Enable building a factory image which can be flashed through the OEM
firmware's web interface. It seems that the web interface requires a
minimum file size of 10MiB, otherwise it will not accept the image.
The update image is a regular sysupgrade tarball packed in a Netgear
encrypted image. The Netgear encrypted image is the same as used in
WAX202 or WAX206, including the encryption keys and IV.
This adds a script which creates the rootfs_data volume on first
startup. This is required since the OEM firmware's sysupgrade scripts
do not create such a paritition. Note that any script ordered after
70_initramfs_test will not get executed on initramfs. Hence this new
script 75_rootfs_prepare won't create the rootfs_data volume when
using the recovery initramfs.
Also, this deletes the kernel_backup and rootfs_backup volumes in case
we have to create the rootfs_data volumes. This makes sure that
OpenWrt is the actual backup firmware instead of the stock firmware.
References in WAX220 GPL source:
https://www.downloads.netgear.com/files/GPL/WAX220-V1.0.2.8-gpl-src.tar.gz
* package/base-files/files/lib/upgrade/nand.sh:186
Creation of rootfs_data is disabled
* Uboot-upstream/board/mediatek/common/ubi_helper.c
Automatic creation of UBI backup volumes
Signed-off-by: Stefan Agner <stefan@agner.ch>
(cherry picked from commit fa9d977f97)
Enable the ethernet LED's on the ZyXEL NWA50AX Pro to show link-state as
well as activity.
Both LED's are configured pulsing.
AMBER | 10/100
GREEN | 1000
A+G | 2500
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 4c0fdad7ea)
The ZTE MF287 Pro is a LTE router used (exclusively?) by the network
operator "3". It is very similar to the MF287+, but the hardware layout
and partition layout have changed quite a bit.
Specifications
==============
SoC: IPQ4018
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 4x GBit LAN
LTE: ZTE Cat12
WiFi: 802.11a/b/g/n/ac SoC-integrated
USB: 1x 2.0
MAC addresses
=============
LAN: from config + 2
WiFi 1: from config
WiFi 2: from config + 1
Installation
============
Option 1 - TFTP
---------------
TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:
setenv serverip 192.168.1.100
setenv ipaddr 192.168.1.1
tftpboot 0x82000000 openwrt.bin
bootm 0x82000000
From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:
ubiattach -m17
cat /dev/ubi0_0 > /tmp/ubi0_0
cat /dev/ubi0_1 > /tmp/ubi0_1
Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.
Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:
ubirmvol /dev/ubi0 -N ubi_rootfs
ubirmvol /dev/ubi0 -N kernel
Option 2 - From stock firmware
------------------------------
The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.
The exploit will be available at the device wiki page.
Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".
ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd13 is the partition labelled "rootfs" by calling
"cat /proc/mtd".
Complete commands:
cd /tmp
tftp -g -r factory.bin 192.168.0.22
cat /proc/driver/sensor_id
flash_erase /dev/mtd17 0 0
dd if=/tmp/factory.bin of=/dev/mtdblock17 bs=131072
Afterwards, reboot your device and you should have a working OpenWrt
installation.
Restore Stock
=============
Option 1 - via UART
-------------------
Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.
Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.
ubiattach -m 17
ubirmvol /dev/ubi0 -N kernel
ubirmvol /dev/ubi0 -N rootfs
ubirmvol /dev/ubi0 -N rootfs_data
ubimkvol /dev/ubi0 -N kernel -s $kernel_length
ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1
Option 2 - from within OpenWrt
------------------------------
This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.
Follow the commands from Option 1 to flash back to stock.
LTE Modem
=========
The LTE modem is similar to other ZTE devices and controls some more LEDs
and battery management.
Configuring the connection using uqmi works properly, the modem
provides three serial ports and a QMI CDC ethernet interface.
Other Notes
===========
Contrary to the stock firmware, the USB port on the back can be used.
There is one GPIO Switch "Power button blocker" which, if enabled, does not
trigger a reset of the SoC if the modem reboots. If disabled, the SoC is
rebooted along with the modem. The modem can be rebooted via the exported
GPIO "modem-reset" in /sys/class/gpio.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
(cherry picked from commit edfe91372a)
This brings the 23.05 branch into parity with the main.
kmod-sfp was in the main branch profile but not the 23.05 version.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
The kernel FSL_ENETC_QOS option is only a compile time
option, it does not result in a separate module being built.
Set it to 'y' to resolve a warning from the kernel compile:
.config:2654:warning: symbol value 'm' invalid for FSL_ENETC_QOS
Signed-off-by: Mathew McBride <matt@traverse.com.au>
Fixes: c3151b6f04 ("armvirt: 64: add support for other SystemReady-compatible vendors")
(cherry picked from commit 7770d08e2b)
This MDIO driver was already being built, but not installed due
to being selected by the ThunderX Ethernet driver.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(cherry picked from commit 0018b33531)
The initial armv8 module incorrectly labelled the Thunder(v1) as
supporting the ThunderX2, when they have different drivers.
Add kmod-octeon-tx2 to support the newer devices.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(cherry picked from commit 7c5bdff9c4)
kmod-bcmgenet is needed for Ethernet support on the
Raspberry Pi 4.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(cherry picked from commit 911ee97774)
These are used by common Broadcom SoC's like
the BCM2711 (RPi4) and iProc network processor.
Tested on the RPi4B using the Raspberry Pi
UEFI+ACPI firmware[1].
Signed-off-by: Mathew McBride <matt@traverse.com.au>
[1] - https://github.com/pftf/RPi4
(cherry picked from commit 27ca83c627)
When comparing the generated OpenWrt .config to the Linux arm64
defconfig, I noticed these SATA controllers were not included.
As they may be used as a boot drive, they should be built into
the kernel.
CONFIG_SATA_MVEBU is for Marvell platforms.
CONFIG_SATA_QORIQ is for NXP Layerscape.
CONFIG_SATA_SIL24 is for Arm's Juno development board, see Linux
kernel commit d7c38ff1cd86 ("arm64: defconfig: Add Juno SATA
controller").
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.05/5.15 version of commit 9cb173e9f1)
This turns on various PCI related options which are enabled
in the Linux kernel arch/arm64/configs/defconfig but not
yet in the OpenWrt config.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.05/5.15 version of commit 15d3536c9d)
This is part of an effort to reduce differences between
the OpenWrt armsr/armv8 config and Linux arm64 defconfig.
This enables CONFIG_ARCH_BCM and downstream
CONFIG_ARCH_BCM2835 (= BCM2711 like Raspberry Pi 4)
and CONFIG_ARCH_BCM_IPROC (Broadcom iProc packet processors).
The broadband specific SoC's (ARCH_BCMBCA) are left out
as it is assumed these will not be doing EFI boot.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.5/5.15 version of commit df23eed179)
Renesas markets several embedded Arm64 SoCs in the
RZ series (RZ/G, RZ/V), so should be enabled in
a general purpose target.
Automotive (R-Car) SoC's are not enabled by this change.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.05/5.15 version of commit 1ff4f4df23)
A review of the generated OpenWrt kernel .config
vs the Linux arm64 defconfig showed that this
option was not being enabled, as it is disabled
in OpenWrt's generic config.
ACPI_BUTTON is needed to report and respond to
power button events, so it should be enabled.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.05/5.15 version of commit c4c60e4b19)
To bring the armsr/armv8 kernel configuration closer to the Linux
arm64 defconfig, synchronize options related to CPU features
(especially more recent Armv8.X variants), scheduler, EFI vars,
CMA and scheduler options.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.05/5.15 version commit 22e0c7be47)
x86/64 enables support for KVM so I can't see a reason why
not on armsr/armv8 as well.
Arm CPU errata workaround items related to virtualization
are also enabled by this change.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.05/5.15 version of commit e505873e65)
To reduce differences with the Linux arm64 defconfig,
sync the enabled erratum items with defconfig.
There are still some options not selected due to
CONFIG_KVM or other options not enabled in OpenWrt
by default.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.05/5.15 version of commit 5c4239ac3f)
Support for PF_XDP sockets monitoring interface used by the ss tool.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 06e64f9b36)
This compiles the CONFIG_PTP_1588_CLOCK support into the kernel binary
and activates the drivers for KVM and VMware which allow syncing the
host time with the VM when OpenWrt is running in a VM. With this change
the CONFIG_HYPERV_UTILS driver is now build into the kernel, because it
depends on the PTP framework being compiled in. CONFIG_HYPERV_UTILS was
build as a module, but not packages before.
Fixes: #13277
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 54d470ed0e)
This activates PCI Express ASPM control in Linux. Without this option it
is completely controlled by the BIOS, now Linux will take over and apply
some workarounds if needed.
Fixes: #13248
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit ff71035751)
Sets status indications led color on Xiaomi mi-mini router as other Xiaomi routers
Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
(cherry picked from commit 54e5e396c5)
It seems that the Meraki bootloader does not respect the kernel ARM booting
specification[1] that requires that address where DTB is located needs to
be 64-bit aligned and often places the DTB on a non 64-bit aligned address
and then kernel fails to find the DTB magic and fails to boot.
Even worse, there is no prints until early printk is enabled and then its
visible that kernel is trying to find the ATAG-s as DTB was not found or
is invalid.
Unifi 6 devices had the same issue and it can be solved by passing the
load adress as part of the FIT image.
It seems that the vendor was aware of the issue and is always relocating
the DTB to 0x89000000, so lets just do the same.
Now that booting is reliable, reenable default images for the Meraki MR33
and MR74 devices.
Reviewed-by: Lech Perczak lech.perczak@gmail.com
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit f1c80445bd)
ipq40xx was converted to DSA and swconfig is not being included at all in
the default packages so there is no need to drop it from device packages.
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit bb4a25860f)
MR33 and MR74 share pretty much everything in the image recipe, so lets
extract a common recipe to avoid duplication.
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 9e9dc1890c)
Rename two patches which were only accepted in Linux 6.2, but were
marked as if they were accepted in Linux 6.1.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 42e14d3ed8)
the Marvell 10G PHY driver is no way specific to ARM SystemReady
systems, it frequently occurs on SFP+ copper modules and is useful on
many targets.
Hence it been added to package/kernel/linux/modules/netdevices and we
can remove the now redundant target-specific module.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit c524a76f4c)
A dependency of the MT7988 MMC host controller on the SoC's RTC clock
being running has been discovered. Mark RTC clock as critical to fix
MMC host on MT7988.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 0454691960)
This has been a part of modified upstream patch but got lost on major
kernel bump to 5.15, so bring it back.
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
[Add patch for kernel 6.1 too]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 5e6bab661a)
return ubnt_rocket-m and ubnt_powerbridge-m back to ath79-generic
They have enough RAM-ressources to not be considered as tiny.
This reverts the commit f4415f7635 partially
Signed-off-by: Felix Baumann <felix.bau@gmx.de>
(cherry picked from commit 9e86a96af5)
1. Add new symbols to generic config
2. Bump kernel
Changelog: https://lore.kernel.org/stable/2023080818-groin-gradient-a031@gregkh/
All patches automatically rebased.
Signed-off-by: John Audia <therealgraysky@proton.me>
[Refreshed on top of OpenWrt 23.05]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit daed3322d3)
Hardware information:
---------------------
- RTL8380 SoC
- 8 Gigabit RJ45 PoE ports (built-in RTL8218B)
- 2 SFP ports (built-in SerDes)
- RJ45 RS232 port on front panel
- 32 MiB NOR Flash
- 128 MiB DDR3 DRAM
- PT7A7514 watchdog
- PoE chips: Nuvoton M0516LDE + BCM59121
Known issues:
---------------------
- PoE LEDs are uncontrolled.
(Manual taken from f2f09bc002)
Booting initramfs image:
------------------------
- Prepare a FTP or TFTP server serving the OpenWrt initramfs image and
connect the server to a switch port.
- Connect to the console port of the device and enter the extended
boot menu by typing Ctrl+B when prompted.
- Choose the menu option "<3> Enter Ethernet SubMenu".
- Set network parameters via the option "<5> Modify Ethernet Parameter".
Enter the FTP/TFTP filename as "Load File Name" ("Target File Name"
can be left blank, it is not required for booting from RAM). Note that
the configuration is saved on flash, so it only needs to be done once.
- Select "<1> Download Application Program To SDRAM And Run".
Initial installation:
---------------------
- Boot an initramfs image as described above, then use sysupgrade to
install OpenWrt permanently. After initial installation, the
bootloader needs to be configured to load the correct image file
- Enter the extended boot menu again and choose "<4> File Control",
then select "<2> Set Application File type".
- Enter the number of the file "openwrt-kernel.bin" (should be 1), and
use the option "<1> +Main" to select it as boot image.
- Choose "<0> Exit To Main Menu" and then "<1> Boot System".
NOTE: The bootloader on these devices can only boot from the VFS
filesystem which normally spans most of the flash. With OpenWrt, only
the first part of the firmware partition contains a valid filesystem,
the rest is used for rootfs. As the bootloader does not know about this,
you must not do any file operations in the bootloader, as this may
corrupt the OpenWrt installation (selecting the boot image is an
exception, as it only stores a flag in the bootloader data, but doesn't
write to the filesystem).
Example PoE config file (/etc/config/poe):
---------------------
config global
option budget '180'
config port
option enable '1'
option id '1'
option name 'lan8'
option poe_plus '1'
option priority '2'
config port
option enable '1'
option id '2'
option name 'lan7'
option poe_plus '1'
option priority '2'
config port
option enable '1'
option id '3'
option name 'lan6'
option poe_plus '1'
option priority '2'
config port
option enable '1'
option id '4'
option name 'lan5'
option poe_plus '1'
option priority '2'
config port
option enable '1'
option id '5'
option name 'lan4'
option poe_plus '1'
option priority '2'
config port
option enable '1'
option id '6'
option name 'lan3'
option poe_plus '1'
option priority '2'
config port
option enable '1'
option id '7'
option name 'lan2'
option poe_plus '1'
option priority '2'
config port
option enable '1'
option id '8'
option name 'lan1'
option poe_plus '1'
option priority '2'
Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
(cherry picked from commit b370753fc4)
When building with Linux 5.15 the 'const' type results in warnings.
Restore the original non-const type in those cases.
Fixes: 36d0aa9c2d ("mediatek: filogic: sync pinctrl-mt7988 with MediaTek SDK")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 1eb67cb070)
Update pinctrl driver for the MT7988 with driver from mtk-openwrt-feeds.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 36d0aa9c2d)
Enable driver for MediaTek SuperSpeedPlus XS-PHY transceiver for the
USB3.1 GEN2 controllers found in the MT7988 SoC.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit dc4aafb309)
Changes introduced in commit 54dc1cde48 ("mediatek: filogic: add
support for Xiaomi WR30U") missed to end the case item with mandatory
`;;` which lead to a broken sysupgrade.
Fixes: 54dc1cde48 ("mediatek: filogic: add support for Xiaomi WR30U")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Because this device enable NMBM by default, most users use custom
U-Boot with NMBM-Enabled in Chinese forums.
This layout is the same as the ubootmod layout but enabling NMBM.
Signed-off-by: Hank Moretti <mchank9999@gmail.com>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: ESMT F50L1G41LB 128MB
RAM: NT52B128M16JR-FL 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, Mesh
Power: DC 12V 1A
Flash instructions:
1. Get ssh access
Check this link: https://forum.openwrt.org/t/openwrt-support-for-xiaomi-ax3000ne/153769/22
2. Backup import partitions
```
dev: size erasesize name
mtd1: 00100000 00020000 "BL2"
mtd2: 00040000 00020000 "Nvram"
mtd3: 00040000 00020000 "Bdata"
mtd4: 00200000 00020000 "Factory"
mtd5: 00200000 00020000 "FIP"
mtd8: 02200000 00020000 "ubi"
mtd9: 02200000 00020000 "ubi1"
mtd12: 00040000 00020000 "KF"
```
Use these commands blow to backup your stock partitions.
```
nanddump -f /tmp/BL2.bin /dev/mtd1
nanddump -f /tmp/Nvram.bin /dev/mtd2
nanddump -f /tmp/Bdata.bin /dev/mtd3
nanddump -f /tmp/Factory.bin /dev/mtd4
nanddump -f /tmp/FIP.bin /dev/mtd5
nanddump -f /tmp/ubi.bin /dev/mtd8
nanddump -f /tmp/KF.bin /dev/mtd12
```
Then, transfer them to your computer via scp, netcat, tftp
or others and keep them in a safe place.
3. Setup Nvram
Get the current stock: `cat /proc/cmdline`
If you find `firmware=0` or `mtd=ubi`, use these commands:
```
nvram set boot_wait=on
nvram set uart_en=1
nvram set flag_boot_rootfs=1
nvram set flag_last_success=1
nvram set flag_boot_success=1
nvram set flag_try_sys1_failed=0
nvram set flag_try_sys2_failed=0
nvram commit
```
If you find `firmware=1` or `mtd=ubi1`, use these commands:
```
nvram set boot_wait=on
nvram set uart_en=1
nvram set flag_boot_rootfs=0
nvram set flag_last_success=0
nvram set flag_boot_success=1
nvram set flag_try_sys1_failed=0
nvram set flag_try_sys2_failed=0
nvram commit
```
4. Flash stock-initramfs-factory.ubi
If you find `firmware=0` or `mtd=ubi`:
`ubiformat /dev/mtd9 -y -f /tmp/stock-initramfs-factory.ubi`
If you find `firmware=1` or `mtd=ubi1`:
`ubiformat /dev/mtd8 -y -f /tmp/stock-initramfs-factory.ubi`
Then reboot your router, it should boot to the openwrt
initramfs system now.
5. Setup uboot-env
Now it will be setup automatically in upgrade process,
you can skip this step.
If your `fw_setenv` did not work, you need run this command:
`echo "/dev/mtd1 0x0 0x10000 0x20000" > /etc/fw_env.config`
Then setup uboot-env:
```
fw_setenv boot_wait on
fw_setenv uart_en 1
fw_setenv flag_boot_rootfs 0
fw_setenv flag_last_success 1
fw_setenv flag_boot_success 1
fw_setenv flag_try_sys1_failed 8
fw_setenv flag_try_sys2_failed 8
fw_setenv mtdparts "nmbm0:1024k(bl2),256k(Nvram),256k(Bdata),
2048k(factory),2048k(fip),256k(crash),256k(crash_log),
34816k(ubi),34816k(ubi1),32768k(overlay),12288k(data),256k(KF)"
```
6. Flash stock-squashfs-sysupgrade.bin
Use shell command:
`sysupgrade -n /tmp/stock-squashfs-sysupgrade.bin`
Or go to luci web.
If you need to change to Openwrt U-Boot layout, do next. If you
do not need, please ignore it.
Change to OpenWrt U-Boot:
1. Flash ubootmod-initramfs-factory.ubi
Check mtd partitions: `cat /proc/mtd`
```
mtd7: 00040000 00020000 "KF"
mtd8: 02200000 00020000 "ubi_kernel"
mtd9: 04e00000 00020000 "ubi"
```
Run following command:
`ubiformat /dev/mtd8 -y -f /tmp/ubootmod-initramfs-factory.ubi`
Then reboot your router, it should boot to the openwrt initramfs
system now.
2. Check mtd again
```
mtd7: 00040000 00020000 "KF"
mtd8: 07000000 00020000 "ubi"
```
Make sure mtd8 is ubi.
3. Install kmod-mtd-rw
Run command: `opkg update && opkg install kmod-mtd-rw`
Or get it in openwrt server, or build it yourself, then install
it manually
Then run this command:
`insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1`
4. Clean up pstore
Run Command: `rm -f /sys/fs/pstore/*`
5. Format ubi and create new ubootenv volume
```
ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
```
6. (Optional) Add recovery boot feature.
```
ubimkvol /dev/ubi0 -n 2 -N recovery -s 10MiB
ubiupdatevol /dev/ubi0_2 /tmp/ubootmod-initramfs-recovery.itb
```
7. Flash Openwrt U-Boot
```
mtd write /tmp/ubootmod-preloader.bin BL2
mtd write /tmp/ubootmod-bl31-uboot.fip FIP
```
6. Flash ubootmod-squashfs-sysupgrade.itb
Use shell command:
`sysupgrade -n /tmp/ubootmod-squashfs-sysupgrade.itb`
Or go to luci web.
Now everything is done, Enjoy!
Go Back to stock from Openwrt U-Boot:
1. Force flash ubootmod-initramfs-recovery.itb
Use shell command:
`sysupgrade -F -n /tmp/ubootmod-initramfs-recovery.itb`
Or go to luci web.
Then it should boot to the openwrt initramfs system now.
2. Format ubi and Nvram
```
ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8
mtd erase Nvram
```
3. Install kmod-mtd-rw
Run command: `opkg update && opkg install kmod-mtd-rw`
Or get it in openwrt server, or build it yourself, then install
it manually
Then run this command:
`insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1`
4. Flash stock U-Boot and ubi
```
mtd write /tmp/BL2.bin BL2
mtd write /tmp/FIP.bin FIP
mtd write /tmp/ubi.bin ubi
```
Then reboot your router, waiting it finished rollback in minutes.
Go Back to stock from stock layout Openwrt:
Just run command: `ubiformat /dev/mtd8 -y -f /tmp/ubi.bin`
Then reboot your router, waiting it finished rollback in minutes.
Notes:
1. Openwrt U-Boot and ubootmod openwrt did not enable NMBM.
Please make your backup safe.
Signed-off-by: Hank Moretti <mchank9999@gmail.com>
Hardware
--------
SOC: MediaTek MT7986A
RAM: 1GB DDR4
FLASH: 4GB eMMC
WiFi: 2x2 2.4 GHz 802.11 b/g/n/ax MT7916 DBDC
4x4 5 GHz 802.11 a/n/ac/ax MT7986
2x2 6 GHz 802.11ax MT7916 DBDC
ETH: 4x LAN 1Gbit/s (MT7531)
1x WAN 2.5Gbit/s (GPY211)
BTN: RESET, WPS
LED: Antenna LEDs (GPIO)
Mood-LED (Kinetic KTD2601) - unsupported
UART: Header nest to USB port - 3V3 115200 8N1
[BUTTON] GND - RX - TX [USB]
Installation
------------
1. Connect to the device using serial console.
2. Interrupt the Autoboot process when promted by sending '0' twice.
3. Serve the OpenWrt initramfs image using TFTP at 192.168.1.66. Name
the image "predator.bin" and conenct the TFTP server to the routers
LAN port.
4. Configure U-Boot to allow loading unsigned images from MMC
$ setenv bootcmd 'mmc read 0x40000000 0x00004400 0x0010000;
fdt addr $(fdtcontroladdr); fdt rm /signature; bootm 0x40000000';
saveenv
5. Transfer the image from U-Boot
$ setenv serverip 192.168.1.66; setenv ipaddr 192.168.1.1;
tftpboot 0x46000000 predator.bin; fdt addr $(fdtcontroladdr);
fdt rm /signature; bootm
6. Wait for OpenWrt to boot
7. Transfer the OpenWrt sysupgrade image to the router using scp.
8. Install OpenWrt using sysupgrade.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 7e7eb5312d)
It seems that DSA-based b53 driver never worked with BCM53573 SoCs and
BCM53125.
In case of swconfig-based b53 this fixes a regression. Switching bgmac
from using mdiobus_register() to of_mdiobus_register() resulted in MDIO
device (BCM53125) having of_node set (see of_mdiobus_register_phy()).
That made downstream b53 driver read invalid data from DT and broke
Ethernet support.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 79fd3e62b4)
new versions of the device have NAND with 8bit ECC
which was not yet supported before. This change removes
ECC restrictions.
Signed-off-by: Alexander Friese <af944580@googlemail.com>
(cherry picked from commit 6b11f0ec83)
Hardware
--------
CPU: Qualcomm IPQ4018
RAM: 256M
Flash: 16MB SPI-NOR (W25Q128)
128MB SPI-NAND (XTX)
WiFi: 2T2R (2GHz 802.11n ; 5 GHz 802.11ac)
ETH: 4x LAN ; 1x WAN (Gigabit)
CELL: Quectel RG501Q 3G/4G/5G
UART: Available on the goldfinger connector (Pinout silkscreened)
115200 8N1 3V3 - Only connect RX / TX / GND
Installation
------------
1. Enable SSH in the Teltonika UI
(System --> Administration --> Access Control)
2. Check from which partition set the device is currently running from.
$ cat /proc/boot_info/rootfs/primaryboot
In case this output reads 0, install a Software update from Teltonika
first. After upgrade completion, check this file now reads 1 before
continuing.
2. Transfer the OpenWrt factory image to the device using scp. Use the
same password (user root!) as used for the Web-UI.
$ scp -O openwrt-factory.bin root@192.168.1.1:/tmp
3. Connect to the device using ssh as the root user.
4. Install OpenWrt by writing the factory image to flash.
$ ubiformat /dev/mtd16 -y -f /tmp/openwrt-factory.bin
5. Instruct the bootloaer to boot from the first partition set.
$ echo 0 > /proc/boot_info/rootfs/primaryboot
$ cat /proc/boot_info/getbinary_bootconfig > /tmp/bootconfig.bin
$ cat /proc/boot_info/getbinary_bootconfig1 > /tmp/bootconfig1.bin
$ mtd write /tmp/bootconfig.bin /dev/mtd2
$ mtd write /tmp/bootconfig1.bin /dev/mtd3
6. Reboot the device.
$ reboot
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 844bb4bfad)
These are used by both the armsr (EFI boot) and
layerscape targets for phylink-controlled SFP
support on NXP DPAA2 platforms (LS1088,LS2088,LX2160).
This is in place of commit a7bd96c98f
("layerscape: add patches for SFP support on DPAA2 platforms")
in the main branch. armsr in main started at kernel 6.1
so there is not an equivalent 5.15 commit to cherry pick.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
All the tools (e.g fw_setenv, ubiupdatevol) and config (fw_env.config)
needed for sysupgrade are already included in /lib/upgrade/stage2
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(cherry picked from commit 094c37708a)
The Traverse LS1043 boards were not publicly released,
all the production has been going to OEM customers who
do not use the image format defined in the OpenWrt tree.
Only a few samples were circulated outside Traverse
and our OEM customers. The public release (then called
Five64) of this series was cancelled in favour of our
LS1088A based design (Ten64).
It is best to remove these boards to avoid wasting
OpenWrt project and contributor resources.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(cherry picked from commit 8e7ba6fbae)
The Ten64 board[1] is based around NXP's Layerscape LS1088A SoC.
It is capable of booting both standard Linux distributions
from disk devices, using EFI, and booting OpenWrt
from NAND.
See the online manual for more information, including the
flash layout[2].
This patchset adds support for generating Ten64 images
for NAND boot.
For disk boot, one can use the EFI support that was
recently added to the armvirt target.
We previously supported NAND users by building
inside our armvirt/EFI target[3], but this approach
is not suitable for OpenWrt upstream. Users who
used our supplied NAND images will be able to upgrade
to this via sysupgrade.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
[1] - https://www.traverse.com.au/hardware/ten64
[2] - https://ten64doc.traverse.com.au/hardware/flash/
[3] - Example:
285e4360e1
(cherry picked from commit af0546da34)
The mdio bus is used to control externel switch. In most cases, they are
disabled, which is the normal behavior. Treating this as an error makes
no sense, so we need to change the notification level from error to info.
Fixes: a2acdf9607 ("ramips: mt7620: remove useless GMAC nodes")
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
(cherry picked from commit 285f0668f4)
This commit adds headers to the patches, so they can be applied with the
git am command.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
(cherry picked from commit 5d51079fd0)
The maximum offset that can be supported is 0x20000000
Do not override it to to something bigger than that on MT7621, as that could
cause issues based on the fixed memory mappings. This makes the last 64 MB
RAM unusable on MT7621 devices with 512 MB but avoids incurring a heavy
performance hit
Fixes: cd2b74e01e ("ramips: mt7621: disable highmem support and remove highmem offset patch")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit a110de8152)
Hardware
--------
CPU: Mediatek MT7981
RAM: 512M DDR4
FLASH: 256M NAND
ETH: MaxLinear GPY211 (2.5GbE N Base-T)
WiFi: Mediatek MT7981 (2.4GHz 2T2R:2 5GHz 3T3R:2 802.11ax)
BTN: 1x Reset
LED: 1x Multi-Color
UART Console
------------
Available below the rubber cover next to the ethernet port.
Settings: 115200 8N1
Layout:
<12V> <LAN> GND-RX-TX-VCC
Logic-Level is 3V3. Don't connect VCC to your UART adapter!
Installation Web-UI
-------------------
Upload the Factory image using the devices Web-Interface.
As the device uses a dual-image partition layout, OpenWrt can only
installed on Slot A. This requires the current active image prior
flashing the device to be on Slot B.
In case this is not the case, OpenWrt will boot only one time, returning
to the ZyXEL firmware the second boot.
If this happens, first install a ZyXEL firmware upgrade of any version
and install OpenWrt after that.
Installation TFTP / Recovery
----------------------------
This installation routine is especially useful in case of a bricked
device.
Attach to the UART console header of the device. Interrupt the boot
procedure by pressing Enter.
The bootloader has a reduced command-set available from CLI, but more
commands can be executed by abusing the atns command.
Boot a OpenWrt initramfs image available on a TFTP server at
192.168.1.66. Rename the image to nwa50axpro-openwrt-initramfs.bin.
$ atnf nwa50axpro-openwrt-initramfs.bin
$ atna 192.168.1.88
$ atns "192.168.1.66; tftpboot; setenv fdt_high 0xffffffffffffffff;
bootm"
Upon booting, set the booted image to the correct slot:
$ zyxel-bootconfig /dev/mtd9 get-status
$ zyxel-bootconfig /dev/mtd9 set-image-status 0 valid
$ zyxel-bootconfig /dev/mtd9 set-active-image 0
Copy the OpenWrt sysupgrade image to the device using scp.
Write the sysupgrade image to NAND using sysupgrade.
$ sysupgrade -n image.bin
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit f0445746f6)
U-Boot complains that the overlayed DT needs relocation, so set
DEVICE_DTS_LOADADDR to have it relocated.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit b1d10e0174)
removed redundant eeprom partition nodes from
cn7130_ubnt_edgerouter-4.dts and cn7130_ubnt_edgerouter-6p.dts
as they are identically defined in cn7130_ubnt_edgerouter-e300.dtsi.
Signed-off-by: Carsten Spieß <mail@carsten-spiess.de>
(integrated eeprom referenced node in the .dtsi)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit 700f11aaad)
The MAC addresses should be read from 3rd MTD partition,
but only two MTD partitions are populated.
To fix it, a partitions node has to surround the partition
nodes in device tree.
Tested with Edgerouter 6P
Signed-off-by: Carsten Spieß <mail@carsten-spiess.de>
(fixed checkpatch complains)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit 2b1d7965c7)
LEDs on Edgerouter 6P didn't work correctly:
blue /white LED swapped, on/off state inverted
Fixed in device tree:
swap the GPIO ports for power:blue and power:white LEDs
change LED activity from LOW to HIGH
Tested on Edgerouter 6P
Signed-off-by: Carsten Spieß <mail@carsten-spiess.de>
(cherry picked from commit 9009672930)
there's a new symbol NVMEM_IMX_OCOTP_ELE that needs to be defined.
otherwise the build will fail:
| i.MX On-Chip OTP Controller support (NVMEM_IMX_OCOTP_ELE) [N/m/y/?] (NEW)
| make[6]: *** [scripts/kconfig/Makefile:77: syncconfig] Error 1
| make[5]: *** [Makefile:628: syncconfig] Error 2
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
The PHY driver now uses regmap created from pio syscon, we no longer
need the boottrap device.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit f321a49fd5)
Backport in-SoC Gigabit Ethernet PHY driver instead of carrying the
driver in files-5.15.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 9fac590096)
The PHY driver needs to read a register containing the values of the
bootstrap pins (which happen to be the PHY LEDs) to determine the LED
polarities. Allow regmap access to first pinctrl bank by adding the
'syscon' compatible, and reference the pinctrl in the MDIO bus where
the PHY driver will look for it.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 1f1e0b1144)
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: W25N01GVZEIG 128MB
RAM: NT5CB128M16JR-FL 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, WPS
Power: DC 12V 1A
Flash instructions:
1. PC run command: "telnet 192.168.124.1 99"
Username: H3C, password is the web login
password of the router.
2. Download preloader.bin and bl31-uboot.fip
3. PC run command: "python3 -m http.server 80"
4. Download files in the telnet window:
"wget http://192.168.124.xx/xxx.bin"
Replace xx with your PC's IP and
the preloader.bin and bl31-uboot.fip.
5. Flushing openwrt's uboot:
"mtd write xxx-preloader.bin BL2"
"mtd write xxx-bl31-uboot.fip FIP"
6. Connect to the router via the Lan port,
set a static ip of your PC.
(ip 192.168.1.254, gateway 192.168.1.1)
7. Download initramfs image, reboot router,
waiting for tftp recovery to complete.
8. After openwrt boots up, perform sysupgrade.
Note:
1. The u-boot-env partition on mtd is empty,
OEM stores their env on ubi:u-boot-env.
2. Back up all mtd partitions before flashing.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
(cherry picked from commit e78d1a06c8)
Netgear EX6250v2, EX6400v3, EX6410v2, EX6470 are wall-plug 802.11ac
(Wi-Fi 5) extenders. Like other MT7629 devices, Wi-Fi does not work
currently as there is no driver.
Related: https://github.com/openwrt/openwrt/pull/5084
For future reference, 2.4GHz MAC = LAN+1, 5GHz MAC = LAN+2.
Specifications:
* MT7629, 256 MiB RAM, 16 MiB SPI NOR
* MT7761N (2.4GHz) / MT7762N (5GHz) - no driver
* Ethernet: 1 port 10/100/1000
* UART: 115200 baud (labeled on board)
Installation:
* Flash the factory image through the stock web interface, or TFTP to
the bootloader. NMRP can be used to TFTP without opening the case.
* After installation, perform a factory reset. Wait for the device to
boot, then hold the reset button for 10 seconds. This is needed
because sysupgrade in the stock firmware will attempt to preserve its
configuration using sysupgrade.tgz.
See https://github.com/openwrt/openwrt/pull/4182
Revert to stock firmware:
* Flash the stock firmware to the bootloader using TFTP/NMRP.
Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
(cherry picked from commit 73de41898f)
These fields are used for EAX12 and EX6250v2 series, and perhaps other
devices. Compatibility is preserved with the WAX202 and WAX206.
In addition, adds the related vars to DEVICE_VARS so that the variables
work correctly with multiple devices.
References in GPL source:
https://www.downloads.netgear.com/files/GPL/EAX12_EAX11v2_EAX15v2_GPL_V1.0.3.34_src.tar.gz
* tools/imgencoder/src/gj_enc.c
Contains code that generates the encrypted image.
Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
(cherry picked from commit 0a1ebccc87)
Mikrotik RB951 router has a buzzer on the board, which makes annoying noises
due to the interference caused by PoE input or Wifi transmission
when no GPIO pin state is set.
I added buzzer node to device's DTS in order to set deault level to 1
and to provide easier access for it.
Signed-off-by: Pavel Pernička <pernicka.pa@gmail.com>
(cherry picked from commit dac0a133cf)
MikroTik RB951G-2HnD is a wireless SOHO router that was previously
supported by the ar71xx target, see commit 7a709573d7 ("ar71xx: add
kernel support for the Mikrotik RB951G board").
Specifications
--------------
- SoC: Atheros AR9344 (600 MHz)
- RAM: 128 MB (2x 64 MB)
- Storage: 128 MB NAND flash (various manufacturers)
- Ethernet: Atheros AR8327 switch, 5x 10/100/1000 Mbit/s
- 1x PoE in (port 1, 8-30 V input)
- Wireless: Atheros AR9340 (802.11b/g/n)
- USB: 2.0 (1A)
- 8x LED:
- 1x power (green, not configurable)
- 1x user (green, not configurable)
- 5x GE ports (green, not configurable)
- 1x wireless (green, not configurable)
- 1x button (restart)
Unlike on the RB951Ui-2HnD, none of the LEDs on this device seem to be
GPIO-controllable, which was also the case for older OpenWRT versions
that supported this board via a mach file. The Ethernet port LEDs are
controlled by the switch chip.
See https://mikrotik.com/product/RB951G-2HnD for more details.
Flashing
--------
TFTP boot initramfs image and then perform sysupgrade. Follow
common MikroTik procedures at https://openwrt.org/toh/mikrotik/common.
Signed-off-by: Michał Kępień <openwrt@kempniu.pl>
(cherry picked from commit db02cecd6a)
Mikrotik RouterBOARD 951Ui-2HnD and Mikrotik RouterBOARD RB951G-2HnD are
very similar devices. Extract the DTS bits that are identical for these
two boards to a separate DTSI file.
Signed-off-by: Michał Kępień <openwrt@kempniu.pl>
(cherry picked from commit c6ef417094)
Fixes: 4970dd027b ("bcm47xx: revert bgmac back to the old limited max frame size")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 83aeb0bbd4)
This includes some driver changes and support for fixed cells layout.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 07bdc55515)
Calling rtl822x_probe() on phy devices which uses the rtl822x_read_mmd()
and rtl822x_write_mmd() functions makes no sense and the probe ends with
an EOPNOTSUPP error.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
(cherry picked from commit 5af7d47cd7)
Migrate to "new" image generation method. Device profiles will be generated
based on image/Makefile instead of profiles/ , which will also allow to
automatically build images for all supported devices via buildbot.
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
The upstream board-2.bin file in the linux-firmware.git
repository for the QCA4019 contains a packed board-2.bin
for this device for both 2.4G and 5G wifis. This isn't
something that the ath10k driver supports.
Until this feature either gets implemented - which is
very unlikely -, or the upstream boardfile is mended
(both, the original submitter and ath10k-firmware
custodian have been notified). OpenWrt will go back
and use its own bespoke boardfile. This unfortunately
means that 2.4G and on some revisions the 5G WiFi is
not available in the initramfs image for this device.
Fixes: #12886
Reported-by: Christian Heuff <christian@heuff.at>
Debugged-by: Georgios Kourachanis <geo.kourachanis@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit 75505c5ec7)
The TP-Link EAP613 v1 is a ceiling-mount 802.11ax access point. It can
be powered via PoE or a DC barrel connector (12V). Connecting to the
UART requires fine soldering and careful manipulation of any soldered
wires.
Device details:
* SoC: MT7621AT
* Flash: 16 MiB SPI NOR
* RAM: 256 MiB DDR3L
* Wi-Fi:
* MT7905DA + MT7975D: 2.4 GHz + 5 GHz (DBDC), 2x2:2
* Two stamped metal antennas (ANT1, ANT2)
* One PCB antenna (ANT3)
* One unpopulated antenna (ANT4)
* Ethernet:
* 1× 10/100/1000 Mbps port with PoE
* LEDs:
* Array of four blue LEDs with one control line
* Buttons:
* Reset
* Board test points:
* UART: next to CPU RF-shield and power circuits
* JTAG: under CPU RF-shield (untested)
* Watchdog: 3PEAK TPV706 (not implemented)
Althought three antennas are populated, the MT7905DA does not support
the additional Rx chain for background DFS detection (or Bluetooth)
according to commit 6cbcc34f50 ("ramips: disable unsupported
background radar detection").
MAC addresses:
* LAN: 48:22:54:xx:xx:a2 (device label)
* WLAN 2.4 GHz: 48:22:54:xx:xx:a2
* WLAN 5 GHz: 48:22:54:xx:xx:a3
The radio calibration blob stored in flash also contains valid MAC
addresses for both radio bands (OUI 00:0c:43).
Factory install:
1. Enable SSH on the device via web interface
2. Log in with SSH, and run `cliclientd stopcs`
3. Upload -factory.bin image via web interface. It may be necessary to
shorten the filename of the image to e.g. 'factory.bin'.
Recovery:
1. Open the device by unscrewing four screws from the backside
2. Carefully remove board from the housing
3. Connect to UART (3.3V):
* Find test points labelled "VCC", "GND", "UART_TX", "UART_RX"
* Solder wires to test points or connect otherwise. Be careful not
to damage the PCB e.g. by pulling on soldered wires.
* Open console with 115200n8 settings
4. Interrupt bootloader and use tftpboot to start an initramfs:
setenv ipaddr $DEVICE_IP
setenv serverip $SERVER_IP
tftpboot 84000000 openwrt-initramfs-kernel.bin
bootm
DO NOT use saveenv to store modified u-boot environment variables. The
environment is saved at flash offset 0x30000, which erases part of the
(secondary) bootloader.
The device uses two bootloader stages. The first stage will load the
second stage from a uImage stored at flash offset 0x10000. In case of
a damaged second stage, the first stage should allow uploading a new
image via y-modem (untested).
Signed-off-by: Sander Vanheule <sander@svanheule.net>
(cherry picked from commit 11588c52b4)
The NETGEAR WAX220 employs NMBM on SPI-NAND. In order to avoid dealing
with invalid factory data, enable NMBM in the area preceding the UBI
volume.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 92eec257dd)
CONFIG_FRAME_WARN value is set by config/Config-kernel.in based on the
target type dynamically since commit:
16a2051 ("kernel: Set CONFIG_FRAME_WARN depending on target").
However, CONFIG_FRAME_WARN was not set to get filtered out so it ended up
in multiple target configs during refreshes.
So, lets filter out CONFIG_FRAME_WARN as its set dynamically to prevent it
ending up in more target configs.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
(cherry picked from commit 7a9a4168bb)
This commit adds support for following wireless routers:
- Beeline SmartBox PRO (Serсomm S1500 AWI)
- WiFire S1500.NBN (Serсomm S1500 BUC)
This commit is based on this PR:
- Link: https://github.com/openwrt/openwrt/pull/4770
- Author: Maximilian Weinmann <x1@disroot.org>
The opening of this PR was agreed with author.
My changes:
- Sorting, minor changes and some movings between dts and dtsi
- Move leds to dts when possible
- Recipes for the factory image
- Update of the installation/recovery/return to stock guides
- Add reset GPIO for the pcie1
Common specification
--------------------
SoC: MediaTek MT7621AT (880 MHz, 2 cores)
Switch: MediaTek MT7530 (via SoC MT7621AT)
Wireless: 2.4 GHz, MT7602EN, b/g/n, 2x2
Wireless: 5 GHz, MT7612EN, a/n/ac, 2x2
Ethernet: 5 ports - 5×GbE (WAN, LAN1-4)
Mini PCIe: via J2 on PCB, not soldered on the board
UART: J4 -> GND[], TX, VCC(3.3V), RX
BootLoader: U-Boot SerComm/Mediatek
Beeline SmartBox PRO specification
----------------------------------
RAM (Nanya NT5CB128M16FP): 256 MiB
NAND-Flash (ESMT F59L2G81A): 256 MiB
USB ports: 2xUSB2.0
LEDs: Status (white), WPS (blue), 2g (white), 5g (white) + 10 LED Ethernet
Buttons: 2 button (reset, wps), 1 switch button (ROUT<->REP)
Power: 12 VDC, 1.5 A
PCB Sticker: 970AWI0QW00N256SMT Ver. 1.0
CSN: SG15********
MAC LAN: 94:4A:0C:**:**:**
Manufacturer's code: 0AWI0500QW1
WiFire S1500.NBN specification
------------------------------
RAM (Nanya NT5CC64M16GP): 128 MiB
NAND-Flash (ESMT F59L1G81MA): 128 MiB
USB ports: 1xUSB2.0
LEDs: Status (white), WPS (white), 2g (white), 5g (white) + 10 LED Ethernet
Buttons: 2 button (RESET, WPS)
Power: 12 VDC, 1.0 A
PCB Sticker: 970BUC0RW00N128SMT Ver. 1.0
CSN: MH16********
MAC WAN: E0:60:66:**:**:**
Manufacturer's code: 0BUC0500RW1
MAC address table (PRO)
-----------------------
use address source
LAN *:23 factory 0x1000 (label)
WAN *:24 factory $label +1
2g *:23 factory $label
5g *:25 factory $label +2
MAC addresses (NBN)
-------------------
use address source
LAN *:0e factory 0x1000
WAN *:0f LAN +1 (label)
2g *:0f LAN +1
5g *:10 LAN +2
OEM easy installation
---------------------
1. Remove all dots from the factory image filename (except the dot
before file extension)
2. Upload and update the firmware via the original web interface
3. Two options are possible after the reboot:
a. OpenWrt - that's OK, the mission accomplished
b. Stock firmware - install Stock firmware (to switch booflag from
Sercomm0 to Sercomm1) and then OpenWrt factory image.
Return to Stock
---------------
1. Change the bootflag to Sercomm1 in OpenWrt CLI and then reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock2
reboot
2. Install stock firmware via the web OEM firmware interface
Recovery
--------
Use sercomm-recovery tool.
Link: https://github.com/danitool/sercomm-recovery
Tested-by: Pavel Ivanov <pi635v@gmail.com>
Tested-by: Denis Myshaev <denis.myshaev@gmail.com>
Tested-by: Oleg Galeev <olegingaleev@gmail.com>
Tested-By: Ivan Pavlov <AuthorReflex@gmail.com>
Co-authored-by: Maximilian Weinmann <x1@disroot.org>
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
(cherry picked from commit 2d6784a033)
This commit moves a part of the code from the "sercomm-factory-cqr" recipe
to the separate "sercomm-mkhash" recipe. This simplifies recipes and
allows insert additional recipes between these code blocks (required for
the future support for Beeline SmartBox PRO router).
dd automatically fills the file by 0x00 if the filesize is less than
offset where we start writing. We drop such dd command so we need to add
--extra-padding-size 0x190 to the sercomm-pid.py call.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
(cherry picked from commit f560be583a)
This commit adds support for Mercusys MR90X(EU) v1 router.
Device specification
--------------------
SoC Type: MediaTek MT7986BLA, Cortex-A53, 64-bit
RAM: MediaTek MT7986BLA (512MB)
Flash: SPI NAND GigaDevice GD5F1GQ5UEYIGY (128 MB)
Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8)
Ethernet: 1x2.5Gbe (WAN/LAN 2.5Gbps), 3xGbE (WAN/LAN 1Gbps, LAN1, LAN2)
WLAN 2g: MediaTek MT7975N, b/g/n/ax, MIMO 4x4
WLAN 5g: MediaTek MT7975P(N), a/n/ac/ax, MIMO 4x4
LEDs: 1 orange and 1 green status LEDs, 4 green gpio-controlled
LEDs on ethernet ports
Button: 1 (Reset)
USB ports: No
Power: 12 VDC, 2 A
Connector: Barrel
Bootloader: Main U-Boot - U-Boot 2022.01-rc4. Additionally, both UBI
slots contain "seconduboot" (also U-Boot 2022.01-rc4)
Serial console (UART)
---------------------
V
+-------+-------+-------+-------+
| +3.3V | GND | TX | RX |
+---+---+-------+-------+-------+
|
+--- Don't connect
The R3 (TX line) and R6 (RX line) are absent on the PCB. You should
solder them or solder the jumpers.
Installation (UART)
-------------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
tftpboot initramfs-kernel.bin
bootm
4. Once inside OpenWrt, set / update env variables:
fw_setenv baudrate 115200
fw_setenv bootargs "ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit"
fw_setenv fdtcontroladdr 5ffc0e70
fw_setenv ipaddr 192.168.1.1
fw_setenv loadaddr 0x46000000
fw_setenv mtdids "spi-nand0=spi-nand0"
fw_setenv mtdparts "spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)"
fw_setenv netmask 255.255.255.0
fw_setenv serverip 192.168.1.2
fw_setenv stderr serial@11002000
fw_setenv stdin serial@11002000
fw_setenv stdout serial@11002000
fw_setenv tp_boot_idx 0
5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image
Installation (without UART)
---------------------------
1. Login as root via SSH (router IP, port 20001, password - your web
interface password)
2. Open for editing /etc/hotplug.d/iface/65-iptv (e.g., using WinSCP and
SSH settings from the p.1)
3. Add a newline after "#!/bin/sh":
telnetd -l /bin/login.sh
4. Save "65-iptv" file
5. Toggle "IPTV/VLAN Enable" checkbox in the router web interface and
save
6. Make sure that telnetd is running:
netstat -ltunp | grep 23
7. Login via telnet to router IP, port 23 (no username and password are
required)
8 Upload OpenWrt "initramfs-kernel.bin" to the "/tmp" folder of the
router (e.g., using WinSCP and SSH settings from the p.1)
9. Stock busybox doesn't contain ubiupdatevol command. Hence, we need to
download and upload the full version of busybox to the router. For
example, from here:
https://github.com/xerta555/Busybox-Binaries/raw/master/busybox-arm64
Upload busybox-arm64 to the /tmp dir of the router and run:
in the telnet shell:
cd /tmp
chmod a+x busybox-arm64
10. Check "initramfs-kernel.bin" size:
du -h initramfs-kernel.bin
11. Delete old and create new "kernel" volume with appropriate size
(greater than "initramfs-kernel.bin" size):
ubirmvol /dev/ubi0 -N kernel
ubimkvol /dev/ubi0 -n 1 -N kernel -s 9MiB
12. Write OpenWrt "initramfs-kernel.bin" to the flash:
./busybox-arm64 ubiupdatevol /dev/ubi0_1 /tmp/initramfs-kernel.bin
13. u-boot-env can be empty so lets create it (or overwrite it if it
already exists) with the necessary values:
fw_setenv baudrate 115200
fw_setenv bootargs "ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit"
fw_setenv fdtcontroladdr 5ffc0e70
fw_setenv ipaddr 192.168.1.1
fw_setenv loadaddr 0x46000000
fw_setenv mtdids "spi-nand0=spi-nand0"
fw_setenv mtdparts "spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)"
fw_setenv netmask 255.255.255.0
fw_setenv serverip 192.168.1.2
fw_setenv stderr serial@11002000
fw_setenv stdin serial@11002000
fw_setenv stdout serial@11002000
fw_setenv tp_boot_idx 0
14. Reboot to OpenWrt initramfs:
reboot
15. Login as root via SSH (IP 192.168.1.1, port 22)
16. Upload OpenWrt sysupgrade.bin image to the /tmp dir of the router
17. Run sysupgrade:
sysupgrade -n /tmp/sysupgrade.bin
Recovery
--------
1. Press Reset button and power on the router
2. Navigate to U-Boot recovery web server (http://192.168.1.1/) and
upload the OEM firmware
Recovery (UART)
---------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
tftpboot initramfs-kernel.bin
bootm
4. Do what you need (restore partitions from a backup, install OpenWrt
etc.)
Stock layout
------------
0x000000000000-0x000000200000 : "boot"
0x000000200000-0x000000300000 : "u-boot-env"
0x000000300000-0x000003500000 : "ubi0"
0x000003500000-0x000006700000 : "ubi1"
0x000006700000-0x000006f00000 : "userconfig"
0x000006f00000-0x000007300000 : "tp_data"
ubi0/ubi1 format
----------------
U-Boot at boot checks that all volumes are in place:
+-------------------------------+
| Volume Name: uboot Vol ID: 0|
| Volume Name: kernel Vol ID: 1|
| Volume Name: rootfs Vol ID: 2|
+-------------------------------+
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| label | 00:eb:xx:xx:xx:be | label |
| LAN | 00:eb:xx:xx:xx:be | label |
| WAN | 00:eb:xx:xx:xx:bf | label+1 |
| WLAN 2g | 00:eb:xx:xx:xx:be | label |
| WLAN 5g | 00:eb:xx:xx:xx:bd | label-1 |
+---------+-------------------+-----------+
label MAC address was found in UBI partition "tp_data", file
"default-mac". OEM wireless eeprom is also there (file
"MT7986_EEPROM.bin").
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
(cherry picked from commit e4fe3097ef)
[Fix merging conflict]
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
The ZTE MF287+ is a LTE router used (exclusively?) by the network operator
"3". The MF287 (i.e. non-plus aka 3Neo) is also supported (the only
difference is the LTE modem)
Specifications
==============
SoC: IPQ4018
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 4x GBit LAN
LTE: ZTE Cat12 (MF287+) / ZTE Cat6 (MF287)
WiFi: 802.11a/b/g/n/ac SoC-integrated
MAC addresses
=============
LAN: from config + 2
WiFi 1: from config
WiFi 2: from config + 1
Installation
============
Option 1 - TFTP
---------------
TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:
setenv serverip 192.168.1.100
setenv ipaddr 192.168.1.1
tftpboot 0x82000000 openwrt.bin
bootm 0x82000000
From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:
ubiattach -m14
cat /dev/ubi0_0 > /tmp/ubi0_0
cat /dev/ubi0_1 > /tmp/ubi0_1
Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.
Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:
ubirmvol /dev/ubi0 -N ubi_rootfs
ubirmvol /dev/ubi0 -N kernel
Option 2 - From stock firmware
------------------------------
The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.
The exploit will be available at the device wiki page.
Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".
ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd13 is the partition labelled "rootfs" by calling
"cat /proc/mtd".
Complete commands:
cd /tmp
tftp -g -r factory.bin 192.168.0.22
cat /proc/driver/sensor_id
flash_erase /dev/mtd13 0 0
dd if=/tmp/factory.bin of=/dev/mtdblock13 bs=131072
Afterwards, reboot your device and you should have a working OpenWrt
installation.
Restore Stock
=============
Option 1 - via UART
-------------------
Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.
Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.
ubiattach -m 14
ubirmvol /dev/ubi0 -N kernel
ubirmvol /dev/ubi0 -N rootfs
ubirmvol /dev/ubi0 -N rootfs_data
ubimkvol /dev/ubi0 -N kernel -s $kernel_length
ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1
Option 2 - from within OpenWrt
------------------------------
This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.
Follow the commands from Option 1 to flash back to stock.
LTE Modem
=========
The LTE modem is similar to other ZTE devices and controls some more LEDs
and battery management.
Configuring the connection using uqmi works properly, the modem
provides three serial ports and a QMI CDC ethernet interface.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
(cherry picked from commit f70ee53b08)
Some ZTE devices require the gpio-restart driver to support restarting the
LTE modem along with OpenWrt
Signed-off-by: Andreas Böhler <dev@aboehler.at>
(cherry picked from commit 9ffdaa7fa1)
Hardware
--------
SOC: MediaTek MT7986
RAM: 1024MB DDR3
FLASH: 128MB SPI-NAND (Winbond)
WIFI: Mediatek MT7986 DBDC 802.11ax 2.4/5 GHz
ETH: Realtek RTL8221B-VB-CG 2.5 N-Base-T PHY with PoE
UART: 3V3 115200 8N1 (Pinout silkscreened / Do not connect VCC)
Installation
------------
1. Download the OpenWrt initramfs image. Copy the image to a TFTP server
2. Connect the TFTP server to the WAX220. Conect to the serial console,
interrupt the autoboot process by pressing '0' when prompted.
3. Download & Boot the OpenWrt initramfs image.
$ setenv ipaddr 192.168.2.1
$ setenv serverip 192.168.2.2
$ tftpboot openwrt.bin
$ bootm
4. Wait for OpenWrt to boot. Transfer the sysupgrade image to the device
using scp and install using sysupgrade.
$ sysupgrade -n <path-to-sysupgrade.bin>
Signed-off-by: Flole Systems <flole@flole.de>
Signed-off-by: Stefan Agner <stefan@agner.ch>
(cherry picked from commit 984786a2f7)
