The Airoha EN7581 got renamed to AN7581 due to move from Econet to
Airoha.
To save on compatibility, use both compatible for the device.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
CONFIG_HARDEN_BRANCH_PREDICTOR option is included two times in this
configuration file. Remove one definition. On arm32 SoC it should not be
needed.
Fixes: 54f9744c82 ("treewide: disable spectre mitigation on unaffected Arm32 targets")
Link: https://github.com/openwrt/openwrt/pull/16743
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Also remove vmlinuz-initramfs files from final imagebuilder image as
these file are not needed.
Fixes: c85348d9ab ("imagebuilder: remove initramfs image files")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
ALFA Network WiFi CampPro Nano Duo is a dual-radio Wi-Fi signal extender
(router) in USB dongle form-factor (Type-A plug is used only for power),
based on combination of two radio chipsets: Qualcomm QCA9531 (main SOC)
and MediaTek MT7610U (connected over USB 2.0 interface).
Specifications:
- SOC: QCA9531 v2 (650 MHz)
- DRAM: DDR2 128 MiB (Nanya NT5TU64M16HG-AC)
- Flash: 16 MiB SPI NOR (Macronix MX25L12835F)
- Ethernet: 1x 10/100 Mbps Ethernet (QCA9531)
- Wi-Fi: 2x2:2 2.4 GHz Wi-Fi 4 (QCA9531)
1x1:1 2.4/5 GHz Wi-Fi 5 (MT7610U)
- Antenna: 3x RP-SMA (female) antenna connectors
- LED: 1x orange (RJ45, power indicator)
2x green (status + RJ45 activity/link)
1x blue (Wi-Fi 2.4 GHz status)
- Button: 1x button (reset)
- UART: 1x 4-pin, 2.00 mm pitch header on PCB
- Other: external h/w watchdog (EM6324QYSP5B, enabled by default)
GPIO-controlled USB power for MT7610U
MAC addresses:
- LAN: 00:c0:ca:xx:xx:6d (art 0x2, -1)
- 2.4 GHz (QCA9531): 00:c0:ca:xx:xx:6e (art 0x2, device's label)
- 2.4/5 GHz (MT7610U): 00:c0:ca:xx:xx:6f (from eeprom)
Flash instructions:
You can use sysupgrade image directly in vendor firmware which is based
on LEDE/OpenWrt. Alternatively, you can use web recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with RJ45 port, press the reset button, power up device,
wait for first blink of status LED (indicates network setup), then
keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Instead of passing NULL to gpiochip_add_data, we can populate the
parameter and use gpiochip_get_data instead of a custom function.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16739
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Easier to just use devm_platform_ioremap_resource.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16701
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for the Cisco Meraki MX64 and MX65 devices which
use the Broadcom NSP SoC, which is compatible with the bcm53xx platform.
MX64 Hardware info:
- CPU: Broadcom BCM58625 Cortex A9 @ 1200Mhz
- RAM: 2 GB (4 x 4Gb SK Hynix H5TC4G83CFR)
- Storage: 1 GB (Micron MT29F8G08ABACA)
- Networking: BCM58625 internal switch (5x 1GbE ports)
- USB: 1x USB2.0
- Serial: Internal header
MX65 Hardware info:
- CPU: Broadcom BCM58625 Cortex A9 @ 1200Mhz
- RAM: 2 GB (4 x 4Gb SK Hynix H5TC4G83CFR)
- Storage: 1 GB (Micron MT29F8G08ABACA)
- Networking: BCM58625 switch (2x 1GbE ports, used for WAN ports 1 & 2)
2x Qualcomm QCA8337 switches (10x 1GbE ports, used for LAN ports 3-12)
- PSE: Broadcom BCM59111KMLG connected to LAN ports 11 & 12
- USB: 1x USB2.0
- Serial: Internal header
Notes:
- The Meraki provided GPL source are available at [2].
- Wireless capability on the MX64W and MX65W exists in the form of 2x
Broadcom BCM43520KMLG, which is not supported. These devices will work
otherwise as standard MX64 or MX65 devices.
- Early MX64 units use an A0 variant of the BCM958625 SoC which lacks
cache coherency and uses a different "secondary-boot-reg". As a
consequence a different device tree is needed.
- Installation of OpenWrt requires changing u-boot to a custom version.
This is due to the stock u-boot "nand read" command being limited to
load only 2MB, in spite of the bootkernel1 and bootkernel2 partitions
both being 3MB in the stock layout. It is also required to allow
booting via USB, enabling cache coherency and setting up the QCA
switches and Serdes link on the MX65. The modified sources for U-boot
are available for the MX64[3] and MX65[4].
- Initial work on this device used a small bootloader within the OEM
partition scheme. To allow booting of larger kernels, UBI and bootm
support has been added, along with ability to store env variables to
the NAND. The Shmoo and newly created env partitions have been moved
to the extra space available after the nvram data.
- Users who installed the previous non-UBI supporting bootloader will
need to convert to the new one before flashing a compatible image.
These steps are detailed below.
References:
[1] https://www.broadcom.com/products/embedded-and-networking-processors/c
ommunications/bcm5862x
[2] https://dl.meraki.net/wired-14-39-mx64-20190426.tar.bz2
[3] https://github.com/clayface/U-boot-MX64-20190430_MX64
[4] https://github.com/clayface/U-boot-MX64-20190430_MX65
Installation guide:
Initial installation steps:
1. Compile or obtain OpenWrt files for the MX64 or MX65, including
u-boot[3][4], initramfs and sysupgrade images.
2. A USB disk with DOS partition scheme and primary FAT partition is
required.
3. If installing onto an MX64, set up a local web server.
4. On the device, boot into diagnostic mode by holding reset when
powering on the device. Continue to hold reset until the orange LED
begins to flash white. On used units the white flash may be difficult
to see.
5. Plug an Ethernet cable into the first LAN port, set the host to
192.168.1.2 and confirm telnet connectivity to 192.168.1.1.
U-boot installation - MX64 Only:
1. Newer fw versions require extra steps to support OpenWrt. To check,
please connect via telnet and run:
`cat /sys/block/mtdblock0/ro`
If the result is 1, your mtd0 is locked will need to perform extra
steps 4 and 5 in this section. If the result is 0 then skip these.
2. Check which SoC is in use by running the following command:
`devmem 0x18000000`
If devmem is not found then try:
`devmem2 0x18000000`
If the output begins with anything between "0x3F00-0x3F03" you will
need to use the A0 release. For any other output, eg "0x3F04" or
higher, use the regular MX64 image.
3 Confirm the size of the device's boot(mtd0) partition. In most
cases it should be 0x100000 or larger. If this is the case, please
proceed to use the uboot_mx64 image. If the reported size is
0x80000, please use the uboot_mx64_small image, then follow the
later guide to change to the larger image.
`cat /proc/mtd`
Example output:
`# cat /proc/mtd
cat /proc/mtd
dev: size erasesize name
mtd0: 00100000 00040000 "boot"
mtd1: 00080000 00040000 "shmoo"
mtd2: 00300000 00040000 "bootkernel1"
mtd3: 00100000 00040000 "nvram"
mtd4: 00300000 00040000 "bootkernel2"
mtd5: 3f700000 00040000 "ubi"
mtd6: 40000000 00040000 "all"`
4. Set up a webserver to serve the appropriate uboot_mx64 from the
following location and verify the SHA512:
https://github.com/clayface/U-boot-MX64-20190430_MX64
5. (Only if mtd0 is locked) You will also need the mtd-rw.ko kernel
module to unlock the partition from the same repo. An mtd executable
is also needed to write the mtd block. Place these on the web server
as well.
6. (Only if mtd0 is locked) Use wget to retrieve the files on the MX64:
`wget http://192.168.1.2/mtd-rw.ko`
`insmod mtd-rw.ko i_want_a_brick=1`
and confirm the unlock is set with dmesg
`mtd-rw: mtd0: setting writeable flag`
7. Download the appropriate u-boot image according to step 3. If you
did not need to unlock the mtd0 partition then use dd to write the
file, with caution:
`wget http://192.168.1.2/uboot_mx64`
`dd if=uboot_mx64 of=/dev/mtdblock0`
If you needed to unlock the mtd0 partition using the mtd-rw module,
run these commands instead to install u-boot instead:
`wget http://192.168.1.2/mtd`
`chmod +x mtd`
`wget http://192.168.1.2/uboot_mx64`
`./mtd write uboot_mx64 /dev/mtd0`
8. Once this has successfully completed, power off the device. If you
did not need to install the small u-boot image, proceed to
"OpenWrt Installation". Otherwise proceed to "UBI supporting
bootloader installation".
U-boot installation - MX65 Only:
1. Obtain telnet access to the MX65.
2. Confirm the size of the device's boot(mtd0) partition. In most
cases it should be 0x100000 or larger. If this is the case, please
proceed to use the uboot_mx65 image. If the reported size is
0x80000, please use the uboot_mx65_small image, then follow the
later guide to change to the larger image.
`cat /proc/mtd`
3. Prepare a USB drive formatted to FAT. Download the appropriate
uboot_mx65 to the USB drive from the following location and verify
the SHA512:
https://github.com/clayface/U-boot-MX64-20190430_MX65
3. Once you have telnet access to the MX65, plug in the USB disk and
run the following commands, with caution. The USB disk should
automount but if it does not, you will need to power off and on
again with reset held. Depending on step 2, use the uboot_mx65 or
uboot_mx65_small image accordingly:
`cd /tmp/media/sda1`
`dd if=uboot_mx65 of=/dev/mtdblock0`
4. Once this has successfully completed, power off the device. If you
did not need to install the small u-boot image, proceed to
"OpenWrt Installation". Otherwise proceed to "UBI supporting
bootloader installation".
UBI supporting bootloader installation:
These steps need to be followed if the older u-boot image was
installed, either because the Meraki diagnostic partition scheme used
0x80000 as the mtd0 size, or because you installed the u-boot provided
while OpenWrt support was still under development. If using OpenWrt,
please make a backup before proceeding.
1. Obtain the relevant image from the MX64(A0) or MX65 u-boot repo:
`openwrt-bcm5862x-generic-meraki_XXXX-initramfs-kernel.bin`
2. With the USB drive already inserted, power on the device while
holding the reset button. A white/orange flashing pattern will
occur shortly after power on. Let go of the reset button. The
device is now booting into OpenWrt initramfs stored on the USB
disk.
3. Connect by SSH to 192.168.1.1 and flash the embedded u-boot image,
changing X as appropriate:
`mtd write /root/uboot_mx6X /dev/mtd0`
You do not need to reboot as this image can handle "Kernel-in-UBI"
OpenWrt installation.
4. You can proceed to obtain and flash the appropriate OpenWrt image
at "OpenWrt Installation" Step 3.
5. Reboot will take significantly longer due to Shmoo calibration. In
case the device does not come online after several minute, power-
cycle the device and see if it boots. If you see an orange/white
flashing pattern, this indicates UBI booting was not successful and
you will need to copy a new bcm53xx image to a USB disk before
booting it and attempting to install OpenWrt again - refer to
"OpenWrt Installation" step 1. Do not attempt to reflash u-boot in
this scenario.
OpenWrt Installation:
1. Having obtained an OpenWrt image, please copy the file
`openwrt-bcm53xx-generic-meraki_XXXX-initramfs.bin`
to the base directory of a FAT formatted USB drive using DOS
partition scheme ,where XXXX is mx64, mx64_a0 or mx65 depending on
which device you have.
2. With the USB drive already inserted, power on the device. Boot time
will be longer than usual while Shmoo calibration takes place. A
different white/orange flashing pattern will eventually occur to
indicate device is now booting into OpenWrt initramfs stored on the
USB disk.
3. Ensuring Ethernet is plugged into a LAN port with IP set in the
192.168.1.0/24 subnet excluding 192.168.1.1, use SCP to copy the
sysupgrade file to 192.168.1.1:/tmp, eg:
`scp openwrt-bcm53xx-generic-meraki_XXXX-squashfs.sysupgrade.bin\
192.168.1.1:/tmp`
4. Connect by SSH to 192.168.1.1 and run sysupgrade:
`sysupgrade \
/tmp/openwrt-bcm53xx-generic-meraki_XXXX-squashfs.sysupgrade.bin`
5. OpenWrt should now be installed on the device.
Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
[ Rebase kernel configuration for 6.6,
fix failsafe by making kmod-eeprom-at24 and kmod-dsa-qca8k built-in,
resolve conflicts,
add LED aliases,
fix eth0 MAC address at probe ]
TODO:
- fix multiple LED colors not applied despite aliases - due to custom
/etc/diag.sh
- fix race condition between preinit and probing of the DSA tree,
causing no network interface available in failsafe mode (in general
case - to allow moving drivers back to modules)
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16634
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Enable support for qca8k switch used in Meraki MX65. This is required to
properly support preinit networking on this device, otherwise unit won't
be accessible in failsafe mode.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16634
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is required for the AT24 EEPROM holding MAC address on Meraki
devices to probe before preinit starts, so all network devices can be
available at the preinit network setup starts
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16634
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Meraki MX6x devices use them to store MAC address, so it is required to be
built-in for networking to probe properly, before preinit network setup
happens, which in turn is required for proper failsafe mode access.
Enable CONFIG_EEPROM_AT24 for the target.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16634
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This patch is required to support reading MAC address on Meraki MX64/65
line of devices, but also touches MR32, so let's backport it first.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16634
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This patch adds "REQUIRE_IMAGE_METADATA=1" requirement for the MR26 and
MR32, with REQUIRE_IMAGE_METADATA explicitly 0 elsewhere. This is based
upon bcm63xx's base-files/lib/upgrade/platform.sh.
Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16634
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Oversight from 8d302f5ebc , which requires
this to work. I couldn't test it as I ended up wiping my UBI volume by
accident.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16580
Signed-off-by: Robert Marko <robimarko@gmail.com>
This is needed in order to get a MAC address from UBI.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16580
Signed-off-by: Robert Marko <robimarko@gmail.com>
linux,ubi expects the volname variable, not volume.
This will fix NVMEM-on-UBI.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16580
Signed-off-by: Robert Marko <robimarko@gmail.com>
Since kernel_oldconfig doesn't work properly with it, I ran that first
and then moved all the config symbols to config-6.6 and found the
differences.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16580
Signed-off-by: Robert Marko <robimarko@gmail.com>
make kernel_oldconfig doesn't seem to work with this. Handle manually.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16580
Signed-off-by: Robert Marko <robimarko@gmail.com>
Adjusts the default config to modern kernels.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16580
Signed-off-by: Robert Marko <robimarko@gmail.com>
The ImageBuilder when using the profile for the OpenWrt One has been
failing because the initramfs image included in the ubinized image could
not be found.
Fix that by using the staged initramfs instead when using the
ImageBuilder.
Fixes: 797904b3cb ("mediatek/filogic: add OpenWrt One support")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Introduce EN7581 SoC support with currently rfb board supported.
This is a new 64bit SoC from Airoha that is currently almost fully
supported upstream with only the DTS missing. Setting source-only
waiting for the full upstream support to be completed.
Link: https://github.com/openwrt/openwrt/pull/16730
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Backport alloc_netdev_dummy patch from upstream needed for new Airoha
EN7581 SoC.
Refresh all affected patch with make target/linux/refresh.
Link: https://github.com/openwrt/openwrt/pull/16730
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
In preparation for EN7581 SoC support, move en7523 in dedicated
subtarget.
This is needed as EN7581 is now 64bit but en7523 is 32bit hence have
very different kernel config.
Also rename patch to a more friendly number sequence.
Link: https://github.com/openwrt/openwrt/pull/16730
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
COMFAST CF-E355AC v2 is a ceiling mount AP with PoE support,
based on Qualcomm/Atheros QCA9531 + QCA9886.
Short specification:
- 1x 10/100 Mbps Ethernet, with PoE support (wan/eth1)
- 1x 10/100/1000 Mbps Ethernet, with PoE support (lan/eth0)
- 128MB of RAM (DDR2)
- 16 MB of FLASH
- 2T2R 2.4 GHz, 802.11b/g/n (wlan2g)
- 2T2R 5 GHz, 802.11ac/n/a, WAVE 2 (wlan5g)
- built-in 4x 3 dBi antennas
- output power (max): 500 mW (27 dBm)
- 1x RGB LED, 1x button
- separate watchdog chip via GPIO (bottom of PCB?)
- UART header on PCB with proper labelling
Markings on PCB:
* R121QH_VER2.1 (silkscreen, bottom)
* CF-WA800 (sticker, top)
Initial flashing instructions:
Original firmware is based on OpenWrt.
a) Use sysupgrade image directly in vendor GUI.
b) Or via tftp:
ipaddr=192.168.1.1
serverip=192.168.1.10
bootfile="firmware.bin"
c) Or possibly via u-boot's `httpd` command.
MAC-address mapping follows original firmware:
* eth1 (wan) is the lowest mac address (art @ 0x0)
* eth0 (lan) uses eth1 + 1 (art @ 0x1002)
* wlan2g (phy1) uses eth1 + 2 (art @ 0x06)
* wlan5g (phy0) uses eth1 + 10 (not present in art)
* unused MAC (eth1 + 3) (art @ 0x5006)
Art dump (`hexdump /dev/mtd1 |grep ZZZZ`):
0000000 ZZZZ XXXX XXX0 ZZZZ XXXX XXX2 ffff ffff
0001000 0202 ZZZZ XXXX XXX1 0000 0000 0000 0000
0005000 202f bd21 0101 ZZZZ XXXX XXX3 0000 2000
Root access to original firmware (only via UART) can be achieved by
making a backup of configuration from web interface. Backup contains
whole `/etc` directory...
Signed-off-by: Priit Laes <plaes@plaes.org>
Link: https://github.com/openwrt/openwrt/pull/16556
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Fix conditions for handling offloaded packets
Fixes: #13430
Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Set the physical switch to KEY_RFKILL, since its previous value
(KEY_SETUP) is unsupported. This should also make the KEY_RESET button
functional, by allowing the gpio-button-hotplug kmod to load.
Signed-off-by: Chris Jones <cmsj@tenshu.net>
Link: https://github.com/openwrt/openwrt/pull/16564
Signed-off-by: Robert Marko <robimarko@gmail.com>
AT803X_PHY was replaced with QCA83XX_PHY which handles external switches.
But for internal ones like in the Meraki MR24, AT803X_PHY is needed.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16737
Signed-off-by: Robert Marko <robimarko@gmail.com>
The qpic DMA controller is used by the parallel NAND Flash
interface. We don't need to enable it when nand-controller node
is marked as disabled.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/16654
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Mikrotik seems to prefer "hEX S" as general name for this model,
therefore include this in devicetree model name as well.
Signed-off-by: Priit Laes <plaes@plaes.org>
Link: https://github.com/openwrt/openwrt/pull/16658
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This allows the llvm toolchain to be executed on different host.
Also add it to strip list.
Fixes: 0ac0840088 ("sdk: ship llvm toolchain")
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Link: https://github.com/openwrt/openwrt/pull/16674
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Increase usage of devm to get rid of goto and _remove.
Get rid of hw_reset_count. It's not really used for anything.
Use dev_err_probe to handle potential EPROBE_DEFER.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16588
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
If LEDs are disabled, they should not be handled.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16651
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
No longer need normal _remove function. Replaced with _disable.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16651
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
NEC Aterm WG1800HP2 is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on
QCA9558.
Specification:
- SoC : Qualcomm Atheros QCA9558
- RAM : DDR2 128 MiB (2x Nanya NT5TU32M16DG-AC)
- Flash : SPI-NOR 16 MiB (Macronix MX25L12845EMI-10G)
- WLAN : 2.4/5 GHz
- 2.4 GHz : 3T3R (Qualcomm Atheros QCA9558 (SoC))
- 5 GHz : 3T3R (Qualcomm Atheros QCA9880)
- Ethernet : 5x 10/100/1000 Mbps
- switch : Atheros AR8327
- LEDs/Keys (GPIO) : 12x/5x
- UART : through-hole on PCB
- assignment : 3.3V, GND, NC, TX, RX from tri-angle marking
- settings : 9600n8
- USB : 1x USB 2.0 Type-A
- hub (internal) : NEC uPD720114
- Power : 12 VDC, 1.5 A (Max. 17 W)
- Stock OS : NetBSD based
Flash instruction using initramfs-factory.bin image (StockFW WebUI):
1. Boot WG1800HP2 with router mode normally
2. Access to the WebUI ("http://aterm.me/" or "http://192.168.0.1/") on
the device and open firmware update page ("ファームウェア更新")
3. Select the OpenWrt initramfs-factory.bin image and click update
("更新") button
4. After updating, the device will be rebooted and booted with OpenWrt
initramfs image
5. On the initramfs image, upload (or download) uboot.bin and
sysupgrade.bin image to the device
6. Replace the bootloader with a uboot.bin image
mtd write <uboot.bin image> bootloader
7. Perform sysupgrade with a sysupgrade.bin image
sysupgrade <sysupgrade image>
8. Wait ~120 seconds to complete flashing
Flash instruction using initramfs-factory.bin image (bootloader CLI):
1. Connect and open serial console
2. Power on WG1800HP2 and interrupt bootloader by ESC key
3. Login to the bootloader CLI with a password "chiron"
4. Start TFTP server by "tftpd" command
5. Upload initramfs-factory.bin via tftp from your computer
example (Windows): tftp -i 192.168.0.1 PUT initramfs-factory.bin
6. Boot initramfs image by "boot" command
7. On the initramfs image, back up the stock bootloader and firmware if
needed
8. Upload (or download) uboot.bin and sysupgrade.bin image to the device
9. Replace the bootloader with a uboot.bin image
10. Perform sysupgrade with a sysupgrade.bin image
11. Wait ~120 seconds to complete flashing
Notes:
- All LEDs are connected to the TI TCA6416A (marking: PH416A) I2C
Expander chip.
- The stock bootloader requires an unknown filesystem on firmware area
in the flash. Booting of OpenWrt from that filesystem cannot be
handled, so the bootloader needs to be replaced to mainline U-Boot
before OpenWrt installation.
MAC addresses:
LAN : A4:12:42:xx:xx:44 (config, 0x6 (hex))
WAN : A4:12:42:xx:xx:45 (config, 0xc (hex))
2.4 GHz: A4:12:42:xx:xx:46 (config, 0x0 (hex))
5 GHz : A4:12:42:xx:xx:47 (config, 0x12 (hex))
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16297
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
NEC Aterm WG1800HP is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on
QCA9558.
Specification:
- SoC : Qualcomm Atheros QCA9558
- RAM : DDR2 128 MiB (2x Nanya NT5TU32M16DG-AC)
- Flash : SPI-NOR 16 MiB (Macronix MX25L12845EMI-10G)
- WLAN : 2.4/5 GHz
- 2.4 GHz : 3T3R (Qualcomm Atheros QCA9558 (SoC))
- 5 GHz : 3T3R (Qualcomm Atheros QCA9880)
- Ethernet : 5x 10/100/1000 Mbps
- switch : Atheros AR8327
- LEDs/Keys (GPIO) : 12x/5x
- UART : through-hole on PCB
- assignment : 3.3V, GND, NC, TX, RX from tri-angle marking
- settings : 9600n8
- USB : 1x USB 2.0 Type-A
- hub (internal) : NEC uPD720114
- Power : 12 VDC, 1.5 A (Max. 17 W)
- Stock OS : NetBSD based
Flash instruction using initramfs-factory.bin image (StockFW WebUI):
1. Boot WG1800HP with router mode normally
2. Access to the WebUI ("http://aterm.me/" or "http://192.168.0.1/") on
the device and open firmware update page ("ファームウェア更新")
3. Downgrade the stock firmware to v1.0.2
4. After downgrading, select the OpenWrt initramfs-factory.bin image and
click update ("更新") button
5. After updating, the device will be rebooted and booted with OpenWrt
initramfs image
6. On the initramfs image, upload (or download) uboot.bin and
sysupgrade.bin image to the device
7. Replace the bootloader with a uboot.bin image
mtd write <uboot.bin image> bootloader
8. Perform sysupgrade with a sysupgrade.bin image
sysupgrade <sysupgrade image>
9. Wait ~120 seconds to complete flashing
Flash instruction using initramfs-factory.bin image (bootloader CLI):
1. Connect and open serial console
2. Power on WG1800HP and interrupt bootloader by ESC key
3. Login to the bootloader CLI with a password "chiron"
4. Start TFTP server by "tftpd" command
5. Upload initramfs-factory.bin via tftp from your computer
example (Windows): tftp -i 192.168.0.1 PUT initramfs-factory.bin
6. Boot initramfs image by "boot" command
7. On the initramfs image, back up the stock bootloader and firmware if
needed
8. Upload (or download) uboot.bin and sysupgrade.bin image to the device
9. Replace the bootloader with a uboot.bin image
10. Perform sysupgrade with a sysupgrade.bin image
11. Wait ~120 seconds to complete flashing
Notes:
- All LEDs are connected to the TI TCA6416A (marking: PH416A) I2C
Expander chip.
- The stock bootloader requires an unknown filesystem on firmware area
in the flash. Booting of OpenWrt from that filesystem cannot be
handled, so the bootloader needs to be replaced to mainline U-Boot
before OpenWrt installation.
- The data length of blocks in firmware image will be checked
(4M < threshold < 6M) on the stock WebUI on some versions (v1.0.28,
v1.0.30(latest), ...), so needs to be downgraded before OpenWrt
installation with initramfs-factory image.
MAC addresses:
LAN : 10:66:82:xx:xx:04 (config, 0x6 (hex))
WAN : 10:66:82:xx:xx:05 (config, 0xc (hex))
2.4 GHz: 10:66:82:xx:xx:06 (config, 0x0 (hex))
5 G : 10:66:82:xx:xx:07 (config, 0x12 (hex))
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16297
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
NEC Aterm WG1400HP is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on
QCA9558.
Specification:
- SoC : Qualcomm Atheros QCA9558
- RAM : DDR2 128 MiB (2x Nanya NT5TU32M16DG-AC)
- Flash : SPI-NOR 16 MiB (Macronix MX25L12845EMI-10G)
- WLAN : 2.4/5 GHz
- 2.4 GHz : 3T3R (Qualcomm Atheros QCA9558 (SoC))
- 5 GHz : 2T2R (Qualcomm Atheros QCA9882)
- Ethernet : 5x 10/100/1000 Mbps
- switch : Atheros AR8327
- LEDs/Keys (GPIO) : 12x/5x
- UART : through-hole on PCB
- assignment : 3.3V, GND, NC, TX, RX from tri-angle marking
- settings : 9600n8
- USB : 1x USB 2.0 Type-A
- hub (internal) : NEC uPD720114
- Power : 12 VDC, 1.5 A (Max. 17 W)
- Stock OS : NetBSD based
Flash instruction using initramfs-factory.bin image (StockFW WebUI):
1. Boot WG1400HP with router mode normally
2. Access to the WebUI ("http://aterm.me/" or "http://192.168.0.1/") on
the device and open firmware update page ("ファームウェア更新")
3. Select the OpenWrt initramfs-factory.bin image and click update
("更新") button
4. After updating, the device will be rebooted and booted with OpenWrt
initramfs image
5. On the initramfs image, upload (or download) uboot.bin and
sysupgrade.bin image to the device
6. Replace the bootloader with a uboot.bin image
mtd write <uboot.bin image> bootloader
7. Perform sysupgrade with a sysupgrade.bin image
sysupgrade <sysupgrade image>
8. Wait ~120 seconds to complete flashing
Flash instruction using initramfs-factory.bin image (bootloader CLI):
1. Connect and open serial console
2. Power on WG1400HP and interrupt bootloader by ESC key
3. Login to the bootloader CLI with a password "chiron"
4. Start TFTP server by "tftpd" command
5. Upload initramfs-factory.bin via tftp from your computer
example (Windows): tftp -i 192.168.0.1 PUT initramfs-factory.bin
6. Boot initramfs image by "boot" command
7. On the initramfs image, back up the stock bootloader and firmware if
needed
8. Upload (or download) uboot.bin and sysupgrade.bin image to the device
9. Replace the bootloader with a uboot.bin image
10. Perform sysupgrade with a sysupgrade.bin image
11. Wait ~120 seconds to complete flashing
Notes:
- All LEDs are connected to the TI TCA6416A (marking: PH416A) I2C
Expander chip.
- The stock bootloader requires an unknown filesystem on firmware area
in the flash. Booting of OpenWrt from that filesystem cannot be
handled, so the bootloader needs to be replaced to mainline U-Boot
before OpenWrt installation.
MAC addresses:
LAN : 10:66:82:xx:xx:20 (config, 0x6 (hex))
WAN : 10:66:82:xx:xx:21 (config, 0xc (hex))
2.4 GHz: 10:66:82:xx:xx:22 (config, 0x0 (hex))
5 GHz : 10:66:82:xx:xx:23 (config, 0x12 (hex))
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16297
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Commonize function names of SGMII calibration functions of QCA955x added
for Meraki MR18, to use them for NEC Aterm series based on QCA9558 as
well.
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16297
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add missing reset bits of USB phys on QCA955x SoCs to qca955x.dtsi to
handle them.
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16297
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
It seems this was only used by one device in ar71xx. Might as well
reapply it.
Make use of the separate TX gain table for WZR-HP-G450H:
0f978bfaf2
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15949
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The Gemtek WVRTM-127ACN is an indoor dual band wifi router
with internal antennas and 3 Gigabit Ethernet ports.
The Gemtek WVRTM-130ACN is an indoor dual band wifi router
with external antennas and 5 Gigabit Ethernet ports.
Hardware of WVRTM-127ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB
- Storage: 128 MB NAND SLC flash
- Ethernet: 3x 10/100/1000 Mbps LAN1,LAN2 & WAN
- Wireless: 2.4GHz: Mediatek MT7603EN (802.11b/g/n)
- Wireless: 5GHz: Mediatek MT7612EN (802.11n/ac)
- LEDs: 11x
- Buttons: 2x WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ IN (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-127ACN_V02" "19K-513-8500R" "RoHS" "1717"
Hardware of WVRTM-130ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB (Kioxia TC58BVG0S3HTA00)
- Storage: 128 MB NAND SLC (Winbond W971GG6SB-25)
- Ethernet: 5x 10/100/1000 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
- Wireless: 2.4GHz and 5GHz Mediatek MT7615DN (802.11ac/b/g/n) (DBDC)
- LEDs: 10x
- Buttons: 3x Power, WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-130ACN_V01" "19K-515-4500R" "RoHS" "2112"
Enable access to uboot menu (needed in wvrtm-130acn):
- The access to uboot menu is blocked by `bootdelay = 0` set in ubootenv.
With stock firmware version 01.01.02.163 and previous, you can use CVE 2020-24365
command injection https://nvd.nist.gov/vuln/detail/CVE-2020-24365
python3 exploit.py -t 192.168.1.1 -c "fw_setenv bootdelay 3; fw_saveenv"
Backup the stock firmware:
- Connect via uart
- Connect via ethernet and assign your pc the address 192.168.15.x/24
- Power on the device; and start typing '4' to enter uboot menu
- Set factory mode and boot
MT7621 # setenv factory 2; saveenv
MT7621 # nand read 2800000 2000000 81000000; bootm
- Telnet and copy all mtd blocks
telnet 192.168.15.1
- Copy all mtd blocks and start webserver
for N in $(seq 0 6); do dd if=/dev/mtd$N of=/tmp/eeprom_mtd$N.bin; done
mount -o bind /tmp /www
lighttpd -f /etc/lighttpd.conf
- Backup stock rootfs_data (optional)
dd if=/dev/mtd7 of=/tmp/eeprom_mtd7.bin
dd if=/dev/mtd8 of=/tmp/eeprom_mtd8.bin
- Download to your pc from http://192.168.15.1/eeprom_mtd$N.bin
Installation:
- Connect via uart
- Connect via ethernet and assign your pc the address 10.10.10.3/24
- Start a tftp server and serve the image initramfs-kernel.bin
mkdir /tmp/ftpd;
cp initramfs-kernel.bin /tmp/ftpd/kernel.bin
dnsmasq --enable-tftp --tftp-root=/tmp/ftpd
- Power on the device; and start typing '4' to halt the bootloader
- Change the active mtd partition from mtd6 to mtd5 (needed by uboot)
MT7621 # setenv mtddevnum 5; saveenv
- Write the openwrt initramfs in ram via tftp and boot it
MT7621 # tftpboot 81000000 kernel.bin; bootm
- From the initramfs create the ubi device and install openwrt via sysupgrade
ubiformat /dev/mtd11 -y
sysupgrade -n -v /tmp/sysupgrade.bin
Recovery:
Restore the stock firmware from the backup of the mtd blocks
mtd write eeprom_mtd5.bin firmware
mtd write eeprom_mtd6.bin Kernel2
mtd write eeprom_mtd7.bin Storage1
mtd write eeprom_mtd8.bin Storage2
ubiformat /dev/mtd8 -y
reboot
Links to previous works on wvrtm-127acn:
https://github.com/digiampietro/hacking-gemtekhttps://forum.openwrt.org/t/add-support-for-gemtek-wvrtm-127acn-linkem-provider/168757
Signed-off-by: Samuele Longhi <agave@dracaena.it>
Link: https://github.com/openwrt/openwrt/pull/16685
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The swconfig-based b53 driver for the BCM53128 switch stopped working
after commits b2cfed48f6 (Revert "swconfig: fix Broadcom b53 support")
and e4e410733f (kernel: export switch_generic_set_link() symbol). This
rendered the 8 LAN ports of the EdgeSwitch 8XP non-functional, so the
image compilation for the device was disabled (5a1d7d8c1b).
This commit adds the kmod-dsa-b53-mdio and kmod-dsa-b53 packages
with the upstream B53 DSA driver, replacing the swconfig-based
kmod and kmod-switch-bcm53xx-mdio downstream ones that are not used by
any other device.
The 8 LAN ports of the EdgeSwitch 8XP are usable again. The 02_network
init script has been updated with the new DSA interfaces lan1 .. lan8.
Image building has been reenabled for the device, adding the usual DSA
incompatibility notice.
Tested on a Ubiquiti EdgeSwitch 8XP.
Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
Link: https://github.com/openwrt/openwrt/pull/11680
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
