Commit Graph

175 Commits

Author SHA1 Message Date
Andreas Böhler
39320d4b58
ipq40xx: ZTE MF287 fix sysupgrade
While refactoring support for the MF287 series, an entry in platform.sh
was overlooked - this fixes sysupgrade on this devices.

Signed-off-by: Andreas Böhler <dev@aboehler.at>
(cherry picked from commit 964b576fc1)
2023-09-25 20:52:39 +02:00
Andreas Böhler
a684b512e5 ipq40xx: refactor ZTE MF287 series
The ZTE MF287 requires a different board calibration file for ath10k than
the ZTE MF287+. The two devices receive their own DTS, thus the device tree
is slightly refactored.

Signed-off-by: Andreas Böhler <dev@aboehler.at>
(cherry picked from commit 9c7578d560)
2023-09-24 12:55:18 +02:00
Andreas Böhler
e658eee813 ipq4019: add support for ZTE MF287 Pro aka DreiNeo Pro
The ZTE MF287 Pro is a LTE router used (exclusively?) by the network
operator "3". It is very similar to the MF287+, but the hardware layout
and partition layout have changed quite a bit.

Specifications
==============

SoC: IPQ4018
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 4x GBit LAN
LTE: ZTE Cat12
WiFi: 802.11a/b/g/n/ac SoC-integrated
USB: 1x 2.0

MAC addresses
=============

LAN: from config + 2
WiFi 1: from config
WiFi 2: from config + 1

Installation
============

Option 1 - TFTP
---------------

TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:

  setenv serverip 192.168.1.100
  setenv ipaddr 192.168.1.1
  tftpboot 0x82000000 openwrt.bin
  bootm 0x82000000

From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:

  ubiattach -m17
  cat /dev/ubi0_0 > /tmp/ubi0_0
  cat /dev/ubi0_1 > /tmp/ubi0_1

Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.

Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:

  ubirmvol /dev/ubi0 -N ubi_rootfs
  ubirmvol /dev/ubi0 -N kernel

Option 2 - From stock firmware
------------------------------

The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.

The exploit will be available at the device wiki page.

Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".

ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd13 is the partition labelled "rootfs" by calling
"cat /proc/mtd".

Complete commands:

  cd /tmp
  tftp -g -r factory.bin 192.168.0.22
  cat /proc/driver/sensor_id
  flash_erase /dev/mtd17 0 0
  dd if=/tmp/factory.bin of=/dev/mtdblock17 bs=131072

Afterwards, reboot your device and you should have a working OpenWrt
installation.

Restore Stock
=============

Option 1 - via UART
-------------------

Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.

Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.

  ubiattach -m 17
  ubirmvol /dev/ubi0 -N kernel
  ubirmvol /dev/ubi0 -N rootfs
  ubirmvol /dev/ubi0 -N rootfs_data
  ubimkvol /dev/ubi0 -N kernel -s $kernel_length
  ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
  ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
  ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1

Option 2 - from within OpenWrt
------------------------------

This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.

Follow the commands from Option 1 to flash back to stock.

LTE Modem
=========

The LTE modem is similar to other ZTE devices and controls some more LEDs
and battery management.

Configuring the connection using uqmi works properly, the modem
provides three serial ports and a QMI CDC ethernet interface.

Other Notes
===========

Contrary to the stock firmware, the USB port on the back can be used.

There is one GPIO Switch "Power button blocker" which, if enabled, does not
trigger a reset of the SoC if the modem reboots. If disabled, the SoC is
rebooted along with the modem. The modem can be rebooted via the exported
GPIO "modem-reset" in /sys/class/gpio.

Signed-off-by: Andreas Böhler <dev@aboehler.at>
(cherry picked from commit edfe91372a)
2023-08-21 21:41:12 +02:00
David Bauer
897d55bcdf ipq40xx: add support for Teltonika RUTX50
Hardware
--------
CPU:     Qualcomm IPQ4018
RAM:     256M
Flash:   16MB SPI-NOR (W25Q128)
         128MB SPI-NAND (XTX)
WiFi:    2T2R (2GHz 802.11n ; 5 GHz 802.11ac)
ETH:     4x LAN ; 1x WAN (Gigabit)
CELL:    Quectel RG501Q 3G/4G/5G

UART: Available on the goldfinger connector (Pinout silkscreened)
      115200 8N1 3V3 - Only connect RX / TX / GND

Installation
------------

1. Enable SSH in the Teltonika UI
   (System --> Administration --> Access Control)

2. Check from which partition set the device is currently running from.

   $ cat /proc/boot_info/rootfs/primaryboot

   In case this output reads 0, install a Software update from Teltonika
   first. After upgrade completion, check this file now reads 1 before
   continuing.

2. Transfer the OpenWrt factory image to the device using scp. Use the
   same password (user root!) as used for the Web-UI.

   $ scp -O openwrt-factory.bin root@192.168.1.1:/tmp

3. Connect to the device using ssh as the root user.

4. Install OpenWrt by writing the factory image to flash.

   $ ubiformat /dev/mtd16 -y -f /tmp/openwrt-factory.bin

5. Instruct the bootloaer to boot from the first partition set.

   $ echo 0 > /proc/boot_info/rootfs/primaryboot
   $ cat /proc/boot_info/getbinary_bootconfig > /tmp/bootconfig.bin
   $ cat /proc/boot_info/getbinary_bootconfig1 > /tmp/bootconfig1.bin
   $ mtd write /tmp/bootconfig.bin /dev/mtd2
   $ mtd write /tmp/bootconfig1.bin /dev/mtd3

6. Reboot the device.

   $ reboot

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 844bb4bfad)
2023-07-26 15:37:56 +02:00
Andreas Böhler
023a8853c8 ipq4019: add support for ZTE MF287+ aka DreiNeo
The ZTE MF287+ is a LTE router used (exclusively?) by the network operator
"3". The MF287 (i.e. non-plus aka 3Neo) is also supported (the only
difference is the LTE modem)

Specifications
==============

SoC: IPQ4018
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 4x GBit LAN
LTE: ZTE Cat12 (MF287+) / ZTE Cat6 (MF287)
WiFi: 802.11a/b/g/n/ac SoC-integrated

MAC addresses
=============

LAN: from config + 2
WiFi 1: from config
WiFi 2: from config + 1

Installation
============

Option 1 - TFTP
---------------

TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:

  setenv serverip 192.168.1.100
  setenv ipaddr 192.168.1.1
  tftpboot 0x82000000 openwrt.bin
  bootm 0x82000000

From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:

  ubiattach -m14
  cat /dev/ubi0_0 > /tmp/ubi0_0
  cat /dev/ubi0_1 > /tmp/ubi0_1

Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.

Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:

  ubirmvol /dev/ubi0 -N ubi_rootfs
  ubirmvol /dev/ubi0 -N kernel

Option 2 - From stock firmware
------------------------------

The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.

The exploit will be available at the device wiki page.

Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".

ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd13 is the partition labelled "rootfs" by calling
"cat /proc/mtd".

Complete commands:

  cd /tmp
  tftp -g -r factory.bin 192.168.0.22
  cat /proc/driver/sensor_id
  flash_erase /dev/mtd13 0 0
  dd if=/tmp/factory.bin of=/dev/mtdblock13 bs=131072

Afterwards, reboot your device and you should have a working OpenWrt
installation.

Restore Stock
=============

Option 1 - via UART
-------------------

Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.

Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.

  ubiattach -m 14
  ubirmvol /dev/ubi0 -N kernel
  ubirmvol /dev/ubi0 -N rootfs
  ubirmvol /dev/ubi0 -N rootfs_data
  ubimkvol /dev/ubi0 -N kernel -s $kernel_length
  ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
  ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
  ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1

Option 2 - from within OpenWrt
------------------------------

This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.

Follow the commands from Option 1 to flash back to stock.

LTE Modem
=========

The LTE modem is similar to other ZTE devices and controls some more LEDs
and battery management.

Configuring the connection using uqmi works properly, the modem
provides three serial ports and a QMI CDC ethernet interface.

Signed-off-by: Andreas Böhler <dev@aboehler.at>
(cherry picked from commit f70ee53b08)
2023-07-01 15:31:56 +02:00
Yanase Yuki
0c15f45fa7 ipq40xx: convert Buffalo WTR-M2133HP to DSA
This commit convert WTR-M2133HP to DSA setup.

Signed-off-by: Yanase Yuki <dev@zpc.sakura.ne.jp>
(cherry picked from commit edb3a4162c)
2023-06-08 15:33:14 +02:00
张 鹏
dd97954772 ipq40xx: add e2600ac c2 to dsa
Convert E2600ac c2 to DSA and enable it.

Signed-off-by: 张 鹏 <sd20@qxwlan.com>
[ rename port to more generic name ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 0dca52cf59)
2023-05-31 23:14:32 +02:00
张 鹏
f2a13cf10e ipq40xx: add e2600ac c1 to dsa
Convert E2600ac c1 to DSA and enable it.

Signed-off-by: 张 鹏 <sd20@qxwlan.com>
[ rename port to more generic name ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 7f2ecab0f4)
2023-05-31 23:14:25 +02:00
Christian Lamparter
eab9de0c9c ipq40xx: convert EZVIZ CS-W3-WD1200G-EUP to DSA
Convert the repeater to DSA.

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2023-05-20 15:19:14 +02:00
Nick Hainke
3cac52f9a1
ipq40xx: convert AVM FRITZ!Repeater 3000 to DSA
Convert the repeater to DSA.

Signed-off-by: Nick Hainke <vincent@systemli.org>
2023-05-03 16:16:19 +02:00
Nick Hainke
0f269554e4
ipq40xx: convert GL-AP1300 to DSA
Convert GL-AP1300 to DSA and enable it.

While working on it rename the GL-AP1300 leds from green to white.

Tested-by: Rob White <rob@blue-wave.net>
Tested-by: Robert Sommer <frauhottelmann@gmail.com>
Signed-off-by: Nick Hainke <vincent@systemli.org>
2023-04-24 18:32:26 +02:00
David Bauer
72780e3eac ipq40xx: convert AP-365 to DSA
Re-enable the Aruba AP-365 with DSA support. Changes are trvivial, as
the board design is pretty much the already updated AP-303.

Run-tested on the device.

Signed-off-by: David Bauer <mail@david-bauer.net>
2023-04-15 14:15:42 +02:00
Michael Trinidad
ff91a12c8d base-files: fix Linksys upgrade, restore config step
It appears that the refactor of the upgrade process for NAND devices                                                                                                                            resulted in the nand_do_upgrade_success step not being called for
devices using the linksys.sh script. As a result, configuration was
not preserved over sysupgrade steps.

This corrects a typo in the call of nand_do_upgrade_failed for ipq40xx
and ipq806x devices using the linksys.sh script.

Fixes: 8634c1080d ("ipq40xx: Fix Linksys upgrade, restore config step")
Fixes: 2715aff5df ("ipq806x: Fix Linksys upgrade, restore config step")
Signed-off-by: Michael Trinidad <trinidude4@hotmail.com>
2023-04-11 12:22:35 +02:00
Jeff Kletsky
8634c1080d ipq40xx: Fix Linksys upgrade, restore config step
It appears that the refactor of the upgrade process for NAND devices
resulted in the nand_do_upgrade_success step not being called for
devices using the linksys.sh script. As a result, configuration
was not preserved over sysupgrade steps.

This was restored for some devices in
commit 84ff6c90dd ("base-files: bring back nand_do_upgrade_success").
This restored preservation of config for ipq40xx devices using the
linksys.sh script. Other devices and targets have not been examined.

Closes: #11677
Fixes: e25e6d8e54 ("base-files: fix and clean up nand sysupgrade code")
Tested-on: EA8300

Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
(checkpatch nitpick)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2023-03-26 16:39:37 +02:00
Robert Marko
eb564690c9 ipq40xx: add support for Wallystech DR40x9
Adds support for the Wallys DR40x9 series boards.
They come in IPQ4019 and IPQ4029 versions.
IPQ4019/4029 only differ in that that IPQ4029 is the industrial version that is rated to higher temperatures.

Specifications are:
* CPU: Qualcomm IPQ40x9 (4x ARMv7A Cortex A7) at 716 MHz
* RAM: 512 MB
* Storage: 2MB of SPI-NOR, 128 MB of parallel NAND
* USB 3.0 TypeA port for users
* MiniPCI-E with PCI-E 2.0 link
* MiniPCI-E for LTE modems with only USB2.0 link
* 2 SIM card slots that are selected via GPIO11
* MicroSD card slot
* Ethernet: 2x GBe with 24~48V passive POE
* SFP port (Does not work, I2C and GPIO's not connected on hardware)
* DC Jack
* UART header
* WLAN: In-SoC 2x2 802.11b/g/n and 2x2 802.11a/n/ac
* 4x MMCX connectors for WLAN
* Reset button
* 8x LED-s

Installation instructions:
Connect to UART, pins are like this:
-> 3.3V | TX | RX | GND

Settings are 115200 8n1

Boot initramfs from TFTP:
tftpboot 0x84000000 openwrt-ipq40xx-generic-wallys_dr40x9-initramfs-fit-uImage.itb

bootm

Then copy the sysupgrade image to the /tmp folder and execute sysupgrade -n <image_name>

The board file binary was provided from Wallystech on March 14th 2023
including full permission to use and distribute.

Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
2023-03-21 16:38:23 +01:00
David Bauer
bf055fcdca ipq40xx: convert Netgear EX6100/EX6150 v2 to DSA
Signed-off-by: David Bauer <mail@david-bauer.net>
2023-03-08 02:19:01 +01:00
Daniel Golle
e8625c89ef treewide: replace /sys/devices/virtual/ubi by /sys/class/ubi
Starting from Linux Kernel version 6.3 UBI devices will no longer be
considered virtual, but rather have an MTD device parent. Hence they
will no longer be listed under /sys/devices/virtual/ubi which is
used in multiple places in OpenWrt. Prepare for future kernels by
using /sys/class/ubi instead of /sys/devuces/virtual/ubi.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2023-02-15 03:27:59 +00:00
James Andrewartha
7c04e80f87 ipq40xx: convert Extreme AP3915i to DSA
Convert and re-enabled Extreme AP3915i to DSA.

Signed-off-by: James Andrewartha <trs80@ucc.asn.au>
2023-01-17 23:45:44 +01:00
Martin Schiller
539b52068a ipq40xx: add DSL support for FritzBox 7530
Set up MAC, LED, settings and default packages for DSL usage, similar
to the lantiq target.

Due to licensing uncertainty, we do not include the firmware files for the
DSL drivers. To have a working DSL setup, follow the instructions below.

Download the firmware files locally:

  mkdir -p files/lib/firmware/09a9
  wget -P files/lib/firmware/09a9 https://gitlab.com/prpl-foundation/intel/vrx518_aca_fw/-/raw/ugw-8.5.2/platform/xrx500/aca_fw.bin
  wget -P files/lib/firmware https://gitlab.com/prpl-foundation/intel/vrx518_ppe_fw/-/raw/ugw_8.5.2.10/platform/xrx500/ppe_fw.bin
  wget -P files/lib/firmware https://gitlab.com/prpl-foundation/intel/dsl_vr11_firmware_xdsl/-/raw/ugw-8.5.2/xcpe_8D1507_8D0901.bin
  ln -s xcpe_8D1507_8D0901.bin files/lib/firmware/vdsl.bin

For people building their own images:

Run the above commands in the root of your local OpenWrt clone,
and the firmware files will be part of the resulting images.

For people downloading images:

Copy the firmware files onto the router once it's booted up:
  scp -O -r files/lib/firmware root@fritz:/lib
Reboot the device afterwards.

Signed-off-by: Martin Schiller <ms.3headeddevs@gmail.com>
[cleaned up]
Signed-off-by: Andre Heider <a.heider@gmail.com>
[set up LED]
Signed-off-by: Jan Hoffmann <jan@3e8.eu>
Signed-off-by: Andre Heider <a.heider@gmail.com>
2023-01-16 23:41:41 +00:00
Vincent Tremblay
9e4ede8344 ipq40xx: add support for Linksys WHW03 V2
SOC:             Qualcomm IPQ4019
WiFi 1:          QCA4019 IEEE 802.11b/g/n
WiFi 2:          QCA4019 IEEE 802.11a/n/ac
WiFi 3:          QCA8888 IEEE 802.11a/n/ac
Bluetooth:       Qualcomm CSR8811 (A12U)
Zigbee:          Silicon Labs EM3581 NCP + Skyworks SE2432L
Ethernet:        Qualcomm Atheros QCA8072 (2-port)
Flash 1:         Mactronix MX30LF4G18AC-XKI
RAM (NAND):      SK hynix H5TC4G63CFR-PBA (512MB)
LED Controller:  NXP PCA9633 (I2C)
Buttons:         Single reset button (GPIO).

- The three WiFis were fully tested and are configured with the same settings as in the vendor firmware.
- The specific board files were submitted to the ATH10k mailing list but I'm still waiting for a reply. They can be removed once they are approved upstream.
- Two ethernet ports are accessible on the device. By default one is configured as WAN and the other one is LAN. They are fully working.

Bluetooth:
========
- Fully working with the following caveats:
  - RFKILL need to be enabled in the kernel.
  - An older version of bluez is needed as bccmd is needed to configure the chip.

Zigbee:
======
- The spidev device is available in the /dev directory.
- GPIOs are configured the same way as in the vendor firmware.
- Tests are on-going. I am working on getting access to the Silicon Labs stack to validate that it is fully working.

Installation:
=========
The squash-factory image can be installed via the Linksys Web UI:
1. Open "http://192.168.1.1/ca" (Change the IP with the IP of your device).
2. Login with your admin password.
3. To enter into the support mode, click on the "CA" link and the bottom of the page.
4. Open the "Connectivity" menu and upload the squash-factory image with the "Choose file" button.
5. Click start. Ignore all the prompts and warnings by click "yes" in all the popups.

The device uses a dual partition mechanism. The device automatically revert to the previous partition after 3 failed boot attempts.
If you want to force the previous firmware to load, you can turn off and then turn on the device for 2 seconds, 3 times in a row.

It can also be done via TFTP:
1. Setup a local TFTP server and configure its IP to 192.168.1.100.
2. Rename your image to "nodes_v2.img" and put it to the TFTP root of your server.
3. Connect to the device through the serial console.
4. Power on device and press enter when prompted to drop into U-Boot.
5. Flash the partition of your choice by typing "run flashimg" or "run flashimg2".
6. Once flashed, enter "reset" to reboot the device.

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Vincent Tremblay <vincent@vtremblay.dev>
2023-01-15 12:55:38 +01:00
Marcin Gajda
700c47a5f6 ipq40xx: Add support ZTE MF18A
Light and small router ( In Poland operators sells together with MC7010 outdoor modem to provide WIFI inside home).
Device specification

SoC Type: Qualcomm IPQ4019
RAM: 256 MiB
Flash: 128 MiB SPI NAND (Winbond W25N01GV)
ROM: 2MiB SPI Flash (GD25Q16)
Wireless 2.4 GHz (IP4019): b/g/n, 2x2
Wireless 5 GHz (QCA9982): a/n/ac, 3x3
Ethernet: 2xGbE (WAN/LAN1, LAN2)
USB ports: No
Button: 2 (Reset/WPS)
LEDs: 3 external leds: Power (blue) , WiFI (blue and red), SMARTHOME (blue and red) and 1 internal (blue) -- NOTE: Power controls all external led (if down ,all others also not lights even signal is up)
Power: 5VDC, 2,1A via USB-C socket
Bootloader: U-Boot
On board ZWave and Zigbee (EFR32 MG1P232GG..)  modules ( not supported by orginal software )
Installation

 1.Open MF18A case by ungluing rubber pad under the router and unscrew screws, and connect to serial console port,
   with the following pinout, starting from pin 1, which is the topmost pin when the board is upright (reset button on the bottom) :

    VCC (3.3V). Do not use unless you need to source power for the converer from it.
    TX
    RX
    GND

    Default port configuration in U-boot as well as in stock firmware is 115200-8-N-1.

 2.Place OpenWrt initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.0.2

 3.Connect TFTP server to RJ-45 port (WAN/LAN1).

 4.Power on MF18A , stop in u-Boot (using ESC button) and run u-Boot commands:
    setenv serverip 192.168.0.2
    setenv ipaddr 192.168.0.1
    set fdt_high 0x85000000
    tftpboot 0x84000000 openwrt-ipq40xx-generic-zte_mf18a-initramfs-fit-zImage.itb
    bootm 0x84000000

 5.Please make backup of original partitions, if you think about revert to stock, specially mtd8 (Web UI) and mtd9 (rootFS). Use /tmp as temporary storage and do:

WEB PARITION

cat /dev/mtd8 > /tmp/mtd8.bin
scp /tmp/mtd8.bin root@YOURSERVERIP:/
rm /tmp/mtd8.bin
ROOT PARITION

cat /dev/mtd9 > /tmp/mtd9.bin
scp /tmp/mtd9.bin root@YOURSERVERIP:/
rm /tmp/mtd9.bin

If you are sure ,that you want to flash openwrt, from uBoot, before bootm, clean rootfs partition with command:
nand erase 0x1800000 0x1D00000

 6.Login via ssh or serial and remove stock partitions (default IP 192.168.1.1):
ubiattach -m 9 # it could return error if ubi was attached before or rootfs part was erased before
ubirmvol /dev/ubi0 -N ubi_rootfs # it could return error if rootfs part was erased before
ubirmvol /dev/ubi0 -N ubi_rootfs_data # some devices doesn't have it

 7. Install image via :
sysupgrade -n /tmp/openwrt-ipq40xx-generic-zte_mf18a-squashfs-sysupgrade.bin

previously wgeting bin. Sometimes it could print ubi attach error, but please ignore it if process goes forward.

Back to Stock (!!! need original dump taken from initramfs !!!) -------------

Place mtd8.bin and mtd9.bin initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.0.2
Connect serial console (115200,8n1) to serial console connector .
Connect TFTP server to RJ-45 port (WAN/LAN1).
rename mtd8.bin to web.img and mtd9.bin to root_uImage_s
Stop in u-Boot (using ESC button) and run u-Boot commands:
This will erase Web and RootFS:
nand erase 0x1000000 0x800000
nand erase 0x1800000 0x1D00000

This will restore RootFS:
tftpboot 0x84000000 root_uImage_s
nand erase 0x1800000 0x1D00000
nand write 0x84000000 0x1800000 0x1D00000

This will restore Web Interface:
tftpboot 0x84000000 web.img
nand erase 0x1000000 0x800000
nand write 0x84000000 0x1000000 0x800000

After first boot on stock firwmare, do a factory reset. Push reset button for 5 seconds so all parameters will be reverted to the one printed on label on bottom of the router

As reference was taken MF289F support by Giammarco Marzano stich86@gmail.com and MF286D by Pawel Dembicki paweldembicki@gmail.com

Signed-off-by: Marcin Gajda <mgajda@o2.pl>
2023-01-14 19:19:36 +01:00
Tony Ambardar
6fc334cbdc ipq40xx: sysupgrade: allow flashing Linksys factory firmware
Allow forced flashing of a factory firmware image, after checking for the
correct FIT magic header and Linksys board-specific footer. Details of the
footer are already described in scripts/linksys-image.sh.

This is convenient as it avoids using a TFTP server or OEM GUI, and allows
restoring OEM firmware or installing a "breaking" OpenWrt update (e.g DSA
migration and kernel repartition) directly from the command line.

Devices supported at this time include EA6350v3, EA8300, MR8300 and WHW01.

Reviewed-by: Robert Marko <robimarko@gmail.com>
Tested-by:  Wyatt Martin <wawowl@gmail.com> # WHW01
Tested-by:  Tony Ambardar <itugrok@yahoo.com> # EA6350v3
Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
2022-12-31 05:02:38 -08:00
Tony Ambardar
4b367e2b60 ipq40xx: migrate Linksys WHW01 to DSA and re-enable
Convert Linksys WHW01 network configuration to DSA and re-enable builds.

Reviewed-by: Robert Marko <robimarko@gmail.com>
Tested-by: Wyatt Martin <wawowl@gmail.com>
Signed-off-by: Wyatt Martin <wawowl@gmail.com>
Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
2022-12-31 05:02:38 -08:00
Tony Ambardar
2a9f3b7717 ipq40xx: fix up Linksys WHW01 board name, device definition
Update the board name defined in DTS to match online documentation and the
name encoded into factory firmware. This helps supports flashing firmware
factory images using 'sysupgrade'.

Original WHW01 device definition assumes the rootfs IMAGE_SIZE is 33 MB
instead of the correct 74 MB, and defines factory images which include
extra adjustments/padding that do not match OEM factory images and may
cause problems flashing. Update image size and build recipe to fix these.

Suggested-by: Wyatt Martin <wawowl@gmail.com>
Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
2022-12-31 05:02:38 -08:00
Tony Ambardar
cda6f1c832 ipq40xx: re-enable EA6350v3, EA8300, MR8300 builds
Raise the kernel size from 3 MB to 5 MB for EA6350v3, EA8300 and MR8300,
and correspondingly reduce the rootfs size by 2 MB:
  * modify partition definitions in related .dts files
  * modify device kernel/image sizes in generic.mk

Update to compat-version 2.0 to force factory image usage on sysupgrade,
noting the current version 1.1 is an unreleased update for DSA migration.

Also update the compat-version message, explaining the need to run one of
the following console commands to update U-Boot's kernel-size variable
before flashing the OpenWrt factory image.

    fw_setenv kernsize 500000          # (OpenWrt command line)

    setenv kernsize 500000 ; saveenv   # (U-Boot serial console)

Finally, re-enable the 3 devices.

Reviewed-by: Robert Marko <robimarko@gmail.com>
Tested-by: Nicolas TORMO <badulesia.granieri@gmail.com> # MR8300
Tested-by: Tony Ambardar <itugrok@yahoo.com> # EA6350v3
Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
2022-12-31 05:02:38 -08:00
Nick Hainke
3195a992d6
ipq40xx: convert Aruba AP-303H to DSA and enable target again
The target was disabled since noone did the DSA conversion. Add the
conversion and enable it again.

Tested-by: John Walshaw <jjw@myself.com>
Signed-off-by: Bjoern Dobe <bjoern@dobecom.de>
Signed-off-by: Nick Hainke <vincent@systemli.org>
2022-12-29 17:39:30 +01:00
Alexander Couzens
d4c460648d
ipq40xx: add support for Mikrotik wAP R ac / LTE / LTE6
The Mikrotik wAP R AC is an outdoor, dual band, dual radio (802.11ac) AP
with a miniPCIe slot for a LTE modem.
The wAP R AC is similar to the wAP AC but with the miniPCIe slot.
The wAP R AC requires installing a LTE modem.
The wAP LTE and wAP LTE6 comes with a LTE modem installed.

See https://mikrotik.com/product/wap_r_ac for more info.

Specifications:
- SoC: Qualcomm Atheros IPQ4018
- CPU: 4x ARM Cortex A7
- RAM: 128MB
- Storage: 16MB NOR flash
- Wireless:
   - Built-in IPQ4018 (SoC) 802.11b/g/n 2x2:2, internal antenna
   - Built-in IPQ4018 (SoC) 802.11a/n/ac 2x2:2, internal antenna
- Ethernet: Built-in IPQ4018 (SoC, QCA8075) , 2x 1000/100/10 ports
  one with 802.3af/at PoE in
- 1x Mini PCI-E port (USB2)

Installation:
Boot the initramfs image via TFTP, then flash the sysupgrade image using
sysupgrade. Details at https://openwrt.org/toh/mikrotik/common.

Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
2022-11-27 13:28:22 +00:00
Sven Eckelmann
fc69532eb9 ipq40xx: Convert plasmacloud,pa2200 to DSA
* ethernet1:

  - physical port label "Ethernet 1"
  - its mac address is printed on the device label

* ethernet2:

  - physical port label "Ethernet 2"
  - can be used to power the device

Both ports are not marked by there role (because the vendor firmware
automatically detects roles) but the "Ethernet 2" port was used in the past
for "WAN" functionality in OpenWrt.

Tested-by: Michaël BILCOT <michael.bilcot@gmail.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
2022-11-13 15:26:34 +01:00
Sven Eckelmann
ce6c9e0328 ipq40xx: utilize nvmem-cells for plasmacloud,pa2200
The calibration data and mac addresses on this device are stored in the
0:ART partition. It is therefore possible to move the code to handle them
directly to the devicetree instead of the various scripts.

But the actual relevant information about the partition layout is provided
by the bootloader via bootargs (mtdparts) and not via the devicetree
itself. Instead of using a fixed-partition template, the mtd dynamic
partitions support from the upstream kernel is used.

Reported-by: Robert Marko <robert.marko@sartura.hr>
Tested-by: Michaël BILCOT <michael.bilcot@gmail.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
2022-11-13 15:26:34 +01:00
Sven Eckelmann
539a5fd624 ipq40xx: Convert plasmacloud,pa1200 to DSA
* ethernet1:

  - physical port label "Ethernet 1"
  - its mac address is printed on the device label

* ethernet2:

  - physical port label "Ethernet 2"
  - can be used to power the device

Both ports are not marked by there role (because the vendor firmware
automatically detects roles) but the "Ethernet 2" port was used in the past
for "WAN" functionality in OpenWrt.

Signed-off-by: Sven Eckelmann <sven@narfation.org>
2022-11-13 15:26:34 +01:00
Sven Eckelmann
b8bda645fc ipq40xx: utilize nvmem-cells for plasmacloud,pa1200
The calibration data and mac addresses on this device are stored in the
0:ART partition. It is therefore possible to move the code to handle them
directly to the devicetree instead of the various scripts.

But the actual relevant information about the partition layout is provided
by the bootloader via bootargs (mtdparts) and not via the devicetree
itself. Instead of using a fixed-partition template, the mtd dynamic
partitions support from the upstream kernel is used.

Reported-by: Robert Marko <robert.marko@sartura.hr>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
2022-11-13 15:26:34 +01:00
Sven Eckelmann
087a8e39be ipq40xx: utilize nvmem-cells for openmesh,a62
The calibration data and mac addresses on this device are stored in the
0:ART partition. It is therefore possible to move the code to handle them
directly to the devicetree instead of the various scripts.

But the actual relevant information about the partition layout is provided
by the bootloader via bootargs (mtdparts) and not via the devicetree
itself. Instead of using a fixed-partition template, the mtd dynamic
partitions support from the upstream kernel is used.

Reported-by: Robert Marko <robert.marko@sartura.hr>
Reviewed-by: Robert Marko <robimarko@gmail.com>
Tested-by: Michaël BILCOT <michael.bilcot@gmail.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
2022-11-12 18:15:55 +01:00
Sven Eckelmann
2b2f14c959 ipq40xx: utilize nvmem-cells for openmesh,a42
The calibration data and mac addresses on this device are stored in the
0:ART partition. It is therefore possible to move the code to handle them
directly to the devicetree instead of the various scripts.

But the actual relevant information about the partition layout is provided
by the bootloader via bootargs (mtdparts) and not via the devicetree
itself. Instead of using a fixed-partition template, the mtd dynamic
partitions support from the upstream kernel is used.

Reported-by: Robert Marko <robert.marko@sartura.hr>
Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
2022-11-12 18:15:55 +01:00
Sven Eckelmann
c6bef1b83a ipq40xx: Convert openmesh,a62 to DSA
* ethernet1:

  - physical port label "Ethernet 1"
  - can be used to power the device
  - its mac address is printed on the device label

* ethernet2:

  - physical port label "Ethernet 2"

Both ports are not marked by there role (because the vendor firmware
automatically detects roles) but the "Ethernet 1" port was used in the past
for "WAN" functionality in OpenWrt.

Reviewed-by: Robert Marko <robimarko@gmail.com>
Tested-by: Michaël BILCOT <michael.bilcot@gmail.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
2022-11-12 18:15:55 +01:00
Sven Eckelmann
66a3c32b47 ipq40xx: Convert openmesh,a42 to DSA
* ethernet1:

  - physical port label "Ethernet 1"
  - can be used to power the device
  - its mac address is printed on the device label

* ethernet2:

  - physical port label "Ethernet 2"

Both ports are not marked by there role (because the vendor firmware
automatically detects roles) but the "Ethernet 1" port was used in the past
for "WAN" functionality in OpenWrt.

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
2022-11-12 18:15:55 +01:00
Guillaume Lefebvre
65d9a715fc ipq40xx: D-Link DAP-2610: convert to DSA
Reenable D-Link DAP-2610, convert it to DSA and label port to 'lan', as shown on the case

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Guillaume Lefebvre <guillaume@zelig.ch>
2022-11-12 18:15:55 +01:00
Weiping Yang
9945d05171 ipq40xx: add support for GL.iNet GL-A1300
Specifications:
SOC:		Qualcomm IPQ4018 (DAKOTA) ARM Quad-Core
RAM:		256 MiB
FLASH1:		4 MiB NOR
FLASH2:		128 MiB NAND
ETH:		Qualcomm QCA8075
WLAN1:		Qualcomm Atheros QCA4018 2.4GHz 802.11b/g/n 2x2
WLAN2:		Qualcomm Atheros QCA4018 5G 802.11n/ac W2 2x2
USB:		1 x USB 3.0 port
Button:		1 x Reset button
Switch:		1 x Mode switch
LED:		1 x Blue LED + 1 x White LED

Install via uboot tftp or uboot web failsafe.

By uboot tftp:
(IPQ40xx) # tftpboot 0x84000000 openwrt-ipq40xx-generic-glinet_gl-a1300-squashfs-nand-factory.ubi
(IPQ40xx) # nand erase 0 0x8000000
(IPQ40xx) # nand write 0x84000000 0 $filesize

By uboot web failsafe:
Push the reset button for 10 seconds util the power led flash faster,
then use broswer to access http://192.168.1.1

Afterwards upgrade can use sysupgrade image.

Signed-off-by: Weiping Yang <weiping.yang@gl-inet.com>
2022-11-09 23:34:37 +01:00
Csaba Sipos
cc8b8f1b41 ipq40xx: add support for MikroTik hAP ac3 LTE6 kit
This adds support for the MikroTik RouterBOARD RBD53GR-5HacD2HnD
(hAP ac³ LTE6 kit), an  indoor dual band, dual-radio 802.11ac
wireless AP with built-in Mini PCI-E LTE modem, one USB port, five
10/100/1000 Mbps Ethernet ports.

See https://mikrotik.com/product/hap_ac3_lte6_kit for more info.

Specifications:
 - SoC: Qualcomm Atheros IPQ4019
 - RAM: 256 MB
 - Storage: 16 MB NOR
 - Wireless:
   · Built-in IPQ4019 (SoC) 802.11b/g/n 2x2:2, 3 dBi internal antennae
   · Built-in IPQ4019 (SoC) 802.11a/n/ac 2x2:2, 5.5 dBi internal antennae
 - Ethernet: Built-in IPQ4019 (SoC, QCA8075) , 5x 1000/100/10 port
 - 1x USB Type A port
 - 1x Mini PCI-E port (supporting USB)
 - 1x Mini PCI-E LTE modem (MikroTik R11e-LTE6, Cat.6)

Installation:

Make sure your unit is runnning RouterOS v6 and RouterBOOT v6 (tested on 6.49.6).

0. Export your MikroTik license key (in case you want to use the device with RouterOS later)
1. Boot the initramfs image via TFTP
2. Upload the "openwrt-ipq40xx-mikrotik-mikrotik_hap-ac3-lte6-kit-squashfs-sysupgrade.bin" via SCP to the /tmp folder
3. Use sysupgrade to flash the image: sysupgrade -n /tmp/openwrt-ipq40xx-mikrotik-mikrotik_hap-ac3-lte6-kit-squashfs-sysupgrade.bin
4. Recovery to factory software is possible via Netinstall:
   https://help.mikrotik.com/docs/display/ROS/Netinstall

Signed-off-by: Csaba Sipos <metro4@freemail.hu>
2022-10-30 23:14:45 +01:00
Davide Fioravanti
8d921167e9
ipq40xx: convert to DSA and enable Netgear Orbi devices
Convert to DSA and enable again Netgear Orbi devices:
 - RBR50
 - RBS50
 - SRR60
 - SRS60

Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
2022-10-25 02:34:46 +02:00
Brian Norris
a3da858ab0 ipq40xx: Convert Google Wifi to DSA, reenable
Undo parts of these:

116feb4a1c ipq40xx: remove non-converted network configs
db19efee95 ipq40xx: disable boards not converted to DSA

Reintroduce the DT paths /soc/edma@c080000/gmac{0,1}, because the stock
bootloader has memorized them (instead of following aliases); then plug
the MAC address back in via 05_set_iface_mac_ipq40xx.sh, since the
'local-mac-address' property is no longer in the correct node.

Cc: David Bauer <mail@david-bauer.net>
Cc: Robert Marko <robert.marko@sartura.hr>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
2022-10-23 08:27:40 +02:00
Jack Chen
57577bb8cc ipq40xx: convert to DSA and enable mobipromo,cm520-79f
Convert to DSA and enable the MobiPromo CM520-79F device again.

Signed-off-by: Jack Chen <redchenjs@live.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2022-10-23 01:45:52 +02:00
Chen Minqiang
3505933073 ipq40xx: convert to DSA and enable asus,rt-ac42u
This convert board asus,rt-ac42u to DSA and re-enable it

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
2022-10-22 20:09:58 +08:00
Mark Mentovai
9a8e008188 ipq40xx: Convert mikrotik,wap-ac to DSA
As done previously, this preserves the MAC addresses of they physical
Ethernet ports. The interfaces are renamed as eth0 is in use for the
native GMAC; the new interface naming matches the physical port labels.
 - sw-eth1 corresponds to the physical port labeled ETH1 and has the
   base MAC address. This port can be used to power the device.
 - sw-eth2 corresponds to the physical port labeled ETH2 and has a MAC
   address one greater than the base.

As this device has 2 physical ports, they are each connected to their
respective PHYs, allowing the link status to be visible to software.
Since they are not marked on the case with any role (such as LAN or
WAN), both are bridged to the lan network by default, although this can
easily be changed if needed.

Signed-off-by: Mark Mentovai <mark@mentovai.com>
2022-10-19 22:58:12 +02:00
INAGAKI Hiroshi
32e41ba18a ipq40xx: convert to DSA and enable Sony NCP-HG100/Cellular
This patch converts networking on Sony NCP-HG100/Cellular to DSA and
re-enables support for the device.

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2022-10-09 22:45:06 +02:00
Dirk Buchwalder
579ea6b970 ipq40xx: ZTE MF289F: convert to DSA
Convert ZTE MF289F device to DSA, re-order network ports to match the
labels on the case and re-enable the device.

Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
Reviewed-by: Robert Marko <robimarko@gmail.com>
Reviewed-by: Lech Perczak <lech.perczak@gmail.com>
2022-10-09 22:39:48 +02:00
Tomasz Maciej Nowak
ee38573093
ipq40xx: pakedge_wr-1: convert to DSA
Convert pakedge_wr-1 device to DSA and enable it.

Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>i
[ improve commit description ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2022-10-05 19:16:52 +02:00
Tomasz Maciej Nowak
70d9193b51
ipq40xx: luma_wrtq-329acn: convert to DSA
Convert luma_wrtq-329acn device to DSA and enable it.

Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
[ improve commit description ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2022-10-05 19:10:28 +02:00
Robert Marko
116feb4a1c ipq40xx: remove non-converted network configs
Remove networking configs for non DSA converted boards in ipq40xx.
Currently, they are just causing clutter.

Signed-off-by: Robert Marko <robert.marko@sartura.hr>
2022-10-02 23:04:39 +02:00
Lech Perczak
b9b4c51b2b ipq40xx: Meraki MR33: convert MAC addresses to nvmem
This fixes assigning random MAC to br-lan interface upon boot.
While at that, rename at24@50 node to eeprom@50, to align with upstream
device tree style.

Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2022-10-02 23:04:39 +02:00
Robert Marko
550253bdf9 ipq40xx: convert some boards to DSA
Convert IPQ40xx boards to DSA setup.

Signed-off-by: Leon M. George <leon@georgemail.eu>
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Signed-off-by: Nick Hainke <vincent@systemli.org>
Signed-off-by: ChunAm See <z1250747241@gmail.com>
Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
Signed-off-by: Andrew Sim <andrewsimz@gmail.com>
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
2022-10-02 23:04:39 +02:00