on Qualcomm/Atheros QCA9563 + QCA9886 + QCA8337.

Short specification:

    2x 10/100/1000 Mbps Ethernet, with PoE support
    128MB of RAM (DDR2)
    16 MB of FLASH
    3T3R 2.4 GHz, 802.11b/g/n
    2T2R 5 GHz, 802.11ac/n/a, wave 2
    built-in 5x 3 dBi antennas
    output power (max): 500 mW (27 dBm)
    1x RGB LED, 1x button
    built-in watchdog chipset

Flash instruction:
1) Original firmware is based on OpenWrt.
Use sysupgrade image directly in vendor GUI.

2) TFTP
2.1) Set a tftp server on your machine with a fixed IP address of
     192.168.1.10. A place the sysupgrade as firmware_auto.bin.
2.2) boot the device with an ethernet connection on fixed ip route
2.3) wait a few seconds and try to login via ssh

3) TFTP trough Bootloader
3.1) open the device case and get a uart connection working
3.2) stop the autoboot process and test connection with serverip
3.3) name the sysupgrade image firmware.bin and run firmware_upg

MAC addresses:
Though the OEM firmware has four adresses in the usual locations,
it appears that the assigned addresses are just incremented in a
different way:

interface    address    location
LAN:          *:DC      0x0
WAN           *:DD      0x1002
WLAN 2.4g     *:E6      n/a (0x0 + 10)
WLAN 5g       *:DE      0x6
unused        *:DF      0x5006

The MAC address pointed at the label is the one assign to the LAN
interface.

Signed-off-by: Joao Henrique Albuquerque <joaohccalbu@gmail.com>
[add label-mac-device, remove redundant uart status, fix whitespace
issues, fix commit message wrapping, remove x bit on DTS file]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-05-17 01:01:32 +02:00
Adrian Schmutzler
6780019892 ath79: fix sorting in generic 02_network
The two device strings were not ordered properly.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-05-14 00:19:11 +02:00
Adrian Schmutzler
60e931eae2 ath79: consolidate testing kernel
All subtargets have the same testing kernel set, so move it to the
target definition.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-04-10 19:28:04 +02:00
Michael Pratt
37ea5d9a65 ath79: add factory.bin for ALLNET ALL-WAP02860AC
This device is a Senao-based product
using hardware and software from Senao
with the tar-gz platform for factory.bin
and checksum verification at boot time
using variables stored in uboot environment
and a 'failsafe' image when it fails.

Extremely similar hardware/software to Engenius EAP1200H
and other Engenius APs with qca955x

Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2021-04-08 09:20:59 +02:00
Michael Pratt
d5035f0d26 ath79: add Senao 'failsafe' sysupgrade procedure
Use a similar upgrade method for sysupgrade.bin, like factory.bin,
for Senao boards with the tar.gz OEM upgrade platform,
and 'failsafe' image which is loaded on checksum failure.

This is inspired by the OEM upgrade script /etc/fwupgrade.sh
and the existing platforms for dual-boot Senao boards.

Previously, if the real kernel was damaged or missing
the only way to recover was with UART serial console,
because the OKLI lzma-loader is programmed to halt.

uboot did not detect cases where kernel or rootfs is damaged
and boots OKLI instead of the failsafe image,
because the checksums stored in uboot environment
did not include the real kernel and rootfs space.

Now, the stored checksums include the space for both
the lzma-loader, kernel, and rootfs.
Therefore, these boards are now practically unbrickable.

Also, the factory.bin and sysupgrade.bin are now the same,
except for image metadata.
This allows for flashing OEM image directly from openwrt
as well as flashing openwrt image directly from OEM.

Make 'loader' partition writable so that it can be updated
during a sysupgrade.

tested with
ENS202EXT v1
EAP1200H
EAP350 v1
EAP600
ECB350 v1
ECB600
ENH202 v1

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2021-04-08 09:20:59 +02:00
INAGAKI Hiroshi
e2331fb549 ath79: fix label_mac for NEC Aterm WG1200CR
On NEC Aterm WG1200CR, the MAC address for WAN is printed in the label
on the case, not LAN.
This patch fixes this issue.

Fixes: 50fdc0374b ("ath79: provide label MAC address")

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2021-03-27 16:28:01 +01:00
Mauri Sandberg
bc356de285 ath79: Add support for Buffalo WZR-HP-G300NH
This device is a wireless router working on 2.4GHz band based on
Qualcom/Atheros AR9132 rev 2 SoC and is accompanied by Atheros AR9103
wireless chip and Realtek RTL8366RB/S switches. Due to two different
switches being used also two different devices are provided.

  Specification:
  - 400 MHz CPU
  - 64 MB of RAM
  - 32 MB of FLASH (NOR)
  - 3x3:2 2.4 GHz 802.11bgn
  - 5x 10/100/1000 Mbps Ethernet
  - 4x LED, 3x button, On/Off slider, Auto/On/Off slider
  - 1x USB 2.0
  - bare UART header place on PCB

  Flash instruction:
  - NOTE: Pay attention to the switch variant and choose the image to
    flash accordingly. (dmesg / kernel logs can tell it)
  - Methods for flashing
    - Apply factory image in OEM firmware web-gui.
    - Sysupgrade on top of existing OpenWRT image
    - U-Boot TFPT recovery for both stock or OpenWRT images:
      The device U-boot contains a TFTP server that by default has
      an address 192.168.11.1 (MAC 02:AA:BB:CC:DD:1A). During the boot
      there is a time window, during which the device allows an image to
      be uploaded from a client with address 192.168.11.2. The image will
      be written on flash automatically.

      1) Have a computer with static IP address 192.168.11.2 and the
         router device switched off.
      2) Connect the LAN port next to the WAN port in the device and the
         computer using a network switch.
      3) Assign IP 192.168.11.1 the MAC address 02:AA:BB:CC:DD:1A
         arp -s 192.168.11.1 02:AA:BB:CC:DD:1A
      4) Initiate an upload using TFTP image variant
         curl -T <imagename> tftp://192.168.11.1
      5) Switch on the device. The image will be uploaded subsequently.
         You can keep an eye on the diag light on the device, it should
         keep on blinking for a while indicating the writing of the image.

  General notes:
  - In the stock firmware the MAC address is the same among all
    interfaces so it is left here that way too.

  Recovery:
  - TFTP method
  - U-boot serial console

  Differences to ar71xx platform
  - This device is split in two different targets now due to hardware
    being a bit different under the hood. Dynamic solution within the same
    image is left for later time.
  - GPIOs for a sliding On/Off switch, marked 'Movie engine' on the device
    cover, were the wrong way around and were renamed qos_on -> movie_off,
    qos_off -> movie_on. Associated key codes remained the same they were.

  The device tree source code is mostly based on musashino's work

Signed-off-by: Mauri Sandberg <sandberg@mailfence.com>
2021-03-22 09:23:10 +01:00
Walter Sonius
46c0634b50 ath79: fix lan port display order for sitecom wlr-7100
Physical port order watched from the back of the device is:
4 / 3 / 2 / 1 / WAN which also matches corresponding leds.
This patch corrects LuCI switch webpage LAN port order.

Signed-off-by: Walter Sonius <walterav1984@gmail.com>
[improve commit title, fix sorting in 02_network]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-03-21 22:45:20 +01:00
Adrian Schmutzler
85b1f4d8ca treewide: remove execute bit and shebang from board.d files
So far, board.d files were having execute bit set and contained a
shebang. However, they are just sourced in board_detect, with an
apparantly unnecessary check for execute permission beforehand.

Replace this check by one for existance and make the board.d files
"normal" files, as would be expected in /etc anyway.

Note:

This removes an apparantly unused '#!/bin/sh /etc/rc.common' in
target/linux/bcm47xx/base-files/etc/board.d/01_network

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-03-06 11:30:06 +01:00
David Bauer
2a26cb51fe ath79: enable Regulator support for target
Regulator support was enabled on all subtargets except for ath79-nand.
With Kernel 5.10, AT803x requires Regulator support, thus enabling on
the complete target, as ath79-nand requires AT803x.

While this is only required on Kernel 5.10, enable it also on 5.4. We
have no major size-constraint, so enabling it on 5.4 allows us to clean
up the occurences in the subtarget configuration.

Signed-off-by: David Bauer <mail@david-bauer.net>
2021-02-22 00:57:25 +01:00
David Bauer
d6b785d477 ath79: add kernel 5.10 support
This adds Kernel 5.10 support for the generic, nand and tiny subtargets.

The following patch is not contained, as it needs to be reworked:
platform/920-mikrotik-rb4xx.patch

Tested-on:
 - Siemens WS-AP3610
 - Enterasys WS-AP3710
 - Aerohive HiveAP 121
 - TP-Link TL-WA901 v2
 - TP-Link TL-WR741 v1

Signed-off-by: David Bauer <mail@david-bauer.net>
2021-02-20 01:26:33 +01:00
Martin Kennedy
e2db870398 ath79: fix chip used for Meraki MR12 caldata_extract
The original setup fails to trigger ART calibration data
extraction for the AR9287. Instead, it would only have extracted
calibration data for an internal WMAC chip which is not present on
this board.

Fixes: 55d2db0e8c ("ath79: add support for Meraki MR12")

Signed-off-by: Martin Kennedy <hurricos@gmail.com>
[commit title/message facelift]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-02-13 21:21:01 +01:00
Sebastian Schaper
dc4745da7a ath79: add support for D-Link DAP-3662 A1
Specifications:
 * QCA9557, 16 MiB Flash, 128 MiB RAM, 802.11n 2T2R
 * QCA9882, 802.11ac 2T2R
 * 2x Gigabit LAN (1x 802.11af PoE)
 * IP68 pole-mountable outdoor case

Installation:
 * Factory Web UI is at 192.168.0.50
   login with 'admin' and blank password, flash factory.bin
 * Recovery Web UI is at 192.168.0.50
   connect network cable, hold reset button during power-on and keep it
   pressed until uploading has started (only required when checksum is ok,
   e.g. for reverting back to oem firmware), flash factory.bin

After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.

Both ethernet ports are set to LAN by default, matching the labelling on
the case. However, since both GMAC Interfaces eth0 and eth1 are connected
to the switch (QCA8337), the user may create an additional 'wan' interface
as desired and override the vlan id settings to map br-lan / wan to either
the PoE or non-PoE port, depending on the individual scenario of use.

So, the LAN and WAN ports would then be connected to different GMACs, e.g.

config interface 'lan'
	option ifname 'eth0.1'
	...

config interface 'wan'
	option ifname 'eth1.2'
	...

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '1 0t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '2 6t'

Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
[add configuration example]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-02-09 13:10:33 +01:00
Michael Pratt
f5f01bcacd ath79: use internal switch for EAP300 v2
Have the port use GMAC1 with internal switch
which fixes the issue of the ethernet LED not functioning
The LED is triggered by the internal switch, not a GPIO.

The GPIO for the ethernet LED was added in ath79
as it was defined in the ar71xx target
but it was not functioning in ath79 for a previously unknown reason.

It is unknown why that GPIO was defined as an LED in ar71xx.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
[drop unrelated changes: model property and SPI max frequency]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-02-08 16:34:18 +01:00
Michael Pratt
88079bd616 ath79: make all eth ports LAN for Engenius APs
for:
 - ENH202 v1
 - ENS202EXT v1
 - EnstationAC v1
 - EWS511AP

For EWS511AP, have default behavior as static ip
to match the behavior of all other APs in ath79

These boards are sold as
Client Bridge or Point to Point or Access Point
so there is probably no benefit to have WAN by default
for one of the ports, to prevent user confusion.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2021-02-08 16:34:18 +01:00
Adrian Schmutzler
8a79161a82 ath79: wrap ucidef_add_switch in 02_network
Wrap line to be consistent with all other definitions.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-02-05 21:57:19 +01:00
Martin Kennedy
55d2db0e8c ath79: add support for Meraki MR12
Port device support for Meraki MR12 from the ar71xx target to ath79.

Specifications:

  - SoC: AR7242-AH1A CPU
  - RAM: 64MiB (NANYA NT5DS32M16DS-5T)
  - NOR Flash: 16MiB (MXIC MX25L12845EMI-10G)
  - Ethernet: 1 x PoE Gigabit Ethernet Port (SoC MAC + AR8021-BL1E PHY)
  - Ethernet: 1 x 100Mbit port (SoC MAC+PHY)
  - Wi-Fi: Atheros AR9283-AL1A (2T2R, 11n)

Installation:

  1. Requires TFTP server at 192.168.1.101, w/ initramfs & sysupgrade .bins
  2. Open shell case
  3. Connect a USB->TTL cable to headers furthest from the RF shield
  4. Power on the router; connect to U-boot over 115200-baud connection
  5. Interrupt U-boot process to boot Openwrt by running:
       setenv bootcmd bootm 0xbf0a0000; saveenv;
       tftpboot 0c00000 <filename-of-initramfs-kernel>.bin;
       bootm 0c00000;
  6. Copy sysupgrade image to /tmp on MR12
  7. sysupgrade /tmp/<filename-of-sysupgrade>.bin

Notes:

  - kmod-owl-loader is still required to load the ART partition into the
    driver.

  - The manner of storing MAC addresses is updated from ar71xx; it is
    at 0x66 of the 'config' partition, where it was discovered that the
    OEM firmware stores it. This is set as read-only. If you are
    migrating from ar71xx and used the method mentioned above to
    upgrade, use kmod-mtd-rw or UCI to add the MAC back in. One more
    method for doing this is described below.

  - Migrating directly from ar71xx has not been thoroughly tested, but
    one method has been used a couple of times with good success,
    migrating 18.06.2 to a full image produced as of this commit. Please
    note that these instructions are only for experienced users, and/or
    those still able to open their device up to flash it via the serial
    headers should anything go wrong.

    1) Install kmod-mtd-rw and uboot-envtools
    2) Run `insmod mtd-rw.ko i_want_a_brick=1`
    3) Modify /etc/fw_env.config to point to the u-boot-env partition.
       The file /etc/fw_env.config should contain:

       # MTD device   env offset  env size    sector size
       /dev/mtd1      0x00000     0x10000     0x10000

       See https://openwrt.org/docs/techref/bootloader/uboot.config
       for more details.

    4) Run `fw_printenv` to verify everything is correct, as per the
       link above.
    5) Run `fw_setenv bootcmd bootm 0xbf0a0000` to set a new boot address.
    6) Manually modify /lib/upgrade/common.sh's get_image function:
       Change ...

       cat "$from" 2>/dev/null | $cmd

       ... into ...

       (
         dd if=/dev/zero bs=1 count=$((0x66)) ; # Pad the first 102 bytes
         echo -ne '\x00\x18\x0a\x12\x34\x56'  ; # Add in MAC address
         dd if=/dev/zero bs=1 count=$((0x20000-0x66-0x6)) ; # Pad the rest
         cat "$from" 2>/dev/null
       ) | $cmd

       ... which, during the upgrade process, will pad the image by
       128K of zeroes-plus-MAC-address, in order for the ar71xx's
       firmware partition -- which starts at 0xbf080000 -- to be
       instead aligned with the ath79 firmware partition, which
       starts 128K later at 0xbf0a0000.

    7) Copy the sysupgrade image into /tmp, as above
    8) Run `sysupgrade -F /tmp/<sysupgrade>.bin`, then wait

    Again, this may BRICK YOUR DEVICE, so make *sure* to have your
    serial cable handy.

Signed-off-by: Martin Kennedy <hurricos@gmail.com>
[add LED migration and extend compat message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-02-05 16:56:08 +01:00
David Bauer
51f578efa5 ath79: add support for Ubiquiti UniFi AP Outdoor+
Hardware
--------
Atheros AR7241
16M SPI-NOR
64M DDR2
Atheros AR9283 2T2R b/g/n
2x Fast Ethernet (built-in)

Installation
------------

Transfer the Firmware update to the device using SCP.

Install using fwupdate.real -m <openwrt.bin> -d

Signed-off-by: David Bauer <mail@david-bauer.net>
2021-02-01 00:47:46 +01:00
Adrian Schmutzler
9b5e9b65cf ath79: remove generic profiles
On a platform with many very different devices, like found on ath79,
the generic profiles seem like remnants of the past that do not
have a real use anymore.

Remove them to have one thing less to maintain.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Acked-by: Paul Spooren <mail@aparcar.org>
2021-01-27 21:31:20 +01:00
Michael Pratt
96017a6013 ath79: add support for Senao Engenius EAP1200H
FCC ID: A8J-EAP1200H

Engenius EAP1200H is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+

**Specification:**

  - QCA9557 SOC
  - QCA9882 WLAN	PCI card, 5 GHz, 2x2, 26dBm
  - AR8035-A PHY	RGMII GbE with PoE+ IN
  - 40 MHz clock
  - 16 MB FLASH		MX25L12845EMI-10G
  - 2x 64 MB RAM	NT5TU32M16FG
  - UART at J10		populated
  - 4 internal antenna plates (5 dbi, omni-directional)
  - 5 LEDs, 1 button (power, eth0, 2G, 5G, WPS) (reset)

**MAC addresses:**

  MAC addresses are labeled as ETH, 2.4G, and 5GHz
  Only one Vendor MAC address in flash

  eth0 ETH  *:a2 art 0x0
  phy1 2.4G *:a3 ---
  phy0 5GHz *:a4 ---

**Serial Access:**

  the RX line on the board for UART is shorted to ground by resistor R176
  therefore it must be removed to use the console
  but it is not necessary to remove to view boot log

  optionally, R175 can be replaced with a solder bridge short

  the resistors R175 and R176 are next to the UART RX pin at J10

**Installation:**

  2 ways to flash factory.bin from OEM:

  Method 1: Firmware upgrade page:

    OEM webpage at 192.168.1.1
    username and password "admin"
    Navigate to "Firmware Upgrade" page from left pane
    Click Browse and select the factory.bin image
    Upload and verify checksum
    Click Continue to confirm and wait 3 minutes

  Method 2: Serial to load Failsafe webpage:

    After connecting to serial console and rebooting...
    Interrupt uboot with any key pressed rapidly
    execute `run failsafe_boot` OR `bootm 0x9fd70000`
    wait a minute
    connect to ethernet and navigate to
    "192.168.1.1/index.htm"
    Select the factory.bin image and upload
    wait about 3 minutes

**Return to OEM:**

  If you have a serial cable, see Serial Failsafe instructions
  otherwise, uboot-env can be used to make uboot load the failsafe image

  *DISCLAIMER*
  The Failsafe image is unique to Engenius boards.
  If the failsafe image is missing or damaged this will brick the device
  DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt

  ssh into openwrt and run
  `fw_setenv rootfs_checksum 0`
  reboot, wait 3 minutes
  connect to ethernet and navigate to 192.168.1.1/index.htm
  select OEM firmware image from Engenius and click upgrade

**TFTP recovery:**

  Requires serial console, reset button does nothing

  rename initramfs to 'vmlinux-art-ramdisk'
  make available on TFTP server at 192.168.1.101
  power board, interrupt boot
  execute tftpboot and bootm 0x81000000

  NOTE: TFTP is not reliable due to bugged bootloader
  set MTU to 600 and try many times

**Format of OEM firmware image:**

  The OEM software of EAP1200H is a heavily modified version
  of Openwrt Kamikaze. One of the many modifications
  is to the sysupgrade program. Image verification is performed
  simply by the successful ungzip and untar of the supplied file
  and name check and header verification of the resulting contents.
  To form a factory.bin that is accepted by OEM Openwrt build,
  the kernel and rootfs must have specific names...

    openwrt-ar71xx-generic-eap1200h-uImage-lzma.bin
    openwrt-ar71xx-generic-eap1200h-root.squashfs

  and begin with the respective headers (uImage, squashfs).
  Then the files must be tarballed and gzipped.
  The resulting binary is actually a tar.gz file in disguise.
  This can be verified by using binwalk on the OEM firmware images,
  ungzipping then untaring.

  Newer EnGenius software requires more checks but their script
  includes a way to skip them, otherwise the tar must include
  a text file with the version and md5sums in a deprecated format.

  The OEM upgrade script is at /etc/fwupgrade.sh.

  OKLI kernel loader is required because the OEM software
  expects the kernel to be no greater than 1536k
  and the factory.bin upgrade procedure would otherwise
  overwrite part of the kernel when writing rootfs.

Note on PLL-data cells:

  The default PLL register values will not work
  because of the external AR8035 switch between
  the SOC and the ethernet port.

  For QCA955x series, the PLL registers for eth0 and eth1
  can be see in the DTSI as 0x28 and 0x48 respectively.
  Therefore the PLL registers can be read from uboot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x18050028 1` and `md 0x18050048 1`.

  The clock delay required for RGMII can be applied
  at the PHY side, using the at803x driver `phy-mode`.
  Therefore the PLL registers for GMAC0
  do not need the bits for delay on the MAC side.
  This is possible due to fixes in at803x driver
  since Linux 5.1 and 5.3

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2021-01-23 12:53:22 +01:00
Sven Eckelmann
0988e03f0e ath79: Add support for OpenMesh MR1750 v2
Device specifications:
======================

* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 3T3R 2.4 GHz Wi-Fi (11n)
* 3T3R 5 GHz Wi-Fi (11ac)
* 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 1x ethernet
  - AR8035 ethernet PHY (RGMII)
  - 10/100/1000 Mbps Ethernet
  - 802.3af POE
  - used as LAN interface
* 12-24V 1A DC
* internal antennas

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to the
device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
[rebase, add LED migration]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-19 21:41:26 +01:00
Sven Eckelmann
ae7680dc4b ath79: Add support for OpenMesh MR1750 v1
Device specifications:
======================

* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 3T3R 2.4 GHz Wi-Fi (11n)
* 3T3R 5 GHz Wi-Fi (11ac)
* 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 1x ethernet
  - AR8035 ethernet PHY (RGMII)
  - 10/100/1000 Mbps Ethernet
  - 802.3af POE
  - used as LAN interface
* 12-24V 1A DC
* internal antennas

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to the
device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
[rebase, apply shared DTSI/device node, add LED migration]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-19 21:41:26 +01:00
Sven Eckelmann
31172e53f9 ath79: Add support for OpenMesh MR900 v2
Device specifications:
======================

* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 3T3R 2.4 GHz Wi-Fi
* 3T3R 5 GHz Wi-Fi
* 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 1x ethernet
  - AR8035 ethernet PHY (RGMII)
  - 10/100/1000 Mbps Ethernet
  - 802.3af POE
  - used as LAN interface
* 12-24V 1A DC
* internal antennas

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to the
device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
[rebase, add LED migration]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-19 15:39:36 +01:00
Sven Eckelmann
e06c9eec5d ath79: Add support for OpenMesh MR900 v1
Device specifications:
======================

* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 3T3R 2.4 GHz Wi-Fi
* 3T3R 5 GHz Wi-Fi
* 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 1x ethernet
  - AR8035 ethernet PHY (RGMII)
  - 10/100/1000 Mbps Ethernet
  - 802.3af POE
  - used as LAN interface
* 12-24V 1A DC
* internal antennas

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to the
device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
[rebase, add LED migration]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-19 15:39:36 +01:00
Sven Eckelmann
d9a3af46d8 ath79: Add support for OpenMesh MR600 v2
Device specifications:
======================

* Qualcomm/Atheros AR9344 rev 2
* 560/450/225 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2T2R 2.4 GHz Wi-Fi
* 2T2R 5 GHz Wi-Fi
* 8x GPIO-LEDs (6x wifi, 1x wps, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 1x ethernet
  - AR8035 ethernet PHY (RGMII)
  - 10/100/1000 Mbps Ethernet
  - 802.3af POE
  - used as LAN interface
* 12-24V 1A DC
* internal antennas

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to the
device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
[rebase, add LED migration]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-19 15:39:36 +01:00
Sven Eckelmann
4b35999588 ath79: Add support for OpenMesh MR600 v1
Device specifications:
======================

* Qualcomm/Atheros AR9344 rev 2
* 560/450/225 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2T2R 2.4 GHz Wi-Fi
* 2T2R 5 GHz Wi-Fi
* 4x GPIO-LEDs (2x wifi, 1x wps, 1x power)
* 1x GPIO-button (reset)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 1x ethernet
  - AR8035 ethernet PHY (RGMII)
  - 10/100/1000 Mbps Ethernet
  - 802.3af POE
  - used as LAN interface
* 12-24V 1A DC
* internal antennas

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to the
device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
[rebase, make WLAN LEDs consistent, add LED migration]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-19 15:39:36 +01:00
Russell Senior
591a4c9ed3 ath79: Add support for Ubiquiti Bullet AC
CPU:         Atheros AR9342 rev 3 SoC
RAM:         64 MB DDR2
Flash:       16 MB NOR SPI
WLAN 2.4GHz: Atheros AR9342 v3 (ath9k)
WLAN 5.0GHz: QCA988X
Ports:       1x GbE

Flashing procedure is identical to other ubnt devices.
https://openwrt.org/toh/ubiquiti/common

Flashing through factory firmware
1. Ensure firmware version v8.7.0 is installed.
   Up/downgrade to this exact version.
2. Patch fwupdate.real binary using
   `hexdump -Cv /bin/ubntbox | sed 's/14 40 fe 27/00 00 00 00/g' | \
    hexdump -R > /tmp/fwupdate.real`
3. Make the patched fwupdate.real binary executable using
   `chmod +x /tmp/fwupdate.real`
4. Copy the squashfs factory image to /tmp on the device
5. Flash OpenWrt using `/tmp/fwupdate.real -m <squashfs-factory image>`
6. Wait for the device to reboot
(copied from Ubiquiti NanoBeam AC and modified)

Flashing from serial console
1. Connect serial console (115200 baud)
2. Connect ethernet to a network with a TFTP server, through a
   passive PoE injector.
3. Press a key to obtain a u-boot prompt
4. Set your TFTP server's ip address, with:
   setenv serverip <tftp-server-address>
5. Set the Bullet AC's ip address, with:
   setenv ipaddr <bullet-ac-address>
6. Set the boot file, with:
   setenv bootfile <name-of-initramfs-binary-on-tftp-server>
7. Fetch the binary with tftp:
   tftpboot
8. Boot the initramfs binary:
   bootm
9. From the initramfs, fetch the sysupgrade binary, and flash it with
   sysupgrade.

The Bullet AC is identified as a 2WA board by Ubiquiti. As such, the UBNT_TYPE
must match from the "Flashing through factory firmware" install instructions
to work.

Phy0 is QCA988X which can tune either band (2.4 or 5GHz). Phy1 is AR9342,
on which 5GHz is disabled.  It isn't currently known whether phy1 is
routed to the N connector at all.

Signed-off-by: Russell Senior <russell@personaltelco.net>
2021-01-15 18:32:38 +01:00
Michael Pratt
0070650df4 ath79: move small-flash Engenius boards to tiny
This moves some of the Engenius boards from generic to tiny:

 - EAP350 v1
 - ECB350 v1
 - ENH202 v1

For these, factory.bin builds are already failing on master
branch because of the unique situation for these boards:

 - 8 MB flash
 - an extra "failsafe" image for recovery
 - TFTP does not work (barely possible with 600 MTU)
 - bootloader loads image from a longer flash offset
 - 1 eraseblock each needed for OKLI kernel loader and fake rootfs
 - using mtd-concat to make use of remaining space...

The manual alternative would be removing the failsafe partition.
However this comes with the risk of extremely difficult recovery
if a flash ever fails because TFTP on the bootloader is bugged.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[improve commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-07 19:51:50 +01:00
Sebastian Schaper
d7d87cedcf ath79: Fix 02_network setup for D-Link DAP-2660 A1
The device is a one-port, but was set up as two-port by the
default case in 02_network. Fix it.

Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
[commit title/message facelift]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-04 01:09:32 +01:00
Sebastian Schaper
8ae2ee99c6 ath79: add support for D-Link DAP-3320 A1
Specifications:
 * QCA9533, 16 MiB Flash, 64 MiB RAM, 802.11n 2T2R
 * 10/100 Ethernet Port, 802.11af PoE
 * IP55 pole-mountable outdoor case

Installation:
 * Factory Web UI is at 192.168.0.50
   login with 'admin' and blank password, flash factory.bin
 * Recovery Web UI is at 192.168.0.50
   connect network cable, hold reset button during power-on and keep it
   pressed until uploading has started (only required when checksum is ok,
   e.g. for reverting back to oem firmware), flash factory.bin

After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.

Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2021-01-04 01:09:32 +01:00
Sebastian Schaper
5b58710fad ath79: add support for D-Link DAP-2680 A1
Specifications:
 * QCA9558, 16 MiB Flash, 256 MiB RAM, 802.11n 3T3R
 * QCA9984, 802.11ac Wave 2 3T3R
 * Gigabit LAN Port (AR8035), 802.11at PoE

Installation:
 * Factory Web UI is at 192.168.0.50
   login with 'admin' and blank password, flash factory.bin
 * Recovery Web UI is at 192.168.0.50
   connect network cable, hold reset button during power-on and keep it
   pressed until uploading has started (only required when checksum is ok,
   e.g. for reverting back to oem firmware), flash factory.bin

After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.

Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2021-01-04 01:09:32 +01:00
Sebastian Schaper
b077accb9c ath79: add support for D-Link DAP-2230 A1
Specifications:
 * QCA9533, 16 MiB Flash, 64 MiB RAM, 802.11n 2T2R
 * 10/100 Ethernet Port, 802.11af PoE

Installation:
 * Factory Web UI is at 192.168.0.50
   login with 'admin' and blank password, flash factory.bin
 * Recovery Web UI is at 192.168.0.50
   connect network cable, hold reset button during power-on and keep it
   pressed until uploading has started (only required when checksum is ok,
   e.g. for reverting back to oem firmware), flash factory.bin

After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.

Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2021-01-04 01:09:32 +01:00
Sven Eckelmann
80713657b2 ath79: Add support for OpenMesh OM5P
Device specifications:
======================

* Qualcomm/Atheros AR9344 rev 2
* 560/450/225 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 5 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
  - eth0
    + builtin switch port 1
    + used as LAN interface
  - eth1
    + 18-24V passive POE (mode B)
    + used as WAN interface
* 12-24V 1A DC
* internal antennas

WAN/LAN LEDs appear to be wrong in ar71xx and have been swapped here.

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to the
device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
[add LED swap comment]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-30 23:32:07 +01:00
Sven Eckelmann
ff9e48e75c ath79: Add support for OpenMesh OM2P v2
Device specifications:
======================

* Qualcomm/Atheros AR9330 rev 1
* 400/400/200 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 1T1R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
  - eth0
    + builtin switch port 1
    + used as LAN interface
  - eth1
    + 18-24V passive POE (mode B)
    + used as WAN interface
* 12-24V 1A DC
* external antenna

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to
the device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
2020-12-30 23:32:07 +01:00
Sven Eckelmann
eb3a5ddba0 ath79: Add support for OpenMesh OM2P-LC
Device specifications:
======================

* Qualcomm/Atheros AR9330 rev 1
* 400/400/200 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 1T1R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
  - eth0
    + builtin switch port 1
    + used as LAN interface
  - eth1
    + 18-24V passive POE (mode B)
    + used as WAN interface
* 12-24V 1A DC
* internal antennas

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to
the device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
2020-12-30 23:32:07 +01:00
Sven Eckelmann
75900a25ed ath79: add support for OpenMesh OM2P-HS v3
Device specifications:
======================

* Qualcomm/Atheros AR9341 rev 1
* 535/400/200 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
  - eth0
    + 802.3af POE
    + builtin switch port 1
    + used as LAN interface
  - eth1
    + 18-24V passive POE (mode B)
    + used as WAN interface
* 12-24V 1A DC
* internal antennas

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to
the device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
2020-12-29 00:03:26 +01:00
Sven Eckelmann
f096accce2 ath79: add support for OpenMesh OM2P-HS v2
Device specifications:
======================

* Qualcomm/Atheros AR9341 rev 1
* 535/400/200 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
  - eth0
    + 802.3af POE
    + builtin switch port 1
    + used as LAN interface
  - eth1
    + 18-24V passive POE (mode B)
    + used as WAN interface
* 12-24V 1A DC
* internal antennas

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to
the device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
2020-12-29 00:03:26 +01:00
Sven Eckelmann
a462412977 ath79: add support for OpenMesh OM2P-HS v1
Device specifications:
======================

* Qualcomm/Atheros AR9341 rev 1
* 535/400/200 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
  - eth0
    + 802.3af POE
    + builtin switch port 1
    + used as LAN interface
  - eth1
    + 18-24V passive POE (mode B)
    + used as WAN interface
* 12-24V 1A DC
* internal antennas

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to
the device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
[drop redundant status from eth1]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-29 00:03:26 +01:00
Sven Eckelmann
d0a9cf662e ath79: increase openmesh sysupgrade copy block size
The upgrade script for the openmesh sysupgrade procedure used always an 1
byte block size. This made it easier to seek the correct position in the CE
image and to make sure the right amount of data was copied. But this also
meant that the reading/writing of data required an excessive amount of
syscalls and copy operations.

A 5.4MB big sysupgrade image on an OM2P-HS v3 needed roughly 120s for the
write operation (170s in total) during the sysupgrade.

But it is possible to reduce this overhead slightly:

* index access to read the file size can be done in single 8 byte chunk
  (while doing the seek with byte granularity) because each size entry is
  example 8 bytes long
* the fwupgrade.cfg can be read as one block (while seeking to its position
  using its actual byte offset) because it should be rather small and fit
  into the RAM easily
* the kernel can be read in 1KB blocks (while seking to its positions using
  its actual byte offset) because the the size of the kernel is always a
  multiple of the NOR flash block size (64KB and 256KB)

This results in a sysupgrade write time of roughly 90s (140s in total).

This could be reduced even further when also using larger chunks for the
rootfs. But the squashfs rootfs image is at the moment always

  (256KB or 64KB) * block + 4 bytes

long. It would be expected that the time for the sysupgrade write could be
reduced to roughly 30s (80s in total) when busybox's dd would support
the iflag count_bytes.

Reported-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
2020-12-28 19:37:24 +01:00
Sven Eckelmann
5b37b52e69 ath79: Add support for OpenMesh OM2P-HS v4
Device specifications:
======================

* Qualcomm/Atheros QCA9533 v2
* 650/600/217 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
  - eth0
    + 24V passive POE (mode B)
    + used as WAN interface
  - eth1
    + 802.3af POE
    + builtin switch port 1
    + used as LAN interface
* 12-24V 1A DC
* internal antennas

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to
the device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
2020-12-28 19:37:24 +01:00
Sven Eckelmann
dd1d95cb03 ath79: Add support for OpenMesh OM2P v4
Device specifications:
======================

* Qualcomm/Atheros QCA9533 v2
* 650/600/217 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 1T1R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
  - eth0
    + Label: Ethernet 1
    + 24V passive POE (mode B)
  - eth1
    + Label: Ethernet 2
    + 802.3af POE
    + builtin switch port 1
* 12-24V 1A DC
* external antenna

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to
the device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
[wrap two very long lines, fix typo in comment]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-28 19:37:24 +01:00
Michael Pratt
33d26a9a40 ath79: add support for Senao Engenius EAP350 v1
FCC ID: U2M-EAP350

Engenius EAP350 is a wireless access point with 1 gigabit PoE ethernet port,
2.4 GHz wireless, external ethernet switch, and 2 internal antennas.

Specification:

  - AR7242 SOC
  - AR9283 WLAN			(2.4 GHz, 2x2, PCIe on-board)
  - AR8035-A switch		(GbE with 802.3af PoE)
  - 40 MHz reference clock
  - 8 MB FLASH			MX25L6406E
  - 32 MB RAM			EM6AA160TSA-5G
  - UART at J2			(populated)
  - 3 LEDs, 1 button		(power, eth, 2.4 GHz) (reset)
  - 2 internal antennas

MAC addresses:

  MAC address is labeled as "MAC"
  Only 1 address on label and in flash
  The OEM software reports these MACs for the ifconfig

  eth0	MAC	*:0c	art 0x0
  phy0	---	*:0d	---

Installation:

  2 ways to flash factory.bin from OEM:

  - if you get Failsafe Mode from failed flash:
      only use it to flash Original firmware from Engenius
      or risk kernel loop or halt which requires serial cable

  Method 1: Firmware upgrade page:

    OEM webpage at 192.168.10.1
    username and password "admin"
    Navigate to "Upgrade Firmware" page from left pane
    Click Browse and select the factory.bin image
    Upload and verify checksum
    Click Continue to confirm and wait 3 minutes

  Method 2: Serial to load Failsafe webpage:

    After connecting to serial console and rebooting...
    Interrupt uboot with any key pressed rapidly
    execute `run failsafe_boot` OR `bootm 0x9f670000`
    wait a minute
    connect to ethernet and navigate to
    "192.168.1.1/index.htm"
    Select the factory.bin image and upload
    wait about 3 minutes

Return to OEM:

  If you have a serial cable, see Serial Failsafe instructions
  otherwise, uboot-env can be used to make uboot load the failsafe image

  *DISCLAIMER*
  The Failsafe image is unique to Engenius boards.
  If the failsafe image is missing or damaged this will not work
  DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt

  ssh into openwrt and run
  `fw_setenv rootfs_checksum 0`
  reboot, wait 3 minutes
  connect to ethernet and navigate to 192.168.1.1/index.htm
  select OEM firmware image from Engenius and click upgrade

Format of OEM firmware image:

  The OEM software of EAP350 is a heavily modified version
  of Openwrt Kamikaze. One of the many modifications
  is to the sysupgrade program. Image verification is performed
  simply by the successful ungzip and untar of the supplied file
  and name check and header verification of the resulting contents.
  To form a factory.bin that is accepted by OEM Openwrt build,
  the kernel and rootfs must have specific names...

    openwrt-senao-eap350-uImage-lzma.bin
    openwrt-senao-eap350-root.squashfs

  and begin with the respective headers (uImage, squashfs).
  Then the files must be tarballed and gzipped.
  The resulting binary is actually a tar.gz file in disguise.
  This can be verified by using binwalk on the OEM firmware images,
  ungzipping then untaring.

  The OEM upgrade script is at /etc/fwupgrade.sh

  Later models in the EAP series likely have a different platform
  and the upgrade and image verification process differs.

  OKLI kernel loader is required because the OEM software
  expects the kernel to be no greater than 1024k
  and the factory.bin upgrade procedure would
  overwrite part of the kernel when writing rootfs.

Note on PLL-data cells:

  The default PLL register values will not work
  because of the external AR8035-A switch between
  the SOC and the ethernet PHY chips.

  For AR724x series, the PLL register for GMAC0
  can be seen in the DTSI as 0x2c.
  Therefore the PLL register can be read from uboot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x1805002c 1`.

  uboot did not have a good value for 1 GBps
  so it was taken from other similar DTS file.

Tested from master, all link speeds functional

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2020-12-25 10:38:13 +01:00
Michael Pratt
6c98edaae2 ath79: add support for Senao Engenius EAP600
FCC ID: A8J-EAP600

Engenius EAP600 is a wireless access point with 1 gigabit ethernet port,
dual-band wireless, external ethernet switch, 4 internal antennas
and 802.3af PoE.

Specification:

  - AR9344 SOC			(5 GHz, 2x2, WMAC)
  - AR9382 WLAN			(2.4 GHz, 2x2, PCIe on-board)
  - AR8035-A switch		(GbE with 802.3af PoE)
  - 40 MHz reference clock
  - 16 MB FLASH			MX25L12845EMI-10G
  - 2x 64 MB RAM		NT5TU32M16DG
  - UART at H1			(populated)
  - 5 LEDs, 1 button		(power, eth, 2.4 GHz, 5 GHz, wps) (reset)
  - 4 internal antennas

MAC addresses:

  MAC addresses are labeled MAC1 and MAC2
  The MAC address in flash is not on the label
  The OEM software reports these MACs for the ifconfig

  eth0	MAC 1	*:5e	---
  phy1	MAC 2	*:5f	---	(2.4 GHz)
  phy0	-----	*:60	art 0x0	(5 GHz)

Installation:

  2 ways to flash factory.bin from OEM:

  - if you get Failsafe Mode from failed flash:
      only use it to flash Original firmware from Engenius
      or risk kernel loop or halt which requires serial cable

  Method 1: Firmware upgrade page:

    OEM webpage at 192.168.1.1
    username and password "admin"
    Navigate to "Upgrade Firmware" page from left pane
    Click Browse and select the factory.bin image
    Upload and verify checksum
    Click Continue to confirm and wait 3 minutes

  Method 2: Serial to load Failsafe webpage:

    After connecting to serial console and rebooting...
    Interrupt uboot with any key pressed rapidly
    execute `run failsafe_boot` OR `bootm 0x9fdf0000`
    wait a minute
    connect to ethernet and navigate to
    "192.168.1.1/index.htm"
    Select the factory.bin image and upload
    wait about 3 minutes

Return to OEM:

  If you have a serial cable, see Serial Failsafe instructions
  otherwise, uboot-env can be used to make uboot load the failsafe image

  *DISCLAIMER*
  The Failsafe image is unique to Engenius boards.
  If the failsafe image is missing or damaged this will not work
  DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt

  ssh into openwrt and run
  `fw_setenv rootfs_checksum 0`
  reboot, wait 3 minutes
  connect to ethernet and navigate to 192.168.1.1/index.htm
  select OEM firmware image from Engenius and click upgrade

Format of OEM firmware image:

  The OEM software of EAP600 is a heavily modified version
  of Openwrt Kamikaze. One of the many modifications
  is to the sysupgrade program. Image verification is performed
  simply by the successful ungzip and untar of the supplied file
  and name check and header verification of the resulting contents.
  To form a factory.bin that is accepted by OEM Openwrt build,
  the kernel and rootfs must have specific names...

    openwrt-senao-eap600-uImage-lzma.bin
    openwrt-senao-eap600-root.squashfs

  and begin with the respective headers (uImage, squashfs).
  Then the files must be tarballed and gzipped.
  The resulting binary is actually a tar.gz file in disguise.
  This can be verified by using binwalk on the OEM firmware images,
  ungzipping then untaring.

  The OEM upgrade script is at /etc/fwupgrade.sh

  Later models in the EAP series likely have a different platform
  and the upgrade and image verification process differs.

  OKLI kernel loader is required because the OEM software
  expects the kernel to be no greater than 1536k
  and the factory.bin upgrade procedure would
  overwrite part of the kernel when writing rootfs.

Note on PLL-data cells:

  The default PLL register values will not work
  because of the external AR8035-A switch between
  the SOC and the ethernet PHY chips.

  For AR934x series, the PLL register for GMAC0
  can be seen in the DTSI as 0x2c.
  Therefore the PLL register can be read from uboot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x1805002c 1`.

  Unfortunately uboot did not have the best values
  so they were taken from other similar DTS files.

Tested from master, all link speeds functional

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2020-12-25 10:38:13 +01:00
Michael Pratt
4a55ef639d ath79: add support for Senao Engenius ECB600
FCC ID: A8J-ECB600

Engenius ECB600 is a wireless access point with 1 gigabit PoE ethernet port,
dual-band wireless, external ethernet switch, and 4 external antennas.

Specification:

  - AR9344 SOC			(5 GHz, 2x2, WMAC)
  - AR9382 WLAN			(2.4 GHz, 2x2, PCIe on-board)
  - AR8035-A switch		(GbE with 802.3af PoE)
  - 40 MHz reference clock
  - 16 MB FLASH			MX25L12845EMI-10G
  - 2x 64 MB RAM		NT5TU32M16DG
  - UART at H1			(populated)
  - 4 LEDs, 1 button		(power, eth, 2.4 GHz, 5 GHz) (reset)
  - 4 external antennas

MAC addresses:

  MAC addresses are labeled MAC1 and MAC2
  The MAC address in flash is not on the label
  The OEM software reports these MACs for the ifconfig

  phy1	MAC 1	*:52	---	(2.4 GHz)
  phy0	MAC 2	*:53	---	(5 GHz)
  eth0	-----	*:54	art 0x0

Installation:

  2 ways to flash factory.bin from OEM:

  - if you get Failsafe Mode from failed flash:
      only use it to flash Original firmware from Engenius
      or risk kernel loop or halt which requires serial cable

  Method 1: Firmware upgrade page:

    OEM webpage at 192.168.1.1
    username and password "admin"
    Navigate to "Upgrade Firmware" page from left pane
    Click Browse and select the factory.bin image
    Upload and verify checksum
    Click Continue to confirm and wait 3 minutes

  Method 2: Serial to load Failsafe webpage:

    After connecting to serial console and rebooting...
    Interrupt uboot with any key pressed rapidly
    execute `run failsafe_boot` OR `bootm 0x9fdf0000`
    wait a minute
    connect to ethernet and navigate to
    "192.168.1.1/index.htm"
    Select the factory.bin image and upload
    wait about 3 minutes

Return to OEM:

  If you have a serial cable, see Serial Failsafe instructions
  otherwise, uboot-env can be used to make uboot load the failsafe image

  *DISCLAIMER*
  The Failsafe image is unique to Engenius boards.
  If the failsafe image is missing or damaged this will not work
  DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt

  ssh into openwrt and run
  `fw_setenv rootfs_checksum 0`
  reboot, wait 3 minutes
  connect to ethernet and navigate to 192.168.1.1/index.htm
  select OEM firmware image from Engenius and click upgrade

Format of OEM firmware image:

  The OEM software of ECB600 is a heavily modified version
  of Openwrt Kamikaze. One of the many modifications
  is to the sysupgrade program. Image verification is performed
  simply by the successful ungzip and untar of the supplied file
  and name check and header verification of the resulting contents.
  To form a factory.bin that is accepted by OEM Openwrt build,
  the kernel and rootfs must have specific names...

    openwrt-senao-ecb600-uImage-lzma.bin
    openwrt-senao-ecb600-root.squashfs

  and begin with the respective headers (uImage, squashfs).
  Then the files must be tarballed and gzipped.
  The resulting binary is actually a tar.gz file in disguise.
  This can be verified by using binwalk on the OEM firmware images,
  ungzipping then untaring.

  The OEM upgrade script is at /etc/fwupgrade.sh

  Later models in the ECB series likely have a different platform
  and the upgrade and image verification process differs.

  OKLI kernel loader is required because the OEM software
  expects the kernel to be no greater than 1536k
  and the factory.bin upgrade procedure would
  overwrite part of the kernel when writing rootfs.

Note on PLL-data cells:

  The default PLL register values will not work
  because of the external AR8035-A switch between
  the SOC and the ethernet PHY chips.

  For AR934x series, the PLL register for GMAC0
  can be seen in the DTSI as 0x2c.
  Therefore the PLL register can be read from uboot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x1805002c 1`.

  Unfortunately uboot did not have the best values
  so they were taken from other similar DTS files.

Tested from master, all link speeds functional

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2020-12-25 10:38:13 +01:00
Michael Pratt
fe2f53f21c ath79: add support for Senao Engenius EnStationAC v1
FCC ID: A8J-ENSTAC

Engenius EnStationAC v1 is an outdoor wireless access point/bridge with
2 gigabit ethernet ports on 2 external ethernet switches,
5 GHz only wireless, internal antenna plates, and proprietery PoE.

Specification:

  - QCA9557 SOC
  - QCA9882 WLAN		(PCI card, 5 GHz, 2x2, 26dBm)
  - AR8035-A switch		(RGMII GbE with PoE+ IN)
  - AR8031 switch		(SGMII GbE with PoE OUT)
  - 40 MHz reference clock
  - 16 MB FLASH			MX25L12845EMI-10G
  - 2x 64 MB RAM		NT5TU32M16FG
  - UART at J10			(unpopulated)
  - internal antenna plates	(19 dbi, directional)
  - 7 LEDs, 1 button		(power, eth, wlan, RSSI) (reset)

MAC addresses:

  MAC addresses are labeled as ETH and 5GHz
  Vendor MAC addresses in flash are duplicate

  eth0	ETH	*:d3	art 0x0/0x6
  eth1	----	*:d4	---
  phy0	5GHz	*:d5	---

Installation:

  2 ways to flash factory.bin from OEM:

  - if you get Failsafe Mode from failed flash:
      only use it to flash Original firmware from Engenius
      or risk kernel loop or halt which requires serial cable

  Method 1: Firmware upgrade page:

    OEM webpage at 192.168.1.1
    username and password "admin"
    Navigate to "Firmware" page from left pane
    Click Browse and select the factory.bin image
    Upload and verify checksum
    Click Continue to confirm and wait 3 minutes

  Method 2: Serial to load Failsafe webpage:

    After connecting to serial console and rebooting...
    Interrupt uboot with any key pressed rapidly
    execute `run failsafe_boot` OR `bootm 0x9fd70000`
    wait a minute
    connect to ethernet and navigate to
    "192.168.1.1/index.htm"
    Select the factory.bin image and upload
    wait about 3 minutes

Return to OEM:

  If you have a serial cable, see Serial Failsafe instructions
  otherwise, uboot-env can be used to make uboot load the failsafe image

  *DISCLAIMER*
  The Failsafe image is unique to Engenius boards.
  If the failsafe image is missing or damaged this will not work
  DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt

  ssh into openwrt and run
  `fw_setenv rootfs_checksum 0`
  reboot, wait 3 minutes
  connect to ethernet and navigate to 192.168.1.1/index.htm
  select OEM firmware image from Engenius and click upgrade

TFTP recovery:

  rename initramfs to 'vmlinux-art-ramdisk'
  make available on TFTP server at 192.168.1.101
  power board
  hold or press reset button repeatedly

  NOTE: for some Engenius boards TFTP is not reliable
  try setting MTU to 600 and try many times

Format of OEM firmware image:

  The OEM software of EnStationAC is a heavily modified version
  of Openwrt Altitude Adjustment 12.09. One of the many modifications
  is to the sysupgrade program. Image verification is performed
  simply by the successful ungzip and untar of the supplied file
  and name check and header verification of the resulting contents.
  To form a factory.bin that is accepted by OEM Openwrt build,
  the kernel and rootfs must have specific names...

    openwrt-ar71xx-enstationac-uImage-lzma.bin
    openwrt-ar71xx-enstationac-root.squashfs

  and begin with the respective headers (uImage, squashfs).
  Then the files must be tarballed and gzipped.
  The resulting binary is actually a tar.gz file in disguise.
  This can be verified by using binwalk on the OEM firmware images,
  ungzipping then untaring.

  Newer EnGenius software requires more checks but their script
  includes a way to skip them, otherwise the tar must include
  a text file with the version and md5sums in a deprecated format.

  The OEM upgrade script is at /etc/fwupgrade.sh.

  OKLI kernel loader is required because the OEM software
  expects the kernel to be no greater than 1536k
  and the factory.bin upgrade procedure would otherwise
  overwrite part of the kernel when writing rootfs.

Note on PLL-data cells:

  The default PLL register values will not work
  because of the external AR8033 switch between
  the SOC and the ethernet PHY chips.

  For QCA955x series, the PLL registers for eth0 and eth1
  can be see in the DTSI as 0x28 and 0x48 respectively.
  Therefore the PLL registers can be read from uboot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x18050028 1` and `md 0x18050048 1`.

  For eth0 at 1000 speed, the value returned was
  ae000000 but that didn't work, so following
  the logical pattern from the rest of the values,
  the guessed value of a3000000 works better.

  later discovered that delay can be placed on the PHY end only
  with phy-mode as 'rgmii-id' and set register to 0x82...

Tested from master, all link speeds functional

Signed-off-by: Michael Pratt <mcpratt@pm.me>
[fixed SoB to match From:]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2020-12-22 19:11:50 +01:00
Sebastian Schaper
8ec997d006 ath79: add support for D-Link DAP-2660 A1
Specifications:
 * QCA9557, 16 MiB Flash, 128 MiB RAM, 802.11n 2T2R
 * QCA9882, 802.11ac 2T2R
 * Gigabit LAN Port (AR8035), 802.11af PoE

Installation:
 * Factory Web UI is at 192.168.0.50
   login with 'admin' and blank password, flash factory.bin
 * Recovery Web UI is at 192.168.0.50
   connect network cable, hold reset button during power-on and keep it
   pressed until uploading has started (only required when checksum is ok,
   e.g. for reverting back to oem firmware), flash factory.bin

After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.

Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
2020-12-22 19:11:50 +01:00
Roman Kuzmitskii
491ae3357e ath79: add support for Ubiquiti airCube AC
The Ubiquiti Network airCube AC is a cube shaped device supporting
2.4 GHz and 5 GHz with internal 2x2 MIMO antennas.
It can be powered with either one of:
 - 24v power supply with 3.0mm x 1.0mm barrel plug
 - 24v passive PoE on first LAN port
There are four 10/100/1000 Mbps ports (1 * WAN + 3 * LAN).
First LAN port have optional PoE passthrough to the WAN port.

SoC:       Qualcomm / Atheros AR9342
RAM:       64 MB DDR2
Flash:     16 MB SPI NOR
Ethernet:  4x 10/100/1000 Mbps (1 WAN + 3 LAN)
LEDS:      1x via a SPI controller (not yet supported)
Buttons:   1x Reset
Serial:    1x (only RX and TX); 115200 baud, 8N1

Missing features:
 - LED control is not supported

Physical to internal switch port mapping:
 - physical port #1 (poe in) = switchport 2
 - physical port #2 = switchport 3
 - physical port #3 = switchport 5
 - physical port #4 (wan/poe out) = switchport 4

Factory update is tested and is the same as for Ubiquiti AirCube ISP
hence the shared configuration between that devices.

Signed-off-by: Roman Kuzmitskii <damex.pp@icloud.com>
2020-12-22 19:11:50 +01:00
Sven Eckelmann
17e5920490 ath79: Add support for Plasma Cloud PA300E
Device specifications:

* Qualcomm/Atheros QCA9533 v2
* 650/600/217 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash (mx25l12805d)
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
  - eth0
    + Label: Ethernet 1
    + 24V passive POE (mode B)
    + used as WAN interface
  - eth1
    + Label: Ethernet 2
    + 802.3af POE
    + builtin switch port 2
    + used as LAN interface
* 12-24V 1A DC
* external antennas

Flashing instructions:

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the factory image to the u-boot when the device boots up.

Signed-off-by: Sven Eckelmann <sven@narfation.org>
2020-12-22 19:11:50 +01:00
Sven Eckelmann
5fc28ef479 ath79: Add support for Plasma Cloud PA300
Device specifications:

* Qualcomm/Atheros QCA9533 v2
* 650/600/217 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash (mx25l12805d)
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
  - eth0
    + Label: Ethernet 1
    + 24V passive POE (mode B)
    + used as WAN interface
  - eth1
    + Label: Ethernet 2
    + 802.3af POE
    + builtin switch port 2
    + used as LAN interface
* 12-24V 1A DC
* internal antennas

Flashing instructions:

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the factory image to the u-boot when the device boots up.

Signed-off-by: Sven Eckelmann <sven@narfation.org>
2020-12-22 19:11:50 +01:00
Michael Pratt
7073ebf0f9 ath79: add support for Senao Engenius ECB350 v1
FCC ID: A8J-ECB350

Engenius ECB350 v1 is an indoor wireless access point with a gigabit ethernet port,
2.4 GHz wireless, external antennas, and PoE.

**Specification:**

  - AR7242 SOC
  - AR9283 WLAN			2.4 GHz (2x2), PCIe on-board
  - AR8035-A switch		RGMII, GbE with 802.3af PoE
  - 40 MHz reference clock
  - 8 MB FLASH			25L6406EM2I-12G
  - 32 MB RAM
  - UART at J2			(populated)
  - 2 external antennas
  - 3 LEDs, 1 button		(power, lan, wlan) (reset)

**MAC addresses:**

  MACs are labeled as WLAN and WAN
  vendor MAC addresses in flash are duplicate

  phy0	WLAN	*:b8	---
  eth0	WAN	*:b9	art 0x0/0x6

**Installation:**

  - if you get Failsafe Mode from failed flash:
      only use it to flash Original firmware from Engenius
      or risk kernel loop or halt which requires serial cable

  Method 1: Firmware upgrade page:

  OEM webpage at 192.168.1.1
  username and password "admin"
  Navigate to "Firmware" page from left pane
  Click Browse and select the factory.bin image
  Upload and verify checksum
  Click Continue to confirm and wait 3 minutes

  Method 2: Serial to load Failsafe webpage:

  After connecting to serial console and rebooting...
  Interrupt uboot with any key pressed rapidly
  execute `run failsafe_boot` OR `bootm 0x9f670000`
  wait a minute
  connect to ethernet and navigate to
  "192.168.1.1/index.htm"
  Select the factory.bin image and upload
  wait about 3 minutes

**Return to OEM:**

  If you have a serial cable, see Serial Failsafe instructions
  otherwise, uboot-env can be used to make uboot load the failsafe image

  *DISCLAIMER*
  The Failsafe image is unique to Engenius boards.
  If the failsafe image is missing or damaged this will not work
  DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt

  ssh into openwrt and run
  `fw_setenv rootfs_checksum 0`
  reboot, wait 3 minutes
  connect to ethernet and navigate to 192.168.1.1/index.htm
  select OEM firmware image from Engenius and click upgrade

**TFTP recovery** (unstable / not reliable):

  rename initramfs to 'vmlinux-art-ramdisk'
  make available on TFTP server at 192.168.1.101
  power board while holding or pressing reset button repeatedly

  NOTE: for some Engenius boards TFTP is not reliable
  try setting MTU to 600 and try many times

**Format of OEM firmware image:**

  The OEM software of ECB350 v1 is a heavily modified version
  of Openwrt Kamikaze. One of the many modifications
  is to the sysupgrade program. Image verification is performed
  by the successful ungzip and untar of the supplied file
  and name check and header verification of the resulting contents.
  To form a factory.bin that is accepted by OEM Openwrt build,
  the kernel and rootfs must have specific names
  and begin with the respective headers (uImage, squashfs).
  Then the files must be tarballed and gzipped.
  The resulting binary is actually a tar.gz file in disguise.
  This can be verified by using binwalk on the OEM firmware images,
  ungzipping then untaring.

  The OEM upgrade script is at /etc/fwupgrade.sh.

  OKLI kernel loader is required because the OEM software
  expects the kernel size to be no greater than 1536k
  and otherwise the factory.bin upgrade procedure would
  overwrite part of the kernel when writing rootfs.
  The factory upgrade script follows the original mtd partitions.

**Note on PLL-data cells:**

  The default PLL register values will not work
  because of the AR8035 switch between
  the SOC and the ethernet port.

  For AR724x series, the PLL register for GMAC0
  can be seen in the DTSI as 0x2c.
  Therefore the PLL register can be read from u-boot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x1805002c 1`

  However the registers that u-boot sets are not ideal and sometimes wrong...
  the at803x driver supports setting the RGMII clock/data delay on the PHY side.
  This way the pll-data register only needs to handle invert and phase.

  for this board no extra adjustements are needed on the MAC side
  all link speeds functional

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2020-12-22 19:11:50 +01:00
Chen Minqiang
a1b5a43fc4 ath79: add support for GL.iNet GL-USB150
Add support for the ar71xx supported GL.iNet GL-USB150 to ath79.

GL.iNet GL-USB150 is an USB dongle WiFi router, based on Atheros AR9331.

Specification:

- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- Realtek RTL8152B USB to Ethernet bridge (connected with AR9331 PHY4)
- 1T1R 2.4 GHz
- 2x LED, 1x button
- UART header on PCB

Flash instruction:

Vendor software is based on openwrt so you can flash the sysupgrade
image via the vendor GUI or using command line sysupgrade utility.
Make sure to not save configuration over reflash as uci settings
differ between versions.

Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
2020-12-22 19:11:50 +01:00
Michael Pratt
73bdbb3d20 ath79: enable factory.bin and adjust profile of ECB1750
factory.bin was not tested for ECB1750...
but it was tested on it's sister board ECB1200

The product ID for the header can be verified by inspecting
the header of OEM images, or in the u-boot environment.

Also:

  - the LAN LED is controlled directly by the AR8035 switch
  - the labelled (first increment) MAC for both is ethaddr (eth0)
  - list packages in alphabetical order
  - use default sysupgrade.bin recipe

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2020-12-22 19:11:50 +01:00
Michael Pratt
f244143609 ath79: add support for Senao Engenius ECB1200
FCC ID: A8J-ECB1200

Engenius ECB1200 is an indoor wireless access point with a GbE port,
2.4 GHz and 5 GHz wireless, external antennas, and 802.3af PoE.

**Specification:**

  - QCA9557 SOC			MIPS, 2.4 GHz (2x2)
  - QCA9882 WLAN		PCIe card, 5 GHz (2x2)
  - AR8035-A switch		RGMII, GbE with 802.3af PoE, 25 MHz clock
  - 40 MHz reference clock
  - 16 MB FLASH			25L12845EMI-10G
  - 2x 64 MB RAM		1538ZFZ V59C1512164QEJ25
  - UART at JP1			(unpopulated, RX shorted to ground)
  - 4 external antennas
  - 4 LEDs, 1 button		(power, eth, wifi2g, wifi5g) (reset)

**MAC addresses:**

  MAC Addresses are labeled as ETH and 5GHZ
  U-boot environment has the vendor MAC addresses
  MAC addresses in ART do not match vendor

  eth0	ETH	*:5c	u-boot-env ethaddr
  phy0	5GHZ	*:5d	u-boot-env athaddr
  ----	----	????	art 0x0/0x6

**Installation:**

  Method 1: Firmware upgrade page:

  OEM webpage at 192.168.1.1
  username and password "admin"
  Navigate to "Firmware" page from left pane
  Click Browse and select the factory.bin image
  Upload and verify checksum
  Click Continue to confirm and wait 3 minutes

  Method 2: Serial to load Failsafe webpage:

  After connecting to serial console and rebooting...
  Interrupt uboot with any key pressed rapidly

  (see TFTP recovery)
  perform a sysupgrade

**Serial Access:**

  the RX line on the board for UART is shorted to ground by resistor R176
  therefore it must be removed to use the console
  but it is not necessary to remove to view boot log
  optionally, R175 can be replaced with a solder bridge short

  the resistors R175 and R176 are next to the UART pinout at JP1

**Return to OEM:**

  If you have a serial cable, see Serial Failsafe instructions

  Unlike most Engenius boards, this does not have a 'failsafe' image
  the only way to return to OEM is TFTP or serial access to u-boot

**TFTP recovery:**

  Unlike most Engenius boards, TFTP is reliable here

  rename initramfs-kernel.bin to 'ap.bin'
  make the file available on a TFTP server at 192.168.1.10
  power board while holding or pressing reset button repeatedly

  or with serial access:
  run `tftpboot` or `run factory_boot` with initramfs-kernel.bin
  then `bootm` with the load address

**Format of OEM firmware image:**

  The OEM software of ECB1200 is a heavily modified version
  of Openwrt Altitude Adjustment 12.09.

  This Engenius board, like ECB1750, uses a proprietary header
  with a unique Product ID. The header for factory.bin is
  generated by the mksenaofw program included in openwrt.

**Note on PLL-data cells:**

  The default PLL register values will not work
  because of the AR8035 switch between
  the SOC and the ethernet port.

  For QCA955x series, the PLL registers for eth0 and eth1
  can be see in the DTSI as 0x28 and 0x48 respectively.
  Therefore the PLL registers can be read from uboot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x18050028 1` and `md 0x18050048 1`.

  However the registers that u-boot sets are not ideal and sometimes wrong...
  the at803x driver supports setting the RGMII clock/data delay on the PHY side.
  This way the pll-data register only needs to handle invert and phase.

  for this board clock invert is needed on the MAC side
  all link speeds functional

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2020-12-22 19:11:50 +01:00
Tomasz Maciej Nowak
0d96d36841 ath79: add support for AirTight C-75
AirTight Networks (later renamed to Mojo Networks) C-75 is a dual-band
access point, also sold by WatchGuard under name AP320.

Specification
SoC: Qualcomm Atheros QCA9550
RAM: 128 MiB DDR2
Flash: 2x 16 MiB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
      5 GHz 3T3R QCA9890 oversized Mini PCIe card
Ethernet: 2x 10/100/1000 Mbps QCA8334
          port labeled LAN1 is PoE capable (802.3at)
USB: 1x 2.0
LEDs: 7x which two are GPIO controlled, four switch controlled, one
      controlled by wireless driver
Buttons: 1x GPIO controlled
Serial: RJ-45 port, Cisco pinout
        baud: 115200, parity: none, flow control: none
JTAG: Yes, pins marked J1 on PCB

Installation
1. Prepare TFTP server with OpenWrt initramfs-kernel image.
2. Connect to one of LAN ports.
3. Connect to serial port.
4. Power on the device and when prompted to stop autoboot, hit any key.
5. Adjust "ipaddr" and "serverip" addresses in U-Boot environment, use
   'setenv' to do that, then run following commands:
    tftpboot 0x81000000 <openwrt_initramfs-kernel_image_name>
    bootm 0x81000000
6. Wait about 1 minute for OpenWrt to boot.
7. Transfer OpenWrt sysupgrade image to /tmp directory and flash it
   with:
    sysupgrade -n /tmp/<openwrt_sysupgrade_image_name>
8. After flashing, the access point will reboot to OpenWrt. Wait few
   minutes, until the Power LED stops blinking, then it's ready for
   configuration.

Known issues
Green power LED does not work.

Additional information
The U-Boot fails to initialise ethernet ports correctly when a UART
adapter is attached to UART pins (marked J3 on PCB).

Cc: Vladimir Georgievsky <vladimir.georgievsky@yahoo.com>
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
2020-12-19 19:42:00 +01:00
Martin Blumenstingl
b403a6e124 ath79: add support for the Belkin F9K1115 v2 (AC1750 DB Wi-Fi)
This device has (almost?) identical hardware to the F9J1108 v2 but uses
a different firmware magic and model number.

Specifications:

SoC: QCA9558
CPU: 720 MHz
Flash: 16 MiB NOR
RAM: 128 MiB
WiFi 2.4 GHz: QCA9558-AT4A 3x3 MIMO 802.11b/g/n
WiFi 5 GHz: QCA9880-2R4E 3x3 MIMO 802.11a/n/ac
Ethernet: 4x LAN and 1x WAN (all 1Gbit/s ports)
USB: 1 x USB 2.0 (lower), 1 x USB 3.0 (upper)

MAC addresses based on OEM firmware:

Interface   Address   Location
---------   -------   --------
lan         *:5A      sometimes in 0x6
wan         *:5B      0x0
2.4Ghz      *:5A      0x1002
5Ghz        As per mini PCIe EEPROM

Flashing instructions:

The factory.bin can be flashed via the Belkin web UI or via the uboot
HTTP upgrade page (which is by default listening on 192.168.2.1). Once
the factory.bin has been written, sysupgrade.bin will work as usual.

Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
2020-12-14 16:59:49 +01:00
Damien Mascord
b9971db7c3 ath79: add support for Belkin F9J1108v2 (AC1750 DB Wi-Fi)
This device is the non-US build of the F9K1115 v2, with a different
firmware magic.

Specifications:

SoC: QCA9558
CPU: 720 MHz
Flash: 16 MiB NOR
RAM: 128 MiB
WiFi 2.4 GHz: QCA9558-AT4A 3x3 MIMO 802.11b/g/n
WiFi 5 GHz: QCA9880-2R4E 3x3 MIMO 802.11a/n/ac
Ethernet: 4x LAN and 1x WAN (all 1gbps)
USB: 1 x USB 2.0 (lower), 1 x USB 3.0 (upper)

MAC addresses based on OEM firmware:

Interface   Address   Location
---------   -------   --------
lan         *:5A      sometimes in 0x6
wan         *:5B      0x0
2.4Ghz      *:5A      0x1002
5Ghz        As per mini PCIe EEPROM

Flashing instructions:

The factory.bin can be flashed via the Belkin web UI or via the uboot
http upgrade page.
Once the factory.bin has been written, sysupgrade.bin will work as usual.

Signed-off-by: Damien Mascord <tusker@tusker.org>
Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
[wrap commit message/code, adjust label-mac-device, whitespace fixes,
merge block in 02_network]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-07 14:22:00 +01:00
Adrian Schmutzler
33c27ccf4a ath79: add support for TP-Link TL-WDR7500 v3
This ports support for the TP-Link TL-WDR7500 v3 from ar71xx to ath79.

The basic features appear to be identical to the Archer C7 v1, however
it has the (supported) QCA9880-BR4A chip of the C7 v2.

Specifications:

  SoC:       QCA9558
  CPU:       720 MHz
  Flash:     8 MiB
  RAM:       128 MiB
  WLAN:      2.4 GHz b/g/n, 5 GHz a/n/ac
             Qualcomm Atheros QCA9880-BR4A
  Ethernet:  5x Gbit ports
  USB:       2x 2.0 ports

Flashing instructions:

Upload the factory image via the OEM firmware GUI.

TFTP recovery appears to be available as well.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-04 18:21:08 +01:00
Tomasz Maciej Nowak
760952ad02 ath79: restore sysupgrade support for ja76pf2 and routerstations
Because the bug described in FS#2428 has been fixed with bf2870c1d9
("kernel: fix mtd partition erase < parent_erasesize writes") these
devices can now safely do sysupgrade.

Restore sysupgrade support disabled in:

0cc87b3bac ("ath79: image: disable sysupgrade images for routerstations
and ja76pf2")

cc5256a8bf ("ath79: base-files: disable sysupgrade for routerstations
and ja76pf2")

Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
[move Build block, remove check-size argument, wrap sysupgrade line,
make commit message easier to read]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-01 20:03:15 +01:00
Michael Pratt
b31aaa0580 ath79: add support for Senao Engenius EAP300 v2
FCC ID: A8J-EAP300A

Engenius EAP300 v2 is an indoor wireless access point with a
100/10-BaseT ethernet port, 2.4 GHz wireless, internal antennas,
and 802.3af PoE.

**Specification:**

  - AR9341
  - 40 MHz reference clock
  - 16 MB FLASH			MX25L12845EMI-10G
  - 64 MB RAM
  - UART at J1			(populated)
  - Ethernet port with POE
  - internal antennas
  - 3 LEDs, 1 button		(power, eth, wlan) (reset)

**MAC addresses:**

  phy0  *:d3   art 0x1002 (label)
  eth0  *:d4   art 0x0/0x6

**Installation:**

  - if you get Failsafe Mode from failed flash:
      only use it to flash Original firmware from Engenius
      or risk kernel loop or halt which requires serial cable

  Method 1: Firmware upgrade page:

  OEM webpage at 192.168.1.1
  username and password "admin"
  Navigate to "Firmware" page from left pane
  Click Browse and select the factory.bin image
  Upload and verify checksum
  Click Continue to confirm and wait 3 minutes

  Method 2: Serial to load Failsafe webpage:

  After connecting to serial console and rebooting...
  Interrupt uboot with any key pressed rapidly
  execute `run failsafe_boot` OR `bootm 0x9fdf0000`
  wait a minute
  connect to ethernet and navigate to
  "192.168.1.1/index.htm"
  Select the factory.bin image and upload
  wait about 3 minutes

**Return to OEM:**

  If you have a serial cable, see Serial Failsafe instructions

  *DISCLAIMER*
  The Failsafe image is unique to Engenius boards.
  If the failsafe image is missing or damaged this will not work
  DO NOT downgrade to ar71xx this way, can cause kernel loop or halt

  The easiest way to return to the OEM software is the Failsafe image
  If you dont have a serial cable, you can ssh into openwrt and run

  `mtd -r erase fakeroot`

  Wait 3 minutes
  connect to ethernet and navigate to 192.168.1.1/index.htm
  select OEM firmware image from Engenius and click upgrade

**TFTP recovery** (unstable / not reliable):

  rename initramfs to 'vmlinux-art-ramdisk'
  make available on TFTP server at 192.168.1.101
  power board while holding or pressing reset button repeatedly

  NOTE: for some Engenius boards TFTP is not reliable
  try setting MTU to 600 and try many times

**Format of OEM firmware image:**

  The OEM software of EAP300 v2 is a heavily modified version
  of Openwrt Kamikaze. One of the many modifications
  is to the sysupgrade program. Image verification is performed
  simply by the successful ungzip and untar of the supplied file
  and name check and header verification of the resulting contents.
  To form a factory.bin that is accepted by OEM Openwrt build,
  the kernel and rootfs must have specific names
  and begin with the respective headers (uImage, squashfs).
  Then the files must be tarballed and gzipped.
  The resulting binary is actually a tar.gz file in disguise.
  This can be verified by using binwalk on the OEM firmware images,
  ungzipping then untaring.

  The OEM upgrade script is at /etc/fwupgrade.sh.

  OKLI kernel loader is required because the OEM software
  expects the kernel size to be no greater than 1536k
  and otherwise the factory.bin upgrade procedure would
  overwrite part of the kernel when writing rootfs.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
[clarify MAC address section, bump PKG_RELEASE for uboot-envtools]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-11-25 13:23:06 +01:00
Sander Vanheule
b0ecae504b ath79: support for TP-Link EAP225 v3
TP-Link EAP225 v3 is an AC1350 (802.11ac Wave-2) ceiling mount access
point. Serial port access for debricking requires fine soldering.

Device specifications:
* SoC: QCA9563 @ 775MHz
* RAM: 128MiB DDR2
* Flash: 16MiB SPI-NOR
* Wireless 2.4GHz (SoC): b/g/n, 3x3
* Wireless 5Ghz (QCA9886): a/n/ac, 2x2 MU-MINO
* Ethernet (AR8033): 1× 1GbE, 802.3at PoE

Flashing instructions:
* ssh into target device and run `cliclientd stopcs`
* Upgrade with factory image via web interface

Debricking:
* Serial port can be soldered on PCB J3 (1: TXD, 2: RXD, 3: GND, 4: VCC)
    * Bridge unpopulated resistors R225 (TXD) and R237 (RXD).
      Do NOT bridge R230.
    * Use 3.3V, 115200 baud, 8n1
* Interrupt bootloader by holding CTRL+B during boot
* tftp initramfs to flash via LuCI web interface
    setenv ipaddr 192.168.1.1 # default, change as required
    setenv serverip 192.168.1.10 # default, change as required
    tftp 0x80800000 initramfs.bin
    bootelf $fileaddr

MAC addresses:
MAC address (as on device label) is stored in device info partition at
an offset of 8 bytes. ath9k device has same address as ethernet, ath10k
uses address incremented by 1.
From OEM boot log:

    Using interface ath0 with hwaddr b0:...:3e and ssid "..."
    Using interface ath10 with hwaddr b0:...:3f and ssid "..."

Tested by forum user blinkstar88

Signed-off-by: Sander Vanheule <sander@svanheule.net>
2020-11-23 22:53:15 +01:00
Sander Vanheule
4f86edf477 ath79: support for TP-Link EAP225-Outdoor v1
TP-Link EAP225-Outdoor v1 is an AC1200 (802.11ac Wave-2) pole or wall
mount access point. Debricking requires access to the serial port, which
is non-trivial.

Device specifications:
* SoC: QCA9563 @ 775MHz
* Memory: 128MiB DDR2
* Flash: 16MiB SPI-NOR
* Wireless 2.4GHz (SoC): b/g/n 2x2
* Wireless 5GHz (QCA9886): a/n/ac 2x2 MU-MIMO
* Ethernet (AR8033): 1× 1GbE, PoE

Flashing instructions:
* ssh into target device with recent (>= v1.6.0) firmware
* run `cliclientd stopcs` on target device
* upload factory image via web interface

Debricking:
To recover the device, you need access to the serial port. This requires
fine soldering to test points, or the use of probe pins.
* Open the case and solder wires to the test points: RXD, TXD and TPGND4
  * Use a 3.3V UART, 115200 baud, 8n1
* Interrupt bootloader by holding ctrl+B during boot
* upload initramfs via built-in tftp client and perform sysupgrade
    setenv ipaddr 192.168.1.1 # default, change as required
    setenv serverip 192.168.1.10 # default, change as required
    tftp 0x80800000 initramfs.bin
    bootelf $fileaddr

MAC addresses:
MAC address (as on device label) is stored in device info partition at
an offset of 8 bytes. ath9k device has same address as ethernet, ath10k
uses address incremented by 1.
From stock ifconfig:

    ath0      Link encap:Ethernet  HWaddr D8:...:2E
    ath10     Link encap:Ethernet  HWaddr D8:...:2F
    br0       Link encap:Ethernet  HWaddr D8:...:2E
    eth0      Link encap:Ethernet  HWaddr D8:...:2E

Tested by forum user PolynomialDivision on firmware v1.7.0.
UART access tested by forum user arinc9.

Signed-off-by: Sander Vanheule <sander@svanheule.net>
2020-11-23 22:53:15 +01:00
Sander Vanheule
b11ad48764 ath79: support for TP-Link EAP245 v1
TP-Link EAP245 v1 is an AC1750 (802.11ac Wave-1) ceiling mount access point.

Device specifications:
* SoC: QCA9563 @ 775MHz
* RAM: 128MiB DDR2
* Flash: 16MiB SPI-NOR
* Wireless 2.4GHz (SoC): b/g/n, 3x3
* Wireless 5Ghz (QCA9880): a/n/ac, 3x3
* Ethernet (AR8033): 1× 1GbE, 802.3at PoE

Flashing instructions:
* Upgrade the device to firmware v1.4.0 if necessary
* Exploit the user management page in the web interface to start telnetd
  by changing the username to `;/usr/sbin/telnetd -l/bin/sh&`.
* Immediately change the malformed username back to something valid
  (e.g. 'admin') to make ssh work again.
* Use the root shell via telnet to make /tmp world writeable (chmod 777)
* Extract /usr/bin/uclited from the device via ssh and apply the binary
  patch listed below. The patch is required to prevent `uclited -u` in
  the last step from crashing.
* Copy the patched uclited programme back to the device at /tmp/uclited
  (via ssh)
* Upload the factory image to /tmp/upgrade.bin (via ssh)
* Run `chmod +x /tmp/uclited && /tmp/uclited -u` to install OpenWrt.

    --- xxd uclited
    +++ xxd uclited-patched
    @@ -53796,7 +53796,7 @@
     000d2240: 8c44 0000 0320 f809 0000 0000 8fbc 0010  .D... ..........
     000d2250: 8fa6 0a4c 02c0 2821 8f82 87b8 0000 0000  ...L..(!........
    -000d2260: 8c44 0000 0c13 45e0 27a7 0018 8fbc 0010  .D....E.'.......
    +000d2260: 8c44 0000 2402 0000 0000 0000 8fbc 0010  .D..$...........
     000d2270: 1040 001d 0000 1821 8f99 8374 3c04 0058  .@.....!...t<..X
     000d2280: 3c05 0056 2484 a898 24a5 9a30 0320 f809  <..V$...$..0. ..

Debricking:
* Serial port can be soldered on PCB J3 (1: TXD, 2: RXD, 3: GND, 4: VCC)
    * Bridge unpopulated resistors R225 (TXD) and R237 (RXD).
      Do NOT bridge R230.
    * Use 3.3V, 115200 baud, 8n1
* Interrupt bootloader by holding CTRL+B during boot
* tftp initramfs to flash via the LuCI web interface
    setenv ipaddr 192.168.1.1 # default, change as required
    setenv serverip 192.168.1.10 # default, change as required
    tftp 0x80800000 initramfs.bin
    bootelf $fileaddr

Tested on the EAP245 v1 running the latest firmware (v1.4.0). The binary
patch might not apply to uclited from other firmware versions.

EAP245 v1 device support was originally developed and maintained by
Julien Dusser out-of-tree. This patch and "ath79: prepare for 1-port
TP-Link EAP2x5 devices" are based on that work.

Signed-off-by: Sander Vanheule <sander@svanheule.net>
2020-11-23 22:53:15 +01:00
Rui Salvaterra
eb087ae4f4 ath79: move the squashfs feature to the parent target
All subtargets define it. Move it to the parent target and remove
it from all subtargets.

Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
2020-11-23 13:20:53 +01:00
Piotr Dymacz
64a6f4a9c1 ath79: add support for ALFA Network Pi-WiFi4
ALFA Network Pi-WiFi4 is a Qualcomm QCA9531 v2 based, high-power 802.11n
WiFi board in Raspberry Pi 3B shape, equipped with 1x FE and 4x USB 2.0.

Specifications:

- Qualcomm/Atheros QCA9531 v2
- 650/400/200 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16+ MB of flash (SPI NOR)
- 1x 10/100 Mbps Ethernet
- 2T2R 2.4 GHz Wi-Fi with Qorvo RFFM8228P FEM
- 2x IPEX/U.FL connectors on PCB
- 4x USB 2.0 Type-A
- Genesys Logic GL850G 4-port USB HUB
- USB power is controlled by GPIO
- 5x LED (3x on PCB, 2x in RJ45, 4x driven by GPIO)
- 1x button (reset)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- 1x micro USB Type-B for power and system console (Holtek HT42B534)
- UART and GPIO (8-pin, 1.27 mm pitch) header on PCB

Flash instruction:

You can use sysupgrade image directly in vendor firmware which is based
on LEDE/OpenWrt. Alternatively, you can use web recovery mode in U-Boot:

1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
   device, wait for first blink of all LEDs (indicates network setup),
   then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.

Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-11-18 23:49:34 +01:00
Piotr Dymacz
d44463b087 ath79: add label MAC address for ALFA Network N5Q
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-11-18 23:49:34 +01:00
Nick Hainke
79f3f1358b ath79: Add support for Ubiquiti NanoBeam AC Gen2
CPU:         Atheros AR9342 rev 3 SoC
RAM:         64 MB DDR2
Flash:       16 MB NOR SPI
WLAN 2.4GHz: Atheros AR9342 v3 (ath9k)
WLAN 5.0GHz: QCA988X
Ports:       2x GbE

Flashing procedure is identical to other ubnt devices.
https://openwrt.org/toh/ubiquiti/common

Flashing through factory firmware
1. Ensure firmware version v8.7.0 is installed.
   Up/downgrade to this exact version.
2. Patch fwupdate.real binary using
   `hexdump -Cv /bin/ubntbox | sed 's/14 40 fe 27/00 00 00 00/g' | \
    hexdump -R > /tmp/fwupdate.real`
3. Make the patched fwupdate.real binary executable using
   `chmod +x /tmp/fwupdate.real`
4. Copy the squashfs factory image to /tmp on the device
5. Flash OpenWrt using `/tmp/fwupdate.real -m <squashfs-factory image>`
6. Wait for the device to reboot
(copied from Ubiquiti NanoBeam AC and modified)

To keep it consistent, we will add the gen1 variant to
the nanobeam ac gen1.

Signed-off-by: Nick Hainke <vincent@systemli.org>
2020-11-18 21:13:46 +01:00
Adrian Schmutzler
aafbfc6ac3 ath79: fix missing ";;" in 11-ath10k-caldata
This adds a missing ";;" in the switch-case in 11-ath10k-caldata.

Fixes: 4d36569b9c ("ath79: fix ath10k caldata extraction on some
D-Link DIR-842 C3 devices")

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-11-16 19:26:25 +01:00
Paul Fertser
4d36569b9c ath79: fix ath10k caldata extraction on some D-Link DIR-842 C3 devices
According to forum threads [0][1] and a report on IRC by Doc-Saintly
some of those boards have calibration data in a different place. Only
one alternative location is known.

Without proper board calibration data (board.bin having all 0xff bytes)
ath10k firmware still tries to load but crashes on startup with a
confusing error message.

If you're applying this patch manually on your device do not forget to
remove /lib/firmware/ath10k/pre-cal-pci-0000:00:00.0.bin and reboot to
force caldata re-extraction.

[0] https://forum.openwrt.org/t/support-for-d-link-dir842-rev-c3/41654
[1] https://forum.openwrt.org/t/d-link-dir-842-cant-access-firmware-upload-form/65454

Signed-off-by: Paul Fertser <fercerpav@gmail.com>
2020-11-16 14:05:24 +01:00
张鹏
448de2e2e5 ath79: add support for Qxwlan E600G v2 / E600GAC v2
E600G v2 based on Qualcomm/Atheros QCA9531

Specification:

 - 650/600/200 MHz (CPU/DDR/AHB)
 - 128/64 MB of RAM (DDR2)
 - 8/16 MB of FLASH (SPI NOR)
 - 2T2R 2.4 GHz
 - 2 x 10/100 Mbps Ethernet(RJ45)
 - 1 x MiniPCI-e
 - 1 x SIM (3G/4G)
 - 5 x LED , 1 x Button(SW2-Reset Buttun), 1 x power input
 - UART(J100) header on PCB(115200 8N1)

E600GAC v2 based on Qualcomm/Atheros QCA9531 + QCA9887

Specification:

 - 650/600/200 MHz (CPU/DDR/AHB)
 - 128/64 MB of RAM (DDR2)
 - 8/16 MB of FLASH (SPI NOR)
 - 2T2R 2.4 GHz
 - 1T1R 5 GHz
 - 2 x 10/100 Mbps Ethernet(RJ45)
 - 6 x LED (one three-color led), 2 x Button(SW2-Reset Buttun),1 x power input
 - UART (J100)header on PCB(115200 8N1)

Flash instruction:

1.Using tftp mode with UART connection and original OpenWrt image
 - Configure PC with static IP 192.168.1.10 and tftp server.
 - Rename "openwrt-ath79-generic-xxx-squashfs-sysupgrade.bin"
   to "firmware.bin" and place it in tftp server directory.
 - Connect PC with one of LAN ports, power up the router and press
   key "Enter" to access U-Boot CLI.
 - Use the following commands to update the device to OpenWrt:
   run lfw
 - After that the device will reboot and boot to OpenWrt.
 - Wait until all LEDs stops flashing and use the router.

2.Using httpd mode with Web UI connection and original OpenWrt image
 - Configure PC with static IP 192.168.1.xxx(2-255) and tftp server.
 - Connect PC with one of LAN ports,press the reset button, power up
   the router and keep button pressed for around 6-7 seconds, until
   leds flashing.
 - Open your browser and enter 192.168.1.1,You will see the upgrade
   interface, select "openwrt-ath79-generic-xxx-squashfs-
   sysupgrade.bin" and click the upgrade button.
 - After that the device will reboot and boot to OpenWrt.
 - Wait until all LEDs stops flashing and use the router.

Signed-off-by: 张鹏 <sd20@qxwlan.com>
[rearrange in generic.mk, fix one case in 04_led_migration, update
commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-11-12 17:18:26 +01:00
David Bauer
4c5eb1040f ath79: use correct firmware name for UniFi AP
The Ubiquiti UniFi AP does not have a AHB connected radio but a PCI one.
Also the EEPROM ist only 0x440 bytes of length.

Reported-by: Martin Weinelt <martin@darmstadt.freifunk.net>
Tested-by: Martin Weinelt <martin@darmstadt.freifunk.net>
Signed-off-by: David Bauer <mail@david-bauer.net>
2020-11-01 15:30:05 +01:00
David Bauer
d011952d19 ath79: remove AT803X config symbol from subtargets
The AT803X_PHY kernel config symbol is already enabled target-wide. SO
it does not have to be enabled for individual subtargets.

Signed-off-by: David Bauer <mail@david-bauer.net>
2020-11-01 15:29:58 +01:00
Adrian Schmutzler
8087499ac5 ath79: enable upgrade from ar71xx for Qxwlan devices
This supports upgrade from ar71xx for the recently added Qxwlan
devices E1700AC v2, E558 v2, E750A v4 and E750G v8.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-10-26 21:07:22 +01:00
张鹏
4ff7bdfeeb ath79: add support for Qxwlan E1700AC v2
E1700AC v2 based on Qualcomm/Atheros QCA9563 + QCA9880.

Specification:

 - 750/400/250 MHz (CPU/DDR/AHB)
 - 128 MB of RAM (DDR2)
 - 8/16 MB of FLASH (SPI NOR)
 - 3T3R 2.4 GHz
 - 3T3R 5 GHz
 - 2 x 10/1000M Mbps Ethernet (RJ45)
 - 1 x MiniPCI-e
 - 1 x SIM (3G/4G)
 - 1 x USB 2.0 Port
 - 5 x LED , 2 x Button(S8-Reset Buttun), 1 x power input
 - UART (J5) header on PCB (115200 8N1)

Flash instruction:

   1.Using tftp mode with UART connection and original LEDE image
      - Configure PC with static IP 192.168.1.10 and tftp server.
      - Rename "openwrt-ar71xx-generic-xxx-squashfs-sysupgrade.bin"
        to "firmware.bin" and place it in tftp server directory.
      - Connect PC with one of LAN ports, power up the router and press
        key "Enter" to access U-Boot CLI.
      - Use the following commands to update the device to LEDE:
        run lfw
      - After that the device will reboot and boot to LEDE.
      - Wait until all LEDs stops flashing and use the router.

   2.Using httpd mode with Web UI connection and original LEDE image
      - Configure PC with static IP 192.168.1.xxx(2-255) and tftp server.
      - Connect PC with one of LAN ports,press the reset button, power up
        the router and keep button pressed for around 6-7 seconds, until
        leds flashing.
      - Open your browser and enter 192.168.1.1,You will see the upgrade
        interface, select "openwrt-ar71xx-generic-xxx-squashfs-
        sysupgrade.bin" and click the upgrade button.
      - After that the device will reboot and boot to LEDE.
      - Wait until all LEDs stops flashing and use the router.

Signed-off-by: 张鹏 <sd20@qxwlan.com>
[cut out of bigger patch, keep swconfig, whitespace fixes]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-10-17 20:18:00 +02:00
张鹏
987d9028e1 ath79: add support for Qxwlan E558 v2
Qxwlan E558 v2 is based on Qualcomm QCA9558 + AR8327.

Specification:

 - 720/600/200 MHz (CPU/DDR/AHB)
 - 128 MB of RAM (DDR2)
 - 8/16 MB of FLASH (SPI NOR)
 - 2T2R 2.4 GHz (QCA9558)
 - 3x 10/100/1000 Mbps Ethernet (one port with PoE support)
 - 4x miniPCIe slot (USB 2.0 bus only)
 - 1x microSIM slot
 - 5x LED (4 driven by GPIO)
 - 1x button (reset)
 - 1x 3-pos switch
 - 1x DC jack for main power input (9-48 V)
 - UART (JP5) and LEDs (J8) headers on PCB

Flash instruction:

   1.Using tftp mode with UART connection and original LEDE image
      - Configure PC with static IP 192.168.1.10 and tftp server.
      - Rename "openwrt-ar71xx-generic-xxx-squashfs-sysupgrade.bin"
        to "firmware.bin" and place it in tftp server directory.
      - Connect PC with one of LAN ports, power up the router and press
        key "Enter" to access U-Boot CLI.
      - Use the following commands to update the device to LEDE:
        run lfw
      - After that the device will reboot and boot to LEDE.
      - Wait until all LEDs stops flashing and use the router.

   2.Using httpd mode with Web UI connection and original LEDE image
      - Configure PC with static IP 192.168.1.xxx(2-255) and tftp server.
      - Connect PC with one of LAN ports,press the reset button, power up
        the router and keep button pressed for around 6-7 seconds, until
        leds flashing.
      - Open your browser and enter 192.168.1.1,You will see the upgrade
        interface, select "openwrt-ar71xx-generic-xxx-squashfs-
        sysupgrade.bin" and click the upgrade button.
      - After that the device will reboot and boot to LEDE.
      - Wait until all LEDs stops flashing and use the router.

Signed-off-by: 张鹏 <sd20@qxwlan.com>
[cut out of bigger patch, keep swconfig, whitespace adjustments]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-10-17 20:17:59 +02:00
张鹏
27a7d071c0 ath79: add support for Qxwlan E750G v8
Qxwlan E750G v8 is based on Qualcomm QCA9344 + QCA9334.

Specification:

 - 560/450/225 MHz (CPU/DDR/AHB)
 - 128 MB of RAM (DDR2)
 - 8/16 MB of FLASH (SPI NOR)
 - 2T2R 2.4G GHz (AR9344)
 - 2x 10/100/1000 Mbps Ethernet (one port with PoE support)
 - 7x LED (6 driven by GPIO)
 - 1x button (reset)
 - 1x DC jack for main power input (9-48 V)
 - UART (J23) and LEDs (J2) headers on PCB

Flash instruction:

   1.Using tftp mode with UART connection and original LEDE image
      - Configure PC with static IP 192.168.1.10 and tftp server.
      - Rename "openwrt-ar71xx-generic-xxx-squashfs-sysupgrade.bin"
        to "firmware.bin" and place it in tftp server directory.
      - Connect PC with one of LAN ports, power up the router and press
        key "Enter" to access U-Boot CLI.
      - Use the following commands to update the device to LEDE:
        run lfw
      - After that the device will reboot and boot to LEDE.
      - Wait until all LEDs stops flashing and use the router.

   2.Using httpd mode with Web UI connection and original LEDE image
      - Configure PC with static IP 192.168.1.xxx(2-255) and tftp server.
      - Connect PC with one of LAN ports,press the reset button, power up
        the router and keep button pressed for around 6-7 seconds, until
        leds flashing.
      - Open your browser and enter 192.168.1.1,You will see the upgrade
        interface, select "openwrt-ar71xx-generic-xxx-squashfs-
        sysupgrade.bin" and click the upgrade button.
      - After that the device will reboot and boot to LEDE.
      - Wait until all LEDs stops flashing and use the router.

Signed-off-by: 张鹏 <sd20@qxwlan.com>
[cut out of bigger patch, keep swconfig]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-10-17 20:17:59 +02:00
Peng Zhang
5666ca913a ath79: add support for Qxwlan E750A v4
Qxwlan E750A v4 is based on Qualcomm QCA9344.

Specification:

 - 560/450/225 MHz (CPU/DDR/AHB)
 - 128 MB of RAM (DDR2)
 - 8/16 MB of FLASH (SPI NOR)
 - 2T2R 5G GHz (AR9344)
 - 2x 10/100 Mbps Ethernet (one port with PoE support)
 - 1x miniPCIe slot (USB 2.0 bus only)
 - 7x LED (6 driven by GPIO)
 - 1x button (reset)
 - 1x DC jack for main power input (9-48 V)
 - UART (J23) and LEDs (J2) headers on PCB

Flash instruction:

   1.Using tftp mode with UART connection and original LEDE image
      - Configure PC with static IP 192.168.1.10 and tftp server.
      - Rename "openwrt-ar71xx-generic-xxx-squashfs-sysupgrade.bin"
        to "firmware.bin" and place it in tftp server directory.
      - Connect PC with one of LAN ports, power up the router and press
        key "Enter" to access U-Boot CLI.
      - Use the following commands to update the device to LEDE:
        run lfw
      - After that the device will reboot and boot to LEDE.
      - Wait until all LEDs stops flashing and use the router.

   2.Using httpd mode with Web UI connection and original LEDE image
      - Configure PC with static IP 192.168.1.xxx(2-255) and tftp server.
      - Connect PC with one of LAN ports,press the reset button, power up
        the router and keep button pressed for around 6-7 seconds, until
        leds flashing.
      - Open your browser and enter 192.168.1.1,You will see the upgrade
        interface, select "openwrt-ar71xx-generic-xxx-squashfs-
        sysupgrade.bin" and click the upgrade button.
      - After that the device will reboot and boot to LEDE.
      - Wait until all LEDs stops flashing and use the router.

Signed-off-by: Peng Zhang <sd20@qxwlan.com>
[cut out of bigger patch, alter use of DEVICE_VARIANT, merge case
in 01_leds, use lower case for v4]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-10-15 18:52:39 +02:00
Roman Kuzmitskii
582ba9ddc7 ath79: rename ubnt,acb-isp to ubnt,aircube-isp
Use the full model name for this device to make it easier to
recognize for the users and in order to make it consistent with
the other devices.

While at it, fix sorting in 03_gpio_switches.

Signed-off-by: Roman Kuzmitskii <damex.pp@icloud.com>
[commit message facelift]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-10-06 15:13:27 +02:00
Adrian Schmutzler
e3af1666f4 ath79: rename TP-Link TL-WPA8630P v2 (EU) to v2.0 (EU)
Since we have a v2.1 (EU) with different partitioning now, rename
the v2.0 to make the difference visible to the user more directly.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-10-04 15:44:05 +02:00
Joe Mullally
7422c7a6fa ath79: add support for TP-Link TL-WPA8630P (EU) v2.1
This adds support for the TP-Link TL-WPA8630P (EU) in its v2.1
version. The only unique aspect for the firmware compared to v2
layout is the partition layout.

Note that while the EU version has different partitioning for
v2.0 and v2.1, the v2.1 (AU) is supported by the v2-int image.

If you plan to use this device, make sure you have a look at
the Wiki page to check whether the device is supported and
which image needs to be taken.

Specifications
--------------

  - QCA9563 750MHz, 2.4GHz WiFi
  - QCA9888 5GHz WiFi
  - 8MiB SPI Flash
  - 128MiB RAM
  - 3 GBit Ports (QCA8337)
  - PLC (QCA7550)

Installation
------------

Installation is possible from the OEM web interface. Make sure to
install the latest OEM firmware first, so that the PLC firmware is
at the latest version. However, please also check the Wiki page
for hints according to altered partitioning between OEM firmware
revisions.

Notes
-----

The OEM firmware has 0x620000 to 0x680000 unassigned, so we leave
this empty as well. It is complicated enough already ...

Signed-off-by: Joe Mullally <jwmullally@gmail.com>
[improve partitions, use v2 DTSI, add entry in 02_network, rewrite
and extend commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-10-04 15:44:05 +02:00
Adrian Schmutzler
6f96a4d043 ath79: remove model name from LED labels
Currently, we request LED labels in OpenWrt to follow the scheme

  modelname:color:function

However, specifying the modelname at the beginning is actually
entirely useless for the devices we support in OpenWrt. On the
contrary, having this part actually introduces inconvenience in
several aspects:

  - We need to ensure/check consistency with the DTS compatible
  - We have various exceptions where not the model name is used,
    but the vendor name (like tp-link), which is hard to track
    and justify even for core-developers
  - Having model-based components will not allow to share
    identical LED definitions in DTSI files
  - The inconsistency in what's used for the model part complicates
    several scripts, e.g. board.d/01_leds or LED migrations from
    ar71xx where this was even more messy

Apart from our needs, upstream has deprecated the label property
entirely and introduced new properties to specify color and
function properties separately. However, the implementation does
not appear to be ready and probably won't become ready and/or
match our requirements in the foreseeable future.

However, the limitation of generic LEDs to color and function
properties follows the same idea pointed out above. Generic LEDs
will get names like "green:status" or "red:indicator" then, and
if a "devicename" is prepended, it will be the one of an internal
device, like "phy1:amber:status".

With this patch, we move into the same direction, and just drop
the boardname from the LED labels. This allows to consolidate
a few definitions in DTSI files (will be much more on ramips),
and to drop a few migrations compared to ar71xx that just changed
the boardname. But mainly, it will liberate us from a completely
useless subject to take care of for device support review and
maintenance.
To also drop the boardname from existing configurations, a simple
migration routine is added unconditionally.

Although this seems unfamiliar at first look, a quick check in kernel
for the arm/arm64 dts files revealed that while 1033 lines have
labels with three parts *:*:*, still 284 actually use a two-part
labelling *:*, and thus is also acceptable and not even rare there.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-10-02 13:51:39 +02:00
Piotr Dymacz
e9263123f9 ath79: add support for Hak5 WiFi Pineapple NANO
Hak5 WiFi Pineapple NANO is an "USB dongle" device dedicated for Wi-Fi
pentesters. This device is based on Atheros AR9331 and AR9271. Support
for it was first introduced in 950b278c81 (ar71xx). FCC ID: 2AB87-NANO.

Specifications:

- Atheros AR9331
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR1)
- 16 MB of flash (SPI NOR)
- 1T1R 2.4 GHz Wi-Fi (AR9331)
- 1T1R 2.4 GHz Wi-Fi (AR9271L), with ext. PA and LNA (Qorvo RFFM4203)
- 2x RP-SMA antenna connectors
- 1x USB 2.0 to 10/100 Ethernet bridge (ASIX AX88772A)
- integrated 4-port USB 2.0 HUB: Alcor Micro AU6259:
  - 1x USB 2.0
  - 1x microSD card reader (Genesys Logic GL834L)
  - Atheros AR9271L
- 1x LED, 1x button
- UART (4-pin, 2 mm pitch) header on PCB
- USB 2.0 Type-A plug for power and AX88772A

Flash instruction:

You can use sysupgrade image directly in vendor firmware which is based
on OpenWrt/LEDE.

Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-09-28 01:28:37 +02:00
Piotr Dymacz
b33ce8c535 ath79: add support for Hak5 Packet Squirrel
Hak5 Packet Squirrel is a pocket-sized device dedicated for pentesters
(MITM attacks). This device is based on Atheros AR9331 but it lacks
WiFi. Support for it was first introduced in 950b278c81 (ar71xx).

Specifications:

- Atheros AR9331
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x RJ45 10/100 Mbps Ethernet (AR9331)
- 1x USB 2.0
- 1x RGB LED, 1x button, 1x 4-way mechanical switch
- 1x Micro USB Type-B for main power input

Flash instruction:

You can use sysupgrade image directly in vendor firmware which is based
on OpenWrt/LEDE.

Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-09-28 01:28:37 +02:00
Piotr Dymacz
a2f3a58607 ath79: add support for Hak5 LAN Turtle
Hak5 LAN Turtle is an "USB Ethernet Adapter" shaped device dedicated for
sysadmins and pentesters. This device is based on Atheros AR9331 but it
lacks WiFi. Support for it was first introduced in 950b278c81 (ar71xx).

Two different versions of this device exist and it's up to the user to
install required drivers (generic image supports only common features):

- LAN Turtle 3G with Quectel UG96 3G modem
- LAN Turtle SD with microSD card reader (Alcorlink AU6435R)

Specifications:

- Atheros AR9331
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 1x RJ45 10/100 Mbps Ethernet (AR9331)
- 1x USB 2.0 to 10/100 Ethernet bridge (Realtek RTL8152B)
- 2x LED (power, system), 1x button (inside, on the PCB)
- USB 2.0 Type-A plug for power and RTL8152B

Flash instruction:

You can use sysupgrade image directly in vendor firmware which is based
on OpenWrt/LEDE.

Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-09-28 01:28:37 +02:00
Piotr Dymacz
70a57d48db ath79: add support for ALFA Network N5Q
ALFA Network N5Q is a successor of previous model, the N5 (outdoor
CPE/AP, based on Atheros AR7240 + AR9280). New version is based on
Atheros AR9344.

Support for this device was first introduced in 4b0eebe9df (ar71xx
target) but users are advised to migrate from ar71xx target without
preserving settings as ath79 support includes some changes in network
and LED default configuration. They were aligned with vendor firmware
and recently added N2Q model (both Ethernet ports as LAN, labelled as
LAN1 and LAN2).

Specifications:

- Atheros AR9344
- 550/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x 10/100 Mbps Ethernet, with passive PoE support (24 V)
- 2T2R 5 GHz Wi-Fi, with ext. PA (RFPA5542) and LNA, up to 27 dBm
- 2x IPEX/U.FL or MMCX antenna connectors (for PCBA version)
- 8x LED (7 are driven by GPIO)
- 1x button (reset)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- header for optional 802.3at/af PoE module
- DC jack for main power input (optional, not installed by default)
- UART (4-pin, 2.54 mm pitch) header on PCB
- LEDs (2x 5-pin, 2.54 mm pitch) header on PCB

Flash instruction:

You can use sysupgrade image directly in vendor firmware which is based
on OpenWrt/LEDE. Alternatively, you can use web recovery mode in U-Boot:

1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
   device, wait for first blink of all LEDs (indicates network setup),
   then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.

Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-09-28 01:28:37 +02:00
Piotr Dymacz
6492ea7d9e ath79: add support for ALFA Network N2Q
ALFA Network N2Q is an outdoor N300 AP/CPE based on Qualcomm/Atheros
QCA9531 v2. This model is a successor of the old N2 which was based
on Atheros AR7240. FCC ID: 2AB8795311.

Specifications:

- Qualcomm/Atheros QCA9531 v2
- 650/400/200 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2T2R 2.4 GHz Wi-Fi with ext. PA (Skyworks SE2623L) and LNA
- 2x 10/100 Mbps Ethernet with passive PoE input in one port (24 V)
- PoE pass through in second port (controlled by GPIO)
- support for optional 802.3af/at PoE module
- 1x mini PCIe slot (PCIe bus, extra 4.2 V for high power cards)
- 2x IPEX/U.FL connectors on PCB
- 1x USB 2.0 mini Type-B (power controlled by GPIO)
- 8x LED (7 of them are driven by GPIO)
- 1x button (reset)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- UART (4-pin, 2.54 mm pitch) header on PCB
- LEDs (2x 5-pin, 2.54 mm pitch) header on PCB

Flash instruction:

You can use sysupgrade image directly in vendor firmware which is based
on LEDE/OpenWrt. Alternatively, you can use web recovery mode in U-Boot:

1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
   device, wait for first blink of all LEDs (indicates network setup),
   then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.

Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-09-28 01:28:37 +02:00
Piotr Dymacz
9bcf98ed85 ath79: add support for ALFA Network R36A
ALFA Network R36A is a successor of the previous model, the R36 (Ralink
RT3050F based). New version is based on Qualcomm/Atheros QCA9531 v2, FCC
ID: 2AB879531.

Support for this device was first introduced in af8f0629df (ar71xx
target). When updating from previous release (and/or ar71xx target),
user should only adjust the WAN LED trigger type (netdev in ar71xx,
switch port in ath79).

Specifications:

- Qualcomm/Atheros QCA9531 v2
- 650/400/200 MHz (CPU/DDR/AHB)
- 128 MB (R36AH/-U2) or 64 MB (R36A) of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x 10/100 Mbps Ethernet
- Passive PoE input support (12~36 V) in RJ45 near DC jack
- 2T2R 2.4 GHz Wi-Fi with Qorvo RFFM8228P FEM
- 2x IPEX/U.FL connectors on PCB
- 1x USB 2.0 Type-A
- 1x USB 2.0 mini Type-B in R36AH-U2 version
- USB power is controlled by GPIO
- 6/7x LED (5/6 of them are driven by GPIO)
- 2x button (reset, wifi/wps)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- DC jack with lock, for main power input (12 V)
- UART (4-pin, 2.54 mm pitch) header on PCB

Optional/additional features in R36A series (R36A was the first model):
- for R36AH:    USB 2.0 hub*
- for R36AH-U2: USB 2.0 hub*, 1x USB 2.0 mini Type-B, one more LED

*) there are at least three different USB 2.0 hub in R36AH/-U2 variants:
- Terminus-Tech FE 1.1
- Genesys Logic GL852G
- Genesys Logic GL850G (used in latests revision)

Flash instruction:

You can use sysupgrade image directly in vendor firmware which is based
on LEDE/OpenWrt. Alternatively, you can use web recovery mode in U-Boot:

1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
   device, wait for first blink of all LEDs (indicates network setup),
   then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.

Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-09-28 01:28:37 +02:00
Piotr Dymacz
cf42660dce ath79: add support for Samsung WAM250
Samsung WAM250 is a dual-band (selectable, not simultaneous) wireless
hub, dedicated for Samsung Shape Wireless Audio System. The device is
based on Atheros AR9344 (FCC ID: A3LWAM250). Support for this device
was first introduced in e58e49bdbe (ar71xx target).

Specifications:

- Atheros AR9344
- 560/450/225 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x 10/100 Mbps Ethernet
- 2T2R 2.4/5 GHz Wi-Fi, with ext. PA (SE2598L, SE5003L) and LNA
- 1x USB 2.0
- 4x LED (all are driven by GPIO)
- 2x button (reset, wps/speaker add)
- DC jack for main power input (14 V)
- UART header on PCB (J4, RX: 3, TX: 5)

Flash instruction:

This device uses dual-image (switched between upgrades) with a common
jffs2 config partition. Fortunately, there is a way to disable this mode
so that more flash space can be used by OpenWrt image.

You can easily access this device over telnet, using root/root
credentials (the same also work for serial console access).

1. Make sure that your device uses second (bootpart=2) image using
   command: "fw_printenv bootpart".
2. If your device uses first image (bootpart=1), perform upgrade to the
   latest vendor firmware (after the update, device should boot from
   second partition) using web gui (default login: admin/1234567890).
3. Rename "sysupgrade" image to "firmware.bin", download it (you can use
   wget, tftp or ftpget) to "/tmp" and issue below commands:

   mtd_debug erase /dev/mtd3 0 $(wc -c /tmp/firmware.bin | awk -F' ' '{print $1}')
   mtd_debug write /dev/mtd3 0 $(wc -c /tmp/firmware.bin)
   fw_setenv bootpart
   fw_setenv bootcmd "bootm 0x9f070000"
   reboot

Revert to vendor firmware instruction:

1. Download vendor firmware to "/tmp" device and issue below commands:

   fw_setenv bootpart 1
   sysupgrade -n -F SS_BHUB_v2.2.05.bin

Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-09-28 01:28:37 +02:00
Piotr Dymacz
c65c306d33 ath79: add support for Wallys DR531
Wallys DR531 is based on Qualcomm Atheros QCA9531 v2. Support for this
device was first introduced in e767980eb8 (ar71xx target).

Specifications:

- Qualcomm/Atheros QCA9531 v2
- 550/400/200 MHz (CPU/DDR/AHB)
- 2x 10/100 Mbps Ethernet
- 64 MB of RAM (DDR2)
- 8 MB of flash (SPI NOR)
- 2T2R 2.4 GHz Wi-Fi, with external PA (SE2576L), up to 30 dBm
- 2x MMCX connectors (optional IPEX/U.FL)
- mini PCIe connector (PCIe/USB buses and mini SIM slot)
- 7x LED, 1x button, 1x optional buzzer
- UART, JTAG and LED headers on PCB

Flash instruction (do it under U-Boot, using UART):

  tftpb 0x80060000 openwrt-ath79-...-dr531-squashfs-sysupgrade.bin
  erase 0x9f050000 +$filesize
  cp.b $fileaddr 0x9f050000 $filesize
  setenv bootcmd "bootm 0x9f050000"
  saveenv && reset

Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-09-28 01:28:37 +02:00
Piotr Dymacz
66abd58196 ath79: add support for ALFA Network AP121FE
The AP121FE is a slightly modified version of already supported AP121F
model (added to ar71xx in 0c6165d21a and to ath79 in 334bbc5198).

The differences in compare to AP121F:

- no micro SD card reader
- USB data lines are included in Type-A plug
- USB bus switched to device/peripheral mode (permanently, in bootstrap)

Other than that, specifications are the same:

- Atheros AR9331
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR1)
- 16 MB of flash (SPI NOR)
- 1x 10/100 Mbps Ethernet
- 1T1R 2.4 GHz Wi-Fi, up to 15 dBm
- 1x IPEX/U.FL connector, internal PCB antenna
- 3x LED, 1x button, 1x switch
- 4-pin UART header on PCB (2 mm pitch)
- USB 2.0 Type-A plug (power and data)

Flash instruction (under U-Boot web recovery mode):

1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with RJ45 port, press the reset button, power up device,
   wait for first blink of all LEDs (indicates network setup), then keep
   button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.

Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2020-09-28 01:28:37 +02:00
Adrian Schmutzler
96023cd4ba ath79: fix LED labels for PowerCloud CAP324
The order of function and color in the labels in inverted for the
LAN LEDs. Fix it.

Fixes: 915966d861 ("ath79: Port PowerCloud Systems CAP324 support")

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-09-27 15:58:14 +02:00
Adrian Schmutzler
d232a8ac7d ath79: fix rssi-low LED for My Net Range Extender
The LED color was missing in 01_leds.

Fixes: 745dee11ac ("ath79: add support for WD My Net Wi-Fi Range
Extender")

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-09-27 15:58:14 +02:00
David Bauer
b7da0d2944 ath79: add support for Ubiquiti UniFi AP Pro
This adds support for the Ubiquiti UniFi AP Pro to the ath79 target. The
device was previously supported on the now removed ar71xx target.

SoC   Atheros AR9344
WiFi  Atheros AR9344 & Atheros AR9280
ETH   Atheros AR8327
RAM   128M DDR2
FLASH 16M SPI-NOR

Installation
------------

Follow the Ubiquiti TFTP recovery procedure for this device.

1. Hold down the reset button while connecting power for 10 seconds.
2. Transfer the factory image via TFTP to the AP (192.168.1.20)
3. Wait 2 minutes for the AP to write the firmware to flash. The device
   will automatically reboot to OpenWrt.

Signed-off-by: David Bauer <mail@david-bauer.net>
2020-09-17 18:07:39 +02:00
Adrian Schmutzler
25f2f66eea ath79: add support for Buffalo WZR-600DHP
The hardware of this device seems to be identical to WZR-HP-AG300H.
It was already implemented as a clone in ar71xx.

Specification:
- 680 MHz CPU (Qualcomm Atheros AR7161)
- 128 MiB RAM
- 32 MiB Flash
- WiFi 5 GHz a/n
- WiFi 2.4 GHz b/g/n
- 5x 1000Base-T Ethernet
- 1x USB 2.0

Installation of OpenWRT from vendor firmware:
- Connect to the Web-interface at http://192.168.11.1
- Go to “Administration” → “Firmware Upgrade”
- Upload the OpenWrt factory image

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-09-16 17:32:12 +02:00
Adrian Schmutzler
a99614a44f ath79: consistently use "info" label for default-mac partition
The tp-link safeloader devices typically contain a partition
"default-mac" which stores the MAC addresses. It is followed by other
partitions containing device info, like

  {"default-mac", 0x610000, 0x00020},
  {"pin", 0x610100, 0x00020},
  {"product-info", 0x611100, 0x01000},

In DTS, we typically assign a 0x10000 sized partition for these,
which is mostly labelled "mac" or "info". In rarer cases, the
partitions have been enclosed in a larger "tplink" or "config"
partition.

However, when comparing different devices, the implementation appears
relatively arbitrary at the moment.
Thus, this PR aims at harmonizing these partitions by always using
the name "info" for the DTS partition containing "default-mac".
"info" is preferred over "mac" as we never just have "default-mac"
alone, but always some other device-info partitions as well.

While at it, this also establishes a similar partitioning for the
few devices where the "info" partitions are part of a bigger
unspecific "config" partition or similar.

Besides the harmonization itself, this also allows to merge a few
cases in 11-ath10k-caldata.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-09-16 17:28:48 +02:00