mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-30 02:29:01 +00:00
9f223a20bd
75 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Jihoon Han
|
84451173f0 |
ath79: add support for Dongwon T&I DW02-412H
Dongwon T&I DW02-412H is a 2.4/5GHz band 11ac (WiFi-5) router, based on
Qualcomm Atheros QCA9557.
Specifications
--------------
- SoC: Qualcomm Atheros QCA9557-AT4A
- RAM: DDR2 128MB
- Flash: SPI NOR 2MB (Winbond W25Q16DVSSIG / ESMT F25L16PA(2S)) +
NAND 64/128MB
- WiFi:
- 2.4GHz: QCA9557 WMAC
- 5GHz: QCA9882-BR4A
- Ethernet: 5x 10/100/1000Mbps
- Switch: QCA8337N-AL3C
- USB: 1x USB 2.0
- UART:
- JP2: 3.3V, TX, RX, GND (3.3V is the square pad) / 115200 8N1
Installation
--------------
1. Connect a serial interface to UART header and
interrupt the autostart of kernel.
2. Transfer the factory image via TFTP and write it to the NAND flash.
3. Update U-Boot environment variable.
> tftpboot 0x81000000 <your image>-factory.img
> nand erase 0x1000000
> nand write 0x81000000 0x1000000 ${filesize}
> setenv bootpart 2
> saveenv
Revert to stock firmware
--------------
1. Revert to stock U-Boot environment variable.
> setenv bootpart 1
> saveenv
MAC addresses as verified by OEM firmware
--------------
WAN: *:XX (label)
LAN: *:XX + 1
2.4G: *:XX + 3
5G: *:XX + 4
The label MAC address was found in art 0x0.
Credits
--------------
Credit goes to the @manatails who first developed how to port OpenWRT
to this device and had a significant impact on this patch.
And thanks to @adschm and @mans0n for guiding me to revise the code
in many ways.
Signed-off-by: Jihoon Han <rapid_renard@renard.ga>
Reviewed-by: Sungbo Eo <mans0n@gorani.run>
Tested-by: Sungbo Eo <mans0n@gorani.run>
|
||
Sven Eckelmann
|
9a172797e5 |
ath79: Add support for OpenMesh A40
Device specifications:
======================
* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2T2R 2.4 GHz Wi-Fi (11n)
* 2T2R 5 GHz Wi-Fi (11ac)
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x ethernet
- eth0
+ Label: Ethernet 1
+ AR8035 ethernet PHY (RGMII)
+ 10/100/1000 Mbps Ethernet
+ 802.3af POE
+ used as WAN interface
- eth1
+ Label: Ethernet 2
+ AR8035 ethernet PHY (SGMII)
+ 10/100/1000 Mbps Ethernet
+ used as LAN interface
* 1x USB
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
|
||
|
Sven Eckelmann
|
eaf2e32c12 |
ath79: Add support for OpenMesh A60
Device specifications:
======================
* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 3T3R 2.4 GHz Wi-Fi (11n)
* 3T3R 5 GHz Wi-Fi (11ac)
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x ethernet
- eth0
+ Label: Ethernet 1
+ AR8035 ethernet PHY (RGMII)
+ 10/100/1000 Mbps Ethernet
+ 802.3af POE
+ used as WAN interface
- eth1
+ Label: Ethernet 2
+ AR8031 ethernet PHY (SGMII)
+ 10/100/1000 Mbps Ethernet
+ used as LAN interface
* 1x USB
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
|
||
Giulio Lorenzo
|
b108ed0ab0 |
ath79: add support for ZiKing CPE46B
ZiKing CPE46B is a POE outdoor 2.4ghz device with an integrated directional antenna. It is low cost and mostly available via Aliexpress, references can be found at: - https://forum.openwrt.org/t/anddear-ziking-cpe46b-ar9331-ap121/60383 - https://git.lsd.cat/g/openwrt-cpe46b Specifications: - Atheros AR9330 - 32MB of RAM - 8MB of flash (SPI NOR) - 1 * 2.4ghz integrated antenna - 2 * 10/100/1000 ethernet ports (1 POE) - 3 * Green LEDs controlled by the SoC - 3 * Green LEDs controlled via GPIO - 1 * Reset Button controlled via GPIO - 1 * 4 pin serial header on the PCB - Outdoor packaging Flashing instruction: You can use sysupgrade image directly in vendor firmware which is based on OpenWrt/LEDE. In case of issues with the vendor GUI, the vendor Telnet console is vulnerable to command injection and can be used to gain a shell directly on the OEM OpenWrt distribution. Signed-off-by: Giulio Lorenzo <salveenee@mortemale.org> [fix whitespaces, drop redundant uart status and serial0, drop num-chipselects, drop 0x1002 MAC address for wmac] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> |
||
Mauri Sandberg
|
addf47a9a8 |
uboot-envtools: add support for Buffalo WZR-HP-G300NH
This adds an entries for wzr-hp-g300nh-rb and wzr-hp-g300nh-s. Signed-off-by: Mauri Sandberg <sandberg@mailfence.com> |
||
Piotr Dymacz
|
914563e286 |
uboot-envtools: drop shebang from uci-defaults and lib files
These files are sourced and non-executable, a shebang is redundant. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com> |
||
Michael Pratt
|
96017a6013 |
ath79: add support for Senao Engenius EAP1200H
FCC ID: A8J-EAP1200H
Engenius EAP1200H is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
**Specification:**
- QCA9557 SOC
- QCA9882 WLAN PCI card, 5 GHz, 2x2, 26dBm
- AR8035-A PHY RGMII GbE with PoE+ IN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16FG
- UART at J10 populated
- 4 internal antenna plates (5 dbi, omni-directional)
- 5 LEDs, 1 button (power, eth0, 2G, 5G, WPS) (reset)
**MAC addresses:**
MAC addresses are labeled as ETH, 2.4G, and 5GHz
Only one Vendor MAC address in flash
eth0 ETH *:a2 art 0x0
phy1 2.4G *:a3 ---
phy0 5GHz *:a4 ---
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin at J10
**Installation:**
2 ways to flash factory.bin from OEM:
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will brick the device
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery:**
Requires serial console, reset button does nothing
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board, interrupt boot
execute tftpboot and bootm 0x81000000
NOTE: TFTP is not reliable due to bugged bootloader
set MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of EAP1200H is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-ar71xx-generic-eap1200h-uImage-lzma.bin
openwrt-ar71xx-generic-eap1200h-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
Newer EnGenius software requires more checks but their script
includes a way to skip them, otherwise the tar must include
a text file with the version and md5sums in a deprecated format.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied
at the PHY side, using the at803x driver `phy-mode`.
Therefore the PLL registers for GMAC0
do not need the bits for delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
Signed-off-by: Michael Pratt <mcpratt@pm.me>
|
||
|
Sven Eckelmann
|
0988e03f0e |
ath79: Add support for OpenMesh MR1750 v2
Device specifications: ====================== * Qualcomm/Atheros QCA9558 ver 1 rev 0 * 720/600/240 MHz (CPU/DDR/AHB) * 128 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 3T3R 2.4 GHz Wi-Fi (11n) * 3T3R 5 GHz Wi-Fi (11ac) * 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default)) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 1x ethernet - AR8035 ethernet PHY (RGMII) - 10/100/1000 Mbps Ethernet - 802.3af POE - used as LAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org> [rebase, add LED migration] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> |
||
|
Sven Eckelmann
|
ae7680dc4b |
ath79: Add support for OpenMesh MR1750 v1
Device specifications: ====================== * Qualcomm/Atheros QCA9558 ver 1 rev 0 * 720/600/240 MHz (CPU/DDR/AHB) * 128 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 3T3R 2.4 GHz Wi-Fi (11n) * 3T3R 5 GHz Wi-Fi (11ac) * 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default)) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 1x ethernet - AR8035 ethernet PHY (RGMII) - 10/100/1000 Mbps Ethernet - 802.3af POE - used as LAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org> [rebase, apply shared DTSI/device node, add LED migration] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> |
||
|
Sven Eckelmann
|
31172e53f9 |
ath79: Add support for OpenMesh MR900 v2
Device specifications: ====================== * Qualcomm/Atheros QCA9558 ver 1 rev 0 * 720/600/240 MHz (CPU/DDR/AHB) * 128 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 3T3R 2.4 GHz Wi-Fi * 3T3R 5 GHz Wi-Fi * 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default)) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 1x ethernet - AR8035 ethernet PHY (RGMII) - 10/100/1000 Mbps Ethernet - 802.3af POE - used as LAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org> [rebase, add LED migration] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> |
||
|
Sven Eckelmann
|
e06c9eec5d |
ath79: Add support for OpenMesh MR900 v1
Device specifications: ====================== * Qualcomm/Atheros QCA9558 ver 1 rev 0 * 720/600/240 MHz (CPU/DDR/AHB) * 128 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 3T3R 2.4 GHz Wi-Fi * 3T3R 5 GHz Wi-Fi * 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default)) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 1x ethernet - AR8035 ethernet PHY (RGMII) - 10/100/1000 Mbps Ethernet - 802.3af POE - used as LAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org> [rebase, add LED migration] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> |
||
|
Sven Eckelmann
|
d9a3af46d8 |
ath79: Add support for OpenMesh MR600 v2
Device specifications: ====================== * Qualcomm/Atheros AR9344 rev 2 * 560/450/225 MHz (CPU/DDR/AHB) * 128 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 2T2R 2.4 GHz Wi-Fi * 2T2R 5 GHz Wi-Fi * 8x GPIO-LEDs (6x wifi, 1x wps, 1x power) * 1x GPIO-button (reset) * external h/w watchdog (enabled by default)) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 1x ethernet - AR8035 ethernet PHY (RGMII) - 10/100/1000 Mbps Ethernet - 802.3af POE - used as LAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org> [rebase, add LED migration] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> |
||
|
Sven Eckelmann
|
4b35999588 |
ath79: Add support for OpenMesh MR600 v1
Device specifications: ====================== * Qualcomm/Atheros AR9344 rev 2 * 560/450/225 MHz (CPU/DDR/AHB) * 128 MB of RAM * 16 MB of SPI NOR flash - 2x 7 MB available; but one of the 7 MB regions is the recovery image * 2T2R 2.4 GHz Wi-Fi * 2T2R 5 GHz Wi-Fi * 4x GPIO-LEDs (2x wifi, 1x wps, 1x power) * 1x GPIO-button (reset) * TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX) * 1x ethernet - AR8035 ethernet PHY (RGMII) - 10/100/1000 Mbps Ethernet - 802.3af POE - used as LAN interface * 12-24V 1A DC * internal antennas Flashing instructions: ====================== Various methods can be used to install the actual image on the flash. Two easy ones are: ap51-flash ---------- The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be used to transfer the image to the u-boot when the device boots up. initramfs from TFTP ------------------- The serial console must be used to access the u-boot shell during bootup. It can then be used to first boot up the initramfs image from a TFTP server (here with the IP 192.168.1.21): setenv serverip 192.168.1.21 setenv ipaddr 192.168.1.1 tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr The actual sysupgrade image can then be transferred (on the LAN port) to the device via scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/ On the device, the sysupgrade must then be started using sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin Signed-off-by: Sven Eckelmann <sven@narfation.org> [rebase, make WLAN LEDs consistent, add LED migration] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> |
||
|
Sven Eckelmann
|
80713657b2 |
ath79: Add support for OpenMesh OM5P
Device specifications:
======================
* Qualcomm/Atheros AR9344 rev 2
* 560/450/225 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 5 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
- eth0
+ builtin switch port 1
+ used as LAN interface
- eth1
+ 18-24V passive POE (mode B)
+ used as WAN interface
* 12-24V 1A DC
* internal antennas
WAN/LAN LEDs appear to be wrong in ar71xx and have been swapped here.
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
[add LED swap comment]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
|
||
|
Sven Eckelmann
|
ff9e48e75c |
ath79: Add support for OpenMesh OM2P v2
Device specifications:
======================
* Qualcomm/Atheros AR9330 rev 1
* 400/400/200 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 1T1R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
- eth0
+ builtin switch port 1
+ used as LAN interface
- eth1
+ 18-24V passive POE (mode B)
+ used as WAN interface
* 12-24V 1A DC
* external antenna
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to
the device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
|
||
|
Sven Eckelmann
|
eb3a5ddba0 |
ath79: Add support for OpenMesh OM2P-LC
Device specifications:
======================
* Qualcomm/Atheros AR9330 rev 1
* 400/400/200 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 1T1R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
- eth0
+ builtin switch port 1
+ used as LAN interface
- eth1
+ 18-24V passive POE (mode B)
+ used as WAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to
the device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
|
||
|
Sven Eckelmann
|
75900a25ed |
ath79: add support for OpenMesh OM2P-HS v3
Device specifications:
======================
* Qualcomm/Atheros AR9341 rev 1
* 535/400/200 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
- eth0
+ 802.3af POE
+ builtin switch port 1
+ used as LAN interface
- eth1
+ 18-24V passive POE (mode B)
+ used as WAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to
the device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
|
||
|
Sven Eckelmann
|
f096accce2 |
ath79: add support for OpenMesh OM2P-HS v2
Device specifications:
======================
* Qualcomm/Atheros AR9341 rev 1
* 535/400/200 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
- eth0
+ 802.3af POE
+ builtin switch port 1
+ used as LAN interface
- eth1
+ 18-24V passive POE (mode B)
+ used as WAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to
the device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
|
||
|
Sven Eckelmann
|
a462412977 |
ath79: add support for OpenMesh OM2P-HS v1
Device specifications:
======================
* Qualcomm/Atheros AR9341 rev 1
* 535/400/200 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
- eth0
+ 802.3af POE
+ builtin switch port 1
+ used as LAN interface
- eth1
+ 18-24V passive POE (mode B)
+ used as WAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to
the device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
[drop redundant status from eth1]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
|
||
|
Sven Eckelmann
|
5b37b52e69 |
ath79: Add support for OpenMesh OM2P-HS v4
Device specifications:
======================
* Qualcomm/Atheros QCA9533 v2
* 650/600/217 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
- eth0
+ 24V passive POE (mode B)
+ used as WAN interface
- eth1
+ 802.3af POE
+ builtin switch port 1
+ used as LAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to
the device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
|
||
|
Sven Eckelmann
|
dd1d95cb03 |
ath79: Add support for OpenMesh OM2P v4
Device specifications:
======================
* Qualcomm/Atheros QCA9533 v2
* 650/600/217 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 1T1R 2.4 GHz Wi-Fi
* 6x GPIO-LEDs (3x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
- eth0
+ Label: Ethernet 1
+ 24V passive POE (mode B)
- eth1
+ Label: Ethernet 2
+ 802.3af POE
+ builtin switch port 1
* 12-24V 1A DC
* external antenna
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to
the device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
[wrap two very long lines, fix typo in comment]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
|
||
|
Michael Pratt
|
33d26a9a40 |
ath79: add support for Senao Engenius EAP350 v1
FCC ID: U2M-EAP350
Engenius EAP350 is a wireless access point with 1 gigabit PoE ethernet port,
2.4 GHz wireless, external ethernet switch, and 2 internal antennas.
Specification:
- AR7242 SOC
- AR9283 WLAN (2.4 GHz, 2x2, PCIe on-board)
- AR8035-A switch (GbE with 802.3af PoE)
- 40 MHz reference clock
- 8 MB FLASH MX25L6406E
- 32 MB RAM EM6AA160TSA-5G
- UART at J2 (populated)
- 3 LEDs, 1 button (power, eth, 2.4 GHz) (reset)
- 2 internal antennas
MAC addresses:
MAC address is labeled as "MAC"
Only 1 address on label and in flash
The OEM software reports these MACs for the ifconfig
eth0 MAC *:0c art 0x0
phy0 --- *:0d ---
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.10.1
username and password "admin"
Navigate to "Upgrade Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9f670000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
Format of OEM firmware image:
The OEM software of EAP350 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-eap350-uImage-lzma.bin
openwrt-senao-eap350-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh
Later models in the EAP series likely have a different platform
and the upgrade and image verification process differs.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1024k
and the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035-A switch between
the SOC and the ethernet PHY chips.
For AR724x series, the PLL register for GMAC0
can be seen in the DTSI as 0x2c.
Therefore the PLL register can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
uboot did not have a good value for 1 GBps
so it was taken from other similar DTS file.
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
|
||
|
Michael Pratt
|
6c98edaae2 |
ath79: add support for Senao Engenius EAP600
FCC ID: A8J-EAP600
Engenius EAP600 is a wireless access point with 1 gigabit ethernet port,
dual-band wireless, external ethernet switch, 4 internal antennas
and 802.3af PoE.
Specification:
- AR9344 SOC (5 GHz, 2x2, WMAC)
- AR9382 WLAN (2.4 GHz, 2x2, PCIe on-board)
- AR8035-A switch (GbE with 802.3af PoE)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16DG
- UART at H1 (populated)
- 5 LEDs, 1 button (power, eth, 2.4 GHz, 5 GHz, wps) (reset)
- 4 internal antennas
MAC addresses:
MAC addresses are labeled MAC1 and MAC2
The MAC address in flash is not on the label
The OEM software reports these MACs for the ifconfig
eth0 MAC 1 *:5e ---
phy1 MAC 2 *:5f --- (2.4 GHz)
phy0 ----- *:60 art 0x0 (5 GHz)
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Upgrade Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
Format of OEM firmware image:
The OEM software of EAP600 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-eap600-uImage-lzma.bin
openwrt-senao-eap600-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh
Later models in the EAP series likely have a different platform
and the upgrade and image verification process differs.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035-A switch between
the SOC and the ethernet PHY chips.
For AR934x series, the PLL register for GMAC0
can be seen in the DTSI as 0x2c.
Therefore the PLL register can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
Unfortunately uboot did not have the best values
so they were taken from other similar DTS files.
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
|
||
|
Michael Pratt
|
4a55ef639d |
ath79: add support for Senao Engenius ECB600
FCC ID: A8J-ECB600
Engenius ECB600 is a wireless access point with 1 gigabit PoE ethernet port,
dual-band wireless, external ethernet switch, and 4 external antennas.
Specification:
- AR9344 SOC (5 GHz, 2x2, WMAC)
- AR9382 WLAN (2.4 GHz, 2x2, PCIe on-board)
- AR8035-A switch (GbE with 802.3af PoE)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16DG
- UART at H1 (populated)
- 4 LEDs, 1 button (power, eth, 2.4 GHz, 5 GHz) (reset)
- 4 external antennas
MAC addresses:
MAC addresses are labeled MAC1 and MAC2
The MAC address in flash is not on the label
The OEM software reports these MACs for the ifconfig
phy1 MAC 1 *:52 --- (2.4 GHz)
phy0 MAC 2 *:53 --- (5 GHz)
eth0 ----- *:54 art 0x0
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Upgrade Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
Format of OEM firmware image:
The OEM software of ECB600 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-ecb600-uImage-lzma.bin
openwrt-senao-ecb600-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh
Later models in the ECB series likely have a different platform
and the upgrade and image verification process differs.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8035-A switch between
the SOC and the ethernet PHY chips.
For AR934x series, the PLL register for GMAC0
can be seen in the DTSI as 0x2c.
Therefore the PLL register can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
Unfortunately uboot did not have the best values
so they were taken from other similar DTS files.
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
|
||
|
Michael Pratt
|
fe2f53f21c |
ath79: add support for Senao Engenius EnStationAC v1
FCC ID: A8J-ENSTAC
Engenius EnStationAC v1 is an outdoor wireless access point/bridge with
2 gigabit ethernet ports on 2 external ethernet switches,
5 GHz only wireless, internal antenna plates, and proprietery PoE.
Specification:
- QCA9557 SOC
- QCA9882 WLAN (PCI card, 5 GHz, 2x2, 26dBm)
- AR8035-A switch (RGMII GbE with PoE+ IN)
- AR8031 switch (SGMII GbE with PoE OUT)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16FG
- UART at J10 (unpopulated)
- internal antenna plates (19 dbi, directional)
- 7 LEDs, 1 button (power, eth, wlan, RSSI) (reset)
MAC addresses:
MAC addresses are labeled as ETH and 5GHz
Vendor MAC addresses in flash are duplicate
eth0 ETH *:d3 art 0x0/0x6
eth1 ---- *:d4 ---
phy0 5GHz *:d5 ---
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
TFTP recovery:
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board
hold or press reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
Format of OEM firmware image:
The OEM software of EnStationAC is a heavily modified version
of Openwrt Altitude Adjustment 12.09. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-ar71xx-enstationac-uImage-lzma.bin
openwrt-ar71xx-enstationac-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
Newer EnGenius software requires more checks but their script
includes a way to skip them, otherwise the tar must include
a text file with the version and md5sums in a deprecated format.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8033 switch between
the SOC and the ethernet PHY chips.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
For eth0 at 1000 speed, the value returned was
ae000000 but that didn't work, so following
the logical pattern from the rest of the values,
the guessed value of a3000000 works better.
later discovered that delay can be placed on the PHY end only
with phy-mode as 'rgmii-id' and set register to 0x82...
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[fixed SoB to match From:]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
|
||
|
Sven Eckelmann
|
17e5920490 |
ath79: Add support for Plasma Cloud PA300E
Device specifications:
* Qualcomm/Atheros QCA9533 v2
* 650/600/217 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash (mx25l12805d)
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
- eth0
+ Label: Ethernet 1
+ 24V passive POE (mode B)
+ used as WAN interface
- eth1
+ Label: Ethernet 2
+ 802.3af POE
+ builtin switch port 2
+ used as LAN interface
* 12-24V 1A DC
* external antennas
Flashing instructions:
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the factory image to the u-boot when the device boots up.
Signed-off-by: Sven Eckelmann <sven@narfation.org>
|
||
|
Sven Eckelmann
|
5fc28ef479 |
ath79: Add support for Plasma Cloud PA300
Device specifications:
* Qualcomm/Atheros QCA9533 v2
* 650/600/217 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash (mx25l12805d)
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
- eth0
+ Label: Ethernet 1
+ 24V passive POE (mode B)
+ used as WAN interface
- eth1
+ Label: Ethernet 2
+ 802.3af POE
+ builtin switch port 2
+ used as LAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the factory image to the u-boot when the device boots up.
Signed-off-by: Sven Eckelmann <sven@narfation.org>
|
||
|
Michael Pratt
|
7073ebf0f9 |
ath79: add support for Senao Engenius ECB350 v1
FCC ID: A8J-ECB350
Engenius ECB350 v1 is an indoor wireless access point with a gigabit ethernet port,
2.4 GHz wireless, external antennas, and PoE.
**Specification:**
- AR7242 SOC
- AR9283 WLAN 2.4 GHz (2x2), PCIe on-board
- AR8035-A switch RGMII, GbE with 802.3af PoE
- 40 MHz reference clock
- 8 MB FLASH 25L6406EM2I-12G
- 32 MB RAM
- UART at J2 (populated)
- 2 external antennas
- 3 LEDs, 1 button (power, lan, wlan) (reset)
**MAC addresses:**
MACs are labeled as WLAN and WAN
vendor MAC addresses in flash are duplicate
phy0 WLAN *:b8 ---
eth0 WAN *:b9 art 0x0/0x6
**Installation:**
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9f670000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery** (unstable / not reliable):
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board while holding or pressing reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of ECB350 v1 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel size to be no greater than 1536k
and otherwise the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
The factory upgrade script follows the original mtd partitions.
**Note on PLL-data cells:**
The default PLL register values will not work
because of the AR8035 switch between
the SOC and the ethernet port.
For AR724x series, the PLL register for GMAC0
can be seen in the DTSI as 0x2c.
Therefore the PLL register can be read from u-boot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`
However the registers that u-boot sets are not ideal and sometimes wrong...
the at803x driver supports setting the RGMII clock/data delay on the PHY side.
This way the pll-data register only needs to handle invert and phase.
for this board no extra adjustements are needed on the MAC side
all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
|
||
|
Michael Pratt
|
f244143609 |
ath79: add support for Senao Engenius ECB1200
FCC ID: A8J-ECB1200 Engenius ECB1200 is an indoor wireless access point with a GbE port, 2.4 GHz and 5 GHz wireless, external antennas, and 802.3af PoE. **Specification:** - QCA9557 SOC MIPS, 2.4 GHz (2x2) - QCA9882 WLAN PCIe card, 5 GHz (2x2) - AR8035-A switch RGMII, GbE with 802.3af PoE, 25 MHz clock - 40 MHz reference clock - 16 MB FLASH 25L12845EMI-10G - 2x 64 MB RAM 1538ZFZ V59C1512164QEJ25 - UART at JP1 (unpopulated, RX shorted to ground) - 4 external antennas - 4 LEDs, 1 button (power, eth, wifi2g, wifi5g) (reset) **MAC addresses:** MAC Addresses are labeled as ETH and 5GHZ U-boot environment has the vendor MAC addresses MAC addresses in ART do not match vendor eth0 ETH *:5c u-boot-env ethaddr phy0 5GHZ *:5d u-boot-env athaddr ---- ---- ???? art 0x0/0x6 **Installation:** Method 1: Firmware upgrade page: OEM webpage at 192.168.1.1 username and password "admin" Navigate to "Firmware" page from left pane Click Browse and select the factory.bin image Upload and verify checksum Click Continue to confirm and wait 3 minutes Method 2: Serial to load Failsafe webpage: After connecting to serial console and rebooting... Interrupt uboot with any key pressed rapidly (see TFTP recovery) perform a sysupgrade **Serial Access:** the RX line on the board for UART is shorted to ground by resistor R176 therefore it must be removed to use the console but it is not necessary to remove to view boot log optionally, R175 can be replaced with a solder bridge short the resistors R175 and R176 are next to the UART pinout at JP1 **Return to OEM:** If you have a serial cable, see Serial Failsafe instructions Unlike most Engenius boards, this does not have a 'failsafe' image the only way to return to OEM is TFTP or serial access to u-boot **TFTP recovery:** Unlike most Engenius boards, TFTP is reliable here rename initramfs-kernel.bin to 'ap.bin' make the file available on a TFTP server at 192.168.1.10 power board while holding or pressing reset button repeatedly or with serial access: run `tftpboot` or `run factory_boot` with initramfs-kernel.bin then `bootm` with the load address **Format of OEM firmware image:** The OEM software of ECB1200 is a heavily modified version of Openwrt Altitude Adjustment 12.09. This Engenius board, like ECB1750, uses a proprietary header with a unique Product ID. The header for factory.bin is generated by the mksenaofw program included in openwrt. **Note on PLL-data cells:** The default PLL register values will not work because of the AR8035 switch between the SOC and the ethernet port. For QCA955x series, the PLL registers for eth0 and eth1 can be see in the DTSI as 0x28 and 0x48 respectively. Therefore the PLL registers can be read from uboot for each link speed after attempting tftpboot or another network action using that link speed with `md 0x18050028 1` and `md 0x18050048 1`. However the registers that u-boot sets are not ideal and sometimes wrong... the at803x driver supports setting the RGMII clock/data delay on the PHY side. This way the pll-data register only needs to handle invert and phase. for this board clock invert is needed on the MAC side all link speeds functional Signed-off-by: Michael Pratt <mcpratt@pm.me> |
||
|
Michael Pratt
|
b31aaa0580 |
ath79: add support for Senao Engenius EAP300 v2
FCC ID: A8J-EAP300A
Engenius EAP300 v2 is an indoor wireless access point with a
100/10-BaseT ethernet port, 2.4 GHz wireless, internal antennas,
and 802.3af PoE.
**Specification:**
- AR9341
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 64 MB RAM
- UART at J1 (populated)
- Ethernet port with POE
- internal antennas
- 3 LEDs, 1 button (power, eth, wlan) (reset)
**MAC addresses:**
phy0 *:d3 art 0x1002 (label)
eth0 *:d4 art 0x0/0x6
**Installation:**
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, can cause kernel loop or halt
The easiest way to return to the OEM software is the Failsafe image
If you dont have a serial cable, you can ssh into openwrt and run
`mtd -r erase fakeroot`
Wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery** (unstable / not reliable):
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board while holding or pressing reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of EAP300 v2 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel size to be no greater than 1536k
and otherwise the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[clarify MAC address section, bump PKG_RELEASE for uboot-envtools]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
|
||
|
Piotr Dymacz
|
1bce45fc0f |
uboot-envtools: ath79: add support for ALFA Network Pi-WiFi4
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com> |
||
|
Piotr Dymacz
|
b4e9e81002 |
uboot-envtools: ath79: add support for ALFA Network N5Q
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com> |
||
|
Piotr Dymacz
|
6ae0684297 |
uboot-envtools: ath79: add support for ALFA Network N2Q
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com> |
||
|
Piotr Dymacz
|
9181b039f3 |
uboot-envtools: ath79: add support for ALFA Network R36A
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com> |
||
|
Piotr Dymacz
|
c40b693bd8 |
uboot-envtools: ath79: add support for Samsung WAM250
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com> |
||
|
Piotr Dymacz
|
9b699301f5 |
uboot-envtools: ath79: add support for Wallys DR531
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com> |
||
|
Piotr Dymacz
|
77598f19cc |
uboot-envtools: ath79: add support for ALFA Network AP121FE
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com> |
||
Michael Pratt
|
22caf30a65 |
ath79: add support for Senao Engenius ENH202 v1
FCC ID: U2M-ENH200
Engenius ENH202 is an outdoor wireless access point with 2 10/100 ports,
built-in ethernet switch, internal antenna plates and proprietery PoE.
Specification:
- Qualcomm/Atheros AR7240 rev 2
- 40 MHz reference clock
- 8 MB FLASH ST25P64V6P (aka ST M25P64)
- 32 MB RAM
- UART at J3 (populated)
- 2x 10/100 Mbps Ethernet (built-in switch at gmac1)
- 2.4 GHz, 2x2, 29dBm (Atheros AR9280 rev 2)
- internal antenna plates (10 dbi, semi-directional)
- 5 LEDs, 1 button (LAN, WAN, RSSI) (Reset)
Known Issues:
- Sysupgrade from ar71xx no longer possible
- Power LED not controllable, or unknown gpio
MAC addresses:
eth0/eth1 *:11 art 0x0/0x6
wlan *:10 art 0x120c
The device label lists both addresses, WLAN MAC and ETH MAC,
in that order.
Since 0x0 and 0x6 have the same content, it cannot be
determined which is eth0 and eth1, so we chose 0x0 for both.
Installation:
2 ways to flash factory.bin from OEM:
- Connect ethernet directly to board (the non POE port)
this is LAN for all images
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
In upper right select Reset
"Restore to factory default settings"
Wait for reboot and login again
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt boot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9f670000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, can cause kernel loop or halt
The easiest way to return to the OEM software is the Failsafe image
If you dont have a serial cable, you can ssh into openwrt and run
`mtd -r erase fakeroot`
Wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
Format of OEM firmware image:
The OEM software of ENH202 is a heavily modified version
of Openwrt Kamikaze bleeding-edge. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-enh202-uImage-lzma.bin
openwrt-senao-enh202-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring, and by swapping headers to see
what the OEM upgrade utility accepts and rejects.
OKLI kernel loader is required because the OEM firmware
expects the kernel to be no greater than 1024k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on built-in switch:
ENH202 is originally configured to be an access point,
but with two ethernet ports, both WAN and LAN is possible.
the POE port is gmac0 which is preferred to be
the port for WAN because it gives link status
where swconfig does not.
Signed-off-by: Michael Pratt <mpratt51@gmail.com>
[assign label_mac in 02_network, use ucidef_set_interface_wan,
use common device definition, some reordering]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
|
||
|
Michael Pratt
|
6decbf3186 |
ath79: add support for Senao Engenius ENS202EXT v1
Engenius ENS202EXT v1 is an outdoor wireless access point with 2 10/100 ports,
with built-in ethernet switch, detachable antennas and proprietery PoE.
FCC ID: A8J-ENS202
Specification:
- Qualcomm/Atheros AR9341 v1
- 535/400/200/40 MHz (CPU/DDR/AHB/REF)
- 64 MB of RAM
- 16 MB of FLASH MX25L12835F(MI-10G)
- UART (J1) header on PCB (unpopulated)
- 2x 10/100 Mbps Ethernet (built-in switch Atheros AR8229)
- 2.4 GHz, up to 27dBm (Atheros AR9340)
- 2x external, detachable antennas
- 7x LED (5 programmable in ath79), 1x GPIO button (Reset)
Known Issues:
- Sysupgrade from ar71xx no longer possible
- Ethernet LEDs stay on solid when connected, not programmable
MAC addresses:
eth0/eth1 *:7b art 0x0/0x6
wlan *:7a art 0x1002
The device label lists both addresses, WLAN MAC and ETH MAC,
in that order.
Since 0x0 and 0x6 have the same content, it cannot be
determined which is eth0 and eth1, so we chose 0x0 for both.
Installation:
2 ways to flash factory.bin from OEM:
- Connect ethernet directly to board (the non POE port)
this is LAN for all images
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
In upper right select Reset
"Restore to factory default settings"
Wait for reboot and login again
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt boot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
*If you are unable to get network/LuCI after flashing*
You must perform another factory reset:
After waiting 3 minutes or when Power LED stop blinking:
Hold Reset button for 15 seconds while powered on
or until Power LED blinks very fast
release and wait 2 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
*DISCLAIMER*
The Failsafe image is unique to this model.
The following directions are unique to this model.
DO NOT downgrade to ar71xx this way, can cause kernel loop
The easiest way to return to the OEM software is the Failsafe image
If you dont have a serial cable, you can ssh into openwrt and run
`mtd -r erase fakeroot`
Wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
TFTP Recovery:
For some reason, TFTP is not reliable on this board.
Takes many attempts, many timeouts before it fully transfers.
Starting with an initramfs.bin:
Connect to ethernet
set IP address and TFTP server to 192.168.1.101
set up infinite ping to 192.168.1.1
rename the initramfs.bin to "vmlinux-art-ramdisk" and host on TFTP server
disconnect power to the board
hold reset button while powering on board for 8 seconds
Wait a minute, power LED should blink eventually if successful
and a minute after that the pings should get replies
You have now loaded a temporary Openwrt with default settings temporarily.
You can use that image to sysupgrade another image to overwrite flash.
Format of OEM firmware image:
The OEM software of ENS202EXT is a heavily modified version
of Openwrt Kamikaze bleeding-edge. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-ens202ext-uImage-lzma.bin
openwrt-senao-ens202ext-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring, and by swapping headers to see
what the OEM upgrade utility accepts and rejects.
Note on the factory.bin:
The newest kernel is too large to be in the kernel partition
the new ath79 kernel is beyond 1592k
Even ath79-tiny is 1580k
Checksum fails at boot because the bootloader (modified uboot)
expects kernel to be 1536k. If the kernel is larger, it gets
overwritten when rootfs is flashed, causing a broken image.
The mtdparts variable is part of the build and saving a new
uboot environment will not persist after flashing.
OEM version might interact with uboot or with the custom
OEM partition at 0x9f050000.
Failed checksums at boot cause failsafe image to launch,
allowing any image to be flashed again.
HOWEVER: one should not install older Openwrt from failsafe
because it can cause rootfs to be unmountable,
causing kernel loop after successful checksum.
The only way to rescue after that is with a serial cable.
For these reasons, a fake kernel (OKLI kernel loader)
and fake squashfs rootfs is implemented to take care of
the OEM firmware image verification and checksums at boot.
The OEM only verifies the checksum of the first image
of each partition respectively, which is the loader
and the fake squashfs. This completely frees
the "firmware" partition from all checks.
virtual_flash is implemented to make use of the wasted space.
this leaves only 2 erase blocks actually wasted.
The loader and fakeroot partitions must remain intact, otherwise
the next boot will fail, redirecting to the Failsafe image.
Because the partition table required is so different
than the OEM partition table and ar71xx partition table,
sysupgrades are not possible until one switches to ath79 kernel.
Note on sysupgrade.tgz:
To make things even more complicated, another change is needed to
fix an issue where network does not work after flashing from either
OEM software or Failsafe image, which implants the OEM (Openwrt Kamikaze)
configuration into the jffs2 /overlay when writing rootfs from factory.bin.
The upgrade script has this:
mtd -j "/tmp/_sys/sysupgrade.tgz" write "${rootfs}" "rootfs"
However, it also accepts scripts before and after:
before_local="/etc/before-upgradelocal.sh"
after_local="/etc/after-upgradelocal.sh"
before="before-upgrade.sh"
after="after-upgrade.sh"
Thus, we can solve the issue by making the .tgz an empty file
by making a before-upgrade.sh in the factory.bin
Note on built-in switch:
There is two ports on the board, POE through the power supply brick,
the other is on the board. For whatever reason, in the ar71xx target,
both ports were on the built-in switch on eth1. In order to make use
of a port for WAN or a different LAN, one has to set up VLANs.
In ath79, eth0 and eth1 is defined in the DTS so that the
built-in switch is seen as eth0, but only for 1 port
the other port is on eth1 without a built-in switch.
eth0: switch0
CPU is port 0
board port is port 1
eth1: POE port on the power brick
Since there is two physical ports,
it can be configured as a full router,
with LAN for both wired and wireless.
According to the Datasheet, the port that is not on the switch
is connected to gmac0. It is preferred that gmac0 is chosen as WAN
over a port on an internal switch, so that link status can pass
to the kernel immediately which is more important for WAN connections.
Signed-off-by: Michael Pratt <mpratt51@gmail.com>
[apply sorting in 01_leds, make factory recipe more generic, create common
device node, move label-mac to 02_network, add MAC addresses to commit
message, remove kmod-leds-gpio, use gzip directly]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
|
||
Tomasz Maciej Nowak
|
ebf71533f9 |
ath79: add support for ALLNET ALL-WAP02860AC
ALLNET ALL-WAP02860AC is a dual-band wireless access point.
Specification
SoC: Qualcomm Atheros QCA9558
RAM: 128 MB DDR2
Flash: 16 MB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
5 GHz 3T3R QCA9880 Mini PCIe card
Ethernet: 1x 10/100/1000 Mbps AR8035-A, PoE capable (802.3at)
LEDS: 5x, which four are GPIO controlled
Buttons: 1x GPIO controlled
UART: 4 pin header near Mini PCIe card, starting count from white
triangle on PCB
1. VCC 3.3V, 2. GND, 3. TX, 4. RX
baud: 115200, parity: none, flow control: none
MAC addresses
Calibration data does not contain valid MAC addresses.
The calculated MAC addresses are chosen in accordance with OEM firmware.
Because of:
a) constrained environment (SNMP) when connecting through Telnet
or SSH,
b) hard-coded kernel and rootfs sizes,
c) checksum verification of kerenel and rootfs images in bootloder,
creating factory image accepted by OEM web interface is difficult,
therefore, to install OpenWrt on this device UART connection is needed.
The teardown is simple, unscrew four screws to disassemble the casing,
plus two screws to separate mainboard from the casing.
Before flashing, be sure to have a copy of factory firmware, in case You
wish to revert to original firmware.
Installation
1. Prepare TFTP server with OpenWrt initramfs-kernel image.
2. Connect to LAN port.
3. Connect to UART port.
4. Power on the device and when prompted to stop autoboot, hit any key.
5. Alter U-Boot environment with following commands:
setenv failsafe_boot bootm 0x9f0a0000
saveenv
6. Adjust "ipaddr" and "serverip" addresses in U-Boot environment, use
'setenv' to do that, then run following commands:
tftpboot 0x81000000 <openwrt_initramfs-kernel_image_name>
bootm 0x81000000
7. Wait about 1 minute for OpenWrt to boot.
8. Transfer OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade -n /tmp/<openwrt_sysupgrade_image_name>
9. After flashing, the access point will reboot to OpenWrt. Wait few
minutes, until the Power LED stops blinking, then it's ready for
configuration.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
[add MAC address comment to commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
|
||
Christoph Krapp
|
d32010d5ff |
uboot-envtools: ath79: add ZyXEL NBG6616 uboot env support
This adds support for ZyXEL NBG6616 uboot-env access Signed-off-by: Christoph Krapp <achterin@googlemail.com> |
||
Davy Hollevoet
|
394f54ee62 |
ath79/nand: add support for Netgear WNDR4300TN
This patch adds support for the WNDR4300TN, marketed by Belgian ISP
Telenet. The hardware is the same as the WNDR4300 v1, without the
fifth ethernet port (WAN) and the USB port. The circuit board has
the traces, but the components are missing.
Specifications:
* SoC: Atheros AR9344
* RAM: 128 MB
* Flash: 128 MB NAND flash
* WiFi: Atheros AR9580 (5 GHz) and AR9344 (2.4 GHz)
* Ethernet: 4x 1000Base-T
* LED: Power, LAN, WiFi 2.4GHz, WiFi 5GHz, WPS
* UART: on board, to the right of the RF shield at the top of the board
Installation:
* Flashing through the OEM web interface:
+ Connect your computer to the router with an ethernet cable and browse
to http://192.168.0.51/
+ Log in with the default credentials are admin:password
+ Browse to Advanced > Administration > Firmware Upgrade in the Telenet
interface
+ Upload the Openwrt firmware: openwrt-ath79-nand-netgear_wndr4300tn-squashfs-factory.img
+ Proceed with the firmware installation and give the device a few
minutes to finish and reboot.
* Flashing through TFTP:
+ Configure your wired client with a static IP in the 192.168.1.x range,
e.g. 192.168.1.10 and netmask 255.255.255.0.
+ Power off the router.
+ Press and hold the RESET button (the factory reset button on the bottom
of the device, with the gray circle around it, next to the Telenet logo)
and turn the router on while keeping the button pressed.
+ The power LED will start flashing orange. You can release the button
once it switches to flashing green.
+ Transfer the image over TFTP:
$ tftp 192.168.1.1 -m binary -c put openwrt-ath79-nand-netgear_wndr4300tn-squashfs-factory.img
Signed-off-by: Davy Hollevoet <github@natox.be>
[use DT label reference for adding LEDs in DTSI files]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
|
||
Rui Salvaterra
|
9565c5726a |
uboot-envtools: ath79: add support for the Nanostation M (XM)
Tested on an AirGrid M2 (AG‑HP‑2G16). Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com> |
||
Huangbin Zhan
|
7d97fe55f4 |
uboot-envtools: ath79: update ubootenv partion index for gl-ar300m
The block index of u-boot-env changed from mtd1 to mtd3 after upgrading kernel to 5.4. This patch search the mtd block by label name, work as expect when perform a clean flash. Signed-off-by: Huangbin Zhan <zhanhb88@gmail.com> |
||
Sungbo Eo
|
358aec7775 |
ath79: add support for Arduino Yun
Arduino Yun is a microcontroller development board, based on Atmel
ATmega32u4 and Atheros AR9331.
Specifications:
- MCU: ATmega32U4
- SoC: AR9331
- RAM: DDR2 64MB
- Flash: SPI NOR 16MB
- WiFi:
- 2.4GHz: SoC internal
- Ethernet: 1x 10/100Mbps
- USB: 1x 2.0
- MicroSD: 1x SDHC
Notes:
- Stock firmware is based on OpenWrt AA.
- The SoC UART can be accessed only through the MCU.
YunSerialTerminal is recommended for access to serial console.
- Stock firmware uses non-standard 250000 baudrate by default.
- The MCU can be reprogrammed from the SoC with avrdude linuxgpio.
Installation:
1. Update U-Boot environment variables to adapt to new partition scheme.
> setenv bootcmd "run addboard; run addtty; run addparts; run addrootfs; bootm 0x9f050000 || bootm 0x9fea0000"
> setenv mtdparts "spi0.0:256k(u-boot)ro,64k(u-boot-env),15936k(firmware),64k(nvram),64k(art)ro"
> saveenv
2. Boot into stock firmware normally and perform sysupgrade with
sysupgrade image.
# sysupgrade -n -F /tmp/sysupgrade.bin
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
|
||
Renaud Lepage
|
108df3eabb |
ath79: add support for the Netgear WNDRMAC v1
The Netgear WNDRMAC v1 is a hardware variant of the Netgear WNDR3700 v2 Specifications ============== * SoC: Atheros AR7161 * RAM: 64mb * Flash on board: 16mb * WiFi: Atheros AR9220 (a/n), Atheros AR9223 (b/g/n) * Ethernet: RealTek RTL8366SR (1xWAN, 4xLAN, Gigabit) * Power: 12 VDC, 2.5 A * Full specs on [openwrt.org](https://openwrt.org/toh/hwdata/netgear/netgear_wndrmac_v1) Flash Instructions ================== It is possible to use the OEM Upgrade page to install the `factory` variant of the firmware. After the initial upgrade, you will need to telnet into the router (default IP 192.168.1.1) to install anything. You may install LuCI this way. At this point, you will have a web interface to configure OpenWRT on the WNDRMAC v1. Please use the `sysupgrade` variant for subsequent flashes. Recovery Instructions ===================== A TFTP-based recovery flash is possible if the need arises. Please refer to the WNDR3700 page on openwrt.org for details. https://openwrt.org/toh/netgear/wndr3700#troubleshooting_and_recovery Signed-off-by: Renaud Lepage <root@cybikbase.com> [update DTSI include name] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> |
||
Stijn Segers
|
63bef34db9 |
uboot-envtools: ath79: add Netgear WNDR4300SW
Add Netgear WNDR4300SW to the list of supported boards. Signed-off-by: Stijn Segers <foss@volatilesystems.org> |
||
weidong jia
|
75512fe0e7 |
uboot-envtools: fix domywifi_dw33d Bad CRC error
The current dw33d partition index has changed, this patch solves this problem. old partition layout dev: size erasesize name mtd0: 00040000 00010000 "u-boot" mtd1: 00010000 00010000 "u-boot-env" mtd2: 00fa0000 00010000 "oem-firmware" mtd3: 00010000 00010000 "art" mtd4: 00500000 00020000 "kernel" mtd5: 05b00000 00020000 "ubi" mtd6: 02000000 00020000 "oem-backup" new partition layout dev: size erasesize name mtd0: 00500000 00020000 "kernel" mtd1: 05b00000 00020000 "ubi" mtd2: 02000000 00020000 "oem-backup" mtd3: 00040000 00010000 "u-boot" mtd4: 00010000 00010000 "u-boot-env" mtd5: 00fa0000 00010000 "oem-firmware" mtd6: 00010000 00010000 "art" Signed-off-by: weidong jia <jwdsccd@gmail.com> |
||
Manuel Giganto
|
b2130b9ce8 |
ath79: add support for Devolo Magic 2 WIFI
This patch support Devolo Magic 2 WIFI, board devolo_dlan2-2400-ac.
This device is a plc wifi AC2400 router/extender with 2 Ethernet
ports, has a G.hn PLC and uses LCMP protocol from Home Grid Forum.
Hardware:
SoC: AR9344
CPU: 560 MHz
Flash: 16 MiB (W25Q128JVSIQ)
RAM: 128 MiB DDR2
Ethernet: 2xLAN 10/100/1000
PLC: 88LX5152 (MaxLinear G.hn)
PLC Flash: W25Q32JVSSIQ
PLC Uplink: 1Gbps MIMO
PLC Link: RGMII 1Gbps (WAN)
WiFi: Atheros AR9340 2.4GHz 802.11bgn
Atheros AR9882-BR4A 5GHz 802.11ac
Switch: QCA8337, Port0:CPU, Port2:PLC, Port3:LAN1, Port4:LAN2
Button: 3x Buttons (Reset, wifi and plc)
LED: 3x Leds (wifi, plc white, plc red)
GPIO Switch: 11-PLC Pairing (Active Low)
13-PLC Enable
21-WLAN power
MACs Details verified with the stock firmware:
Radio1: 2.4 GHz &wmac *:4c Art location: 0x1002
Radio0: 5.0 GHz &pcie *:4d Art location: 0x5006
Ethernet ðernet *:4e = 2.4 GHz + 2
PLC uplink --- *:4f = 2.4 GHz + 3
Label MAC address is from PLC uplink
OEM SSID: echo devolo-$(grep SerialNumber /dev/mtd1 | grep -o ...$)
OEM WiFi password: grep DlanSecurityID /dev/mtd1|tr -d -|cut -d'=' -f 2
Recommendations: Configure and link your PLC with OEM firmware
BEFORE you flash the device. PLC configuration/link should
remain in different memory and should work straight forward
after flashing.
Restrictions: PLC link detection to trigger plc red led is not
available. PLC G.hn chip is not compatible with open-plc-tools,
it uses LCMP protocol with AES-128 and requires different
software.
Notes: Pairing should be possible with gpio switch. Default
configuration will trigger wifi led with 2.4Ghz wifi traffic
and plc white led with wan traffic.
Flash instruction (TFTP):
1. Set PC to fixed ip address 192.168.0.100
2. Download the sysupgrade image and rename it to uploadfile
3. Start a tftp server with the image file in its root directory
4. Turn off the router
5. Press and hold Reset button
6. Turn on router with the reset button pressed and wait ~15 seconds
7. Release the reset button and after a short time
the firmware should be transferred from the tftp server
8. Allow 1-2 minutes for the first boot.
Signed-off-by: Manuel Giganto <mgigantoregistros@gmail.com>
|
||
|
WeiDong Jia
|
643cab4f31 |
ath79: add support for DomyWifi DW33D
This commit ports the device from ar71xx to the ath79 target and modifies the partition layout. 1. Firmware is installed to nand flash. 2. Modify the uboot-env parameter to boot from the nand flash. 3. The kernel size is extended to 5M. 4.nor flash retains the oem firmware. oem partition layout dev: size erasesize name mtd0: 00040000 00010000 "u-boot" mtd1: 00010000 00010000 "u-boot-env" mtd2: 00e30000 00010000 "rootfs" mtd3: 00170000 00010000 "kernel" mtd4: 00010000 00010000 "art" mtd5: 00f90000 00010000 "firmware" mtd6: 06000000 00020000 "rootfs_data" mtd7: 02000000 00020000 "backup" new partition layout dev: size erasesize name mtd0: 00040000 00010000 "u-boot" mtd1: 00010000 00010000 "u-boot-env" mtd2: 00fa0000 00010000 "oem-firmware" mtd3: 00010000 00010000 "art" mtd4: 00500000 00020000 "kernel" mtd5: 05b00000 00020000 "ubi" mtd6: 02000000 00020000 "oem-backup" MAC address overview: All mac addresses are stored in the art partition. eth0: 0x0 eth1: 0x6 ath9k: 0xc ath10k: 0x12 No valid addresses in 0x1002 and 0x5006. All addresses match the OEM firmware. Install from oem firmware. Enable ssh service: Connect to the router web, click professional, click system-startup, and add dropbear in the local startup input box. Click system-administration, delete ssh-key, and replace your ssh pub key. Restart the router. 1.Upload openwrt firmware to the device scp openwrt-snapshot-r11365-df60a0852c-ath79-nand-domywifi_dw33d-\ squashfs-factory.bin root@192.168.10.1:/tmp 2.modify uboot-env. ssh login to the device: fw_setenv bootcmd 'nboot 0x8050000 0;bootm || bootm 0x9fe80000' Run the fw_printenv command to check if the settings are correct. 3.Write openwrt firmware. ssh login to the device: mtd -r write /tmp/openwrt-snapshot-r11365-df60a0852c-ath79-nand-\ domywifi_dw33d-squashfs-factory.bin /dev/mtd6 The device will restart automatically and the openwrt firmware installation is complete. Restore oem firmware.just erase the kernel partition and the ubi partition. ssh login to the device: mtd erase /dev/mtd4 mtd -r erase /dev/mtd5 Reboot the device Signed-off-by: WeiDong Jia <jwdsccd@gmail.com> [alter flash instruction in commit message] Signed-off-by: Chuanhong Guo <gch981213@gmail.com> |