removed redundant eeprom partition nodes from
cn7130_ubnt_edgerouter-4.dts and cn7130_ubnt_edgerouter-6p.dts
as they are identically defined in cn7130_ubnt_edgerouter-e300.dtsi.
Signed-off-by: Carsten Spieß <mail@carsten-spiess.de>
(integrated eeprom referenced node in the .dtsi)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit 700f11aaad)
The MAC addresses should be read from 3rd MTD partition,
but only two MTD partitions are populated.
To fix it, a partitions node has to surround the partition
nodes in device tree.
Tested with Edgerouter 6P
Signed-off-by: Carsten Spieß <mail@carsten-spiess.de>
(fixed checkpatch complains)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit 2b1d7965c7)
LEDs on Edgerouter 6P didn't work correctly:
blue /white LED swapped, on/off state inverted
Fixed in device tree:
swap the GPIO ports for power:blue and power:white LEDs
change LED activity from LOW to HIGH
Tested on Edgerouter 6P
Signed-off-by: Carsten Spieß <mail@carsten-spiess.de>
(cherry picked from commit 9009672930)
Some device recipes remove default target packages. If user tries to add
them back they will be ignored, since packages list is processed in one
go. Process the device recipe packages first and do user ones later, so
additions won't get filtered out.
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
(cherry picked from commit e40b9a7fa0)
'help' target fails not finding a file, so follow up on a change[2] made
as a fix for main README[1].
1. d0113711a3 ("README: port to 21st century")
2. 751486b31f ("build: fix README.md reference after rename")
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
(cherry picked from commit 2d5f7035cf)
(cherry picked from commit e9911f10e4)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Instead of loading the whole image into the memory when generating the
sha256 sum, we load the file in chunks and update the hash incrementally
to avoid MemoryError in python. Also remove a stray empty line.
Fixes: #13056
Signed-off-by: Adones Pitogo <pitogo.adones@gmail.com>
(mention empty line removal, adds Fixes from PR)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit bdb4b78210)
there's a new symbol NVMEM_IMX_OCOTP_ELE that needs to be defined.
otherwise the build will fail:
| i.MX On-Chip OTP Controller support (NVMEM_IMX_OCOTP_ELE) [N/m/y/?] (NEW)
| make[6]: *** [scripts/kconfig/Makefile:77: syncconfig] Error 1
| make[5]: *** [Makefile:628: syncconfig] Error 2
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
DT overlays do not need relocation in order to be applied, so drop
defining the load address for dtbos.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit cff3786bd5)
The side-effect and main motivation is to also drop the FIT structure size
limit because with multiple device tree overlays it may easily grow beyond
the previous 4kB limit in the future.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 98e3f82c3f)
The PHY driver now uses regmap created from pio syscon, we no longer
need the boottrap device.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit f321a49fd5)
Backport in-SoC Gigabit Ethernet PHY driver instead of carrying the
driver in files-5.15.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 9fac590096)
The PHY driver needs to read a register containing the values of the
bootstrap pins (which happen to be the PHY LEDs) to determine the LED
polarities. Allow regmap access to first pinctrl bank by adding the
'syscon' compatible, and reference the pinctrl in the MDIO bus where
the PHY driver will look for it.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 1f1e0b1144)
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: W25N01GVZEIG 128MB
RAM: NT5CB128M16JR-FL 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, WPS
Power: DC 12V 1A
Flash instructions:
1. PC run command: "telnet 192.168.124.1 99"
Username: H3C, password is the web login
password of the router.
2. Download preloader.bin and bl31-uboot.fip
3. PC run command: "python3 -m http.server 80"
4. Download files in the telnet window:
"wget http://192.168.124.xx/xxx.bin"
Replace xx with your PC's IP and
the preloader.bin and bl31-uboot.fip.
5. Flushing openwrt's uboot:
"mtd write xxx-preloader.bin BL2"
"mtd write xxx-bl31-uboot.fip FIP"
6. Connect to the router via the Lan port,
set a static ip of your PC.
(ip 192.168.1.254, gateway 192.168.1.1)
7. Download initramfs image, reboot router,
waiting for tftp recovery to complete.
8. After openwrt boots up, perform sysupgrade.
Note:
1. The u-boot-env partition on mtd is empty,
OEM stores their env on ubi:u-boot-env.
2. Back up all mtd partitions before flashing.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
(cherry picked from commit e78d1a06c8)
The OEM uboot limit brush into 3rd-party firmware.
So add a custom uboot build to support openwrt.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
(cherry picked from commit 437e79ad6d)
Netgear EX6250v2, EX6400v3, EX6410v2, EX6470 are wall-plug 802.11ac
(Wi-Fi 5) extenders. Like other MT7629 devices, Wi-Fi does not work
currently as there is no driver.
Related: https://github.com/openwrt/openwrt/pull/5084
For future reference, 2.4GHz MAC = LAN+1, 5GHz MAC = LAN+2.
Specifications:
* MT7629, 256 MiB RAM, 16 MiB SPI NOR
* MT7761N (2.4GHz) / MT7762N (5GHz) - no driver
* Ethernet: 1 port 10/100/1000
* UART: 115200 baud (labeled on board)
Installation:
* Flash the factory image through the stock web interface, or TFTP to
the bootloader. NMRP can be used to TFTP without opening the case.
* After installation, perform a factory reset. Wait for the device to
boot, then hold the reset button for 10 seconds. This is needed
because sysupgrade in the stock firmware will attempt to preserve its
configuration using sysupgrade.tgz.
See https://github.com/openwrt/openwrt/pull/4182
Revert to stock firmware:
* Flash the stock firmware to the bootloader using TFTP/NMRP.
Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
(cherry picked from commit 73de41898f)
These fields are used for EAX12 and EX6250v2 series, and perhaps other
devices. Compatibility is preserved with the WAX202 and WAX206.
In addition, adds the related vars to DEVICE_VARS so that the variables
work correctly with multiple devices.
References in GPL source:
https://www.downloads.netgear.com/files/GPL/EAX12_EAX11v2_EAX15v2_GPL_V1.0.3.34_src.tar.gz
* tools/imgencoder/src/gj_enc.c
Contains code that generates the encrypted image.
Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
(cherry picked from commit 0a1ebccc87)
Mikrotik RB951 router has a buzzer on the board, which makes annoying noises
due to the interference caused by PoE input or Wifi transmission
when no GPIO pin state is set.
I added buzzer node to device's DTS in order to set deault level to 1
and to provide easier access for it.
Signed-off-by: Pavel Pernička <pernicka.pa@gmail.com>
(cherry picked from commit dac0a133cf)
MikroTik RB951G-2HnD is a wireless SOHO router that was previously
supported by the ar71xx target, see commit 7a709573d7 ("ar71xx: add
kernel support for the Mikrotik RB951G board").
Specifications
--------------
- SoC: Atheros AR9344 (600 MHz)
- RAM: 128 MB (2x 64 MB)
- Storage: 128 MB NAND flash (various manufacturers)
- Ethernet: Atheros AR8327 switch, 5x 10/100/1000 Mbit/s
- 1x PoE in (port 1, 8-30 V input)
- Wireless: Atheros AR9340 (802.11b/g/n)
- USB: 2.0 (1A)
- 8x LED:
- 1x power (green, not configurable)
- 1x user (green, not configurable)
- 5x GE ports (green, not configurable)
- 1x wireless (green, not configurable)
- 1x button (restart)
Unlike on the RB951Ui-2HnD, none of the LEDs on this device seem to be
GPIO-controllable, which was also the case for older OpenWRT versions
that supported this board via a mach file. The Ethernet port LEDs are
controlled by the switch chip.
See https://mikrotik.com/product/RB951G-2HnD for more details.
Flashing
--------
TFTP boot initramfs image and then perform sysupgrade. Follow
common MikroTik procedures at https://openwrt.org/toh/mikrotik/common.
Signed-off-by: Michał Kępień <openwrt@kempniu.pl>
(cherry picked from commit db02cecd6a)
Mikrotik RouterBOARD 951Ui-2HnD and Mikrotik RouterBOARD RB951G-2HnD are
very similar devices. Extract the DTS bits that are identical for these
two boards to a separate DTSI file.
Signed-off-by: Michał Kępień <openwrt@kempniu.pl>
(cherry picked from commit c6ef417094)
Fixes: 4970dd027b ("bcm47xx: revert bgmac back to the old limited max frame size")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 83aeb0bbd4)
This includes some driver changes and support for fixed cells layout.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 07bdc55515)
Calling rtl822x_probe() on phy devices which uses the rtl822x_read_mmd()
and rtl822x_write_mmd() functions makes no sense and the probe ends with
an EOPNOTSUPP error.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
(cherry picked from commit 5af7d47cd7)
If a kernel package was defined where all KCONFIG symbols were dynamic,
and versioned, no FILES would be installed, as the foreach evaluation was
providing the value of the variable defined by the KCONFIG symbol name
including the version test
Fix this by calling the version_filter function on the list of KCONFIG
variable names run through by foreach
Example, kernel 6.1:
KCONFIG:=CONFIG_OLD@lt6.1 CONFIG_NEW@ge6.1
filter-out any KCONFIG settings forced by package:
CONFIG_OLD@lt6.1 CONFIG_NEW@ge6.1
there are dynamic settings, so for each of them,
get the value of the make variable defined by symbol name:
CONFIG_OLD@lt6.1 is not set
CONFIG_NEW@ge6.1 is not set
versus
CONFIG_OLD is not set
CONFIG_NEW=m
test if any of these are m, or y
if yes, install files, otherwise, nothing to install
Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au>
(cherry picked from commit b3448b3fdb)
Migrate to "new" image generation method. Device profiles will be generated
based on image/Makefile instead of profiles/ , which will also allow to
automatically build images for all supported devices via buildbot.
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
The upstream board-2.bin file in the linux-firmware.git
repository for the QCA4019 contains a packed board-2.bin
for this device for both 2.4G and 5G wifis. This isn't
something that the ath10k driver supports.
Until this feature either gets implemented - which is
very unlikely -, or the upstream boardfile is mended
(both, the original submitter and ath10k-firmware
custodian have been notified). OpenWrt will go back
and use its own bespoke boardfile. This unfortunately
means that 2.4G and on some revisions the 5G WiFi is
not available in the initramfs image for this device.
Fixes: #12886
Reported-by: Christian Heuff <christian@heuff.at>
Debugged-by: Georgios Kourachanis <geo.kourachanis@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit 75505c5ec7)
The TP-Link EAP613 v1 is a ceiling-mount 802.11ax access point. It can
be powered via PoE or a DC barrel connector (12V). Connecting to the
UART requires fine soldering and careful manipulation of any soldered
wires.
Device details:
* SoC: MT7621AT
* Flash: 16 MiB SPI NOR
* RAM: 256 MiB DDR3L
* Wi-Fi:
* MT7905DA + MT7975D: 2.4 GHz + 5 GHz (DBDC), 2x2:2
* Two stamped metal antennas (ANT1, ANT2)
* One PCB antenna (ANT3)
* One unpopulated antenna (ANT4)
* Ethernet:
* 1× 10/100/1000 Mbps port with PoE
* LEDs:
* Array of four blue LEDs with one control line
* Buttons:
* Reset
* Board test points:
* UART: next to CPU RF-shield and power circuits
* JTAG: under CPU RF-shield (untested)
* Watchdog: 3PEAK TPV706 (not implemented)
Althought three antennas are populated, the MT7905DA does not support
the additional Rx chain for background DFS detection (or Bluetooth)
according to commit 6cbcc34f50 ("ramips: disable unsupported
background radar detection").
MAC addresses:
* LAN: 48:22:54:xx:xx:a2 (device label)
* WLAN 2.4 GHz: 48:22:54:xx:xx:a2
* WLAN 5 GHz: 48:22:54:xx:xx:a3
The radio calibration blob stored in flash also contains valid MAC
addresses for both radio bands (OUI 00:0c:43).
Factory install:
1. Enable SSH on the device via web interface
2. Log in with SSH, and run `cliclientd stopcs`
3. Upload -factory.bin image via web interface. It may be necessary to
shorten the filename of the image to e.g. 'factory.bin'.
Recovery:
1. Open the device by unscrewing four screws from the backside
2. Carefully remove board from the housing
3. Connect to UART (3.3V):
* Find test points labelled "VCC", "GND", "UART_TX", "UART_RX"
* Solder wires to test points or connect otherwise. Be careful not
to damage the PCB e.g. by pulling on soldered wires.
* Open console with 115200n8 settings
4. Interrupt bootloader and use tftpboot to start an initramfs:
setenv ipaddr $DEVICE_IP
setenv serverip $SERVER_IP
tftpboot 84000000 openwrt-initramfs-kernel.bin
bootm
DO NOT use saveenv to store modified u-boot environment variables. The
environment is saved at flash offset 0x30000, which erases part of the
(secondary) bootloader.
The device uses two bootloader stages. The first stage will load the
second stage from a uImage stored at flash offset 0x10000. In case of
a damaged second stage, the first stage should allow uploading a new
image via y-modem (untested).
Signed-off-by: Sander Vanheule <sander@svanheule.net>
(cherry picked from commit 11588c52b4)
Add support for a number of new TP-Link devices.
9e2de8515be1 tplink-safeloader: add EAP610 v3 and EAP613 v1
bb12cf5c3fa9 tplink-safeloader: Add support for TP-Link Deco M5
a2d49fb1e188 tplink-safeloader: add RU support-list entry for Archer C6U v1
Signed-off-by: Sander Vanheule <sander@svanheule.net>
(cherry picked from commit 0cdcf03382)
The NETGEAR WAX220 employs NMBM on SPI-NAND. In order to avoid dealing
with invalid factory data, enable NMBM in the area preceding the UBI
volume.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 92eec257dd)
When using an Intel AX210 card, the Bluetooth hci interface failed
to start due to a missing "ibt-0041-0041.sfi" file.
Bluetooth: hci0: Failed to load Intel firmware file intel/ibt-0041-0041.sfi (-2)
A device specific configuration file (DDC) is also required:
Bluetooth: hci0: Found device firmware: intel/ibt-0041-0041.sfi
Bluetooth: hci0: Waiting for firmware download to complete
...
Bluetooth: hci0: Found Intel DDC parameters: intel/ibt-0041-0041.ddc
Bluetooth: hci0: Applying Intel DDC parameters completed
Bluetooth: hci0: Firmware timestamp 2023.13 buildtype 1 build 62562
Fixes: #8558
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(cherry picked from commit fff6833d4c)
CONFIG_FRAME_WARN value is set by config/Config-kernel.in based on the
target type dynamically since commit:
16a2051 ("kernel: Set CONFIG_FRAME_WARN depending on target").
However, CONFIG_FRAME_WARN was not set to get filtered out so it ended up
in multiple target configs during refreshes.
So, lets filter out CONFIG_FRAME_WARN as its set dynamically to prevent it
ending up in more target configs.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
(cherry picked from commit 7a9a4168bb)
This commit adds support for following wireless routers:
- Beeline SmartBox PRO (Serсomm S1500 AWI)
- WiFire S1500.NBN (Serсomm S1500 BUC)
This commit is based on this PR:
- Link: https://github.com/openwrt/openwrt/pull/4770
- Author: Maximilian Weinmann <x1@disroot.org>
The opening of this PR was agreed with author.
My changes:
- Sorting, minor changes and some movings between dts and dtsi
- Move leds to dts when possible
- Recipes for the factory image
- Update of the installation/recovery/return to stock guides
- Add reset GPIO for the pcie1
Common specification
--------------------
SoC: MediaTek MT7621AT (880 MHz, 2 cores)
Switch: MediaTek MT7530 (via SoC MT7621AT)
Wireless: 2.4 GHz, MT7602EN, b/g/n, 2x2
Wireless: 5 GHz, MT7612EN, a/n/ac, 2x2
Ethernet: 5 ports - 5×GbE (WAN, LAN1-4)
Mini PCIe: via J2 on PCB, not soldered on the board
UART: J4 -> GND[], TX, VCC(3.3V), RX
BootLoader: U-Boot SerComm/Mediatek
Beeline SmartBox PRO specification
----------------------------------
RAM (Nanya NT5CB128M16FP): 256 MiB
NAND-Flash (ESMT F59L2G81A): 256 MiB
USB ports: 2xUSB2.0
LEDs: Status (white), WPS (blue), 2g (white), 5g (white) + 10 LED Ethernet
Buttons: 2 button (reset, wps), 1 switch button (ROUT<->REP)
Power: 12 VDC, 1.5 A
PCB Sticker: 970AWI0QW00N256SMT Ver. 1.0
CSN: SG15********
MAC LAN: 94:4A:0C:**:**:**
Manufacturer's code: 0AWI0500QW1
WiFire S1500.NBN specification
------------------------------
RAM (Nanya NT5CC64M16GP): 128 MiB
NAND-Flash (ESMT F59L1G81MA): 128 MiB
USB ports: 1xUSB2.0
LEDs: Status (white), WPS (white), 2g (white), 5g (white) + 10 LED Ethernet
Buttons: 2 button (RESET, WPS)
Power: 12 VDC, 1.0 A
PCB Sticker: 970BUC0RW00N128SMT Ver. 1.0
CSN: MH16********
MAC WAN: E0:60:66:**:**:**
Manufacturer's code: 0BUC0500RW1
MAC address table (PRO)
-----------------------
use address source
LAN *:23 factory 0x1000 (label)
WAN *:24 factory $label +1
2g *:23 factory $label
5g *:25 factory $label +2
MAC addresses (NBN)
-------------------
use address source
LAN *:0e factory 0x1000
WAN *:0f LAN +1 (label)
2g *:0f LAN +1
5g *:10 LAN +2
OEM easy installation
---------------------
1. Remove all dots from the factory image filename (except the dot
before file extension)
2. Upload and update the firmware via the original web interface
3. Two options are possible after the reboot:
a. OpenWrt - that's OK, the mission accomplished
b. Stock firmware - install Stock firmware (to switch booflag from
Sercomm0 to Sercomm1) and then OpenWrt factory image.
Return to Stock
---------------
1. Change the bootflag to Sercomm1 in OpenWrt CLI and then reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock2
reboot
2. Install stock firmware via the web OEM firmware interface
Recovery
--------
Use sercomm-recovery tool.
Link: https://github.com/danitool/sercomm-recovery
Tested-by: Pavel Ivanov <pi635v@gmail.com>
Tested-by: Denis Myshaev <denis.myshaev@gmail.com>
Tested-by: Oleg Galeev <olegingaleev@gmail.com>
Tested-By: Ivan Pavlov <AuthorReflex@gmail.com>
Co-authored-by: Maximilian Weinmann <x1@disroot.org>
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
(cherry picked from commit 2d6784a033)
This commit moves a part of the code from the "sercomm-factory-cqr" recipe
to the separate "sercomm-mkhash" recipe. This simplifies recipes and
allows insert additional recipes between these code blocks (required for
the future support for Beeline SmartBox PRO router).
dd automatically fills the file by 0x00 if the filesize is less than
offset where we start writing. We drop such dd command so we need to add
--extra-padding-size 0x190 to the sercomm-pid.py call.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
(cherry picked from commit f560be583a)
This commit adds support for Mercusys MR90X(EU) v1 router.
Device specification
--------------------
SoC Type: MediaTek MT7986BLA, Cortex-A53, 64-bit
RAM: MediaTek MT7986BLA (512MB)
Flash: SPI NAND GigaDevice GD5F1GQ5UEYIGY (128 MB)
Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8)
Ethernet: 1x2.5Gbe (WAN/LAN 2.5Gbps), 3xGbE (WAN/LAN 1Gbps, LAN1, LAN2)
WLAN 2g: MediaTek MT7975N, b/g/n/ax, MIMO 4x4
WLAN 5g: MediaTek MT7975P(N), a/n/ac/ax, MIMO 4x4
LEDs: 1 orange and 1 green status LEDs, 4 green gpio-controlled
LEDs on ethernet ports
Button: 1 (Reset)
USB ports: No
Power: 12 VDC, 2 A
Connector: Barrel
Bootloader: Main U-Boot - U-Boot 2022.01-rc4. Additionally, both UBI
slots contain "seconduboot" (also U-Boot 2022.01-rc4)
Serial console (UART)
---------------------
V
+-------+-------+-------+-------+
| +3.3V | GND | TX | RX |
+---+---+-------+-------+-------+
|
+--- Don't connect
The R3 (TX line) and R6 (RX line) are absent on the PCB. You should
solder them or solder the jumpers.
Installation (UART)
-------------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
tftpboot initramfs-kernel.bin
bootm
4. Once inside OpenWrt, set / update env variables:
fw_setenv baudrate 115200
fw_setenv bootargs "ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit"
fw_setenv fdtcontroladdr 5ffc0e70
fw_setenv ipaddr 192.168.1.1
fw_setenv loadaddr 0x46000000
fw_setenv mtdids "spi-nand0=spi-nand0"
fw_setenv mtdparts "spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)"
fw_setenv netmask 255.255.255.0
fw_setenv serverip 192.168.1.2
fw_setenv stderr serial@11002000
fw_setenv stdin serial@11002000
fw_setenv stdout serial@11002000
fw_setenv tp_boot_idx 0
5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image
Installation (without UART)
---------------------------
1. Login as root via SSH (router IP, port 20001, password - your web
interface password)
2. Open for editing /etc/hotplug.d/iface/65-iptv (e.g., using WinSCP and
SSH settings from the p.1)
3. Add a newline after "#!/bin/sh":
telnetd -l /bin/login.sh
4. Save "65-iptv" file
5. Toggle "IPTV/VLAN Enable" checkbox in the router web interface and
save
6. Make sure that telnetd is running:
netstat -ltunp | grep 23
7. Login via telnet to router IP, port 23 (no username and password are
required)
8 Upload OpenWrt "initramfs-kernel.bin" to the "/tmp" folder of the
router (e.g., using WinSCP and SSH settings from the p.1)
9. Stock busybox doesn't contain ubiupdatevol command. Hence, we need to
download and upload the full version of busybox to the router. For
example, from here:
https://github.com/xerta555/Busybox-Binaries/raw/master/busybox-arm64
Upload busybox-arm64 to the /tmp dir of the router and run:
in the telnet shell:
cd /tmp
chmod a+x busybox-arm64
10. Check "initramfs-kernel.bin" size:
du -h initramfs-kernel.bin
11. Delete old and create new "kernel" volume with appropriate size
(greater than "initramfs-kernel.bin" size):
ubirmvol /dev/ubi0 -N kernel
ubimkvol /dev/ubi0 -n 1 -N kernel -s 9MiB
12. Write OpenWrt "initramfs-kernel.bin" to the flash:
./busybox-arm64 ubiupdatevol /dev/ubi0_1 /tmp/initramfs-kernel.bin
13. u-boot-env can be empty so lets create it (or overwrite it if it
already exists) with the necessary values:
fw_setenv baudrate 115200
fw_setenv bootargs "ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit"
fw_setenv fdtcontroladdr 5ffc0e70
fw_setenv ipaddr 192.168.1.1
fw_setenv loadaddr 0x46000000
fw_setenv mtdids "spi-nand0=spi-nand0"
fw_setenv mtdparts "spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)"
fw_setenv netmask 255.255.255.0
fw_setenv serverip 192.168.1.2
fw_setenv stderr serial@11002000
fw_setenv stdin serial@11002000
fw_setenv stdout serial@11002000
fw_setenv tp_boot_idx 0
14. Reboot to OpenWrt initramfs:
reboot
15. Login as root via SSH (IP 192.168.1.1, port 22)
16. Upload OpenWrt sysupgrade.bin image to the /tmp dir of the router
17. Run sysupgrade:
sysupgrade -n /tmp/sysupgrade.bin
Recovery
--------
1. Press Reset button and power on the router
2. Navigate to U-Boot recovery web server (http://192.168.1.1/) and
upload the OEM firmware
Recovery (UART)
---------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
tftpboot initramfs-kernel.bin
bootm
4. Do what you need (restore partitions from a backup, install OpenWrt
etc.)
Stock layout
------------
0x000000000000-0x000000200000 : "boot"
0x000000200000-0x000000300000 : "u-boot-env"
0x000000300000-0x000003500000 : "ubi0"
0x000003500000-0x000006700000 : "ubi1"
0x000006700000-0x000006f00000 : "userconfig"
0x000006f00000-0x000007300000 : "tp_data"
ubi0/ubi1 format
----------------
U-Boot at boot checks that all volumes are in place:
+-------------------------------+
| Volume Name: uboot Vol ID: 0|
| Volume Name: kernel Vol ID: 1|
| Volume Name: rootfs Vol ID: 2|
+-------------------------------+
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| label | 00:eb:xx:xx:xx:be | label |
| LAN | 00:eb:xx:xx:xx:be | label |
| WAN | 00:eb:xx:xx:xx:bf | label+1 |
| WLAN 2g | 00:eb:xx:xx:xx:be | label |
| WLAN 5g | 00:eb:xx:xx:xx:bd | label-1 |
+---------+-------------------+-----------+
label MAC address was found in UBI partition "tp_data", file
"default-mac". OEM wireless eeprom is also there (file
"MT7986_EEPROM.bin").
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
(cherry picked from commit e4fe3097ef)
[Fix merging conflict]
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
The ZTE MF287+ is a LTE router used (exclusively?) by the network operator
"3". The MF287 (i.e. non-plus aka 3Neo) is also supported (the only
difference is the LTE modem)
Specifications
==============
SoC: IPQ4018
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 4x GBit LAN
LTE: ZTE Cat12 (MF287+) / ZTE Cat6 (MF287)
WiFi: 802.11a/b/g/n/ac SoC-integrated
MAC addresses
=============
LAN: from config + 2
WiFi 1: from config
WiFi 2: from config + 1
Installation
============
Option 1 - TFTP
---------------
TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:
setenv serverip 192.168.1.100
setenv ipaddr 192.168.1.1
tftpboot 0x82000000 openwrt.bin
bootm 0x82000000
From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:
ubiattach -m14
cat /dev/ubi0_0 > /tmp/ubi0_0
cat /dev/ubi0_1 > /tmp/ubi0_1
Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.
Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:
ubirmvol /dev/ubi0 -N ubi_rootfs
ubirmvol /dev/ubi0 -N kernel
Option 2 - From stock firmware
------------------------------
The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.
The exploit will be available at the device wiki page.
Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".
ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd13 is the partition labelled "rootfs" by calling
"cat /proc/mtd".
Complete commands:
cd /tmp
tftp -g -r factory.bin 192.168.0.22
cat /proc/driver/sensor_id
flash_erase /dev/mtd13 0 0
dd if=/tmp/factory.bin of=/dev/mtdblock13 bs=131072
Afterwards, reboot your device and you should have a working OpenWrt
installation.
Restore Stock
=============
Option 1 - via UART
-------------------
Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.
Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.
ubiattach -m 14
ubirmvol /dev/ubi0 -N kernel
ubirmvol /dev/ubi0 -N rootfs
ubirmvol /dev/ubi0 -N rootfs_data
ubimkvol /dev/ubi0 -N kernel -s $kernel_length
ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1
Option 2 - from within OpenWrt
------------------------------
This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.
Follow the commands from Option 1 to flash back to stock.
LTE Modem
=========
The LTE modem is similar to other ZTE devices and controls some more LEDs
and battery management.
Configuring the connection using uqmi works properly, the modem
provides three serial ports and a QMI CDC ethernet interface.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
(cherry picked from commit f70ee53b08)
