FCC ID: 2AG6R-AN700APIAC
Araknis AN-700-AP-I-AC is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
this board is a Senao device:
the hardware is equivalent to EnGenius EAP1750
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails
**Specification:**
- QCA9558 SOC MIPS 74kc, 2.4 GHz WMAC, 3x3
- QCA9880 WLAN PCI card, 5 GHz, 3x3, 26dBm
- AR8035-A PHY RGMII GbE with PoE+ IN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16
- UART console J10, populated, RX shorted to ground
- 4 antennas 5 dBi, internal omni-directional plates
- 4 LEDs power, 2G, 5G, wps
- 1 button reset
NOTE: all 4 gpio controlled LEDS are viewed through the same lightguide
therefore, the power LED is off for default state
**MAC addresses:**
MAC address labeled as ETH
Only one Vendor MAC address in flash at art 0x0
eth0 ETH *:xb art 0x0
phy1 2.4G *:xc ---
phy0 5GHz *:xd ---
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin at J10
**Installation:**
Method 1: Firmware upgrade page:
(if you cannot access the APs webpage)
factory reset with the reset button
connect ethernet to a computer
OEM webpage at 192.168.20.253
username and password 'araknis'
make a new password, login again...
Navigate to 'File Management' page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm
wait about 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
192.168.20.253
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
Method 1: Serial to load Failsafe webpage (above)
Method 2: delete a checksum from uboot-env
this will make uboot load the failsafe image at next boot
because it will fail the checksum verification of the image
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait a minute
connect to ethernet and navigate to
192.168.20.253
select OEM firmware image and click upgrade
Method 3: backup mtd partitions before upgrade
**TFTP recovery:**
Requires serial console, reset button does nothing
rename initramfs-kernel.bin to '0101A8C0.img'
make available on TFTP server at 192.168.1.101
power board, interrupt boot with serial console
execute `tftpboot` and `bootm 0x81000000`
NOTE: TFTP may not be reliable due to bugged bootloader
set MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software is built using SDKs from Senao
which is based on a heavily modified version
of Openwrt Kamikaze or Altitude Adjustment.
One of the many modifications is sysupgrade being performed by a custom script.
Images are verified through successful unpackaging, correct filenames
and size requirements for both kernel and rootfs files, and that they
start with the correct magic numbers (first 2 bytes) for the respective headers.
Newer Senao software requires more checks but their script
includes a way to skip them.
The OEM upgrade script is at
/etc/fwupgrade.sh
OKLI kernel loader is required because the OEM software
expects the kernel to be less than 1536k
and the OEM upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied at the PHY side,
using the at803x driver `phy-mode` setting through the DTS.
Therefore, the Ethernet Configuration registers for GMAC0
do not need the bits for RGMII delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
Signed-off-by: Michael Pratt <mcpratt@pm.me>
FCC ID: 2AG6R-AN500APIAC
Araknis AN-500-AP-I-AC is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
this board is a Senao device:
the hardware is equivalent to EnGenius EAP1200
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails
**Specification:**
- QCA9557 SOC MIPS 74kc, 2.4 GHz WMAC, 2x2
- QCA9882 WLAN PCI card 168c:003c, 5 GHz, 2x2, 26dBm
- AR8035-A PHY RGMII GbE with PoE+ IN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16
- UART console J10, populated, RX shorted to ground
- 4 antennas 5 dBi, internal omni-directional plates
- 4 LEDs power, 2G, 5G, wps
- 1 button reset
NOTE: all 4 gpio controlled LEDS are viewed through the same lightguide
therefore, the power LED is off for default state
**MAC addresses:**
MAC address labeled as ETH
Only one Vendor MAC address in flash at art 0x0
eth0 ETH *:e1 art 0x0
phy1 2.4G *:e2 ---
phy0 5GHz *:e3 ---
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin at J10
**Installation:**
Method 1: Firmware upgrade page:
(if you cannot access the APs webpage)
factory reset with the reset button
connect ethernet to a computer
OEM webpage at 192.168.20.253
username and password 'araknis'
make a new password, login again...
Navigate to 'File Management' page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm
wait about 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
192.168.20.253
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
Method 1: Serial to load Failsafe webpage (above)
Method 2: delete a checksum from uboot-env
this will make uboot load the failsafe image at next boot
because it will fail the checksum verification of the image
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait a minute
connect to ethernet and navigate to
192.168.20.253
select OEM firmware image and click upgrade
Method 3: backup mtd partitions before upgrade
**TFTP recovery:**
Requires serial console, reset button does nothing
rename initramfs-kernel.bin to '0101A8C0.img'
make available on TFTP server at 192.168.1.101
power board, interrupt boot with serial console
execute `tftpboot` and `bootm 0x81000000`
NOTE: TFTP may not be reliable due to bugged bootloader
set MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software is built using SDKs from Senao
which is based on a heavily modified version
of Openwrt Kamikaze or Altitude Adjustment.
One of the many modifications is sysupgrade being performed by a custom script.
Images are verified through successful unpackaging, correct filenames
and size requirements for both kernel and rootfs files, and that they
start with the correct magic numbers (first 2 bytes) for the respective headers.
Newer Senao software requires more checks but their script
includes a way to skip them.
The OEM upgrade script is at
/etc/fwupgrade.sh
OKLI kernel loader is required because the OEM software
expects the kernel to be less than 1536k
and the OEM upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied at the PHY side,
using the at803x driver `phy-mode` setting through the DTS.
Therefore, the Ethernet Configuration registers for GMAC0
do not need the bits for RGMII delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
Signed-off-by: Michael Pratt <mcpratt@pm.me>
FCC ID: U2M-AN300APIN
Araknis AN-300-AP-I-N is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
this board is a Senao device:
the hardware is equivalent to EnGenius EWS310AP
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails
**Specification:**
- AR9344 SOC MIPS 74kc, 2.4 GHz WMAC, 2x2
- AR9382 WLAN PCI on-board 168c:0030, 5 GHz, 2x2
- AR8035-A PHY RGMII GbE with PoE+ IN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM 1839ZFG V59C1512164QFJ25
- UART console J10, populated, RX shorted to ground
- 4 antennas 5 dBi, internal omni-directional plates
- 4 LEDs power, 2G, 5G, wps
- 1 button reset
NOTE: all 4 gpio controlled LEDS are viewed through the same lightguide
therefore, the power LED is off for default state
**MAC addresses:**
MAC address labeled as ETH
Only one Vendor MAC address in flash at art 0x0
eth0 ETH *:7d art 0x0
phy1 2.4G *:7e ---
phy0 5GHz *:7f ---
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin at J10
**Installation:**
Method 1: Firmware upgrade page:
(if you cannot access the APs webpage)
factory reset with the reset button
connect ethernet to a computer
OEM webpage at 192.168.20.253
username and password 'araknis'
make a new password, login again...
Navigate to 'File Management' page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm
wait about 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
192.168.20.253
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
Method 1: Serial to load Failsafe webpage (above)
Method 2: delete a checksum from uboot-env
this will make uboot load the failsafe image at next boot
because it will fail the checksum verification of the image
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait a minute
connect to ethernet and navigate to
192.168.20.253
select OEM firmware image and click upgrade
Method 3: backup mtd partitions before upgrade
**TFTP recovery:**
Requires serial console, reset button does nothing
rename initramfs-kernel.bin to '0101A8C0.img'
make available on TFTP server at 192.168.1.101
power board, interrupt boot with serial console
execute `tftpboot` and `bootm 0x81000000`
NOTE: TFTP may not be reliable due to bugged bootloader
set MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software is built using SDKs from Senao
which is based on a heavily modified version
of Openwrt Kamikaze or Altitude Adjustment.
One of the many modifications is sysupgrade being performed by a custom script.
Images are verified through successful unpackaging, correct filenames
and size requirements for both kernel and rootfs files, and that they
start with the correct magic numbers (first 2 bytes) for the respective headers.
Newer Senao software requires more checks but their script
includes a way to skip them.
The OEM upgrade script is at
/etc/fwupgrade.sh
OKLI kernel loader is required because the OEM software
expects the kernel to be less than 1536k
and the OEM upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied at the PHY side,
using the at803x driver `phy-mode` setting through the DTS.
Therefore, the Ethernet Configuration registers for GMAC0
do not need the bits for RGMII delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
Signed-off-by: Michael Pratt <mcpratt@pm.me>
ALFA Network Tube-2HQ is a successor of the Tube-2H/P series (EOL) which
was based on the Atheros AR9331. The new version uses Qualcomm QCA9531.
Specifications:
- Qualcomm/Atheros QCA9531 v2
- 650/400/200 MHz (CPU/DDR/AHB)
- 64 or 128 MB of RAM (DDR2)
- 16+ MB of flash (SPI NOR)
- 1x 10/100 Mbps Ethernet with passive PoE input (24 V)
(802.3at/af PoE support with optional module)
- 1T1R 2.4 GHz Wi-Fi with external PA (SE2623L, up to 27 dBm) and LNA
- 1x Type-N (male) antenna connector
- 6x LED (5x driven by GPIO)
- 1x button (reset)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- UART (4-pin, 2.00 mm pitch) header on PCB
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on LEDE/OpenWrt. Alternatively, you can use web recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
device, wait for first blink of all LEDs (indicates network setup),
then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Switch to a generic GPIO cascade driver.
Signed-off-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Signed-off-by: Petr Štetiar <ynezz@true.cz> [missing commit description]
Hardware
--------
SoC: QCN5502
Flash: 16 MiB
RAM: 128 MiB
Ethernet: 1 gigabit port
Wireless No1: QCN5502 on-chip 2.4GHz 4x4
Wireless No2: QCA9984 pcie 5GHz 4x4
USB: none
Installation
------------
Flash the factory image using the stock web interface or TFTP the
factory image to the bootloader.
What works
----------
- LEDs
- Ethernet port
- 5GHz wifi (QCA9984 pcie)
What doesn't work
-----------------
- 2.4GHz wifi (QCN5502 on-chip)
(I was not able to make this work, probably because ath9k requires
some changes to support QCN5502.)
Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
This makes available the additional space,
which was occupied by OEM's jffs2 partition before:
"0x000000f80000-0x000001000000 : jffs2"
Reverting to the OEM firmware will also recover
this partition, i.e. it is not needed and can be
used by OpenWrt.
Signed-off-by: Tamas Balogh <tamasbalogh@hotmail.com>
Device specifications:
======================
* Qualcomm/Atheros AR7240 rev 2
* 350/350/175 MHz (CPU/DDR/AHB)
* 32 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 1T1R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
- eth0
+ 18-24V passive POE (mode B)
+ used as WAN interface
- eth1
+ builtin switch port 4
+ used as LAN interface
* 12-24V 1A DC
* external antenna
The device itself requires the mtdparts from the uboot arguments to
properly boot the flashed image and to support dual-boot (primary +
recovery image). Unfortunately, the name of the mtd device in mtdparts is
still using the legacy name "ar7240-nor0" which must be supplied using the
Linux-specfic DT parameter linux,mtd-name to overwrite the generic name
"spi0.0".
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Device specifications:
======================
* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/200 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2T2R 2.4 GHz Wi-Fi (11n)
* 2T2R 5 GHz Wi-Fi (11ac)
* 4x GPIO-LEDs (3x wifi, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* TI tmp423 (package kmod-hwmon-tmp421) for temperature monitoring
* 2x ethernet
- eth0
+ AR8035 ethernet PHY (RGMII)
+ 10/100/1000 Mbps Ethernet
+ 802.3af POE
+ used as LAN interface
- eth1
+ AR8031 ethernet PHY (RGMII)
+ 10/100/1000 Mbps Ethernet
+ 18-24V passive POE (mode B)
+ used as WAN interface
* 12-24V 1A DC
* internal antennas
This device support is based on the partially working stub from commit
53c474abbd ("ath79: add new OF only target for QCA MIPS silicon").
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
- clean up leftovers regarding MAC configure in dts
- fix alphabetical order in caldata
- IMAGE_SIZE for sysupgrade image
Signed-off-by: Tamas Balogh <tamasbalogh@hotmail.com>
Device specifications:
======================
* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2T2R 2.4 GHz Wi-Fi (11n)
* 2T2R 5 GHz Wi-Fi (11ac)
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* TI tmp423 (package kmod-hwmon-tmp421) for temperature monitoring
* 2x ethernet
- eth0
+ AR8035 ethernet PHY (RGMII)
+ 10/100/1000 Mbps Ethernet
+ 802.3af POE
+ used as LAN interface
- eth1
+ AR8035 ethernet PHY (SGMII)
+ 10/100/1000 Mbps Ethernet
+ 18-24V passive POE (mode B)
+ used as WAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Device specifications:
======================
* Qualcomm/Atheros AR9344 rev 2
* 560/450/225 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 1T1R 2.4 GHz Wi-Fi
* 2T2R 5 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* TI tmp423 (package kmod-hwmon-tmp421) for temperature monitoring
* 2x ethernet
- eth0
+ AR8035 ethernet PHY
+ 10/100/1000 Mbps Ethernet
+ 802.3af POE
+ used as LAN interface
- eth1
+ 10/100 Mbps Ethernet
+ builtin switch port 1
+ 18-24V passive POE (mode B)
+ used as WAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Asus RP-AC66 Repeater
Hardware specifications:
Board: AP152
SoC: QCA9563
DRAM: 64MB DDR2
Flash: 25l128 16MB SPI-NOR
LAN/WAN: 1x1000M QCA8033
WiFi 5GHz: QCA9880
Clocks: CPU:775.000MHz, DDR:650.000MHz, AHB:258.333MHz, Ref:25.000MHz
MAC addresses as verified by OEM firmware:
use address source
Lan/Wan *:24 art 0x1002 (label)
2G *:24 art 0x1002
5G *:26 art 0x5006
Installation:
Asus windows recovery tool:
- install the Asus firmware restoration utility
- unplug the router, hold the reset button while powering it on
- release when the power LED flashes slowly
- specify a static IP on your computer:
IP address: 192.168.1.75
Subnet mask 255.255.255.0
- Start the Asus firmware restoration utility, specify the factory image
and press upload
- Do not power off the device after OpenWrt has booted until the LED flashing.
TFTP Recovery method:
- set computer to a static ip, 192.168.1.75
- connect computer to the LAN 1 port of the router
- hold the reset button while powering on the router for a few seconds
- send firmware image using a tftp client; i.e from linux:
$ tftp
tftp> binary
tftp> connect 192.168.1.1
tftp> put factory.bin
tftp> quit
Signed-off-by: Tamas Balogh <tamasbalogh@hotmail.com>
SoC: AR9344
RAM: 128MB
Flash: 16MiB SPI NOR
5GHz WiFi: AR9382 PCIe 2x2:2 802.11n
2.4GHz WiFi: AR9344 (SoC) AHB 2x2:2 802.11n
5x Fast ethernet via SoC switch (green LEDs)
1x USB 2.0
4x front LEDs from SoC GPIO
1x front WPS button from SoC GPIO
1x bottom reset button from SoC GPIO
UART header JP1, 115200 no parity 1 stop
TX
GND
VCC
(N/P)
RX
Flash factory image via "emergency room" recovery:
- Configure your computer with a static IP 192.168.1.123/24
- Connect to LAN port on the N600 switch
- Hold reset putton
- Power on, holding reset until the power LED blinks slowly
- Visit http://192.168.1.1/ and upload OpenWrt factory image
- Wait at least 5 minutes for flashing, reboot and key generation
- Visit http://192.168.1.1/ (OpenWrt LuCI) and upload OpenWrt sysupgrade image
Signed-off-by: Ryan Mounce <ryan@mounce.com.au>
[dt leds preparations]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
The jjPlus JWAP230 is an access point board built around the QCA9558,
with built-in 2.4GHz 3x3 N WiFi (28dBm). It can be expanded with 2
mini-PCIe boards, and has an USB2 root port.
Specifications:
- SOC: Qualcomm Atheros QCA9558
- CPU: 720MHz
- H/W switch: QCA8327 rev 2
- Flash: 16 MiB SPI NOR (en25qh128)
- RAM: 128 MiB DDR2
- WLAN: AR9550 built-in SoC bgn 3T3R (ath9k)
- PCI: 2x mini-PCIe (optional 5V)
- LEDs: 6x LEDs (3 are currently available)
- Button: 1x Reset (not yet defined)
- USB2:
- 1x Type A root port
- 1x combined mini-PCIe
- Ethernet:
- 2x 10/100/1000 (1x PoE 802.3af (36-57 V))
Notes:
The device used to be supported in the ar71xx target.
For upgrades: Please use "sysupgrade --force -n <image>".
This will restore the device back to OpenWrt defaults!
MAC address assignment:
use source
LAN art 0x0
WAN art 0x6
WLAN art 0x1002 (as part of the calibration data)
Flash instructions:
- install from u-boot with tftp (requires serial access)
> setenv ipaddr a.b.c.d
> setenv serverip e.f.g.h
> tftp 0x80060000 \
openwrt-ath79-generic-jjplus_jwap230-squashfs-sysupgrade.bin
> erase 0x9f050000 +${filesize}
> cp.b $fileaddr 0x9f050000 $filesize
> setenv bootcmd bootm 0x9f050000
> saveenv
Signed-off-by: Olivier Valentin <valentio@free.fr>
[Added DT-Leds (based on ar71xx), Added more notes about sysupgrade,
fixed "qca9550" to match SoC in commit and dts file name]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Add the Embedded Wireless "Balin" platform, it is in ar71xx too
SoC: QCA AR9344 or AR9350
RAM: DDR2-RAM 64MBytes
Flash: SPI-NOR 16MBytes
WLAN: 2 x 2 MIMO 2.4 & 5 GHz IEEE802.11 a/b/g/n
Ethernet: 3 x 10/100 Mb/s
USB: 1 x USB2.0 Host/Device bootstrap-pin at power-up
PCIe: MiniPCIe - 1 x lane PCIe 1.2
Button: 1 x Reset-Button
UART: 1 x Normal, 1 x High-Speed
JTAG: 1 x EJTAG
LED: 1 x Green Power/Status LED
GPIO: 10 x Input/Output multiplexed
The module comes already with the current vanilla OpenWrt firmware.
To update, use "sysupgrade -n --force <image>" image directly in
vendor firmware. This resets the existing configurations back to
default!
Signed-off-by: Catrinel Catrinescu <cc@80211.de>
[indent, led function+color properties, fix partition unit-address,
re-enable pcie port, mention button+led in commit message]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Further devices from the series have been added in the meantime,
introducing `qca955x_dlink_dap-2xxx.dtsi`.
Thus, merge support for DAP-2695 with the existing dtsi.
This implies factory images can now be flashed via the regular
OEM Web UI, as well as the bootloader recovery.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
Specifications:
SOC: QCA9531 650 MHz
ROM: 16 MiB Flash (Winbond W25Q128FV)
RAM: 128 MiB DDR2 (Winbond W971GG6SB)
LAN: 10/100M *2
WAN: 10/100M *1
LED: BGR color *1
Mac address:
label C8:0E:77:xx:xx:68 art@0x0
lan C8:0E:77:xx:xx:62 art@0x6
wan C8:0E:77:xx:xx:68 art@0x0 (same as the label)
wlan C8:0E:77:xx:xx:B2 art@0x1002 (load automatically)
TFTP installation:
* Set local IP to 192.168.67.100 and open tftpd64, link lan
port to computer.
Rename "xxxx-factory.bin" to
"openwrt-ar71xx-generic-ap147-16M-rootfs-squashfs.bin".
* Make sure firmware file is in the tftpd's directory, push
reset button and plug in, hold it for 5 seconds, and then
it will download firmware from tftp server automatically.
More information:
* This device boot from flash@0xe80000 so we need a okli
loader to deal with small kernel partition issue. In order
to make full use of the storage space, connect a part of the
previous kernel partition to the firmware.
Stock Modify
0x000000-0x040000(u-boot) 0x000000-0x040000(u-boot)
0x040000-0x050000(u-boot-env) 0x000000-0x050000(u-boot-env)
0x050000-0xe80000(rootfs) 0x050000-0xe80000(firmware part1)
0xe80000-0xff0000(kernel) 0xe80000-0xe90000(okli-loader)
0xe90000-0xff0000(firmware part2)
0xff0000-0x1000000(art) 0xff0000-0x1000000(art)
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
AR9331 requires kmod-usb2-chipidea to use the USB ports. Include the
correct package so they can be used with the base image.
Signed-off-by: David Bauer <mail@david-bauer.net>
These instructions are repeated for a few devices now, let's move
them to shared definition so we do not repeat ourselves too often.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Change `DAP-2965` to `DAP-2695` for device selection in menuconfig.
Fixes: cd09f26660 ("ath79: add support for D-Link DAP-2695-A1")
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
[add Fixes]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The Onion Omega is a hardware development platform with built-in WiFi.
https://onioniot.github.io/wiki/
Specifications:
- QCA9331 @ 400 MHz (MIPS 24Kc Big-Endian Processor)
- 64MB of DDR2 RAM running at 400 MHz
- 16MB of on-board flash storage
- Support for USB 2.0
- Support for Ethernet at 100 Mbps
- 802.11b/g/n WiFi at 150 Mbps
- 18 digital GPIOs
- A single Serial UART
- Support for SPI
- Support for I2S
Flash instructions:
The device is running OpenWrt upon release using the ar71xx target.
Both a sysupgrade
and uploading the factory image using u-boots web-UI do work fine.
Depending on the ssh client, it might be necessary to enable outdated
KeyExchange methods e.g. in the clients ssh-config:
Host 192.168.1.1
KexAlgorithms +diffie-hellman-group1-sha1
The stock credentials are: root onioneer
For u-boots web-UI manually configure `192.168.1.2/24` on your computer,
connect to `192.168.1.1`.
MAC addresses as verified by OEM firmware:
2G phy0 label
LAN eth0 label - 1
LAN is only available in combination with an optional expansion dock.
Based on vendor acked commit:
commit 5cd49bb067 ("ar71xx: add support for Onion Omega")
Partly reverts:
commit fc553c7e4c ("ath79: drop unused/incomplete dts")
Signed-off-by: Jan-Niklas Burfeind <git@aiyionpri.me>
Specifications:
- SoC: QCA9558
- DRAM: 128MB DDR2
- Flash: 16MB SPI-NOR
- Wireless: on-board abgn 2×2 2.4GHz radio
- Ethernet: 2x 10/100/1000 Mbps (1x 802.11af PoE)
- miniPCIe slot
Flash instruction:
- From u-boot
tftpboot 0x80500000 openwrt-ath79-generic-compex_wpj558-16m-squashfs-sysupgrade.bin
erase 0x9f030000 +$filesize
cp.b $fileaddr 0x9f030000 $filesize
boot
- From cpximg loader
The cpximg loader can be started either by holding the reset button
during power up. Once it's running, a TFTP-server under 192.168.1.1 will accept
the image appropriate for the board revision that is etched on the board.
For example, if the board is labelled '6A07':
tftp -v -m binary 192.168.1.1 -c put openwrt-ath79-generic-compex_wpj558-16m-squashfs-cpximg-6a07.bin
Signed-off-by: Romain Mahoux <romain@mahoux.fr>
[convert to nvmem, remove redundant lan_mac in 02_network]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Atheros DB120 reference board.
Specifications:
SoC: QCA9344
DRAM: 128Mb DDR2
Flash: 8Mb SPI-NOR, 128Mb NAND flash
Switch: 5x 10/100Mbps via AR8229 switch (integrated into SoC),
5x 10/100/1000Mbps via QCA8237 via RGMII
WLAN: AR9300 (SoC, 2.4G+5G) + AR9340 (PCIe, 5G-only)
USB: 1x 2.0
UART: standard QCA UART header
JTAG: yes
Button: 1x reset
LEDs: a lot
Slots: 2x mPCIe + 1x mini-PCI, but using them requires
additional undocumented changes.
Misc: The board allows to boot off NAND, and there is
I2S audio support as well - also requiring
additional undocumented changes.
Installation:
1. Original bootloader
Connect the board to ethernet
Set up a server with an IP address of 192.168.1.10
Make the openwrt-ath79-generic-atheros_db120-squashfs-factory.bin
available via TFTP
tftpboot 0x80060000 openwrt-ath79-generic-atheros_db120-squashfs-factory.bin
erase 0x9f050000 +$filesize
cp.b $fileaddr 0x9f050000 $filesize
2. pepe2k's u-boot_mod
Connect the board to ethernet
Set up a server with an IP address of 192.168.1.10
Make the openwrt-ath79-generic-atheros_db120-squashfs-factory.bin
available via TFTP, as "firmware.bin"
run fw_upg
Reboot the board.
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
[explicit factory recipe in generic.mk, sorting in 10-ath9k-eeprom,
convert to nvmem, use fwconcat* names in DTS, remove unneeded DT
labels, remove redundant uart node]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The GL-X300B is a industrial 4G LTE router based on the Qualcomm
QCA9531 SoC.
Specifications:
- Qualcomm QCA9531 @ 650 MHz
- 128 MB of RAM
- 16 MB of SPI NOR FLASH
- 2x 10/100 Mbps Ethernet
- 2.4GHz 802.11b/g/n
- 1x USB 2.0 (vbus driven by GPIO)
- 4x LED, driven by GPIO
- 1x button (reset)
- 1x mini pci-e slot (vcc driven by GPIO)
- RS-485 Serial Port (untested)
Flash instructions:
This firmware can be flashed using either sysupgrade from the GL.iNet
firmware or the recovery console as follows:
- Press and hold the reset button
- Connect power to the router, wait five seconds
- Manually configure 192.168.1.2/24 on your computer, connect to
192.168.1.1
- Upload the firmware image using the web interface
RS-485 serial port is untested and may depend on the following commit in
the GL.iNet repo:
202e83a32a
MAC addresses as verified by OEM firmware:
vendor OpenWrt address
WAN eth0 label
LAN eth1 label + 1
2g phy0 label + 2
The label MAC address was found in the art partition at 0x0
Based on vendor commit:
16c5708b20
Signed-off-by: John Marrett <johnf@zioncluster.ca>
Specifications:
* QCA9531, 16 MiB flash (Winbond W25Q128JVSQ), 128 MiB RAM
* 802.11n 2T2R (external antennas)
* QCA9887, 802.11ac 1T1R (connected with diplexer to one of the antennas)
* 3x 10/100 LAN, 1x 10/100 WAN
* UART header with pinout printed on PCB
Installation:
* The device comes with a bootloader installed only
* The bootloader offers DHCP and is reachable at http://10.123.123.1
* Accept the agreement and flash sysupgrade.bin
* Use Firefox if flashing does not work
TFTP recovery with static IP:
* Rename sysupgrade.bin to jt-or750i_firmware.bin
* Offer it via TFTP server at 192.168.0.66
* Keep the reset button pressed for 4 seconds after connecting power
TFTP recovery with dynamic IP:
* Rename sysupgrade.bin to jt-or750i_firmware.bin
* Offer it via TFTP server with a DHCP server running at the same address
* Keep the reset button pressed for 6 seconds after connecting power
Co-authored-by: Sebastian Schaper <openwrt@sebastianschaper.net>
Signed-off-by: Vincent Wiemann <vincent.wiemann@ironai.com>
sysupgrade metadata is not flashed to the device, so check-size
should be called _before_ adding metadata to the image.
While at it, do some obvious wrapping improvements.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Acked-by: Paul Spooren <mail@aparcar.org>
Device specifications
* SoC: QCA9563 @ 775MHz (MIPS 74Kc)
* RAM: 128MiB DDR2
* Flash: 16MiB SPI-NOR (EN25QH128)
* Wireless 2.4GHz (SoC): b/g/n, 3x3
* Wireless 5Ghz (QCA9988): a/n/ac, 4x4 MU-MIMO
* IoT Wireless 2.4GHz (QCA6006): currently unusable
* Ethernet (AR8327): 3 LAN × 1GbE, 1 WAN × 1GbE
* LEDs: Internet (blue/orange), System (blue/orange)
* Buttons: Reset
* UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1)
* Power: 12VDC, 1,5A
MAC addresses map (like in OEM firmware)
art@0x0 88:C3:97:*:57 wan/label
art@0x1002 88:C3:97:*:2D lan/wlan2g
art@0x5006 88:C3:97:*:2C wlan5g
Obtain SSH Access
1. Download and flash the firmware version 1.3.8 (China).
2. Login to the router web interface and get the value of `stok=` from the
URL
3. Open a new tab and go to the following URL (replace <STOK> with the stok
value gained above; line breaks are only for easier handling, please put
together all four lines into a single URL without any spaces):
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev
?bssid=any&user_id=any&ssid=-h%0Anvram%20set%20ssh_en%3D1%0Anvram%20commit
%0Ased%20-i%20%27s%2Fchannel%3D.%2A%2Fchannel%3D%5C%5C%22debug%5C%5C%22%2F
g%27%20%2Fetc%2Finit.d%2Fdropbear%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A
4. Wait 30-60 seconds (this is the time required to generate keys for the
SSH server on the router).
Create Full Backup
1. Obtain SSH Access.
2. Create backup of all flash (on router):
dd if=/dev/mtd0 of=/tmp/ALL.backup
3. Copy backup to PC (on PC):
scp root@192.168.31.1:/tmp/ALL.backup ./
Tip: backup of the original firmware, taken three times, increases the
chances of recovery :)
Calculate The Password
* Locally using shell (replace "12345/E0QM98765" with your router's serial
number):
On Linux
printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | \
md5sum - | head -c8 && echo
On macOS
printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | \
md5 | head -c8
* Locally using python script (replace "12345/E0QM98765" with your
router's serial number):
wget https://raw.githubusercontent.com/eisaev/ax3600-files/master/scripts/calc_passwd.py
python3.7 -c 'from calc_passwd import calc_passwd; print(calc_passwd("12345/E0QM98765"))'
* Online
https://www.oxygen7.cn/miwifi/
Debricking (lite)
If you have a healthy bootloader, you can use recovery via TFTP using
programs like TinyPXE on Windows or dnsmasq on Linux. To switch the router
to TFTP recovery mode, hold down the reset button, connect the power
supply, and release the button after about 10 seconds. The router must be
connected directly to the PC via the LAN port.
Debricking
You will need a full dump of your flash, a CH341 programmer, and a clip
for in-circuit programming.
Install OpenWRT
1. Obtain SSH Access.
2. Create script (on router):
echo '#!/bin/sh' > /tmp/flash_fw.sh
echo >> /tmp/flash_fw.sh
echo '. /bin/boardupgrade.sh' >> /tmp/flash_fw.sh
echo >> /tmp/flash_fw.sh
echo 'board_prepare_upgrade' >> /tmp/flash_fw.sh
echo 'mtd erase rootfs_data' >> /tmp/flash_fw.sh
echo 'mtd write /tmp/openwrt.bin firmware' >> /tmp/flash_fw.sh
echo 'sleep 3' >> /tmp/flash_fw.sh
echo 'reboot' >> /tmp/flash_fw.sh
echo >> /tmp/flash_fw.sh
chmod +x /tmp/flash_fw.sh
3. Copy `openwrt-ath79-generic-xiaomi_aiot-ac2350-squashfs-sysupgrade.bin`
to the router (on PC):
scp openwrt-ath79-generic-xiaomi_aiot-ac2350-squashfs-sysupgrade.bin \
root@192.168.31.1:/tmp/openwrt.bin
4. Flash OpenWRT (on router):
/bin/ash /tmp/flash_fw.sh &
5. SSH connection will be interrupted - this is normal.
6. Wait for the indicator to turn blue.
Signed-off-by: Evgeniy Isaev <isaev.evgeniy@gmail.com>
[improve commit message formatting slightly]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This commit adds support for the Teltonika RUT230 v1, a Atheros AR9331
based router with a Quectel UC20 UMTS modem.
Hardware
--------
Atheros AR9331
16 MB SPI-NOR XTX XT25F128B
64M DDR2 memory
Atheros AR9331 1T1R 802.11bgn Wireless
Boootloader: pepe2k U-Boot mod
Hardware-Revision
-----------------
There are two board revisions of the RUT230, a v0 and v1.
A HW version is silkscreened on the top of the PCBs front side as well
as shown in the Teltonika UI. However, this looks to be a different
identifier, as the GPl dump shows this silkscreened / UI shown version
are internally treated identically.
Th following mapping has been obtained from the latest GPl dump.
HW Ver 01 - 04 --> v0
HW Ver > 05 --> v1
My board was a HW Ver 09 and is treated as a v1.
Installation
------------
While attaching power, hold down the reset button and release it after
the signal LEDs flashed 3 times.
Attach your Computer with the devices LAN port and assign yourself the
IPv4 address 192.168.1.10/24. Open a web browser, navigate to
192.168.1.1. Upload the OpenWrt factory image.
The device will install OpenWrt and automatically reboots afterwards.
You can use the smae procedure with the stock firmware to return back to
the vendor firmware.
Signed-off-by: David Bauer <mail@david-bauer.net>
NEC Aterm WF1200CR is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on
QCA9561.
Specification:
- SoC : Qualcomm Atheros QCA9561
- RAM : DDR2 128 MiB (W971GG6SB-25)
- Flash : SPI-NOR 8 MiB (MX25L6433FM2I-08G)
- WLAN : 2.4/5 GHz 2T2R
- 2.4 GHz : QCA9561 (SoC)
- 5 GHz : QCA9888
- Ethernet : 2x 10/100 Mbps
- Switch : QCA9561 (SoC)
- LEDs/Keys : 8x/3x (2x buttons, 1x slide-switch)
- UART : through-hole on PCB
- JP1: Vcc, GND, NC, TX, RX from "JP1" marking
- 115200n8
- Power : 12 VDC, 0.9 A
Flash instruction using factory image (stock: < v1.3.2):
1. Boot WF1200CR normally with "Router" mode
2. Access to "http://192.168.10.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt factory image and click update ("更新") button to
perform firmware update
4. Wait ~150 seconds to complete flashing
Alternate flash instruction using initramfs image (stock: >= v1.3.2):
1. Prepare the TFTP server with the IP address 192.168.1.10 and place
the OpenWrt initramfs image to the TFTP directory with the name
"0101A8C0.img"
2. Connect serial console to WF1200CR
3. Boot WF1200CR and interrupt with any key after the message
"Hit any key to stop autoboot: 2", the U-Boot starts telnetd after
the message "starting telnetd server from server 192.168.1.1"
4. login the telnet (address: 192.168.1.1)
5. Perform the following commands to modify "bootcmd" variable
temporary and check the value
(to ignore the limitation of available commands, "tp; " command at
the first is required as dummy, and the output of "printenv" is
printed on the serial console)
tp; set bootcmd 'set autostart yes; tftpboot'
tp; printenv
6. Save the modified variable with the following command and reset
device
tp; saveenv
tp; reset
7. The U-Boot downloads initramfs image from TFTP server and boots it
8. On initramfs image, download the sysupgrade image to the device and
perform the following commands to erase stock firmware and sysupgrade
mtd erase firmware
sysupgrade <sysupgrade image>
9. After the rebooting by completion of sysupgrade, start U-Boot telnetd
and login with the same way above (3, 4)
10. Perform the following commands to reset "bootcmd" variable to the
default and reset the device
tp; run seattle
tp; reset
(the contents of "seattle":
setenv bootcmd 'bootm 0x9f070040' && saveenv)
11. Wait booting-up the device
Known issues:
- the following 6x LEDs are connected to the gpio controller on QCA9888
chip and the implementation of control via the controller is missing in
ath10k/ath10k-ct
- "ACTIVE" (Red/Green)
- "2.4GHz" (Red/Green)
- "5GHz" (Red/Green)
Note:
- after the version v1.3.2 of stock firmware, "offline update" by
uploading image by user is deleted and the factory image cannot be
used
- the U-Boot on WF1200CR doesn't configure the port-side LEDs on WAN/LAN
and the configuration is required on OpenWrt
- gpio-hog: set the direction of GPIO 14(WAN)/19(LAN) to output
- pinmux: set GPIO 14/19 as switch-controlled LEDs
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
This patch adds support for the Devolo dLAN pro 1200+ WiFi ac.
This device is a plc wifi AC2400 router/extender with 2 Ethernet ports,
has a QCA7500 PLC and uses the HomePlug AV2 standard.
Other than the PLC the hardware is identical to the Devolo Magic 2 WIFI.
Therefore it uses the same dts, which was moved to a dtsi to be included
by both boards.
This is a board that was previously included in the ar71xx tree.
Hardware:
SoC: AR9344
CPU: 560 MHz
Flash: 16 MiB (W25Q128JVSIQ)
RAM: 128 MiB DDR2
Ethernet: 2xLAN 10/100/1000
PLC: QCA75000 (Qualcomm HPAV2)
PLC Uplink: 1Gbps MIMO
PLC Link: RGMII 1Gbps (WAN)
WiFi: Atheros AR9340 2.4GHz 802.11bgn
Atheros AR9882-BR4A 5GHz 802.11ac
Switch: QCA8337, Port0:CPU, Port2:PLC, Port3:LAN1, Port4:LAN2
Button: 3x Buttons (Reset, wifi and plc)
LED: 3x Leds (wifi, plc white, plc red)
GPIO Switch: 11-PLC Pairing (Active Low)
13-PLC Enable
21-WLAN power
MACs Details verified with the stock firmware:
Radio1: 2.4 GHz &wmac *:4c Art location: 0x1002
Radio0: 5.0 GHz &pcie *:4d Art location: 0x5006
Ethernet ðernet *:4e = 2.4 GHz + 2
PLC uplink --- *:4f = 2.4 GHz + 3
Label MAC address is from PLC uplink
The Powerline (PLC) interface of the dLAN pro 1200+ WiFi ac requires 3rd
party firmware which is not available from standard OpenWrt package
feeds. There is a package feed on github which you must add to
OpenWrt buildroot so you can build a firmware image which supports the
plc interface.
See: https://github.com/0xFelix/dlan-openwrt (forked from Devolo and
added compatibility for OpenWrt 21.02)
Flash instruction (TFTP):
1. Set PC to fixed ip address 192.168.0.100
2. Download the sysupgrade image and rename it to uploadfile
3. Start a tftp server with the image file in its root directory
4. Turn off the router
5. Press and hold Reset button
6. Turn on router with the reset button pressed and wait ~15 seconds
7. Release the reset button and after a short time
the firmware should be transferred from the tftp server
8. Allow 1-2 minutes for the first boot.
Signed-off-by: Felix Matouschek <felix@matouschek.org>
[add "plus" to compatible and device name]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Specifications:
SoC: QCA9533
DRAM: 32Mb DDR1
Flash: 8/16Mb SPI-NOR
LAN: 4x 10/100Mbps via AR8229 switch (integrated into SoC)
on GMII
WAN: 1x 10/100Mbps via MII
WLAN: QCA9530
USB: 1x 2.0
UART: standard QCA UART header
JTAG: yes
Button: 1x WPS, 1x reset
LEDs: 8x LEDs
A version with 4Mb flash is also available, but due to lack of
enough space it's not supported.
As the original flash layout does not provide enough space for
the kernel (1472k), the firmware uses OKLI and concat flash to
overcome the limitation without changing the boot address of the
bootloaders.
Installation:
1. Original bootloader
Connect the board to ethernet
Set up a server with an IP address of 192.168.1.10
Make the openwrt-ath79-generic-qca_ap143-8m-squashfs-factory.bin
available via TFTP
tftpboot 0x80060000 openwrt-ath79-generic-qca_ap143-8m-squashfs-factory.bin
erase 0x9f050000 +$filesize
cp.b $fileaddr 0x9f050000 $filesize
Reboot the board.
2. pepe2k's u-boot_mod
Connect the board to ethernet
Set up a server with an IP address of 192.168.1.10
Make the openwrt-ath79-generic-qca_ap143-8m-squashfs-factory.bin
available via TFTP, as "firmware.bin"
run fw_upg
Reboot the board.
For the 16M version of the board, please use
openwrt-ath79-generic-qca_ap143-16m-squashfs-factory.bin
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
[use fwconcatX names, drop redundant uart status, fix IMAGE_SIZE,
set up IMAGE/factory.bin without metadata]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Device specifications:
======================
* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2T2R 2.4 GHz Wi-Fi (11n)
* 2T2R 5 GHz Wi-Fi (11ac)
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x ethernet
- eth0
+ Label: Ethernet 1
+ AR8035 ethernet PHY (RGMII)
+ 10/100/1000 Mbps Ethernet
+ 802.3af POE
+ used as WAN interface
- eth1
+ Label: Ethernet 2
+ AR8035 ethernet PHY (SGMII)
+ 10/100/1000 Mbps Ethernet
+ used as LAN interface
* 1x USB
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Device specifications:
======================
* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 3T3R 2.4 GHz Wi-Fi (11n)
* 3T3R 5 GHz Wi-Fi (11ac)
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x ethernet
- eth0
+ Label: Ethernet 1
+ AR8035 ethernet PHY (RGMII)
+ 10/100/1000 Mbps Ethernet
+ 802.3af POE
+ used as WAN interface
- eth1
+ Label: Ethernet 2
+ AR8031 ethernet PHY (SGMII)
+ 10/100/1000 Mbps Ethernet
+ used as LAN interface
* 1x USB
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
ZiKing CPE46B is a POE outdoor 2.4ghz device with an integrated directional
antenna. It is low cost and mostly available via Aliexpress, references can
be found at:
- https://forum.openwrt.org/t/anddear-ziking-cpe46b-ar9331-ap121/60383
- https://git.lsd.cat/g/openwrt-cpe46b
Specifications:
- Atheros AR9330
- 32MB of RAM
- 8MB of flash (SPI NOR)
- 1 * 2.4ghz integrated antenna
- 2 * 10/100/1000 ethernet ports (1 POE)
- 3 * Green LEDs controlled by the SoC
- 3 * Green LEDs controlled via GPIO
- 1 * Reset Button controlled via GPIO
- 1 * 4 pin serial header on the PCB
- Outdoor packaging
Flashing instruction:
You can use sysupgrade image directly in vendor firmware which is based
on OpenWrt/LEDE. In case of issues with the vendor GUI, the vendor
Telnet console is vulnerable to command injection and can be used to gain
a shell directly on the OEM OpenWrt distribution.
Signed-off-by: Giulio Lorenzo <salveenee@mortemale.org>
[fix whitespaces, drop redundant uart status and serial0, drop
num-chipselects, drop 0x1002 MAC address for wmac]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
COMFAST CF-E375AC is a ceiling mount AP with PoE support,
based on Qualcomm/Atheros QCA9563 + QCA9886 + QCA8337.
Short specification:
2x 10/100/1000 Mbps Ethernet, with PoE support
128MB of RAM (DDR2)
16 MB of FLASH
3T3R 2.4 GHz, 802.11b/g/n
2T2R 5 GHz, 802.11ac/n/a, wave 2
built-in 5x 3 dBi antennas
output power (max): 500 mW (27 dBm)
1x RGB LED, 1x button
built-in watchdog chipset
Flash instruction:
1) Original firmware is based on OpenWrt.
Use sysupgrade image directly in vendor GUI.
2) TFTP
2.1) Set a tftp server on your machine with a fixed IP address of
192.168.1.10. A place the sysupgrade as firmware_auto.bin.
2.2) boot the device with an ethernet connection on fixed ip route
2.3) wait a few seconds and try to login via ssh
3) TFTP trough Bootloader
3.1) open the device case and get a uart connection working
3.2) stop the autoboot process and test connection with serverip
3.3) name the sysupgrade image firmware.bin and run firmware_upg
MAC addresses:
Though the OEM firmware has four adresses in the usual locations,
it appears that the assigned addresses are just incremented in a
different way:
interface address location
LAN: *:DC 0x0
WAN *:DD 0x1002
WLAN 2.4g *:E6 n/a (0x0 + 10)
WLAN 5g *:DE 0x6
unused *:DF 0x5006
The MAC address pointed at the label is the one assign to the LAN
interface.
Signed-off-by: Joao Henrique Albuquerque <joaohccalbu@gmail.com>
[add label-mac-device, remove redundant uart status, fix whitespace
issues, fix commit message wrapping, remove x bit on DTS file]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Before this commit, it was assumed that mkhash is in the PATH. While
this was fine for the normal build workflow, this led to some issues if
make TOPDIR="$(pwd)" -C "$pkgdir" compile
was called manually. In most of the cases, I just saw warnings like this:
make: Entering directory '/home/.../package/gluon-status-page'
bash: line 1: mkhash: command not found
bash: line 1: mkhash: command not found
bash: line 1: mkhash: command not found
bash: line 1: mkhash: command not found
bash: line 1: mkhash: command not found
bash: line 1: mkhash: command not found
bash: line 1: mkhash: command not found
bash: line 1: mkhash: command not found
[...]
While these were only warnings and the package still compiled sucessfully,
I also observed that some package even fail to build because of this.
After applying this commit, the variable $(MKHASH) is introduced. This
variable points to $(STAGING_DIR_HOST)/bin/mkhash, which is always the
correct path.
Signed-off-by: Leonardo Mörlein <me@irrelefant.net>
This device is a Senao-based product
using hardware and software from Senao
with the tar-gz platform for factory.bin
and checksum verification at boot time
using variables stored in uboot environment
and a 'failsafe' image when it fails.
Extremely similar hardware/software to Engenius EAP1200H
and other Engenius APs with qca955x
Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
By using the same custom kernel header magic
in both OKLI lzma-loader, DTS, and makefile
this hack is not necessary anymore
However, "rootfs" size and checksum
must now be supplied by the factory.bin image
through a script that is accepted by the OEM upgrade script.
This is because Senao OEM scripts assume a squashfs header exists
at the offset for the original "rootfs" partition
which is actually the kernel + rootfs in this implementation,
and takes size value from the header that would be there with hexdump,
but this offset is now the uImage header instead.
This frees up 1 eraseblock
previously used by the "fakeroot" partition
for bypassing the OEM image verification.
Also, these Senao devices with a 'failsafe' partition
and the tar-gz factory.bin platform would otherwise require
flashing the new tar-gz sysupgrade.bin afterward.
So this also prevents having to flash both images
when starting from OEM or 'failsafe'
the OEM upgrade script verifies the header magic numbers,
but only the first two bytes.
Example:
[ "${magic_word_kernel}" = "2705" ] &&
[ "${magic_word_rootfs}" = "7371" -o "${magic_word_rootfs}" = "6873" ] &&
errcode="0"
therefore picked the magic number
0x73714f4b
which is
'sqOK'
Signed-off-by: Michael Pratt <mcpratt@pm.me>
This device is a wireless router working on 2.4GHz band based on
Qualcom/Atheros AR9132 rev 2 SoC and is accompanied by Atheros AR9103
wireless chip and Realtek RTL8366RB/S switches. Due to two different
switches being used also two different devices are provided.
Specification:
- 400 MHz CPU
- 64 MB of RAM
- 32 MB of FLASH (NOR)
- 3x3:2 2.4 GHz 802.11bgn
- 5x 10/100/1000 Mbps Ethernet
- 4x LED, 3x button, On/Off slider, Auto/On/Off slider
- 1x USB 2.0
- bare UART header place on PCB
Flash instruction:
- NOTE: Pay attention to the switch variant and choose the image to
flash accordingly. (dmesg / kernel logs can tell it)
- Methods for flashing
- Apply factory image in OEM firmware web-gui.
- Sysupgrade on top of existing OpenWRT image
- U-Boot TFPT recovery for both stock or OpenWRT images:
The device U-boot contains a TFTP server that by default has
an address 192.168.11.1 (MAC 02:AA:BB:CC:DD:1A). During the boot
there is a time window, during which the device allows an image to
be uploaded from a client with address 192.168.11.2. The image will
be written on flash automatically.
1) Have a computer with static IP address 192.168.11.2 and the
router device switched off.
2) Connect the LAN port next to the WAN port in the device and the
computer using a network switch.
3) Assign IP 192.168.11.1 the MAC address 02:AA:BB:CC:DD:1A
arp -s 192.168.11.1 02:AA:BB:CC:DD:1A
4) Initiate an upload using TFTP image variant
curl -T <imagename> tftp://192.168.11.1
5) Switch on the device. The image will be uploaded subsequently.
You can keep an eye on the diag light on the device, it should
keep on blinking for a while indicating the writing of the image.
General notes:
- In the stock firmware the MAC address is the same among all
interfaces so it is left here that way too.
Recovery:
- TFTP method
- U-boot serial console
Differences to ar71xx platform
- This device is split in two different targets now due to hardware
being a bit different under the hood. Dynamic solution within the same
image is left for later time.
- GPIOs for a sliding On/Off switch, marked 'Movie engine' on the device
cover, were the wrong way around and were renamed qos_on -> movie_off,
qos_off -> movie_on. Associated key codes remained the same they were.
The device tree source code is mostly based on musashino's work
Signed-off-by: Mauri Sandberg <sandberg@mailfence.com>
Make packages depending on usb-serial selective, so we do not have
to add kmod-usb-serial manually for every device.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
These recipes and definitions can apply
to devices from other vendors
with PCB boards or SDK produced by Senao
not only the brand Engenius
possible examples:
Extreme Networks, WatchGuard, OpenMesh,
Fortinet, ALLNET, OCEDO, Plasma Cloud, devolo, etc.
so rename all of these items
and move DEVICE_VENDOR from common to generic/tiny.mk
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Specifications:
* QCA9557, 16 MiB Flash, 128 MiB RAM, 802.11n 2T2R
* QCA9882, 802.11ac 2T2R
* 2x Gigabit LAN (1x 802.11af PoE)
* IP68 pole-mountable outdoor case
Installation:
* Factory Web UI is at 192.168.0.50
login with 'admin' and blank password, flash factory.bin
* Recovery Web UI is at 192.168.0.50
connect network cable, hold reset button during power-on and keep it
pressed until uploading has started (only required when checksum is ok,
e.g. for reverting back to oem firmware), flash factory.bin
After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.
Both ethernet ports are set to LAN by default, matching the labelling on
the case. However, since both GMAC Interfaces eth0 and eth1 are connected
to the switch (QCA8337), the user may create an additional 'wan' interface
as desired and override the vlan id settings to map br-lan / wan to either
the PoE or non-PoE port, depending on the individual scenario of use.
So, the LAN and WAN ports would then be connected to different GMACs, e.g.
config interface 'lan'
option ifname 'eth0.1'
...
config interface 'wan'
option ifname 'eth1.2'
...
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '1 0t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '2 6t'
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
[add configuration example]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Port device support for Meraki MR12 from the ar71xx target to ath79.
Specifications:
- SoC: AR7242-AH1A CPU
- RAM: 64MiB (NANYA NT5DS32M16DS-5T)
- NOR Flash: 16MiB (MXIC MX25L12845EMI-10G)
- Ethernet: 1 x PoE Gigabit Ethernet Port (SoC MAC + AR8021-BL1E PHY)
- Ethernet: 1 x 100Mbit port (SoC MAC+PHY)
- Wi-Fi: Atheros AR9283-AL1A (2T2R, 11n)
Installation:
1. Requires TFTP server at 192.168.1.101, w/ initramfs & sysupgrade .bins
2. Open shell case
3. Connect a USB->TTL cable to headers furthest from the RF shield
4. Power on the router; connect to U-boot over 115200-baud connection
5. Interrupt U-boot process to boot Openwrt by running:
setenv bootcmd bootm 0xbf0a0000; saveenv;
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin;
bootm 0c00000;
6. Copy sysupgrade image to /tmp on MR12
7. sysupgrade /tmp/<filename-of-sysupgrade>.bin
Notes:
- kmod-owl-loader is still required to load the ART partition into the
driver.
- The manner of storing MAC addresses is updated from ar71xx; it is
at 0x66 of the 'config' partition, where it was discovered that the
OEM firmware stores it. This is set as read-only. If you are
migrating from ar71xx and used the method mentioned above to
upgrade, use kmod-mtd-rw or UCI to add the MAC back in. One more
method for doing this is described below.
- Migrating directly from ar71xx has not been thoroughly tested, but
one method has been used a couple of times with good success,
migrating 18.06.2 to a full image produced as of this commit. Please
note that these instructions are only for experienced users, and/or
those still able to open their device up to flash it via the serial
headers should anything go wrong.
1) Install kmod-mtd-rw and uboot-envtools
2) Run `insmod mtd-rw.ko i_want_a_brick=1`
3) Modify /etc/fw_env.config to point to the u-boot-env partition.
The file /etc/fw_env.config should contain:
# MTD device env offset env size sector size
/dev/mtd1 0x00000 0x10000 0x10000
See https://openwrt.org/docs/techref/bootloader/uboot.config
for more details.
4) Run `fw_printenv` to verify everything is correct, as per the
link above.
5) Run `fw_setenv bootcmd bootm 0xbf0a0000` to set a new boot address.
6) Manually modify /lib/upgrade/common.sh's get_image function:
Change ...
cat "$from" 2>/dev/null | $cmd
... into ...
(
dd if=/dev/zero bs=1 count=$((0x66)) ; # Pad the first 102 bytes
echo -ne '\x00\x18\x0a\x12\x34\x56' ; # Add in MAC address
dd if=/dev/zero bs=1 count=$((0x20000-0x66-0x6)) ; # Pad the rest
cat "$from" 2>/dev/null
) | $cmd
... which, during the upgrade process, will pad the image by
128K of zeroes-plus-MAC-address, in order for the ar71xx's
firmware partition -- which starts at 0xbf080000 -- to be
instead aligned with the ath79 firmware partition, which
starts 128K later at 0xbf0a0000.
7) Copy the sysupgrade image into /tmp, as above
8) Run `sysupgrade -F /tmp/<sysupgrade>.bin`, then wait
Again, this may BRICK YOUR DEVICE, so make *sure* to have your
serial cable handy.
Signed-off-by: Martin Kennedy <hurricos@gmail.com>
[add LED migration and extend compat message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
A header used in ELECOM WRC-300GHBK2-I and WRC-1750GHBK2-I/C is also
used in ELECOM WRC-2533GHBK-I, so split the code to generate the header
and move it to image-commands.mk to use from ramips target.
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Reviewed-by: Sungbo Eo <mans0n@gorani.run>
FCC ID: A8J-EAP1200H
Engenius EAP1200H is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
**Specification:**
- QCA9557 SOC
- QCA9882 WLAN PCI card, 5 GHz, 2x2, 26dBm
- AR8035-A PHY RGMII GbE with PoE+ IN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16FG
- UART at J10 populated
- 4 internal antenna plates (5 dbi, omni-directional)
- 5 LEDs, 1 button (power, eth0, 2G, 5G, WPS) (reset)
**MAC addresses:**
MAC addresses are labeled as ETH, 2.4G, and 5GHz
Only one Vendor MAC address in flash
eth0 ETH *:a2 art 0x0
phy1 2.4G *:a3 ---
phy0 5GHz *:a4 ---
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin at J10
**Installation:**
2 ways to flash factory.bin from OEM:
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will brick the device
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery:**
Requires serial console, reset button does nothing
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board, interrupt boot
execute tftpboot and bootm 0x81000000
NOTE: TFTP is not reliable due to bugged bootloader
set MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of EAP1200H is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-ar71xx-generic-eap1200h-uImage-lzma.bin
openwrt-ar71xx-generic-eap1200h-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
Newer EnGenius software requires more checks but their script
includes a way to skip them, otherwise the tar must include
a text file with the version and md5sums in a deprecated format.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied
at the PHY side, using the at803x driver `phy-mode`.
Therefore the PLL registers for GMAC0
do not need the bits for delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Device specifications:
======================
* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 3T3R 2.4 GHz Wi-Fi (11n)
* 3T3R 5 GHz Wi-Fi (11ac)
* 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 1x ethernet
- AR8035 ethernet PHY (RGMII)
- 10/100/1000 Mbps Ethernet
- 802.3af POE
- used as LAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
[rebase, add LED migration]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Device specifications:
======================
* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 3T3R 2.4 GHz Wi-Fi (11n)
* 3T3R 5 GHz Wi-Fi (11ac)
* 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 1x ethernet
- AR8035 ethernet PHY (RGMII)
- 10/100/1000 Mbps Ethernet
- 802.3af POE
- used as LAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
[rebase, apply shared DTSI/device node, add LED migration]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
