Specifications:
* QCA9563, 16 MiB flash, 128 MiB RAM, 2T2R 802.11n
* QCA9886 2T2R 801.11ac Wave 2
* QCA7550 Homeplug AV2 1300
* AR8337, 3 Gigabit ports (1, 2: LAN; 3: WAN)
To make use of PLC functionality, firmware needs to be
provided via plchost (QCA7550 comes without SPI NOR),
patched with the Network Password and MAC.
Flashing via OEM Web Interface
* Flash 'factory.bin' using web-interface
* Wait until firmware succesfully installed and device booted
* Hold down reset button to reset factory defaults (~10 seconds)
Flashing via Recovery Web Interface:
* Hold down reset button during power-on (~10 seconds)
* Recovery Web UI is at 192.168.0.50, no DHCP.
* Flash 'recovery.bin' with
scripts/flashing/dlink_recovery_upload.py
(Recovery Web UI does not work with modern OSes)
Return to stock
* Hold down reset button during power-on (~10 seconds)
* Recovery Web UI is at 192.168.0.50, no DHCP.
* Flash unencrypted stock firmware with
scripts/flashing/dlink_recovery_upload.py
(Recovery Web UI does not work with modern OSes)
Co-developed-by: Sebastian Schaper <openwrt@sebastianschaper.net>
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
Signed-off-by: Daniel Linjama <daniel@dev.linjama.com>
Those devices have Ethernet interfaces using base MAC address increased
by 0x40 in the 3rd indexed byte (00:00:00:FF:00:00). To describe that we
were using a custom (downstream) "mac-address-increment-byte" property.
The same result can be achieved by using "mac-base" with a properly
adjusted offset value (0x40 << 16). It may be not pretty but it should
work without custom property or downstream kernel patch to support it.
Cc: Ansuel Smith <ansuelsmth@gmail.com>
Cc: Catrinel Catrinescu <cc@80211.de>
Cc: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Reviewed-by: Rosen Penev <rosenp@gmail.com>
Fortinet FAP-220-B is a dual-radio, dual-band 802.11n enterprise managed
access point with PoE input and single gigabit Ethernet interface.
Hardware highlights:
Power: 802.3af PoE input on Ethernet port, +12V input on 5.5/2.1mm DC jack.
SoC: Atheros AR7161 (MIPS 24kc at 680MHz)
RAM: 64MB DDR400
Flash: 16MB SPI-NOR
Wi-Fi 1: Atheros AR9220 2T2R 802.11abgn (dual-band)
Wi-Fi 2: Atheros AR9223 2T2R 802.11bgn (single-band)
Ethernet: Atheros AR8021 single gigabit Phy (RGMII)
Console: External RS232 port using Cisco 8P8C connector (9600-8-N-1)
USB: Single USB 2.0 host port
LEDs: Power (single colour, green), Wi-Fi 1, Wi-Fi 2, Ethernet, Mode, Status
(dual-colour, green and yellow)
Buttons: reset button hidden in bottom grill,
in the top row, 2nd column from the right.
Label MAC address: eth0
FCC ID: TVE-220102
Serial port pinout:
3 - TxD
4 - GND
6 - RxD
Installation: The same methods apply as for already supported FAP-221-B.
For both methods, a backup of flash partitions is recommended, as stock firmware
is not freely available on the internet.
(a) Using factory image:
1. Connect console cable to the console port
2. Connect Ethernet interface to your PC
3. Start preferred terminal at 9600-8-N-1
4. Have a TFTP server running on the PC.
5. Put the "factory" image in TFTP root
6. Power on the device
7. Break boot sequence by pressing "Ctrl+C"
8. Press "G". The console will ask you for device IP, server IP, and filename.
Enter them appropriately.
The defaults are:
Server IP: 192.168.1.1 # Update accordingly
Device IP: 192.168.1.2 # Update accordingly
Image file: image.out # Use for example: openwrt-ath79-generic-fortinet_fap-220-b-squashfs-factory.bin
9. The device will load the firmware over TFTP, and verify it. When
verification passes, press "D" to continue installation. The device
will reboot on completion.
(b) Using initramfs + sysupgrade
1. Connect console cable to the console port
2. Connect Ethernet interface to your PC
3. Start preferred terminal at 9600-8-N-1
4. Have a TFTP server running on the PC.
5. Put the "initramfs" image in TFTP root
6. Power on the device.
7. Break boot sequence by pressing "Ctrl+C"
8. Enter hidden U-boot shell by pressing "K". The password is literal "1".
9. Load the initramfs over TFTP:
> setenv serverip 192.168.1.1 # Your PC IP
> setenv ipaddr 192.168.1.22 # Device IP, both have to share a subnet.
> tftpboot 81000000 openwrt-ath79-generic-fortinet_fap-220-b-initramfs-kernel.bin
> bootm 81000000
10. (Optional) Copy over contents of at least "fwconcat0", "loader", and "fwconcat1"
partitions, to allow restoring factory firmware in future:
# cat /dev/mtd1 > /tmp/mtd1_fwconcat0.bin
# cat /dev/mtd2 > /tmp/mtd2_loader.bin
# cat /dev/mtd3 > /tmp/mtd3_fwconcat1.bin
and then SCP them over to safety at your PC.
11. When the device boots, copy over the sysupgrade image, and execute
normal upgrade:
# sysupgrade openwrt-ath79-generic-fortinet_fap-220-b-squashfs-sysupgrade.bin
Return to stock firmware:
1. Boot initramfs image as per initial installation up to point 9
2. Copy over the previously backed up contents over network
3. Write the backed up contents back:
# mtd write /tmp/mtd1_fwconcat0.bin fwconcat0
# mtd write /tmp/mtd2_loader.bin loader
# mtd write /tmp/mtd3_fwconcat1.bin fwconcat1
4. Erase the reserved partition:
# mtd erase reserved
5. Reboot the device
Quirks and known issues:
- The power LED blinking pattern is disrupted during boot, probably due
to very slow serial console, which prints a lot during boot compared
to stock FW.
- "mac-address-ascii" device tree binding cannot yet be used for address
stored in U-boot partition, because it expects the colons as delimiters,
which this address lacks. Addresses found in ART partition are used
instead.
- Due to using kmod-owl-loader, the device will lack wireless interfaces
while in initramfs, unless you compile it in.
- The device heats up A LOT on the bottom, even when idle. It even
contains a warning sticker there.
- Stock firmware uses a fully read-write filesystem for its rootfs.
- Stock firmware loads a lot of USB-serial converter drivers for use
with built-in host, probably meant for hosting modem devices.
- U-boot build of the device is stripped of all branding, despite that
evidence of it (obviously) being U-boot can be found in the binary.
- The user can break into hidden U-boot shell using key "K" after
breaking boot sequence. The password is "1" (without quotes).
- Telnet is available by default, with login "admin", without password.
The same is true for serial console, both drop straight to the Busybox
shell.
- The web interface drops to the login page again, after successfull
login.
- Whole image authentication boils down to comparing a device ID against
one stored in U-boot.
- And this device is apparently made by a security company.
Big thanks for Michael Pratt for providing support for FAP-221-B, which
shares the entirety of image configuration with this device, this saved
me a ton of work.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
In preparation for FAP-220-B support, rename ar934x_fortinet_loader.dtsi
to arxxxx_fortinet_loader.dtsi, to avoid confusion, as FAP-220-B shares
flash layout with FAP-221-B exactly despite different SoC.
While at that, add a label to U-boot partition to allow for nvmem MAC
binding in future.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Specifications:
SoC: QCA9531(650MHz)
RAM: DDR2 128M
Flash: SPI NOR 16M + SPI NAND 128M
WiFi: 2.4GHz with 2 antennas(WiFi/Thread)
Ethernet:
1xLAN(10/100M)
2xWAN(10/100M)
Button: 1x Reset Button
Switch: 1x Mode switch
LED: 1x Blue LED + 1x White LED + 1x Orange LED
IOT: Thread + ZigBee/Zwave
By uboot web failsafe:
Push the reset button for 5 seconds util the power led flash faster,
then use broswer to access http://192.168.1.1
Afterwards upgrade can use sysupgrade image.
Signed-off-by: Weiping Yang <weiping.yang@gl-inet.com>
Due to circuit issue or silicon defect, sometimes the WiFi switch button
of the Archer C7 v2 can be accidentally triggered multiple times in one
second. This will cause WiFi to be unexpectedly shut down and trigger
'irq 23: nobody cared'[1] warning. Increasing the key debounce interval
to 1000 ms can fix this issue. This patch also add the missing rfkill
key label.
[1] Warning Log:
```
[87765.218511] irq 23: nobody cared (try booting with the "irqpoll" option)
[87765.225331] CPU: 0 PID: 317 Comm: irq/23-keys Not tainted 5.15.118 #0
...
[87765.486246] handlers:
[87765.488543] [<85257547>] 0x800c29a0 threaded [<5c6328a2>] 0x80ffe0b8 [gpio_button_hotplug@4cf73d00+0x1a00]
[87765.498364] Disabling IRQ #23
```
Fixes: https://github.com/openwrt/openwrt/issues/13010
Fixes: https://github.com/openwrt/openwrt/issues/12167
Fixes: https://github.com/openwrt/openwrt/issues/11191
Fixes: https://github.com/openwrt/openwrt/issues/7835
Tested-by: Hans Hasert
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
The compex WPJ563 actually has both usb controllers wired:
usb0 --> pci-e slot
usb1 --> pin header
As the board exposes it for generic use, enable this controller too.
fixes: #13650
Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
The driver for the cellular modems serial interface was missing from the
default device packages.
The driver is required to interact with the modem using AT commands.
Other devices with a 4G modem also ship with this package, thus let's
add it to the default packages for the board.
Signed-off-by: David Bauer <mail@david-bauer.net>
On some WLR-7100 routers, significant packet loss was observed. This is
fixed by configuring a delay on the GMAC0 RXD and RXDV lines.
The values used in this commit are copied from the values used by the
stock firmare (based on register dumping).
Out of four test routers, the problem was consistently observed on two.
It is unclear what the relevant difference is exactly (the two working
routers were v1 001 with AR1022 and v1 002 with AR9342, the two broken
routers were both v1 002 with AR1022). All PCB routing also seems
identical, so maybe there is some stray capacitance on some of these
that adds just enough delay or so...
With this change, the packet loss disappears on the broken routers,
without introducing new packet loss on the previously working routers.
Note that the PHY *also* has delays enabled (through
`qca,ar8327-initvals`) on both RX and TX lines, but apparently that is
not enough, or it is not effective (registers have been verified to be
written).
For detailed discussion of this issue and debug history, see
https://forum.openwrt.org/t/sitecom-wlr-7100-development-progress/79641
Signed-off-by: Matthijs Kooijman <matthijs@stdin.nl>
This patch adds support for the MikroTik RouterBOARD 750 r2, marketed as
hEX lite, a small indoor router with 5x 10/100 Mbps Ethernet ports, one
with PoE in. The device was already supported by the ar71xx target.
Specifications:
- SoC: Qualcomm Atheros QCA9533
- Flash: 16 MB SPI NOR
- RAM: 64 MB
- Ethernet: 4x 10/100 Mbps LAN, 1x 10/100 Mbps WAN (PoE in)
- LEDs: 5x Ethernet port activity (green), 1x user (green)
- Buttons: 1x reset
See https://mikrotik.com/product/RB750r2 for more details.
Not working:
- Serial port (already not working in ar71xx)
Flashing:
TFTP boot initramfs image and then perform sysupgrade. Only the
"Internet" port will ask for an initramfs image. Follow common
MikroTik procedure as in https://openwrt.org/toh/mikrotik/common.
Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
Make use of minor sector size (4k) erasure on supported flash chips
to improve spi read/write performance.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
ath79 PCIe interrupt controller has stopped working correctly. This
is because the DT exposing a non-sensical interrupt-map property,
and their drivers relying on the kernel ignoring this property[1].
This patch fixes the PCIe init error:
ath9k 0000:00:00.0: of_irq_parse_pci: failed with rc=-14
Notice:
This is just a workaround, not a fix. PCIe driver and related dts
node need to be rewritten.
[1] https://lore.kernel.org/all/20211201114102.13446-1-maz@kernel.org/
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
All kernel configs are refreshed by
'make kernel_oldconfig CONFIG_TARGET=target' and
'make kernel_oldconfig CONFIG_TARGET=subtarget'.
upstreamed patches:
010-v5.17-spi-ar934x-fix-transfer-and-word-delays.patch
011-v5.17-spi-ar934x-fix-transfer-size.patch
020-v5.18-spi-ath79-Implement-the-spi_mem-interface.patch
030-v5.18-ath79-add-support-for-booting-QCN550x.patch
build and run tested on:
ath79/generic/ar7241
ath79/generic/qca9563
ath79/nand/ar9344
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Some symbols are outdated or missing due to daily kernel bumps. It's
better to re-add them. All configs are automatically refreshed by
'make kernel_oldconfig CONFIG_TARGET=taget' and
'make kernel_oldconfig CONFIG_TARGET=subtarget'
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
From the Netgear u-boot GPL code[1]. Bootloader always unconditionally
marks block 768, 1020 - 1023 as bad blocks on each boot. This may lead
to conflicts with the OpenWrt nand driver since these blocks may be good
blocks. In this case, U-boot will override the oob of these blocks so
that break the ubi volume. The system will be damaged after first reboot.
To avoid this issue, manually skip these blocks by using "mtd-concat".
[1] https://www.downloads.netgear.com/files/GPL/EX7300v2series-V1.0.0.146_gpl_src.tar.bz2.zip
Fixes: https://github.com/openwrt/openwrt/issues/8878
Tested-by: Yousaf <yousaf465@gmail.com>
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
In Netgear u-boot GPL code, nand devices uses this formula to locate the
rootfs offset.
offset = (((128 + KERNEL_SIZE) / BLOCK_SIZE) + 1) * BLOCK_SIZE;
Howerver, WNDR4500 source code incorrectly define the nand block size to
64k. In some cases, it causes u-boot can't get the correct rootfs offset,
which result in boot failure. This patch workaround it by padding kernel
size to (128k * n - 128 - 1). The additional char '\0' is used to ensure
the (128 + KERNEL_SIZE) can't be divided by the BLOCK_SIZE.
Fixes: https://github.com/openwrt/openwrt/issues/13050
Fixes: 3c1512a25d ("ath79: optimize the firmware recipe for Netgear NAND devices")
Tested-by: Yousaf <yousaf465@gmail.com>
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
With upstream accepted "mac-base" binding there is no need for a
downstream "mac-address-ascii" workaround anymore.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
return ubnt_rocket-m and ubnt_powerbridge-m back to ath79-generic
They have enough RAM-ressources to not be considered as tiny.
This reverts the commit f4415f7635 partially
Signed-off-by: Felix Baumann <felix.bau@gmx.de>
ASUS RT-AC59U / RT-AC59U v2 are wi-fi routers with a large number of
alternate names, including RT-AC1200GE, RT-AC1300G PLUS, RT-AC1500UHP,
RT-AC57U v2/v3, RT-AC58U v2/v3, and RT-ACRH12.
ASUS ZenWiFi AC Mini(CD6) is a mesh wifi system. The unit labeled CD6R
is the router, and CD6N is the node.
Hardware:
- SoC: QCN5502
- RAM: 128 MiB
- UART: 115200 baud (labeled on boards)
- Wireless:
- 2.4GHz: QCN5502 on-chip 4x4 802.11b/g/n
currently unsupported due to missing support for QCN550x in ath9k
- 5GHz: QCA9888 pcie 5GHz 2x2 802.11a/n/ac
- Flash: SPI NOR
- RT-AC59U / CD6N: 16 MiB
- RT-AC59U v2 / CD6R: 32 MiB
- Ethernet: gigabit
- RT-AC59U / RT-AC59U v2: 4x LAN 1x WAN
- CD6R: 3x LAN 1x WAN
- CD6N: 2x LAN
- USB:
- RT-AC59U / RT-AC59U v2: 1 port USB 2.0
- CD6R / CD6N: none
WiFi calibration data contains valid MAC addresses.
The initramfs image is uncompressed because I was unable to boot a
compressed initramfs from memory (gzip or lzma). Booting a compressed
image from flash works fine.
Installation:
To install without opening the case:
- Set your computer IP address to 192.168.1.10/24
- Power up with the Reset button pressed
- Release the Reset button after about 5 seconds or until you see the
power LED blinking slowly
- Upload OpenWRT factory image via TFTP client to 192.168.1.1
Revert to stock firmware using the same TFTP method.
Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
This option was removed from upstream kernel back in 2022.
See commits:
2d16803c562ecc644803d42ba98a8e0aef9c014e (>=6.0)
3dd33a09f5dc12ccb0902923c4c784eb0f8c7554 (>=5.15.61 backport)
Signed-off-by: Christian Svensson <blue@cmd.nu>
COMFAST CF-E380AC v2 is a ceiling mount AP with PoE
support, based on Qualcomm/Atheros QCA9558+QCA9880+AR8035.
There are two versions of this model, with different RAM
and U-Boot mtd partition sizes:
- v1: 128 MB of RAM, 128 KB U-Boot image size
- v2: 256 MB of RAM, 256 KB U-Boot image size
Version number is available only inside vendor GUI,
hardware and markings are the same.
Short specification:
- 720/600/200 MHz (CPU/DDR/AHB)
- 1x 10/100/1000 Mbps Ethernet, with PoE support
- 128 or 256 MB of RAM (DDR2)
- 16 MB of FLASH
- 3T3R 2.4 GHz, with external PA (SE2576L), up to 28 dBm
- 3T3R 5 GHz, with external PA (SE5003L1), up to 30 dBm
- 6x internal antennas
- 1x RGB LED, 1x button
- UART (T11), LEDs/GPIO (J7) and USB (T12) headers on PCB
- external watchdog (Pericon Technology PT7A7514)
COMFAST MAC addresses :
Though the OEM firmware has four adresses in the usual locations,
it appears that the assigned addresses are just incremented in a different way:
Interface address location
Lan *:00 0x0
2.4g *:0A n/a (0x0 + 10)
5g *:02 0x6
Unused Addresses found in ART hexdump
address location
*:01 0x1002
*:03 0x5006
To keep code consistency the MAC address assignments are made based on increments of the one found in 0x0;
Signed-off-by: Joao Henrique Albuquerque <joaohccalbu@gmail.com>
Mikrotik RB951 router has a buzzer on the board, which makes annoying noises
due to the interference caused by PoE input or Wifi transmission
when no GPIO pin state is set.
I added buzzer node to device's DTS in order to set deault level to 1
and to provide easier access for it.
Signed-off-by: Pavel Pernička <pernicka.pa@gmail.com>
