mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-22 15:02:32 +00:00
9ef931f96b
11 Commits
Author | SHA1 | Message | Date | |
---|---|---|---|---|
Lech Perczak
|
8c78a13bfc |
ath79: support ZTE MF286
ZTE MF286 is an indoor LTE category 6 CPE router with simultaneous dual-band 802.11ac plus 802.11n Wi-Fi radios and quad-port gigabit Ethernet switch, FXS and external USB 2.0 port. Hardware highlights: - CPU: QCA9563 SoC at 775MHz, - RAM: 128MB DDR2, - NOR Flash: MX25L1606E 2MB SPI Flash, for U-boot only, - NAND Flash: GD5F1G04UBYIG 128MB SPI NAND-Flash, for all other data, - Wi-Fi 5GHz: QCA9882 2x2 MIMO 802.11ac radio, - WI-Fi 2.4GHz: QCA9563 3x3 MIMO 802.11n radio, - Switch: QCA8337v2 4-port gigabit Ethernet, with single SGMII CPU port, - WWAN: MDM9230-based category 6 internal LTE modem in extended mini-PCIE form factor, with 3 internal antennas and 2 external antenna connections, single mini-SIM slot. Modem model identified as MF270, - FXS: one external ATA port (handled entirely by modem part) with two physical connections in parallel, - USB: Single external USB 2.0 port, - Switches: power switch, WPS, Wi-Fi and reset buttons, - LEDs: Wi-Fi, Test (internal). Rest of LEDs (Phone, WWAN, Battery, Signal state) handled entirely by modem. 4 link status LEDs handled by the switch on the backside. - Battery: 3Ah 1-cell Li-Ion replaceable battery, with charging and monitoring handled by modem. - Label MAC device: eth0 Console connection: connector X2 is the console port, with the following pinout, starting from pin 1, which is the topmost pin when the board is upright: - VCC (3.3V). Do not use unless you need to source power for the converer from it. - TX - RX - GND Default port configuration in U-boot as well as in stock firmware is 115200-8-N-1. Installation: Due to different flash layout from stock firmware, sysupgrade from within stock firmware is impossible, despite it's based on QSDK which itself is based on OpenWrt. STEP 0: Stock firmware update: As installing OpenWrt cuts you off from official firmware updates for the modem part, it is recommended to update the stock firmware to latest version before installation, to have built-in modem at the latest firmware version. STEP 1: gaining root shell: Method 1: This works if busybox has telnetd compiled in the binary. If this does not work, try method 2. Using well-known exploit to start telnetd on your router - works only if Busybox on stock firmware has telnetd included: - Open stock firmware web interface - Navigate to "URL filtering" section by going to "Advanced settings", then "Firewall" and finally "URL filter". - Add an entry ending with "&&telnetd&&", for example "http://hostname/&&telnetd&&". - telnetd will immediately listen on port 4719. - After connecting to telnetd use "admin/admin" as credentials. Method 2: This works if busybox does not have telnetd compiled in. Notably, this is the case in DNA.fi firmware. If this does not work, try method 3. - Set IP of your computer to 192.168.1.22. - Have a TFTP server running at that address - Download MIPS build of busybox including telnetd, for example from: https://busybox.net/downloads/binaries/1.21.1/busybox-mips and put it in it's root directory. Rename it as "telnetd". - As previously, login to router's web UI and navigate to "URL filtering" - Using "Inspect" feature, extend "maxlength" property of the input field named "addURLFilter", so it looks like this: <input type="text" name="addURLFilter" id="addURLFilter" maxlength="332" class="required form-control"> - Stay on the page - do not navigate anywhere - Enter "http://aa&zte_debug.sh 192.168.1.22 telnetd" as a filter. - Save the settings. This will download the telnetd binary over tftp and execute it. You should be able to log in at port 23, using "admin/admin" as credentials. Method 3: If the above doesn't work, use the serial console - it exposes root shell directly without need for login. Some stock firmwares, notably one from finnish DNA operator lack telnetd in their builds. STEP 2: Backing up original software: As the stock firmware may be customized by the carrier and is not officially available in the Internet, IT IS IMPERATIVE to back up the stock firmware, if you ever plan to returning to stock firmware. Method 1: after booting OpenWrt initramfs image via TFTP: PLEASE NOTE: YOU CANNOT DO THIS IF USING INTERMEDIATE FIRMWARE FOR INSTALLATION. - Dump stock firmware located on stock kernel and ubi partitions: ssh root@192.168.1.1: cat /dev/mtd4 > mtd4_kernel.bin ssh root@192.168.1.1: cat /dev/mtd8 > mtd8_ubi.bin And keep them in a safe place, should a restore be needed in future. Method 2: using stock firmware: - Connect an external USB drive formatted with FAT or ext4 to the USB port. - The drive will be auto-mounted to /var/usb_disk - Check the flash layout of the device: cat /proc/mtd It should show the following: mtd0: 00080000 00010000 "uboot" mtd1: 00020000 00010000 "uboot-env" mtd2: 00140000 00020000 "fota-flag" mtd3: 00140000 00020000 "caldata" mtd4: 00140000 00020000 "mac" mtd5: 00600000 00020000 "cfg-param" mtd6: 00140000 00020000 "oops" mtd7: 00800000 00020000 "web" mtd8: 00300000 00020000 "kernel" mtd9: 01f00000 00020000 "rootfs" mtd10: 01900000 00020000 "data" mtd11: 03200000 00020000 "fota" Differences might indicate that this is NOT a vanilla MF286 device but one of its later derivatives. - Copy over all MTD partitions, for example by executing the following: for i in 0 1 2 3 4 5 6 7 8 9 10 11; do cat /dev/mtd$i > \ /var/usb_disk/mtd$i; done - If the count of MTD partitions is different, this might indicate that this is not a standard MF286 device, but one of its later derivatives. - (optionally) rename the files according to MTD partition names from /proc/mtd - Unmount the filesystem: umount /var/usb_disk; sync and then remove the drive. - Store the files in safe place if you ever plan to return to stock firmware. This is especially important, because stock firmware for this device is not available officially, and is usually customized by the mobile providers. STEP 3: Booting initramfs image: Method 1: using serial console (RECOMMENDED): - Have TFTP server running, exposing the OpenWrt initramfs image, and set your computer's IP address as 192.168.1.22. This is the default expected by U-boot. You may wish to change that, and alter later commands accordingly. - Connect the serial console if you haven't done so already, - Interrupt boot sequence by pressing any key in U-boot when prompted - Use the following commands to boot OpenWrt initramfs through TFTP: setenv serverip 192.168.1.22 setenv ipaddr 192.168.1.1 tftpboot 0x81000000 openwrt-ath79-nand-zte_mf286-initramfs-kernel.bin bootm 0x81000000 (Replace server IP and router IP as needed). There is no emergency TFTP boot sequence triggered by buttons, contrary to MF283+. - When OpenWrt initramfs finishes booting, proceed to actual installation. Method 2: using initramfs image as temporary boot kernel This exploits the fact, that kernel and rootfs MTD devices are consecutive on NAND flash, so from within stock image, an initramfs can be written to this area and booted by U-boot on next reboot, because it uses "nboot" command which isn't limited by kernel partition size. - Download the initramfs-kernel.bin image - Split the image into two parts on 3MB partition size boundary, which is the size of kernel partition. Pad the output of second file to eraseblock size: dd if=openwrt-ath79-nand-zte_mf286-initramfs-kernel.bin \ bs=128k count=24 \ of=openwrt-ath79-zte_mf286-intermediate-kernel.bin dd if=openwrt-ath79-nand-zte_mf286-initramfs-kernel.bin \ bs=128k skip=24 conv=sync \ of=openwrt-ath79-zte_mf286-intermediate-rootfs.bin - Copy over /usr/bin/flash_eraseall and /usr/bin/nandwrite utilities to /tmp. This is CRITICAL for installation, as erasing rootfs will cut you off from those tools on flash! - After backing up the previous MTD contents, write the images to the respective MTD devices: /tmp/flash_eraseall /dev/<kernel-mtd> /tmp/nandwrite /dev/<kernel-mtd> \ /var/usb_disk/openwrt-ath79-zte_mf286-intermediate-kernel.bin /tmp/flash_eraseall /dev/<kernel-mtd> /tmp/nandwrite /dev/<rootfs-mtd> \ /var/usb_disk/openwrt-ath79-zte_mf286-intermediate-rootfs.bin - Ensure that no bad blocks were present on the devices while writing. If they were present, you may need to vary the split between kernel and rootfs parts, so U-boot reads a valid uImage after skipping the bad blocks. If it fails, you will be left with method 3 (below). - If write is OK, reboot the device, it will reboot to OpenWrt initramfs: reboot -f - After rebooting, SSH into the device and use sysupgrade to perform proper installation. Method 3: using built-in TFTP recovery (LAST RESORT): - With that method, ensure you have complete backup of system's NAND flash first. It involves deliberately erasing the kernel. - Download "-initramfs-kernel.bin" image for the device. - Prepare the recovery image by prepending 8MB of zeroes to the image, and name it root_uImage: dd if=/dev/zero of=padding.bin bs=8M count=1 cat padding.bin openwrt-ath79-nand-zte_mf286-initramfs-kernel.bin > root_uImage - Set up a TFTP server at 192.0.0.1/8. Router will use random address from that range. - Put the previously generated "root_uImage" into TFTP server root directory. - Deliberately erase "kernel" partition" using stock firmware after taking backup. THIS IS POINT OF NO RETURN. - Restart the device. U-boot will attempt flashing the recovery initramfs image, which will let you perform actual installation using sysupgrade. This might take a considerable time, sometimes the router doesn't establish Ethernet link properly right after booting. Be patient. - After U-boot finishes flashing, the LEDs of switch ports will all light up. At this moment, perform power-on reset, and wait for OpenWrt initramfs to finish booting. Then proceed to actual installation. STEP 4: Actual installation: - scp the sysupgrade image to the device: scp openwrt-ath79-nand-zte_mf286-squashfs-sysupgrade.bin \ root@192.168.1.1:/tmp/ - ssh into the device and execute sysupgrade: sysupgrade -n /tmp/openwrt-ath79-nand-zte_mf286-squashfs-sysupgrade.bin - Wait for router to reboot to full OpenWrt. STEP 5: WAN connection establishment Since the router is equipped with LTE modem as its main WAN interface, it might be useful to connect to the Internet right away after installation. To do so, please put the following entries in /etc/config/network, replacing the specific configuration entries with one needed for your ISP: config interface 'wan' option proto 'qmi' option device '/dev/cdc-wdm0' option auth '<auth>' # As required, usually 'none' option pincode '<pin>' # If required by SIM option apn '<apn>' # As required by ISP option pdptype '<pdp>' # Typically 'ipv4', or 'ipv4v6' or 'ipv6' For example, the following works for most polish ISPs config interface 'wan' option proto 'qmi' option device '/dev/cdc-wdm0' option auth 'none' option apn 'internet' option pdptype 'ipv4' If you have build with LuCI, installing luci-proto-qmi helps with this task. Restoring the stock firmware: Preparation: If you took your backup using stock firmware, you will need to reassemble the partitions into images to be restored onto the flash. The layout might differ from ISP to ISP, this example is based on generic stock firmware. The only partitions you really care about are "web", "kernel", and "rootfs". For easy padding and possibly restoring configuration, you can concatenate most of them into images written into "ubi" meta-partition in OpenWrt. To do so, execute something like: cat mtd5_cfg-param.bin mtd6-oops.bin mtd7-web.bin mtd9-rootfs.bin > \ mtd8-ubi_restore.bin You can skip the "fota" partition altogether, it is used only for stock firmware update purposes and can be overwritten safely anyway. The same is true for "data" partition which on my device was found to be unused at all. Restoring mtd5_cfg-param.bin will restore the stock firmware configuration you had before. Method 1: Using initramfs: - Boot to initramfs as in step 3: - Completely detach ubi0 partition using ubidetach /dev/ubi0_0 - Look up the kernel and ubi partitions in /proc/mtd - Copy over the stock kernel image using scp to /tmp - Erase kernel and restore stock kernel: (scp mtd4_kernel.bin root@192.168.1.1:/tmp/) mtd write <kernel_mtd> mtd4_kernel.bin rm mtd4_kernel.bin - Copy over the stock partition backups one-by-one using scp to /tmp, and restore them individually. Otherwise you might run out of space in tmpfs: (scp mtd3_ubiconcat0.bin root@192.168.1.1:/tmp/) mtd write <ubiconcat0_mtd> mtd3_ubiconcat0.bin rm mtd3_ubiconcat0.bin (scp mtd5_ubiconcat1.bin root@192.168.1.1:/tmp/) mtd write <ubiconcat1_mtd> mtd5_ubiconcat1.bin rm mtd5_ubiconcat1.bin - If the write was correct, force a device reboot with reboot -f Method 2: Using live OpenWrt system (NOT RECOMMENDED): - Prepare a USB flash drive contatining MTD backup files - Ensure you have kmod-usb-storage and filesystem driver installed for your drive - Mount your flash drive mkdir /tmp/usb mount /dev/sda1 /tmp/usb - Remount your UBI volume at /overlay to R/O mount -o remount,ro /overlay - Write back the kernel and ubi partitions from USB drive cd /tmp/usb mtd write mtd4_kernel.bin /dev/<kernel_mtd> mtd write mtd8_ubi.bin /dev/<kernel_ubi> - If everything went well, force a device reboot with reboot -f Last image may be truncated a bit due to lack of space in RAM, but this will happen over "fota" MTD partition which may be safely erased after reboot anyway. Method 3: using built-in TFTP recovery (LAST RESORT): - Assemble a recovery rootfs image from backup of stock partitions by concatenating "web", "kernel", "rootfs" images dumped from the device, as "root_uImage" - Use it in place of "root_uImage" recovery initramfs image as in the TFTP pre-installation method. Quirks and known issues - Kernel partition size is increased to 4MB compared to stock 3MB, to accomodate future kernel updates - at this moment OpenWrt 5.10 kernel image is at 2.5MB which is dangerously close to the limit. This has no effect on booting the system - but keep that in mind when reassembling an image to restore stock firmware. - uqmi seems to be unable to change APN manually, so please use the one you used before in stock firmware first. If you need to change it, please use protocok '3g' to establish connection once, or use the following command to change APN (and optionally IP type) manually: echo -ne 'AT+CGDCONT=1,"IP","<apn>' > /dev/ttyUSB0 - The only usable LED as a "system LED" is the green debug LED hidden inside the case. All other LEDs are controlled by modem, on which the router part has some influence only on Wi-Fi LED. - Wi-Fi LED currently doesn't work while under OpenWrt, despite having correct GPIO mapping. All other LEDs are controlled by modem, including this one in stock firmware. GPIO19, mapped there only acts as a gate, while the actual signal source seems to be 5GHz Wi-Fi radio, however it seems it is not the LED exposed by ath10k as ath10k-phy0. - GPIO5 used for modem reset is a suicide switch, causing a hardware reset of whole board, not only the modem. It is attached to gpio-restart driver, to restart the modem on reboot as well, to ensure QMI connectivity after reboot, which tends to fail otherwise. - Modem, as in MF283+, exposes root shell over ADB - while not needed for OpenWrt operation at all - have fun lurking around. - MAC address shift for 5GHz Wi-Fi used in stock firmware is 0x320000000000, which is impossible to encode in the device tree, so I took the liberty of using MAC address increment of 1 for it, to ensure different BSSID for both Wi-Fi interfaces. Signed-off-by: Lech Perczak <lech.perczak@gmail.com> |
||
Rui Salvaterra
|
27b5bae2ec |
treewide: remove redundant ubifs kconfig symbols
For the targets which enable ubifs, these symbols are already part of the generic kconfigs. Drop them from the target kconfigs. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com> |
||
Aleksander Jan Bajkowski
|
77575d4c02 |
kernel: move some disabled symbols to generic
Move some disabled config options found in lantiq target to generic. Signed-off-by: Aleksander Jan Bajkowski <A.Bajkowski@stud.elka.pw.edu.pl> |
||
Roger Pueyo Centelles
|
a66eee6336 |
ath79: add mikrotik subtarget
This commit creates the ath79/mikrotik subtarget in order to support MikroTik devices based on Qualcomm Atheros MIPS SoCs. MikroTik devices need a couple of specific features: the split MiNOR firmware MTD format, which is not used by other devices, and the 4k sector erase size on SPI NOR storage, which can not be added to the ath79/generic and ath79/nand subtargets now. Additionally, the commit moves the two MikroTik devices already in the generic and nand subtargets to this new one. Tested on the RB922 board and the wAP AC router. Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net> |
||
David Bauer
|
86fe348949 |
ath79: add back NAND symbols to NAND target
The NAND config symbols were removed unintentionally while adding support for Linux 5.4. Add the respective symbols for v4.19 as well as v5.4. Signed-off-by: David Bauer <mail@david-bauer.net> |
||
David Bauer
|
53ab9865c2 |
ath79: add support for kernel 5.4
Signed-off-by: David Bauer <mail@david-bauer.net> [refreshed] Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com> * Sync the patches with the changes done for kernel 4.19 * Use KERNEL_TESTING_PATCHVER * Refresh the configuration * Fix multiple compile bugs in the patches * Only add own ag71xx files for kernel 4.19 and use upstream version for 5.4. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> |
||
Roger Pueyo Centelles
|
8f93c05a59 |
ath79: add support for MikroTik RouterBOARD 922UAGS-5HPacD
This patch ports support for the MikroTik RouterBOARD 922UAGS-5HPacD with a built-in 802.11ac High-Power radio (31dBm), which was already available in the ar71xx target. See https://mikrotik.com/product/RB922UAGS-5HPacD for more info. Specifications: - SoC: Qualcomm Atheros QCA9558 (720 MHz) - RAM: 128 MB - Storage: 128 MB NAND - Wireless: external QCA9882 802.11a/ac 2x2:2 - Ethernet: 1x 1000/100/10 Mbps, integrated, via AR8031 PHY, passive PoE-in 24V - SFP: 1x host - USB: 1x 2.0 type A - PCIe: 1x Mini slot (also contains USB 2.0 for 3G/LTE modems) - SIM slot: 1x mini-SIM Working: - Board/system detection - SPI and NAND storage - PCIe - USB type A host - Wireless - Ethernet - LEDs (user, phy0) - Reset button - Sysupgrade to/from ar71xx Not supported: - RSSI LEDs - SFP cage Installation methods: - Sysupgrade from ar71xx (it is advisable to use the -n option to wipe any previous settings), or - Boot the initramfs image via TFTP and then flash the sysupgrade image using "sysupgrade -n" Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net> |
||
Jeff Kletsky
|
20b3e77ba3 |
ath79: prepare NAND subtarget for upstream support of SPI NAND
Linux 4.19 supplies the upstream spi-nand framework,
permitting porting and support of boards with SPI NAND.
* Adjusted nand/target.mk to provide FEATURES += squashfs nand
* Updated config-default to provide current MTD and UBI support
Defaults selected for:
CONFIG_MTD_UBI_WL_THRESHOLD=4096
CONFIG_MTD_UBI_BEB_LIMIT=20
# CONFIG_MTD_UBI_FASTMAP is not set
# CONFIG_MTD_UBI_GLUEBI is not set
The bad-block reservation limit technically should be 21 for Paragon
SPI NAND but most other devices in the class are 20 blocks per Gbit.
In Linux 5.2 this is specified on a per-chip basis through NAND_MEMORG
Contents adjusted to remove declarations provided at the target level
by commit
|
||
David Bauer
|
62db255543 |
ath79: add support for Aerohive HiveAP 121
This commit adds support for the Aerohive HiveAP-121. It was previously already supported in the ar71xx subtarget. The following is copied from the commit which added ar71xx support: Specification: - SoC: Atheros AR9344-BC2A at 560MHz - WiFi 1: 2.4GHz Atheros AR9340? - SoC - WiFi 2: 5.0GHz Atheros AR9382-AL1A - Memory: 128MB from 2x Nanya NT5TU32M16DG-AC - SPI: 1MB Macronix MX25L8006E - NAND: 128MB Hynix H27U1G8F2BTR-BC - Ethernet: Atheros AR8035-A - USB: 1x 2.0 - TPM: Atmel SC3204 Flashing: 1. Hook into UART (9600 baud) and enter U-Boot. You may need to enter a password of administrator or AhNf?d@ta06 if prompted. 2. Once in U-Boot, download and flash LEDE factory image over tftp: dhcp; setenv serverip tftp-server-ip; tftpboot 0x81000000 lede-ar71xx-nand-hiveap-121-squashfs-factory.bin; nand erase 0x800000 0x800000; nand write 0x81000000 0x800000 0x800000; reset; Signed-off-by: David Bauer <mail@david-bauer.net> |
||
Michal Cieslakiewicz
|
758a4d1766 |
ath79: add AR934x NAND Flash Controller driver
This patch contains updated driver for Atheros NAND Flash Controller written originally by Gabor Juhos for ar71xx (aka 'ar934x-nfc'). ath79 version has adapted to work with kernel 4.19 and Device Tree. It has also been renamed to 'ar934x-nand' to avoid confusion with Near-Field Communication technology. Controller is present on Atheros AR934x SoCs and required for accessing internal flash storage on routers like Netgear WNDR4300. This port preserves all NAND programming code while moving platform configuration to Device Tree and replacing some kernel functions marked for retirement by 4.19. Suitable definition is included in 'ar934x.dtsi' ('nand@1b000200' section). Most important changes to ar71xx version are: * old kernel sections of code removed * 'bool swap_dma' provided by platform data is now set by boolean DT property 'qca,nand-swap-dma' * board-supplied (mach-*.c code) platform data removed - its elements become either unused, redundant or replaced by DT methods (like reset) * IRQ is reserved by devm_request_irq() so free_irq() is not needed anymore * calls to deprecated nand_scan_ident() + nand_scan_tail() function pair replaced by using recommended nand_scan() with attach_chip() callback * ECC is set to hardware by default, can be overriden by standard DT 'nand-ecc-*' properties (software Hamming or BCH are other options) This driver has been successfully tested on Netgear WNDR4300 running experimental ath79 OpenWrt master branch. Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl> [add reset control] Signed-off-by: David Bauer <mail@david-bauer.net> |
||
Marty E. Plummer
|
0e81968ee8 |
ath79: add initial nand support for gl-ar300m
Signed-off-by: Marty E. Plummer <hanetzer@startmail.com> |