Commit Graph

548 Commits

Author SHA1 Message Date
Marcin Gajda
07b9186e88 ipq40xx: Add support Netgear LBR20
**Netgear LBR20** is a router with two gigabit ethernets , three wifi radios and integrated LTE cat.18 modem.

SoC Type: Qualcomm IPQ4019
RAM: 512 MiB
Flash: 256 MiB , SLC NAND, 2 Gbit (Macronix MX30LF2G18AC)
Bootloader: U-Boot
Modem: LTE CAT.18 Quectel EG-18EA ,  Max. 1.2Gbps downlink / 150Mbps uplink

WiFi class AC2200:
- radio0 : 5G on QCA9888 , WiFi5- 802.11a/n/ac MU-MIMO 2x2 , 887Mbps , 80MHz - limited for low channels
- radio1: 2,4G on IPQ4019 ,WiFi4- 802.11b/g/n MIMO2x2 300Mbps 40Mhz
- radio2: 5G on IPQ4019 , WiFi5- 802.11a/n/ac MU-MIMO 2x2 , 887Mbps ,80Mhz - limited for high channels  (from 100 up to 165) . Becouse of DFS remember to set country before turning on.

Ethernet: 2x1GbE (WAN/LAN1, LAN2)
LEDs:  section power : green and red  , section on top (orbi) drived by TLC59208F: red, green ,blue and white
USB ports: No
Buttons:  2 Reset and SYNC(WPS)
Power: 12 VDC, 2,5 A
Connector type: Barrel

OpenWRT Installation
1. Simplest way is just do upgrade from webpage with *factory.img
2. You can also do it with standard tool for Netgear's debricking - NMPRFlash
3. Most advanced way is to open device , connect to UART console and :
- Prepare OpenWrt initramfs image in TFTP server root (server IP 192.168.1.10)
- Connect serial console (115200,8n1) to UART connector
- Connect TFTP server to RJ-45 port
- Stop in u-Boot and run u-Boot command:

> setenv serverip 192.168.1.10
> set fdt_high 0x85000000
> tftpboot 0x83000000 openwrt-ipq40xx-generic-netgear_lbr20-initramfs-zImage.itb
> bootm 0x83000000

- Login via ssh
- upload or download *sysupgrade.bin ( like wget ... or scp transfer)
-  Install image via "sysupgrade -n" (like “sysupgrade -n /tmp/openwrt-ipq40xx-generic-netgear_lbr20-squashfs-sysupgrade.bin”)

Back to Stock
- Download firmware from official Netgear's webpage , it will be *.img file after decompressing.
- Use NMRPFlash tool  ( detailed insructions on project page https://github.com/jclehner/nmrpflash )

Open the case
- Unscrew nuts and remove washers from antenna's conectors.
- There are two Torx T10 screws under the label next to antenna conectors. You have to unglue this label from left and right corner to get it
- Two parts of shell covers will slide out from eachother , you have to unglue two small rubber pads and namplate sticker on bottom to do that.
- PCB is screwed with 4Pcs of Torx T10 screws
- Before lifting up PCB remove pigtiles for LTE antennas and release them from PCB and radiator (black and white wires)
- On other side of PCB ,in left bottom corner there is already soldered with 4 pins UART connector for console. Counting from left it is  +3,3V , TX , RX ,GND (reffer to this picture: https://i.ibb.co/Pmrf9KB/20240116-103524.jpg )

BDF's files are in firmware_qca-wireless  https://github.com/openwrt/firmware_qca-wireless/ and in parallel sent to ath10k@lists.infradead.org.

Signed-off-by: Marcin Gajda <mgajda@o2.pl>
2024-02-23 19:46:23 +01:00
Paweł Owoc
70fd815e57 qualcommax: ipq807x: add support for Linksys MX5300
Hardware specification:
========
SoC: Qualcomm IPQ8072A
Flash: 512MB (Winbond W29N04GZBIBA)
RAM: 1GB (2x Nanya DDR3L NT5CC256M16ER-EK)
Ethernet: 5x 10/100/1000Mbps (Qualcomm QCA8075)
WiFi1: 5GHz ac 4x4 (Qualcomm QCA9984 + Skyworks SKY85746-11) - channels 100-169
WiFi2: 5GHz ax 4x4 (Qualcomm QCN5054 + Skyworks SKY85755-11) - channels 36-64
WiFi3: 2.4GHz ax 4x4 (Qualcomm QCN5024 + Skyworks SKY8340-11)
IoT: Bluetooth 5, Zigbee and Thread (Qualcomm QCA4024 + Skyworks SE2433T-R)
IoT Flash: 4MB (Macronix MX25R3235F)
RTC: ST M41T00S
LED: 1x RGB status (NXP PCA9633)
USB: 1x USB 3.0
Button: WPS, Reset

Flash instructions:
========
1. Manually upgrade firmware using openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin image.
More details can be found here: https://www.linksys.com/hk/support-article?articleNum=274497
After first boot check actual partition:
- fw_printenv -n boot_part
and install firmware on second partition using command in case of 2:
- mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin kernel
and in case of 1:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel

2. Installation using serial connection from OEM firmware (default login: root, password: admin):
- fw_printenv -n boot_part
In case of 2:
- flash_erase /dev/mtd21 0 0
  nandwrite -p /dev/mtd21 openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin
or in case of 1:
- flash_erase /dev/mtd23 0 0
  nandwrite -p /dev/mtd23 openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin
After first boot install firmware on second partition:
- mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin kernel
or:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel

3. Installation from initramfs image using USB FAT32 formatted drive:
Stop u-boot and run:
- usb start && fatload usb 0:1 $loadaddr openwrt-qualcommax-ipq807x-linksys_mx5300-initramfs-uImage.itb && bootm $loadaddr
Write firmware to the flash from initramfs:
- mtd -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin kernel
and:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel

4. Back to the OEM firmware:
- mtd -e kernel -n write FW_MX5300_1.1.9.200251_prod.img kernel
and:
- mtd -r -e alt_kernel -n write FW_MX5300_1.1.9.200251_prod.img alt_kernel

5. USB recovery:
- fw_setenv usbimage 'openwrt-qualcommax-ipq807x-linksys_mx5300-initramfs-uImage.itb'
  fw_setenv bootusb 'usb start && fatload usb 0:1 $loadaddr $usbimage && bootm $loadaddr'
  fw_setenv bootcmd 'run bootusb; aq_load_fw && if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'

Notes:
========
IoT device is accesible over spi. Not yet supported.

Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2024-02-23 13:34:59 +01:00
Mantas Pucka
44168fda78 qualcommax: ipq60xx: Add 8devices Mango DVK
8devices Mango DVK is a single board computer / devkit for 8devices Mango
system-on-module (SoM).

Specifications:
* CPU: Qualcomm IPQ6010 Quad core Cortex-A53 1.8GHz
* RAM: 512 MB
* Storage:
    * 32 MB serial NOR flash (on SoM)
    * 256 MB parallel NAND flash (on DVK)
* Ethernet:
    * 2x1G RJ45 ports(QCA8072 or QCA8075)
    * 1x2.5G RJ45 port (QCA8081)
    * 1xSFP (shares SGMII with QCA8081)
* Switch: Qualcomm Atheros IPQ6010
* WLAN:
    * 2.4GHz: QCN5121 2x2 802.11b/g/n/ax 574 Mbps PHY rate
    * 5GHz: QCN5152 2x2 802.11a/n/ac/ax 1201 Mbps PHY rate
* USB:
    * 1x USB3.0 Type-A port
    * 1x USB2.0 available at mini PCIe slot
* PCIe: 1x mini PCIe slot 1xLane Gen3 (8GT/s)
* SD/eMMC (on a single shared bus - only one can be active):
    * micro SD slot
    * eMMC module connector
* LEDs:
    * Green power led (not controllable)
    * Green 2.4GHz radio led (GPIO 67)
    * Green 5GHz radio led (GPIO 66)
* Buttons:
    * 1x (WPS GPIO79) button
* GPIOs: 2.54mm header brings out 18 GPIOs (1.8V level)
* UART: 4-pin UART header (3.3V level)
    * 115200 8N1, 3.3V-Tx-Rx-GND (3.3V is pin 1 close to boot-switch SW2)
* Power:
    * PoE IN on 2.5G port (passive 24-48V)
    * DC power terminal (12-58V)

Installation instructions:

Vendor image format is compatible with squashfs-sysupgrade image. Run:

sysupgrade -n -F openwrt-qualcommax-ipq60xx-8devices_mango-dvk-squashfs-sysupgrade.bin

Signed-off-by: Mantas Pucka <mantas@8devices.com>
2024-02-21 21:42:23 +01:00
Daniel Golle
b03d3644cf mediatek: filogic: add BananaPi BPi-R3 mini
Hardware specification
----------------------
 SoC: MediaTek MT7986A 4x A53
 Flash: 128MB SPI-NAND, 8GB eMMC
 RAM: 2GB DDR4
 Ethernet: 2x 2.5GbE (Airoha EN8811H)
 WiFi: MediaTek MT7976C 2x2 2.4G + 3x3 5G
 Interfaces:
  * M.2 Key-M: PCIe 2.0 x2 for NVMe SSD
  * M.2 Key-B: USB 3.0 with SIM slot
  * front USB 2.0 port
 LED: Power, Status, WLAN2G, WLAN5G, LTE, SSD
 Button: Reset, internal boot switch
 Fan: PWM-controlled 5V fan
 Power: 12V Type-C PD

Installation instructions for eMMC
----------------------------------
0. Set boot switch to boot from SPI-NAND (assuming stock rom or immortalwrt
   running there).
1. Write GPT partition table to eMMC
   Move openwrt-mediatek-filogic-bananapi_bpi-r3-mini-emmc-gpt.bin to
   the device /tmp using scp and write it to /dev/mmcblk0:
    dd if=/tmp/openwrt-*-r3-mini-emmc-gpt.bin of=/dev/mmcblk0
2. Reboot (to reload partition table)
3. Write bootloader and OpenWrt images
   Move files to the device /tmp using scp:
    - openwrt-*-bananapi_bpi-r3-mini-emmc-preloader.bin
    - openwrt-*-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip
    - openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb
    - openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb
   Write them to the appropriate partitions:
    echo 0 > /sys/block/mmcblk0boot0/force_ro
    dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-preloader.bin of=/dev/mmcblk0boot0
    dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip of=/dev/mmcblk0p3
    dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb of=/dev/mmcblk0p4
    dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb of=/dev/mmcblk0p5
    sync

4. Remove the device from power, set boot switch to eMMC and boot into
   OpenWrt. The device will come up with IP 192.168.1.1 and assume the
   Ethernet port closer to the USB-C power connector as LAN port.

5. If you like to have Ethernet support inside U-Boot (eg. to boot via
   TFTP) you also need to write the PHY firmware to /dev/mmcblk0boot1:
    echo 0 > /sys/block/mmcblk0boot1/force_ro
    dd if=/lib/firmware/airoha/EthMD32.dm.bin of=/dev/mmcblk0boot1
    dd if=/lib/firmware/airoha/EthMD32.DSP.bin bs=16384 seek=1 of=/dev/mmcblk0boot1

Installation instructions for NAND
----------------------------------
0. Set boot switch to boot from eMMC (assuming OpenWrt is installed there
   by instructions above. Using stock rom or immortalwrt does NOT work!)

1. Write things to NAND
   Move files to the device /tmp using scp:
    - openwrt-*-bananapi_bpi-r3-mini-snand-preloader.bin
    - openwrt-*-bananapi_bpi-r3-mini-snand-bl31-uboot.fip
    - openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb
    - openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb
   Write them to the appropriate locations:
    mtd write /tmp/openwrt-*-bananapi_bpi-r3-mini-snand-preloader.bin /dev/mtd0
    ubidetach -m 1
    ubiformat /dev/mtd1
    ubiattach -m 1
    volsize=$(wc -c < /tmp/openwrt-*-bananapi_bpi-r3-mini-snand-bl31-uboot.fip)
    ubimkvol /dev/ubi0 -N fip -n 0 -s $volsize -t static
    ubiupdatevol /dev/ubi0_0 /tmp/openwrt-*-bananapi_bpi-r3-mini-snand-bl31-uboot.fip
    cd /lib/firmware/airoha
    cat EthMD32.dm.bin EthMD32.DSP.bin > /tmp/en8811h-fw.bin
    ubimkvol /dev/ubi0 -N en8811h-firmware -n 1 -s 147456 -t static
    ubiupdatevol /dev/ubi0_1 /tmp/en8811h-fw.bin
    ubimkvol /dev/ubi0 -n 2 -N ubootenv -s 126976
    ubimkvol /dev/ubi0 -n 3 -N ubootenv2 -s 126976
    volsize=$(wc -c < /tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb)
    ubimkvol /dev/ubi0 -n 4 -N recovery -s $volsize
    ubiupdatevol /dev/ubi0_4 /tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb
    volsize=$(wc -c < /tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb)
    ubimkvol /dev/ubi0 -n 4 -N recovery -s $volsize
    ubiupdatevol /dev/ubi0_4 /tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb

3. Remove the device from power, set boot switch to NAND, power up and
   boot into OpenWrt.

Partially based on immortalwrt support for the R3 mini, big thanks for
doing the ground work!

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2024-02-15 19:30:08 +00:00
Daniel Golle
41c053141e mediatek: mt7622: convert unifi6lr-v{1,2,3}-ubootmod to fitblk
No bootloader changes needed in this case, smooth transition.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2024-02-15 19:30:08 +00:00
Daniel Golle
208f6c1232 mediatek: mt7622: convert BPi-R64 to all-UBI layout and fitblk
Modernize bootloader and flash memory layout of the BPi-R64 similar to
how it has also been done for the BPi-R3.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2024-02-15 19:30:08 +00:00
Daniel Golle
8afce4893b uboot-envtools: mediatek_filogic: update bpi-r3
Unify env configuration now that BPi-R4 and BPi-R3 both use fitblk.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2024-02-15 19:30:08 +00:00
Daniel Golle
1192554d56 uboot-envtools: filogic: add support for BananaPi R4
Add environment settings for the BananaPi BPI-R4 router board which
can boot from (and store its bootloader environment on) micro SD card,
SPI-NAND and eMMC.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2024-02-15 19:30:08 +00:00
Daniel Golle
13ddc65b2c uboot-envtools: filogic: de-duplicate UBI env settings
Use function instead of duplicating the env settings on UBI for
OpenWrt-built U-Boot over and over.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2024-02-15 19:30:08 +00:00
David Bentham
d8f4453bf2 mediatek: add Comfast CF-E393AX support
Comfast CF-E393AX is a dual-band Wi-Fi 6 POE ceiling mount access point.

Oem firmware is a custom openwrt 21.02 snapshot version.

We can gain access via ssh once we remove the root password.

Hardware specification:
  SoC: MediaTek MT7981A 2x A53
  Flash: 128 MB SPI-NAND
  RAM: 256MB DDR3
  Ethernet: 1x 10/100/1000 Mbps built-in PHY (WAN)
            1x 10/100/1000/2500 Mbps MaxLinear GPY211C (LAN)
  Switch: MediaTek MT7531AE
  WiFi: MediaTek MT7976D
  LEDS: 1x (Red, Blue and Green)
  Button: Reset
  UART: 3.3v, 115200n8
  --------------------------
  | Layout |
  | ----------------- |
  | 4 | VCC GND TX RX | <= |
  | ----------------- |
  --------------------------

Gain SSH access:
1. Login into web interface (http://apipaddress/computer/login.html),
   and download the
   configuration(http://apipaddress/computer/config.html).

2. Rename downloaded backup config - 'backup.file to backup.tar.gz',
   Enter 'fakeroot' command then decompress the configuration:
   tar -zxf backup.tar.gz

3. Edit 'etc/shadow', update (remove) root password:
   With password =
   'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
   'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
   to
   Without password =
   'root::0:99999:7:::'
   'root::0:99999:7:::'

4. Repack 'etc' directory back to a new backup file:
   tar -zcf backup-ssh.tar.gz etc/
5. Rename new config tar.gz file to 'backup-ssh.file'
   Exit fakeroot - 'exit'

6. Upload new configuration via web interface, now you
   can SSH with the following:

   'ssh -vv -o HostKeyAlgorithms=+ssh-rsa \
   -o PubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.10.1'.

   Backup the mtd partitions
   - https://openwrt.org/docs/guide-user/installation/generic.backup

7. Copy openwrt factory firmware to the tmp folder to install via ssh:

   'scp -o HostKeyAlgorithms=+ssh-rsa \
   -o PubkeyAcceptedAlgorithms=+ssh-rsa \
   *-mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin \
   root@192.168.10.1:/tmp/'

   'sysupgrade -n -F \
   /tmp/*--mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin'

8. Once led has stopped flashing - Connect via ssh with the
   default openwrt ip address - 'ssh root@192.168.1.1'

9. SSH copy the openwrt sysupgrade firmware and upgrade
   as per the default instructions.

Signed-off-by: David Bentham <db260179@gmail.com>
2024-02-02 13:01:38 +01:00
Chuanhong Guo
1b7e62b20b mediatek: drop NMBM layout for Xiaomi WR30U
This reverts commit dcdcfc1511.

This is a firmware for third-party u-boot mod, which should not
be carried here by us.

Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
2024-01-23 19:24:32 +08:00
Tianling Shen
c0c3234e17 mediatek: add support for JDCloud RE-CP-03
Hardware specification:
  SoC: MediaTek MT7986A 4x A53
  Flash: 128GB eMMC
  RAM: 1GB DDR4
  Ethernet: 4x 1GbE, 1x 2.5GbE (RTL8221B)
  Switch: MediaTek MT7531AE
  WiFi: MediaTek MT7976C
  Button: Reset, Joylink
  Power: DC 12V 2A

Flash instructions:
1. Download and flash the vendor migration firmware via webUI:
   https://firmware.download.immortalwrt.eu.org/cnsztl/mediatek/filogic/openwrt-mediatek-mt7986-jdcloud_re-cp-03-vendor-migration.bin
   (Default address is 192.168.68.1, user root, no password)
2. After device has booted up, write new GPT table:
   dd if=openwrt-mediatek-filogic-jdcloud_re-cp-03-gpt.bin of=/dev/mmcblk0 bs=512 seek=0 count=34 conv=fsync
3. Erase and write new BL2:
   echo 0 > /sys/block/mmcblk0boot0/force_ro
   dd if=/dev/zero of=/dev/mmcblk0boot0 bs=512 count=8192 conv=fsync
   dd if=openwrt-mediatek-filogic-jdcloud_re-cp-03-preloader.bin of=/dev/mmcblk0boot0 bs=512 conv=fsync
4. Erase and write new FIP:
   dd if=/dev/zero of=/dev/mmcblk0 bs=512 seek=13312 count=8192 conv=fsync
   dd if=openwrt-mediatek-filogic-jdcloud_re-cp-03-bl31-uboot.fip of=/dev/mmcblk0 bs=512 seek=13312 conv=fsync
5. Set static IP on your PC:
   IP 192.168.1.254/24, GW 192.168.1.1
6. Serve OpenWrt initramfs image using TFTP server.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt has booted, perform sysupgrade.
9. Additionally, if you want to have eMMC recovery boot feature:
     (Don't worry! You will always have TFTP recovery boot feature.)
   dd if=openwrt-mediatek-filogic-jdcloud_re-cp-03-initramfs-recovery.itb of=/dev/mmcblk0p4 bs=512 conv=fsync

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2024-01-19 21:43:32 +01:00
Dim Fish
7dbcc1215a mediatek: filogic: add support for Xiaomi AX3000T
**SoC**: MediaTek MT7981B 2x A53
  **Flash**: ESMT F50L1G41LB 128MB
  **RAM**: NT52B128M16JR-FL 256MB
  **Ethernet**: 4x 10/100/1000 Mbps
  **Switch**: MediaTek MT7531AE
  **WiFi**: MediaTek MT7976C
  **Buttons**: Reset, Mesh
  **Power**: DC 12V 1A

1. Get ssh access. Supported stock firmware **1.0.47**
   ```
   curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=*******/api/misystem/arn_switch" -d "open=1&model=1&level=%0Anvram%20set%20ssh_en%3D1%0A"
   curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=*******/api/misystem/arn_switch" -d "open=1&model=1&level=%0Anvram%20commit%0A"
   curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=*******/api/misystem/arn_switch" -d "open=1&model=1&level=%0Ased%20-i%20's%2Fchannel%3D.*%2Fchannel%3D%22debug%22%2Fg'%20%2Fetc%2Finit.d%2Fdropbear%0A"
   curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=*******/api/misystem/arn_switch" -d "open=1&model=1&level=%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A"
   curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=********/api/misystem/arn_switch" -d "open=1&model=1&level=%0Apasswd%20-d%20root%0A
   ```

2. Backup stock partitions
   ```
   nanddump -f /tmp/BL2.bin /dev/mtd1
   nanddump -f /tmp/Nvram.bin /dev/mtd2
   nanddump -f /tmp/Bdata.bin /dev/mtd3
   nanddump -f /tmp/Factory.bin /dev/mtd4
   nanddump -f /tmp/FIP.bin /dev/mtd5
   nanddump -f /tmp/ubi.bin /dev/mtd8
   nanddump -f /tmp/KF.bin /dev/mtd12
   ```
   Then transfer them to your computer in a safe place.

3. Get firmware information `cat /proc/cmdline`

4. Copy openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi to **/tmp** and flash
   If **firmware=0**
   ```
   ubiformat /dev/mtd9 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi
   nvram set boot_wait=on
   nvram set uart_en=1
   nvram set flag_boot_rootfs=1
   nvram set flag_last_success=1
   nvram set flag_boot_success=1
   nvram set flag_try_sys1_failed=0
   nvram set flag_try_sys2_failed=0
   nvram commit
   reboot
   ```
   If **firmware=1**
   ```
   ubiformat /dev/mtd8 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi
   nvram set boot_wait=on
   nvram set uart_en=1
   nvram set flag_boot_rootfs=0
   nvram set flag_last_success=0
   nvram set flag_boot_success=1
   nvram set flag_try_sys1_failed=0
   nvram set flag_try_sys2_failed=0
   nvram commit
   reboot
   ```

   Then reboot your router, it should boot to the OpenWrt initramfs system now.

5. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin
   `sysupgrade -n /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin`

1. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb
   `ubiformat /dev/mtd8 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb`

   `reboot`

2. Install kmod-mtd-rw
   `opkg update && opkg install kmod-mtd-rw`

   `insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1`

3. Format ubi and create new ubootenv volume
   ```
   ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8
   ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
   ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
   ```

4. *(Optional **-10Mb** free space) Add recovery boot feature.*
   ```
   ubimkvol /dev/ubi0 -n 2 -N recovery -s 10MiB
   ubiupdatevol /dev/ubi0_2 /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb
   ```

5. Flash Openwrt U-Boot
   ```
   mtd write /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-preloader.bin BL2
   mtd write /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip FIP
   ```

6. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-squashfs-sysupgrade.itb
   `sysupgrade -n /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-squashfs-sysupgrade.itb`

1. Force flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb
   `sysupgrade -F -n /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb`

2. Format ubi and Nvram
   ```
   ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8
   mtd erase Nvram
   ```

3. Install kmod-mtd-rw
   `opkg update && opkg install kmod-mtd-rw`

   `insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1`

4. Flash stock images from backup
   ```
   mtd write /tmp/BL2.bin BL2
   mtd write /tmp/FIP.bin FIP
   mtd write /tmp/ubi.bin ubi
   ```
   Then reboot your router, waiting it finished rollback in minutes.

   `ubiformat /dev/mtd7 -y -f /tmp/ubi.bin`
   Then reboot your router, waiting it finished rollback in minutes.

Signed-off-by: Dim Fish <dimfish@gmail.com>
2024-01-06 17:51:11 +01:00
Mohammad Sayful Islam
46a2490e8f ipq807x: add support for Linksys MX4200 V1 and V2
Linksys MX4200 is a 802.11ax Tri-band router/AP.
Specifications:
* CPU: Qualcomm IPQ8174 Quad core Cortex-A53 1.4GHz
* RAM: 512MB of DDR3
* Storage: 512Mb NAND
* Ethernet: 4x1G RJ45 ports (QCA8075)
* WLAN:
	* 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate
	* 5GHz: Qualcomm QCN5054 2x2@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate
	* 5GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate
* LED-s:
	* RGB system led

* Buttons: 1x Soft reset 1x WPS
* Power: 12V DC Jack

Installation instructions:
Open Linksys Web UI - http://192.168.1.1/ca or http://10.65.1.1/ca depending on your setup.
Login with your admin password. The default password can be found on a sticker under the device.
To enter into the support mode, click on the “CA” link and the bottom of the page.
Open the “Connectivity” menu and upload the squash-factory image with the “Choose file” button.
Click start. Ignore all the prompts and warnings by click “yes” in all the popups.
The Wifi radios are turned off by default. To configure the router, you will need to connect your computer to the LAN port of the device.
Then you would need to write openwrt to the other partition for it to work
- First Check booted partition
fw_printenv -n boot_part

- Then install Openwrt to the other partition if booted in slot 1:
mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4200v(X)-squashfs-factory.bin alt_kernel

- If in slot 2:
mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4200v(X)-squashfs-factory.bin kernel

Replace (X) with your model version either 1 or 2

Signed-off-by: Mohammad Sayful Islam <sayf.mohammad01@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2024-01-06 16:13:23 +01:00
Roland Reinl
fdb87a91b4 mediatek: Add support for D-Link EAGLE PRO AI R32
R32 is like the M32 part of the EAGLE PRO AI series from D-Link.

Specification:
 - MT7622BV SoC with 2.4GHz wifi
 - MT7975AN + MT7915AN for 5GHz
 - MT7531BE Switch
 - 512MB RAM
 - 128 MB flash
 - 2 LEDs (Status and Internet, both can be either orange or white)
 - 2 buttons (WPS and Reset)

Compared to M32, the R32 has the following differences:
 - 4 LAN ports instead of 2
 - The recory image starts with DLK6E6015001 instaed of DLK6E6010001
 - Individual LEDs for power and internet
 - MAC address is stored at another offset in the ODM partition

MAC addresses:
 - WAN MAC is stored in partition "Odm" at offset 0x81
 - LAN (as printed on the device) is WAN MAC + 1
 - WLAN MAC (2.4 GHz) is WAN MAC + 2
 - WLAN MAC (5GHz) is WAN MAC + 3

Flashing via Recovery Web Interface:
 - Set your IP address to 192.168.0.10, subnetmask 255.255.255.0
 - Press the reset button while powering on the deivce
 - Keep the reset button pressed until the internet LED blinks fast
 - Open a Chromium based and goto http://192.168.0.1
 - Download openwrt-mediatek-mt7622-dlink_eagle-pro-ai-r32-a1-squashfs-recovery.bin

Flashing via uBoot:
 - Open the case, connect to the UART console
 - Set your IP address to 10.10.10.3, subnet mask 255.255.255.0. Connect to one of the LAN interfaces of the router
 - Run a tftp server which provides openwrt-mediatek-mt7622-dlink_eagle-pro-ai-r32-initramfs-kernel.bin.
 - You can rename the file to iverson_uImage (no extension), then you don't have to enter the whole file name in uboot later.
 - Power on the device and select "1. System Load Linux to SDRAM via TFTP." in the boot menu
 - Enter image file, tftp server IP and device IP (if they differ from the default).
 - TFTP download to RAM will start. After a few seconds OpenWrt initramfs should start
 - The initramfs is accessible via 192.168.1.1, change your IP address accordingly (or use multiple IP addresses on your interface)
 - Create a backup of the Kernel1 partition, this file is required if a revert to stock should be done later
 - Perform a sysupgrade using openwrt-mediatek-mt7622-dlink_eagle-pro-ai-r32-squashfs-sysupgrade.bin
 - Reboot the device. OpenWrt should start from flash now

Revert back to stock using the Recovery Web Interface:
 - Set your IP address to 192.168.0.10, subnetmask 255.255.255.0
 - Press the reset button while powering on the deivce
 - Keep the reset button pressed until the internet LED blinks fast
 - Open a Chromium based and goto http://192.168.0.1
 - Flash a decrypted firmware image from D-Link. Decrypting an firmware image is described below.

Decrypting a D-Link firmware image:
 - Download https://github.com/RolandoMagico/firmware-utils/blob/M32/src/m32-firmware-util.c
 - Compile a binary from the downloaded file, e.g. gcc m32-firmware-util.c -lcrypto -o m32-firmware-util
 - Run ./m32-firmware-util R32 --DecryptFactoryImage <OriginalFirmware> <OutputFile>
 - Example for firmware R32A1_FW103B01: ./m32-firmware-util R32 --DecryptFactoryImage R32A1_FW103B01.bin R32A1_FW103B01.decrypted.bin

Revert back to stock using uBoot:
 - Open the case, connect to the UART console
 - Set your IP address to 10.10.10.3, subnet mask 255.255.255.0. Connect to one of the LAN interfaces of the router
 - Run a tftp server which provides the previously created backup of the Kernel1 partition.
 - You can rename the file to iverson_uImage (no extension), then you don't have to enter the whole file name in uboot later.
 - Power on the device and select "2. System Load Linux Kernel then write to Flash via TFTP." in the boot menu
 - Enter image file, tftp server IP and device IP (if they differ from the default).
 - TFTP download to FLASH will start. After a few seconds the stock firmware should start again

There is also an image openwrt-mediatek-mt7622-dlink_eagle-pro-ai-r32-a1-squashfs-tftp.bin which can directly be flashed via U-Boot and TFTP.
It can be used if no backup of the Kernel1 partition is reuqired.

Flahsing via OEM web interface is currently not possible, the OEM images are encrypted. Creating images is only possible manually at the moment.
The support for the M32/R32 already includes support for flashing from the OEM web interface:
 - The device tree contains both partitions (Kernel1 and Kernel2) with conditions to select the correct one based on the kernel command line
 - The U-Boot variable "boot_part" is set accordingly during startup to finish the partition swap after flashing from the OEM web interface
 - OpenWrt sysupgrade flashing always uses the partition where it was initially flashed to (no partition swap)

Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
2024-01-02 21:22:46 +01:00
Xavier Franquet
782eb05008 mediatek: filogic: add support ASUS RT-AX59U
(based on support for ASUS RT-AX59U by liushiyou006)

SOC: MediaTek MT7986
RAM: 512MB DDR4
FLASH: 128MB SPI-NAND (Winbond W25N01GV)
WIFI: Mediatek MT7986 DBDC 802.11ax 2.4/5 GHz
ETH: MediaTek MT7531 Switch
UART: 3V3 115200 8N1 (Pinout silkscreened / Do not connect VCC)

Upgrade from AsusWRT to OpenWRT using UART

    Download the OpenWrt initramfs image.
    Copy the image to a TFTP server reachable at 192.168.1.70/24. Rename the image to rtax59u.bin.

    Connect the PC with TFTP server to the RT-AX59U.
    Set a static ip on the ethernet interface of your PC.
    (ip address: 192.168.1.70, subnet mask:255.255.255.0)
    Conect to the serial console, interrupt the autoboot process by pressing '4' when prompted.

    Download & Boot the OpenWrt initramfs image.

    $ setenv ipaddr 192.168.1.1
    $ setenv serverip 192.168.1.70
    $ tftpboot 0x46000000 rtax59u.bin
    $ bootm 0x46000000

    Wait for OpenWrt to boot. Transfer the sysupgrade image to the device using scp and install using sysupgrade.

    $ sysupgrade -n <path-to-sysupgrade.bin>

Upgrade from AsusWRT to OpenWRT using WebUI

    Download transit TRX file from https://drive.google.com/drive/folders/1A20QdjK7Udagu31FSszpWAk8-cGlCwsq

    Upgrade firmware from WebUI (192.168.50.1) using downloaded TRX file

    Wait for OpenWRT to boot (192.168.1.1).

    Upgrade system with sysupgrade image using luci or uploading it through scp and executing sysupgrade command

MAC Address for WLAN 5g is not following the same algorithm as in AsusWRT.
We have increased by one the WLAN 5g to avoid collisions with other networks from WLAN 2g
when bit 28 is already set.

              : Stock             : OpenWrt
  WLAN 2g (1) : C8:xx:xx:0D:xx:D4 : C8:xx:xx:0D:xx:D4
  WLAN 2g (2) :                   : CA:xx:xx:0D:xx:D4
  WLAN 2g (3) :                   : CE:xx:xx:0D:xx:D4
  WLAN 5g (1) : CA:xx:xx:1D:xx:D4 : CA:xx:xx:1D:xx:D5
  WLAN 5g (2) :                   : CE:xx:xx:1D:xx:D5
  WLAN 5g (3) :                   : C2:xx:xx:1D:xx:D5

  WLAN 2g (1) : 08:xx:xx:76:xx:BE : 08:xx:xx:76:xx:BE
  WLAN 2g (2) :                   : 0A:xx:xx:76:xx:BE
  WLAN 2g (3) :                   : 0E:xx:xx:76:xx:BE
  WLAN 5g (1) : 0A:xx:xx:76:xx:BE : 0A:xx:xx:76:xx:BF
  WLAN 5g (2) :                   : 0E:xx:xx:76:xx:BF
  WLAN 5g (3) :                   : 02:xx:xx:76:xx:BF

Signed-off-by: Xavier Franquet <xavier@franquet.es>
2023-12-31 00:03:24 +01:00
Mikhail Zhilkin
485adc9d3c mediatek: add support for Routerich AX3000
This PR is continuation of work under "mediatek: add support for Routerich
AX3000" #13703 by the agreement with PR #13703 original author (Maximilian
Weinmann <x1@disroot.org>). All reviews from the previous PR were taken
into into account.

Routerich AX3000 is a wireless WiFi 6 router.

Specification
-------------
- SoC       : MediaTek MT7981BA dual-core ARM Cortex-A53 1.3 GHz
- RAM       : DDR3 256 MiB (ESMT M15T2G16128A)
- Flash     : SPI-NAND 128 MiB (ESMT F50L1G41LB)
- WLAN      : MediaTek MT7976CN dual-band WiFi 6
  - 2.4 GHz : b/g/n/ax, MIMO 2x2
  - 5 GHz   : a/n/ac/ax, MIMO 2x2
- Ethernet  : 10/100/1000 Mbps x4 (MediaTek MT7531AE)
- USB       : 1x 2.0
- UART      : through-hole on PCB
  - [J500] GND, TX, RX, 3.3V (115200n8)
- Buttons   : Mesh, Reset
- LEDs      : 1x Power (Blue)
              1x WiFi 2.4 GHz (Blue)
              1x WiFi 5 GHz (Red)
              1x Mesh (Blue)
              3x LAN activity (Blue)
              1x WAN activity (Blue)
              2x WAN no-internet (Red)
- Power     : 12 VDC, 1.5 A

Installation
------------
Flash OpenWrt 'sysupgrade.bin' image using stock firmware web-interface
(without keeping settings).

Return to stock
---------------
Install stock firmware image (without keeping settings) using OpenWrt
sysupgrade method.

Recovery
--------
Connect uart, use u-boot menu to flash stock firmware image or boot
OpenWrt initramfs image.

MAC addresses
-------------
+---------+-------------------+-----------+
|         | MAC               | Algorithm |
+---------+-------------------+-----------+
| WAN     | 24:0f:5e:xx:xx:b4 | label     |
| LAN     | 24:0f:5e:xx:xx:b5 | label+1   |
| WLAN 2g | 24:0f:5e:xx:xx:b6 | label+2   |
| WLAN 5g | 24:0f:5e:xx:xx:b7 | label+3   |
+---------+-------------------+-----------+
The WLAN 2g MAC was found in 'Factory', 0x4

Co-authored-by: Maximilian Weinmann <x1@disroot.org>
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2023-12-26 17:17:23 +01:00
Ian Oderon
4300bc6688 mediatek: add support for Zbtlink ZBT-Z8103AX
Specifications:
SoC: MediaTek MT7981B
RAM: 256MiB
Flash: SPI-NAND 128 MiB
Switch: 1 WAN, 3 LAN (Gigabit)
Buttons: Reset, Mesh
Power: DC 12V 1A
WiFi: MT7976CN
UART: 115200n8
UART Layout:
VCC-RX-TX-GND

No. of Antennas: 6
Note: Upon opening the router, only 5 antennas were connected
to the mainboard.

Led Layout:
Power-Mesh-5gwifi-WAN-LAN3-LAN2-LAN1-2gWiFi

Buttons:
Reset-Mesh

Installation:
A. Through OpenWrt Dashboard:
If your router comes with OpenWrt preinstalled (modified by the seller),
you can easily upgrade by going to the dashboard (192.168.1.1) and then
navigate to System -> Backup/Flash firmware, then flash the firmware

B. Through TFTP
Standard installation via UART:

1. Connect USB Serial Adapter to the UART, (NOTE: Don't connect the VCC pin).
2. Power on the router. Make sure that you can access your router via UART.
3. Restart the router then repeatedly press ctrl + c to skip default boot.
4. Type > bootmenu
5. Press '2' to select upgrade firmware
6. Press 'Y' on 'Run image after upgrading?'
7. Press '0' and hit 'enter' to select TFTP client (default)
8. Fill the U-Boot's IP address and TFTP server's IP address.
9. Finally, enter the 'firmware' filename.

Signed-off-by: Ian Oderon <ianoderon@gmail.com>
2023-12-26 00:02:19 +01:00
Mikhail Zhilkin
f3cdc9f988 ramips: add support for Rostelecom RT-FE-1A
Rostelecom RT-FE-1A is a wireless WiFi 5 router manufactured by Sercomm
company.

Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 256 MiB
Flash: 128 MiB
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7615E): a/n/ac, 4x4
Ethernet: 5x GbE (WAN, LAN1, LAN2, LAN3, LAN4)
USB ports: No
Button: 2 buttons (Reset & WPS)
LEDs:
   - 1x Power (green, unmanaged)
   - 1x Status (green, gpio)
   - 1x 2.4G (green, hardware, mt76-phy0)
   - 1x 2.4G (blue, gpio)
   - 1x 5G (green, hardware, mt76-phy1)
   - 1x 5G (blue, gpio)
   - 5x Ethernet (green, hardware, 4x LAN & WAN)
Power: 12 VDC, 1.5 A
Connector type: barrel
Bootloader: U-Boot

Installation
-----------------

1.  Login to the router web interface (default http://192.168.0.1/)
    under "admin" account

2.  Navigate to Settings -> Configuration -> Save to Computer

3.  Decode the configuration. For example, using cfgtool.py tool (see
    related section):
    cfgtool.py -u configurationBackup.cfg

4.  Open configurationBackup.xml and find the following block:

<OBJECT name="User." type="object" writable="1" encryption="0" >
<OBJECT name="1." type="object" writable="1" encryption="0" >
<PARAMETER name="Password" type="string" value="<some value>" writable="1" encryption="1" password="1" />
</OBJECT>

5.  Replace <some value> by a new superadmin password and add a line
    which enabling superadmin login after. For example, the block after
    the changes:

<OBJECT name="User." type="object" writable="1" encryption="0" >
<OBJECT name="1." type="object" writable="1" encryption="0" >
<PARAMETER name="Password" type="string" value="s0meP@ss" writable="1" encryption="1" password="1" />
<PARAMETER name="Enable" type="boolean" value="1" writable="1" encryption="0"/>
</OBJECT>

6.  Encode the configuration. For example, using cfgtool.py tool:
       cfgtool.py -p configurationBackup.xml

7.  Upload the changed configuration (configurationBackup_changed.cfg) to
    the router

8.  Login to the router web interface (superadmin:xxxxxxxxxx, where
    xxxxxxxxxx is a new password from the p.5)

9.  Enable SSH access to the router (Settings -> Access control -> SSH)

10. Connect to the router using SSH shell using superadmin account

11. Run in SSH shell:
    sh

12. Make a mtd backup (optional, see related section)

13. Change bootflag to Sercomm1 and reboot:
    printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
    reboot

14. Login to the router web interface under admin account

15. Remove dots from the OpenWrt factory image filename

16. Update firmware via web using OpenWrt factory image

Revert to stock
---------------
Change bootflag to Sercomm1 in OpenWrt CLI and then reboot:
   printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3

mtd backup
----------
1. Set up a tftp server (e.g. tftpd64 for windows)
2. Connect to a router using SSH shell and run the following commands:
   cd /tmp
   for i in 0 1 2 3 4 5 6 7 8 9; do nanddump -f mtd$i /dev/mtd$i; \
   tftp -l mtd$i -p 192.168.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done
   tftp -l mtd.md5 -p 192.168.0.2

MAC Addresses
-------------
+-----+------------+---------+
| use | address    | example |
+-----+------------+---------+
| LAN | label      | f4:*:66 |
| WAN | label + 11 | f4:*:71 |
| 2g  | label + 2  | f4:*:68 |
| 5g  | label + 3  | f4:*:69 |
+-----+------------+---------+
The label MAC address was found in Factory, 0x21000

cfgtool.py
----------
A tool for decoding and encoding Sercomm configs.
Link: https://github.com/r3d5ky/sercomm_cfg_unpacker

Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2023-12-06 00:12:56 +01:00
David Bauer
dd5d4e24af uboot-envtools: fix GL-MT2500 offset
The previous offsets did also work, as they've wrapped back to 0x0.
However, in reality the environment starts at offset 0x0 of the
u-boot-env MMC partition.

Signed-off-by: David Bauer <mail@david-bauer.net>
2023-12-03 06:56:02 +01:00
David Bauer
1239668648 mediatek: add support for GL.iNet GL-MT2500
Hardware
--------
SoC:  MediaTek MT7981BA
RAM:  1GB DDR4 (NANYA NT5AD512M16C4-JR)
MMC:  8GB eMMC (Samsung 8GTF4R)
ETH:  1000Base-T LAN (ePHY)
      2500Base-T WAN (MaxLinear GPY211C)
BTN:  1x Reset Button
LED:  System (blue/white)
      VPN (white)
USB:  1x USB-A (USB 3.0)
UART: 115200 8N1 - Pinout on board next to LAN port
      Don't connect 3.3V!

Known Issues
------------
U-Boot vendor recovery does not seem to accept any images, neither
GL.iNet images nor OpenWrt images. Recovery requires serial access!

Installation
------------
Upload the OpenWrt sysupgrade image to the Gl.iNet Web-UI. Make sure to
not retain existing settings.

Signed-off-by: David Bauer <mail@david-bauer.net>
2023-11-27 08:02:41 +01:00
Rani Hod
e29f4a3f70 ath79: add support for D-link DAP-1720 A1
D-Link DAP-1720 rev A1 is a mains-powered AC1750 Wi-Fi range extender,
manufactured by Alpha Networks [8WAPAC28.1A1G].
(in square brackets: PCB silkscreen markings)

Specifications:
* CPU (Qualcomm Atheros QCA9563-AL3A [U5]):
  775 MHz single core MIPS 74Kc;
* RAM (Winbond W9751G6KB-25J [U3]):
  64 MiB DDR2;
* ROM (Winbond W25Q128FV [U16]):
  16 MiB SPI NOR flash;
* Ethernet (AR8033-AL1A PHY [U1], no switch):
  1 GbE RJ45 port (no PHY LEDs);
* Wi-Fi
  * 2.4 GHz (Qualcomm Atheros QCA9563-AL3A [U5]):
    3x3 802.11n;
  * 5 GHz (Qualcomm Atheros QCA9880-BR4A [U9]):
    3x3 802.11ac Wave 1;
  * 3 foldable dual-band antennas (U.fl) [P1],[P2],[P3];
* GPIO LEDs:
  * RSSI low (red/green) [D2];
  * RSSI medium (green) [D3];
  * RSSI high (green) [D4];
  * status (red/green) [D5];
* GPIO buttons:
  * WPS [SW1], co-located with status LED;
  * reset [SW4], accessible via hole in the side;
* Serial/UART:
  Tx-Gnd-3v3-Rx [JP1], Tx is the square pin, 1.25mm pitch;
  125000-8-n-1 in U-boot, 115200-8-n-1 in kernel;
* Misc:
  * 12V VCC [JP2], fed from internal 12V/1A AC to DC converter;
  * on/off slide switch [SW2] (disconnects VCC mechanically);
  * unpopulated footprints for a Wi-Fi LED [D1];
  * unpopulated footprints for a 4-pin 3-position slide switch (SW3);

MAC addresses:
* Label = LAN;
* 2.4 GHz WiFi = LAN;
* 5 GHz WiFi = LAN+2;

Installation:
* `factory.bin` can be used to install OpenWrt from OEM firmware via the
  standard upgrade webpage at http://192.168.0.50/UpdateFirmware.html
* `recovery.bin` can be used to install OpenWrt (or revert to OEM
  firmware) from D-Link Web Recovery. To enter web recovery, keep reset
  button pressed and then power on the device. Reset button can be
  released when the red status LED is bright; it will then blink slowly.
  Set static IP to 192.168.0.10, navigate to http://192.168.0.50 and
  upload 'recovery.bin'. Note that in web recovery mode the device
  ignores ping and DHCP requests.

Note: 802.11s is not supported by the default `ath10k` driver and
firmware, but is supported by the non-CT driver and firmware variants.
The `-smallbuffers` driver variant is recommended due to RAM size.

Co-developed-by: Anthony Sepa <protectivedad@gmail.com>
Signed-off-by: Rani Hod <rani.hod@gmail.com>
2023-11-26 18:27:35 +01:00
Chukun Pan
4825defe44
uboot-envtools: filogic: reorder alphabetically
Reorder scripts to keep alphabetical order.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
2023-11-25 23:16:35 +01:00
Nicolò Veronese
2a0805fd3d uboot-envtools: add support for Zyxel EX5601-T0 ubootmod
The ubootmod bootlaoder for EX5601-T0 uses two partitions
 in ubi to store enviroment variables. so proper config
 is needed.

Signed-off-by: Nicolò Veronese <nicveronese@gmail.com>
2023-11-25 14:51:21 +01:00
Daniel Golle
c8c2f52262 mediatek: add support for Zbtlink ZBT-Z8102AX
Specifications:
SoC: MediaTek MT7981B
RAM: 1024MiB
Flash: SPI-NAND 128 MiB
Switch: 1 WAN, 4 LAN (Gigabit)
USB: two M.2 slots for 5G modems via USB 3.0 hub, external USB 3.0 port
Buttons: Reset, Mesh
Power: DC 12V 1A
WiFi: MT7976CN
UART: 115200n8
UART Layout:
VCC-RX-TX-GND

Installation:
A. Through OpenWrt Dashboard:
If your router comes with OpenWrt preinstalled (modified by the seller),
you can easily upgrade by going to the dashboard (192.168.1.1) and then
navigate to System -> Backup/Flash firmware, then flash the firmware

B. Through TFTP
Standard installation via UART:

1. Connect USB Serial Adapter to the UART, (NOTE: Don't connect the VCC pin).
2. Power on the router. Make sure that you can access your router via UART.
3. Restart the router then repeatedly press ctrl + c to skip default boot.
4. Type > bootmenu
5. Press '2' to select upgrade firmware
6. Press 'Y' on 'Run image after upgrading?'
7. Press '0' and hit 'enter' to select TFTP client (default)
8. Fill the U-Boot's IP address and TFTP server's IP address.
9. Finally, enter the 'firmware' filename.

Based on patch adding support for similar Zbtlink ZBT-Z8103AX device by
Ian Ishmael C. Oderon.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2023-11-24 21:28:35 +00:00
Daniel Golle
2634d3f855 uboot-envtools: add settings for Synology DS213j
Add settings to be able to access the U-Boot environment on the
Synology DS213j NAS.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2023-11-20 13:40:17 +00:00
Chukun Pan
b42c527228 uboot-mediatek: add JCG Q30 PRO support
The vendor uboot will verify firmware at boot.
So add a custom uboot build for this device.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
2023-11-19 16:52:16 +01:00
Daniel Golle
f8414f1a6f uboot-envtools: add environment config for MeiG SLT866
Add configuration to access U-Boot environment on MeiG SLT866.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2023-11-03 21:16:29 +00:00
Weiping Yang
c7baca3bb6 ath79: add support for GL.iNet GL-S200
Specifications:
SoC: QCA9531(650MHz)
RAM: DDR2 128M
Flash: SPI NOR 16M + SPI NAND 128M
WiFi: 2.4GHz with 2 antennas(WiFi/Thread)
Ethernet:
    1xLAN(10/100M)
    2xWAN(10/100M)
Button: 1x Reset Button
Switch: 1x Mode switch
LED: 1x Blue LED + 1x White LED + 1x Orange LED
IOT: Thread + ZigBee/Zwave

By uboot web failsafe:
Push the reset button for 5 seconds util the power led flash faster,
then use broswer to access http://192.168.1.1

Afterwards upgrade can use sysupgrade image.

Signed-off-by: Weiping Yang <weiping.yang@gl-inet.com>
2023-10-31 13:53:11 +01:00
Milan Krstic
17465fc77e ramips: add support for ZyXEL LTE5398-M904
ZyXEL LTE5398-M904 is a dual band 802.11ac indoor LTE/3G CPE with an FXS
port.

Specifications:

* SoC: Mediatek MT7621AT
* RAM: 256 MB
* Flash: 128MB NAND (MX30LF1G18AC)
* WiFi: MediaTek MT7603 2.4G + MediaTek MT7615 5G
* Switch: 2 GbE ports MT7530
* LTE/3G: Quectel EG18-EA LTE-A Cat. 18
* SIM: 1 micro-SIM card slot
* Buttons: Reset, WPS
* LEDs: power (G/B), internet (G), LTE (R/G/Orange), WiFi (G), voice (G)
* VoIP: 1 FXS RJ11 port
* Power: 12V, 2A

UART serial console:

57600,8N1
Unpopulated header J5:

 [o] GND
 [ ] key - no pin
 [o] RX
 [o] TX
 [o] 3.3V Vcc

Installation:

* Log in as root using ssh to 192.168.1.1
* scp OpenWrt initramfs-recovery.bin image to root@192.168.1.1:/tmp/
* Prepare bootloader config by running:
   nvram setro uboot DebugFlag 0x1
   nvram setro uboot CheckBypass 0
   nvram commit
* Run "mtd_write -w write /tmp/initramfs-recovery.bin Kernel" and reboot
* Wait for OpenWrt to boot and ssh to root@192.168.1.1
* Run sysupgrade with OpenWrt squashfs-sysupgrade.bin image

For mode details about flashing see:
2449a63208 (ramips: mt7621: Add support for ZyXEL NR7101, 2021-04-19)

Unsupported:

* FXS/Voice

Signed-off-by: Milan Krstic <milan.krstic@gmail.com>
2023-10-29 18:51:11 +01:00
Kristian Skramstad
5e33fdfc47 qualcommax: ipq807x: add support for Netgear WAX630
```
Specifications:
* CPU: Qualcomm IPQ8074A, SoC Version: 2.0, Quad core 1651 MHz
* RAM: 1 GiB of DDR3 466 MHz
* Flash: NAND 512 MiB (Winbond W29N04GZ)
* 6 RGB LEDs: Power, LAN1, LAN2, 2.4GHz, 5GHz H and 5GHz L
* UART: One 4-pin populated header next to the heatsink and a chip.
  GND RXD TXD, beginning from the external antennas. 115200n8.

Lan:
* One 100/1000/2.5GBASE-T Gigabit Ethernet 802.3bt/at
* One 100/1000 Gigabit Ethernet

Wlan:
* 4x4 in 2.4GHz  : 802.11b/g/n/ax
* 4x4 in 5.0GHz L: 802.11a/n/ac/ax
* 4x4 in 5.0GHz H: 802.11a/n/ac/ax
* OFDM and OFDMA
* Bidir and MU-MIMO
* Internal antenna 2.86/4.41/4.98 dBi (2.4GHz/5GHz L/5GHz H)

Power:
* 802.3bt/at 30.1W
* DC 12V/3.5A

Mounting: Wall and ceiling
```

```
1.  Download the OpenWrt initramfs image. Copy the image to a TFTP server
2.  Connect to the console on the AP, and connect the LAN port to your LAN
3.  Stop auto boot to get to U-boot shell, interrupt the autoboot process by pressing '0' when prompted
4.  Set active_fw in env
4.  Set active_fw in env
    # setenv active_fw 1
5.  Transfer the initramfs image with TFTP
    # setenv serverip 192.168.1.10 (IP of TFTP server host)
    # setenv ipaddr 192.168.1.1 (IP used by the router for getting the image, must be in the same subnet as the TFTP host)
    # tftpboot openwrt-qualcommax-ipq807x-netgear_wax630-initramfs-uImage.itb
6.  Reboot and load the image
    # bootm
7.  SCP factory image to the AP
    # scp openwrt-qualcommax-ipq807x-netgear_wax630-squashfs-factory.ubi root@192.168.1.1:/tmp/
8.  Connect to device using SSH (use the LAN port)
9.  Flash squashfs-factory.ubi from within the initramfs instance of OpenWRT
    Before you flash, please check your mtd partitions where mtdX is the right mtd rootfs partition.
    # cat /proc/mtd (To check MTD partitions)
    # ubiformat /dev/mtd18 -y -f /tmp/openwrt-qualcommax-ipq807x-netgear_wax630-squashfs-factory.ubi
10. Set active_fw to 0
    # /usr/sbin/fw_setenv active_fw 0
11. Reboot the AP and your done
    # reboot
```

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Kristian Skramstad <kristian+github@83.no>
2023-10-28 19:49:18 +02:00
Tianling Shen
423186d7d8 mediatek: add CMCC RAX3000M support
Hardware specification:
  SoC: MediaTek MT7981B 2x A53
  Flash: 64GB eMMC or 128 MB SPI-NAND
  RAM: 512MB
  Ethernet: 4x 10/100/1000 Mbps
  Switch: MediaTek MT7531AE
  WiFi: MediaTek MT7976C
  Button: Reset, Mesh
  Power: DC 12V 1A
- UART: 3.3v, 115200n8
  --------------------------
  |         Layout         |
  |   -----------------    |
  | 4 | GND TX VCC RX | <= |
  |   -----------------    |
  --------------------------

Gain SSH access:
1. Login into web interface, and download the configuration.
2. Enter fakeroot, decompress the configuration:
   tar -zxf cfg_export_config_file.conf
3. Edit 'etc/config/dropbear', set 'enable' to '1'.
4. Edit 'etc/shadow', update (remove) root password:
   'root::19523:0:99999:7:::'
5. Repack 'etc' directory:
   tar -zcf cfg_export_config_file.conf etc/
   * If you find an error about 'etc/wireless/mediatek/DBDC_card0.dat',
     just ignore it.
6. Upload new configuration via web interface, now you can SSH to RAX3000M.

Check stroage type:
Check the label on the back of the device:
"CH EC CMIIT ID: xxxx" is eMMC version
"CH    CMIIT ID: xxxx" is NAND version

eMMC Flash instructions:
1. SSH to RAX3000M, and backup everything, especially 'factory' part.
   ('data' partition can be ignored, it's useless.)
2. Write new GPT table:
   dd if=openwrt-mediatek-filogic-cmcc_rax3000m-emmc-gpt.bin of=/dev/mmcblk0 bs=512 seek=0 count=34 conv=fsync
3. Erase and write new BL2:
   echo 0 > /sys/block/mmcblk0boot0/force_ro
   dd if=/dev/zero of=/dev/mmcblk0boot0 bs=512 count=8192 conv=fsync
   dd if=openwrt-mediatek-filogic-cmcc_rax3000m-emmc-preloader.bin of=/dev/mmcblk0boot0 bs=512 conv=fsync
4. Erase and write new FIP:
   dd if=/dev/zero of=/dev/mmcblk0 bs=512 seek=13312 count=8192 conv=fsync
   dd if=openwrt-mediatek-filogic-cmcc_rax3000m-emmc-bl31-uboot.fip of=/dev/mmcblk0 bs=512 seek=13312 conv=fsync
5. Set static IP on your PC:
   IP 192.168.1.254, GW 192.168.1.1
6. Serve OpenWrt initramfs image using TFTP server.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt has booted, perform sysupgrade.
9. Additionally, if you want to have eMMC recovery boot feature:
     (Don't worry! You will always have TFTP recovery boot feature.)
   dd if=openwrt-mediatek-filogic-cmcc_rax3000m-initramfs-recovery.itb of=/dev/mmcblk0p4 bs=512 conv=fsync

NAND Flash instructions:
1. SSH to RAX3000M, and backup everything, especially 'Factory' part.
2. Erase and write new BL2:
   mtd erase BL2
   mtd write openwrt-mediatek-filogic-cmcc_rax3000m-nand-preloader.bin BL2
3. Erase and write new FIP:
   mtd erase FIP
   mtd write openwrt-mediatek-filogic-cmcc_rax3000m-nand-bl31-uboot.fip FIP
4. Set static IP on your PC:
   IP 192.168.1.254, GW 192.168.1.1
5. Serve OpenWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After OpenWrt has booted, erase UBI volumes:
   ubidetach -p /dev/mtd0
   ubiformat -y /dev/mtd0
   ubiattach -p /dev/mtd0
8. Create new ubootenv volumes:
   ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
   ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Additionally, if you want to have NAND recovery boot feature:
     (Don't worry! You will always have TFTP recovery boot feature.)
   ubimkvol /dev/ubi0 -n 2 -N recovery -s 20MiB
   ubiupdatevol /dev/ubi0_2 openwrt-mediatek-filogic-cmcc_rax3000m-initramfs-recovery.itb
10. Perform sysupgrade.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-10-28 19:05:07 +02:00
Glen Lee
3aef61060e
ipq806x: add support for Extreme Networks AP3935
Extreme Networks AP3935i/e -
https://www.extremenetworks.com/support/documentation/access-points-ap3935i-e/

SoC: IPQ8068 QYY AT46279K45060I
RAM: NANYA 1527 NT5CC256M16DP-DI 515073W0EF 7 TW
FLASH: NOR - S25FL256S1 - 32MB
       NAND - Macronix MX30UF4G28AB - 512MB
LAN: Atheros AR8035-A J5150WL 1515 CN - RGMII
LAN2: Atheros AR8033-AL1A SKCSR.AJ1 1444 China - SGMII
WLAN2: QCA9990 OVV FNPV209 K451406
WLAN5: QCA9990 OVV FNPV209 K451406
SERIAL: RS232 Port (115200 8n1) Cisco console cable and
        4pin Serial Header | 3.3 | GND | RX | TX

MAC address for LAN1/LAN2/WLAN 2G/WLAN 5G in uboot env

 * Installation via either RJ45 console or on-board 4 PIN header

Install Method
--------------
1) Setup TFTP server, and place
     openwrt-ipq806x-generic-extreme_ap3935-initramfs-uImage image
     in /srv/tftp or similar
2) Connect to console on router and connect ethernet port "LAN1" to
     your LAN
3) Interupt the boot with any character
4) Login with admin/new2day for default password
     (use reset/FactoryDefault if password needs to be reset)
5) Set serverip to TFTP IP: set serverip 192.168.1.2
6) Set ipaddr to another IP: set ipaddr 192.168.1.101
7) Make uboot ping something to activate eth0 on boot:
     set bootcmd 'ping 192.168.1.1; run boot_flash'
     saveenv
8) TFTP image to RAM:
     tftpboot 0x42000000
openwrt-ipq806x-generic-extreme_ap3935i-initramfs-uImage
9) Boot image: bootm 0x42000000
     In OpenWRT, "LAN1" is LAN, "LAN2" is WAN
10) SFTP openwrt-ipq806x-generic-extreme_ap3935-squashfs-nand-sysupgrade.bin
     image to /tmp
11) sysupgrade /tmp/openwrt-*-nand-sysupgrade.bin

Signed-off-by: Glen Lee <g2lee@yahoo.com>
2023-10-05 00:56:57 +02:00
Jianhui Zhao
fe10f97439 filogic: add support for GL.iNet GL-MT6000
Hardware specification:
* SoC: MediaTek MT7986A 4x A53
* Flash: 8GB EMMC
* RAM: 1GB DDR4
* Ethernet:
  * 2x2.5G RJ45 port (RTL8221B)
  * 4x1G RJ45 ports (MT7531AE)
* WLAN:
  * 2.4GHz: MT7976GN 4T4R
  * 5GHz: MT7976AN 4T4R
* Button: Reset
* LED: 1 x dual color LED
* USB: 1 x USB 3.0
* Power: DC 12V 4A
* UART: 3V3 115200 8N1 (Pinout: GND TX RX VCC)
* JTAG: 9 PIN

If you want to use u-boot from OpenWrt, you can upgrade it safely.
* bl2: openwrt-mediatek-filogic-glinet_gl-mt6000-preloader.bin
* fip: openwrt-mediatek-filogic-glinet_gl-mt6000-bl31-uboot.fip

`openwrt-mediatek-filogic-glinet_gl-mt6000-squashfs-factory.bin` is used in OpenWrt's u-boot.

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
2023-09-29 00:18:26 +01:00
Elbert Mai
75ee5546e9 mediatek: filogic: add support for Ubiquiti UniFi 6 Plus (U6+)
Ubiquiti U6+ is a dual-band WiFi 6 PoE access point.
It is a drop-in upgrade of the U6 lite.

Specifications
---

- SoC: MediaTek MT7981A dual-core ARM Cortex-A53 1.3 GHz
- RAM: 256 MB DDR3-2133 RAM
- Flash: 16 MB SPI NOR and 4 GB eMMC
- LAN: 1x Gigabit Ethernet with 802.3af/at support
- WLAN: MediaTek MT7976C 2x2 MIMO dual-band WiFi 6
- LEDs: 1x blue and 1x white
- Buttons: 1x reset button

Installation
---

1. Power device using a PoE injector or switch
2. Connect via Ethernet to the device with static IP 192.168.1.2
3. SSH into the device with password: ubnt

        $ ssh ubnt@192.168.1.20

4. Unlock kernel partitions for writing

        $ echo 5edfacbf > /proc/ubnthal/.uf

5. Confirm correct partitions

        $ grep PARTNAME /sys/block/mmcblk0/mmcblk0p6/uevent
        PARTNAME=kernel0
        $ grep PARTNAME /sys/block/mmcblk0/mmcblk0p7/uevent
        PARTNAME=kernel1
        $ grep PARTNAME /sys/block/mmcblk0/mmcblk0p8/uevent
        PARTNAME=bs

6. Set and confirm bootloader environment

        $ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr); fdt rm /signature; bootubnt"
        $ fw_setenv bootcmd_real "run boot_openwrt"
        $ fw_printenv

7. Copy sysupgrade image to /tmp/openwrt.bin via scp
8. Copy kernel and rootfs to mmcblk0p6 and mmcblk0p7, respectively

        $ tar xf /tmp/openwrt.bin sysupgrade-ubnt_unifi-6-plus/kernel -O | dd of=/dev/mmcblk0p6
        $ tar xf /tmp/openwrt.bin sysupgrade-ubnt_unifi-6-plus/root -O | dd of=/dev/mmcblk0p7

9. Ensure device boots from mmcblk0p6

        $ echo -ne "\x00\x00\x00\x00\x2b\xe8\x4d\xa3" > /dev/mmcblk0p8

10. Reboot the device

        $ reboot

Signed-off-by: Elbert Mai <code@elbertmai.com>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
2023-09-24 17:16:16 +02:00
Kristian Skramstad
76e419288f ipq807x: add support for Netgear WAX620
```
Specifications:
* CPU: Qualcomm IPQ8072A, SoC Version: 2.0, Quad core Cortex-A53 1.6896 GHz
* RAM: 1 GiB of DDR4 600 MHz
* Flash: NAND 2x256 MiB (Macronix MX30UF2G18AC)
* 4 RGB LEDs: Power, LAN, 2.4GHz and 5GHz
* UART: Two 4-pin unpopulated headers under the LEDs.
  Use the header closest to LED 4 and 5.
  They are marked with a white stroke.
  TX RX GND, beginning from "4". 115200n8.

Lan:
* One 100/1000/2.5GBASE-T Gigabit Ethernet (QCA8081)

Wlan:
* 4x4 in 2.4GHz: 802.11b/g/n/ax
* 4x4 in 5.0GHz: 802.11a/n/ac/ax
* OFDM and OFDMA
* Bidir and MU-MIMO
* Internal antenna 3.1/4.3 dBi (2.4GHz/5GHz)

Power:
* PoE+ 802.3at/af 25.5W
* DC 12V 2.5A
```

```
Note: The OpenWrt image is setup with DHCP and not a static IP.
1.  Download the OpenWrt initramfs image. Copy the image to a TFTP server
2.  Connect to console on the AP, and connect the LAN port to your LAN
3.  Stop auto boot to get to U-boot shell, interrupt the autoboot process by pressing '0' when prompted
4.  Set active_fw in env
    # setenv active_fw 1
5.  Transfer the initramfs image with TFTP
    # setenv serverip 192.168.1.10 (IP of TFTP server host)
    # setenv ipaddr 192.168.1.1 (IP used by the router for getting the image, must be in the same subnet as the TFTP host)
    # tftpboot openwrt-qualcommax-ipq807x-netgear_wax620-initramfs-uImage.itb
6.  Reboot and load the image
    # bootm
7.  SCP factory image to the AP
    # scp openwrt-qualcommax-ipq807x-netgear_wax620-squashfs-factory.ubi root@192.168.1.1:/tmp/
8.  Connect to device using SSH (use the LAN port)
9.  Flash squashfs-factory.ubi from within the initramfs instance of OpenWRT
    Before you flash, please check your mtd partitions where mtdX is the right mtd rootfs partition.
    # cat /proc/mtd (To check MTD partitions)
    # ubiformat /dev/mtd19 -y -f /tmp/openwrt-qualcommax-ipq807x-netgear_wax620-squashfs-factory.ubi
10. Set active_fw to 0
    # /usr/sbin/fw_setenv active_fw 0
11. Reboot the AP and your done
    # reboot
```

Signed-off-by: Kristian Skramstad <kristian+github@83.no>
2023-09-24 13:09:16 +02:00
Piotr Dymacz
69f12c2f23 uboot-envtools: ramips: add support for ALFA Network AX1800RM
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2023-09-11 11:46:52 +02:00
Patricia Lee
907e9e0bd3 mediatek: add support for Cetron CT3003
**Hardware specification:**

- SoC: MediaTek MT7981B 2x A53
- Flash: ESMT F50L1G41LB 128MB
- RAM: Nanya NT5CC128M16JR-EK 256MB
- Ethernet: 4 x 10/100/1000 Mbps
- Switch: MediaTek MT7531AE
- WiFi: MediaTek MT7976C
- Button: Reset, Mesh
- Power: DC 12V 1A
- UART: 3.3v, 115200n8
  | Layout:   |
  | :-------- |
  | <Antenna> |
  | VCC       |
  | GND       |
  | Tx        |
  | Rx        |

**Flash instructions:**

1. Rename `openwrt-mediatek-filogic-cetron_ct3003-squashfs-factory.bin` to `factory.bin`.
2. Upload the `factory.bin` using the device's Web interface.
3. Click the upgrade button and wait for the process to finish.
4. Access the OpenWrt interface using the same password.
5. Use the 'Restore' function to reset the firmware to its initial state.

**Notes:**

If you plan to recovery the stock firmware in the future, it's advisable
to connect the device via the serial port and enter failsafe mode to
back up all the MTD partitions before proceeding the steps above.

Signed-off-by: Patricia Lee <patricialee320@gmail.com>
2023-09-08 23:17:26 +02:00
Stefan Agner
4af06aaf33 mediatek: filogic: wax220: cleanup device tree
Fix compatible string to match what is supported upstream, fix alignment
and order MTD partitions according to offset.

Signed-off-by: Stefan Agner <stefan@agner.ch>
2023-08-22 13:37:27 +02:00
Bjørn Mork
6cc14bf66a filogic: support Telenor branded ZyXEL EX5700
Telenor quirks
--------------
The operator specific firmware running on the Telenor branded
ZyXEL EX5700 includes U-Boot modifications affecting the OpenWrt
installation.

Notable changes to U-Boot include
- environment is stored in RAM and reset to defaults when power
  cycled
- dual partition scheme with "nomimal" or "rescue" systems, falling
  back to "rescue" unless the OS signals success in 3 attempts
- several runtime additions to the device-tree

Some of these modifications have side effects requiring workarounds
- U-Boot modifies /chosen/bootargs in an unsafe manner, and will crash
  unless this node exists
- U-Boot verifies that the selected rootfs UBI volume exists, and
  refuses to boot if it doesn't. The chosen "rootfs" volume must contain
  a squashfs signature even for tftp or initramfs booting.
- U-Boot parses the "factoryparams" UBI volume, setting the "ethaddr"
  variable to the label mac.  But "factoryparams" does not always
  exist.  Instead there is a "RIP" volume containing all the factory
  data.  Copying the "RIP" volume to  "factoryparams" will fix this

Hardware
--------
SOC:   MediaTek MT7986
RAM:   1GB DDR4
FLASH: 512MB SPI-NAND (Mikron xxx)
WIFI:  Mediatek MT7986 802.11ax 5 GHz
       Mediatek MT7916 DBDC 802.11ax 2.4 + 6 GHz
ETH:   MediaTek MT7531 Switch + SoC
       3 x builtin 1G phy (lan1, lan2, lan3)
       2 x MaxLinear GPY211C 2.5 N-Base-T phy (lan4, wan)
USB:   1 x USB 3.2 Enhanced SuperSpeed port
UART:  3V3 115200 8N1 (Pinout: GND KEY RX TX VCC)

Installation
------------
1. Download the OpenWrt initramfs image. Copy the image to a TFTP server
   reachable at 192.168.1.2/24. Rename the image to C0A80101.img.

2. Connect the TFTP server to lan1, lan2 or lan3. Connect to the serial
   console, Interrupt the autoboot process by pressing ESC when prompted.

3. Download and boot the OpenWrt initramfs image.

   $ env set uboot_bootcount 0
   $ env set firmware nominal
   $ tftpboot
   $ bootm

4. Wait for OpenWrt to boot. Transfer the sysupgrade image to the device
   using scp and install using sysupgrade.

   $ sysupgrade -n <path-to-sysupgrade.bin>

Missing features
----------------

- The "lan1", "lan2" and "lan3" port LEDs are driven by the switch but
  OpenWrt does not correctly configure the output.
- The "lan4" and "wan" port LEDs are driven by the GPH211C phys and
  not configured by OpenWrt.

Signed-off-by: Bjørn Mork <bjorn@mork.no>
2023-08-20 01:14:06 +02:00
Thomas Kupper
4d79a65d60 ipq807x: add support for Netgear RAX120v2
Netgear Nighthawk RAX120v2 AX WIFI router with 5 1G and 1 5G ports.

The majority of the code is based on @jewwest's PR #11830.

Specifications:
    * CPU: Qualcomm IPQ8074 Quad core Cortex-A53 2.2GHz
    * RAM: 1024MB of DDR3 (Nanya NT5CC256M16EP-EK × 2)
    * Flash: SPI-NAND 512 MiB (Winbond W29N04GZBIBA)
    * Ethernet: 4x 10/100/1000 Mbps LAN,
                1x 10/100/1000 Mbps WAN (Qualcomm QCA8075),
                1x 10/100/1000/2500/5000 Mbps LAN/WAN (Aquantia AQR111B0 PHY)
    * Wi-Fi:
        * 2.4 GHz: Qualcomm QCN5024 4x4
        * 2x 5 GHz: Qualcomm QCN5054 4x4
    * USB: 2x USB 3.0
    * LEDs: Power, 2.4GHz & 5GHz Radio, WPS, WAN, USB1 & USB2, 5G LAN
    * Keys: LEDs On/Off, Power, Reset, RFKILL, WPS
    * UART: Marked J9003 VCC TX RX GND, beginning from "1". 3.3v, 115200n8
    * Power: 19 VDC, 3.1 A

Installation:
    * Flashing OpenWrt is done in two steps:
        a) Flash *-squashfs-web-ui-factory.img from stock UI (thanks to @wangyu-).
           This writes an initramfs based OpenWrt image onto the RAX120v2
        b) From OpenWrt flash the *-squashfs-sysupgrade.bin using LuCI or the commandline

    * U-Boot allows booting an initramfs image via TFTP:
    - Set ip of your PC to 192.168.1.100
        - At the serial console interrupt boot at "Hit any key to stop autoboot:"
        - In u-boot run `tftpsrv`
        - On your PC send the OpenWrt initramfs image:

          tftp 192.168.1.1 -m binary -c put openwrt-ipq807x-generic-netgear_rax120v2-initramfs-uImage.itb

Make 5G Aquantia phy work:
    For the 5G port labeled 'lan5' to work a firmware is needed. This can be loaded in
    u-boot by writing the firmware to the correct mtd partition.

    The firmware file found in the Netgear stock firmware under /lib/firmware/ named
    'AQR-G3_v4.3.C-AQR_DNI_DR-EQ35AX8-R-prov1_ID23888_VER1311.cld' is needed and has to
    be converted to a MBN file.

    The `mkheader.py` script used here can be found in the Netgear V1.2.8.40 GPL source,
    under 'git_home/u-boot.git/tools/mkheader.py'

    Convert the CLD file to MBN using:
    $ python2 mkheader.py 0x44000000 0x13 <*.cld file> aqr_4.3.C.mbn

    This MBN file can then be flashed to the MTD partition to be used by u-boot.

    The necessary files can also be found in
        https://github.com/boretom/openwrt-fork/tree/rax120v2/aquantia-firmware

    * Write MBN file to MTD partition to be loaded automatically by u-boot:

      U-boot automatically tries to load the firmware from nand at address 0x7e00000 which
      corresponds to `/dev/mtd25` in OpenWrt.

        - find ETHPHYFW partition while running OpenWrt (expected: /dev/mtd25)

          $ fgrep -i 'ethphyfw' /proc/mtd
          mtd25: 00080000 00020000 "ethphyfw

        - copy mbn file to /tmp/ folder of the router

          $ scp aqr-v4.3.C.mbn 192.168.1.1:/tmp/

        - write mbn file to ethphyfw partition

          $ mtd write /tmp/aqr_v4.3.C.mbn /dev/mtd25

Revert to stock firmware:
    * Flash the stock firmware to the bootloader using TFTP/NMRP.

References to RAX120v2 GPL source:
    https://www.downloads.netgear.com/files/GPL/RAX120-V1.2.8.40_gpl_src.zip

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Thomas Kupper <thomas.kupper@gmail.com>
2023-08-19 17:12:46 +02:00
Ivan Pavlov
a87bc138cf uboot-envtools: add u-boot env config for Xiaomi mi-mini
Add u-boot env config for Xiaomi mi-mini for using fw_printenv and fw_setenv on this board

Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
2023-08-14 20:08:05 +02:00
Hank Moretti
dcdcfc1511 mediatek: filogic: add specific layout for WR30U
Because this device enable NMBM by default, most users use custom
U-Boot with NMBM-Enabled in Chinese forums.

This layout is the same as the ubootmod layout but enabling NMBM.

Signed-off-by: Hank Moretti <mchank9999@gmail.com>
2023-07-27 13:46:26 +02:00
Hank Moretti
20603e764d uboot-mediatek: add support for Xiaomi WR30U
Add a custom uboot build to support openwrt uboot layout.

Signed-off-by: Hank Moretti <mchank9999@gmail.com>
2023-07-27 13:41:05 +02:00
Christian Svensson
6bf0e76494 octeon: n821: add Cisco vEdge 1000 base
This is the first commit to introduce the base for the N821 board used
in Cisco vEdge 1000.

This commit does not include the custom CPLD drivers but rather
everything else that is already present in the upstream kernel.

This results in an image that boots, but e.g. the SFP ports are not
usable.

Hardware:

  - CPU: Cavium Networks CN6130, 4 cores @ 1.0 GHz
  - Flash:
    - 16 MiB SPI NOR presented as 2x8 MiB for A/B boot recovery
    - 8192 MiB eMMC
  - RAM: 4096 MiB
  - Ethernet 1Gbit ports: 1x
  - Ethernet SFP ports: 8x
  - USB ports: 2x 3.0 Type-A on front panel
  - Serial: Two, one internal and one external
  - JTAG: Yes
  - LED count: 18x
  - Button count: 1x
  - GPIOs: 1x
  - Power: 2x redundant DC 12V barrel plug
  - Extra: Slot for SD card on front

See the OpenWrt wiki for more hardware details.

Installation:

  - Flash squashfs to /dev/sda2 and put kernel on /dev/sda1.
  - Update uboot's bootcmd environment variable to match.

Full installation guide will be added to OpenWrt wiki when sysupgrade
support is added.

Signed-off-by: Christian Svensson <blue@cmd.nu>
Signed-off-by: Tommy Nevtelen <tommy@nevtelen.com>
Tested-by: Viktor Ekmark <viktor@ekmark.se>
Tested-by: Daniel Wennberg <github@networkninja.se>
2023-07-15 17:05:58 +02:00
Wenli Looi
520c9917f8 ath79: add support for ASUS RT-AC59U / ZenWiFi CD6
ASUS RT-AC59U / RT-AC59U v2 are wi-fi routers with a large number of
alternate names, including RT-AC1200GE, RT-AC1300G PLUS, RT-AC1500UHP,
RT-AC57U v2/v3, RT-AC58U v2/v3, and RT-ACRH12.

ASUS ZenWiFi AC Mini(CD6) is a mesh wifi system. The unit labeled CD6R
is the router, and CD6N is the node.

Hardware:

- SoC: QCN5502
- RAM: 128 MiB
- UART: 115200 baud (labeled on boards)
- Wireless:
  - 2.4GHz: QCN5502 on-chip 4x4 802.11b/g/n
    currently unsupported due to missing support for QCN550x in ath9k
  - 5GHz: QCA9888 pcie 5GHz 2x2 802.11a/n/ac
- Flash: SPI NOR
  - RT-AC59U / CD6N: 16 MiB
  - RT-AC59U v2 / CD6R: 32 MiB
- Ethernet: gigabit
  - RT-AC59U / RT-AC59U v2: 4x LAN 1x WAN
  - CD6R: 3x LAN 1x WAN
  - CD6N: 2x LAN
- USB:
  - RT-AC59U / RT-AC59U v2: 1 port USB 2.0
  - CD6R / CD6N: none

WiFi calibration data contains valid MAC addresses.

The initramfs image is uncompressed because I was unable to boot a
compressed initramfs from memory (gzip or lzma). Booting a compressed
image from flash works fine.

Installation:

To install without opening the case:

- Set your computer IP address to 192.168.1.10/24
- Power up with the Reset button pressed
- Release the Reset button after about 5 seconds or until you see the
  power LED blinking slowly
- Upload OpenWRT factory image via TFTP client to 192.168.1.1

Revert to stock firmware using the same TFTP method.

Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
2023-07-08 20:19:00 +02:00
Mikhail Zhilkin
2d6784a033 ramips: add support for Sercomm S1500 devices
This commit adds support for following wireless routers:
 - Beeline SmartBox PRO (Serсomm S1500 AWI)
 - WiFire S1500.NBN (Serсomm S1500 BUC)

This commit is based on this PR:
 - Link: https://github.com/openwrt/openwrt/pull/4770
 - Author: Maximilian Weinmann <x1@disroot.org>
The opening of this PR was agreed with author.

My changes:
- Sorting, minor changes and some movings between dts and dtsi
- Move leds to dts when possible
- Recipes for the factory image
- Update of the installation/recovery/return to stock guides
- Add reset GPIO for the pcie1

Common specification
--------------------
SoC:        MediaTek MT7621AT (880 MHz, 2 cores)
Switch:     MediaTek MT7530 (via SoC MT7621AT)
Wireless:   2.4 GHz, MT7602EN, b/g/n, 2x2
Wireless:   5 GHz, MT7612EN, a/n/ac, 2x2
Ethernet:   5 ports - 5×GbE (WAN, LAN1-4)
Mini PCIe:  via J2 on PCB, not soldered on the board
UART:       J4 -> GND[], TX, VCC(3.3V), RX
BootLoader: U-Boot SerComm/Mediatek

Beeline SmartBox PRO specification
----------------------------------
RAM (Nanya NT5CB128M16FP): 256 MiB
NAND-Flash (ESMT F59L2G81A): 256 MiB
USB ports: 2xUSB2.0
LEDs: Status (white), WPS (blue), 2g (white), 5g (white) + 10 LED Ethernet
Buttons: 2 button (reset, wps), 1 switch button (ROUT<->REP)
Power: 12 VDC, 1.5 A
PCB Sticker: 970AWI0QW00N256SMT Ver. 1.0
CSN: SG15********
MAC LAN: 94:4A:0C:**:**:**
Manufacturer's code: 0AWI0500QW1

WiFire S1500.NBN specification
------------------------------
RAM (Nanya NT5CC64M16GP): 128 MiB
NAND-Flash (ESMT F59L1G81MA): 128 MiB
USB ports: 1xUSB2.0
LEDs: Status (white), WPS (white), 2g (white), 5g (white) + 10 LED Ethernet
Buttons: 2 button (RESET, WPS)
Power: 12 VDC, 1.0 A
PCB Sticker: 970BUC0RW00N128SMT Ver. 1.0
CSN: MH16********
MAC WAN: E0:60:66:**:**:**
Manufacturer's code: 0BUC0500RW1

MAC address table (PRO)
-----------------------
use   address   source
LAN   *:23      factory 0x1000 (label)
WAN   *:24      factory $label +1
2g    *:23      factory $label
5g    *:25      factory $label +2

MAC addresses (NBN)
-------------------
use   address   source
LAN   *:0e      factory 0x1000
WAN   *:0f      LAN +1 (label)
2g    *:0f      LAN +1
5g    *:10      LAN +2

OEM easy installation
---------------------
1. Remove all dots from the factory image filename (except the dot
   before file extension)
2. Upload and update the firmware via the original web interface
3. Two options are possible after the reboot:
   a. OpenWrt - that's OK, the mission accomplished
   b. Stock firmware - install Stock firmware (to switch booflag from
      Sercomm0 to Sercomm1) and then OpenWrt factory image.

Return to Stock
---------------
1. Change the bootflag to Sercomm1 in OpenWrt CLI and then reboot:
   printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock2
   reboot
2. Install stock firmware via the web OEM firmware interface

Recovery
--------
Use sercomm-recovery tool.
Link: https://github.com/danitool/sercomm-recovery

Tested-by: Pavel Ivanov <pi635v@gmail.com>
Tested-by: Denis Myshaev <denis.myshaev@gmail.com>
Tested-by: Oleg Galeev <olegingaleev@gmail.com>
Tested-By: Ivan Pavlov <AuthorReflex@gmail.com>
Co-authored-by: Maximilian Weinmann <x1@disroot.org>
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2023-07-01 16:05:01 +02:00
Mathew McBride
8e7ba6fbae layerscape: remove Traverse LS1043 boards
The Traverse LS1043 boards were not publicly released,
all the production has been going to OEM customers who
do not use the image format defined in the OpenWrt tree.

Only a few samples were circulated outside Traverse
and our OEM customers. The public release (then called
Five64) of this series was cancelled in favour of our
LS1088A based design (Ten64).

It is best to remove these boards to avoid wasting
OpenWrt project and contributor resources.

Signed-off-by: Mathew McBride <matt@traverse.com.au>
2023-07-01 15:47:08 +02:00
Chukun Pan
437e79ad6d uboot-mediatek: add H3C Magic NX30 Pro support
The OEM uboot limit brush into 3rd-party firmware.
So add a custom uboot build to support openwrt.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
2023-07-01 15:13:08 +02:00
Wenli Looi
73de41898f mediatek: add support for Netgear EX6250v2 series
Netgear EX6250v2, EX6400v3, EX6410v2, EX6470 are wall-plug 802.11ac
(Wi-Fi 5) extenders. Like other MT7629 devices, Wi-Fi does not work
currently as there is no driver.

Related: https://github.com/openwrt/openwrt/pull/5084

For future reference, 2.4GHz MAC = LAN+1, 5GHz MAC = LAN+2.

Specifications:
* MT7629, 256 MiB RAM, 16 MiB SPI NOR
* MT7761N (2.4GHz) / MT7762N (5GHz) - no driver
* Ethernet: 1 port 10/100/1000
* UART: 115200 baud (labeled on board)

Installation:
* Flash the factory image through the stock web interface, or TFTP to
  the bootloader. NMRP can be used to TFTP without opening the case.
* After installation, perform a factory reset. Wait for the device to
  boot, then hold the reset button for 10 seconds. This is needed
  because sysupgrade in the stock firmware will attempt to preserve its
  configuration using sysupgrade.tgz.
  See https://github.com/openwrt/openwrt/pull/4182

Revert to stock firmware:
* Flash the stock firmware to the bootloader using TFTP/NMRP.

Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
2023-07-01 14:42:11 +02:00
Wenli Looi
32ea8a9a7e ramips: add support for Netgear EAX12 series
Netgear EAX12, EAX11v2, EAX15v2 are wall-plug 802.11ax (Wi-Fi 6)
extenders that share the SoC, WiFi chip, and image format with the
WAX202.

Specifications:
* MT7621, 256 MiB RAM, 128 MiB NAND
* MT7915: 2.4/5 GHz 2x2 802.11ax (DBDC)
* Ethernet: 1 port 10/100/1000
* UART: 115200 baud (labeled on board)

All LEDs and buttons appear to work without state_default.

Installation:
* Flash the factory image through the stock web interface, or TFTP to
  the bootloader. NMRP can be used to TFTP without opening the case.

Revert to stock firmware:
* Flash the stock firmware to the bootloader using TFTP/NMRP.

References in GPL source:
https://www.downloads.netgear.com/files/GPL/EAX12_EAX11v2_EAX15v2_GPL_V1.0.3.34_src.tar.gz

* target/linux/ramips/dts/mt7621-rfb-ax-nand.dts
  DTS file for this device.

Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
2023-07-01 14:42:11 +02:00
Alexey Bartenev
ce998cb6e1 ramips: add support for D-Link DIR-806A B1 router
General specification:
SoC Type: MediaTek MT7620A (580MHz)
ROM: 8 MB SPI-NOR (MX25L6406E)
RAM: 64 MB DDR (W9751G6KB-25)
Switch: MediaTek MT7530
Ethernet: 5 ports - 5×100MbE (WAN, LAN1-4)
Wireless: 2.4 GHz (MediaTek RT5390): b/g/n
Wireless: 5 GHz (MediaTek MT7610EN): ac/n
Buttons: 2 button (POWER, WPS/RESET)
Bootloader: U-Boot 1.1.3
Power: 12 VDC, 0.5 A

MACs:
| LAN	| [Factory + 0x04] - 2		|
| WLAN 2.4g	| [Factory + 0x04] - 1		|
| WLAN 5g	| [Factory + 0x8004] - 3	|
| WAN	| [Factory + 0x04] - 2		|

OEM easy installation:

1. Use a PC to browse to http://192.168.0.1.
2. Go to the System section and open the Firmware Update section.
3. Under the Local Update at the right, click on the CHOOSE FILE...
4. When a modal window appears, choose the firmware file and click on
 the Open.
5. Next click on the UPDATE FIRMWARE button and upload the firmware image.
Wait for the router to flash and reboot.

OEM installation using the TFTP method (need level converter):

1. Download the latest firmware image.
2. Set up a Tftp server on a PC (e.g. Tftpd32) and place the firmware
 image to the root directory of the server.
3. Power off the router and use a twisted pair cable to connect the PC
 to any of the router's LAN ports.
4. Configure the network adapter of the PC to use IP address 192.168.0.180
 and subnet mask 255.255.255.0.
5. Connect serial port (57600 8N1) and turn on the router.
6. Then interrupt "U-Boot Boot Menu" by hitting 2 key (select "2: Load
 system code then write to Flash via TFTP.").
7. Press Y key when show "Warning!! Erase Linux in Flash then burn new
 one. Are you sure? (Y/N)"
Input device IP (192.168.0.1) ==:192.168.0.1
Input server IP (192.168.0.180) ==:192.168.0.180
Input Linux Kernel filename () ==:firmware_name
The router should download the firmware via TFTP and complete flashing in
 a few minutes.
After flashing is complete, use the PC to browse to http://192.168.1.1 or
 ssh to proceed with the configuration.

Signed-off-by: Alexey Bartenev <41exey@proton.me>
2023-06-25 16:25:01 +02:00
Mathew McBride
af0546da34 layerscape: armv8_64b: add Traverse Ten64 NAND variant
The Ten64 board[1] is based around NXP's Layerscape LS1088A SoC.
It is capable of booting both standard Linux distributions
from disk devices, using EFI, and booting OpenWrt
from NAND.

See the online manual for more information, including the
flash layout[2].

This patchset adds support for generating Ten64 images
for NAND boot.
For disk boot, one can use the EFI support that was
recently added to the armvirt target.

We previously supported NAND users by building
inside our armvirt/EFI target[3], but this approach
is not suitable for OpenWrt upstream. Users who
used our supplied NAND images will be able to upgrade
to this via sysupgrade.

Signed-off-by: Mathew McBride <matt@traverse.com.au>

[1] - https://www.traverse.com.au/hardware/ten64
[2] - https://ten64doc.traverse.com.au/hardware/flash/
[3] - Example:
285e4360e1
2023-06-25 16:02:19 +02:00
Maximilian Martin
906e2a1b99 ath79: Add support for MOXA AWK-1137C
Device specifications:
======================

* Qualcomm/Atheros AR9344
* 128 MB of RAM
* 16 MB of SPI NOR flash
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4/5 GHz Wi-Fi
* 4x GPIO-LEDs (1x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* 2x fast ethernet
  - lan1
    + builtin switch port 1
    + used as WAN interface
  - lan2
    + builtin switch port 2
    + used as LAN interface
* 9-30V DC
* external antennas

Flashing instructions:
======================

Log in to https://192.168.127.253/
   Username: admin
   Password: moxa

Open Maintenance > Firmware Upgrade and install the factory image.

Serial console access:
======================

Connect a RS232-USB converter to the maintenance port.
   Pinout: (reset button left) [GND] [NC] [RX] [TX]

Firmware Recovery:
==================

When the WLAN and SYS LEDs are flashing, the device is in recovery mode.

Serial console access is required to proceed with recovery.

Download the original image from MOXA and rename it to 'awk-1137c.rom'.
Set up a TFTP server at 192.168.127.1 and connect to a lan port.

Follow the instructions on the serial console to start the recovery.

Signed-off-by: Maximilian Martin <mm@simonwunderlich.de>
2023-06-25 12:59:26 +02:00
Mikhail Zhilkin
e4fe3097ef mediatek: add support for Mercusys MR90X v1
This commit adds support for Mercusys MR90X(EU) v1 router.

Device specification
--------------------
SoC Type:   MediaTek MT7986BLA, Cortex-A53, 64-bit
RAM:        MediaTek MT7986BLA (512MB)
Flash:      SPI NAND GigaDevice GD5F1GQ5UEYIGY (128 MB)
Ethernet:   MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8)
Ethernet:   1x2.5Gbe (WAN/LAN 2.5Gbps), 3xGbE (WAN/LAN 1Gbps, LAN1, LAN2)
WLAN 2g:    MediaTek MT7975N, b/g/n/ax, MIMO 4x4
WLAN 5g:    MediaTek MT7975P(N), a/n/ac/ax, MIMO 4x4
LEDs:       1 orange and 1 green status LEDs, 4 green gpio-controlled
            LEDs on ethernet ports
Button:     1 (Reset)
USB ports:  No
Power:      12 VDC, 2 A
Connector:  Barrel
Bootloader: Main U-Boot - U-Boot 2022.01-rc4. Additionally, both UBI
            slots contain "seconduboot" (also U-Boot 2022.01-rc4)

Serial console (UART)
---------------------
                            V
+-------+-------+-------+-------+
| +3.3V |  GND  |  TX   |  RX   |
+---+---+-------+-------+-------+
    |
    +--- Don't connect

The R3 (TX line) and R6 (RX line) are absent on the PCB. You should
solder them or solder the jumpers.

Installation (UART)
-------------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
   pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
      tftpboot initramfs-kernel.bin
      bootm
4. Once inside OpenWrt, set / update env variables:
      fw_setenv baudrate 115200
      fw_setenv bootargs "ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit"
      fw_setenv fdtcontroladdr 5ffc0e70
      fw_setenv ipaddr 192.168.1.1
      fw_setenv loadaddr 0x46000000
      fw_setenv mtdids "spi-nand0=spi-nand0"
      fw_setenv mtdparts "spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)"
      fw_setenv netmask 255.255.255.0
      fw_setenv serverip 192.168.1.2
      fw_setenv stderr serial@11002000
      fw_setenv stdin serial@11002000
      fw_setenv stdout serial@11002000
      fw_setenv tp_boot_idx 0
5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image

Installation (without UART)
---------------------------
1.  Login as root via SSH (router IP, port 20001, password - your web
    interface password)
2.  Open for editing /etc/hotplug.d/iface/65-iptv (e.g., using WinSCP and
    SSH settings from the p.1)
3.  Add a newline after "#!/bin/sh":
       telnetd -l /bin/login.sh
4.  Save "65-iptv" file
5.  Toggle "IPTV/VLAN Enable" checkbox in the router web interface and
    save
6.  Make sure that telnetd is running:
       netstat -ltunp | grep 23
7.  Login via telnet to router IP, port 23 (no username and password are
    required)
8  Upload OpenWrt "initramfs-kernel.bin" to the "/tmp" folder of the
    router (e.g., using WinSCP and SSH settings from the p.1)
9.  Stock busybox doesn't contain ubiupdatevol command. Hence, we need to
    download and upload the full version of busybox to the router. For
    example, from here:
    https://github.com/xerta555/Busybox-Binaries/raw/master/busybox-arm64
    Upload busybox-arm64 to the /tmp dir of the router and run:
    in the telnet shell:
       cd /tmp
       chmod a+x busybox-arm64
10. Check "initramfs-kernel.bin" size:
       du -h initramfs-kernel.bin
11. Delete old and create new "kernel" volume with appropriate size
    (greater than "initramfs-kernel.bin" size):
       ubirmvol /dev/ubi0 -N kernel
       ubimkvol /dev/ubi0 -n 1 -N kernel -s 9MiB
12. Write OpenWrt "initramfs-kernel.bin" to the flash:
       ./busybox-arm64 ubiupdatevol /dev/ubi0_1 /tmp/initramfs-kernel.bin
13. u-boot-env can be empty so lets create it (or overwrite it if it
    already exists) with the necessary values:
       fw_setenv baudrate 115200
       fw_setenv bootargs "ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit"
       fw_setenv fdtcontroladdr 5ffc0e70
       fw_setenv ipaddr 192.168.1.1
       fw_setenv loadaddr 0x46000000
       fw_setenv mtdids "spi-nand0=spi-nand0"
       fw_setenv mtdparts "spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)"
       fw_setenv netmask 255.255.255.0
       fw_setenv serverip 192.168.1.2
       fw_setenv stderr serial@11002000
       fw_setenv stdin serial@11002000
       fw_setenv stdout serial@11002000
       fw_setenv tp_boot_idx 0
14. Reboot to OpenWrt initramfs:
       reboot
15. Login as root via SSH (IP 192.168.1.1, port 22)
16. Upload OpenWrt sysupgrade.bin image to the /tmp dir of the router
17. Run sysupgrade:
       sysupgrade -n /tmp/sysupgrade.bin

Recovery
--------
1. Press Reset button and power on the router
2. Navigate to U-Boot recovery web server (http://192.168.1.1/) and
   upload the OEM firmware

Recovery (UART)
---------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
   pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
      tftpboot initramfs-kernel.bin
      bootm
4. Do what you need (restore partitions from a backup, install OpenWrt
   etc.)

Stock layout
------------
0x000000000000-0x000000200000 : "boot"
0x000000200000-0x000000300000 : "u-boot-env"
0x000000300000-0x000003500000 : "ubi0"
0x000003500000-0x000006700000 : "ubi1"
0x000006700000-0x000006f00000 : "userconfig"
0x000006f00000-0x000007300000 : "tp_data"

ubi0/ubi1 format
----------------
U-Boot at boot checks that all volumes are in place:
+-------------------------------+
| Volume Name: uboot   Vol ID: 0|
| Volume Name: kernel  Vol ID: 1|
| Volume Name: rootfs  Vol ID: 2|
+-------------------------------+

MAC addresses
-------------
+---------+-------------------+-----------+
|         | MAC               | Algorithm |
+---------+-------------------+-----------+
| label   | 00:eb:xx:xx:xx:be | label     |
| LAN     | 00:eb:xx:xx:xx:be | label     |
| WAN     | 00:eb:xx:xx:xx:bf | label+1   |
| WLAN 2g | 00:eb:xx:xx:xx:be | label     |
| WLAN 5g | 00:eb:xx:xx:xx:bd | label-1   |
+---------+-------------------+-----------+
label MAC address was found in UBI partition "tp_data", file
"default-mac". OEM wireless eeprom is also there (file
"MT7986_EEPROM.bin").

Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2023-06-25 12:25:22 +02:00
David Bauer
1b467a902e ath79: add support for Aruba AP-115
Hardware
========

CPU   Qualcomm Atheros QCA9558
RAM   256MB DDR2
FLASH 2x 16M SPI-NOR (Macronix MX25L12805D)
WIFI  Qualcomm Atheros QCA9558
      Atheros AR9590

Installation
============

1. Attach to the serial console of the AP-105.
   Interrupt autoboot and change the U-Boot env.

   $ setenv rb_openwrt "setenv ipaddr 192.168.1.1;
     setenv serverip 192.168.1.66;
     netget 0x80060000 ap115.bin; go 0x80060000"
   $ setenv fb_openwrt "bank 1;
     cp.b 0xbf100040 0x80060000 0x10000; go 0x80060000"
   $ setenv bootcmd "run fb_openwrt"
   $ saveenv

2. Load the OpenWrt initramfs image on the device using TFTP.
   Place the initramfs image as "ap105.bin" in the TFTP server
   root directory, connect it to the AP and make the server reachable
   at 192.168.1.66/24.

   $ run rb_openwrt

3. Once OpenWrt booted, transfer the sysupgrade image to the device
   using scp and use sysupgrade to install the firmware.

Signed-off-by: David Bauer <mail@david-bauer.net>
2023-06-23 00:20:56 +02:00
Flole Systems
984786a2f7 filogic: add support for Netgear WAX220
Hardware
--------
SOC:   MediaTek MT7986
RAM:   1024MB DDR3
FLASH: 128MB SPI-NAND (Winbond)
WIFI:  Mediatek MT7986 DBDC 802.11ax 2.4/5 GHz
ETH:   Realtek RTL8221B-VB-CG 2.5 N-Base-T PHY with PoE
UART:  3V3 115200 8N1 (Pinout silkscreened / Do not connect VCC)

Installation
------------

1. Download the OpenWrt initramfs image. Copy the image to a TFTP server
2. Connect the TFTP server to the WAX220. Conect to the serial console,
   interrupt the autoboot process by pressing '0' when prompted.
3. Download & Boot the OpenWrt initramfs image.

   $ setenv ipaddr 192.168.2.1
   $ setenv serverip 192.168.2.2
   $ tftpboot openwrt.bin
   $ bootm

4. Wait for OpenWrt to boot. Transfer the sysupgrade image to the device
   using scp and install using sysupgrade.

   $ sysupgrade -n <path-to-sysupgrade.bin>

Signed-off-by: Flole Systems <flole@flole.de>
Signed-off-by: Stefan Agner <stefan@agner.ch>
2023-06-21 23:32:26 +02:00
Robert Marko
83314c13d0
qualcommax: move ipq807x support to subtarget
Now that qualcommax exists as a target and dependencies have been updated
let move ipq807x support to subtarget of qualcommax.

This is mostly copy/paste with the exception of having to update SSDK and
NSS-DP to use CONFIG_TARGET_SUBTARGET.

This is a preparation for later addition of IPQ60xx and IPQ50xx support.

Signed-off-by: Robert Marko <robimarko@gmail.com>
2023-06-16 11:11:09 +02:00
Robert Marko
f02f6aaa8d
ipq807x: rename target to qualcommax
Currently, ipq807x only covers Qualcomm IPQ807x SoC-s.
However, Qualcomm also has IPQ60xx and IPQ50xx SoC-s under the AX WiSoC-s
and they share a lot of stuff with IPQ807x, especially IPQ60xx so to avoid
duplicating kernel patches and everything lets make a common target with
per SoC subtargets.

Start doing that by renaming ipq807x to qualcommax so that dependencies
on ipq807x target can be updated.

Signed-off-by: Robert Marko <robimarko@gmail.com>
2023-06-16 11:11:08 +02:00
Maximilian Weinmann
8fcfb21b16 ramips: Add support for Beeline SmartBox TURBO+
This adds support for Beeline Smart Box TURBO+ (Serсomm S3 CQR) router.

Device specification
--------------------
SoC Type: MediaTek MT7621AT (880 MHz, 2 cores)
RAM (Nanya NT5CC64M16GP): 128 MiB
Flash (Macronix MX30LF1G18AC): 128 MiB
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7615N): a/n/ac, 4x4
Ethernet: 5 ports - 5×GbE (WAN, LAN1-4)
USB ports: 1xUSB3.0
Buttons: 2 button (reset, wps)
LEDs: Red, Green, Blue
Zigbee (EFR32MG1B232GG): 3.0
Stock bootloader: U-Boot 1.1.3
Power: 12 VDC, 1.5 A

Installation (fw 2.0.9)
-----------------------
1.  Login to the web interface under SuperUser (root) credentials.
    Password: SDXXXXXXXXXX, where SDXXXXXXXXXX is serial number of the
    device written on the backplate stick.
2.  Navigate to Setting -> WAN. Add:
       Name - WAN1
       Connection Type - Static
       IP Address - 172.16.0.1
       Netmask - 255.255.255.0
    Save -> Apply. Set default: WAN1
3.  Enable SSH and HTTP on WAN. Setting -> Remote control. Add:
       Protocol - SSH
       Port - 22
       IP Address - 172.16.0.1
       Netmask - 255.255.255.0
       WAN Interface - WAN1
    Save ->Apply
    Add:
       Protocol - HTTP
       Port - 80
       IP Address - 172.16.0.1
       Netmask - 255.255.255.0
       WAN interface - WAN1
    Save -> Apply
4.  Set up your PC ethernet:
       Connection Type - Static
       IP Address - 172.16.0.2
       Netmask - 255.255.255.0
       Gateway - 172.16.0.1
5.  Connect PC using ethernet cable to the WAN port of the router
6.  Connect to the router using SSH shell under SuperUser account
7.  Make a mtd backup (optional, see related section)
8.  Change bootflag to Sercomm1 and reboot:
        printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
        reboot
9.  Login to the router web interface under admin account
10. Remove dots from the OpenWrt factory image filename
11. Update firmware via web using OpenWrt factory image

Revert to stock
---------------
Change bootflag to Sercomm1 in OpenWrt CLI and then reboot:
   printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3

mtd backup
----------
1. Set up a tftp server (e.g. tftpd64 for windows)
2. Connect to a router using SSH shell and run the following commands:
      cd /tmp
      for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \
      tftp -l mtd$i -p 172.16.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done
      tftp -l mtd.md5 -p 171.16.0.2

Recovery
--------
Use sercomm-recovery tool.
Link: https://github.com/danitool/sercomm-recovery

MAC Addresses (fw 2.0.9)
------------------------
+-----+------------+---------+
| use | address    | example |
+-----+------------+---------+
| LAN | label      | *:e8    |
| WAN | label + 1  | *:e9    |
| 2g  | label + 4  | *:ec    |
| 5g  | label + 5  | *:ed    |
+-----+------------+---------+
The label MAC address was found in Factory 0x21000

Factory image format
--------------------
+---+-------------------+-------------+--------------------+
| # | Offset            | Size        | Description        |
+---+-------------------+-------------+--------------------+
| 1 | 0x0               | 0x200       | Tag Header Factory |
| 2 | 0x200             | 0x100       | Tag Header Kernel1 |
| 3 | 0x300             | 0x100       | Tag Header Kernel2 |
| 4 | 0x400             | SIZE_KERNEL | Kernel             |
| 5 | 0x400+SIZE_KERNEL | SIZE_ROOTFS | RootFS(UBI)        |
+---+-------------------+-------------+--------------------+

Co-authored-by: Mikhail Zhilkin <csharper2005@gmail.com>
Signed-off-by: Maximilian Weinmann <x1@disroot.org>
2023-06-11 13:36:38 +08:00
Petr Štetiar
2e910039dd
ipq807x: add initial support for prpl Foundation Haze board
Haze is prpl Foundation's reference board (WNC LVRP).

Board info:

 - IPQ8072A SoC
 - 2 GiB RAM
 - 4 GiB eMMC
 - 8MiB SPI NOR (MX25U6435F)

 - 3x 1GigE ports (QCA8075)
 - 1x 10GigE port (AQR113C)
 - 1x SFP cage

 - WiFi 6GHz 160MHz (QCN9074)
 - WiFi 5GHz 80+80MHz (QCN5054)
 - WiFi 2.4G (QCN5024)

 - ARM Standard 20-pin 2.54mm/0.1" JTAG (1V8 !!!)
 - Bluetooth v5.0 + EDR with integrated Class 1 PA (CYW20704)
 - 1x M.2 B-key socket with PCIe 3.0
 - 1x USB 3.0 port
 - UART marked J6 is 4-pin 2.54mm/0.1" connector 3V3(arrow),RX,TX,GND (115200 8N1)
 - Reset and WPS buttons

Flashing instructions:

 1. From U-Boot boot OpenWrt using initramfs image:

    IPQ807x# tftpboot openwrt-ipq807x-generic-prpl_haze-initramfs-uImage.itb && bootm

 2. In OpenWrt running from initramfs execute sysupgrade:

    root@OpenWrt:/# sysupgrade -n /tmp/openwrt-ipq807x-generic-prpl_haze-squashfs-sysupgrade.bin

Work in progress/known issues:

 * SFP feature not implemented/tested
 * M.2 feature not implemented/tested
 * Bluetooth feature not implemented/tested
 * 6GHz wireless should be working, but not tested
 * MAC address assigments for LAN interfaces

Signed-off-by: Petr Štetiar <ynezz@true.cz>
2023-06-10 21:29:07 +02:00
Jianhui Zhao
6892603efa uboot-envtools: Add u-boot env config for GL-MT3000
This commit add u-boot env config for GL-MT3000, so
that we can use fw_printenv to print u-boot env and
use fw_setenv to set u-boot env in GL-MT3000.

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
2023-06-09 22:28:45 +02:00
Petr Štetiar
a3ee2bf9a1
Revert "ipq807x: add initial support for prpl Foundation Haze board"
This reverts commit 48603a271e as this
was commited by accident, its still work in progress.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
2023-06-05 11:46:47 +02:00
Petr Štetiar
48603a271e
ipq807x: add initial support for prpl Foundation Haze board
Haze is prpl Foundation's reference board (WNC LVRP).

Board info:

 - IPQ8072A SoC
 - 2 GiB RAM
 - 4 GiB eMMC
 - 8MiB SPI NOR (MX25U6435F)

 - 3x 1GigE ports (QCA8075)
 - 1x 10GigE port (AQR113C)
 - 1x SFP cage

 - WiFi 6GHz 160MHz (QCN9074)
 - WiFi 5GHz 80+80MHz (QCN5054)
 - WiFi 2.4G (QCN5024)

 - ARM Standard 20-pin 2.54mm/0.1" JTAG (1V8 !!!)
 - Bluetooth v5.0 + EDR with integrated Class 1 PA (CYW20704)
 - 1x M.2 B-key socket with PCIe 3.0
 - 1x USB 3.0 port
 - UART 4-pin 3V3(arrow),RX,TX,GND (115200 8N1)
 - Reset and WPS buttons

Flashing instructions:

 1. From U-Boot boot OpenWrt using initramfs image:

    IPQ807x# tftpboot openwrt-ipq807x-generic-prpl_haze-initramfs-uImage.itb && bootm

 2. In OpenWrt running from initramfs execute sysupgrade:

    root@OpenWrt:/# sysupgrade -n /tmp/openwrt-ipq807x-generic-prpl_haze-squashfs-sysupgrade.bin

Work in progress/known issues:

 * SFP feature not implemented/tested
 * M.2 feature not implemented/tested
 * Bluetooth feature not implemented/tested
 * 6GHz wireless should be working, but not tested
 * MAC address assigments for LAN interfaces

Signed-off-by: Petr Štetiar <ynezz@true.cz>
2023-06-05 08:31:43 +02:00
Chukun Pan
c51eb17730 uboot-mediatek: add Qihoo 360T7 support
The vendor uboot will verify firmware at boot.
So add a custom uboot build for this device.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
2023-05-27 11:17:08 +01:00
Antti Nykänen
07c45c0859 ipq807x: add support for Compex WPQ873
The Compex WPQ873 is a development board with two M.2 B-key
 slots for cellular modems.

Device info:
 - IPQ8072A SoC
 - 512MiB RAM
 - 256MiB NAND flash
 - 8MiB SPI NOR
 - 3x 1GigE ports
 - 1x 2.5GigE port
 - 2.4GHz/5GHz AX WLAN
 - 1x USB 3.0 port
 - 1x M.2 B-key socket with PCIe 3.0
 - 1x M.2 B-key socket with PCIe 2.0 and USB 3.0
 - 4x SIM card slots
 - Bluetooth LE 5.0 (QCA4024)

Prerequisites
1) TFTP server
2) 3.3V USB to TTL cable for UART console
   2.54mm pitch 4-pin header for UART is readily provided on board, no modifications are necessary to access it
   TTL connector pinout: 2=TX, 3=RX, 4=GND
   Arrow marks pin 1 which is 3.3V
   Serial port settings: 115200 8N1 no flow control

The device will most likely ship with a QSDK-based firmware.

1. Power on device and interrupt u-boot to obtain u-boot CLI

2. set serverip to IP address of the TFTP server, for example:

        `setenv serverip 192.168.1.10`

3. Download image from TFTP server:

        `tftpboot 0x44000000 openwrt-ipq807x-generic-compex_wpq873-squashfs-factory.ubi`

4. Flash ubi image to both partitions and reset:

        `sf probe
         imxtract 0x44000000 ubi
         nand device 0
         nand erase 0x0 0x3400000
         nand erase 0x3c00000 0x3400000
         nand write $fileaddr 0x0 $filesize
         nand write $fileaddr 0x3c00000 $filesize
         reset`

Afterwards, you can use sysupgrade to flash new OpenWRT images.

Signed-off-by: Antti Nykänen <antti.nykanen@nokia.com>
2023-05-26 13:05:02 +03:00
Pietro Ameruoso
1c05388ab0 mediatek: add support for Zyxel EX5601-T0 router
Zyxel EX5601-T0 specifics
--------------
The operator specific firmware running on the Zyxel branded
EX5601-T0 includes  U-Boot modifications affecting the OpenWrt
installation.

Partition Table
| dev  | size     | erasesize | name          |
| ---- | -------- | --------- | ------------- |
| mtd0 | 20000000 | 00040000  | "spi0.1"      |
| mtd1 | 00100000 | 00040000  | "BL2"         |
| mtd2 | 00080000 | 00040000  | "u-boot-env"  |
| mtd3 | 00200000 | 00040000  | "Factory"     |
| mtd4 | 001c0000 | 00040000  | "FIP"         |
| mtd5 | 00040000 | 00040000  | "zloader"     |
| mtd6 | 04000000 | 00040000  | "ubi"         |
| mtd7 | 04000000 | 00040000  | "ubi2"        |
| mtd8 | 15a80000 | 00040000  | "zyubi"       |

The router boots BL2 which than loads FIP (u-boot).
U-boot has hardcoded a command to always launch Zloader "mtd read zloader 0x46000000" and than "bootm". Bootargs are deactivated.
Zloader is the zyxel booloader which allow to dual-boot ubi or ubi2, by default access to zloader is blocked.
Too zloader checks that the firmware contains a particolar file called zyfwinfo.
Additional details regarding Zloader can be found here:
https://hack-gpon.github.io/zyxel/
https://forum.openwrt.org/t/adding-openwrt-support-for-zyxel-ex5601-t0/155914

Hardware
--------
SOC: MediaTek MT7986a
CPU: 4 core cortex-a53 (2000MHz)
RAM: 1GB DDR4
FLASH: 512MB SPI-NAND (Micron xxx)
WIFI: Wifi6 Mediatek MT7976 802.11ax 5 GHz 4x4 + 2.4GHZ 4x4
ETH: MediaTek MT7531 Switch + SoC
3 x builtin 1G phy (lan1, lan2, lan3)
1 x MaxLinear GPY211B 2.5 N-Base-T phy5 (lan4)
1 x MaxLinear GPY211B 2.5Gbit xor SFP/N-Base-T phy6 (wan)
USB: 1 x USB 3.2 Enhanced SuperSpeed port
UART: 3V3 115200 8N1 (Pinout: GND KEY RX TX VCC)
VOIP: 2 FXS ports for analog phones

MAC Address Table
-----------------
eth0/lan    Factory 0x002a
eth1/wan    Factory 0x0024
wifi 2.4Ghz Factory 0x0004
wifi 5Ghz   Factory 0x0004 + 1

Serial console (UART)
---------------------
+-------+-------+-------+-------+-------+
| +3.3V |  RX   |  TX   |  KEY  |  GND  |
+---+---+-------+-------+-------+-------+
    |
    +--- Don't connect

Installation
------------
Keep in mind that openwrt can only run on the UBI partition, the openwrt firmware is not able to understand the zloader bootargs.
The procedure allows restoring the UBI partition with the Zyxel firmware and retains all the OEM functionalities.

1. Unlock Zloader (this will allow to swap manually between partitions UBI and UBI2):
- Attach a usb-ttl adapter to your computer and boot the router.
- While the router is booting at some point you will read the following: `Please press Enter to activate this console.`
- As soon as you read that press enter, type root and than press enter again (just do it, don't care about the logs scrolling).
- Most likely the router is still printing the boot log, leave it boot until it stops.
- If everything went ok you should have full root access "root@EX5601-T0:/#".
- Type the following command and press enter: "fw_setenv EngDebugFlag 0x1".
- Reboot the router.
- As soon as you read `Hit any key to stop autoboot:` press Enter.
- If everything went ok you should have the following prompt: "ZHAL>".
- You have successfully unlocked zloader access, this procedure must be done only once.

2. Check the current active partition:
- Boot the router and repeat the steps above to gain root access.
- Type the following command to check the current active image: "cat /proc/cmdline".
- If `rootubi=ubi` it means that the active partition is `mtd6`
- If `rootubi=ubi2` it means that the active partition is `mtd7`
- As mentioned earlier we need to flash openwrt into ubi/mtd6 and never overwrite ubi2/mtd7 to be able to fully roll-back.
- To activate and boot from mtd7 (ubi2) enter into ZHAL> command prompt and type the following commands:
atbt 1  # unlock write
atsw    # swap boot partition
atsr    # reboot the router
- After rebooting check again with "cat /proc/cmdline" that you are correctly booting from mtd7/ubi2
- If yes proceed with the installation guide. If not probably you don't have a firmware into ubi2 or you did something wrong.

3. Flashing:
- Download the sysupgrade file for the router from openwrt, than we need to add the zyfwinfo file into the sysupgrade tar.
Zloader only checks for the magic (which is a fixed value 'EXYZ') and the crc of the file itself (256bytes).
I created a script to create a valid zyfwinfo file but you can use anything that does exactly the same:
https://raw.githubusercontent.com/pameruoso/OpenWRT-Zyxel-EX5601-T0/main/gen_zyfwinfo.sh
- Add the zyfwinfo file into the sysupgrade tar.
- Enter via telnet or ssh into the router with admin credentials
- Enter the following commands to disable the firmware and model checks
"zycli fwidcheck off" and "zycli modelcheck off"
- Open the router web interface and in the update firmware page select the "restore default settings option"
- Select the sysupgrade file and click on upload.
- The router will flash and reboot itself into openwrt from UBI

4. Restoring and going back to Zyxel firmware.
- Use the ZHAL> command line to manually swap the boot parition to UBI2 with the following:
atbt 1  # unlock write
atsw    # swap boot partition
atsr    # reboot the router
- You will boot again the Zyxel firmware you have into UBI2 and you can flash the zyxel firmware to overwrite the UBI partition and openwrt.

Working features
----------------
3 gbit lan ports
Wifi
Zyxel partitioning for coexistance with Zloader and dual boot.
WAN SFP port (only after exporting pins 57 and 10. gpiobase411)
leds
reset button
serial interface
usb port
lan ethernet 2.5 gbit port (autosense)
wan ethernet 2.5 gbit port (autosense)

Not working
----------------
voip (missing drivers or proper zyxel platform software)

Swapping the wan ethernet/sfp xor port
----------------
The way to swap the wan port between sfp and ethernet is the following:
export the pins 57 and 10.
Pin 57 is used to probe if an sfp is present.
If pin 57 value is 0 it means that an sfp is present into the cage (cat /sys/class/gpio/gpio468/value).
If pin 57 value is 1 it means that no sfp is inserted into the cage.
In conclusion by default both 57 an 10 pins are by default 1, which means that the active port is the ethernet one.
After inserting an SFP pin 57 will become 0 and you have to manually change the value of pin 10 to 0 too.
This is totally scriptable of course.

Leds description
------------
All the leds are working out of the box but the leds managed by the 2 maxlinear phy (phy 5 lan, phy6 wan).
To activate the phy5 led (rj45 ethernet port led on the back of the router) you have to use mdio-tools.
To activate the phy6 led (led on the front of the router for 2.5gbit link) you have to use mdio-tools.
Example:
Set lan5 led to fast blink on 2500/1000, slow blink on 10/100:
mdio mdio-bus mmd 5:30 raw 0x0001 0x33FC

Set wan 2.5gbit led to constant on when wan is 2.5gbit:
mdio mdio-bus mmd 6:30 raw 0x0001 0x0080

Signed-off-by: Pietro Ameruoso <p.ameruoso@live.it>
2023-05-22 17:58:59 +02:00
Shiji Yang
0ffbef9317 ath79: add support for D-Link DIR-859 A3
Specifications:
  SOC:      QCA9563 775 MHz + QCA9880
  Switch:   QCA8337N-AL3C
  RAM:      Winbond W9751G6KB-25 64 MiB
  Flash:    Winbond W25Q128FVSG 16 MiB
  WLAN:     Wi-Fi4 2.4 GHz 3*3 + 5 GHz 3*3
  LAN:      LAN ports *4
  WAN:      WAN port *1
  Buttons:  reset *1 + wps *1
  LEDs: ethernet *5, power, wlan, wps

MAC Address:
  use      address               source1          source2
  label    40:9b:xx:xx:xx:3c     lan && wlan      u-boot,env@ethaddr
  lan      40:9b:xx:xx:xx:3c     devdata@0x3f     $label
  wan      40:9b:xx:xx:xx:3f     devdata@0x8f     $label + 3
  wlan2g   40:9b:xx:xx:xx:3c     devdata@0x5b     $label
  wlan5g   40:9b:xx:xx:xx:3e     devdata@0x76     $label + 2

Install via Web UI:
  Apply factory image in the stock firmware's Web UI.

Install via Emergency Room Mode:
  DIR-859 A1 will enter recovery mode when the system fails to boot
  or press reset button for about 10 seconds.

  First, set computer IP to 192.168.0.5 and Gateway to 192.168.0.1.
  Then we can open http://192.168.0.1 in the web browser to upload
  OpenWrt factory image or stock firmware. Some modern browsers may
  need to turn on compatibility mode.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2023-05-22 14:45:03 +02:00
Shiji Yang
e5d8739aa8 ath79: improve support for D-Link DIR-8x9 A1 series
1. Remove unnecessary new lines in the dts.
2. Remove duplicate included file "gpio.h" in the device dts.
3. Add missing button labels "reset" and "wps".
4. Unify the format of the reg properties.
5. Add u-boot environment support.
6. Reduce spi clock frequency since the max value suggested by the
   chip datasheet is only 25 MHz.
7. Add seama header fixup for DIR-859 A1. Without this header fixup,
   u-boot checksum for kernel will fail after the first boot.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
2023-05-22 14:45:03 +02:00
Christoph Krapp
e882af2850 ramips: add support for Linksys RE7000
Hardware specification:

- SoC: MediaTek MT7621AT (880 MHz)
- Flash: 16 MB (Macronix MX25L12835FM2I-10G)
- RAM: 128 MB (Nanya NT5CC64M16GP-DI)
- WLAN 2.4 GHz: 2x2 MediaTek MT7603EN
- WLAN 5 GHz: 2x2 MediaTek MT7615N
- Ethernet: 1x 10/100/1000 Mbps
- LED: Power, Wifi, WPS
- Button: Reset, WPS
- UART: 1:VCC, 2:GND, 3:TX, 4:RX (from LAN port)
  Serial console @ 57600,8n1

Flash instructions:

Connect to serial console and start up the device. As the bootloader got
locked you need to type in a password to unlock U-Boot access.
When you see the following output on the console:

relocate_code Pointer at: 87f1c000

type in the super secure password:

1234567890

Then select TFTP boot from RAM by selecting option 1 in the boot menu.
As Linksys decided to leave out a basic TFTP configuration you need to
set server- & client ip as well as the image filename the device will
search for. You need to use the initramfs openwrt image for the TFTP
boot process.

Once openwrt has booted up, upload the sysupgrade image via scp and run
sysupgrade as normal.

Signed-off-by: Christoph Krapp <achterin@gmail.com>
2023-05-09 11:52:53 +02:00
Maximilian Weinmann
ecdb24814f ramips: add support for SNR-CPE-ME1
SNR-CPE-ME1 is a wireless WiFi 5 router manufactured by SNR/NAG company.

Specification:
    - SoC           : MediaTek MT7621A
    - RAM           : DDR3 256 MiB
    - Flash         : SPI-NOR 16 MiB (GD25Q128CSIG)
    - WLAN          : 2.4 GHz (MediaTek MT7603EN)
                      5 GHz (MediaTek MT7610EN)
    - Ethernet      : 10/100/1000 Mbps x5
      - Switch      : MediaTek MT7530 (in SoC)
    - USB           : 3.0 x1
    - UART          : through-hole on PCB
      - [J4] 3.3V, RX, TX, GND (57600n8)
    - Power         : 12 VDC, 2 A

Flash instruction via TFTP:
    1. Boot SNR-CPE-ME1 to recovery mode
        (hold the reset button while power on)
    2. Send firmware via TFTP client:
       TFTP Server address: 192.168.1.1
       TFTP Client address: 192.168.1.131
    3. Wait ~120 seconds to complete flashing
    4. Do sysupgrade using web-interface

Signed-off-by: Maximilian Weinmann <x1@disroot.org>
2023-05-07 14:44:54 +02:00
Andreas Böhler
28df7f7ff2 ramips: mt7621: add support for ZyXEL WSM20
The ZyXEL WSM20 aka Multy M1 is a cheap mesh router system by ZyXEL
based on the MT7621 CPU.

Specifications
==============

SoC: MediaTek MT7621AT (880MHz)
RAM: 256MiB
Flash: 128MiB NAND
Wireless: 802.11ax (2x2 MT7915E DBDC)
Ethernet: 4x 10/100/1000 (MT7530)
Button: 1x WPS, 1x Reset, 1x LED On/Off
LED: 7 LEDs (3x white, 2x red, 2x green)

MAC address assignment
======================

The MAC address assignment follows stock: The label MAC address is the LAN
MAC address, the WAN address is read from flash.

The WiFi MAC addresses are set in userspace to label MAC + 1 and label MAC
+ 2.

Installation (web interface)
============================

The device is cloud-managed, but there is a hidden local firmware upgrade
page in the OEM web interface. The device has to be registered in the
cloud in order to be able to access this page.

The system has a dual firmware design, there is no way to tell which
firmware is currently booted. Therefore, an -initramfs version is flashed
first.

1. Log into the OEM web GUI
2. Access the hidden upgrade page by navigating to
   https://192.168.212.1/gui/#/main/debug/firmwareupgrade
3. Upload the -initramfs-kernel.bin file and flash it
4. Wait for OpenWrt to boot and log in via SSH
5. Transfer the sysupgrade file via SCP
6. Run sysupgrade to install the image
7. Reboot and enjoy

NB: If the initramfs version was installed in RAS2, the sysupgrade script
sets the boot number to the first partition. A backup has to be performed
manually in case the OEM firwmare should be kept.

Installation (UART method)
==========================

The UART method is more difficult, as the boot loader does not have a
timeout set. A semi-working stock firmware is required to configure it:

1. Attach UART
2. Boot the stock firmware until the message about failsafe mode appears
3. Enter failsafe mode by pressing "f" and "Enter"
4. Type "mount_root"
5. Run "fw_setenv bootmenu_delay 3"
6. Reboot, U-Boot now presents a menu
7. The -initramfs-kernel.bin image can be flashed using the menu
8. Run the regular sysupgrade for a permanent installation

Changing the partition to boot is a bit cumbersome in U-Boot, as there is
no menu to select it. It can only be checked using mstc_bootnum. To change
it, issue the following commands in U-Boot:

   nand read 1800000 53c0000 800
   mw.b 1800004 1 1
   nand erase 53c0000 800
   nand write 1800000 53c0000 800

This selects FW1. Replace "mw.b 1800004 1 1" by "mw.b 1800004 2 1" to
change to the second slot.

Back to stock
=============

It is possible to flash back to stock, but a OEM firmware upgrade is
required. ZyXEL does not provide the link on its website, but the link
can be acquired from the OEM web GUI by analyzing the transferred JSON
objects.

It is then a matter of writing the firmware to Kernel2 and setting the
boot partition to FW2:

   mtd write zyxel.bin Kernel2
   echo -ne "\x02" | dd of=/dev/mtdblock7 count=1 bs=1 seek=4 conv=notrunc

Signed-off-by: Andreas Böhler <dev@aboehler.at>
Credits to forum users Annick and SirLouen for their initial work on this
device
2023-04-29 21:53:34 +02:00
Andreas Böhler
097f350aeb ath79: add support for Alcatel HH40V
The Alcatel HH40V is a CAT4 LTE router used by various ISPs.

Specifications
==============

SoC: QCA9531 650MHz
RAM: 128MiB
Flash: 32MiB SPI NOR
LAN: 1x 10/100MBit
WAN: 1x 10/100MBit
LTE: MDM9607 USB 2.0 (rndis configuration)
WiFi: 802.11n (SoC integrated)

MAC address assignment
======================

There are three MAC addresses stored in the flash ROM, the assignment
follows stock. The MAC on the label is the WiFi MAC address.

Installation (TFTP)
===================

1. Connect serial console
2. Configure static IP to 192.168.1.112
3. Put OpenWrt factory.bin file as firmware-system.bin
4. Press Power + WPS and plug in power
5. Keep buttons pressed until TFTP requests are visible
6. Wait for the system to finish flashing and wait for reboot
7. Bootup will fail as the kernel offset is wrong
8. Run "setenv bootcmd bootm 0x9f150000"
9. Reset board and enjoy OpenWrt

Installation (without UART)
===========================

Installation without UART is a bit tricky and requires several steps too
long for the commit message. Basic steps:

1. Create configure backup
2. Patch backup file to enable SSH
3. Login via SSH and configure the new bootcmd
3. Flash OpenWrt factory.bin image manually (sysupgrade doesn't work)

More detailed instructions will be provided on the Wiki page.

Tested by: Christian Heuff <christian@heuff.at>
Signed-off-by: Andreas Böhler <dev@aboehler.at>
2023-04-23 19:32:18 +02:00
Daniel Golle
cc00e22029 uboot-mediatek: add TP-Link TL-XDR4288 and TL-XDR608x
TP-Link TL-XDR608x comes with locked vendor loader. Add U-Boot build
for replacement loader for both TL-XDR6086 and TL-XDR6088. The only
difference at U-Boot level is the different filename requested via
TFTP, matching the corresponding OpenWrt build artifacts for each
device.

The TP-Link TL-XDR4288 has the same hardware as the TP-Link TL-XDR6088
except for the wireless part. Also create a uboot for the TP-Link
TL-XDR4288.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
[rebase to uboot 23.04, correct led and button]
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
2023-04-22 04:10:19 +01:00
David Bauer
765f66810a mpc85xx: add support for Enterasys WS-AP3715i
Hardware
--------

SoC:   NXP P1010 (1x e500 @ 800MHz)
RAM:   256M DDR3 (2x Samsung K4B1G1646G-BCH9)
FLASH: 32M NOR (Spansion S25FL256S)
BTN:   1x Reset
WiFi:  1x Atheros AR9590 2.4 bgn 3x3
       2x Atheros AR9590 5.0 an 3x3
ETH:   2x Gigabit Ethernet (Atheros AR8033 / AR8035)
UART:  115200 8N1 (RJ-45 Cisco)

Installation
------------
1. Grab the OpenWrt initramfs, rename it to ap3715.bin. Place it in
   the root directory of a TFTP server and serve it at
   192.168.1.66/24.

2. Connect to the serial port and boot the AP. Stop autoboot in U-Boot
   by pressing Enter when prompted. Credentials are identical to the one
   in the APs interface. By default it is admin / new2day.

3. Alter the bootcmd in U-Boot:

 $ setenv ramboot_openwrt "setenv ipaddr 192.168.1.1;
   setenv serverip 192.168.1.66; tftpboot 0x2000000 ap3715.bin; bootm"

 $ setenv boot_openwrt "sf probe 0; sf read 0x2000000 0x140000 0x1000000;
   bootm 0x2000000"

 $ setenv bootcmd "run boot_openwrt"

 $ saveenv

4. Boot the initramfs image

 $ run ramboot_openwrt

5. Transfer the OpenWrt sysupgrade image to the AP using SCP. Install
   using sysupgrade.

 $ sysupgrade -n <path-to-sysupgrade.bin>

Signed-off-by: David Bauer <mail@david-bauer.net>
2023-04-08 14:41:01 +02:00
Alexey Bartenev
dc79b51533 ramips: add support for Keenetic Lite III rev. A
General specification:
SoC Type: MediaTek MT7620N (580MHz)
ROM: 8 MB SPI-NOR (W25Q64FV)
RAM: 64 MB DDR (EM6AB160TSD-5G)
Switch: MediaTek MT7530
Ethernet: 5 ports - 5×100MbE (WAN, LAN1-4)
Wireless: 2.4 GHz (MediaTek RT5390): b/g/n
Buttons: 3 button (POWER, RESET, WPS)
Slide switch: 4 position (BASE, ADAPTER, BOOSTER, ACCESS POINT)
Bootloader: U-Boot 1.1.3
Power: 9 VDC, 0.6 A

MAC in stock:
|-	+			|
| LAN 	| RF-EEPROM + 0x04	|
| WLAN	| RF-EEPROM + 0x04	|
| WAN 	| RF-EEPROM + 0x28	|

OEM easy installation
1. Use a PC to browse to http://my.keenetic.net.
2. Go to the System section and open the Files tab.
3. Under the Files tab, there will be a list of system
files. Click on the Firmware file.
4. When a modal window appears, click on the Choose File
button and upload the firmware image.
5. Wait for the router to flash and reboot.

OEM installation using the TFTP method
1. Download the latest firmware image and rename it to
klite3_recovery.bin.
2. Set up a Tftp server on a PC (e.g. Tftpd32) and place the
firmware image to the root directory of the server.
3. Power off the router and use a twisted pair cable to connect
the PC to any of the router's LAN ports.
4. Configure the network adapter of the PC to use IP address
192.168.1.2 and subnet mask 255.255.255.0.
5. Power up the router while holding the reset button pressed.
6. Wait approximately for 5 seconds and then release the
reset button.
7. The router should download the firmware via TFTP and
complete flashing in a few minutes.
After flashing is complete, use the PC to browse to
http://192.168.1.1 or ssh to proceed with the configuration.

Signed-off-by: Alexey Bartenev <41exey@proton.me>
2023-03-27 02:09:58 +02:00
Martin Kennedy
12f52336d2 ath79: Add Aruba AP-175 support
This board is very similar to the Aruba AP-105, but is
outdoor-first. It is very similar to the MSR2000 (though certain
MSR2000 models have a different PHY[^1]).

A U-Boot replacement is required to install OpenWrt on these
devices[^2].

Specifications
--------------
* Device:	Aruba AP-175
* SoC:		Atheros AR7161 680 MHz MIPS
* RAM:		128MB - 2x Mira P3S12D40ETP
* Flash:	16MB MXIC MX25L12845EMI-10G (SPI-NOR)
* WiFi:		2 x DNMA-H92 Atheros AR9220-AC1A 802.11abgn
* ETH:		IC+ IP1001 Gigabit + PoE PHY
* LED:		2x int., plus 12 ext. on TCA6416 GPIO expander
* Console:	CP210X linking USB-A Port to CPU console @ 115200
* RTC:		DS1374C, with internal battery
* Temp:		LM75 temperature sensor

Factory installation:

- Needs a u-boot replacement. The process is almost identical to that
  of the AP105, except that the case is easier to open, and that you
  need to compile u-boot from a slightly different branch:
  https://github.com/Hurricos/u-boot-ap105/tree/ap175

  The instructions for performing an in-circuit reflash with an
  SPI-Flasher like a CH314A can be found on the OpenWrt Wiki
  (https://openwrt.org/toh/aruba/ap-105); in addition a detailed guide
  may be found on YouTube[^3].

- Once u-boot has been replaced, a USB-A-to-A cable may be used to
  connect your PC to the CP210X inside the AP at 115200 baud; at this
  point, the normal u-boot serial flashing procedure will work (set up
  networking; tftpboot and boot an OpenWrt initramfs; sysupgrade to
  OpenWrt proper.)

- There is no built-in functionality to revert back to stock firmware,
  because the AP-175 has been declared by the vendor[^4] end-of-life
  as of 31 Jul 2020. If for some reason you wish to return to stock
  firmware, take a backup of the 16MiB flash before flashing u-boot.

[^1]: https://github.com/shalzz/aruba-ap-310/blob/master/platform/bootloader/apboot-11n/include/configs/msr2k.h#L186

[^2]: https://github.com/Hurricos/u-boot-ap105/tree/ap175

[^3]: https://www.youtube.com/watch?v=Vof__dPiprs

[^4]: https://www.arubanetworks.com/support-services/end-of-life/#product=access-points&version=0

Signed-off-by: Martin Kennedy <hurricos@gmail.com>
2023-03-27 00:27:59 +02:00
Lech Perczak
0eebc6f0dd ath79: support Ruckus ZoneFlex 7341/7343/7363
Ruckus ZoneFlex 7363 is a dual-band, dual-radio 802.11n 2x2 MIMO enterprise
access point. ZoneFlex 7343 is the single band variant of 7363
restricted to 2.4GHz, and ZoneFlex 7341 is 7343 minus two Fast Ethernet
ports.

Hardware highligts:
- CPU: Atheros AR7161 SoC at 680 MHz
- RAM: 64MB DDR
- Flash: 16MB SPI-NOR
- Wi-Fi 2.4GHz: AR9280 PCI 2x2 MIMO radio with external beamforming
- Wi-Fi 5GHz: AR9280 PCI 2x2 MIMO radio with external beamforming
- Ethernet 1: single Gigabit Ethernet port through Marvell 88E1116R gigabit PHY
- Ethernet 2: two Fast Ethernet ports through Realtek RTL8363S switch,
  connected with Fast Ethernet link to CPU.
- PoE: input through Gigabit port
- Standalone 12V/1A power input
- USB: optional single USB 2.0 host port on the -U variants.

Serial console: 115200-8-N-1 on internal H1 header.
Pinout:

H1 ----------
   |1|x3|4|5|
   ----------

Pin 1 is near the "H1" marking.
1 - RX
x - no pin
3 - VCC (3.3V)
4 - GND
5 - TX

Installation:
- Using serial console - requires some disassembly, 3.3V USB-Serial
  adapter, TFTP server, and removing a single PH1 screw.

0. Connect serial console to H1 header. Ensure the serial converter
   does not back-power the board, otherwise it will fail to boot.

1. Power-on the board. Then quickly connect serial converter to PC and
   hit Ctrl+C in the terminal to break boot sequence. If you're lucky,
   you'll enter U-boot shell. Then skip to point 3.
   Connection parameters are 115200-8-N-1.

2. Allow the board to boot.  Press the reset button, so the board
   reboots into U-boot again and go back to point 1.

3. Set the "bootcmd" variable to disable the dual-boot feature of the
   system and ensure that uImage is loaded. This is critical step, and
   needs to be done only on initial installation.

   > setenv bootcmd "bootm 0xbf040000"
   > saveenv

4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed.
   Use the Gigabit interface, Fast Ethernet ports are not supported
   under U-boot:

   > setenv serverip 192.168.1.2
   > setenv ipaddr 192.168.1.1
   > tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7363-initramfs-kernel.bin
   > bootm 0x81000000

5. Optional, but highly recommended: back up contents of "firmware" partition:

   $ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7363_fw_backup.bin

6. Copy over sysupgrade image, and perform actual installation. OpenWrt
   shall boot from flash afterwards:

   $ ssh root@192.168.1.1
   # sysupgrade -n openwrt-ath79-generic-ruckus_zf7363-squashfs-sysupgrade.bin

   After unit boots, it should be available at the usual 192.168.1.1/24.

Return to factory firmware:

1. Copy over the backup to /tmp, for example using scp
2. Unset the "bootcmd" variable:
   fw_setenv bootcmd ""
3. Use sysupgrade with force to restore the backup:
   sysupgrade -F ruckus_zf7363_backup.bin
4. System will reboot.

Quirks and known issues:
- Fast Ethernet ports on ZF7363 and ZF7343 are supported, but management
  features of the RTL8363S switch aren't implemented yet, though the
  switch is visible over MDIO0 bus. This is a gigabit-capable switch, so
  link establishment with a gigabit link partner may take a longer time
  because RTL8363S advertises gigabit, and the port magnetics don't
  support it, so a downshift needs to occur. Both ports are accessible
  at eth1 interface, which - strangely - runs only at 100Mbps itself.
- Flash layout is changed from the factory, to use both firmware image
  partitions for storage using mtd-concat, and uImage format is used to
  actually boot the system, which rules out the dual-boot capability.
- Both radio has its own EEPROM on board, not connected to CPU.
- The stock firmware has dual-boot capability, which is not supported in
  OpenWrt by choice.
  It is controlled by data in the top 64kB of RAM which is unmapped,
  to avoid the interference in the boot process and accidental
  switch to the inactive image, although boot script presence in
  form of "bootcmd" variable should prevent this entirely.
- On some versions of stock firmware, it is possible to obtain root shell,
  however not much is available in terms of debugging facitilies.
  1. Login to the rkscli
  2. Execute hidden command "Ruckus"
  3. Copy and paste ";/bin/sh;" including quotes. This is required only
     once, the payload will be stored in writable filesystem.
  4. Execute hidden command "!v54!". Press Enter leaving empty reply for
     "What's your chow?" prompt.
  5. Busybox shell shall open.
  Source: https://alephsecurity.com/vulns/aleph-2019014
- There is second method to achieve root shell, using command injection
  in the web interface:
  1. Login to web administration interface
  2. Go to Administration > Diagnostics
  3. Enter |telnetd${IFS}-p${IFS}204${IFS}-l${IFS}/bin/sh into "ping"
     field
  4. Press "Run test"
  5. Telnet to the device IP at port 204
  6. Busybox shell shall open.
  Source: https://github.com/chk-jxcn/ruckusremoteshell

Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2023-03-22 22:25:08 +01:00
Lech Perczak
694b8e6521 ath79: support Ruckus ZoneFlex 7351
Ruckus ZoneFlex 7351 is a dual-band, dual-radio 802.11n 2x2 MIMO enterprise
access point.

Hardware highligts:
- CPU: Atheros AR7161 SoC at 680 MHz
- RAM: 64MB DDR
- Flash: 16MB SPI-NOR
- Wi-Fi 2.4GHz: AR9280 PCI 2x2 MIMO radio with external beamforming
- Wi-Fi 5GHz: AR9280 PCI 2x2 MIMO radio with external beamforming
- Ethernet: single Gigabit Ethernet port through Marvell 88E1116R gigabit PHY
- Standalone 12V/1A power input
- USB: optional single USB 2.0 host port on the 7351-U variant.

Serial console: 115200-8-N-1 on internal H1 header.
Pinout:

H1 ----------
   |1|x3|4|5|
   ----------

Pin 1 is near the "H1" marking.
1 - RX
x - no pin
3 - VCC (3.3V)
4 - GND
5 - TX

Installation:
- Using serial console - requires some disassembly, 3.3V USB-Serial
  adapter, TFTP server, and removing a single T10 screw.

0. Connect serial console to H1 header. Ensure the serial converter
   does not back-power the board, otherwise it will fail to boot.

1. Power-on the board. Then quickly connect serial converter to PC and
   hit Ctrl+C in the terminal to break boot sequence. If you're lucky,
   you'll enter U-boot shell. Then skip to point 3.
   Connection parameters are 115200-8-N-1.

2. Allow the board to boot.  Press the reset button, so the board
   reboots into U-boot again and go back to point 1.

3. Set the "bootcmd" variable to disable the dual-boot feature of the
   system and ensure that uImage is loaded. This is critical step, and
   needs to be done only on initial installation.

   > setenv bootcmd "bootm 0xbf040000"
   > saveenv

4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed:

   > setenv serverip 192.168.1.2
   > setenv ipaddr 192.168.1.1
   > tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7351-initramfs-kernel.bin
   > bootm 0x81000000

5. Optional, but highly recommended: back up contents of "firmware" partition:

   $ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7351_fw_backup.bin

6. Copy over sysupgrade image, and perform actual installation. OpenWrt
   shall boot from flash afterwards:

   $ ssh root@192.168.1.1
   # sysupgrade -n openwrt-ath79-generic-ruckus_zf7351-squashfs-sysupgrade.bin

   After unit boots, it should be available at the usual 192.168.1.1/24.

Return to factory firmware:
1. Copy over the backup to /tmp, for example using scp
2. Unset the "bootcmd" variable:
   fw_setenv bootcmd ""
3. Use sysupgrade with force to restore the backup:
   sysupgrade -F ruckus_zf7351_backup.bin
4. System will reboot.

Quirks and known issues:
- Flash layout is changed from the factory, to use both firmware image
  partitions for storage using mtd-concat, and uImage format is used to
  actually boot the system, which rules out the dual-boot capability.
- Both radio has its own EEPROM on board, not connected to CPU.
- The stock firmware has dual-boot capability, which is not supported in
  OpenWrt by choice.
  It is controlled by data in the top 64kB of RAM which is unmapped,
  to avoid the interference in the boot process and accidental
  switch to the inactive image, although boot script presence in
  form of "bootcmd" variable should prevent this entirely.
- On some versions of stock firmware, it is possible to obtain root shell,
  however not much is available in terms of debugging facitilies.
  1. Login to the rkscli
  2. Execute hidden command "Ruckus"
  3. Copy and paste ";/bin/sh;" including quotes. This is required only
     once, the payload will be stored in writable filesystem.
  4. Execute hidden command "!v54!". Press Enter leaving empty reply for
     "What's your chow?" prompt.
  5. Busybox shell shall open.
  Source: https://alephsecurity.com/vulns/aleph-2019014
- There is second method to achieve root shell, using command injection
  in the web interface:
  1. Login to web administration interface
  2. Go to Administration > Diagnostics
  3. Enter |telnetd${IFS}-p${IFS}204${IFS}-l${IFS}/bin/sh into "ping"
     field
  4. Press "Run test"
  5. Telnet to the device IP at port 204
  6. Busybox shell shall open.
  Source: https://github.com/chk-jxcn/ruckusremoteshell

Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2023-03-22 22:25:08 +01:00
Alexandru Gagniuc
7801161c4b ipq807x: add support for Netgear WAX218
Netgear WAX218 is a 802.11ax AP claiming AX3600 support. It is wall
or ceiling mountable. It can be powered via PoE, or a 12 V adapter.

The board has footprints for 2.54mm UART headers. They're difficult to
solder because the GND is connected to a large copper plane. Only try
soldering if you are very skilled. Otherwise, use pogo pins.

Specifications:
---------------
    * CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz
    * RAM: 366 MB of RAM available to OS, not sure of total amount
    * Storage: Macronix MX30UF2G18AC 256MB NAND
    * Ethernet:
            * 2.5G RJ45 port (QCA8081) with PoE input
    * WLAN:
            * 2.4GHz/5GHz with 8 antennas
    * LEDs:
            * Power (Amber)
            * LAN (Blue)
            * 2G WLAN (Blue)
            * 5G WLAN (Blue)
    * Buttons:
            * 1x Factory reset
    * Power: 12V DC Jack
    * UART: Two 4-pin unpopulated headers near the LEDs
            * "J2 UART" is the CPU UART, 3.3 V level

Installation:
=============

Web UI method
-------------

Flashing OpenWRT using the vendor's Web UI is problematic on this
device. The u-boot mechanism for communicating the active rootfs is
antiquated and unreliable. Instead of setting the kernel commandline,
it relies on patching the DTS partitions of the nand node. The way
partitions are patched is incompatible with newer kernels.

Newer kernels use the SMEM partition table, which puts "rootfs" on
mtd12. The vendor's Web UI will flash to either mtd12 or mtd14. One
reliable way to boot from mtd14 and avoid boot loops is to use an
initramfs image.

 1. In the factory web UI, navigate to System Manager -> Firmware.
 2. In the "Local Firmware Upgrade" section, click Browse
 3. Navigate and select the 'web-ui-factory.fit' image
 4. Click "Upload"
 5. On the following page, click on "Proceed"

The flash proceeds at this point and the system will reboot
automatically to OpenWRT.

 6. Flash the 'nand-sysupgrade.bin' using Luci or the commandline

SSH method
----------

Enable SSH using the CLI or Web UI. The root account is locked out to
ssh, and the admin account defaults to Netgear's CLI application.
So we need to get creative:

First, make sure the device boots from the second firmware partition:

    ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \
        /usr/sbin/fw_setenv active_fw 1

Then reboot the device, and run the update:

    scp -O -o kexalgorithms=diffie-hellman-group14-sha1 \
        -o hostkeyalgorithms=ssh-rsa \
        netgear_wax218-squashfs-nand-factory.ubi \
        admin@<ipaddr>:/tmp/openwrt.ubi

    ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \
        /usr/sbin/ubiformat /dev/mtd12 -f /tmp/openwrt.ubi

    ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \
        /usr/sbin/fw_setenv active_fw 0

Now reboot the device, and it should boot into a ready-to-use OpenWRT.

Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
Tested-by: Francisco G Luna <frangonlun@gmail.com>
2023-03-20 11:40:36 -05:00
Kristjan Krušič
f574b535eb
ipq806x: add support for Nokia Airscale AC400i
Hardware
--------

SoC:    Qualcomm IPQ8065
RAM:    512 MB DDR3
Flash:  256 MB NAND (Macronix MX30UF2G18AC) (split into 2x128MB)
        4 MB SPI-NOR (Macronix MX25U3235F)
WLAN:   Qualcomm Atheros QCA9984 - 2.4Ghz
        Qualcomm Atheros QCA9984 - 5Ghz
ETH:    eth0 - POE (100Mbps in U-Boot, 1000Mbps in OpenWrt)
        eth1 - (1000Mbps in both)
        Auto-negotiation broken on both.
USB:    USB 2.0
LED:    5G, 2.4G, ETH1, ETH2, CTRL, PWR (All support green and red)
BTN:    Reset
Other:  SD card slot (non-functional)
Serial: 115200bps, near the Ethernet transformers, labeled 9X.
        Connections from the arrow to the 9X text:
		[NC] - [TXD] - [GND] - [RXD] - [NC]

Installation
------------

0. Connect to the device
Plug your computer into LAN2 (1000Mbps connection required).
If you use the LAN1/POE port, set your computer to force a 100Mbps link.

Connect to the device via TTL (Serial) 115200n8.
Locate the header (or solder pads) labeled 9X,
near the Ethernet jacks/transformers.
There should be an arrow on the other side of the header marking.
The connections should go like this:
(from the arrow to the 9X text): NC - TXD - GND - RXD - NC

1. Prepare for installation
While the AP is powering up, interrupt the startup process.
MAKE SURE TO CHECK YOUR CURRENT PARTITION!

If you see: "Current Partition is : partB" or
"Need to switch partition from partA to partB",
you have to force the device into partA mode, before continuing.
This can be done by changing the PKRstCnt to 5 and resetting the device.

setenv PKRstCnt 5
saveenv
reset

After you interrupt the startup process again,
you should see: Need to switch partition from partB to partA

You can now continue to the next step.

If you see: "Current Partition is : partA",
you can continue to the next step.

2. Prevent partition switching.
To prevent the device from switching partitions,
we are going to modify the startup command.
set bootcmd "setenv PKRstCnt 0; saveenv; bootipq"
setenv

3. First boot
Now, we have to boot the OpenWrt intifs.
The easiest way to do this is by using Tiny PXE.
You can also use the normal U-Boot tftp method.

Run "bootp" this will get an IP from the DHCP server
and possibly the firmware image.
If it doesn't download the firmware image, run "tftpboot".

Now run "bootm" to run the image.

You might see:
"ERROR: new format image overwritten - must RESET the board to recover"
this means that the image you are trying to load is too big.
Use a smaller image for the initial boot.

4. Install OpenWrt from initfs
Once you are booted into OpenWrt,
transfer the OpenWrt upgrade image and
use sysupgrade to install OpenWrt to the device.

Signed-off-by: Kristjan Krušič <kristjan.krusic@krusic22.com>
2023-03-19 18:02:34 +01:00
Aleksey Nasibulin
d45659a571 ramips: add support for SNR-CPE-ME2-SFP
SNR-CPE-ME2-SFP is a wireless router with SFP cage manufactured by SNR/NAG company.

Specification:
- SoC: MediaTek MT7621A
- CPU: 880MHz
- Flash: 16 MB (GD25Q127CSIG)
- RAM:  256 MB
- WLAN: 2.4 GHz, 5 GHz (MediaTek MT7615DN)
- Ethernet: 4x 10/100/1000 Mbps
- SFP cage (using RTL8211FS-CG)
- USB 3.0 port
- Power: 12 VDC, 2 A

Flash instruction via TFTP:
1. Boot SNR-CPE-ME2 to recovery mode
  (press reset button and power on device, hold button for ~10 seconds)
2. Send firmware via TFTP client:
 TFTP Server address: 192.168.1.1
 TFTP Client address: 192.168.1.131
3. Wait ~120 seconds to complete flashing
4. Do sysupgrade using web-interface

MAC Addresses(stock)
--------------------
+----------+------------------+-------------------+
| use      | address          | example           |
+----------+------------------+-------------------+
| Device   | label            | 6A:C4:DD:xx:xx:28 |
| Ethernet | + 1              | 6A:C4:DD:xx:xx:29 |
| 2g       | + 2              | 6A:C4:DD:xx:xx:2A |
| 5g       | + 3              | 6A:C4:DD:xx:xx:2B |
+----------+------------------+-------------------+

Notes:
- Reading sfp eeprom is not supported [1] (driver issue). Stock image has the same situation.

References:
1. https://forum.openwrt.org/t/mt7621-and-reading-sfp-eeprom/152249

Signed-off-by: Aleksey Nasibulin <alealexpro100@ya.ru>
2023-03-08 23:44:59 +01:00
David Bauer
35f6d79513 mpc85xx: add support for Watchguard Firebox T10
Hardware
--------
SoC:    Freescale P1010
RAM:    512MB
FLASH:  1 MB SPI-NOR
        512 MB NAND
ETH:    3x Gigabite Ethernet (Atheros AR8033)
SERIAL: Cisco RJ-45 (115200 8N1)
RTC:    Battery-Backed RTC (I2C)

Installation
------------

1. Patch U-Boot by dumping the content of the SPI-Flash using a SPI
   programmer. The SHA1 hash for the U-Boot password is currently
   unknown.

   A tool for patching U-Boot is available at
   https://github.com/blocktrron/t10-uboot-patcher/

   You can also patch the unknown password yourself. The SHA1 hash is
   E597301A1D89FF3F6D318DBF4DBA0A5ABC5ECBEA

2. Interrupt the bootmenu by pressing CTRL+C. A password prompt appears.
   The patched password is '1234' (without quotation marks)

3. Download the OpenWrt initramfs image. Copy it to a TFTP server
   reachable at 10.0.1.13/24 and rename it to uImage.

4. Connect the TFTP server to ethernet port 0 of the Watchguard T10.

5. Download and boot the initramfs image by entering "tftpboot; bootm;"
   in U-Boot.

6. After OpenWrt booted, create a UBI volume on the old data partition.
   The "ubi" mtd partition should be mtd7, check this using

   $ cat /proc/mtd

   Create a UBI partition by executing

   $ ubiformat /dev/mtd7 -y

7. Increase the loadable kernel-size of U-Boot by executing

   $ fw_setenv SysAKernSize 800000

8. Transfer the OpenWrt sysupgrade image to the Watchguard T10 using
   scp. Install the image by using sysupgrade:

   $ sysupgrade -n <path-to-sysupgrade>

   Note: The LAN ports of the T10 are 1 & 2 while 0 is WAN. You might
   have to change the ethernet-port.

9. OpenWrt should now boot from the internal NAND. Enjoy.

Signed-off-by: David Bauer <mail@david-bauer.net>
2023-03-07 14:05:02 +01:00
Daniel González Cabanelas
be0f1c1b26 mvebu: add support for Buffalo LinkStation LS220DE
The Buffalo LinkStation LS220DE is a dual bay NAS, based on Marvell
Armada 370

Hardware:
   SoC:         Marvell Armada 88F6707
   CPU:         Cortex-A9 800 MHz, 1 core
   Flash 1:     SPI-NOR 1 MiB (U-Boot)
   Flash 2:     NAND 512 MiB (OS)
   RAM:         DDR3 256 MiB
   Ethernet:    1x 1GbE
   USB:         1x 2.0
   SATA:        2x 3Gb/s
   LEDs/Input:  5x / 2x (1x button, 1x slide-switch)
   Fan:         1x casing

Flash instructions, from hard drive:
  1. Get access to the "boot" partition at the hard drive where the stock
     firmware is installed. It can be done with acp-commander or by
     plugging the hard drive to a computer.
  2. Backup the stock uImage:
         mv /boot/uImage.buffalo /boot/uImage.buffalo.bak
  3. Move and rename the Openwrt initramfs image to the boot partition:
         mv openwrt-initramfs-kernel.bin /boot/uImage.buffalo
  4. Power on the Linkstation with the hardrive inside. Now Openwrt will
     boot, but still not installed.
  5. Connect via ssh to OpenWrt:
         ssh root@192.168.1.1
  6. Rename boot files inside boot partition
         mount -t ext3 /dev/sda1 /mnt
         mv /mnt/uImage.buffalo /mnt/uImage.buffalo.openwrt.bak
         mv /mnt/initrd.buffalo /mnt/initrd.buffalo.bak
  7. Format ubi partitions at the NAND flash ("kernel_ubi" and "ubi"):
         ubiformat /dev/mtd0 -y
         ubidetach -p /dev/mtd1
         ubiformat /dev/mtd1 -y
  8. Flash the sysupgrade image:
         sysupgrade -n openwrt-squashfs-sysupgrade.bin
  9. Wait until it finish, the device will reboot with OpenWrt installed
     on the NAND flash.

Restore the stock firmware:
  1. Take the hard drive used for the installation and restore boot backup
     files to their original names:
         mount -t ext3 /dev/sda1 /mnt
         mv /mnt/uImage.buffalo.bak /mnt/uImage.buffalo
         mv /mnt/initrd.buffalo.bak /mnt/initrd.buffalo
  2. Boot from the hard drive and perform a stock firmware update using
     the Buffalo utility. The NAND will be restored to the original
     state.

Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com>
2023-02-26 22:22:48 +01:00
Michael Pratt
4ef86c620f ramips: add support for Senao Engenius EPG600
FCC ID: A8J-EPG600

Engenius EPG600 is an indoor wireless router with
1 Gb ethernet switch, dual-band wireless,
internal antenna plates, USB, and phone lines (not supported)

this board is a Senao device:
the hardware is equivalent to EnGenius ESR600 (except for phone lines)
the software is Senao SDK which is based on openwrt and uboot
which uses the legacy Senao header with Vendor / Product IDs
to verify the firmware upgrade image.

**Specification:**

  - MT7620 SOC		MIPS 24kec, 2.4 GHz WMAC, 2x2
  - RT5592N WLAN	PCI chip, 5 GHz, 2x2
  - QCA8337N Gb SW	RGMII GbE, SW P0 -- SOC P5, 5 LEDs
  - 40 MHz clock
  - 16 MB FLASH		MX25L12845EMI-10G
  - 64 MB RAM		NT5TU32M16
  - UART console	J2, populated
  - USB 2.0 port	direct to SOC
  - 6 GPIO LEDs		power, 2G, 5G, wps2g, wps5g, line
  - 3 buttons		reset, wps, "reg" (registeration)
  - 4 antennas		internal omni-directional plates

NOT YET SUPPORTED: VoIP

  - Si3050-FT + Si3019-FT	Voice DAA, SPI control, PCM data
  - Phone Ports "TEL", "LINE"	RJ11, 4P2C (2 pins)

**MAC addresses:**

  MAC address labeled as MAC ADDRESS
  MACs present in both wifi cal data and uboot environment

  eth0.1/phy1	----	*:82	rf 0x4
  phy0		----	*:83	factory 0x4
  eth0.2	MAC	*:b8	"wanaddr"

**Installation:**

  Method 1: Firmware upgrade page:

    (if you cannot access the APs webpage)
    factory reset with the reset button
    connect ethernet to a computer
    OEM webpage at 192.168.0.1
    username and password 'admin'

    Navigate to gear icon, "Device Management", "Tools"
    select the factory.dlf image
    Upload and verify checksum

  Method 2: Serial to upload initramfs:

    Follow directions for TFTP recovery
    upload and boot initramfs and do a sysupgrade

**TFTP recovery:**

  Requires UART serial console, reset button does nothing

  rename initramfs-kernel.bin to 'uImageEPG600'
  make available on TFTP server at 192.168.99.8
  power board, interrupt boot with "4"
  execute `tftpboot` and `bootm` (with the load address)

**Return to OEM:**

  Images from OEM are provided, but not compatible
  with openwrt sysupgrade. So it must be modified.

  Alternatively, back up all mtd partitions before flashing

**Note on switch registers:**

  The necessary registers needed for the QCA8337 switch
  can be read from interrupted boot (tftpboot, bootm)
  by using the following lines in the switch driver ar8327.c
  in the function 'ar8327_hw_config_of'
  where 'qca,ar8327-initvals' is parsed from DTS
  before the new register values are written:

    pr_info("0x04 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD0_MODE));
    pr_info("0x08 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD5_MODE));
    pr_info("0x0c %08x\n", ar8xxx_read(priv, AR8327_REG_PAD6_MODE));
    pr_info("0x10 %08x\n", ar8xxx_read(priv, AR8327_REG_POWER_ON_STRAP));

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-02-18 16:55:35 +01:00
INAGAKI Hiroshi
54c5f33b30 uboot-envtools: add support for APRESIA ApresiaLightGS120GT-SS
This patch adds support for APRESIA ApresiaLightGS120GT-SS to
uboot-envtools.

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2023-02-13 12:22:17 +01:00
Karl Chan
92276eef70 ramips: add support for ASUS RT-AX54
Specifications:
- Device: ASUS RT-AX54 (AX1800S/HP,AX54HP)
- SoC: MT7621AT
- Flash: 128MB
- RAM: 256MB
- Switch: 1 WAN, 4 LAN (10/100/1000 Mbps)
- WiFi: MT7905 2x2 2.4G + MT7975 2x2 5G
- LEDs: 1x POWER (blue, configurable)
        1x LAN (blue, configurable)
        1x WAN (blue, configurable)
	1x 2.4G (blue, not configurable)
	1x 5G (blue, not configurable)

Flash by U-Boot TFTP method:
- Configure your PC with IP 192.168.1.2
- Set up TFTP server and put the factory.bin image on your PC
- Connect serial port(rate:115200) and turn on AP, then interrupt "U-Boot Boot Menu" by hitting any key
   Select "2. Upgrade firmware"
   Press enter when show "Run firmware after upgrading? (Y/n):"
   Select 0 for TFTP method
   Input U-Boot's IP address: 192.168.1.1
   Input TFTP server's IP address: 192.168.1.2
   Input IP netmask: 255.255.255.0
   Input file name: openwrt-ramips-mt7621-asus_rt-ax1800hp-squashfs-factory.bin
- Restart AP aftre see the log "Firmware upgrade completed!"

Signed-off-by: Karl Chan <exkc@exkc.moe>
2023-02-12 18:27:45 +01:00
Daniel Golle
90dbdb4941 uboot-envtools: filogic: bpi-r3: fix env selection
Selecting the environment when booting from SD card has been broken by
a previous commit. Fix it.

Fixes: f46355b4d7 ("uboot-envtools: mediatek_filogic: fix BPi-R3 when no OS is installed")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2023-01-29 03:43:58 +00:00
Daniel Golle
e51a57e192 uboot-envtools: mt7622: bpi-r64: fix env selection
Selecting the environment when booting from SD card has been broken by
a previous commit. Fix it.

Fixes: 84b5b0f88c ("uboot-envtools: mediatek/mt7622: don't rely on mapped rootfs")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2023-01-29 03:43:58 +00:00
Michael Pratt
52992efc34 ath79: add support for Senao Engenius EWS660AP
FCC ID: A8J-EWS660AP

Engenius EWS660AP is an outdoor wireless access point with
2 gigabit ethernet ports, dual-band wireless,
internal antenna plates, and 802.3at PoE+

**Specification:**

  - QCA9558 SOC		2.4 GHz, 3x3
  - QCA9880 WLAN	mini PCIe card, 5 GHz, 3x3, 26dBm
  - AR8035-A PHY	RGMII GbE with PoE+ IN
  - AR8033 PHY		SGMII GbE with PoE+ OUT
  - 40 MHz clock
  - 16 MB FLASH		MX25L12845EMI-10G
  - 2x 64 MB RAM
  - UART at J1		populated, RX grounded
  - 6 internal antenna plates (5 dbi, omni-directional)
  - 5 LEDs, 1 button (power, eth0, eth1, 2G, 5G) (reset)

**MAC addresses:**

  Base MAC addressed labeled as "MAC"
  Only one Vendor MAC address in flash

  eth0 *:d4 MAC art 0x0
  eth1 *:d5 --- art 0x0 +1
  phy1 *:d6 --- art 0x0 +2
  phy0 *:d7 --- art 0x0 +3

**Serial Access:**

  the RX line on the board for UART is shorted to ground by resistor R176
  therefore it must be removed to use the console
  but it is not necessary to remove to view boot log

  optionally, R175 can be replaced with a solder bridge short

  the resistors R175 and R176 are next to the UART RX pin

**Installation:**

  2 ways to flash factory.bin from OEM:

  Method 1: Firmware upgrade page:

    OEM webpage at 192.168.1.1
    username and password "admin"
    Navigate to "Firmware Upgrade" page from left pane
    Click Browse and select the factory.bin image
    Upload and verify checksum
    Click Continue to confirm and wait 3 minutes

  Method 2: Serial to load Failsafe webpage:

    After connecting to serial console and rebooting...
    Interrupt uboot with any key pressed rapidly
    execute `run failsafe_boot` OR `bootm 0x9fd70000`
    wait a minute
    connect to ethernet and navigate to
    "192.168.1.1/index.htm"
    Select the factory.bin image and upload
    wait about 3 minutes

**Return to OEM:**

  If you have a serial cable, see Serial Failsafe instructions
  otherwise, uboot-env can be used to make uboot load the failsafe image

  ssh into openwrt and run
  `fw_setenv rootfs_checksum 0`
  reboot, wait 3 minutes
  connect to ethernet and navigate to 192.168.1.1/index.htm
  select OEM firmware image from Engenius and click upgrade

**TFTP recovery:**

  Requires serial console, reset button does nothing

  rename initramfs.bin to '0101A8C0.img'
  make available on TFTP server at 192.168.1.101
  power board, interrupt boot
  execute tftpboot and bootm 0x81000000

**Format of OEM firmware image:**

  The OEM software of EWS660AP is a heavily modified version
  of Openwrt Kamikaze. One of the many modifications
  is to the sysupgrade program. Image verification is performed
  simply by the successful ungzip and untar of the supplied file
  and name check and header verification of the resulting contents.
  To form a factory.bin that is accepted by OEM Openwrt build,
  the kernel and rootfs must have specific names...

    openwrt-ar71xx-generic-ews660ap-uImage-lzma.bin
    openwrt-ar71xx-generic-ews660ap-root.squashfs

  and begin with the respective headers (uImage, squashfs).
  Then the files must be tarballed and gzipped.
  The resulting binary is actually a tar.gz file in disguise.
  This can be verified by using binwalk on the OEM firmware images,
  ungzipping then untaring.

  Newer EnGenius software requires more checks but their script
  includes a way to skip them, otherwise the tar must include
  a text file with the version and md5sums in a deprecated format.

  The OEM upgrade script is at /etc/fwupgrade.sh.

  OKLI kernel loader is required because the OEM software
  expects the kernel to be no greater than 1536k
  and the factory.bin upgrade procedure would otherwise
  overwrite part of the kernel when writing rootfs.

Note on PLL-data cells:

  The default PLL register values will not work
  because of the external AR8035 switch between
  the SOC and the ethernet port.

  For QCA955x series, the PLL registers for eth0 and eth1
  can be see in the DTSI as 0x28 and 0x48 respectively.
  Therefore the PLL registers can be read from uboot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x18050028 1` and `md 0x18050048 1`.

  The clock delay required for RGMII can be applied
  at the PHY side, using the at803x driver `phy-mode`.
  Therefore the PLL registers for GMAC0
  do not need the bits for delay on the MAC side.
  This is possible due to fixes in at803x driver
  since Linux 5.1 and 5.3

Tested-by: Niklas Arnitz <openwrt@arnitz.email>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-01-28 20:34:00 +01:00
Wenli Looi
f0eb73a888 ath79: consolidate Netgear EX7300 series images
This change consolidates Netgear EX7300 series devices into two images
corresponding to devices that share the same manufacturer firmware
image. Similar to the manufacturer firmware, the actual device model is
detected at runtime. The logic is taken from the netgear GPL dumps in a
file called generate_board_conf.sh.

Hardware details for EX7300 v2 variants
---------------------------------------
SoC: QCN5502
Flash: 16 MiB
RAM: 128 MiB
Ethernet: 1 gigabit port
Wireless 2.4GHz (currently unsupported due to lack of ath9k support):
- EX6250 / EX6400 v2 / EX6410 / EX6420: QCN5502 3x3
- EX7300 v2 / EX7320: QCN5502 4x4
Wireless 5GHz:
- EX6250: QCA9986 3x3 (detected by ath10k as QCA9984 3x3)
- EX6400 v2 / EX6410 / EX6420 / EX7300 v2 / EX7320: QCA9984 4x4

Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
2023-01-25 00:42:52 +01:00
André Valentin
5dee596501
ipq807x: Add ZyXEL NBG7815
ZyXEL NBG7815 is a premium 802.11ax "tri"-band router/AP.
Specifications:
* CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz
* RAM: 1 GB 2x Nanya NT5CC256M16ER-EK
* Storage:
        * 8MB serial flash Winbond W25Q64DW
        * 4GB eMMC flash Kingston EMMC04G-M627
* Ethernet:
        * 4x1G RJ45 ports (QCA8074A) with 1x status LED per port
        * 1x2.5G RJ45 port (QCA8081) with 1x status LED
        * 1x10G RJ45 port (AQR113C) with 1x status LED
* Switch: Qualcomm Atheros QCA8075
* WLAN:
        * 2.4GHz: Qualcomm QCN5024 4x4@40MHz 802.11b/g/n/ax 1147 Mbps PHY rate
        * 2x 5GHz: Qualcomm QCN5054 4x4 802.11a/b/g/n/ac/ax 2402 PHY rate
* Bluetooth CSR8811 using HSUART, currently unsupported
* USB: 1x USB3.0 Type-A port
* LED-s currently not supported:
        * White
        * Dark Blu
        * Amber
        * Purple
        * Purple and dark blue
        * Red
* Buttons:
        * 1x Soft reset
* Power: 12V DC Jack

Installation instructions:
* Disconnect WAN
* Reset device to factory defaults by pushing reset button 15 sec,
  LEDs should lit orange color.
* After 5-10 minutes, when the LEDs turn constant dark blue,
  put your LAN cable and connect at address 192.168.123.1 by telnet on port 23
* Login with
  NBG7815 login: root
  password: nbg7815@2019
* cd /tmp/ApplicationData
* wget -O openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin http://...
* wget https://github.com/itorK/nbg7815_tools/blob/main/flash_to_openwrt.sh
* run flash_to_openwrt.sh
If you can't use wget, you can transfer the files via nc.
See https://openwrt.org/inbox/toh/zyxel/nbg7815_armor_g5 for installation details.

Bluetooth usage:
* you need at least package bluez-utils, recommended bluez-daemon
* run following commands to enable and start
  hciattach  /dev/ttyMSM1 bcsp
  hciconfig hci0 up

Many thanks to itorK for his work on this device:
https://github.com/itorK/openwrt/tree/nbg7815

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: André Valentin <avalentin@marcant.net>
2023-01-19 13:26:15 +01:00
Vincent Tremblay
afcf1a4de4
uboot-envtools: ipq40xx: fix WHW03V2 mtd partition
The configured u_env partition for the Linksys WHW03 V2 was not correct.
It should have been set to mtd6.

This fix allow to flash the OEM firmware from OpenWRT and to change the
boot partition using fw_setenv.

Fixes: 9e4ede8344 ("ipq40xx: add support for Linksys WHW03 V2")
Signed-off-by: Vincent Tremblay <vincent@vtremblay.dev>
2023-01-18 00:07:30 +01:00
Dirk Buchwalder
26c095cb4d ipq807x: add Dynalink DL-WRX36
Dynalink DL-WRX36 is a AX WIFI router with 4 1G and 1 2.5G ports.

Specifications:

    •     CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz
    •     RAM: 1024MB of DDR3
    •     Storage: 256MB Nand
    •     Ethernet: 4x 1G RJ45 ports (QCA8075) + 1 2.5G Port (QCA8081)
    •     WLAN:
          2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 1174 Mbps PHY rate
          5GHz: Qualcomm QCN5054 4x4 802.11a/b/g/n/ac/ax 2402 PHY rate
    •     1x USB 3.0

    •     1 gpio-controlled dual color led (blue/red)

            • Buttons: 1x soft reset / 1x WPS
            • Power: 12V DC jack

        A poulated serial header is onboard (J1004)
        the connector size is a 4-pin 2.0 mm JST PH.
        RX/TX is working, u-boot bootwait is active, secure boot is enabled.

        Notes:
	- Serial is completely deactivated in the stock firmware image.
	- This commit adds only single partition support, that means
	  sysupgrade is upgrading the current rootfs partition.
	- Installation can be done by serial connection or
	  SSH access on OEM firmware

	Installation Instructions:

	Most part of the installation is performed from an initramfs image
	running OpenWrt, and there are two options to boot it.

	Boot initramfs option 1: Using serial connection (3.3V)
	1. Stop auto boot to get to U-boot shell
	2. Transfer initramfs image to device
	   (openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb)
	   Tested using TFTP and a FAT-formatted USB flash drive.
	3. Boot the initramfs image
	   # bootm

	Boot initramfs option 2: From SSH access on OEM firmware
	1. Copy the initramfs image to a FAT-formatted flash drive
	   (tested on single-partition drive) and connect it to device USB port.
	2. Change boot command so it loads the initramfs image on next boot
	   Fallback to OEM firmware is provided.
	   # fw_setenv bootcmd 'usb start && fatload usb 0:1 0x44000000 openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb && bootm 0x44000000; bootipq'
	3. Reboot the device to boot the initramfs
	   # reboot

	Install OpenWrt from initramfs image:
	1. Use SCP (or other way) to transfer OpenWrt factory image
	2. Connect to device using SSH (on a LAN port)
	3. Check MTD partition table.
	   rootfs and rootfs_1 should be mtd18 and mtd20
	   depending on current OEM slot.
	   # cat /proc/mtd
	4. Do a ubiformat to both rootfs partitions:
	   # ubiformat /dev/mtd18 -y -f /path_to/factory_image
	   # ubiformat /dev/mtd20 -y -f /path_to/factory_image
	5. Set U-boot env variable: mtdids
	   # fw_setenv mtdids 'nand0=nand0'
	6. Get offset of mtd18 to determine current OEM slot
	   - If current OEM slot is 1, offset is 16777216  (0x1000000)
	   - If current OEM slot is 2, offset is 127926272 (0x7a00000)
	   # cat /sys/class/mtd/mtd18/offset
	7. Set U-boot env variable: mtdparts
	   If current OEM slot is 1, run:
	   # fw_setenv mtdparts 'mtdparts=nand0:0x6100000@0x1000000(fs),0x6100000@0x7a00000(fs_1)'
	   If current OEM slot is 2, run:
	   # fw_setenv mtdparts 'mtdparts=nand0:0x6100000@0x7a00000(fs),0x6100000@0x1000000(fs_1)'
	8. Set U-boot env variable: bootcmd
	   # fw_setenv bootcmd 'setenv bootargs console=ttyMSM0,115200n8 ubi.mtd=rootfs rootfstype=squashfs rootwait; ubi part fs; ubi read 0x44000000 kernel; bootm 0x44000000#config@rt5010w-d350-rev0'
	9. Reboot the device
	   # reboot

        Note: this PR adds only single partition support, that means sysupgrade is
              upgrading the current rootfs partition

Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
2023-01-16 12:42:23 +01:00
Matthew Hagan
6e03304c76 ipq807x: add Edgecore EAP102
The Edgecore EAP102 is a wall/ceiling mountable AP. The AP can be
powered by either PoE or AC adapter.

Device info:
 - IPQ8071-A SoC
 - 1GiB RAM
 - 256MiB NAND flash
 - 32MiB SPI NOR
 - 2 Ethernet ports
 - 1 Console port
 - 2GHz/5GHz AX WLAN
 - 2 USB 2.0 ports

Install instructions:

Prerequistes - TFTP server, preferrably within 192.168.1.0/24
	       Console cable plugged in (115200 8N1 no flow control)

1. Power on device and interrupt u-boot to obtain u-boot CLI

2. set serverip to IP address of the TFTP server:

	`setenv serverip 192.168.1.250`

3. Download image from TFTP server:

	`tftpboot 0x44000000 openwrt-ipq807x-generic-edgecore_eap102-squashfs-nand-factory.ubi`

4. Flash ubi image to both partitions and reset:

	`sf probe
	 imxtract 0x44000000 ubi
	 nand device 0
	 nand erase 0x0 0x3400000
	 nand erase 0x3c00000 0x3400000
	 nand write $fileaddr 0x0 $filesize
	 nand write $fileaddr 0x3c00000 $filesize
	 reset`

Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
2023-01-16 12:42:23 +01:00
Robert Marko
2ddb2057cd ipq807x: Add Xiaomi AX9000
Xiaomi AX9000 is a premium 802.11ax "tri"-band router/AP.
Specifications:
* CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz
* RAM: 1024MB of DDR3
* Storage: 256MB of parallel NAND
* Ethernet:
	* 4x1G RJ45 ports (QCA8075) with 1x status LED per port
	* 1x2.5G RJ45 port (QCA8081) with 1x status LED
* WLAN:
	* PCI based Qualcomm QCA9889 1x1 802.11ac Wawe 2 for IoT
	* 2.4GHz: Qualcomm QCN5024 4x4@40MHz 802.11b/g/n/ax 1147 Mbps PHY rate
	* 5.8GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402Mbps PHY rate
	* 5GHz: PCI based Qualcomm QCN9024 4x4@160MHz 802.11a/b/g/n/ac/ax 4804Mbps PHY rate
* USB: 1x USB3.0 Type-A port
* LED-s:
	* System (Blue and Yellow)
	* Network (Blue and Yellow)
	* RGB light bar on top in X shape
* Buttons:
	* 1x Power switch
	* 1x Soft reset
	* 1x Mesh button
* Power: 12V DC Jack

Installation instructions:

Obtaining SSH access is mandatory
https://openwrt.org/inbox/toh/xiaomi/ax9000#obtain_ssh_access

Installation is done by the ubiformat method, through SSH:
1. Open an SSH shell to the router
2. Copy the file openwrt-ipq807x-generic-xiaomi_ax9000-initramfs-factory.ubi to the /tmp directory
3. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1):
nvram get flag_boot_rootfs

4. Find the rootfs and rootfs_1 mtd indexes respectively:
cat /proc/mtd
Please confirm if mtd21 and mtd22 are the correct indexes from above!

5. Use the command ubiformat to flash the opposite mtd with UBI image:

If nvram get flag_boot_rootfs returned 0:
ubiformat /dev/mtd22 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit

otherwise:
ubiformat /dev/mtd21 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit

6. Reboot the device by:
reboot

Previous commands flashed an ubinized OpenWrt initramfs that will serve as the intermediate step
since OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for packages.
Continue in order to pernamently flash OpenWrt:

7. SSH into OpenWrt from one of the LAN ports
8. Copy the file openwrt-ipq807x-generic-xiaomi_ax9000-squashfs-sysupgrade.bin to the /tmp directory
9. Sysupgrade the device:
sysupgrade -n /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-squashfs-sysupgrade.bin

Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired.

Signed-off-by: Robert Marko <robimarko@gmail.com>
2023-01-16 12:42:23 +01:00
Dirk Buchwalder
bd17683261 ipq807x: add QNAP 301w
QNAP 301w is a AX WIFI router with 4 1G and 2 10G ports.

Specifications:

    •     CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz
    •     RAM: 1024MB of DDR3
    •     Storage: 4GB eMMC (contains kernel and rootfs) / 8MB NOR
          (contains art and u-boot-env)
    •     Ethernet: 4x 1G RJ45 ports + 2 10G ports (Aquantia AQR113C)
    •     WLAN:
          2.4GHz: Qualcomm QCN5024 4x4 (40 MHz) 802.11b/g/n/ax 1174 Mbps PHY rate
          5GHz: Qualcomm QCN5054 4x4 (80 MHz) or 2x2 (160 MHz) 802.11a/b/g/n/ac/ax 2402 PHY rate

    •     LEDs:
          7 x GPIO-controlled dual color LEDs + 2 GPIO-controlled single color LEDs

            • Buttons: 1x soft reset / 1x WPS
            • Power: 12V DC jack

        A poulated serial header is onboard.
        RX/TX is working, bootwait is active, secure boot is not enabled.

        SSH can be activated in the stock firmware, hold WPS button til the second beep
	(yes the router has a buzzer)
        SSH is available on port 22200, login with user admin and
	password "mac address of the router".

        Installation Instructions:

            • obtain serial access (https://openwrt.org/inbox/toh/qnap/301w#serial)
            • stop auto boot
            • setenv serverip 192.168.10.1
            • setenv ipaddr 192.168.10.10
            • tftpboot the initramfs image
              (openwrt-ipq807x-generic-qnap_301w-initramfs-fit-uImage.itb)
            • bootm

            • make sure that current_entry is set to "0":
              "fw_printenv -n current_entry" should be print "0". If not,
	       do "fw_setenv current_entry 0"
            • copy openwrt-ipq807x-generic-qnap_301w-squashfs-sysupgrade.bin
	          to the device to /tmp folder
            • sysupgrade -n /tmp/openwrt-ipq807x-generic-qnap_301w-squashfs-sysupgrade.bin
              this flashes openwrt to the first kernel and rootfs partition (mmcblk0p1 / mmcblk0p4)
            • reboot

        Note: this leaves the second kernel / rootfs parition untouched. So if you want
              to go back to stock, stop u-boot autoboot, "setenv current_entry 1" ,
	       "saveenv", "bootipq".
              Stock firmware should start from the second partition.
	      Then do a firmwareupgrade in the stock gui, that should overwrite the openwrt
	      in the first partitions

        Make 10G Aquantia phy's work:
              The aquantia phy's need a firmware to work. This can either be loaded
	      in linux with a userspace tool or in u-boot.

              I was not successfull to load the firmware in linux (aq-fw-download) but luckily there is
	      aq_load_fw available in u-boot. But first the right firmware needs to write
	      to the 0:ETHPHYFW mtd partition (it is empty on my device)

              Grab the ethphy firmware image from:
	      https://github.com/kirdesde/nbg7815_gpl/blob/master/target/linux/ipq/ipq807x_64/prebuilt_images/AQR_ethphyfw.mbn
	      and scp that to openwrt.

              Check the 0:ETHPHYFW partition number:
              cat /proc/mtd|grep "0:ETHPHYFW", should be mtd10.

              Backup the 0:ETHPHYFW partition:
              dd if=/dev/mtd10 of=/tmp/ethphyfw.backup, scp ethphyfw.backup to a save place.

              Write the new firmware image to the 0:ETHPHYFW partition:
              "mtd erase /dev/mtd10", "mtd -n write AQR_ethphyfw.mbn /dev/mtd10".

              Reboot to u-boot.

              Check if aq_load_fw is working:

              "aq_load_fw 0", that checks the firmware and if successfull,
	      loads iram and dram to one of the aquantia phy's.

              If that worked, add the aq_load_fw to the bootcmd:
              setenv bootcmd "aq_load_fw 0 && aq_load_fw 8 && bootipq"

              "saveenv"

              "reset"

              Board reboots and the firmware load to both phy's should start and
	      then openwrt boots.

              Check if the 10G ports work.

              Note: lan port labeled "10G-2" is configured as WAN port as per default.
	      All other port are in the br-lan. This can be changed in the network config.

Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
2023-01-16 12:42:23 +01:00
Dirk Buchwalder
a36fc589fe ipq807x: add Edimax CAX1800
Edimax CAX1800 is a 802.11 ax dual-band AP
with PoE. AP can be ceiling or wall mount.

Specifications:

    •     CPU: Qualcomm IPQ8070A Quad core Cortex-A53 1.4GHz
    •     RAM: 512MB of DDR3
    •     Storage: 128MB NAND (contains rootfs) / 8MB NOR (contains art and uboot-env)
    •     Ethernet: 1x 1G RJ45 port (QCA8072) PoE
    •     WLAN:
          2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate
          5GHz: Qualcomm QCN5054 2x2 802.11a/b/g/n/ac/ax 1201 PHY rate

    •     LEDs:
          3 x GPIO-controlled System-LEDs
          (form one virtual RGB System-LED)
            black_small_square  Buttons: 1x soft reset
            black_small_square  Power: 12V DC jack or PoE (802.3af )

        An unpopulated serial header is onboard.
        RX/TX is working, bootwait is active, secure boot is not enabled.

        SSH can be activated in the stock firmware, but it drops only
        to a limited shell .

        Installation Instructions:

            black_small_square obtain serial access
            black_small_square stop auto boot

            black_small_square tftpboot the initramfs image (serverip is set to 192.168.99.8 in uboot)
            black_small_square bootm

            black_small_square copy openwrt-ipq807x-generic-edimax_cax1800-squashfs-nand-factory.ubi
	      to the device
            black_small_square write the image to the NAND:
            black_small_square cat /proc/mtd and look for rootfs partition (should be mtd0)
            black_small_square ubiformat /dev/mtd0 -f -y  openwrt-ipq807x-generic-edimax_cax1800-squashfs-
              nand-factory.ubi
            black_small_square reboot

	Note: Device is not using dual partitioning (NAND contains other partitions
        with different manufacture data etc.)
	Draytek VigorAP 960C and Lancom LW-600 both look similar, but I haven't checked them.

Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
2023-01-16 12:42:23 +01:00
Zhijun You
8253cb2de5 ipq807x: add Redmi AX6
Redmi AX6 is a budget 802.11ax dual-band router/AP

Specifications:
* CPU: Qualcomm IPQ8071A Quad core Cortex-A53 1.4GHz
* RAM: 512MB of DDR3
* Storage: 128MB NAND
* Ethernet: 4x1G RJ45 ports (QCA8075)
* WLAN:
	* 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate
	* 5GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate
* LEDs:
	* System (Blue/Yellow)
	* Network (Blue/Yellow)
*Buttons: 1x soft reset
*Power: 12V DC jack

Installation instructions:

Obtaining SSH access is mandatory
https://openwrt.org/inbox/toh/xiaomi/xiaomi_redmi_ax6_ax3000#ssh_access

Installation is done by the ubiformat method, through SSH:
1. Open an SSH shell to the router
2. Copy the file openwrt-ipq807x-generic-redmi_ax6-initramfs-factory.ubi to the /tmp directory
3. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1):
nvram get flag_boot_rootfs

4. Find the rootfs and rootfs_1 mtd indexes respectively:
cat /proc/mtd
Please confirm if mtd12 and mtd13 are the correct indexes from above!

5. Use the command ubiformat to flash the opposite mtd with UBI image:

If nvram get flag_boot_rootfs returned 0:
ubiformat /dev/mtd13 -y -f /tmp/openwrt-ipq807x-generic-redmi_ax6-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit

otherwise:
ubiformat /dev/mtd12 -y -f /tmp/openwrt-ipq807x-generic-redmi_ax6-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit

6. Reboot the device by:
reboot

Previous commands flashed an ubinized OpenWrt initramfs that will serve as the intermediate step
since OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for packages.
Continue in order to pernamently flash OpenWrt:

7. SSH into OpenWrt from one of the LAN ports
8. Copy the file openwrt-ipq807x-generic-redmi_ax6-squashfs-sysupgrade.bin to the /tmp directory
9. Sysupgrade the device:
sysupgrade -n /tmp/openwrt-ipq807x-generic-redmi_ax6-squashfs-sysupgrade.bin

Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired.

Signed-off-by: Zhijun You <hujy652@gmail.com>
2023-01-16 12:42:23 +01:00
Robert Marko
8364f08164 ipq807x: add Xiaomi AX3600
Xiaomi AX3600 is a budget 802.11ax dual-band router/AP.
Specifications:
* CPU: Qualcomm IPQ8071A Quad core Cortex-A53 1.4GHz
* RAM: 512MB of DDR3
* Storage: 256MB of parallel NAND
* Ethernet: 4x1G RJ45 ports (QCA8075) with 1x status LED per port
* WLAN:
	* PCI based Qualcomm QCA9889 1x1 802.11ac Wawe 2 for IoT
	* 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate
	* 5GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate
* LED-s:
	* System (Blue and Yellow)
	* IoT (Blue)
	* Network (Blue and Yellow)
* Buttons: 1x Soft reset
* Power: 12V DC Jack

Installation instructions:

Obtaining SSH access is mandatory
https://openwrt.org/inbox/toh/xiaomi/xiaomi_ax3600#obtain_ssh_access

Installation is done by the ubiformat method, through SSH:
1. Open an SSH shell to the router
2. Copy the file openwrt-ipq807x-generic-xiaomi_ax3600-initramfs-factory.ubi to the /tmp directory
3. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1):
nvram get flag_boot_rootfs

4. Find the rootfs and rootfs_1 mtd indexes respectively:
cat /proc/mtd
Please confirm if mtd12 and mtd13 are the correct indexes from above!

5. Use the command ubiformat to flash the opposite mtd with UBI image:

If nvram get flag_boot_rootfs returned 0:
ubiformat /dev/mtd13 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax3600-initramfs-factory.ubi -s 2048 -O 2048 && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit

otherwise:
ubiformat /dev/mtd12 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax3600-initramfs-factory.ubi -s 2048 -O 2048 && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit

6. Reboot the device by:
reboot

Previous commands flashed an ubinized OpenWrt initramfs that will serve as the intermediate step
since OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for packages.
Continue in order to pernamently flash OpenWrt:

7. SSH into OpenWrt from one of the LAN ports
8. Copy the file openwrt-ipq807x-generic-xiaomi_ax3600-squashfs-sysupgrade.bin to the /tmp directory
9. Sysupgrade the device:
sysupgrade -n /tmp/openwrt-ipq807x-generic-xiaomi_ax3600-squashfs-sysupgrade.bin

Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Signed-off-by: Robert Marko <robimarko@gmail.com>
2023-01-16 12:42:23 +01:00