Commit Graph

145 Commits

Author SHA1 Message Date
Isaev Ruslan
9ef4f7f919 qualcommax: ipq60xx: add yuncore fap650 support
This commit adds support for the Yuncore FAP650 device.

Specifications:
- Qualcomm IPQ6018+QCA8075+QCN5022+QCN5052
- 512 MB of RAM (DDR3)
- 8 MB of serial flash (SPI NOR)
- 128 MB of parallel flash (NAND)
- 2x2 2.4 GHz WiFi (IPQ6010)
- 2x2 5 GHz WiFi (IPQ6010)
- 2x 2dBi 2.4G MIMO antenna
- 2x 3dBi 5.8G MIMO antenna
- 5x 1 Gbps Ethernet (QCA8075)
- POE: 48V (IEEE 802.3af)
- power: 12V (~1.5A)
- 1x passthru port (rj45 - rj45)
- 1x cisco rj45 console port
- size: 160mm*86mm*29mm

BACKUP YOUR STOCK FIRMWARE:
```
export device=fap650
mkdir -p /tmp/fw_dump_$device
cd /tmp/fw_dump_$device
dmesg > dmesg_$device.log
dtc -I fs /sys/firmware/devicetree/base > $device.dts
cat /proc/device-tree/model > model
cat /proc/mtd > proc_mtd
while read p; do
mtd_dev=$(echo $p | cut -d: -f1)
echo $mtd_dev
dd if=/dev/$mtd_dev of=$mtd_dev
done < proc_mtd
md5sum * > md5sum.log
tar -cvzf ../$device.tar.gz .
export sum=$(md5sum /tmp/$device.tar.gz | cut -d' ' -f1)
mv ../$device.tar.gz /tmp/${device}_${sum}.tar.gz
echo fw backup saved to: /tmp/${device}_${sum}.tar.gz
```
Upload your backup via tftp to the safe place.

INSTALLATION:
1. stock firmware web ui
Rename factory.bin fw image file to factory.ubin. Flash this image
like ordinary stock fw upgrade.

2. stock firmware telnet method
Enter telnet cli (login: root, password: 476t*_f0%g09y) and upload
 factory.bin fw image and rename it to factory.ubin
`cd /tmp && wget <your_web_server_ip>/factory.ubin`
`sysupgrade factory.ubin

3. initramfs method
    Put imitramfs image to your TFTP server and rename it for example to fap650.initram
    Enable serial console and enter to the u-boot cli.
    Exec these commands:
    `tftpboot <your_tftp_server_ip>:fap650.initram`
    `dhcp`

    When downloading is finished:
    `bootm`
    After booting the device, you need to upload to the device factory.ubi fw image.
    ```
    cd /tmp && wget <your_web_server_ip>/factory.ubi`
    export rootfs=$(cat /proc/mtd | grep rootfs | cut -d: -f1)
    export rootfs_1=$(cat /proc/mtd | grep rootfs_1 | cut -d: -f1)
    ubiformat /dev/${rootfs} -y -f factory.ubi
    ubiformat /dev/${rootfs_1} -y -f factory.ubi
    reboot
    ```

4. u-boot factory.ubi image method
    Put factory.ubi to your TFTP server
    Enter u-boot cli and exec these commands:
    `tftpboot <your_tftp_server_ip>:factory.ubi`
    `dhcp`
    After downloading is finished:
    `flash rootfs`
    `flash rootfs_1`
    `reset`

STOCK FIRMWARE RECOVERY:
Boot initramfs image.
Upload your rootfs mtd partition to the device using scp or download
it from the device using wget.
Enter device ssh cli and exec:
```
cd /tmp && wget <your_web_server_ip>/rootfs_mtd`
export rootfs=$(cat /proc/mtd | grep rootfs | cut -d: -f1)
export rootfs_1=$(cat /proc/mtd | grep rootfs_1 | cut -d: -f1)
ubiformat /dev/${rootfs} -y -f /tmp/rootfs_mtd
ubiformat /dev/${rootfs_1} -y -f /tmp/rootfs_mtd
reboot
```

Signed-off-by: Isaev Ruslan <legale.legale@gmail.com>
2024-04-04 09:29:17 +02:00
Paul Spooren
c02a2db05e treewide: update PKG_MIRROR_HASH after APK version schema
With the change in version schema the downloaded files changed, too,
mostly the hash is now prefixed with a tilde `~` instead of a dash `-`.

Since each downloaded archive contains folder with the same name as the
archive, the checksum changed.

Signed-off-by: Paul Spooren <mail@aparcar.org>
2024-03-25 09:32:48 +01:00
Christian Lamparter
0671803bc5 Revert "ipq-wifi: fix upstream board-2.bin ZTE M289F snafu"
This reverts commit 75505c5ec7.
The issue has been fixed upstream.

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2024-03-09 20:00:11 +01:00
Dirk Buchwalder
93610492b6 qualcommax: ipq60xx: add support for netgear wax214
Netgear WAX214 is a 802.11 ax dual-band AP
    with PoE. (similar to Engenius EWS357APV3)

    Specifications:

        •     CPU: Qualcomm IPQ6010 Quad core Cortex-A53
        •     RAM: 512MB of DDR3
        •     Storage: 128MB NAND (Macronix MX30UF1G18AC)
        •     Ethernet: 1x 1G RJ45 port (QCA8072) PoE
        •     WIFI:
              2.4GHz: Qualcomm QCN5022 2x2 802.11b/g/n/ax 574 Mbps PHY rate
              5GHz: Qualcomm QCN5052 2x2 802.11a/b/g/n/ac/ax 1201 PHY rate

        •     LEDs:
              4 x GPIO-controlled LEDs
                - 1 Power LED (orange)
                - 1 LAN LED (blue)
                - 1 WIFI 5g LED (blue)
                - 1 WIFI 2g LED (blue)
                black_small_square  Buttons: 1x soft reset
                black_small_square  Power: 12V DC jack or PoE (802.3af )

            An populated serial header is onboard, format is
             1.25mm 4p (DF13A-4P-1.25H)
            RX/TX is working, bootwait is active, secure boot is not
            enabled.

            The root password of the stock firmware is unknown,
            but failsafe mode can be entered to reset the password.

            Installation Instructions:

                - obtain serial access
                - stop auto boot (press "4", Entr boot command line
		  interface)
                - setenv active_fw 0 (to boot from the primary rootfs,
                  or set to 1 to boot from the secondary rootfs
                  partition)
                - saveenv

                - tftpboot the initramfs image
                - bootm

                - copy
		  openwrt-qualcommax-ipq60xx-netgear_wax214-squashfs-factory.ubi
                  to the device
                - write the image to the NAND:
                   - cat /proc/mtd and look for rootfs partition (should
		     be mtd11,
                     or mtd12 if you choose active_fw 1)
                   - ubiformat /dev/mtd11 -f -y
		     openwrt-qualcommax-ipq60xx-netgear_wax214-squashfs-factory.ubi
                - reboot

            Note: the firmware is senao-based. But I was unable to build
                  a valid senao-header into the image.
                  Maybe they changed the header format and senaoFW isn't
                  working any more.

Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
2024-03-05 06:34:35 +01:00
Dirk Buchwalder
e8a2fd241d ipq-wifi: update to version 2024-03-04
The new version adds support for the Netgear WAX214.

Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
2024-03-05 06:34:35 +01:00
Paweł Owoc
c2537f3c8f ipq-wifi: update to version 2024-02-25, remove unused ipq8174 extension
fc30aee ipq8074: remove regdomain, update regdb and rename MX4200 BDF
Remove unused ipq8174 extension

Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
2024-02-25 15:04:31 +01:00
Marcin Gajda
07b9186e88 ipq40xx: Add support Netgear LBR20
**Netgear LBR20** is a router with two gigabit ethernets , three wifi radios and integrated LTE cat.18 modem.

SoC Type: Qualcomm IPQ4019
RAM: 512 MiB
Flash: 256 MiB , SLC NAND, 2 Gbit (Macronix MX30LF2G18AC)
Bootloader: U-Boot
Modem: LTE CAT.18 Quectel EG-18EA ,  Max. 1.2Gbps downlink / 150Mbps uplink

WiFi class AC2200:
- radio0 : 5G on QCA9888 , WiFi5- 802.11a/n/ac MU-MIMO 2x2 , 887Mbps , 80MHz - limited for low channels
- radio1: 2,4G on IPQ4019 ,WiFi4- 802.11b/g/n MIMO2x2 300Mbps 40Mhz
- radio2: 5G on IPQ4019 , WiFi5- 802.11a/n/ac MU-MIMO 2x2 , 887Mbps ,80Mhz - limited for high channels  (from 100 up to 165) . Becouse of DFS remember to set country before turning on.

Ethernet: 2x1GbE (WAN/LAN1, LAN2)
LEDs:  section power : green and red  , section on top (orbi) drived by TLC59208F: red, green ,blue and white
USB ports: No
Buttons:  2 Reset and SYNC(WPS)
Power: 12 VDC, 2,5 A
Connector type: Barrel

OpenWRT Installation
1. Simplest way is just do upgrade from webpage with *factory.img
2. You can also do it with standard tool for Netgear's debricking - NMPRFlash
3. Most advanced way is to open device , connect to UART console and :
- Prepare OpenWrt initramfs image in TFTP server root (server IP 192.168.1.10)
- Connect serial console (115200,8n1) to UART connector
- Connect TFTP server to RJ-45 port
- Stop in u-Boot and run u-Boot command:

> setenv serverip 192.168.1.10
> set fdt_high 0x85000000
> tftpboot 0x83000000 openwrt-ipq40xx-generic-netgear_lbr20-initramfs-zImage.itb
> bootm 0x83000000

- Login via ssh
- upload or download *sysupgrade.bin ( like wget ... or scp transfer)
-  Install image via "sysupgrade -n" (like “sysupgrade -n /tmp/openwrt-ipq40xx-generic-netgear_lbr20-squashfs-sysupgrade.bin”)

Back to Stock
- Download firmware from official Netgear's webpage , it will be *.img file after decompressing.
- Use NMRPFlash tool  ( detailed insructions on project page https://github.com/jclehner/nmrpflash )

Open the case
- Unscrew nuts and remove washers from antenna's conectors.
- There are two Torx T10 screws under the label next to antenna conectors. You have to unglue this label from left and right corner to get it
- Two parts of shell covers will slide out from eachother , you have to unglue two small rubber pads and namplate sticker on bottom to do that.
- PCB is screwed with 4Pcs of Torx T10 screws
- Before lifting up PCB remove pigtiles for LTE antennas and release them from PCB and radiator (black and white wires)
- On other side of PCB ,in left bottom corner there is already soldered with 4 pins UART connector for console. Counting from left it is  +3,3V , TX , RX ,GND (reffer to this picture: https://i.ibb.co/Pmrf9KB/20240116-103524.jpg )

BDF's files are in firmware_qca-wireless  https://github.com/openwrt/firmware_qca-wireless/ and in parallel sent to ath10k@lists.infradead.org.

Signed-off-by: Marcin Gajda <mgajda@o2.pl>
2024-02-23 19:46:23 +01:00
Robert Marko
9bd7d8b756 ipq-wifi: fix archive hash
It seems that ipq-wifi bump included and incorrect PKG_MIRROR_HASH value,
so fix it by using:
make package/firmware/ipq-wifi/check FIXUP=1

Fixes: 70fd815e57 ("qualcommax: ipq807x: add support for Linksys MX5300")
Signed-off-by: Robert Marko <robimarko@gmail.com>
2024-02-23 14:14:05 +01:00
Paweł Owoc
70fd815e57 qualcommax: ipq807x: add support for Linksys MX5300
Hardware specification:
========
SoC: Qualcomm IPQ8072A
Flash: 512MB (Winbond W29N04GZBIBA)
RAM: 1GB (2x Nanya DDR3L NT5CC256M16ER-EK)
Ethernet: 5x 10/100/1000Mbps (Qualcomm QCA8075)
WiFi1: 5GHz ac 4x4 (Qualcomm QCA9984 + Skyworks SKY85746-11) - channels 100-169
WiFi2: 5GHz ax 4x4 (Qualcomm QCN5054 + Skyworks SKY85755-11) - channels 36-64
WiFi3: 2.4GHz ax 4x4 (Qualcomm QCN5024 + Skyworks SKY8340-11)
IoT: Bluetooth 5, Zigbee and Thread (Qualcomm QCA4024 + Skyworks SE2433T-R)
IoT Flash: 4MB (Macronix MX25R3235F)
RTC: ST M41T00S
LED: 1x RGB status (NXP PCA9633)
USB: 1x USB 3.0
Button: WPS, Reset

Flash instructions:
========
1. Manually upgrade firmware using openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin image.
More details can be found here: https://www.linksys.com/hk/support-article?articleNum=274497
After first boot check actual partition:
- fw_printenv -n boot_part
and install firmware on second partition using command in case of 2:
- mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin kernel
and in case of 1:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel

2. Installation using serial connection from OEM firmware (default login: root, password: admin):
- fw_printenv -n boot_part
In case of 2:
- flash_erase /dev/mtd21 0 0
  nandwrite -p /dev/mtd21 openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin
or in case of 1:
- flash_erase /dev/mtd23 0 0
  nandwrite -p /dev/mtd23 openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin
After first boot install firmware on second partition:
- mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin kernel
or:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel

3. Installation from initramfs image using USB FAT32 formatted drive:
Stop u-boot and run:
- usb start && fatload usb 0:1 $loadaddr openwrt-qualcommax-ipq807x-linksys_mx5300-initramfs-uImage.itb && bootm $loadaddr
Write firmware to the flash from initramfs:
- mtd -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin kernel
and:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel

4. Back to the OEM firmware:
- mtd -e kernel -n write FW_MX5300_1.1.9.200251_prod.img kernel
and:
- mtd -r -e alt_kernel -n write FW_MX5300_1.1.9.200251_prod.img alt_kernel

5. USB recovery:
- fw_setenv usbimage 'openwrt-qualcommax-ipq807x-linksys_mx5300-initramfs-uImage.itb'
  fw_setenv bootusb 'usb start && fatload usb 0:1 $loadaddr $usbimage && bootm $loadaddr'
  fw_setenv bootcmd 'run bootusb; aq_load_fw && if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'

Notes:
========
IoT device is accesible over spi. Not yet supported.

Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2024-02-23 13:34:59 +01:00
Mantas Pucka
10ba730b7b ipq-wifi: add support for 8devices Mango board
Add support for .ipq6018 BDF suffix and add Mango board entry

Signed-off-by: Mantas Pucka <mantas@8devices.com>
2024-02-21 21:42:23 +01:00
Mantas Pucka
03935cf7de ipq-wifi: update to Git HEAD (2024-02-19)
1cc59e1 ipq6018: add 8devices Mango BDF
10279cc ipq40xx:Add support for Netgear LBR20 with two BDF's

Signed-off-by: Mantas Pucka <mantas@8devices.com>
2024-02-21 21:42:23 +01:00
Chukun Pan
b61ecb7d75 ipq807x: add support for CMCC RM2-6
Hardware specifications:
  SoC: Qualcomm IPQ8070A
  RAM: 512MB of DDR3
  Flash: 256MB Micron NAND
  Ethernet: 2x 1G RJ45 port
  WiFi1: QCN5024 2x2 2.4GHz
  WiFi2: QCN5054 2x2 5GHz
  Fan: 1x GPIO controlled
  Button: Reset, WPS

Flash instructions:
  Upload factory.bin in stock firmware's upgrade page.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2024-02-15 18:44:35 +01:00
Paweł Owoc
45f86a1278
ipq807x: fix whitespace usage
Replace with tab and remove unused whitespaces

Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
2024-01-15 16:52:08 +01:00
Manuel Fombuena
c7c2257f82 ipq-wifi: fix PKG_MIRROR_HASH
Incorrect PKG_MIRROR_HASH introduced on #14356

Fixes: 934873f451 ("ipq-wifi: bump version to 2024-01-06-71f45cff")
Signed-off-by: Manuel Fombuena <mfombuena@innovara.co.uk>
2024-01-08 23:58:30 +01:00
Manuel Fombuena
934873f451 ipq-wifi: bump version to 2024-01-06-71f45cff
673662f ipq8074: add Wallys DR8072V01 BDF
7e8b237 ipq40xx: add ZyXEL WSQ50 QCA4019 BDF
831c1bd ipq40xx: add ZyXEL WSQ50 QCA9984 BDF
f9ff251 ipq40xx: add ASUS MAP-AC2200 QCA9888 BDF
71f45cf ipq8074: Update MX4200 BDF

Signed-off-by: Manuel Fombuena <mfombuena@innovara.co.uk>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2024-01-08 00:07:26 +01:00
Mohammad Sayful Islam
46a2490e8f ipq807x: add support for Linksys MX4200 V1 and V2
Linksys MX4200 is a 802.11ax Tri-band router/AP.
Specifications:
* CPU: Qualcomm IPQ8174 Quad core Cortex-A53 1.4GHz
* RAM: 512MB of DDR3
* Storage: 512Mb NAND
* Ethernet: 4x1G RJ45 ports (QCA8075)
* WLAN:
	* 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate
	* 5GHz: Qualcomm QCN5054 2x2@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate
	* 5GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate
* LED-s:
	* RGB system led

* Buttons: 1x Soft reset 1x WPS
* Power: 12V DC Jack

Installation instructions:
Open Linksys Web UI - http://192.168.1.1/ca or http://10.65.1.1/ca depending on your setup.
Login with your admin password. The default password can be found on a sticker under the device.
To enter into the support mode, click on the “CA” link and the bottom of the page.
Open the “Connectivity” menu and upload the squash-factory image with the “Choose file” button.
Click start. Ignore all the prompts and warnings by click “yes” in all the popups.
The Wifi radios are turned off by default. To configure the router, you will need to connect your computer to the LAN port of the device.
Then you would need to write openwrt to the other partition for it to work
- First Check booted partition
fw_printenv -n boot_part

- Then install Openwrt to the other partition if booted in slot 1:
mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4200v(X)-squashfs-factory.bin alt_kernel

- If in slot 2:
mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4200v(X)-squashfs-factory.bin kernel

Replace (X) with your model version either 1 or 2

Signed-off-by: Mohammad Sayful Islam <sayf.mohammad01@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2024-01-06 16:13:23 +01:00
Chukun Pan
c22aa0be3e ipq807x: add support for ZTE MF269
Hardware specifications:
  SoC: Qualcomm IPQ8071A
  RAM: 512MB of DDR3
  Flash1: Eon EN25S64 8MB
  Flash2: MX30UF2G18AC 256MB
  Ethernet: 2x 2.5G RJ45 port
  Phone: 1x RJ11 port (SPI)
  USB: 1x Type-C 2.0 port
  WiFi1: QCN5024 2.4GHz
  WiFi2: QCN5054 5GHz
  Button: Reset, WPS

Flash instructions:
  1. Connect the router via serial port (115200 8N1 1.8V)
  2. Download the initramfs image, rename it to initramfs.bin,
     and host it with the tftp server.
  3. Interrupt U-Boot and run these commands:
     tftpboot initramfs.bin
     bootm
  4. After openwrt boots up, use scp or luci web
     to upload sysupgrade.bin to upgrade.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2023-12-14 10:30:19 +08:00
Chukun Pan
fbcda3616e
ipq807x: add Arcadyan AW1000 support
Hardware specification:
  SoC: Qualcomm IPQ8072A
  Flash: Toshiba NAND 1GiB
  RAM: 1 GiB of DDR3 466 MHz
  Ethernet: 4x 1Gbps + 1x 2.5Gbps
  WiFi1: QCN5024 2.4GHz ax 4x4
  WiFi2: QCN5054 5GHz ax 4x4
  Button: WiFi, WPS, Reset
  Modem: RG500Q-EA
  USB: 1 x USB 3.0
  Power: DC 12V 4A

Flash instructions:
  1. Download the initramfs image, rename it to
     initramfs.bin, and host it with tftp server.
  2. Interrupt U-Boot and run these commands:
     tftpboot initramfs.bin
     bootm
  3. After openwrt boots up, use scp or luci web
     to upload sysupgrade.bin to upgrade.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2023-12-13 17:29:15 +01:00
Christian Marangi
07b5b3978d
ipq-wifi: update to Git HEAD (2023-11-10)
0c2e810e71ed qcn9074: fix prpl Foundation Haze BDF for old mac80211 version

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-11-10 13:20:31 +01:00
Isaev Ruslan
3763a6a075
ipq807x: add support for Yuncore AX880
SPECIFICATION:
    - Chipset:  IPQ8072A +QCN5054+QCN5024+QCA8081*2
    - Flash NOR-8MB AND NAND-128MB
    - RAM 1Gb DDR
    - IEEE 802.11:  802.11ax/ac/b/g/n
    - 4*4 2.4G Wi-Fi standard   802.11b/g/n/ax
    - 4*4 5.8G Wi-Fi Standard   802.11 a/n/ac/ax
    - 2x 1 Gbps Ethernet (QCA8081) with 802.3at PoE input support
    - 1x  Reset
    - 1x  Bluetooth(optional)
    - 1x  DC Port 12V 3A
    - 4x Antenna    IPEX Connector, 3dBi omni antennas
    - Data Rate:    3657Mbps ( 2.4G: 1182Mbps (11ax 4x4); 5.8G: 2475Mbps (11ax 4x4))
    - RF Power: 2.4g ≤ 20dBm; 5.8g ≤ 19dBm
    - LED light:    Sys; 5.8G wifi; 2.4G wifi; WAN; LAN
    - Max Power Consumption:    ≤ 22W
    - Size: 198mm * 198mm * 41.02mm

BACKUP YOUR STOCK FIRMWARE:
```
export device=ax880
mkdir -p /tmp/fw_dump_$device
cd /tmp/fw_dump_$device
dmesg > dmesg_$device.log
dtc -I fs /sys/firmware/devicetree/base > $device.dts
cat /proc/device-tree/model > model
cat /proc/mtd > proc_mtd
while read p; do
mtd_dev=$(echo $p | cut -d: -f1)
echo $mtd_dev
dd if=/dev/$mtd_dev of=$mtd_dev
done < proc_mtd
md5sum * > md5sum.log
tar -cvzf ../$device.tar.gz .
export sum=$(md5sum /tmp/$device.tar.gz | cut -d' ' -f1)
mv ../$device.tar.gz /tmp/${device}_${sum}.tar.gz
echo fw backup saved to: /tmp/${device}_${sum}.tar.gz
```
Upload your backup via tftp to the safe place.

INSTALLATION:
1. stock firmware web ui
Rename factory.bin fw image file to factory.ubin. Flash this image
like ordinary stock fw upgrade.

2. stock firmware telnet method
Enter telnet cli (login: root, password: 476t*_f0%g09y) and upload
 factory.bin fw image and rename it to factory.ubin
`cd /tmp && wget <your_web_server_ip>/factory.ubin`
`sysupgrade factory.ubin

3. initramfs method
    Put openwrt-ipq807x-generic-yuncore_ax880-initramfs-uImage.itb to your
    TFTP server and rename it to ax880.initram
    Enable serial console and enter to the u-boot cli.
    Exec these commands:
    `tftpboot <your_tftp_server_ip>:ax880.initram`
    `dhcp`

    When downloading is finished:
    `bootm`
    After booting the device, you need to upload to the device factory.ubi fw image.
    ```
    cd /tmp && wget <your_web_server_ip>/factory.ubi`
    export rootfs=$(cat /proc/mtd | grep rootfs | cut -d: -f1)
    export rootfs_1=$(cat /proc/mtd | grep rootfs_1 | cut -d: -f1)
    ubiformat /dev/${rootfs} -y -f factory.ubi
    ubiformat /dev/${rootfs_1} -y -f factory.ubi
    reboot
    ```

4. u-boot factory.ubi image method
    Put openwrt-ipq807x-generic-yuncore_ax880-squashfs-factory.ubi to your
    TFTP server and rename it to ax880.ubi
    Enter u-boot cli and exec these commands:
    `tftpboot <your_tftp_server_ip>:ax880.ubi`
    `dhcp`
    After downloading is finished:
    `flash rootfs`
    `flash rootfs_1`
    `reset`

5. u-boot factory.bin method
    Put openwrt-ipq807x-generic-yuncore_ax880-squashfs-factory.bin to your
    TFTP server and rename it to ax880.bin
    Enter u-boot cli and exec these commands:
    `tftpboot <your_tftp_server_ip>:ax880.bin`
    `dhcp`
    After downloading is finished:
    `imgaddr=$fileaddr && nand device 0`
    Erase rootfs memory:
    `nand erase 0x00000000 0x03400000`
    Write rootfs:
    `nand write $fileaddr 0x00000000 $filesize`
    Erase rootfs_1 memory:
    `nand erase 0x3c00000 0x3400000`
    Write rootfs_1
    `nand write $fileaddr 0x3c00000 $filesize`
    `reset`

STOCK FIRMWARE RECOVERY:
Boot initramfs image.
Upload your rootfs mtd partition to the device using scp or download
it from the device using wget.
Enter device ssh cli and exec:
```
cd /tmp && wget <your_web_server_ip>/mtd21`
export rootfs=$(cat /proc/mtd | grep rootfs | cut -d: -f1)
export rootfs_1=$(cat /proc/mtd | grep rootfs_1 | cut -d: -f1)
ubiformat /dev/${rootfs} -y -f /tmp/mtd21
ubiformat /dev/${rootfs_1} -y -f /tmp/mtd21
reboot
```

Signed-off-by: Isaev Ruslan <legale.legale@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2023-11-09 16:52:10 +01:00
Kristian Skramstad
f9e6218b82 ipq-wifi: update to version 2023-10-12
Contains the following update:
52a1c29 ipq8074: add Netgear WAX630 Board file for Netgear WAX630. Extracted from stock (WAX630_BDF.bin) firmware and repacked.
e7701b8 ipq8074: update RegDB in new submitted BDF
cd04ab7 qcn9074: update RegDB in new submitted BDF

Signed-off-by: Kristian Skramstad <kristian+github@83.no>
2023-10-28 19:49:18 +02:00
Christian Marangi
93182ff272
ipq-wifi: improve and update instructions on how to add board files
Improve and update instructions on how to add board files and both
describe the needed step to upstream a board file or to use it locally.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-10-02 19:00:14 +02:00
Kristian Skramstad
76e419288f ipq807x: add support for Netgear WAX620
```
Specifications:
* CPU: Qualcomm IPQ8072A, SoC Version: 2.0, Quad core Cortex-A53 1.6896 GHz
* RAM: 1 GiB of DDR4 600 MHz
* Flash: NAND 2x256 MiB (Macronix MX30UF2G18AC)
* 4 RGB LEDs: Power, LAN, 2.4GHz and 5GHz
* UART: Two 4-pin unpopulated headers under the LEDs.
  Use the header closest to LED 4 and 5.
  They are marked with a white stroke.
  TX RX GND, beginning from "4". 115200n8.

Lan:
* One 100/1000/2.5GBASE-T Gigabit Ethernet (QCA8081)

Wlan:
* 4x4 in 2.4GHz: 802.11b/g/n/ax
* 4x4 in 5.0GHz: 802.11a/n/ac/ax
* OFDM and OFDMA
* Bidir and MU-MIMO
* Internal antenna 3.1/4.3 dBi (2.4GHz/5GHz)

Power:
* PoE+ 802.3at/af 25.5W
* DC 12V 2.5A
```

```
Note: The OpenWrt image is setup with DHCP and not a static IP.
1.  Download the OpenWrt initramfs image. Copy the image to a TFTP server
2.  Connect to console on the AP, and connect the LAN port to your LAN
3.  Stop auto boot to get to U-boot shell, interrupt the autoboot process by pressing '0' when prompted
4.  Set active_fw in env
    # setenv active_fw 1
5.  Transfer the initramfs image with TFTP
    # setenv serverip 192.168.1.10 (IP of TFTP server host)
    # setenv ipaddr 192.168.1.1 (IP used by the router for getting the image, must be in the same subnet as the TFTP host)
    # tftpboot openwrt-qualcommax-ipq807x-netgear_wax620-initramfs-uImage.itb
6.  Reboot and load the image
    # bootm
7.  SCP factory image to the AP
    # scp openwrt-qualcommax-ipq807x-netgear_wax620-squashfs-factory.ubi root@192.168.1.1:/tmp/
8.  Connect to device using SSH (use the LAN port)
9.  Flash squashfs-factory.ubi from within the initramfs instance of OpenWRT
    Before you flash, please check your mtd partitions where mtdX is the right mtd rootfs partition.
    # cat /proc/mtd (To check MTD partitions)
    # ubiformat /dev/mtd19 -y -f /tmp/openwrt-qualcommax-ipq807x-netgear_wax620-squashfs-factory.ubi
10. Set active_fw to 0
    # /usr/sbin/fw_setenv active_fw 0
11. Reboot the AP and your done
    # reboot
```

Signed-off-by: Kristian Skramstad <kristian+github@83.no>
2023-09-24 13:09:16 +02:00
Andreas Böhler
9c7578d560
ipq40xx: refactor ZTE MF287 series
The ZTE MF287 requires a different board calibration file for ath10k than
the ZTE MF287+. The two devices receive their own DTS, thus the device tree
is slightly refactored.

Signed-off-by: Andreas Böhler <dev@aboehler.at>
2023-09-19 11:43:36 +02:00
Chukun Pan
eb8ddf5d5c
ipq-wifi: update to version 2023-09-16
Contains following updates:

 * ipq8074: add Asus RT-AX89X BDF
 * ipq8074: update RegDB in new submitted BDF
 * ipq40xx: add YYeTs LE1 BDF
 * ipq8074: add Netgear WAX620
 * qca-wireless: ipq40xx: add BDFs for ZTE MF287
 * ipq8174: Add Linksys MX4200

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
2023-09-18 12:20:01 +02:00
Thomas Kupper
4d79a65d60 ipq807x: add support for Netgear RAX120v2
Netgear Nighthawk RAX120v2 AX WIFI router with 5 1G and 1 5G ports.

The majority of the code is based on @jewwest's PR #11830.

Specifications:
    * CPU: Qualcomm IPQ8074 Quad core Cortex-A53 2.2GHz
    * RAM: 1024MB of DDR3 (Nanya NT5CC256M16EP-EK × 2)
    * Flash: SPI-NAND 512 MiB (Winbond W29N04GZBIBA)
    * Ethernet: 4x 10/100/1000 Mbps LAN,
                1x 10/100/1000 Mbps WAN (Qualcomm QCA8075),
                1x 10/100/1000/2500/5000 Mbps LAN/WAN (Aquantia AQR111B0 PHY)
    * Wi-Fi:
        * 2.4 GHz: Qualcomm QCN5024 4x4
        * 2x 5 GHz: Qualcomm QCN5054 4x4
    * USB: 2x USB 3.0
    * LEDs: Power, 2.4GHz & 5GHz Radio, WPS, WAN, USB1 & USB2, 5G LAN
    * Keys: LEDs On/Off, Power, Reset, RFKILL, WPS
    * UART: Marked J9003 VCC TX RX GND, beginning from "1". 3.3v, 115200n8
    * Power: 19 VDC, 3.1 A

Installation:
    * Flashing OpenWrt is done in two steps:
        a) Flash *-squashfs-web-ui-factory.img from stock UI (thanks to @wangyu-).
           This writes an initramfs based OpenWrt image onto the RAX120v2
        b) From OpenWrt flash the *-squashfs-sysupgrade.bin using LuCI or the commandline

    * U-Boot allows booting an initramfs image via TFTP:
    - Set ip of your PC to 192.168.1.100
        - At the serial console interrupt boot at "Hit any key to stop autoboot:"
        - In u-boot run `tftpsrv`
        - On your PC send the OpenWrt initramfs image:

          tftp 192.168.1.1 -m binary -c put openwrt-ipq807x-generic-netgear_rax120v2-initramfs-uImage.itb

Make 5G Aquantia phy work:
    For the 5G port labeled 'lan5' to work a firmware is needed. This can be loaded in
    u-boot by writing the firmware to the correct mtd partition.

    The firmware file found in the Netgear stock firmware under /lib/firmware/ named
    'AQR-G3_v4.3.C-AQR_DNI_DR-EQ35AX8-R-prov1_ID23888_VER1311.cld' is needed and has to
    be converted to a MBN file.

    The `mkheader.py` script used here can be found in the Netgear V1.2.8.40 GPL source,
    under 'git_home/u-boot.git/tools/mkheader.py'

    Convert the CLD file to MBN using:
    $ python2 mkheader.py 0x44000000 0x13 <*.cld file> aqr_4.3.C.mbn

    This MBN file can then be flashed to the MTD partition to be used by u-boot.

    The necessary files can also be found in
        https://github.com/boretom/openwrt-fork/tree/rax120v2/aquantia-firmware

    * Write MBN file to MTD partition to be loaded automatically by u-boot:

      U-boot automatically tries to load the firmware from nand at address 0x7e00000 which
      corresponds to `/dev/mtd25` in OpenWrt.

        - find ETHPHYFW partition while running OpenWrt (expected: /dev/mtd25)

          $ fgrep -i 'ethphyfw' /proc/mtd
          mtd25: 00080000 00020000 "ethphyfw

        - copy mbn file to /tmp/ folder of the router

          $ scp aqr-v4.3.C.mbn 192.168.1.1:/tmp/

        - write mbn file to ethphyfw partition

          $ mtd write /tmp/aqr_v4.3.C.mbn /dev/mtd25

Revert to stock firmware:
    * Flash the stock firmware to the bootloader using TFTP/NMRP.

References to RAX120v2 GPL source:
    https://www.downloads.netgear.com/files/GPL/RAX120-V1.2.8.40_gpl_src.zip

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Thomas Kupper <thomas.kupper@gmail.com>
2023-08-19 17:12:46 +02:00
Christian Lamparter
75505c5ec7 ipq-wifi: fix upstream board-2.bin ZTE M289F snafu
The upstream board-2.bin file in the linux-firmware.git
repository for the QCA4019 contains a packed board-2.bin
for this device for both 2.4G and 5G wifis. This isn't
something that the ath10k driver supports.

Until this feature either gets implemented - which is
very unlikely -, or the upstream boardfile is mended
(both, the original submitter and ath10k-firmware
custodian have been notified). OpenWrt will go back
and use its own bespoke boardfile. This unfortunately
means that 2.4G and on some revisions the 5G WiFi is
not available in the initramfs image for this device.

Fixes: #12886
Reported-by: Christian Heuff <christian@heuff.at>
Debugged-by: Georgios Kourachanis <geo.kourachanis@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2023-07-04 22:06:59 +02:00
Andreas Böhler
f70ee53b08 ipq4019: add support for ZTE MF287+ aka DreiNeo
The ZTE MF287+ is a LTE router used (exclusively?) by the network operator
"3". The MF287 (i.e. non-plus aka 3Neo) is also supported (the only
difference is the LTE modem)

Specifications
==============

SoC: IPQ4018
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 4x GBit LAN
LTE: ZTE Cat12 (MF287+) / ZTE Cat6 (MF287)
WiFi: 802.11a/b/g/n/ac SoC-integrated

MAC addresses
=============

LAN: from config + 2
WiFi 1: from config
WiFi 2: from config + 1

Installation
============

Option 1 - TFTP
---------------

TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:

  setenv serverip 192.168.1.100
  setenv ipaddr 192.168.1.1
  tftpboot 0x82000000 openwrt.bin
  bootm 0x82000000

From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:

  ubiattach -m14
  cat /dev/ubi0_0 > /tmp/ubi0_0
  cat /dev/ubi0_1 > /tmp/ubi0_1

Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.

Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:

  ubirmvol /dev/ubi0 -N ubi_rootfs
  ubirmvol /dev/ubi0 -N kernel

Option 2 - From stock firmware
------------------------------

The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.

The exploit will be available at the device wiki page.

Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".

ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd13 is the partition labelled "rootfs" by calling
"cat /proc/mtd".

Complete commands:

  cd /tmp
  tftp -g -r factory.bin 192.168.0.22
  cat /proc/driver/sensor_id
  flash_erase /dev/mtd13 0 0
  dd if=/tmp/factory.bin of=/dev/mtdblock13 bs=131072

Afterwards, reboot your device and you should have a working OpenWrt
installation.

Restore Stock
=============

Option 1 - via UART
-------------------

Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.

Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.

  ubiattach -m 14
  ubirmvol /dev/ubi0 -N kernel
  ubirmvol /dev/ubi0 -N rootfs
  ubirmvol /dev/ubi0 -N rootfs_data
  ubimkvol /dev/ubi0 -N kernel -s $kernel_length
  ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
  ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
  ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1

Option 2 - from within OpenWrt
------------------------------

This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.

Follow the commands from Option 1 to flash back to stock.

LTE Modem
=========

The LTE modem is similar to other ZTE devices and controls some more LEDs
and battery management.

Configuring the connection using uqmi works properly, the modem
provides three serial ports and a QMI CDC ethernet interface.

Signed-off-by: Andreas Böhler <dev@aboehler.at>
2023-06-25 15:53:03 +02:00
Robert Marko
f02f6aaa8d
ipq807x: rename target to qualcommax
Currently, ipq807x only covers Qualcomm IPQ807x SoC-s.
However, Qualcomm also has IPQ60xx and IPQ50xx SoC-s under the AX WiSoC-s
and they share a lot of stuff with IPQ807x, especially IPQ60xx so to avoid
duplicating kernel patches and everything lets make a common target with
per SoC subtargets.

Start doing that by renaming ipq807x to qualcommax so that dependencies
on ipq807x target can be updated.

Signed-off-by: Robert Marko <robimarko@gmail.com>
2023-06-16 11:11:08 +02:00
Petr Štetiar
c2bb9f055b
ipq-wifi: update to version 2023-06-03
Contains following updates:

 * ipq8074: update RegDB in new submitted BDF
 * Revert "ipq8074: update RegDB in new submitted BDF"
 * qcn9074: update RegDB in new submitted BDF
 * ipq8074: update RegDB in new submitted BDF
 * qca-wireless: ipq40xx: add BDFs for ZTE MF287+
 * Add BDFs for prpl Foundation Haze board

Signed-off-by: Petr Štetiar <ynezz@true.cz>
2023-06-10 21:29:06 +02:00
Petr Štetiar
b6a14ef7b9
Revert "ipq-wifi: add board files for prpl Foundation Haze board"
This reverts commit 6845c53ec3.  as this
was commited by accident, its still work in progress.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
2023-06-05 11:46:37 +02:00
Petr Štetiar
5f2d81cd71
Revert "WIP: ipq-wifi: use my fork temporarily until upstreamed"
This reverts commit 1bad93c426 as this was
commited by accident, its still work in progress.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
2023-06-05 11:46:12 +02:00
Petr Štetiar
1bad93c426
WIP: ipq-wifi: use my fork temporarily until upstreamed
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2023-06-05 08:31:45 +02:00
Petr Štetiar
6845c53ec3
ipq-wifi: add board files for prpl Foundation Haze board
QSDK based factory firmware was setting following board_ids in DTS:

 ath11k_pci 0001:01:00.0: chip_id 0x0 chip_family 0x0 board_id 0xa4 soc_id 0xffffffff
 ath11k c000000.wifi1: chip_id 0x0 chip_family 0x0 board_id 0x294 soc_id 0xffffffff

Thus board-prpl_haze.qcn9074` was extracted from `bus=...qmi-board-id=164.bin`
file and `board-prpl_haze.ipq8074` from `bus=...qmi-board-id=660.bin` file.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
2023-06-05 08:31:44 +02:00
Antti Nykänen
86e7614e0d ipq-wifi: bump to latest git HEAD
0f73d32 ipq8074: update RegDB in new submitted BDF
a4cd21f ipq8074: add Compex WPQ873 BDF
c888dd0 qca-wireless: ipq40xx: Add BDFs for Eero Cento
6388ba9 ipq8074: update regdb for Netgear SXK80 BDF
77775d2 ipq8074: add Netgear SXK80

Signed-off-by: Antti Nykänen <antti.nykanen@nokia.com>
2023-05-26 13:05:02 +03:00
Christian Lamparter
8217f02a1c ipq-wifi: drop upstreamed board-2.bin
The BDFs for the:
	Aruba AP-365
	Devolo Magic 2 WiFi next
	Edgecore ECW5410
	Edgecore OAP100
	Extreme Networks WS-AP3915i
	GL.iNet GL-A1300
	GL.iNet GL-AP1300
	GL.iNet GL-S1300
	Linksys EA8300
	Linksys WHW03v2
	Nokia Wi4A AC400i
	P&W R619AC
	Pakedge WR-1
	Qxwlan E2600AC C1
	Sony NCP-HG100/Cellular
	Teltonika RUTX10
	ZTE MF18A

were upstreamed to the ath10k-firmware repository
and landed in linux-firmware.git.

Furthermore the BDFs for the:
	8devices Habanero
	8devices Jalapeno
	Qxwlan E2600AC C2

have been updated.

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2023-05-18 16:17:52 +02:00
Christian Marangi
69812bf8ed
ipq-wifi: bump to latest git HEAD
b22487d ath11k: qcn8074: Update regDb in every BDF
3add8be ath11k: ipq8074: Update regDb in every BDF
8bb6039 ath11k: ipq8074: add Netgear RAX120v2

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-04-12 12:02:57 +02:00
Christian Marangi
42a5917786
ipq-wifi: bump to latest git HEAD
ccd7e46 ipq40xx: add support for Wallystech DR40x9
2ce60e1 Revert "ipq40xx: add support for Wallystech DR40x9"
ea962ca ipq40xx: add Emplus WAP551 BDF

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-03-27 18:15:13 +02:00
Robert Marko
eb564690c9 ipq40xx: add support for Wallystech DR40x9
Adds support for the Wallys DR40x9 series boards.
They come in IPQ4019 and IPQ4029 versions.
IPQ4019/4029 only differ in that that IPQ4029 is the industrial version that is rated to higher temperatures.

Specifications are:
* CPU: Qualcomm IPQ40x9 (4x ARMv7A Cortex A7) at 716 MHz
* RAM: 512 MB
* Storage: 2MB of SPI-NOR, 128 MB of parallel NAND
* USB 3.0 TypeA port for users
* MiniPCI-E with PCI-E 2.0 link
* MiniPCI-E for LTE modems with only USB2.0 link
* 2 SIM card slots that are selected via GPIO11
* MicroSD card slot
* Ethernet: 2x GBe with 24~48V passive POE
* SFP port (Does not work, I2C and GPIO's not connected on hardware)
* DC Jack
* UART header
* WLAN: In-SoC 2x2 802.11b/g/n and 2x2 802.11a/n/ac
* 4x MMCX connectors for WLAN
* Reset button
* 8x LED-s

Installation instructions:
Connect to UART, pins are like this:
-> 3.3V | TX | RX | GND

Settings are 115200 8n1

Boot initramfs from TFTP:
tftpboot 0x84000000 openwrt-ipq40xx-generic-wallys_dr40x9-initramfs-fit-uImage.itb

bootm

Then copy the sysupgrade image to the /tmp folder and execute sysupgrade -n <image_name>

The board file binary was provided from Wallystech on March 14th 2023
including full permission to use and distribute.

Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
2023-03-21 16:38:23 +01:00
Koen Vandeputte
7699a5b1d7 ipq-wifi: bump to latest git HEAD
f9cece0 ipq40xx: add support for Wallystech DR40x9

Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
2023-03-21 16:38:23 +01:00
Alexandru Gagniuc
7801161c4b ipq807x: add support for Netgear WAX218
Netgear WAX218 is a 802.11ax AP claiming AX3600 support. It is wall
or ceiling mountable. It can be powered via PoE, or a 12 V adapter.

The board has footprints for 2.54mm UART headers. They're difficult to
solder because the GND is connected to a large copper plane. Only try
soldering if you are very skilled. Otherwise, use pogo pins.

Specifications:
---------------
    * CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz
    * RAM: 366 MB of RAM available to OS, not sure of total amount
    * Storage: Macronix MX30UF2G18AC 256MB NAND
    * Ethernet:
            * 2.5G RJ45 port (QCA8081) with PoE input
    * WLAN:
            * 2.4GHz/5GHz with 8 antennas
    * LEDs:
            * Power (Amber)
            * LAN (Blue)
            * 2G WLAN (Blue)
            * 5G WLAN (Blue)
    * Buttons:
            * 1x Factory reset
    * Power: 12V DC Jack
    * UART: Two 4-pin unpopulated headers near the LEDs
            * "J2 UART" is the CPU UART, 3.3 V level

Installation:
=============

Web UI method
-------------

Flashing OpenWRT using the vendor's Web UI is problematic on this
device. The u-boot mechanism for communicating the active rootfs is
antiquated and unreliable. Instead of setting the kernel commandline,
it relies on patching the DTS partitions of the nand node. The way
partitions are patched is incompatible with newer kernels.

Newer kernels use the SMEM partition table, which puts "rootfs" on
mtd12. The vendor's Web UI will flash to either mtd12 or mtd14. One
reliable way to boot from mtd14 and avoid boot loops is to use an
initramfs image.

 1. In the factory web UI, navigate to System Manager -> Firmware.
 2. In the "Local Firmware Upgrade" section, click Browse
 3. Navigate and select the 'web-ui-factory.fit' image
 4. Click "Upload"
 5. On the following page, click on "Proceed"

The flash proceeds at this point and the system will reboot
automatically to OpenWRT.

 6. Flash the 'nand-sysupgrade.bin' using Luci or the commandline

SSH method
----------

Enable SSH using the CLI or Web UI. The root account is locked out to
ssh, and the admin account defaults to Netgear's CLI application.
So we need to get creative:

First, make sure the device boots from the second firmware partition:

    ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \
        /usr/sbin/fw_setenv active_fw 1

Then reboot the device, and run the update:

    scp -O -o kexalgorithms=diffie-hellman-group14-sha1 \
        -o hostkeyalgorithms=ssh-rsa \
        netgear_wax218-squashfs-nand-factory.ubi \
        admin@<ipaddr>:/tmp/openwrt.ubi

    ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \
        /usr/sbin/ubiformat /dev/mtd12 -f /tmp/openwrt.ubi

    ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \
        /usr/sbin/fw_setenv active_fw 0

Now reboot the device, and it should boot into a ready-to-use OpenWRT.

Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
Tested-by: Francisco G Luna <frangonlun@gmail.com>
2023-03-20 11:40:36 -05:00
Kristjan Krušič
cd47a58b73
ipq-wifi: bump to latest git HEAD
31ff96d ipq806x: add support for Nokia Airscale AC400i
1af1df2 ath11k: ipq8074: add Netgear WAX218

Signed-off-by: Kristjan Krušič <kristjan.krusic@krusic22.com>
2023-03-19 18:02:35 +01:00
Kristjan Krušič
f574b535eb
ipq806x: add support for Nokia Airscale AC400i
Hardware
--------

SoC:    Qualcomm IPQ8065
RAM:    512 MB DDR3
Flash:  256 MB NAND (Macronix MX30UF2G18AC) (split into 2x128MB)
        4 MB SPI-NOR (Macronix MX25U3235F)
WLAN:   Qualcomm Atheros QCA9984 - 2.4Ghz
        Qualcomm Atheros QCA9984 - 5Ghz
ETH:    eth0 - POE (100Mbps in U-Boot, 1000Mbps in OpenWrt)
        eth1 - (1000Mbps in both)
        Auto-negotiation broken on both.
USB:    USB 2.0
LED:    5G, 2.4G, ETH1, ETH2, CTRL, PWR (All support green and red)
BTN:    Reset
Other:  SD card slot (non-functional)
Serial: 115200bps, near the Ethernet transformers, labeled 9X.
        Connections from the arrow to the 9X text:
		[NC] - [TXD] - [GND] - [RXD] - [NC]

Installation
------------

0. Connect to the device
Plug your computer into LAN2 (1000Mbps connection required).
If you use the LAN1/POE port, set your computer to force a 100Mbps link.

Connect to the device via TTL (Serial) 115200n8.
Locate the header (or solder pads) labeled 9X,
near the Ethernet jacks/transformers.
There should be an arrow on the other side of the header marking.
The connections should go like this:
(from the arrow to the 9X text): NC - TXD - GND - RXD - NC

1. Prepare for installation
While the AP is powering up, interrupt the startup process.
MAKE SURE TO CHECK YOUR CURRENT PARTITION!

If you see: "Current Partition is : partB" or
"Need to switch partition from partA to partB",
you have to force the device into partA mode, before continuing.
This can be done by changing the PKRstCnt to 5 and resetting the device.

setenv PKRstCnt 5
saveenv
reset

After you interrupt the startup process again,
you should see: Need to switch partition from partB to partA

You can now continue to the next step.

If you see: "Current Partition is : partA",
you can continue to the next step.

2. Prevent partition switching.
To prevent the device from switching partitions,
we are going to modify the startup command.
set bootcmd "setenv PKRstCnt 0; saveenv; bootipq"
setenv

3. First boot
Now, we have to boot the OpenWrt intifs.
The easiest way to do this is by using Tiny PXE.
You can also use the normal U-Boot tftp method.

Run "bootp" this will get an IP from the DHCP server
and possibly the firmware image.
If it doesn't download the firmware image, run "tftpboot".

Now run "bootm" to run the image.

You might see:
"ERROR: new format image overwritten - must RESET the board to recover"
this means that the image you are trying to load is too big.
Use a smaller image for the initial boot.

4. Install OpenWrt from initfs
Once you are booted into OpenWrt,
transfer the OpenWrt upgrade image and
use sysupgrade to install OpenWrt to the device.

Signed-off-by: Kristjan Krušič <kristjan.krusic@krusic22.com>
2023-03-19 18:02:34 +01:00
Christian Marangi
2e72ee1b23
ipq-wifi: bump to latest git HEAD
86180c4 ath10k-firmware: IPQ4019 hw1.0:  Rename variant to ZTE MF18A specific BDF

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-03-18 12:46:33 +01:00
Christian Marangi
880b4811c2
ipq-wifi: bump to latest git HEAD
1f35a8c ath10k-firmware: IPQ4019 hw1.0:  Add variant to Teltonika RUTX10 specific BDF
a49672f ath10k-firmware: QCA99X0 hw2.0:  Add variant to ZTE MF18A specific BDF

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-03-18 12:06:13 +01:00
Mantas Pucka
93b7f0f0ed
ipq-wifi: bump to latest git HEAD and add 8devices boards
2dae618 ipq-wifi: update 8devices Jalapeno BDF
08e92db ipq-wifi: update 8devices Habanero BDF

Signed-off-by: Mantas Pucka <mantas@8devices.com>
[ split ipq40xx changes in separate commit ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-03-17 14:35:49 +01:00
Christian Marangi
f576762814
firmware: ipq-wifi: use project branch and drop local file
Source BDF files out of project dedicated repository and drop local file
from openwrt main repository.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-03-15 16:26:57 +01:00
INAGAKI Hiroshi
f490295bf2
ipq807x: add support for Buffalo WXR-5950AX12
Buffalo WXR-5950AX12 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on
IPQ8074A.

Specification:

- SoC         : Qualcomm IPQ8074A
- RAM         : DDR3 1024 MiB (2x Nanya NT5CC256M16ER-EK)
- Flash       : RAW NAND 256 MiB (Winbond W29N02GZBIBA)
- WLAN        : 2.4/5 GHz (IPQ8074A)
- Ethernet    : 5 ports
  - WAN       : 100/1000/2500/10000 Mbps x1 (AQR113C)
  - LAN       : 100/1000/2500/10000 Mbps x1 (AQR113C),
                10/100/1000 Mbps x3 (QCA8075)
- LED/Keys    : 8x/5x
- UART        : pin header on PCB (J7)
  - assignment: 3.3V, GND, TX, RX from disc marking
  - settings  : 115200n8
- Power       : 12 VDC, 4 A

Flash instruction using initramfs image:

1. Prepare TFTP server with IP address 192.168.11.10
2. Rename OpenWrt initramfs image to "WXR-5950AX12-initramfs.uImage and
   place it to TFTP directory
3. Hold AOSS (WPS) button and power on WXR-5950AX12
4. WXR-5950AX12 downloads initramfs image from TFTP server and boots
   with it automatically
5. Upload sysupgrade image to WXR-5950AX12 and perform sysupgrade
6. Wait ~120 seconds to complete flashing

Partition layout:

0x000000000000-0x000000100000 : "0:sbl1"
0x000000100000-0x000000200000 : "0:mibib"
0x000000200000-0x000000280000 : "0:bootconfig"
0x000000280000-0x000000300000 : "0:bootconfig1"
0x000000300000-0x000000600000 : "0:qsee"
0x000000600000-0x000000900000 : "0:qsee_1"
0x000000900000-0x000000980000 : "0:devcfg"
0x000000980000-0x000000a00000 : "0:devcfg_1"
0x000000a00000-0x000000a80000 : "0:apdp"
0x000000a80000-0x000000b00000 : "0:apdp_1"
0x000000b00000-0x000000b80000 : "0:rpm"
0x000000b80000-0x000000c00000 : "0:rpm_1"
0x000000c00000-0x000000c80000 : "0:cdt"
0x000000c80000-0x000000d00000 : "0:cdt_1"
0x000000d00000-0x000000d80000 : "0:appsblenv"
0x000000d80000-0x000000e80000 : "0:appsbl"
0x000000e80000-0x000000f80000 : "0:appsbl_1"
0x000000f80000-0x000001000000 : "0:art"
0x000001000000-0x000001080000 : "0:art_1"
0x000001080000-0x000001100000 : "0:orgdata"
0x000001100000-0x000001180000 : "0:orgdata_1"
0x000001180000-0x000005180000 : "rootfs"
0x000005180000-0x000009180000 : "rootfs_recover"
0x000009180000-0x000010000000 : "user_property"

Notes:

- WXR-5950AX12 has 2x OS images on NAND flash. The 1st image is for
  normal operation and the 2nd one is for recoverying or firmware
  upgrading on stock.

- Stock U-Boot checks MD5 hashes in "fw_hash" volume in each "root*"
  partition when booting. This is just a comparation of hash strings.

  Behaviors:

  - both "fw_hash" volumes exist, hashes are rootfs == rootfs_recover
    ---> boot from rootfs

  - both "fw_hash" volumes exist, hashes are rootfs != rootfs_recover
    ---> boot from rootfs_recover

    Note: this behavior is used for firmware upgrading on stock

  - "fw_hash" volume in rootfs is missing
    ---> boot from rootfs_recover

  - "fw_hash" volume in rootfs_recover is missing
    ---> boot from rootfs

  - "fw_hash" volumes in both root* partition are missing
    ---> boot from rootfs_recover

Reverting to stock firmware:

1. Decrypt official image by buffalo-enc and remove header

   example of decryption:

   $ buffalo-enc -i wxr_5950ax12_jp_305 -o wxr_5950ax12_jp_305.dec \
                 -d -k olaffuB -O 0xc8

   example of removing header (v3.05):

   - before

   $ hexdump -n 64 -v -C wxr_5950ax12_jp_305.dec
   00000000  57 58 52 2d 35 39 35 30  41 58 31 32 5f 33 2e 30  |WXR-5950AX12_3.0|
   00000010  35 5f 31 2e 30 31 5f 4a  50 5f 6a 70 5f 71 63 61  |5_1.01_JP_jp_qca|
   00000020  0a 66 69 6c 65 6c 65 6e  3d 34 35 33 35 30 39 31  |.filelen=4535091|
   00000030  32 0a 55 42 49 23 01 00  00 00 00 00 00 00 00 00  |2.UBI#..........|
   00000040

   - after

   $ hexdump -n 64 -v -C wxr_5950ax12_jp_305.ubi
   00000000  55 42 49 23 01 00 00 00  00 00 00 00 00 00 00 00  |UBI#............|
   00000010  00 00 08 00 00 00 10 00  78 cf c4 91 00 00 00 00  |........x.......|
   00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
   00000030  00 00 00 00 00 00 00 00  00 00 00 00 3d 2a 64 fd  |............=*d.|
   00000040

2. Boot WXR-5950AX12 with OpenWrt initramfs image

3. Upload modified stock image to WXR-5950AX12

4. Find partitions "rootfs" and "rootfs_recover"

   example:

   root@OpenWrt:/# cat /proc/mtd
   dev:    size   erasesize  name
   ...
   mtd22: 04000000 00020000 "rootfs"
   mtd23: 04000000 00020000 "rootfs_recover"
   ...

   in this case, "rootfs" is mtd22 and "rootfs_recover" is mtd23

5. Format "rootfs"/"rootfs_recover" partition with the uploaded image

   example:

   ubiformat /dev/mtd22 -f /tmp/wxr_5950ax12_jp_305.ubi
   ubiformat /dev/mtd23 -f /tmp/wxr_5950ax12_jp_305.ubi

6. Remove "rootfs"/"rootfs_data" volume from user_property partition

   example:

   . /lib/upgrade/nand.sh
   UBI=$(nand_attach_ubi user_property)
   ubirmvol /dev/$UBI -N rootfs
   ubirmvol /dev/$UBI -N rootfs_data

7. Reboot

MAC addresses:

LAN    : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text))
WAN    : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text))
2.4 GHz: 50:C4:DD:xx:xx:30 (0:APPSBLENV, wlan0addr (text))
5 GHz  : 50:C4:DD:xx:xx:38 (0:APPSBLENV, wlan1addr (text))

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2023-02-12 01:18:39 +01:00
André Valentin
5dee596501
ipq807x: Add ZyXEL NBG7815
ZyXEL NBG7815 is a premium 802.11ax "tri"-band router/AP.
Specifications:
* CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz
* RAM: 1 GB 2x Nanya NT5CC256M16ER-EK
* Storage:
        * 8MB serial flash Winbond W25Q64DW
        * 4GB eMMC flash Kingston EMMC04G-M627
* Ethernet:
        * 4x1G RJ45 ports (QCA8074A) with 1x status LED per port
        * 1x2.5G RJ45 port (QCA8081) with 1x status LED
        * 1x10G RJ45 port (AQR113C) with 1x status LED
* Switch: Qualcomm Atheros QCA8075
* WLAN:
        * 2.4GHz: Qualcomm QCN5024 4x4@40MHz 802.11b/g/n/ax 1147 Mbps PHY rate
        * 2x 5GHz: Qualcomm QCN5054 4x4 802.11a/b/g/n/ac/ax 2402 PHY rate
* Bluetooth CSR8811 using HSUART, currently unsupported
* USB: 1x USB3.0 Type-A port
* LED-s currently not supported:
        * White
        * Dark Blu
        * Amber
        * Purple
        * Purple and dark blue
        * Red
* Buttons:
        * 1x Soft reset
* Power: 12V DC Jack

Installation instructions:
* Disconnect WAN
* Reset device to factory defaults by pushing reset button 15 sec,
  LEDs should lit orange color.
* After 5-10 minutes, when the LEDs turn constant dark blue,
  put your LAN cable and connect at address 192.168.123.1 by telnet on port 23
* Login with
  NBG7815 login: root
  password: nbg7815@2019
* cd /tmp/ApplicationData
* wget -O openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin http://...
* wget https://github.com/itorK/nbg7815_tools/blob/main/flash_to_openwrt.sh
* run flash_to_openwrt.sh
If you can't use wget, you can transfer the files via nc.
See https://openwrt.org/inbox/toh/zyxel/nbg7815_armor_g5 for installation details.

Bluetooth usage:
* you need at least package bluez-utils, recommended bluez-daemon
* run following commands to enable and start
  hciattach  /dev/ttyMSM1 bcsp
  hciconfig hci0 up

Many thanks to itorK for his work on this device:
https://github.com/itorK/openwrt/tree/nbg7815

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: André Valentin <avalentin@marcant.net>
2023-01-19 13:26:15 +01:00
Dirk Buchwalder
26c095cb4d ipq807x: add Dynalink DL-WRX36
Dynalink DL-WRX36 is a AX WIFI router with 4 1G and 1 2.5G ports.

Specifications:

    •     CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz
    •     RAM: 1024MB of DDR3
    •     Storage: 256MB Nand
    •     Ethernet: 4x 1G RJ45 ports (QCA8075) + 1 2.5G Port (QCA8081)
    •     WLAN:
          2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 1174 Mbps PHY rate
          5GHz: Qualcomm QCN5054 4x4 802.11a/b/g/n/ac/ax 2402 PHY rate
    •     1x USB 3.0

    •     1 gpio-controlled dual color led (blue/red)

            • Buttons: 1x soft reset / 1x WPS
            • Power: 12V DC jack

        A poulated serial header is onboard (J1004)
        the connector size is a 4-pin 2.0 mm JST PH.
        RX/TX is working, u-boot bootwait is active, secure boot is enabled.

        Notes:
	- Serial is completely deactivated in the stock firmware image.
	- This commit adds only single partition support, that means
	  sysupgrade is upgrading the current rootfs partition.
	- Installation can be done by serial connection or
	  SSH access on OEM firmware

	Installation Instructions:

	Most part of the installation is performed from an initramfs image
	running OpenWrt, and there are two options to boot it.

	Boot initramfs option 1: Using serial connection (3.3V)
	1. Stop auto boot to get to U-boot shell
	2. Transfer initramfs image to device
	   (openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb)
	   Tested using TFTP and a FAT-formatted USB flash drive.
	3. Boot the initramfs image
	   # bootm

	Boot initramfs option 2: From SSH access on OEM firmware
	1. Copy the initramfs image to a FAT-formatted flash drive
	   (tested on single-partition drive) and connect it to device USB port.
	2. Change boot command so it loads the initramfs image on next boot
	   Fallback to OEM firmware is provided.
	   # fw_setenv bootcmd 'usb start && fatload usb 0:1 0x44000000 openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb && bootm 0x44000000; bootipq'
	3. Reboot the device to boot the initramfs
	   # reboot

	Install OpenWrt from initramfs image:
	1. Use SCP (or other way) to transfer OpenWrt factory image
	2. Connect to device using SSH (on a LAN port)
	3. Check MTD partition table.
	   rootfs and rootfs_1 should be mtd18 and mtd20
	   depending on current OEM slot.
	   # cat /proc/mtd
	4. Do a ubiformat to both rootfs partitions:
	   # ubiformat /dev/mtd18 -y -f /path_to/factory_image
	   # ubiformat /dev/mtd20 -y -f /path_to/factory_image
	5. Set U-boot env variable: mtdids
	   # fw_setenv mtdids 'nand0=nand0'
	6. Get offset of mtd18 to determine current OEM slot
	   - If current OEM slot is 1, offset is 16777216  (0x1000000)
	   - If current OEM slot is 2, offset is 127926272 (0x7a00000)
	   # cat /sys/class/mtd/mtd18/offset
	7. Set U-boot env variable: mtdparts
	   If current OEM slot is 1, run:
	   # fw_setenv mtdparts 'mtdparts=nand0:0x6100000@0x1000000(fs),0x6100000@0x7a00000(fs_1)'
	   If current OEM slot is 2, run:
	   # fw_setenv mtdparts 'mtdparts=nand0:0x6100000@0x7a00000(fs),0x6100000@0x1000000(fs_1)'
	8. Set U-boot env variable: bootcmd
	   # fw_setenv bootcmd 'setenv bootargs console=ttyMSM0,115200n8 ubi.mtd=rootfs rootfstype=squashfs rootwait; ubi part fs; ubi read 0x44000000 kernel; bootm 0x44000000#config@rt5010w-d350-rev0'
	9. Reboot the device
	   # reboot

        Note: this PR adds only single partition support, that means sysupgrade is
              upgrading the current rootfs partition

Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
2023-01-16 12:42:23 +01:00