The workaround for an already-enabled R4K timer used a non-existent
macro CAUSE_DC. Fix compiling by using the actual macro CAUSEF_DC.
Fixes: b7aab19585 ("realtek: SMP handling of R4K timer interrupts")
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Until now there has been no good explanation why we mess with the R4K
timer on SMP. After extensive testing and looking at the SDK code it
becomes clear what it is all about.
When we disable the CEVT_R4K module (we will do with the new timer
driver) the R4K timer hardware still fires interrupts on the secondary
CPU. To get around this we have two options:
- Disable IRQ 7
- Stop the counter completely
This patch selects option two because this is the root of evil.. To be
on the safe side we will do it only in case the CEVT_R4K module is
disabled.
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
The scope of the SMP startup structure is wrong. It is created on the
stack and not as a global variable. This can lead to startup failures.
Fixes: 3f41360eb7 ("realtek: use upstream recommendation for CPU start")
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de
OpenWRT's developer guide prefers having actual patches so they an be
sent upstream more easily.
However, in this case, Adding proper fields also allows for `git am` to
properly function. Some of these patches are quite old, and lack much
traceable history.
This commit tries to rectify that, by digging in the history to find
where and how it was first added.
It is by no means perfect and also shows some patches that should have
been long gone.
Signed-off-by: Olliver Schinagl <oliver@schinagl.nl>
OpenWRT's developer guide prefers having actual patches so they an be
sent upstream more easily.
However, in this case, Adding proper fields also allows for `git am` to
properly function. Some of these patches are quite old, and lack much
traceable history.
This commit tries to rectify that, by digging in the history to find
where and how it was first added.
It is by no means perfect and also shows some patches that should have
been long gone.
Signed-off-by: Olliver Schinagl <oliver@schinagl.nl>
OpenWRT's developer guide prefers having actual patches so they an be
sent upstream more easily.
However, in this case, Adding proper fields also allows for `git am` to
properly function. Some of these patches are quite old, and lack much
traceable history.
This commit tries to rectify that, by digging in the history to find
where and how it was first added.
It is by no means perfect and also shows some patches that should have
been long gone.
Signed-off-by: Olliver Schinagl <oliver@schinagl.nl>
Import patches from mtk-openwrt-feeds (MTK SDK) to support reading
t-phy settings affecting PCIe as well as USB2 and USB3 from efuse.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
efuse is used to store board-specific settings of some of the in-SoC
peripherals. Add it to device tree, so it gets probed on boot and can
be accessed by other drivers.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Allow byte-wise access to mtk-efuse as some drivers require that.
Patch imported from mtk-openwrt-feeds (MTK SDK).
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The corresponding kmod package is marked as HIDDEN and selected by all
other kernel modules that need it, so the kconfig side will be in sync
without manual selection
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Fixes build warnings when using newer versions of grep.
Signed-off-by: Chris Osgood <chris_github@functionalfuture.com>
Tested-by: Georgi Valkov <gvalkov@gmail.com>
Convert MAC address and label_mac configuration of Buffalo
WSR-1166DHP to use the generic function of OpenWrt.
Apply commit 770cfe9 for WCR-1166DS to WSR-1166DHP too.
Tested on the device and MAC address is kept before and after this
change.
Signed-off-by: Kazuhiro Ito <kzhr@d1.dion.ne.jp>
Instead of dropping *fix-typo-in-__mtk_foe_entry.patch which effectively
means keeping the (also wrong) assignment of MTK_FOE_STATE_BIND, rather
use MTK_FOE_STATE_INVALID as that works well on both older (NETSYS_V1)
and newer (NETSYS_V2) MediaTek SoCs.
Suggested-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
When the realtek clock driver was introduced, CONFIG_COMMON_CLK_REALTEK
was not correctly disabled for other subtarget. Add the missing config
flag to fix compilation error on buildbot.
Fixes: 4850bd887c ("realtek: add RTL83XX clock driver")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Move and rename patches which were merged upstream and import follow-up
fixes for MediaTek Ethernet offloading features on MT7622 and Filogic
platforms. Remove patch
793-net-ethernet-mtk_eth_soc-fix-typo-in-__mtk_foe_entry.patch
which breaks hardware flow offloading on MT7622, it will be reverted
upstream as well.
Fixes: c93c5365c0 ("kernel: pick patches for MediaTek Ethernet from linux-next")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Don't overwrite AS_DPM and L2LEARNING flags when dest_port is >= 32.
Fixes: 1773264a0c ("realtek: correct egress frame port verification")
Signed-off-by: Jan Hoffmann <jan@3e8.eu>
The generic imagebuilder does not have a generic in the name, although
this is the default naming scheme. Use bcm53xx as template for this fix.
Before the fix:
openwrt-imagebuilder-octeon.Linux-x86_64.tar.xz
After:
openwrt-imagebuilder-octeon-generic.Linux-x86_64.tar.xz
Signed-off-by: Nick Hainke <vincent@systemli.org>
If this module is not set to y, then I get the following compilation
error during geode build.
Package kmod-w83627hf-wdt is missing dependencies for the following libraries:
watchdog.ko
Setting the linux CONFIG_WATCHDOG_CORE to y as in all other targets
fixes this issue.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
If this module is not set to y, then I get the following compilation
error during geode build.
Package kmod-w83627hf-wdt is missing dependencies for the following
libraries:
watchdog.ko
Setting the linux CONFIG_WATCHDOG_CORE to y as in all other targets
fixes this issue.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
It's a 4G Cat.20 router used by Vodafone Italy (called Vodafone FWA)
and Vodafone DE\T-Mobile PL (called GigaCube).
Modem is a MiniPCIe-to-USB based on Snapdragon X24,
it supports 4CA aggregation.
There are currently two hardware revisions, which
differ on the 5Ghz radio:
AT1 = QCA9984 5Ghz Radio on PCI-E bus
AT2 = IPQ4019 5Ghz Radio inside IPQ4019 like 2.4Ghz
Device specification
--------------------
SoC Type: Qualcomm IPQ4019
RAM: 256 MiB
Flash: 128 MiB SPI NAND (Winbond W25N01GV)
ROM: 2MiB SPI Flash (GD25Q16)
Wireless 2.4 GHz (IP4019): b/g/n, 2x2
Wireless 5 GHz:
(QCA9984): a/n/ac, 4x4 HW REV AT1
(IPA4019): a/n/ac, 2x2 HW REV AT2
Ethernet: 2xGbE (WAN/LAN1, LAN2)
USB ports: No
Button: 2 (Reset/WPS)
LEDs: 3 external leds: Network (white or red), Wifi, Power and 1 internal (blue)
Power: 12 VDC, 1 A
Connector type: Barrel
Bootloader: U-Boot
Installation
------------
1. Place OpenWrt initramfs image for the device on a TFTP
in the server's root. This example uses Server IP: 192.168.0.2
2. Connect serial console (115200,8n1) to serial connector
GND (which is right next to the thing with MF289F MIMO-V1.0), RX, TX
(refer to this image: https://ibb.co/31Gngpr).
3. Connect TFTP server to RJ-45 port (WAN/LAN1).
4. Stop in u-Boot (using ESC button) and run u-Boot commands:
setenv serverip 192.168.0.2
setenv ipaddr 192.168.0.1
set fdt_high 0x85000000
tftp openwrt-ipq40xx-generic-zte_mf289f-initramfs-fit-zImage.itb
bootm $loadaddr
5. Please make backup of original partitions, if you think about revert to
stock, specially mtd16 (Web UI) and mtd17 (rootFS).
Use /tmp as temporary storage and do:
WEB PARITION
--------------------------------------
cat /dev/mtd16 > /tmp/mtd16.bin
scp /tmp/mtd16.bin root@YOURSERVERIP:/
rm /tmp/mtd16.bin
ROOT PARITION
--------------------------------------
cat /dev/mtd17 > /tmp/mtd17.bin
scp /tmp/mtd17.bin root@YOURSERVERIP:/
rm /tmp/mtd17.bin
6. Login via ssh or serial and remove stock partitions
(default IP 192.168.0.1):
# this can return an error, if ubi was attached before
# or rootfs part was erased before.
ubiattach -m 17
# it could return error if rootfs part was erased before
ubirmvol /dev/ubi0 -N ubi_rootfs
# some devices doesn't have it
ubirmvol /dev/ubi0 -N ubi_rootfs_data
7. download and install image via sysupgrade -n
(either use wget/scp to copy the mf289f's squashfs-sysupgrade.bin
to the device's /tmp directory)
sysupgrade -n /tmp/openwrt-...-zte_mf289f-squashfs-sysupgrade.bin
Sometimes it could print ubi attach error, but please ignore it
if process goes forward.
Flash Layout
NAND:
mtd8: 000a0000 00020000 "fota-flag"
mtd9: 00080000 00020000 "0:ART"
mtd10: 00080000 00020000 "mac"
mtd11: 000c0000 00020000 "reserved2"
mtd12: 00400000 00020000 "cfg-param"
mtd13: 00400000 00020000 "log"
mtd14: 000a0000 00020000 "oops"
mtd15: 00500000 00020000 "reserved3"
mtd16: 00800000 00020000 "web"
mtd17: 01d00000 00020000 "rootfs"
mtd18: 01900000 00020000 "data"
mtd19: 03200000 00020000 "fota"
mtd20: 0041e000 0001f000 "kernel"
mtd21: 0101b000 0001f000 "ubi_rootfs"
SPI:
mtd0: 00040000 00010000 "0:SBL1"
mtd1: 00020000 00010000 "0:MIBIB"
mtd2: 00060000 00010000 "0:QSEE"
mtd3: 00010000 00010000 "0:CDT"
mtd4: 00010000 00010000 "0:DDRPARAMS"
mtd5: 00010000 00010000 "0:APPSBLENV"
mtd6: 000c0000 00010000 "0:APPSBL"
mtd7: 00050000 00010000 "0:reserved1"
Back to Stock (!!! need original dump taken from initramfs !!!)
-------------
1. Place mtd16.bin and mtd17.bin initramfs image
for the device on a TFTP in the server's root.
This example uses Server IP: 192.168.0.2
2. Connect serial console (115200,8n1) to serial console
connector (refer to the pin-out from above).
3. Connect TFTP server to RJ-45 port (WAN/LAN1).
4. rename mtd16.bin to web.img and mtd17.bin to root_uImage_s
5. Stop in u-Boot (using ESC button) and run u-Boot commands:
This will erase RootFS+Web:
nand erase 0x1000000 0x800000
nand erase 0x1800000 0x1D00000
This will restore RootFS:
tftpboot 0x84000000 ${dir}root_uImage_s
nand erase 0x1800000 0x1D00000
nand write $fileaddr 0x1800000 $filesize
This will restore Web Interface:
tftpboot 0x84000000 ${dir}web.img
nand erase 0x1000000 0x800000
nand write $fileaddr 0x1000000 $filesize
After first boot on stock firwmare, do a factory reset.
Push reset button for 5 seconds so all parameters will
be reverted to the one printed on label on bottom of the router
Signed-off-by: Giammarco Marzano <stich86@gmail.com>
Reviewed-by: Lech Perczak <lech.perczak@gmail.com>
(Warning: commit message did not conform to UTF-8 - hopefully fixed?,
added description of the pin-out if image goes down, reformatted
commit message to be hopefully somewhat readable on git-web,
redid some of the gpio-buttons & leds DT nodes, etc.)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Sony NCP-HG100/Cellular is a IoT Gateway with 2.4/5 GHz band 11ac
(WiFi-5) wireless function, based on IPQ4019.
Specification:
- SoC : Qualcomm IPQ4019
- RAM : DDR3 512 MiB (H5TC4G63EFR)
- Flash : eMMC 4 GiB (THGBMNG5D1LBAIT)
- WLAN : 2.4/5 GHz 2T2R (IPQ4019)
- Ethernet : 10/100/1000 Mbps x2
- Transceiver : Qualcomm QCA8072
- WWAN : Telit LN940A9
- Z-Wave : Silicon Labs ZM5101
- Bluetooth : Qualcomm CSR8811
- Audio DAC : Realtek ALC5629
- Audio Amp. : Realtek ALC1304
- Voice Input Processor : Conexant CX20924
- Micro Controller Unit : Nuvoton MINI54FDE
- RGB LED, Fan, Temp. sensors
- Touch Sensor : Cypress CY8C4014LQI
- RGB LED driver : TI LP55231 (2x)
- LEDs/Keys : 11x, 6x
- UART : through-hole on PCB
- J1: 3.3V, TX, RX, GND from tri-angle marking
- 115200n8
- Power : 12 VDC, 2.5 A
Flash instruction using initramfs image:
1. Prepare TFTP server with the IP address 192.168.132.100 and place the
initramfs image to TFTP directory with the name "C0A88401.img"
2. Boot NCP-HG100/Cellular and interrupt after the message
"Hit any key to stop autoboot: 2"
3. Perform the following commands and set bootcmd to allow booting from
eMMC
setenv bootcmd "mmc read 0x84000000 0x2e22 0x4000 && bootm 0x84000000"
saveenv
4. Perform the following command to load/boot the OpenWrt initramfs image
tftpboot && bootm
5. On the initramfs image, perform sysupgrade with the sysupgrade image
(if needed, backup eMMC partitions by dd command and download to
other place before performing sysupgrade)
6. Wait for ~120 seconds to complete flashing
Known issues:
- There are no drivers for audio-related chips/functions in Linux Kernel
and OpenWrt, they cannot be used.
- There is no driver for MINI54FDE Micro-Controller Unit, customized for
this device by the firmware in the MCU. This chip controls the
following functions, but they cannot be controlled in OpenWrt.
- RGB LED
- Fan
this fan is controlled automatically by MCU by default, without
driver
- Thermal Sensors (2x)
- Currently, there is no driver or tool for CY8C4014LQI and cannot be
controlled. It cannot be exited from "booting mode" and moved to "normal
op mode" after booting. And also, the 4x buttons (mic mute, vol down,
vol up, alexa trigger) connected to the IC cannot be controlled.
- it can be exited from "booting mode" by installing and executing
i2cset command:
opkg update
opkg install i2c-tools
i2cset -y 1 0x14 0xf 1
- There is a connection issue on the control by uqmi for the WWAN module.
But modemmanager can be used without any issues and the use of it is
recommended.
- With the F2FS format, too many errors are reported on erasing eMMC
partition "rootfs_data" while booting:
[ 1.360270] sdhci: Secure Digital Host Controller Interface driver
[ 1.363636] sdhci: Copyright(c) Pierre Ossman
[ 1.369730] sdhci-pltfm: SDHCI platform and OF driver helper
[ 1.374729] sdhci_msm 7824900.sdhci: Got CD GPIO
...
[ 1.413552] mmc0: SDHCI controller on 7824900.sdhci [7824900.sdhci] using ADMA 64-bit
[ 1.528325] mmc0: new HS200 MMC card at address 0001
[ 1.530627] mmcblk0: mmc0:0001 004GA0 3.69 GiB
[ 1.533530] mmcblk0boot0: mmc0:0001 004GA0 partition 1 2.00 MiB
[ 1.537831] mmcblk0boot1: mmc0:0001 004GA0 partition 2 2.00 MiB
[ 1.542918] mmcblk0rpmb: mmc0:0001 004GA0 partition 3 512 KiB, chardev (247:0)
[ 1.550323] Alternate GPT is invalid, using primary GPT.
[ 1.561669] mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17
...
[ 8.841400] mount_root: loading kmods from internal overlay
[ 8.860241] kmodloader: loading kernel modules from //etc/modules-boot.d/*
[ 8.863746] kmodloader: done loading kernel modules from //etc/modules-boot.d/*
[ 9.240465] block: attempting to load /etc/config/fstab
[ 9.246722] block: unable to load configuration (fstab: Entry not found)
[ 9.246863] block: no usable configuration
[ 9.254883] mount_root: overlay filesystem in /dev/mmcblk0p17 has not been formatted yet
[ 9.438915] urandom_read: 5 callbacks suppressed
[ 9.438924] random: mkfs.f2fs: uninitialized urandom read (16 bytes read)
[ 12.243332] mmc_erase: erase error -110, status 0x800
[ 12.246638] mmc0: cache flush error -110
[ 15.134585] mmc_erase: erase error -110, status 0x800
[ 15.135891] mmc_erase: group start error -110, status 0x0
[ 15.139850] mmc_erase: group start error -110, status 0x0
...(too many the same errors)...
[ 17.350811] mmc_erase: group start error -110, status 0x0
[ 17.356197] mmc_erase: group start error -110, status 0x0
[ 17.439498] sdhci_msm 7824900.sdhci: Card stuck in wrong state! card_busy_detect status: 0xe00
[ 17.446910] mmc0: tuning execution failed: -5
[ 17.447111] mmc0: cache flush error -110
[ 18.012440] F2FS-fs (mmcblk0p17): Found nat_bits in checkpoint
[ 18.062652] F2FS-fs (mmcblk0p17): Mounted with checkpoint version = 428fa16b
[ 18.198691] block: attempting to load /etc/config/fstab
[ 18.198972] block: unable to load configuration (fstab: Entry not found)
[ 18.203029] block: no usable configuration
[ 18.211371] mount_root: overlay filesystem has not been fully initialized yet
[ 18.214487] mount_root: switching to f2fs overlay
So, this support uses ext4 format instead which has no errors.
Note:
- The primary uart is shared for debug console and Z-Wave chip. The
function is switched by GPIO15 (Linux: 427).
value:
1: debug console
0: Z-Wave
- NCP-HG100/Cellular has 2x os-image pairs in eMMC.
- 0:HLOS, rootfs
- 0:HLOS_1, rootfs_1
In OpenWrt, the first image pair is used.
- "bootipq" command in U-Boot requires authentication with signed-image
by default. To boot unsigned image of OpenWrt, use "mmc read" and
"bootm" command instead.
- This support is for "Cellular" variant of NCP-HG100 and not tested on
"WLAN" (non-cellular) variant.
- The board files of ipq-wifi may also be used in "WLAN" variant of
NCP-HG100, but unconfirmed and add files as for "Cellular" variant.
- "NET" LED is used to indicate WWAN status in stock firmware.
- There is no MAC address information in the label on the case, use the
address included in UUID in the label as "label-MAC" instead.
- The "CLOUD" LEDs are partially used for indication of system status in
stock firmware, use they as status LEDs in OpenWrt instead of RGB LED
connected to the MCU.
MAC addresses:
LAN : 5C:FF:35:**:**:ED (ART, 0x6 (hex))
WAN : 5C:FF:35:**:**:EF (ART, 0x0 (hex))
2.4 GHz: 5C:FF:35:**:**:ED (ART, 0x1006 (hex))
5 GHz : 5C:FF:35:**:**:EE (ART, 0x5006 (hex))
partition layout in eMMC (by fdisk, GPT):
Disk /dev/mmcblk0: 7733248 sectors, 3776M
Logical sector size: 512
Disk identifier (GUID): ****
Partition table holds up to 20 entries
First usable sector is 34, last usable sector is 7634910
Number Start (sector) End (sector) Size Name
1 34 1057 512K 0:SBL1
2 1058 2081 512K 0:BOOTCONFIG
3 2082 3105 512K 0:QSEE
4 3106 4129 512K 0:QSEE_1
5 4130 4641 256K 0:CDT
6 4642 5153 256K 0:CDT_1
7 5154 6177 512K 0:BOOTCONFIG1
8 6178 6689 256K 0:APPSBLENV
9 6690 8737 1024K 0:APPSBL
10 8738 10785 1024K 0:APPSBL_1
11 10786 11297 256K 0:ART
12 11298 11809 256K 0:HSEE
13 11810 28193 8192K 0:HLOS
14 28194 44577 8192K 0:HLOS_1
15 44578 306721 128M rootfs
16 306722 568865 128M rootfs_1
17 568866 3958065 1654M rootfs_data
[initial work]
Signed-off-by: Iwao Yuki <dev.clef@gmail.com>
Co-developed-by: Iwao Yuki <dev.clef@gmail.com>
[adjustments, cleanups, commit message, sending patch]
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
(dropped clk_unused_ignore, dropped 901-* patches, renamed
key nodes, changed LEDs chan/labels to match func-en, made
:net -> (w)wan leds)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Fix this occurrence during boot:
/bin/board_detect: line 10: Unsupported: not found
Fixes: 80baffd2aa (" ipq40xx: add support for Pakedge WR-1")
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
On OEM firmware both addresses for In and Out ports are different. Set
them as such also in OpenWrt.
Fixes: e24635710c (" ipq40xx: add support for Luma Home WRTQ-329ACN")
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
use the toolchain's default CPU (464fp) as the CPU option.
This fixes a CPU selection prompt which shows up now.
CPU selection
> 1. Generic 32 bits powerpc (POWERPC_CPU) (NEW)
2. Rely on the toolchain's implicit default CPU (TOOLCHAIN_DEFAULT_CPU) (NEW)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
the 5.10 uml build currently breaks with:
/usr/bin/ld: arch/um/os-Linux/signal.o: in function `sigusr1_handler':
arch/um/os-Linux/signal.c:141: undefined reference to `uml_pm_wake'
But there's an upstream fix for this. Backport the fix
for now but also let upstream know so it finds its way
through the -stable releases.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This adds some missing IOMMU related options for x86/64 and moves some
of them to generic for all targets.
On x86 IOMMU_DEFAULT_DMA_LAZY is used by default, on all other platforms
IOMMU_DEFAULT_DMA_STRICT is the default. we just follow the default
kernel configuration here.
Fixes: 8fea4a102c ("x86/64: enable IOMMU support")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The 5.15 kernel has new interesting features like MGLRU. Most of the
targets already have added support for testing kernel 5.15 since April
2022. Set 5.15 as default for all subtargets.
Testing support was added here:
- ae6bfb7d67 ("ath79: tiny: add 5.15 support for tiny subtarget")
- 9a0155bc4f ("ath79: add 5.15 support for generic subtarget")
- 5af9aafabb ("ath79: mikrotik: add 5.15 support for mikrotik subtarget")
- f3fa68e515 ("ath79: nand: add 5.15 support for nand subtarget")
Tested on:
- Nanostation M5 XM (tiny)
- TP-Link EAP-225 Outdoor (generic)
- TP-Link CPE210 (generic)
Signed-off-by: Nick Hainke <vincent@systemli.org>
Fixes situations where MAC address gets incremented multiple times
if device initialization fails at first and then is deferred.
Fixes: d284e6ef0f ("treewide: convert mtd-mac-address-increment* to generic implementation")
Signed-off-by: Will Moss <willormos@gmail.com>
When building OpenWrt with CONFIG_ALL_KMODS the kernel build will ask
for CONFIG_DEFAULT_FQ_PIE option. This deactivates it by default.
Fixes: c3e4a0d99b ("kernel: netsupport: Add FQ-PIE as an optional sched kmod and extract PIE")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Enable IOMMU support for Intel and AMD x86 platforms. With this, when the
vfio module is present, physical PCI devices can be passed to VMs, for
example with `qemu-system-x86_64 -device vfio-pci,host=05:00.0 ...`.
IOMMU support increases the kernel size by a small amount (~370KB, from
5239840 B to 5611200 B, a ~7% increase in size).
Signed-off-by: Nicola Corna <nicola@corna.info>
Broadcom's U-Boot contains environment data blocks. They need to be
found (offsets aren't predefined) to access env variables.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
When the v1 and v2 variants of the U6LR were introduced, the board
network config was not adapted to the new device names. Due to this, the
wrong network config is applied during initial boot. The resulting
config has lan, wan and a switch, while this device only has a single
ethernet interface without a switch.
Fix this by using a wildcard that matches all the variants.
Fixes: 15a02471bb ("mediatek: new target mt7622-ubnt-unifi-6-lr-v1")
Fixes: 5c8d3893a7 ("mediatek: new target ubnt_unifi-6-lr-v1-ubootmod")
Fixes: 31d86a1a11 ("mediatek: add Ubiquiti UniFi 6 LR v2 targets")
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Acked-by: Daniel Golle <daniel@makrotopia.org>
With the commit 5876d6a62f the command under
`/usr/sbin/grub-bios-setup` has been moved to its own package named
`grub-bios-setup`.
The script `81_upgrade_bootloader` under `/lib/preinit` is used by all
x86 targets to update the bootloader. The script is using the command
`grub-bios-setup` for this.
I get the following output at the first boot after the upgrade.
`/etc/preinit: line 9: /usr/sbin/grub-bios-setup: not found`.
To fix this, the DEFAULT_PACKAGES dependency is extended by the entry
`grub2-bios-setup` so that the missing command is installed again.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Backport upstream code split patch for qca8k needed for ipq40xx target
to correctly implement a DSA driver.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Currently we fix interrupts/timers for the secondary CPU by patching
vsmp_init_secondary(). Get a little bit more generic and use the
upstream recommended way instead. Additionally avoid a check around
register_cps_smp_ops() because it does that itself.
See https://lkml.org/lkml/2022/9/12/522
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
The interrupt controller depends on two control registers. GIMR enables
or disables interrupts and IRRx routes these to MIPS CPU interrupts 2-7.
Wiki currently states "A value of '0' (in IRRx) disconnects this input from
the output line, independent of the line's setting in GIMR."
Contrary to normal intuition this statement DOES NOT mean, that interrupts
can be disabled by IRRx alone. The sad truth was discovered by enabling
SMP for an Zyxel XGS1010 on the 930x target. It shows that driver and
interrupts behave as follows:
- Timer 0 interrupt 7 has active routing to CPU0 and no routing to CPU1
- Timer 1 interrupt 8 has no routing to CPU0 and active routing to CPU1
- Unmasking (enabling) interrupts writes 1 bits to all GIMR registers
- Masking (disabling) interrupts writes 0 bits to both GIMR registers
During operation we can encounter a situation like
- GIMR bit for a interrupt/CPU combination is set to enabed (=1)
- IRRx routing bits for a interrupt/CPU combination are set to disabed (=0)
This setting already allows the hardware to fire interrupts to the target
CPU/VPE if the other CPU/VPE is currently busy. Especially for CPU bound
timer interrupts this is lethal. If timer interrupt 7 arrives at CPU1 and
vice versa for interrupt 8 the restart trigger gets lost. The timer dies
and a msleep() operation in the kernel will halt endlessly.
Fix this by tracking the IRRx active routing setting in a new bitfield with
0="routing active" and 1="no routing". Enable interrupts in GIMR only
for a interrupt & CPU if routing is active. Thus we have
- GIMR = 0 / IRRx = 0 -> everything disabled
- GIMR = 1 / IRRx > 0 -> active and normal routing
- GIMR = 0 / IRRx > 0 -> masked (disabled) with normal routing
- GIMR = 1 / IRRx = 0 -> no longer possible
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
The image builds for Linksys EA6350 v3, EA8300, and MR8300 currently
fail on buildbots due to the KERNEL_SIZE, as stated in commit
17b7756b5a ("ipq40xx: 5.15: add testing kernel version"). Disable
these boards for now.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Change phy-mode of gmac1 to rgmii on mt7621.dtsi. Same code path is
followed for delayed rgmii and rgmii phy-mode on mtk_eth_soc.c.
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Add the missing LEDs for GB-PC2. Some of these LEDs don't exist on the
device schematics. Tests on a GB-PC2 by me and Petr proved otherwise.
Remove ethblack-green and ethblue-green LEDs for GB-PC1. They are not wired
to GPIO 3 or 4 and the wiring is currently unknown.
Set ethyellow-orange to display link state and activity of the ethyellow
interface for GB-PC2.
Link: https://github.com/ngiger/GnuBee_Docs/blob/master/GB-PCx/Documents/GB-PC2_V1.1_schematic.pdf
Tested-by: Petr Louda <petr.louda@outlook.cz>
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
The Build prefix is used for image build commands, while the Device
prefix should be used for base recipes for devices. Apply the same
naming convention here.
While touching the file, also fix the mixed indentation.
Suggested-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Signed-off-by: Sander Vanheule <sander@svanheule.net>
There seems to be no reason to have the Netgear switches as part of
the main Makefile. Move it to its subtarget-specific Makefile since
it is only applicable there.
Signed-off-by: Olliver Schinagl <oliver@schinagl.nl>
[update commit message]
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Currently supported HPE 1920 devices all have an RTL838x SoC, but there
are larger switches with RTL839x SoCs, although currently not supported.
Move the build recipe to common.mk so the larger devices can also make
use of the recipe, while moving it out of the main Makefile.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
The D-Link DGS-1210 device series currently has supported devices with
both RTL838x and RTL839x SoCs. An image build recipe has been defined in
both subtarget makefiles, but these are mostly identical, save for the
SOC variable.
Move the SOC variable from the DGS-1210 build recipes to the applicable
devices, and put the remaining duplicate code in a shared Makefile.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Hardware specification
----------------------
* RTL8393M SoC, 1 MIPS 34Kc core @ 700MHz
* 128MB DRAM
* 32MB NOR Flash
* 48 x 10/100/1000BASE-T ports
- 6 x External PHY with 8 ports (RTL8218D)
* 4 x Gigabit RJ45/SFP Combo ports
- External PHY with 4 SFP ports (RTL8214FC)
* Power LED
* Reset button on front panel
* UART (115200 8N1) via unpopulated standard 0.1" pin header marked J14
The gpio-restart node is not required but it does reset the switch.
TODO: The 4 combo ports attached to the RTL8214FC are not detect
properly. Linux kernel reports 49 and 50 as "External RTL8393 SERDES"
and 51 and 52 as "RTL8218B (external)". Those ports only work if
u-boot initialize it (for example, loading initramfs image using one
of those ports). A patch to PHY detection is needed for full support.
The firmware recovery using U-Boot is broken for all DGS-1210 tested
devices as pressing RESET does not trigger it (only if pressed from a
running stock image)
UART pinout
-----------
[o]ooo|J14
| ||`------ GND
| |`------- RX
| `-------- TX
`---------- Vcc (3V3)
Installation using OEM upgrade
------------------------------
1. Make sure you are running OEM firmware in image2 slot (logged as admin):
- > config firmware image_id 2 boot_up
- > reboot
2. Install squashfs-factory_image1.bin to image1 using (logged as admin):
- > download firmware_fromTFTP <tftpserver> factory_image1.bin
- > config firmware image_id 1 boot_up
- > reboot
Installation using serial interface
-----------------------------------
1. Press Escape key during `Hit Esc key to stop autoboot` prompt
2. Press CTRL+C keys to get into real U-Boot prompt
3. Init network with `rtk network on` command
4. Load image with `tftpboot 0x8f000000 openwrt-realtek-rtl839x-d-link_dgs-1210-52-initramfs-kernel.bin` command
5. Boot the image with `bootm` command
Once booted the initramfs, install the squashfs-sysupgrade.bin as a
normal OpenWrt system.
Dual-boot with stock firmware using writable u-boot-env
-------------------------------------------------------
From stock to OpenWrt / boot image 1 (CLI as admin):
- > config firmware image_id 1 boot_up
- > reboot
From OpenWrt to stock / boot image 2: (shell as root)
- # fw_setenv bootcmd 'run addargs ; bootm 0xb4e80000'
- # fw_setenv image '/dev/mtdblock7'
- # reboot
Debrick using serial interface
------------------------------
1. Press Escape key during `Hit Esc key to stop autoboot` prompt
2. In a Windows PC, run 'D-Link Network Assistant v2.0.2.4'. It should
detect the switch
3. Flash the firmware.
Back to stock firmware using dual-boot
--------------------------------------
If you have serial interface, you can change u-boot env vars
interrupting the boot process. If not but you are running OpenWrt, you
can dual-boot (as mentioned eariler) and skip to step 4:
1. Press Escape key during `Hit Esc key to stop autoboot` prompt
2. Press CTRL+C keys to get into real U-Boot prompt
3. Boot the image 2:
- set image /dev/mtdblock7; run addargs; bootm 0xb4e80000
4. Once booted, log as admin and change the boot image to 2
- > config firmware image_id 2 boot_up
- > reboot
5. After the boot, flash image1 with the vendor image
Back to stock firmware using DNA
--------------------------------
1. From an OpenWrt:
- # fw_setenv bootstop on
- # reboot
2. In a Windows PC, run 'D-Link Network Assistant v2.0.2.4'. It should
detect the switch
3. Flash the firmware.
It has been developed and tested on device with F3 revision.
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
The D-Link DGS device tree was reorganized to better reflect the common
DT parts. The common include is named SOC specific (838X) and it seemed
like a good choice to add another common include in the future for the
RTL839X devices. From the current point of view this option is not really
needed.
1. The common part only includes data that matches RTL839X devices too.
2. The Panasonic DT structure avoids including the basic DTSI inside the
common DTSI.
Taking simplicity of the Panasonic include logic and in perparation to
provide DGS-1210-52 support it makes sense to harmonize this.
- rename common include to reflect its content
- move the link to the root DTSI directly to the device specific DTS
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Otherwise kernel 5.15 will fail to build on subtargets except for mt7621
that has enabled the config.
The disabled PINCTRL_AW9523 config disappears after a refresh, it needs
to be added back manually.
Fixes: 675cf75578 ("ramips: add config-5.15 for mt7620 subtarget")
Fixes: 001176994a ("ramips: add config-5.15 for mt76x8 subtarget")
Fixes: b9d9f33c33 ("ramips: add config-5.15 for rt288x subtarget")
Fixes: 0164dc0c25 ("ramips: add config-5.15 for rt305x subtarget")
Fixes: ef59da8669 ("ramips: add config-5.15 for rt3883 subtarget")
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Currently factory.bin image recipe of ASUS RP-AC51 is not specified
explicitly and is thus set to the leaked one from the device recipe
right above, i.e. ASUS PL-AC56. Fix it to avoid potential breakage.
Fixes: 416d4483e8 ("ath79: add support for ASUS RP-AC51")
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
This matches the scheme used by other target packages and will avoid
confusion with any future version.
Signed-off-by: Andre Heider <a.heider@gmail.com>
This patch will print the name of the modem in the bootlog
during probing.
This allows to verify that the exact model was loaded and not some
generic type.
The only other way to do this is by enabling dynamic debugging
which is disabled by default in OpenWRT
Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
Instead of always including the XHCI driver in the kernel on all
MediaTek boards, selectively include the kernel module only on boards
which actually make use of USB functionality.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Due to an oversight we accidentally inverted the timeout check. This
patch corrects this.
Fixes: 9cec4a0ea4 ("realtek: Use built-in functionality for timeout loop")
Signed-off-by: Olliver Schinagl <oliver@schinagl.nl>
[ wrap poll_timeout line to 80 char ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
- refresh config
- disable suspend as it's pointless in the sope of OpenWrt
- enable CPU frequency scaling
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
In commit 81e3017609 ("realtek: clean up rtl838x MDIO busy wait loop")
a hand-crafted loop was created, that nearly exactly replicate the
iopoll's `read_poll_timeout` functionality.
Use that instead.
Signed-off-by: Olliver Schinagl <oliver@schinagl.nl>
When converting this device to use both GMACs, I mistakenly removed
state_default, which prevented GPIO LEDs and keys from being used.
Fixes: f4eef5f2a1 ("ramips: add support for Linksys E7350")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
When converting this device to use both GMACs, I mistakenly removed
state_default, which prevented GPIO LEDs and keys from being used.
Add back and and extra LEDs that were missing.
Tested all LEDs by turning them on.
Fixes: 26a6a6a60b ("ramips: add support for Belkin RT1800")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Add support for the TP-Link SG2210P switch. This is an RTL8380 based
switch with eight RJ-45 ports with 802.3af PoE, and two SFP ports.
This device shares the same board with the SG2008P and SG2008. To
model this, declare all the capabilities in the sg2xxx dtsi, and
disable unpopulated on the lower end models.
Specifications:
---------------
- SoC: Realtek RTL8380M
- Flash: 32 MiB SPI flash (Vendor varies)
- RAM: 256 MiB (Vendor varies)
- Ethernet: 8x 10/100/1000 Mbps with PoE (all ports)
2x SFP ports
- Buttons: 1x "Reset" button on front panel
- Power: 53.5V DC barrel jack
- UART: 1x serial header, unpopulated
- PoE: 2x TI TPS23861 I2C PoE controller
Works:
------
- (8) RJ-45 ethernet ports
- (2) SFP ports (with caveats)
- Switch functions
- System LED
Not yet enabled:
----------------
- Power-over-Ethernet (driver works, but doesn't enable "auto" mode)
- PoE LEDs
Enabling SFP ports:
-------------------
The SFP port control lines are hardwired, except for tx-disable. These
lines are controller by the RTL8231 in shift register mode. There is
no driver support for this yet.
However, to enable the lasers on SFP1 and SFP2 respectively:
echo 0x0510ff00 > /sys/kernel/debug/rtl838x/led/led_p_en_ctrl
echo 0x140 > /sys/kernel/debug/rtl838x/led/led_sw_p_ctrl.26
echo 0x140 > /sys/kernel/debug/rtl838x/led/led_sw_p_ctrl.24
Install via serial console/tftp:
--------------------------------
The footprints R27 (0201) and R28 (0402) are not populated. To enable
serial console, 50 ohm resistors should be soldered -- any value from
0 ohm to 50 ohm will work. R27 can be replaced by a solder bridge.
The u-boot firmware drops to a TP-Link specific "BOOTUTIL" shell at
38400 baud. There is no known way to exit out of this shell, and no
way to do anything useful.
Ideally, one would trick the bootloader into flashing the sysupgrade
image first. However, if the image exceeds 6MiB in size, it will not
work. The sysupgrade image can also be flashed. To install OpenWrt:
Prepare a tftp server with:
1. server address: 192.168.0.146
2. the image as: "uImage.img"
Power on device, and stop boot by pressing any key.
Once the shell is active:
1. Ground out the CLK (pin 16) of the ROM (U7)
2. Select option "3. Start"
3. Bootloader notes that "The kernel has been damaged!"
4. Release CLK as sson as bootloader thinks image is corrupted.
5. Bootloader enters automatic recovery -- details printed on console
6. Watch as the bootloader flashes and boots OpenWrt.
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
[OpenWrt capitalisation in commit message]
Signed-off-by: Sander Vanheule <sander@svanheule.net>
The "firmware" partition was assembled from two contiguous partitions.
This complexity is unnecessary. Instead of using mtd-concat over
"sys" and "usrimg1", simply declare the "firmware" partition to cover
the flash space instead.
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
The TP-Link RTL83xx based switches have their MAC address programmed
in the "para" partition. While in theory, the format of this partition
is dynamic, in practice, the MAC address appears to be located at a
consistent address. Thus, use nvmem-cells to read this MAC address.
The main MAC is required for deriving the MAC address of the switch
ports. Instead of reading it via mtd_get_mac_binary(), alias the
ethernet0 node as the label-mac-device, and use get_mac_label().
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Although PHY nodes are labeled, the port nodes were not. Labeling of
ports is useful for 'status = "disabled"' ports, which is supported
since commit 9a7f17e11f ("realtek: ignore disabled switch ports")
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
The TP-Link TL-SG2008, TL-SG2008P, and TL-SG2210P use the same board.
The main difference is that some footprints are not populated in the
lower-end models. To model this with minimal duplication, move the
devicetree to a common dtsi, leaving out just the board name.
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
[remove port relabelling from commit message, already merged with commit
18a2b29aa1 ("realtek: tl-sg2008p: fix labeling of lan ports")]
Signed-off-by: Sander Vanheule <sander@svanheule.net>
When we use the internal toolchain USE_SSTRIP will be selected by
default for musl libc and USE_STRIP when glibc is used. Do the same when
an external toolchain is used. USE_GLIBC will also be set for external
toolchain builds based on the EXTERNAL_TOOLCHAIN_LIBC_USE_GLIBC setting.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Serge Vasilugin reports:
To improve mt7620 built-in wifi performance some changes:
1. Correct BW20/BW40 switching (see comments with mark (1))
2. Correct TX_SW_CFG1 MAC reg from v3 of vendor driver see
https://gitlab.com/dm38/padavan-ng/-/blob/master/trunk/proprietary/rt_wifi/rtpci/3.0.X.X/mt76x2/chips/rt6352.c#L531
3. Set bbp66 for all chains.
4. US_CYC_CNT init based on Programming guide, default value was 33 (pci),
set chipset bus clock with fallback to cpu clock/3.
5. Don't overwrite default values for mt7620.
6. Correct some typos.
7. Add support for external LNA:
a) RF and BBP regs never be corrected for this mode
b) eLNA is driven the same way as ePA with mt7620's pin PA
but vendor driver explicitly pin PA to gpio mode (for forrect calibration?)
so I'm not sure that request for pa_pin in dts-file will be enough
First 5 changes (really 2) improve performance for boards w/o eLNA/ePA.
Changes 7 add support for eLNA
Configuration w/o eLAN/ePA and with eLNA show results
tx/rx (from router point of view) for each stream:
35-40/30-35 Mbps for HT20
65-70/60-65 Mbps for HT40
Yes. Max results for 2T2R client is 140-145/135-140
with peaks 160/150, It correspond to mediatek driver results.
Boards with ePA untested.
Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Specification:
SoC: RT5350
CPU Frequency: 360 MHz
Flash Chip: Macronix MX25L6406E (8192 KiB)
RAM: Winbond W9825G6JH-6 (32768 KiB)
3x 10/100 Mbps Ethernet (2x LAN, 1x WAN)
1x external antenna
UART (J1) header on PCB (57800 8n1)
Wireless: SoC-intergated: 2.4GHz 802.11bgn
USB: Yes
8x LED, 2x button
Flash instruction:
Configure PC with static IP 192.168.99.8/24 and start TFTP server.
Rename "openwrt-ramips-rt305x-zyxel_keenetic-4g-b-squashfs-sysupgrade.bin"
to "rt305x_firmware.bin" and place it in TFTP server directory.
Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed until power LED start blinking.
Router will download file from TFTP server, write it to flash and reboot.
Signed-off-by: Sergei Burakov <senior.anonymous@mail.ru>
The newly introduced config symbol CONFIG_CMDLINE_OVERRIDE is only set
for mt7629 for now which breaks automated build on all other mediatek
subtargets. Make sure the symbol is configured as 'is not set' for all
remaining subtargets.
Fixes: c27279dc26 ("mediatek: add support for ipTIME A6004MX Add basic support for ipTIME A6004MX.")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Hardware:
SoC: MediaTek MT7629 Cortex-A7 (ARMv7 1.25GHz, Dual-Core)
RAM: DDR3 128MB
Flash: Macronix MX35LF1GE4AB (SPI-NAND 128MB)
WiFi: MediaTek MT7761N (2.4GHz) / MediaTek MT7762N (5GHz) - no driver
Ethernet: SoC (WAN) / MediaTek MT7531 (LAN x4)
UART: [GND, RX, TX, 3.3V] (115200)
Installation:
- Flash recovery image with TFTP recovery
Revert to stock firmware:
- Flash stock firmware with TFTP recovery
TFTP Recovery method:
1. Unplug the router
2. Hold the reset button and plug in
3. Release when the power LED stops flashing and go off
4. Set your computer IP address manually to 192.168.0.x / 255.255.255.0
5. Flash image with TFTP client to 192.168.0.1
Signed-off-by: Yoonji Park <koreapyj@dcmys.kr>
Support devices that has vendor custom header before FIT image.
Some devices has vendor custom header before FIT image. In this case mtd-
split can not find FIT image and it results in rootfs mount failure.
Please refer iptime,a6004mx device for further examples.
Signed-off-by: Yoonji Park <koreapyj@dcmys.kr>
MT7915 requires an additional antenna for background radar scanning.
Disable this feature in the following devices that do not have a
separate DFS antenna:
linksys,e8450
ruijie,rg-ew3200gx-pro
xiaomi,redmi-router-ax6s
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Background radar detection is not supported on devices that
using MT7905, so disable this feature in the following devices:
asus,rt-ax53u
jcg,q20
tplink,eap615-wall-v1
xiaomi,mi-router-cr6606
xiaomi,mi-router-cr6608
xiaomi,mi-router-cr6609
yuncore,ax820
Devices with MT7915 lacking a DFS antenna also do not support
background DFS:
totolink,x5000r
cudy,x6
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
The patch adding support for LEDs connected to a reset controller did
not apply any more, refresh it on top of current master.
Fixes: 53fc987b25 ("generic: move ledbar driver from mediatek target")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specifications:
- SoC: ar9341
- RAM: 32M
- Flash: 4M
- Ethernet: 5x FE ports
- WiFi: ar9341-wmac
Flash instruction:
Upload generated factory firmware on vendor's web interface.
This device is very similar to the TL-WR841N v8, only two LED GPIOs are
different.
Buttons configuration is similar to TL-WR842ND v2 but both buttons are
active low.
Signed-off-by: Will Moss <willormos@gmail.com>
Add support for TP-Link Deco S4 wifi router
The label refers to the device as S4R and the TP-Link firmware
site calls it the Deco S4 v2. (There does not appear to be a v1)
Hardware (and FCC id) are identical to the Deco M4R v2 but the
flash layout is ordered differently and the OEM firmware encrypts
some config parameters (including the label mac address) in flash
In order to set the encrypted mac address, the wlan's caldata
node is removed from the DTS so the mac can be decrypted with
the help of the uencrypt tool and patched into the wlan fw
via hotplug
Specifications:
SoC: QCA9563-AL3A
RAM: Zentel A3R1GE40JBF
Wireless 2.4GHz: QCA9563-AL3A (main SoC)
Wireless 5GHz: QCA9886
Ethernet Switch: QCA8337N-AL3C
Flash: 16 MB SPI NOR
UART serial access (115200N1) on board via solder pads:
RX = TP1 pad
TX = TP2 pad
GND = C201 (pad nearest board edge)
The device's bootloader and web gui will only accept images that
were signed using TP-Link's RSA key, however a memory safety bug
in the bootloader can be leveraged to install openwrt without
accessing the serial console. See developer forum S4 support page
for link to a "firmware" file that starts a tftp client, or you
may generate one on your own like this:
```
python - > deco_s4_faux_fw_tftp.bin <<EOF
import sys
from struct import pack
b = pack('>I', 0x00008000) + b'X'*16 + b"fw-type:" \
+ b'x'*256 + b"S000S001S002" + pack('>I', 0x80060200) \
b += b"\x00"*(0x200-len(b)) \
+ pack(">33I", *[0x3c0887fc, 0x35083ddc, 0xad000000, 0x24050000,
0x3c048006, 0x348402a0, 0x3c1987f9, 0x373947f4,
0x0320f809, 0x00000000, 0x24050000, 0x3c048006,
0x348402d0, 0x3c1987f9, 0x373947f4, 0x0320f809,
0x00000000, 0x24050000, 0x3c048006, 0x34840300,
0x3c1987f9, 0x373947f4, 0x0320f809, 0x00000000,
0x24050000, 0x3c048006, 0x34840400, 0x3c1987f9,
0x373947f4, 0x0320f809, 0x00000000, 0x1000fff1,
0x00000000])
b += b"\xff"*(0x2A0-len(b)) + b"setenv serverip 192.168.0.2\x00"
b += b"\xff"*(0x2D0-len(b)) + b"setenv ipaddr 192.168.0.1\x00"
b += b"\xff"*(0x300-len(b)) + b"tftpboot 0x81000000 initramfs-kernel.bin\x00"
b += b"\xff"*(0x400-len(b)) + b"bootm 0x81000000\x00"
b += b"\xff"*(0x8000-len(b))
sys.stdout.buffer.write(b)
EOF
```
Installation:
1. Run tftp server on pc with static ip 192.168.0.2
2. Place openwrt "initramfs-kernel.bin" image in tftp root dir
3. Connect pc to router ethernet port1
4. While holding in reset button on bottom of router, power on router
5. From pc access router webgui at http://192.168.0.1
6. Upload deco_s4_faux_fw_tftp.bin
7. Router will load and execture in-memory openwrt
8. Switch pc back to dhcp or static 192.168.1.x
9. Flash openwrt sysupgrade image via luci/ssh at 192.168.1.1
Revert to stock:
Press and hold reset button while powering device to start the
bootloader's recovery mode, where stock firmware can be uploaded
via web gui at 192.168.0.1
Please note that one additional non-github commits is also needed:
firmware-utils: add tplink-safeloader support for Deco S4
Signed-off-by: Nick French <nickfrench@gmail.com>
FCC ID: U2M-CAP2100AG
WatchGuard AP100 is an indoor wireless access point with
1 Gb ethernet port, dual-band but single-radio wireless,
internal antenna plates, and 802.3at PoE+
this board is a Senao device:
the hardware is equivalent to EnGenius EAP300 v2
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails
**Specification:**
- AR9344 SOC MIPS 74kc, 2.4 GHz AND 5 GHz WMAC, 2x2
- AR8035-A EPHY RGMII GbE with PoE+ IN
- 25 MHz clock
- 16 MB FLASH mx25l12805d
- 2x 64 MB RAM
- UART console J11, populated
- GPIO watchdog GPIO 16, 20 sec toggle
- 2 antennas 5 dBi, internal omni-directional plates
- 5 LEDs power, eth0 link/data, 2G, 5G
- 1 button reset
**MAC addresses:**
Label has no MAC
Only one Vendor MAC address in flash at art 0x0
eth0 ---- *:e5 art 0x0 -2
phy0 ---- *:e5 art 0x0 -2
**Installation:**
Method 1: OEM webpage
use OEM webpage for firmware upgrade to upload factory.bin
Method 2: root shell
It may be necessary to use a Watchguard router to flash the image to the AP
and / or to downgrade the software on the AP to access SSH
For some Watchguard devices, serial console over UART is disabled.
NOTE: DHCP is not enabled by default after flashing
**TFTP recovery:**
reset button has no function at boot time
only possible with modified uboot environment,
(see commit message for Watchguard AP300)
**Return to OEM:**
user should make backup of MTD partitions
and write the backups back to mtd devices
in order to revert to OEM reliably
It may be possible to use sysupgrade
with an OEM image as well...
(not tested)
**OEM upgrade info:**
The OEM upgrade script is at /etc/fwupgrade.sh
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
**Note on eth0 PLL-data:**
The default Ethernet Configuration register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For AR934x series, the PLL registers for eth0
can be see in the DTSI as 0x2c.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
The clock delay required for RGMII can be applied
at the PHY side, using the at803x driver `phy-mode`.
Therefore the PLL registers for GMAC0
do not need the bits for delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
**Note on WatchGuard Magic string:**
The OEM upgrade script is a modified version of
the generic Senao sysupgrade script
which is used on EnGenius devices.
On WatchGuard boards produced by Senao,
images are verified using a md5sum checksum of
the upgrade image concatenated with a magic string.
this checksum is then appended to the end of the final image.
This variable does not apply to all the senao devices
so set to null string as default
Tested-by: Steve Wheeler <stephenw10@gmail.com>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
FCC ID: U2M-CAP4200AG
WatchGuard AP200 is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
this board is a Senao device:
the hardware is equivalent to EnGenius EAP600
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails
**Specification:**
- AR9344 SOC MIPS 74kc, 2.4 GHz WMAC, 2x2
- AR9382 WLAN PCI card 168c:0030, 5 GHz, 2x2, 26dBm
- AR8035-A EPHY RGMII GbE with PoE+ IN
- 25 MHz clock
- 16 MB FLASH mx25l12805d
- 2x 64 MB RAM
- UART console J11, populated
- GPIO watchdog GPIO 16, 20 sec toggle
- 4 antennas 5 dBi, internal omni-directional plates
- 5 LEDs power, eth0 link/data, 2G, 5G
- 1 button reset
**MAC addresses:**
Label has no MAC
Only one Vendor MAC address in flash at art 0x0
eth0 ---- *:be art 0x0 -2
phy1 ---- *:bf art 0x0 -1
phy0 ---- *:be art 0x0 -2
**Installation:**
Method 1: OEM webpage
use OEM webpage for firmware upgrade to upload factory.bin
Method 2: root shell
It may be necessary to use a Watchguard router to flash the image to the AP
and / or to downgrade the software on the AP to access SSH
For some Watchguard devices, serial console over UART is disabled.
NOTE: DHCP is not enabled by default after flashing
**TFTP recovery:**
reset button has no function at boot time
only possible with modified uboot environment,
(see commit message for Watchguard AP300)
**Return to OEM:**
user should make backup of MTD partitions
and write the backups back to mtd devices
in order to revert to OEM reliably
It may be possible to use sysupgrade
with an OEM image as well...
(not tested)
**OEM upgrade info:**
The OEM upgrade script is at /etc/fwupgrade.sh
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
**Note on eth0 PLL-data:**
The default Ethernet Configuration register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For AR934x series, the PLL registers for eth0
can be see in the DTSI as 0x2c.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`.
The clock delay required for RGMII can be applied
at the PHY side, using the at803x driver `phy-mode`.
Therefore the PLL registers for GMAC0
do not need the bits for delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
**Note on WatchGuard Magic string:**
The OEM upgrade script is a modified version of
the generic Senao sysupgrade script
which is used on EnGenius devices.
On WatchGuard boards produced by Senao,
images are verified using a md5sum checksum of
the upgrade image concatenated with a magic string.
this checksum is then appended to the end of the final image.
This variable does not apply to all the senao devices
so set to null string as default
Tested-by: Steve Wheeler <stephenw10@gmail.com>
Tested-by: John Delaney <johnd@ankco.net>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
FCC ID: Q6G-AP300
WatchGuard AP300 is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+
this board is a Senao device:
the hardware is equivalent to EnGenius EAP1750
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails
**Specification:**
- QCA9558 SOC MIPS 74kc, 2.4 GHz WMAC, 3x3
- QCA9880 WLAN PCI card 168c:003c, 5 GHz, 3x3, 26dBm
- AR8035-A PHY RGMII GbE with PoE+ IN
- 40 MHz clock
- 32 MB FLASH S25FL512S
- 2x 64 MB RAM NT5TU32M16
- UART console J10, populated
- GPIO watchdog GPIO 16, 20 sec toggle
- 6 antennas 5 dBi, internal omni-directional plates
- 5 LEDs power, eth0 link/data, 2G, 5G
- 1 button reset
**MAC addresses:**
MAC address labeled as ETH
Only one Vendor MAC address in flash at art 0x0
eth0 ETH *:3c art 0x0
phy1 ---- *:3d ---
phy0 ---- *:3e ---
**Serial console access:**
For this board, its not certain whether UART is possible
it is likely that software is blocking console access
the RX line on the board for UART is shorted to ground by resistor R176
the resistors R175 and R176 are next to the UART RX pin at J10
however console output is garbage even after this fix
**Installation:**
Method 1: OEM webpage
use OEM webpage for firmware upgrade to upload factory.bin
Method 2: root shell access
downgrade XTM firewall to v2.0.0.1
downgrade AP300 firmware: v1.0.1
remove / unpair AP from controller
perform factory reset with reset button
connect ethernet to a computer
login to OEM webpage with default address / pass: wgwap
enable SSHD in OEM webpage settings
access root shell with SSH as user 'root'
modify uboot environment to automatically try TFTP at boot time
(see command below)
rename initramfs-kernel.bin to test.bin
load test.bin over TFTP (see TFTP recovery)
(optionally backup all mtdblocks to have flash backup)
perform a sysupgrade with sysupgrade.bin
NOTE: DHCP is not enabled by default after flashing
**TFTP recovery:**
server ip: 192.168.1.101
reset button seems to do nothing at boot time...
only possible with modified uboot environment,
running this command in the root shell:
fw_setenv bootcmd 'if ping 192.168.1.101; then tftp 0x82000000 test.bin && bootm 0x82000000; else bootm 0x9f0a0000; fi'
and verify that it is correct with
fw_printenv
then, before boot, the device will attempt TFTP from 192.168.1.101
looking for file 'test.bin'
to return uboot environment to normal:
fw_setenv bootcmd 'bootm 0x9f0a0000'
**Return to OEM:**
user should make backup of MTD partitions
and write the backups back to mtd devices
in order to revert to OEM
(see installation method 2)
It may be possible to use sysupgrade
with an OEM image as well...
(not tested)
**OEM upgrade info:**
The OEM upgrade script is at /etc/fwupgrade.sh
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
**Note on eth0 PLL-data:**
The default Ethernet Configuration register values will not work
because of the external AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
The clock delay required for RGMII can be applied
at the PHY side, using the at803x driver `phy-mode`.
Therefore the PLL registers for GMAC0
do not need the bits for delay on the MAC side.
This is possible due to fixes in at803x driver
since Linux 5.1 and 5.3
**Note on WatchGuard Magic string:**
The OEM upgrade script is a modified version of
the generic Senao sysupgrade script
which is used on EnGenius devices.
On WatchGuard boards produced by Senao,
images are verified using a md5sum checksum of
the upgrade image concatenated with a magic string.
this checksum is then appended to the end of the final image.
This variable does not apply to all the senao devices
so set to null string as default
Tested-by: Alessandro Kornowski <ak@wski.org>
Tested-by: John Wagner <john@wagner.us.org>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
after some trial and error, it was discovered
that by setting TX only delay on the AR8035 PHY
that setting GMAC registers is no longer necessary.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Other vendors can use this DTSI, for example, WatchGuard
there are likely several brands that use the same board design
because of outsourcing hardware from Senao.
For example, Watchguard AP300
has the same hardware as Engenius EAP600
so we use ar9344_engenius_exx600.dtsi for that
Signed-off-by: Michael Pratt <mcpratt@pm.me>
The RGB LED of the UniFi 6 LR v1 doesn't work when using the Openwrt-
built U-Boot. This is because the vendor loader resets the ledbar
controller while our U-Boot doesn't care.
Add reset-gpio so the ledbar driver in Linux will always reset the
ledbar controller.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Hardware
--------
- SoC: MediaTek MT7621AT with 128 MiB RAM and 32 MiB Flash
- Wi-Fi: MediaTek MT7603 (b/g/n, 2x2) and MediaTek MT7615 (ac, 4x4)
- Bluetooth: CSR8811 (internal USB, install kmod-bluetooth)
Installation
------------
1. Connect to the booted device at 192.168.1.20 using username/password
"ubnt".
2. Update the bootloader environment.
$ fw_setenv devmode TRUE
$ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr);
fdt rm /signature; bootubnt"
$ fw_setenv bootcmd "run boot_openwrt"
3. Transfer the OpenWrt sysupgrade image to the device using SCP.
4. Check the mtd partition number for bs / kernel0 / kernel1
$ cat /proc/mtd
5. Set the bootselect flag to boot from kernel0
$ dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock4
6. Write the OpenWrt sysupgrade image to both kernel0 as well as kernel1
$ dd if=openwrt.bin of=/dev/mtdblock6
$ dd if=openwrt.bin of=/dev/mtdblock7
7. Reboot the device. It should boot into OpenWrt.
Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
The LEDs connected to the MCU are so-called smart LEDs and their signal is
daisy-chained. Because of this, the MCU needs to be told how many LEDs are
connected. It also means the LEDs could be individually controlled, if the MCU
has a command for this.
Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
During GPIO initialization the pin state flips and triggers a reset of
the ledbar MCU. It needs to be moved through an initialization sequence
before working correctly.
Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
Some versions of the ledbar MCU have a reset pin. It needs to be
correctly initialized or we might keep the MCU in reset state.
Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
Or the comparison against a signed char is always true, because the
literal 0xaa is treated as an unsigned int, to which the signed char is
casted during comparison. 0xaa is above the positive values of a signed
char and negative signed char values result in values larger than 0xaa
when casted to unsigned int.
Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
The read response is in the i2c_response variable. Also use %hhx format,
because we're dealing with a single char.
Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
phy[01]radio leaves the leds always on, if they are set through sysfs the leds
get off.
Set the triggers to phy[01]tpt to make them work.
Signed-off-by: David Santamaría Rogado <howl.nsp@gmail.com>
Add Kernel config for testing Linux 5.15 for the rt305x subtarget.
Tested on ZyXEL NBG-419N, works but bad wireless performance.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Backport a preliminary version of Yu Zhao's multi-generational LRU, for
improved memory management. Refresh the patches while at it.
Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
The image build process was modifying the generated IMAGE_KERNEL to
append rootfs information (crc). This caused:
- sysupgrade & factory images to contain 2 times the root.squashfs
information due to both modifying the same IMAGE_KERNEL.
- the generated imagebuilder to contain an erroneous IMAGE_KERNEL that
contained references to an unexisting root.squashfs (the one from
previous cause). The RTL30VW wasn't therefore able to boot the
generated images as they contained checksums from non existing rootfs.
This commit makes sure to use a temporary IMAGE_KERNEL to append the
rootfs information for both factory and sysupgrade images.
Fixes: #10511
Signed-off-by: Gregory Detal <gregory.detal@tessares.net>
Ruckus ZoneFlex 7321 is a dual-band, single radio 802.11n 2x2 MIMO enterprise
access point. It is very similar to its bigger brother, ZoneFlex 7372.
Hardware highligts:
- CPU: Atheros AR9342 SoC at 533 MHz
- RAM: 64MB DDR2
- Flash: 32MB SPI-NOR
- Wi-Fi: AR9342 built-in dual-band 2x2 MIMO radio
- Ethernet: single Gigabit Ethernet port through AR8035 gigabit PHY
- PoE: input through Gigabit port
- Standalone 12V/1A power input
- USB: optional single USB 2.0 host port on the 7321-U variant.
Serial console: 115200-8-N-1 on internal H1 header.
Pinout:
H1 ----------
|1|x3|4|5|
----------
Pin 1 is near the "H1" marking.
1 - RX
x - no pin
3 - VCC (3.3V)
4 - GND
5 - TX
JTAG: Connector H5, unpopulated, similar to MIPS eJTAG, standard,
but without the key in pin 12 and not every pin routed:
------- H5
|1 |2 |
-------
|3 |4 |
-------
|5 |6 |
-------
|7 |8 |
-------
|9 |10|
-------
|11|12|
-------
|13|14|
-------
3 - TDI
5 - TDO
7 - TMS
9 - TCK
2,4,6,8,10 - GND
14 - Vref
1,11,12,13 - Not connected
Installation:
There are two methods of installation:
- Using serial console [1] - requires some disassembly, 3.3V USB-Serial
adapter, TFTP server, and removing a single T10 screw,
but with much less manual steps, and is generally recommended, being
safer.
- Using stock firmware root shell exploit, SSH and TFTP [2]. Does not
work on some rare versions of stock firmware. A more involved, and
requires installing `mkenvimage` from u-boot-tools package if you
choose to rebuild your own environment, but can be used without
disassembly or removal from installation point, if you have the
credentials.
If for some reason, size of your sysupgrade image exceeds 13312kB,
proceed with method [1]. For official images this is not likely to
happen ever.
[1] Using serial console:
0. Connect serial console to H1 header. Ensure the serial converter
does not back-power the board, otherwise it will fail to boot.
1. Power-on the board. Then quickly connect serial converter to PC and
hit Ctrl+C in the terminal to break boot sequence. If you're lucky,
you'll enter U-boot shell. Then skip to point 3.
Connection parameters are 115200-8-N-1.
2. Allow the board to boot. Press the reset button, so the board
reboots into U-boot again and go back to point 1.
3. Set the "bootcmd" variable to disable the dual-boot feature of the
system and ensure that uImage is loaded. This is critical step, and
needs to be done only on initial installation.
> setenv bootcmd "bootm 0x9f040000"
> saveenv
4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed:
> setenv serverip 192.168.1.2
> setenv ipaddr 192.168.1.1
> tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7321-initramfs-kernel.bin
> bootm 0x81000000
5. Optional, but highly recommended: back up contents of "firmware" partition:
$ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7321_fw1_backup.bin
$ ssh root@192.168.1.1 cat /dev/mtd5 > ruckus_zf7321_fw2_backup.bin
6. Copy over sysupgrade image, and perform actual installation. OpenWrt
shall boot from flash afterwards:
$ ssh root@192.168.1.1
# sysupgrade -n openwrt-ath79-generic-ruckus_zf7321-squashfs-sysupgrade.bin
[2] Using stock root shell:
0. Reset the device to factory defaullts. Power-on the device and after
it boots, hold the reset button near Ethernet connectors for 5
seconds.
1. Connect the device to the network. It will acquire address over DHCP,
so either find its address using list of DHCP leases by looking for
label MAC address, or try finding it by scanning for SSH port:
$ nmap 10.42.0.0/24 -p22
From now on, we assume your computer has address 10.42.0.1 and the device
has address 10.42.0.254.
2. Set up a TFTP server on your computer. We assume that TFTP server
root is at /srv/tftp.
3. Obtain root shell. Connect to the device over SSH. The SSHD ond the
frmware is pretty ancient and requires enabling HMAC-MD5.
$ ssh 10.42.0.254 \
-o UserKnownHostsFile=/dev/null \
-o StrictHostKeyCheking=no \
-o MACs=hmac-md5
Login. User is "super", password is "sp-admin".
Now execute a hidden command:
Ruckus
It is case-sensitive. Copy and paste the following string,
including quotes. There will be no output on the console for that.
";/bin/sh;"
Hit "enter". The AP will respond with:
grrrr
OK
Now execute another hidden command:
!v54!
At "What's your chow?" prompt just hit "enter".
Congratulations, you should now be dropped to Busybox shell with root
permissions.
4. Optional, but highly recommended: backup the flash contents before
installation. At your PC ensure the device can write the firmware
over TFTP:
$ sudo touch /srv/tftp/ruckus_zf7321_firmware{1,2}.bin
$ sudo chmod 666 /srv/tftp/ruckus_zf7321_firmware{1,2}.bin
Locate partitions for primary and secondary firmware image.
NEVER blindly copy over MTD nodes, because MTD indices change
depending on the currently active firmware, and all partitions are
writable!
# grep rcks_wlan /proc/mtd
Copy over both images using TFTP, this will be useful in case you'd
like to return to stock FW in future. Make sure to backup both, as
OpenWrt uses bot firmwre partitions for storage!
# tftp -l /dev/<rcks_wlan.main_mtd> -r ruckus_zf7321_firmware1.bin -p 10.42.0.1
# tftp -l /dev/<rcks_wlan.bkup_mtd> -r ruckus_zf7321_firmware2.bin -p 10.42.0.1
When the command finishes, copy over the dump to a safe place for
storage.
$ cp /srv/tftp/ruckus_zf7321_firmware{1,2}.bin ~/
5. Ensure the system is running from the BACKUP image, i.e. from
rcks_wlan.bkup partition or "image 2". Otherwise the installation
WILL fail, and you will need to access mtd0 device to write image
which risks overwriting the bootloader, and so is not covered here
and not supported.
Switching to backup firmware can be achieved by executing a few
consecutive reboots of the device, or by updating the stock firmware. The
system will boot from the image it was not running from previously.
Stock firmware available to update was conveniently dumped in point 4 :-)
6. Prepare U-boot environment image.
Install u-boot-tools package. Alternatively, if you build your own
images, OpenWrt provides mkenvimage in host staging directory as well.
It is recommended to extract environment from the device, and modify
it, rather then relying on defaults:
$ sudo touch /srv/tftp/u-boot-env.bin
$ sudo chmod 666 /srv/tftp/u-boot-env.bin
On the device, find the MTD partition on which environment resides.
Beware, it may change depending on currently active firmware image!
# grep u-boot-env /proc/mtd
Now, copy over the partition
# tftp -l /dev/mtd<N> -r u-boot-env.bin -p 10.42.0.1
Store the stock environment in a safe place:
$ cp /srv/tftp/u-boot-env.bin ~/
Extract the values from the dump:
$ strings u-boot-env.bin | tee u-boot-env.txt
Now clean up the debris at the end of output, you should end up with
each variable defined once. After that, set the bootcmd variable like
this:
bootcmd=bootm 0x9f040000
You should end up with something like this:
bootcmd=bootm 0x9f040000
bootargs=console=ttyS0,115200 rootfstype=squashfs init=/sbin/init
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
mtdparts=mtdparts=ar7100-nor0:256k(u-boot),13312k(rcks_wlan.main),2048k(datafs),256k(u-boot-env),512k(Board Data),13312k(rcks_wlan.bkup)
mtdids=nor0=ar7100-nor0
bootdelay=2
ethact=eth0
filesize=78a000
fileaddr=81000000
partition=nor0,0
mtddevnum=0
mtddevname=u-boot
ipaddr=10.0.0.1
serverip=10.0.0.5
stdin=serial
stdout=serial
stderr=serial
These are the defaults, you can use most likely just this as input to
mkenvimage.
Now, create environment image and copy it over to TFTP root:
$ mkenvimage -s 0x40000 -b -o u-boot-env.bin u-boot-env.txt
$ sudo cp u-boot-env.bin /srv/tftp
This is the same image, gzipped and base64-encoded:
H4sIAAAAAAAAA+3QQW7TQBQAUF8EKRtQI6XtJDS0VJoN4gYcAE3iCbWS2MF2Sss1ORDYqVq6YMEB3rP0
Z/7Yf+aP3/56827VNP16X8Zx3E/Cw8dNuAqDYlxI7bcurpu6a3Y59v3jlzCbz5eLECbt8HbT9Y+HHLvv
x9TdbbpJVVd9vOxWVX05TotVOpZt6nN8qilyf5fKso3hIYTb8JDSEFarIazXQyjLIeRc7PvykNq+iy+T
1F7PQzivmzbcLpYftmfH87G56Wz+/v18sT1r19vu649dqi/2qaqns0W4utmelalPm27I/lac5/p+OluO
NZ+a1JaTz8M3/9hmtT0epmMjVdnF8djXLZx+TJl36TEuTlda93EYQrGpdrmrfuZ4fZPGHzjmp/vezMNJ
MV6n6qumPm06C+MRZb6vj/v4Mk/7HJ+6LarDqXweLsZnXnS5vc9tdXheWRbd0GIdh/Uq7cakOfavsty2
z1nxGwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAD+1x9eTkHLAAAEAA==
7. Perform actual installation. Copy over OpenWrt sysupgrade image to
TFTP root:
$ sudo cp openwrt-ath79-generic-ruckus_zf7321-squashfs-sysupgrade.bin /srv/tftp
Now load both to the device over TFTP:
# tftp -l /tmp/u-boot-env.bin -r u-boot-env.bin -g 10.42.0.1
# tftp -l /tmp/openwrt.bin -r openwrt-ath79-generic-ruckus_zf7321-squashfs-sysupgrade.bin -g 10.42.0.1
Vverify checksums of both images to ensure the transfer over TFTP
was completed:
# sha256sum /tmp/u-boot-env.bin /tmp/openwrt.bin
And compare it against source images:
$ sha256sum /srv/tftp/u-boot-env.bin /srv/tftp/openwrt-ath79-generic-ruckus_zf7321-squashfs-sysupgrade.bin
Locate MTD partition of the primary image:
# grep rcks_wlan.main /proc/mtd
Now, write the images in place. Write U-boot environment last, so
unit still can boot from backup image, should power failure occur during
this. Replace MTD placeholders with real MTD nodes:
# flashcp /tmp/openwrt.bin /dev/<rcks_wlan.main_mtd>
# flashcp /tmp/u-boot-env.bin /dev/<u-boot-env_mtd>
Finally, reboot the device. The device should directly boot into
OpenWrt. Look for the characteristic power LED blinking pattern.
# reboot -f
After unit boots, it should be available at the usual 192.168.1.1/24.
Return to factory firmware:
1. Boot into OpenWrt initramfs as for initial installation. To do that
without disassembly, you can write an initramfs image to the device
using 'sysupgrade -F' first.
2. Unset the "bootcmd" variable:
fw_setenv bootcmd ""
3. Write factory images downloaded from manufacturer website into
fwconcat0 and fwconcat1 MTD partitions, or restore backup you took
before installation:
mtd write ruckus_zf7321_fw1_backup.bin /dev/mtd1
mtd write ruckus_zf7321_fw2_backup.bin /dev/mtd5
4. Reboot the system, it should load into factory firmware again.
Quirks and known issues:
- Flash layout is changed from the factory, to use both firmware image
partitions for storage using mtd-concat, and uImage format is used to
actually boot the system, which rules out the dual-boot capability.
- The 5GHz radio has its own EEPROM on board, not connected to CPU.
- The stock firmware has dual-boot capability, which is not supported in
OpenWrt by choice.
It is controlled by data in the top 64kB of RAM which is unmapped,
to avoid the interference in the boot process and accidental
switch to the inactive image, although boot script presence in
form of "bootcmd" variable should prevent this entirely.
- U-boot disables JTAG when starting. To re-enable it, you need to
execute the following command before booting:
mw.l 1804006c 40
And also you need to disable the reset button in device tree if you
intend to debug Linux, because reset button on GPIO0 shares the TCK
pin.
- On some versions of stock firmware, it is possible to obtain root shell,
however not much is available in terms of debugging facitilies.
1. Login to the rkscli
2. Execute hidden command "Ruckus"
3. Copy and paste ";/bin/sh;" including quotes. This is required only
once, the payload will be stored in writable filesystem.
4. Execute hidden command "!v54!". Press Enter leaving empty reply for
"What's your chow?" prompt.
5. Busybox shell shall open.
Source: https://alephsecurity.com/vulns/aleph-2019014
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Ruckus ZoneFlex 7372 is a dual-band, dual-radio 802.11n 2x2 MIMO enterprise
access point.
Ruckus ZoneFlex 7352 is also supported, lacking the 5GHz radio part.
Hardware highligts:
- CPU: Atheros AR9344 SoC at 560 MHz
- RAM: 128MB DDR2
- Flash: 32MB SPI-NOR
- Wi-Fi 2.4GHz: AR9344 built-in 2x2 MIMO radio
- Wi-Fi 5Ghz: AR9582 2x2 MIMO radio (Only in ZF7372)
- Antennas:
- Separate internal active antennas with beamforming support on both
bands with 7 elements per band, each controlled by 74LV164 GPIO
expanders, attached to GPIOs of each radio.
- Two dual-band external RP-SMA antenna connections on "7372-E"
variant.
- Ethernet 1: single Gigabit Ethernet port through AR8035 gigabit PHY
- Ethernet 2: single Fast Ethernet port through AR9344 built-in switch
- PoE: input through Gigabit port
- Standalone 12V/1A power input
- USB: optional single USB 2.0 host port on "-U" variants.
The same image should support:
- ZoneFlex 7372E (variant with external antennas, without beamforming
capability)
- ZoneFlex 7352 (single-band, 2.4GHz-only variant).
which are based on same baseboard (codename St. Bernard),
with different populated components.
Serial console: 115200-8-N-1 on internal H1 header.
Pinout:
H1
---
|5|
---
|4|
---
|3|
---
|x|
---
|1|
---
Pin 5 is near the "H1" marking.
1 - RX
x - no pin
3 - VCC (3.3V)
4 - GND
5 - TX
JTAG: Connector H2, similar to MIPS eJTAG, standard,
but without the key in pin 12 and not every pin routed:
------- H2
|1 |2 |
-------
|3 |4 |
-------
|5 |6 |
-------
|7 |8 |
-------
|9 |10|
-------
|11|12|
-------
|13|14|
-------
3 - TDI
5 - TDO
7 - TMS
9 - TCK
2,4,6,8,10 - GND
14 - Vref
1,11,12,13 - Not connected
Installation:
There are two methods of installation:
- Using serial console [1] - requires some disassembly, 3.3V USB-Serial
adapter, TFTP server, and removing a single T10 screw,
but with much less manual steps, and is generally recommended, being
safer.
- Using stock firmware root shell exploit, SSH and TFTP [2]. Does not
work on some rare versions of stock firmware. A more involved, and
requires installing `mkenvimage` from u-boot-tools package if you
choose to rebuild your own environment, but can be used without
disassembly or removal from installation point, if you have the
credentials.
If for some reason, size of your sysupgrade image exceeds 13312kB,
proceed with method [1]. For official images this is not likely to
happen ever.
[1] Using serial console:
0. Connect serial console to H1 header. Ensure the serial converter
does not back-power the board, otherwise it will fail to boot.
1. Power-on the board. Then quickly connect serial converter to PC and
hit Ctrl+C in the terminal to break boot sequence. If you're lucky,
you'll enter U-boot shell. Then skip to point 3.
Connection parameters are 115200-8-N-1.
2. Allow the board to boot. Press the reset button, so the board
reboots into U-boot again and go back to point 1.
3. Set the "bootcmd" variable to disable the dual-boot feature of the
system and ensure that uImage is loaded. This is critical step, and
needs to be done only on initial installation.
> setenv bootcmd "bootm 0x9f040000"
> saveenv
4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed:
> setenv serverip 192.168.1.2
> setenv ipaddr 192.168.1.1
> tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7372-initramfs-kernel.bin
> bootm 0x81000000
5. Optional, but highly recommended: back up contents of "firmware" partition:
$ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7372_fw1_backup.bin
$ ssh root@192.168.1.1 cat /dev/mtd5 > ruckus_zf7372_fw2_backup.bin
6. Copy over sysupgrade image, and perform actual installation. OpenWrt
shall boot from flash afterwards:
$ ssh root@192.168.1.1
# sysupgrade -n openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin
[2] Using stock root shell:
0. Reset the device to factory defaullts. Power-on the device and after
it boots, hold the reset button near Ethernet connectors for 5
seconds.
1. Connect the device to the network. It will acquire address over DHCP,
so either find its address using list of DHCP leases by looking for
label MAC address, or try finding it by scanning for SSH port:
$ nmap 10.42.0.0/24 -p22
From now on, we assume your computer has address 10.42.0.1 and the device
has address 10.42.0.254.
2. Set up a TFTP server on your computer. We assume that TFTP server
root is at /srv/tftp.
3. Obtain root shell. Connect to the device over SSH. The SSHD ond the
frmware is pretty ancient and requires enabling HMAC-MD5.
$ ssh 10.42.0.254 \
-o UserKnownHostsFile=/dev/null \
-o StrictHostKeyCheking=no \
-o MACs=hmac-md5
Login. User is "super", password is "sp-admin".
Now execute a hidden command:
Ruckus
It is case-sensitive. Copy and paste the following string,
including quotes. There will be no output on the console for that.
";/bin/sh;"
Hit "enter". The AP will respond with:
grrrr
OK
Now execute another hidden command:
!v54!
At "What's your chow?" prompt just hit "enter".
Congratulations, you should now be dropped to Busybox shell with root
permissions.
4. Optional, but highly recommended: backup the flash contents before
installation. At your PC ensure the device can write the firmware
over TFTP:
$ sudo touch /srv/tftp/ruckus_zf7372_firmware{1,2}.bin
$ sudo chmod 666 /srv/tftp/ruckus_zf7372_firmware{1,2}.bin
Locate partitions for primary and secondary firmware image.
NEVER blindly copy over MTD nodes, because MTD indices change
depending on the currently active firmware, and all partitions are
writable!
# grep rcks_wlan /proc/mtd
Copy over both images using TFTP, this will be useful in case you'd
like to return to stock FW in future. Make sure to backup both, as
OpenWrt uses bot firmwre partitions for storage!
# tftp -l /dev/<rcks_wlan.main_mtd> -r ruckus_zf7372_firmware1.bin -p 10.42.0.1
# tftp -l /dev/<rcks_wlan.bkup_mtd> -r ruckus_zf7372_firmware2.bin -p 10.42.0.1
When the command finishes, copy over the dump to a safe place for
storage.
$ cp /srv/tftp/ruckus_zf7372_firmware{1,2}.bin ~/
5. Ensure the system is running from the BACKUP image, i.e. from
rcks_wlan.bkup partition or "image 2". Otherwise the installation
WILL fail, and you will need to access mtd0 device to write image
which risks overwriting the bootloader, and so is not covered here
and not supported.
Switching to backup firmware can be achieved by executing a few
consecutive reboots of the device, or by updating the stock firmware. The
system will boot from the image it was not running from previously.
Stock firmware available to update was conveniently dumped in point 4 :-)
6. Prepare U-boot environment image.
Install u-boot-tools package. Alternatively, if you build your own
images, OpenWrt provides mkenvimage in host staging directory as well.
It is recommended to extract environment from the device, and modify
it, rather then relying on defaults:
$ sudo touch /srv/tftp/u-boot-env.bin
$ sudo chmod 666 /srv/tftp/u-boot-env.bin
On the device, find the MTD partition on which environment resides.
Beware, it may change depending on currently active firmware image!
# grep u-boot-env /proc/mtd
Now, copy over the partition
# tftp -l /dev/mtd<N> -r u-boot-env.bin -p 10.42.0.1
Store the stock environment in a safe place:
$ cp /srv/tftp/u-boot-env.bin ~/
Extract the values from the dump:
$ strings u-boot-env.bin | tee u-boot-env.txt
Now clean up the debris at the end of output, you should end up with
each variable defined once. After that, set the bootcmd variable like
this:
bootcmd=bootm 0x9f040000
You should end up with something like this:
bootcmd=bootm 0x9f040000
bootargs=console=ttyS0,115200 rootfstype=squashfs init=/sbin/init
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
bootdelay=2
mtdids=nor0=ar7100-nor0
mtdparts=mtdparts=ar7100-nor0:256k(u-boot),13312k(rcks_wlan.main),2048k(datafs),256k(u-boot-env),512k(Board Data),13312k(rcks_wlan.bkup)
ethact=eth0
filesize=1000000
fileaddr=81000000
ipaddr=192.168.0.7
serverip=192.168.0.51
partition=nor0,0
mtddevnum=0
mtddevname=u-boot
stdin=serial
stdout=serial
stderr=serial
These are the defaults, you can use most likely just this as input to
mkenvimage.
Now, create environment image and copy it over to TFTP root:
$ mkenvimage -s 0x40000 -b -o u-boot-env.bin u-boot-env.txt
$ sudo cp u-boot-env.bin /srv/tftp
This is the same image, gzipped and base64-encoded:
H4sIAAAAAAAAA+3QTW7TQBQAYB+AQ2TZSGk6Tpv+SbNBrNhyADSJHWolsYPtlJaDcAWOCXaqQhdIXOD7
Fm/ee+MZ+/nHu58fV03Tr/dFHNf9JDzdbcJVGGRjI7Vfurhu6q7ZlbHvnz+FWZ4vFyFM2mF30/XPhzJ2
X4+pe9h0k6qu+njRrar6YkyzVToWberL+HImK/uHVBRtDE8h3IenlIawWg1hvR5CUQyhLE/vLcpdeo6L
bN8XVdHFumlDTO1NHsL5mI/9Q2r7Lv5J3uzeL5bX27Pj+XjRdJZfXuaL7Vm73nafv+1SPd+nqp7OFuHq
dntWpD5tuqH6e+K8rB+ns+V45n2T2mLyYXjmH9estsfD9DTSuo/DErJNtSu76vswbjg5NU4D3752qsOp
zu8W8/z6dh7mN1lXto9lWx3eNJd5Ng5V9VVTn2afnSYuysf6uI9/8rQv48s3Z93wn+o4XFWl3Vg0x/5N
Vbbta5X9AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAID/+Q2Z/B7cAAAEAA==
7. Perform actual installation. Copy over OpenWrt sysupgrade image to
TFTP root:
$ sudo cp openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin /srv/tftp
Now load both to the device over TFTP:
# tftp -l /tmp/u-boot-env.bin -r u-boot-env.bin -g 10.42.0.1
# tftp -l /tmp/openwrt.bin -r openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin -g 10.42.0.1
Verify checksums of both images to ensure the transfer over TFTP
was completed:
# sha256sum /tmp/u-boot-env.bin /tmp/openwrt.bin
And compare it against source images:
$ sha256sum /srv/tftp/u-boot-env.bin /srv/tftp/openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin
Locate MTD partition of the primary image:
# grep rcks_wlan.main /proc/mtd
Now, write the images in place. Write U-boot environment last, so
unit still can boot from backup image, should power failure occur during
this. Replace MTD placeholders with real MTD nodes:
# flashcp /tmp/openwrt.bin /dev/<rcks_wlan.main_mtd>
# flashcp /tmp/u-boot-env.bin /dev/<u-boot-env_mtd>
Finally, reboot the device. The device should directly boot into
OpenWrt. Look for the characteristic power LED blinking pattern.
# reboot -f
After unit boots, it should be available at the usual 192.168.1.1/24.
Return to factory firmware:
1. Boot into OpenWrt initramfs as for initial installation. To do that
without disassembly, you can write an initramfs image to the device
using 'sysupgrade -F' first.
2. Unset the "bootcmd" variable:
fw_setenv bootcmd ""
3. Write factory images downloaded from manufacturer website into
fwconcat0 and fwconcat1 MTD partitions, or restore backup you took
before installation:
mtd write ruckus_zf7372_fw1_backup.bin /dev/mtd1
mtd write ruckus_zf7372_fw2_backup.bin /dev/mtd5
4. Reboot the system, it should load into factory firmware again.
Quirks and known issues:
- This is first device in ath79 target to support link state reporting
on FE port attached trough the built-in switch.
- Flash layout is changed from the factory, to use both firmware image
partitions for storage using mtd-concat, and uImage format is used to
actually boot the system, which rules out the dual-boot capability.
The 5GHz radio has its own EEPROM on board, not connected to CPU.
- The stock firmware has dual-boot capability, which is not supported in
OpenWrt by choice.
It is controlled by data in the top 64kB of RAM which is unmapped,
to avoid the interference in the boot process and accidental
switch to the inactive image, although boot script presence in
form of "bootcmd" variable should prevent this entirely.
- U-boot disables JTAG when starting. To re-enable it, you need to
execute the following command before booting:
mw.l 1804006c 40
And also you need to disable the reset button in device tree if you
intend to debug Linux, because reset button on GPIO0 shares the TCK
pin.
- On some versions of stock firmware, it is possible to obtain root shell,
however not much is available in terms of debugging facitilies.
1. Login to the rkscli
2. Execute hidden command "Ruckus"
3. Copy and paste ";/bin/sh;" including quotes. This is required only
once, the payload will be stored in writable filesystem.
4. Execute hidden command "!v54!". Press Enter leaving empty reply for
"What's your chow?" prompt.
5. Busybox shell shall open.
Source: https://alephsecurity.com/vulns/aleph-2019014
- Stock firmware has beamforming functionality, known as BeamFlex,
using active multi-segment antennas on both bands - controlled by
RF analog switches, driven by a pair of 74LV164 shift registers.
Shift registers used for each radio are connected to GPIO14 (clock)
and GPIO15 of the respective chip.
They are mapped as generic GPIOs in OpenWrt - in stock firmware,
they were most likely handled directly by radio firmware,
given the real-time nature of their control.
Lack of this support in OpenWrt causes the antennas to behave as
ordinary omnidirectional antennas, and does not affect throughput in
normal conditions, but GPIOs are available to tinker with nonetheless.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Return to using the OpenWrt kernel loader to decompress and load kernel
initram image.
Continue to use the vmlinuz kernel for squashfs.
Mikrotik's bootloader RouterBOOT on some ath79 devices is
failing to boot the current initram, due to the size of the initram image.
On the ath79 wAP-ac:
a 5.7MiB initram image would fail to boot
After this change:
a 6.6MiB initram image successfully loads
This partially reverts commit e91344776b.
An alternative of using RouterBOOT's capability of loading an initrd ELF
section was investigated, but the OpenWrt kernel loader allows larger image.
Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au>
End-users may need to be able to rewrite u-boot configuration on the
WS-AP3825i, which has had repeated issues with the exact configuration
of u-boot, e.g. commit 1d06277407 ("mpc85xx: Fix output location of
padded dtb") (alongside other failures documented for example in this
post[^1] from the main AP3825i porting thread).
To assist with this, remove the `read-only` property from the u-boot
configuration partitions cfg1 and cfg2.
[^1]: https://forum.openwrt.org/t/adding-openwrt-support-for-ws-ap3825i/101168/107
Signed-off-by: Martin Kennedy <hurricos@gmail.com>
Backports patch, which is currently on review [1] for kernel 5.10 and
kernel 5.15, where it applies cleanly. This was tested on CZ.NIC Turris
1.1 router running OpenWrt 21.02.03 with kernel 5.15.
Before:
- In /var/log/messages:
```
[ 16.392988] lm90 0-004c: cannot request IRQ 48
[ 16.398280] lm90: probe of 0-004c failed with error -22
```
- Sensors does not work:
```
root@turris:~# sensors
No sensors found!
Make sure you loaded all the kernel drivers you need.
Try sensors-detect to find out which these are.
```
After:
```
root@turris:/# sensors
sa56004-i2c-0-4c
Adapter: MPC adapter (i2c@3000)
temp1: +44.0°C (low = +0.0°C, high = +70.0°C)
(crit = +85.0°C, hyst = +75.0°C)
temp2: +73.8°C (low = +0.0°C, high = +70.0°C) ALARM (HIGH)
(crit = +85.0°C, hyst = +75.0°C)
```
[1] https://lore.kernel.org/linux-gpio/20220906105431.30911-1-pali@kernel.org/
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
RT-N600 is internally the same as RT-AC1200, as veryfied by @russinnes .
Adding alt_name so that people can find it in firmware selector.
Signed-off-by: Ray Wang <raywang777@foxmail.com>
Tested-by: Russ Innes <russ.innes@gmail.com>
Aka Kroks Rt-Cse5 UW DRSIM (KNdRt31R16), ID 1958:
https://kroks.ru/search/?text=1958
See Kroks OpenWrt fork for support of other models:
https://github.com/kroks-free/openwrt
Device specs:
- CPU: MediaTek MT7628AN
- Flash: 16MB SPI NOR
- RAM: 64MB
- Bootloader: U-Boot
- Ethernet: 5x 10/100 Mbps
- 2.4 GHz: b/g/n SoC
- USB: 1x
- SIM-reader: 2x (driven by a dedicated chip with it's own firmware)
- Buttons: reset
- LEDs: 1x Power, 1x Wi-Fi, 12x others (SIM status, Internet, etc.)
Flashing:
- sysupgrade image via stock firmware WEB interface, IP: 192.168.1.254
- U-Boot launches a WEB server if Reset button is held during power up,
IP: 192.168.1.1
MAC addresses as verified by OEM firmware:
vendor OpenWrt source
LAN eth0 factory 0x4 (label)
2g wlan0 label
Signed-off-by: Andrey Butirsky <butirsky@gmail.com>
Aka "Kroks KNdRt31R19".
Ported from v19.07.8 of OpenWrt fork:
see https://github.com/kroks-free/openwrt
for support of other models.
Device specs:
- CPU: MediaTek MT7628AN
- Flash: 16MB SPI NOR
- RAM: 64MB
- Bootloader: U-Boot
- Ethernet: 1x 10/100 Mbps
- 2.4 GHz: b/g/n SoC
- mPCIe: 1x (usually equipped with an LTE modem by vendor)
- Buttons: reset
- LEDs: 1x Modem, 1x Injector, 1x Wi-Fi, 1x Status
Flashing:
- sysupgrade image via stock firmware WEB interface.
- U-Boot launches a WEB server if Reset button is held during power up.
Server IP: 192.168.1.1
SIM card switching:
The device supports up to 4 SIM cards - 2 locally on board and 2 on
remote SIM-injector.
By default, 1-st local SIM is active.
To switch to e.g. 1-st remote SIM:
echo 0 > /sys/class/gpio/modem1power/value
echo 0 > /sys/class/gpio/modem1sim1/value
echo 1 > /sys/class/gpio/modem1rsim1/value
echo 1 > /sys/class/gpio/modem1power/value
MAC addresses as verified by OEM firmware:
vendor OpenWrt source
LAN eth0 factory 0x4 (label)
2g wlan0 label
Signed-off-by: Kroks <dev@kroks.ru>
[butirsky@gmail.com: port to master; drop dts-v1]
Signed-off-by: Andrey Butirsky <butirsky@gmail.com>
Add Kernel config for testing Linux 5.15 for the mt7620 subtarget.
Tested on Youku YK-L1 which boots fine.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This is an RTL8393-based switch with 802.3af on all 48 ports.
Specifications:
---------------
* SoC: Realtek RTL8393M
* Flash: 32 MiB SPI flash
* RAM: 256 MiB
* Ethernet: 48x 10/100/1000 Mbps with PoE+
* Buttons: 1x "Reset" button, 1x "Speed" button
* UART: 1x serial header, unpopulated
* PoE: 12x TI TPS23861 I2C PoE controller, 384W PoE budget
* SFP: 4 SFP ports
Works:
------
- (48) RJ-45 ethernet ports
- Switch functions
- Buttons
- All LEDs on front panel except port LEDs
- Fan monitoring and basic control
Not yet enabled:
----------------
- PoE - ICs are not in AUTO mode, so the kernel driver is not usable
- Port LEDs
- SFP cages
Install via web interface:
-------------------------
Not supported at this time.
Install via serial console/tftp:
--------------------------------
The U-Boot firmware drops to a TP-Link specific "BOOTUTIL" shell at
38400 baud. There is no known way to exit out of this shell, and no
way to do anything useful.
Ideally, one would trick the bootloader into flashing the sysupgrade
image first. However, if the image exceeds 6MiB in size, it will not
work. To install OpenWRT:
Prepare a tftp server with:
1. server address: 192.168.0.146
2. the image as: "uImage.img"
Power on device, and stop boot by pressing any key.
Once the shell is active:
1. Ground out the CLK (pin 16) of the ROM (U6)
2. Select option "3. Start"
3. Bootloader notes that "The kernel has been damaged!"
4. Release CLK as soon as bootloader thinks image is corrupted.
5. Bootloader enters automatic recovery -- details printed on console
6. Watch as the bootloader flashes and boots OpenWRT.
Blind install via tftp:
-----------------------
This method works when it's not feasible to install a serial header.
Prepare a tftp server with:
1. server address: 192.168.0.146
2. the image as: "uImage.img"
3. Watch network traffic (tcpdump or wireshark works)
4. Power on the device.
5. Wait 1-2 seconds then ground out the CLK (pin 16) of the ROM (U6)
6. When 192.168.0.30 makes tftp requests, release pin 16
7. Wait 2-3 minutes for device to auto-flash and boot OpenWRT
Signed-off-by: Andreas Böhler <dev@aboehler.at>
The Meraki MX100 has ten 1000BASE-T and 2 SFP ethernet ports through
3, 4-port PCIe devices. The default enumeration of these network
devices' names does not correspond to their labeling. Fix this by
explicitly naming the devices, mapping against their sysfs path.
Note that these default network names can only be up to 8 characters,
because we can have up to 8 characters of modifiers (e.g. ^br-,
.4096$), and because the maximum network interface name is 16
characters long.
Signed-off-by: Martin Kennedy <hurricos@gmail.com>
[lowercase subject]
Signed-off-by: Paul Spooren <mail@aparcar.org>
