mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-27 17:18:59 +00:00
e8084a3c3b
18 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Maximilian Martin
|
906e2a1b99 |
ath79: Add support for MOXA AWK-1137C
Device specifications:
======================
* Qualcomm/Atheros AR9344
* 128 MB of RAM
* 16 MB of SPI NOR flash
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4/5 GHz Wi-Fi
* 4x GPIO-LEDs (1x wifi, 2x ethernet, 1x power)
* 1x GPIO-button (reset)
* 2x fast ethernet
- lan1
+ builtin switch port 1
+ used as WAN interface
- lan2
+ builtin switch port 2
+ used as LAN interface
* 9-30V DC
* external antennas
Flashing instructions:
======================
Log in to https://192.168.127.253/
Username: admin
Password: moxa
Open Maintenance > Firmware Upgrade and install the factory image.
Serial console access:
======================
Connect a RS232-USB converter to the maintenance port.
Pinout: (reset button left) [GND] [NC] [RX] [TX]
Firmware Recovery:
==================
When the WLAN and SYS LEDs are flashing, the device is in recovery mode.
Serial console access is required to proceed with recovery.
Download the original image from MOXA and rename it to 'awk-1137c.rom'.
Set up a TFTP server at 192.168.127.1 and connect to a lan port.
Follow the instructions on the serial console to start the recovery.
Signed-off-by: Maximilian Martin <mm@simonwunderlich.de>
|
||
Michael Pratt
|
5e973dd61f |
ath79: add eth0 mac and initvals for Engenius EPG5000
Although VLANs are used, the "eth0" device by itself
does not have a valid MAC, so fix that with preinit script.
More initvals added by editing the driver to print switch registers,
after the bootloader sets them but before openwrt changes them.
The register bits needed for the QCA8337 switch
can be read from interrupted boot (tftpboot, bootm)
by adding print lines in the switch driver ar8327.c
before 'qca,ar8327-initvals' is parsed from DTS and written
for example:
pr_info("0x04 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD0_MODE));
Signed-off-by: Michael Pratt <mcpratt@pm.me>
|
||
|
Michael Pratt
|
f9c28222c8 |
ath79: add support for Senao Engenius ESR1200
FCC ID: A8J-ESR900
Engenius ESR1200 is an indoor wireless router with
a gigabit ethernet switch, dual-band wireless,
internal antenna plates, and a USB 2.0 port
**Specification:**
- QCA9557 SOC 2.4 GHz, 2x2
- QCA9882 WLAN PCIe mini card, 5 GHz, 2x2
- QCA8337N SW 4 ports LAN, 1 port WAN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM
- UART at J1 populated, RX grounded
- 6 internal antenna plates (omni-directional)
- 5 LEDs, 1 button (power, 2G, 5G, WAN, WPS) (reset)
**MAC addresses:**
Base MAC address labeled as "MAC ADDRESS"
MAC "wanaddr" is not similar to "ethaddr"
eth0 *:c8 MAC u-boot-env ethaddr
phy0 *:c8 MAC u-boot-env ethaddr
phy1 *:c9 --- u-boot-env ethaddr +1
WAN *:66:44 u-boot-env wanaddr
**Serial Access:**
RX on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin
**Installation:**
Method 1: Firmware upgrade page
OEM webpage at 192.168.0.1
username and password "admin"
Navigate to Settings (gear icon) --> Tools --> Firmware
select the factory.bin image
confirm and wait 3 minutes
Method 2: TFTP recovery
Follow TFTP instructions using initramfs.bin
use sysupgrade.bin to flash using openwrt web interface
**Return to OEM:**
MTD partitions should be backed up before flashing
using TFTP to boot openwrt without overwriting flash
Alternatively, it is possible to edit OEM firmware images
to flash MTD partitions in openwrt to restore OEM firmware
by removing the OEM header and writing the rest to "firmware"
**TFTP recovery:**
Requires serial console, reset button does nothing at boot
rename initramfs.bin to 'uImageESR1200'
make available on TFTP server at 192.168.99.8
power board, interrupt boot by pressing '4' rapidly
execute tftpboot and bootm
**Note on ETH switch registers**
Registers must be written to the ethernet switch
in order to set up the switch's MAC interface.
U-boot can write the registers on it's own
which is needed, for example, in a TFTP transfer.
The register bits from OEM for the QCA8337 switch
can be read from interrupted boot (tftpboot, bootm)
by adding print lines in the switch driver ar8327.c
before 'qca,ar8327-initvals' is parsed from DTS and written.
for example:
pr_info("0x04 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD0_MODE));
Signed-off-by: Michael Pratt <mcpratt@pm.me>
|
||
|
Michael Pratt
|
96c2119dba |
ath79: add support for Senao Engenius ESR1750
FCC ID: A8J-ESR1750
Engenius ESR1750 is an indoor wireless router with
a gigabit ethernet switch, dual-band wireless,
internal antenna plates, and a USB 2.0 port
**Specification:**
- QCA9558 SOC 2.4 GHz, 3x3
- QCA9880 WLAN PCIe mini card, 5 GHz, 3x3
- QCA8337N SW 4 ports LAN, 1 port WAN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM
- UART at J1 populated, RX grounded
- 6 internal antenna plates (omni-directional)
- 5 LEDs, 1 button (power, 2G, 5G, WAN, WPS) (reset)
**MAC addresses:**
Base MAC address labeled as "MAC ADDRESS"
MAC "wanaddr" is similar to "ethaddr"
eth0 *:58 MAC u-boot-env ethaddr
phy0 *:58 MAC u-boot-env ethaddr
phy1 *:59 --- u-boot-env ethaddr +1
WAN *:10:58 u-boot-env wanaddr
**Serial Access:**
RX on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin
**Installation:**
Method 1: Firmware upgrade page
NOTE: ESR1750 might require the factory.bin
for ESR1200 instead, OEM provides 1 image for both.
OEM webpage at 192.168.0.1
username and password "admin"
Navigate to Settings (gear icon) --> Tools --> Firmware
select the factory.bin image
confirm and wait 3 minutes
Method 2: TFTP recovery
Follow TFTP instructions using initramfs.bin
use sysupgrade.bin to flash using openwrt web interface
**Return to OEM:**
MTD partitions should be backed up before flashing
using TFTP to boot openwrt without overwriting flash
Alternatively, it is possible to edit OEM firmware images
to flash MTD partitions in openwrt to restore OEM firmware
by removing the OEM header and writing the rest to "firmware"
**TFTP recovery:**
Requires serial console, reset button does nothing at boot
rename initramfs.bin to 'uImageESR1200'
make available on TFTP server at 192.168.99.8
power board, interrupt boot by pressing '4' rapidly
execute tftpboot and bootm
**Note on ETH switch registers**
Registers must be written to the ethernet switch
in order to set up the switch's MAC interface.
U-boot can write the registers on it's own
which is needed, for example, in a TFTP transfer.
The register bits from OEM for the QCA8337 switch
can be read from interrupted boot (tftpboot, bootm)
by adding print lines in the switch driver ar8327.c
before 'qca,ar8327-initvals' is parsed from DTS and written.
for example:
pr_info("0x04 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD0_MODE));
Signed-off-by: Michael Pratt <mcpratt@pm.me>
|
||
|
Michael Pratt
|
2f99f7e2d0 |
ath79: add support for Senao Engenius ESR900
FCC ID: A8J-ESR900
Engenius ESR900 is an indoor wireless router with
a gigabit ethernet switch, dual-band wireless,
internal antenna plates, and a USB 2.0 port
**Specification:**
- QCA9558 SOC 2.4 GHz, 3x3
- AR9580 WLAN PCIe on board, 5 GHz, 3x3
- AR8327N SW 4 ports LAN, 1 port WAN
- 40 MHz clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM
- UART at J1 populated, RX grounded
- 6 internal antenna plates (omni-directional)
- 5 LEDs, 1 button (power, 2G, 5G, WAN, WPS) (reset)
**MAC addresses:**
Base MAC address labeled as "MAC ADDRESS"
MAC "wanaddr" is not similar to "ethaddr"
eth0 *:06 MAC u-boot-env ethaddr
phy0 *:06 MAC u-boot-env ethaddr
phy1 *:07 --- u-boot-env ethaddr +1
WAN *:6E:81 u-boot-env wanaddr
**Serial Access:**
RX on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART RX pin
**Installation:**
Method 1: Firmware upgrade page
OEM webpage at 192.168.0.1
username and password "admin"
Navigate to Settings (gear icon) --> Tools --> Firmware
select the factory.bin image
confirm and wait 3 minutes
Method 2: TFTP recovery
Follow TFTP instructions using initramfs.bin
use sysupgrade.bin to flash using openwrt web interface
**Return to OEM:**
MTD partitions should be backed up before flashing
using TFTP to boot openwrt without overwriting flash
Alternatively, it is possible to edit OEM firmware images
to flash MTD partitions in openwrt to restore OEM firmware
by removing the OEM header and writing the rest to "firmware"
**TFTP recovery:**
Requires serial console, reset button does nothing at boot
rename initramfs.bin to 'uImageESR900'
make available on TFTP server at 192.168.99.8
power board, interrupt boot by pressing '4' rapidly
execute tftpboot and bootm
**Note on ETH switch registers**
Registers must be written to the ethernet switch
in order to set up the switch's MAC interface.
U-boot can write the registers on it's own
which is needed, for example, in a TFTP transfer.
The register bits from OEM for the AR8327 switch
can be read from interrupted boot (tftpboot, bootm)
by adding print lines in the switch driver ar8327.c
before 'qca,ar8327-initvals' is parsed from DTS and written.
for example:
pr_info("0x04 %08x\n", ar8xxx_read(priv, AR8327_REG_PAD0_MODE));
Signed-off-by: Michael Pratt <mcpratt@pm.me>
|
||
Wenli Looi
|
f0eb73a888 |
ath79: consolidate Netgear EX7300 series images
This change consolidates Netgear EX7300 series devices into two images corresponding to devices that share the same manufacturer firmware image. Similar to the manufacturer firmware, the actual device model is detected at runtime. The logic is taken from the netgear GPL dumps in a file called generate_board_conf.sh. Hardware details for EX7300 v2 variants --------------------------------------- SoC: QCN5502 Flash: 16 MiB RAM: 128 MiB Ethernet: 1 gigabit port Wireless 2.4GHz (currently unsupported due to lack of ath9k support): - EX6250 / EX6400 v2 / EX6410 / EX6420: QCN5502 3x3 - EX7300 v2 / EX7320: QCN5502 4x4 Wireless 5GHz: - EX6250: QCA9986 3x3 (detected by ath10k as QCA9984 3x3) - EX6400 v2 / EX6410 / EX6420 / EX7300 v2 / EX7320: QCA9984 4x4 Signed-off-by: Wenli Looi <wlooi@ucalgary.ca> |
||
|
Michael Pratt
|
e085812a7d |
ath79: add support for Fortinet FAP-221-B
FCC ID: U2M-CAP4100AG Fortinet FAP-221-B is an indoor access point with 1 Gb ethernet port, dual-band wireless, internal antenna plates, and 802.3at PoE+ Hardware and board design from Senao **Specification:** - AR9344 SOC 2G 2x2, 5G 2x2, 25 MHz CLK - AR9382 WLAN 2G 2x2 PCIe, 40 MHz CLK - AR8035-A PHY RGMII, PoE+ IN, 25 MHz CLK - 16 MB FLASH MX25L12845EMI-10G - 2x 32 MB RAM W9725G6JB-25 - UART at J11 populated, 9600 baud - 6 LEDs, 1 button power, ethernet, wlan, reset Note: ethernet LEDs are not enabled because a new netifd hotplug is required in order to operate like OEM. Board has 1 amber and 1 green for each of the 3 case viewports. **MAC addresses:** 1 MAC Address in flash at end of uboot ASCII encoded, no delimiters Labeled as "MAC Address" on case OEM firmware sets offsets 1 and 8 for wlan eth0 *:1e uboot 0x3ff80 phy0 *:1f uboot 0x3ff80 +1 phy1 *:26 uboot 0x3ff80 +8 **Serial Access:** Pinout: (arrow) VCC GND RX TX Pins are populated with a header and traces not blocked. Bootloader is set to 9600 baud, 8 data, 1 stop. **Console Access:** Bootloader: Interrupt boot with Ctrl+C Press "k" and enter password "1" OR Hold reset button for 5 sec during power on Interrupt the TFTP transfer with Ctrl+C to print commands available, enter "help" OEM: default username is "admin", password blank telnet is available at default address 192.168.1.2 serial is available with baud 9600 to print commands available, enter "help" or tab-tab (busybox list of commands) **Installation:** Use factory.bin with OEM upgrade procedures OR Use initramfs.bin with uboot TFTP commands. Then perform a sysupgrade with sysupgrade.bin **TFTP Recovery:** Using serial console, load initramfs.bin using TFTP to boot openwrt without touching the flash. TFTP is not reliable due to bugged bootloader, set MTU to 600 and try many times. If your TFTP server supports setting block size, higher block size is better. Splitting the file into 1 MB parts may be necessary example: $ tftpboot 0x80100000 image1.bin $ tftpboot 0x80200000 image2.bin $ tftpboot 0x80300000 image3.bin $ tftpboot 0x80400000 image4.bin $ tftpboot 0x80500000 image5.bin $ tftpboot 0x80600000 image6.bin $ bootm 0x80100000 **Return to OEM:** The best way to return to OEM firmware is to have a copy of the MTD partitions before flashing Openwrt. Backup copies should be made of partitions "fwconcat0", "loader", and "fwconcat1" which together is the same flash range as OEM's "rootfs" and "uimage" by loading an initramfs.bin and using LuCI to download the mtdblocks. It is also possible to extract from the OEM firmware upgrade image by splitting it up in parts of lengths that correspond to the partitions in openwrt and write them to flash, after gzip decompression. After writing to the firmware partitions, erase the "reserved" partition and reboot. **OEM firmware image format:** Images from Fortinet for this device ending with the suffix .out are actually a .gz file The gzip metadata stores the original filename before compression, which is a special string used to verify the image during OEM upgrade. After gzip decompression, the resulting file is an exact copy of the MTD partitions "rootfs" and "uimage" combined in the same order and size that they appear in /proc/mtd and as they are on flash. OEM upgrade is performed by a customized busybox with the command "upgrade". Another binary, "restore" is a wrapper for busybox's "tftp" and "upgrade". Signed-off-by: Michael Pratt <mcpratt@pm.me> |
||
Nick French
|
20581ee8b5 |
ath79: add support for TP-Link Deco S4
Add support for TP-Link Deco S4 wifi router
The label refers to the device as S4R and the TP-Link firmware
site calls it the Deco S4 v2. (There does not appear to be a v1)
Hardware (and FCC id) are identical to the Deco M4R v2 but the
flash layout is ordered differently and the OEM firmware encrypts
some config parameters (including the label mac address) in flash
In order to set the encrypted mac address, the wlan's caldata
node is removed from the DTS so the mac can be decrypted with
the help of the uencrypt tool and patched into the wlan fw
via hotplug
Specifications:
SoC: QCA9563-AL3A
RAM: Zentel A3R1GE40JBF
Wireless 2.4GHz: QCA9563-AL3A (main SoC)
Wireless 5GHz: QCA9886
Ethernet Switch: QCA8337N-AL3C
Flash: 16 MB SPI NOR
UART serial access (115200N1) on board via solder pads:
RX = TP1 pad
TX = TP2 pad
GND = C201 (pad nearest board edge)
The device's bootloader and web gui will only accept images that
were signed using TP-Link's RSA key, however a memory safety bug
in the bootloader can be leveraged to install openwrt without
accessing the serial console. See developer forum S4 support page
for link to a "firmware" file that starts a tftp client, or you
may generate one on your own like this:
```
python - > deco_s4_faux_fw_tftp.bin <<EOF
import sys
from struct import pack
b = pack('>I', 0x00008000) + b'X'*16 + b"fw-type:" \
+ b'x'*256 + b"S000S001S002" + pack('>I', 0x80060200) \
b += b"\x00"*(0x200-len(b)) \
+ pack(">33I", *[0x3c0887fc, 0x35083ddc, 0xad000000, 0x24050000,
0x3c048006, 0x348402a0, 0x3c1987f9, 0x373947f4,
0x0320f809, 0x00000000, 0x24050000, 0x3c048006,
0x348402d0, 0x3c1987f9, 0x373947f4, 0x0320f809,
0x00000000, 0x24050000, 0x3c048006, 0x34840300,
0x3c1987f9, 0x373947f4, 0x0320f809, 0x00000000,
0x24050000, 0x3c048006, 0x34840400, 0x3c1987f9,
0x373947f4, 0x0320f809, 0x00000000, 0x1000fff1,
0x00000000])
b += b"\xff"*(0x2A0-len(b)) + b"setenv serverip 192.168.0.2\x00"
b += b"\xff"*(0x2D0-len(b)) + b"setenv ipaddr 192.168.0.1\x00"
b += b"\xff"*(0x300-len(b)) + b"tftpboot 0x81000000 initramfs-kernel.bin\x00"
b += b"\xff"*(0x400-len(b)) + b"bootm 0x81000000\x00"
b += b"\xff"*(0x8000-len(b))
sys.stdout.buffer.write(b)
EOF
```
Installation:
1. Run tftp server on pc with static ip 192.168.0.2
2. Place openwrt "initramfs-kernel.bin" image in tftp root dir
3. Connect pc to router ethernet port1
4. While holding in reset button on bottom of router, power on router
5. From pc access router webgui at http://192.168.0.1
6. Upload deco_s4_faux_fw_tftp.bin
7. Router will load and execture in-memory openwrt
8. Switch pc back to dhcp or static 192.168.1.x
9. Flash openwrt sysupgrade image via luci/ssh at 192.168.1.1
Revert to stock:
Press and hold reset button while powering device to start the
bootloader's recovery mode, where stock firmware can be uploaded
via web gui at 192.168.0.1
Please note that one additional non-github commits is also needed:
firmware-utils: add tplink-safeloader support for Deco S4
Signed-off-by: Nick French <nickfrench@gmail.com>
|
||
Albin Hellström
|
f8c87aa2d2 |
ath79: add support for Extreme Networks WS-AP3805i
Specifications:
- SoC: Qualcomm Atheros QCA9557-AT4A
- RAM: 2x 128MB Nanya NT5TU64M16HG
- FLASH: 64MB - SPANSION FL512SAIFG1
- LAN: Atheros AR8035-A (RGMII GbE with PoE+ IN)
- WLAN2: Qualcomm Atheros QCA9557 2x2 2T2R
- WLAN5: Qualcomm Atheros QCA9882-BR4A 2x2 2T2R
- SERIAL: UART pins at J10 (115200 8n1)
Pinout is 3.3V - GND - TX - RX (Arrow Pad is 3.3V)
- LEDs: Power (Green/Amber)
WiFi 5 (Green)
WiFi 2 (Green)
- BTN: Reset
Installation:
1. Download the OpenWrt initramfs-image.
Place it into a TFTP server root directory and rename it to 1D01A8C0.img
Configure the TFTP server to listen at 192.168.1.66/24.
2. Connect the TFTP server to the access point.
3. Connect to the serial console of the access point.
Attach power and interrupt the boot procedure when prompted.
Credentials are admin / new2day
4. Configure U-Boot for booting OpenWrt from ram and flash:
$ setenv boot_openwrt 'setenv bootargs; bootm 0xa1280000'
$ setenv ramboot_openwrt 'setenv serverip 192.168.1.66;
tftpboot 0x89000000 1D01A8C0.img; bootm'
$ setenv bootcmd 'run boot_openwrt'
$ saveenv
5. Load OpenWrt into memory:
$ run ramboot_openwrt
6. Transfer the OpenWrt sysupgrade image to the device.
Write the image to flash using sysupgrade:
$ sysupgrade -n /path/to/openwrt-sysupgrade.bin
Signed-off-by: Albin Hellström <albin.hellstrom@gmail.com>
[rename vendor - minor style fixes - update commit message]
Signed-off-by: David Bauer <mail@david-bauer.net>
|
||
Sebastian Schaper
|
dc4745da7a |
ath79: add support for D-Link DAP-3662 A1
Specifications:
* QCA9557, 16 MiB Flash, 128 MiB RAM, 802.11n 2T2R
* QCA9882, 802.11ac 2T2R
* 2x Gigabit LAN (1x 802.11af PoE)
* IP68 pole-mountable outdoor case
Installation:
* Factory Web UI is at 192.168.0.50
login with 'admin' and blank password, flash factory.bin
* Recovery Web UI is at 192.168.0.50
connect network cable, hold reset button during power-on and keep it
pressed until uploading has started (only required when checksum is ok,
e.g. for reverting back to oem firmware), flash factory.bin
After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.
Both ethernet ports are set to LAN by default, matching the labelling on
the case. However, since both GMAC Interfaces eth0 and eth1 are connected
to the switch (QCA8337), the user may create an additional 'wan' interface
as desired and override the vlan id settings to map br-lan / wan to either
the PoE or non-PoE port, depending on the individual scenario of use.
So, the LAN and WAN ports would then be connected to different GMACs, e.g.
config interface 'lan'
option ifname 'eth0.1'
...
config interface 'wan'
option ifname 'eth1.2'
...
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '1 0t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '2 6t'
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
[add configuration example]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
|
||
Christoph Krapp
|
459c8c9ef8 |
ath79: add support for ZyXEL NBG6616
Specifications: SoC: Qualcomm Atheros QCA9557 RAM: 128 MB (Nanya NT5TU32M16EG-AC) Flash: 16 MB (Macronix MX25L12845EMI-10G) Ethernet: 5x 10/100/1000 (1x WAN, 4x LAN) Wireless: QCA9557 2.4GHz (nbg), QCA9882 5GHz (ac) USB: 2x USB 2.0 port Buttons: 1x Reset Switches: 1x Wifi LEDs: 11 (Pwr, WAN, 4x LAN, 2x Wifi, 2x USB, WPS) MAC addresses: WAN *:3f uboot-env ethaddr + 3 LAN *:3e uboot-env ethaddr + 2 2.4GHz *:3c uboot-env ethaddr 5GHz *:3d uboot-env ethaddr + 1 The label contains all four MAC addresses, however the one without increment is first, so this one is taken for label MAC address. Notes: The Wifi is controlled by an on/off button, i.e. has to be implemented by a switch (EV_SW). Despite, it appears that GPIO_ACTIVE_HIGH needs to be used, just like recently fixed for the NBG6716. Both parameters have been wrong at ar71xx. Flash Instructions: At first the U-Boot variables need to be changed in order to boot the new combined image format. ZyXEL uses a split kernel + root setup and the current kernel is too large to fit into the partition. As resizing didnt do the trick, I've decided to use the prefered combined image approach to be future-kernel-enlargement-proof (thanks to blocktrron for the assistance). First add a new variable called boot_openwrt: setenv boot_openwrt bootm 0x9F120000 After that overwrite the bootcmd and save the environment: setenv bootcmd run boot_openwrt saveenv After that you can flash the openwrt factory image via TFTP. The servers IP has to be 192.168.1.33. Connect to one of the LAN ports and hold the WPS Button while booting. After a few seconds the NBG6616 will look for a image file called 'ras.bin' and flash it. Return to vendor firmware is possible by resetting the bootcmd: setenv bootcmd run boot_flash saveenv and flashing the vendor image via the TFTP method as described above. Accessing the U-Boot Shell: ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02" When the device is starting up, the user can enter the the loader shell by simply pressing a key within the 3 seconds once the following string appears on the serial console: | Hit any key to stop autoboot: 3 The user is then dropped to a locked shell. | NBG6616> ? | ATEN x,(y) set BootExtension Debug Flag (y=password) | ATSE x show the seed of password generator | ATSH dump manufacturer related data in ROM | ATRT (x,y,z,u) ATRT RAM read/write test (x=level, y=start addr, z=end addr, u=iterations | ATGO boot up whole system | ATUR x upgrade RAS image (filename) In order to escape/unlock a password challenge has to be passed. Note: the value is dynamic! you have to calculate your own! First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env) to get the challange value/seed. | NBG6616> ATSE NBG6616 | 00C91D7EAC3C This seed/value can be converted to the password with the help of this bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors): - tool.sh - ror32() { echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) )) } v="0x$1" a="0x${v:2:6}" b=$(( $a + 0x10F0A563)) c=$(( 0x${v:12:14} & 7 )) p=$(( $(ror32 $b $c) ^ $a )) printf "ATEN 1,%X\n" $p - end of tool.sh - | # bash ./tool.sh 00C91D7EAC3C | ATEN 1,10FDFF5 Copy and paste the result into the shell to unlock zloader. | NBG6616> ATEN 1,10FDFF5 If the entered code was correct the shell will change to use the ATGU command to enter the real u-boot shell. | NBG6616> ATGU | NBG6616# Signed-off-by: Christoph Krapp <achterin@googlemail.com> [move keys to DTSI, adjust usb_power DT label, remove kernel config change, extend commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> |
||
Natalie Kagelmacher
|
8ff631feff |
ath79: add support for AVM FRITZ!WLAN Repeater DVB-C
This commit adds support for the AVM FRITZ!WLAN Repeater DVB-C
SOC: Qualcomm Atheros QCA9556
RAM: 64 MiB
FLASH: 16 MB SPI-NOR
WLAN: QCA9556 3T3R 2.4 GHZ b/g/n and
QCA9880 3T3R 5 GHz n/ac
ETH: Atheros AR8033 1000 Base-T
DVB-C: EM28174 with MaxLinear MXL251 tuner
BTN: WPS Button
LED: Power, WLAN, TV, RSSI0-4
Tested and working:
- Ethernet (correct MAC, gigabit, iperf3 about 200 Mbit/s)
- 2.4 GHz Wi-Fi (correct MAC)
- 5 GHz Wi-Fi (correct MAC)
- WPS Button (tested using wifitoggle)
- LEDs
- Installation via EVA bootloader (FTP recovery)
- OpenWrt sysupgrade (both CLI and LuCI)
- Download of "urlader" (mtd0)
Not working:
- Internal USB
- DVB-C em28174+MxL251 (depends on internal USB)
Installation via EVA bootloader (FTP recovery):
Set NIC to 192.168.178.3/24 gateway 192.168.178.1 and power on the device,
connect to 192.168.178.1 through FTP and sign in with adam2/adam2:
ftp> quote USER adam2
ftp> quote PASS adam2
ftp> binary
ftp> debug
ftp> passive
ftp> quote MEDIA FLSH
ftp> put openwrt-sysupgrade.bin mtd1
Wait for "Transfer complete" together with the transfer details.
Wait two minutes to make sure flash is complete (just to be safe).
Then restart the device (power off and on) to boot into OpenWrt.
Revert your NIC settings to reach OpenWrt at 192.168.1.1
Signed-off-by: Natalie Kagelmacher <nataliek@pm.me>
[fixed sorting - removed change to other board -
prettified commit message]
Signed-off-by: David Bauer <mail@david-bauer.net>
|
||
Adrian Schmutzler
|
48c1fdd046 |
treewide: drop shebang from non-executable target files
This drops the shebang from all target files for /lib and /etc/uci-defaults folders, as these are sourced and the shebang is useless. While at it, fix the executable flag on a few of these files. This does not touch ar71xx, as this target is just used for backporting now and applying cosmetic changes would just complicate things. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> |
||
Stijn Tintel
|
cd09f26660 |
ath79: add support for D-Link DAP-2695-A1
Hardware: * SoC: Qualcomm Atheros QCA9558 * RAM: 256MB * Flash: 16MB SPI NOR * Ethernet: 2x 10/100/1000 (1x 802.3at PoE-PD) * WiFi 2.4GHz: Qualcomm Atheros QCA9558 * WiFi 5GHz: Qualcomm Ahteros QCA9880-2R4E * LEDS: 1x 5GHz, 1x 2.4GHz, 1x LAN1(POE), 1x LAN2, 1x POWER * Buttons: 1x RESET * UART: 1x RJ45 RS-232 Console port Installation via stock firmware: * Install the factory image via the stock firmware web interface Installation via bootloader Emergency Web Server: * Connect your PC to the LAN1(PoE) port * Configure your PC with IP address 192.168.0.90 * Open a serial console to the Console port (115200,8n1) * Press "q" within 2s when "press 'q' to stop autoboot" appears * Open http://192.168.0.50 in a browser * Upload either the factory or the sysupgrade image * Once you see "write image into flash...OK,dest addr=0x9f070000" you can power-cycle the device. Ignore "checksum bad" messages. Setting the MAC addresses for the ethernet interfaces via /etc/board.d/02_network adds the following snippets to /etc/config/network: config device 'lan_eth0_1_dev' option name 'eth0.1' option macaddr 'xx:xx:xx:xx:xx:xx' config device 'wan_eth1_2_dev' option name 'eth1.2' option macaddr 'xx:xx:xx:xx:xx:xx' This would result in the proper MAC addresses being set for the VLAN subinterfaces, but the parent interfaces would still have a random MAC address. Using untagged VLANs could solve this, but would still leave those extra snippets in /etc/config/network, and then the device VLAN setup would differ from the one used in ar71xx. Therefore, the MAC addresses of the ethernet interfaces are being set via preinit instead. The bdcfg partition contains 4 MAC address labels: - lanmac - wanmac - wlanmac - wlanmac_a The first 3 all contain the same MAC address, which is also the one on the label. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> |
||
David Bauer
|
ebddc5f984 |
ath79: add support for Enterasys WS-AP3705i
Hardware
--------
SoC: Atheros AR9344
RAM: 128M DDR2
FLASH: 2x Macronix MX25L12845EM
2x 16MiB SPI-NOR
WLAN2: Atheros AR9344 2x2 2T2R
WLAN5: Atheros AR9580 2x2 2T2R
SERIAL: Cisco-RJ45 on the back (115200 8n1)
Installation
------------
The U-Boot CLI is password protected (using the same credentials as the
OS). Default is admin/new2day.
1. Download the OpenWrt initramfs-image. Place it into a TFTP server
root directory and rename it to 1401A8C0.img. Configure the TFTP
server to listen at 192.168.1.66/24.
2. Connect the TFTP server to the access point.
3. Connect to the serial console of the access point. Attach power and
interrupt the boot procedure when prompted (bootdelay is 1 second).
4. Configure the U-Boot environment for booting OpenWrt from Ram and
flash:
$ setenv boot_openwrt 'setenv bootargs; bootm 0xbf230000'
$ setenv ramboot_openwrt 'setenv serverip 192.168.1.66;
tftpboot 0x85000000; bootm'
$ setenv bootcmd 'run boot_openwrt'
$ saveenv
5. Load OpenWrt into memory:
$ run ramboot_openwrt
Wait for the image to boot.
6. Transfer the OpenWrt sysupgrade image to the device. Write the image
to flash using sysupgrade:
$ sysupgrade -n /path/to/openwrt-sysuograde.bin
Signed-off-by: David Bauer <mail@david-bauer.net>
|
||
|
David Bauer
|
8d9c1087e4 |
ath79: add support for AVM FRITZ!WLAN Repeater 450E
SOC: Qualcomm QCA9556 (Scorpion) 560MHz MIPS74Kc
RAM: 64MB Zentel A3R12E40CBF DDR2
FLASH: 16MiB Winbond W25Q128 SPI NOR
WLAN1: QCA9556 2.4 GHz 802.11b/g/n 3x3
INPUT: WPS button
LED: Power, WiFi, LAN, RSSI indicator
Serial: Header Next to Black metal shield
Pinout is 3.3V - RX - TX - GND (Square Pad is 3.3V)
The Serial setting is 115200-8-N-1.
Installation via EVA:
In the first seconds after Power is connected, the bootloader will
listen for FTP connections on 192.168.178.1. Firmware can be uploaded
like following:
ftp> quote USER adam2
ftp> quote PASS adam2
ftp> binary
ftp> debug
ftp> passive
ftp> quote MEDIA FLSH
ftp> put openwrt-sysupgrade.bin mtd1
Note that this procedure might take up to two minutes.
You need to powercycle the device afterwards to boot OpenWRT.
Tested-by: Andreas Ziegler <dev@andreas-ziegler.de>
Signed-off-by: David Bauer <mail@david-bauer.net>
|
||
|
David Bauer
|
8918c038f3 |
ath79: add support for AVM FRITZ!WLAN Repeater 1750E
This commit adds support for the AVM Fritz!WLAN Repeater 1750E
SOC: Qualcomm QCA9556 (Scorpion) 720MHz MIPS74Kc
RAM: 64MB Zentel A3R12E40CBF DDR2
FLASH: 16MiB Winbond W25Q128 SPI NOR
WLAN1: QCA9556 2.4 GHz 802.11b/g/n 3x3
WLAN2: QCA9880 5 GHz 802.11 n/ac 3x3
INPUT: WPS button
LED: Power, WiFi, LAN, RSSI indicator
Serial: Header Next to Black metal shield
Pinout is 3.3V - RX - TX - GND (Square Pad is 3.3V)
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet
- 2.4 GHz WiFi (correct MAC)
- 5 GHz WiFi (correct MAC)
- Installation via EVA bootloader
- OpenWRT sysupgrade
- Buttons
- LEDs
Installation via EVA:
In the first seconds after Power is connected, the bootloader will
listen for FTP connections on 192.168.178.1. Firmware can be uploaded
like following:
ftp> quote USER adam2
ftp> quote PASS adam2
ftp> binary
ftp> debug
ftp> passive
ftp> quote MEDIA FLSH
ftp> put openwrt-sysupgrade.bin mtd1
Note that this procedure might take up to two minutes.
You need to powercycle the Device afterwards to boot OpenWRT.
Signed-off-by: David Bauer <mail@david-bauer.net>
|
||
|
David Bauer
|
d2b8ccb1c0 |
ath79: add support for Siemens WS-AP3610
Hardware
--------
SoC: Atheros AR7161
RAM: Samsung K4H511638D-UCCC
2x 64M DDR1
SPI: Micron M25P128 (16M)
WiFi: Atheros AR9160 bgn
Atheros AR9160 an
ETH: Broadcom BCM5481
LED: Power (Green/Red)
ETH (Green / Blue / Yellow)
(PHY-controlled)
WiFi 5 (Green / Blue)
WiFi 2 (Green / Blue)
BTN: Reset
Serial: Cisco-Style RJ45 - 115200 8N1
Installation
------------
1. Download the OpenWrt initramfs-image. Place it into a TFTP server
root directory and rename it to 1401A8C0.img. Configure the TFTP
server to listen at 192.168.1.66/24.
2. Connect the TFTP server to the access point.
3. Connect to the serial console of the access point. Attach power and
interrupt the boot procedure when prompted (bootdelay is 1 second).
4. Configure the U-Boot environment for booting OpenWrt from Ram and
flash:
$ setenv boot_openwrt 'setenv bootargs; bootm 0xbf080000'
$ setenv ramboot_openwrt 'setenv serverip 192.168.1.66;
tftpboot; bootm'
$ saveenv
5. Load OpenWrt into memory:
$ run ramboot_openwrt
Wait for the image to boot.
6. Transfer the OpenWrt sysupgrade image to the device. Write the image
to flash using sysupgrade:
$ sysupgrade -n /path/to/openwrt-sysuograde.bin
Signed-off-by: David Bauer <mail@david-bauer.net>
|