This patch adds support for Cisco Meraki MR32.
The unit was donated by Chris Blake. Thank you!
WARNING:
Only the 1x1:1 abgn Air Marshal WIPS wifi is currently supported by b43:
b43-phy2: Found PHY: Analog 9, Type 4 (N), Revision 16
b43-phy2: Found Radio: Manuf 0x17F, ID 0x2057, Revision 9, Version 1
b43-phy2: Loading firmware version 784.2 (2012-08-15 21:35:19)
and only as 802.11ABG!
while WIFI1 and WIFI2 (both BCM4352) are not:
b43-phy0: Broadcom 4352 WLAN found (core revision 42)
b43-phy0 ERROR: FOUND UNSUPPORTED PHY (Analog 12, Type 11 (AC), Revision 1)
Hardware Highlights:
SoC: Broadcom BCM53016A1 (1 GHz, 2 cores)
RAM: 128 MiB
NAND: 128 MiB Spansion S34ML01G2 (~114 MiB useable)
ETH: 1GBit Ethernet Port - PoE
WIFI1: Broadcom BCM43520 an+ac (2x2:2 - id: 0x4352)
WIFI2: Broadcom BCM43520 bgn (2x2:2 - id: 0x4352)
WIFI3: Broadcom BCM43428 abgn (1x1:1 - id: 43428)
BLE: Broadcom BCM20732 (ttyS1)
LEDS: 1 x Programmable RGB Status LED (driven by a PWM)
1 x White LED (GPIO)
1 x Orange LED Fault Indicator (GPIO)
2 x LAN Activity / Speed LEDs (On the RJ45 Port)
BUTTON: one Reset button
MISC: AT24C64 8KiB EEPROM (i2c - stores Ethernet MAC + Serial#!)
ina219 hardware monitor (i2c)
Kensington Lock
SERIAL:
WARNING: The serial port needs a TTL/RS-232 3V3 level converter!
The Serial setting is 115200-8-N-1. The board has a populated
right angle 1x4 0.1" pinheader.
The pinout is: VCC, RX, TX, GND. (Use a multimeter)
Flashing needs a serial adaptor (due to the lack of a working dropbear on
the original firmware).
This flashing procedure for the MR32 was tested with firmware:
"r23-149867:150252-aacharya".
0. Create a seperate Ethernet LAN which does not have access to the internet.
Ideally use 192.168.1.2 for your PC. Make sure to reserve 192.168.1.1 it
will be used later on by the OpenWrt firmware. The original Meraki firmware
will likely try to setup the network via DHCP Discovery, so make sure your
PC is running a DHCP-Server (i.e.: dnsmasq)
'# dnsmasq -i eth# -F 192.168.1.5,192.168.1.50
Furthermore, the PC needs a supported ssh/http/ftp server in order to
retrieve the initramfs + dtb file
1. Disassemble the MR32 device by removing all screws (4 screws are located
under the 4 rubber feets!) and prying open the plastic covers without
breaking the plastic retention clips. Once inside, remove all the screws
on the outer metal shielding to get to the PCB. It's not necessary to
remove the antennas!
2. Connect the serial cable to the serial header.
3. Partially reassemble the outer metal shielding to ensure that the SoC
has a proper heat sink.
4. Connect the Ethernet patch cable to the device and the power cable.
5. Wait for the device to boot and enter the root shell.
(rooting is not discussed in detail here please refer to
Chris Blake - "pwning the meraki mr18" blog post:
<https://servernetworktech.com/2016/02/pwning-the-meraki-mr18/>
(The same method works with the MR32's r23-149867:150252-aacharya)
Wait for the MR32 to enter the "<Meraki>" prompt and enter:
<Meraki> odm serial_num read
(Verify that it matches what's on the S/N Sticker on the back!)
<Meraki> odm serial_num write Q2XX-XXXX-XXXV
<Meraki> odm serial_num read
(Verify that the S/N has changed - and the LED start to flash)
now to flash the firmware:
<Meraki> odm firmware part.safe "http://192.168.1.2/mr32-initramfs.bin"
Once OpenWrt booted use sysupgrade to permanently install
OpenWrt. To do this: Download the latest sysupgrade.bin file
for the MR32 to the device and use sysupgrade *sysupgrade.bin
to install it.
WARNING: DO NOT DELETE the "storage" ubi volume!
To flash later MR32 Firmwares like r25-201804051805-G885d6d78-dhow-rel
requires in-circut-i2c tools to access the I2C EEPROM AT24C64 next to
the SoC. The idea is pretty much the same as from Step 5 from above:
Change the serial number to Q2XXXXXXXXXV (should be around 0x7c), then
attach a serial cable, ethernet (but make sure the device can't reach
the internet!) hit "s" (the small s!) during boot to enter the root-shell
and add the following commands to the /storage/config there:
serial_allow_odm true
serial_access_enabled true
serial_access_check false
valid_config true
and then hit exit to let it finish booting.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
The BCM5301x SoCs do have i2c. Since this is only
being used by the Meraki MR32, this will be packaged
as a module.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
These have made their way into -next. This patch
also includes the portion of the bcm53xx kernel
patch refreshes as the hunks in
302-ARM-dts-BCM5301X-Update-Northstar-pinctrl-binding.patch
moved slightly due to the added nodes.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
The Meraki MR32 (BCM53016A1) uses the pwm to drive the
tricolor LED. The driver has been available in upstream
for a long time. Only the Device-Tree definition was
missing, but it has been queued recently.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
As the PWM has its own sub-system in the Linux kernel,
I think it should be handled in the same way as GPIO, RTC, PCI...
This patch introduces a specific feature flag "pwm" and the
"leds-pwm" kernel module as the first customer.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Some bootloaders are really keen on just one special
fdt in a multi-image fit image. This is a problem, because
currently this is fixed to "fdt@1".
This patch introduces a new device variable:
DEVICE_FDT_NUM that allows to specify the right
fdt number.
If the value is absent "1" will be chosen.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
The Linksys MR8300 is based on QCA4019 and QCA9888
and provides three, independent radios.
NAND provides two, alternate kernel/firmware images
with fail-over provided by the OEM U-Boot.
Hardware Highlights:
SoC: IPQ4019 at 717 MHz (4 CPUs)
RAM: 512MB RAM
SoC: Qualcomm IPQ4019 at 717 MHz (4 CPUs)
RAM: 512M DDR3
FLASH: 256 MB NAND (Winbond W29N02GV, 8-bit parallel)
ETH: Qualcomm QCA8075 (4x GigE LAN, 1x GigE Internet Ethernet Jacks)
BTN: Reset and WPS
USB: USB3.0, single port on rear with LED
SERIAL: Serial pads internal (unpopulated)
LED: Four status lights on top + USB LED
WIFI1: 2x2:2 QCA4019 2.4 GHz radio on ch. 1-14
WIFI2: 2x2:2 QCA4019 5 GHz radio on ch. 36-64
WIFI3: 2x2:2 QCA9888 5 GHz radio on ch. 100-165
Support is based on the already supported EA8300.
Key differences:
EA8300 has 256MB RAM where MR8300 has 512MB RAM.
MR8300 has a revised top panel LED setup.
Installation:
"Factory" images may be installed directly through the OEM GUI using
URL: https://ip-of-router/fwupdate.html (Typically 192.168.1.1)
Signed-off-by: Hans Geiblinger <cybrnook2002@yahoo.com>
[copied Hardware-highlights from EA8300. Fixed alphabetical order.
fixed commit subject, removed bogus unit-address of keys,
fixed author (used Signed-off-By to From:) ]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Luma Home WRTQ-329ACN, also known as Luma WiFi System, is a dual-band
wireless access point.
Specification
SoC: Qualcomm Atheros IPQ4018
RAM: 256 MB DDR3
Flash: 2 MB SPI NOR
128 MB SPI NAND
WIFI: 2.4 GHz 2T2R integrated
5 GHz 2T2R integrated
Ethernet: 2x 10/100/1000 Mbps QCA8075
USB: 1x 2.0
Bluetooth: 1x 4.0 CSR8510 A10, connected to USB bus
LEDS: 16x multicolor LEDs ring, controlled by MSP430G2403 MCU
Buttons: 1x GPIO controlled
EEPROM: 16 Kbit, compatible with AT24C16
UART: row of 4 holes marked on PCB as J19, starting count from the side
of J19 marking on PCB
1. GND, 2. RX, 3. TX, 4. 3.3V
baud: 115200, parity: none, flow control: none
The device supports OTA or USB flash drive updates, unfotunately they
are signed. Until the signing key is known, the UART access is mandatory
for installation. The difficult part is disassembling the casing, there
are a lot of latches holding it together.
Teardown
Prepare three thin, but sturdy, prying tools. Place the device with back
of it facing upwards. Start with the wall having a small notch. Insert
first tool, until You'll feel resistance and keep it there. Repeat the
procedure for neighbouring walls. With applying a pressure, one edge of
the back cover should pop up. Now carefully slide one of the tools to
free the rest of the latches.
There's no need to solder pins to the UART holes, You can use hook clips,
but wiring them outside the casing, will ease debuging and recovery if
problems occur.
Installation
1. Prepare TFTP server with OpenWrt initramfs image.
2. Connect to UART port (don't connect the voltage pin).
3. Connect to LAN port.
4. Power on the device, carefully observe the console output and when
asked quickly enter the failsafe mode.
5. Invoke 'mount_root'.
6. After the overlayfs is mounted run:
fw_setenv bootdelay 3
This will allow to access U-Boot shell.
7. Reboot the device and when prompted to stop autoboot, hit any key.
8. Adjust "ipaddr" and "serverip" addresses in U-Boot environment, use
'setenv' to do that, then run following commands:
tftpboot 0x84000000 <openwrt_initramfs_image_name>
bootm 0x84000000
and wait till OpenWrt boots.
9. In OpenWrt command line run following commands:
fw_setenv openwrt "setenv mtdids nand1=spi_nand; setenv mtdparts mtdparts=spi_nand:-(ubi); ubi part ubi; ubi read 0x84000000 kernel; bootm 0x84000000"
fw_setenv bootcmd "run openwrt"
10. Transfer OpenWrt sysupgrade image to /tmp directory and flash it
with:
ubirmvol /dev/ubi0 -N ubi_rootfs
sysupgrade -v -n /tmp/<openwrt_sysupgrade_image_name>
11. After flashing, the access point will reboot to OpenWrt, then it's
ready for configuration.
Reverting to OEM firmware
1. Execute installation guide steps: 1, 2, 3, 7, 8.
2. In OpenWrt command line run following commands:
ubirmvol /dev/ubi0 -N rootfs_data
ubirmvol /dev/ubi0 -N rootfs
ubirmvol /dev/ubi0 -N kernel
ubirename /dev/ubi0 kernel1 kernel ubi_rootfs1 ubi_rootfs
ubimkvol /dev/ubi0 -S 34 -N kernel1
ubimkvol /dev/ubi0 -S 320 -N ubi_rootfs1
ubimkvol /dev/ubi0 -S 264 -N rootfs_data
fw_setenv bootcmd bootipq
3. Reboot.
Known issues
The LEDs ring doesn't have any dedicated driver or application to control
it, the only available option atm is to manipulate it with 'i2cset'
command. The default action after applying power to device is spinning
blue light. This light will stay active at all time. To disable it
install 'i2c-tools' with opkg and run:
i2cset -y 2 0x48 3 1 0 0 i
The light will stay off until next cold boot.
Additional information
After completing 5. step from installation guide, one can disable asking
for root password on OEM firmware by running:
sed -e 's/root❌/root::/' -i /etc/passwd
This is useful for investigating the OEM firmware. One can look
at the communication between the stock firmware and the vendor's
cloud servers or as a way of making a backup of both flash chips.
The root password seems to be constant across all sold devices.
This is output of 'led_ctl' from OEM firmware to illustrate
possibilities of LEDs ring:
Usage: led_ctl [status | upgrade | force_upgrade | version]
led_ctl solid COLOR <brightness>
led_ctl single COLOR INDEX <brightness 0 - 15>
led_ctl spinning COLOR <period 1 - 16 (lower = faster)>
led_ctl fill COLOR <period 1 - 16 (lower = faster)>
( default is 5 )
led_ctl flashing COLOR <on dur 1 - 128> <off dur 1 - 128>
(default is 34) ( default is 34 )
led_ctl pulsing COLOR
COLOR: red, green, blue, yellow, purple, cyan, white
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
[squash "ipq-wifi: add BDFs for Luma Home WRTQ-329ACN" into commit,
changed ubi volumes for easier integration, slightly reworded
commit message, changed ubi volume layout to use standard names all
around]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
It should return false to indicate that the option should not be ignored
Fixes 064dc1e8 ("dnsmasq: abort when dnssec requested but not
available")
Reported-by: Sami Olmari <sami@olmari.fi>
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
The TFTP server provided by dnsmasq supports serving a select boot image
based on the client's MAC or IP address. This allows an administrator
to activate this feature in /etc/config/dhcp. Here is an example
/etc/config/dhcp that configures dnsmasq with --tftp-unique-root=mac:
...
config dnsmasq
option enable_tftp 1
option tftp_root /usr/libexec/tftpboot
option tftp_unique_root mac
config boot router
option serveraddress 192.168.1.1
option servername tftp.example.com
option filename openwrt-initramfs-kernel.bin
...
With this configuration, dnsmasq will serve
/usr/libexec/tftpboot/00-11-22-33-44-55/openwrt-initramfs-kernel.bin to
the client with MAC address 00:11:22:33:44:55.
Signed-off-by: W. Michael Petullo <mike@flyn.org>
All modifications made by update_kernel.sh
Build system: x86_64
Build-tested: ipq806x, lantiq/xrx200 and ath79/generic
Run-tested: ipq806x (R7800), lantiq (Easybox 904 xDSL)
No dmesg regressions, everything functional
Signed-off-by: John Audia <graysky@archlinux.us>
[add test on lantiq]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Add config options:
srcportmin/srcportmax : range of port numbers to use as UDP source ports
to communicate to the remote VXLAN tunnel endpoint
ageing : lifetime in seconds of FDB entries learnt by the kernel
maxaddress : maximum number of FDB entries
learning : enable/disable entering unknown source link layer addresses
and IP addresses into the VXLAN device FDB.
rsc : enable/disable route short circuit
proxy : enable/disable ARP proxy
l2miss : enable/disable netlink LLADDR miss notifications
l3miss : enable/disable netlink IP ADDR miss notifications
gbp : enable/disable the Group Policy extension
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
This submission relied heavily on the work of
Santiago Rodriguez-Papa <contact at rodsan.dev>
Specifications:
* SoC: MediaTek MT7621A (880 MHz 2c/4t)
* RAM: Winbond W632GG6MB-12 (256M DDR3-1600)
* Flash: Winbond W29N01HVSINA (128M NAND)
* Eth: MediaTek MT7621A (10/100/1000 Mbps x5)
* Radio: MT7603E/MT7615N (2.4 GHz & 5 GHz)
4 antennae: 1 internal and 3 non-deatachable
* USB: 3.0 (x1)
* LEDs:
White (x1 logo)
Green (x6 eth + wps)
Orange (x5, hardware-bound)
* Buttons:
Reset (x1)
WPS (x1)
Installation:
Flash factory image through GUI.
This might fail due to the A/B nature of this device. When flashing, OEM
firmware writes over the non-booted partition. If booted from 'A',
flashing over 'B' won't work. To get around this, you should flash the
OEM image over itself. This will then boot the router from 'B' and
allow you to flash OpenWRT without problems.
Reverting to factory firmware:
Hard-reset the router three times to force it to boot from 'B.' This is
where the stock firmware resides. To remove any traces of OpenWRT from
your router simply flash the OEM image at this point.
Signed-off-by: J. Scott Heppler <shep971@centurylink.net>
SPDX moved from GPL-2.0 to GPL-2.0-only and from GPL-2.0+ to
GPL-2.0-or-later. Reflect that in the SPDX license headers.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
SPDX moved from GPL-2.0 to GPL-2.0-only and from GPL-2.0+ to
GPL-2.0-or-later. Reflect that in the SPDX license headers.
Signed-off-by: Paul Spooren <mail@aparcar.org>
[adjust commit title, update remaining files]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The legacy ar71xx target is removed and multiple targets use DTS now, so
there is no need to point that out for ATH79 specifically.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Make the BSSID and SSID fields optional when configuring a neighbor
report into hostapd.
Both options can now be an empty string. For the BSSID, the first 6 byte
are copied from the neighbor report. For the SSID, the SSID for the
affected hostapd BSS is used.
Signed-off-by: David Bauer <mail@david-bauer.net>
Rafal Milecki pointed out that ubus events are meant for low-level ubus
events only (e.g. addition or removal of an object). Higher level
events should happen as notifications on the ubus object itself.
Dispatch BSS events on the main hostapd ubus object instead of
publishing them as ubus events.
Signed-off-by: David Bauer <mail@david-bauer.net>
bluetooth on mt7622 needs a firmware to start. It can't be built-in or
it tries to load firmware before rootfs is mounted, and then fails.
build it as a kernel module to fix that.
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
hostapd will emit a ubus event with the eventname hostapd.<ifname>.<event>
when adding, removing or reloading a BSS.
This way, services which install state (for example the RMM neighbor
list) can on-demand reinstall this information for the BSS without
polling this state.
Signed-off-by: David Bauer <mail@david-bauer.net>
UCI defaults scripts are supposed to be numbered, but odhcpd's lacked numbering, which
turned out to mess up my custom scripts numbered 9[0-9]_*. The idea is to have high number
(custom) scripts executed last. Jow confirmed numbering is the default case, not the
exception (thanks).
Signed-off-by: Stijn Segers <foss@volatilesystems.org>
Instead of vaguely describing dependencies in the package description
actually split-up into individual packages, each with their
dependencies expressed accurately.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Split utility packages similar to coreutils in packages feed, adding
ALTERNATIVES for those which are also provided by busybox-selinux.
Also add missing license information.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
When the nulldata frame was acked, the probe send count needs to be reset,
otherwise it will keep increasing until the connection is considered dead,
even though it fine.
Reported-by: Georgi Valkov <gvalkov@abv.bg>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The required BusyBox applets are enabled by default, so we can rely on them
being present in the system. This way, we make sure there are no conflicts
with less featured variants of these same applets which might also be
present in the system.
Fixes: 0bd7dfa3ed ("zram-swap: enable swap discard")
Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
[wrap commit description]
Signed-off-by: David Bauer <mail@david-bauer.net>
Some 5GHz wifi interfaces, especially in Tri-band routers, can't use
channel 36. In these cases, the default configuration for 5GHz
interfaces, once enabled, doesn't work.
This patch selects the first non-disabled channel for 5GHz interfaces.
Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
It turns out that 'echo -e' isn't portable; it doesn't work in the dash
builtin echo and Ubuntu users are complaining.
I can't even get octal (specified by POSIX) to work consistently because
those variants of 'echo' which *do* support -e don't seem to interpret
octalwithout it.
I could switch to /bin/echo but using -e with that isn't actually
portable *either* even though it works today.
For now just stick with bash, and use its builtin. We may end up using
something else entirely; perhaps perl.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
We want to be able to make full system images for this system too, just
as we now can for the MT7623 platforms.
The package directory (mt7623n) is now a bit misnamed as it's overly
specific, but the precise set of platforms which we support this way
is evolving and we'll fix it up when the dust settles and we know what
nomenclature makes most sense.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
This fixes several stylistic and functional errors of the recently
added Edgecore ECW5410:
- fix call in 11-ath10k-caldata
- use hex notation in 11-ath10k-caldata
- remove redundant definitions from DTS that are already in DTSI
- use proper sorting in image/Makefile
- use DEVICE_VENDOR/DEVICE_MODEL instead of DEVICE_TITLE
- use SOC instead of DEVICE_DTS
Fixes: 59f0a0fd83 ("ipq806x: add Edgecore ECW5410 support")
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
All modifications made by update_kernel.sh/no manual intervention needed
Run-tested: ipq806x (R7800), ath79 (Archer C7v5), x86/64
No dmesg regressions, everything appears functional
Signed-off-by: John Audia <graysky@archlinux.us>
[add run test from PR]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This bug applied where mtd partition end address,
or erase start address, was not cleanly divisible by parent mtd erasesize.
This error would cause the bits following the end of the partition
to the next erasesize block boundary to be erased,
and this partition-overflow data to be written to the partition erase
address (missing additional partition offset address)
of the mtd (top) parent device.
Fixes: FS#2428
Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au>
Tested-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
[shorten commit title, add Fixes, fix kernel 4.19 as well]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Update to current head of the branch A3700_utils-armada-18.12-fixed:
0967979 ddr: Add DDR3 2CS layout for EspressoBin v5 2GB board
486523e ddr: fix typo for ESPRESSObin 2GB layout
490b2b3 TBB: Fix building for Crypto++ 6.0 and later
0141dd1 TBB: Split INCDIR from LIBDIR
Signed-off-by: Andre Heider <a.heider@gmail.com>
Lift the dependency on the build order, where flash-image.bin may be missing
from the u-boot dir.
While at it, also install the uart images for rescue purposes.
Signed-off-by: Andre Heider <a.heider@gmail.com>
