The Aruba AP-303H is the hospitality version of the Aruba AP-303 with a
POE-passthrough enabled ethernet switch instead of a sigle PHY.
Hardware
--------
SoC: Qualcomm IPQ4029
RAM: 512M DDR3
FLASH: - 128MB SPI-NAND (Macronix)
- 4MB SPI-NOR (Macronix MX25R3235F)
TPM: Atmel AT97SC3203
BLE: Texas Instruments CC2540T
attached to ttyMSM1
ETH: Qualcomm QCA8075
LED: WiFi (amber / green)
System (red / green /amber)
PSE (green)
BTN: Reset
USB: USB 2.0
To connect to the serial console, you can solder to the labled pads next
to the USB port or use your Aruba supplied UARt adapter.
Do NOT plug a standard USB cable into the Console labled USB-port!
Aruba/HPE simply put UART on the micro-USB pins. You can solder yourself
an adapter cable:
VCC - NC
D+ - TX
D- - RX
GND - GND
The console setting in bootloader and OS is 9600 8N1. Voltage level is
3.3V.
To enable a full list of commands in the U-Boot "help" command, execute
the literal "diag" command.
Installation
------------
1. Get the OpenWrt initramfs image. Rename it to ipq40xx.ari and put it
into the TFTP server root directory. Configure the TFTP server to
be reachable at 192.168.1.75/24. Connect the machine running the TFTP
server to the E0 (!) ethernet port of the access point, as it only
tries to pull from the WAN port.
2. Connect to the serial console. Interrupt autobooting by pressing
Enter when prompted.
3. Configure the bootargs and bootcmd for OpenWrt.
$ setenv bootargs_openwrt "setenv bootargs console=ttyMSM0,9600n8"
$ setenv nandboot_openwrt "run bootargs_openwrt; ubi part aos1;
ubi read 0x85000000 kernel; set fdt_high 0x87000000;
bootm 0x85000000"
$ setenv ramboot_openwrt "run bootargs_openwrt;
setenv ipaddr 192.168.1.105; setenv serverip 192.168.1.75;
netget; set fdt_high 0x87000000; bootm"
$ setenv bootcmd "run nandboot_openwrt"
$ saveenv
4. Load OpenWrt into RAM:
$ run ramboot_openwrt
5. After OpenWrt booted, transfer the OpenWrt sysupgrade image to the
/tmp folder on the device. You will need to plug into E1-E3 ports of
the access point to reach OpenWrt, as E0 is the WAN port of the
device.
6. Flash OpenWrt:
$ ubidetach -p /dev/mtd16
$ ubiformat /dev/mtd16
$ sysupgrade -n /tmp/openwrt-sysupgrade.bin
To go back to the stock firmware, simply reset the bootcmd in the
bootloader to the original value:
$ setenv bootcmd "boot"
$ saveenv
Signed-off-by: David Bauer <mail@david-bauer.net>
Hardware:
SOC: Qualcomm IPQ4018
RAM: 128 MB Nanya NT5CC64M16GP-DI
FLASH: 16 MB Macronix MX25L12805D
ETH: Qualcomm QCA8075 (4 Gigabit ports, 3xLAN, 1xWAN)
WLAN: Qualcomm IPQ4018 (2.4 & 5 Ghz)
BUTTON: Shared WPS/Reset button
LED: RGB Status/Power LED
SERIAL: Header J8 (UART, Left side of board). Numbered from
top to bottom:
(1) GND, (2) TX, (3) RX, (4) VCC (White triangle
next to it).
3.3v, 115200, 8N1
Tested/Working:
* Ethernet
* WiFi (2.4 and 5GHz)
* Status LED
* Reset Button (See note below)
Implementation notes:
* The shared WPS/Reset button is implemented as a Reset button
* I could not find a original firmware image to reverse engineer, meaning
currently it's not possible to flash OpenWrt through the Web GUI.
Installation (Through Serial console & TFTP):
1. Set your PC to fixed IP 192.168.1.12, Netmask 255.255.255.0, and connect to
one of the LAN ports
2. Rename the initramfs image to 'C0A8010B.img' and enable a TFTP server on
your pc, to serve the image
2. Connect to the router through serial (See connection properties above)
3. Hit a key during startup, to pause startup
4. type `setenv serverip 192.168.1.12`, to set the tftp server address
5. type `tftpboot`, to load the image from the laptop through tftp
6. type `bootm` to run the loaded image from memory
6. (If you want to return to stock firmware later, create an full MTD backup,
e.g. using instructions here https://openwrt.org/docs/guide-user/installation/generic.backup#create_full_mtd_backup)
7. Transfer the 'sysupgrade' OpenWrt firmware image from PC to router, e.g.:
`scp xxx-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/upgrade.bin`
8. Run sysupgrade to permanently install OpenWrt to flash: `sysupgrade -n /tmp/upgrade.bin`
Revert to stock:
To revert to stock, you need the MTD backup from step 6 above:
1. Unpack the MTD backup archive
2. Transfer the 'firmware' partition image to the router (e.g. mtd8_firmware.backup)
3. On the router, do `mtd write mtd8_firmware.backup firmware`
Signed-off-by: Tom Brouwer <tombrouwer@outlook.com>
[removed BOARD_NAME, OpenWRT->OpenWrt, changed LED device name to board name]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This patch does the following:
- move WiFi LED setup to DTS
- fix LAN/WAN MAC addresses and add label MAC address
- wan5G -> wlan5G, power -> led_power
- increase flash SPI frequency to 30MHz
MAC addresses are stored in Factory partition at:
0x1006: WiFi 2.4GHz, WAN (label_mac)
0x5006: WiFi 5GHz, LAN (label_mac +4)
By improving flash speed,
`time dd if=/dev/mtdblock8 of=/dev/null bs=2k`
is reduced from 7m 10.26s to 5m 9.52s.
Using higher frequencies did not improve speed further.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Hardware
--------
SoC: Qualcomm IPQ4029
RAM: 512M DDR3
FLASH: - 128MB NAND (Macronix MX30LF1G18AC)
- 4MB SPI-NOR (Macronix MX25R3235F)
TPM: Atmel AT97SC3203
BLE: Texas Instruments CC2540T
attached to ttyMSM0
ETH: Atheros AR8035
LED: WiFi (amber / green)
System (red / green)
BTN: Reset
To connect to the serial console, you can solder to the labled pads next
to the USB port or use your Aruba supplied UARt adapter.
Do NOT plug a standard USB cable into the Console labled USB-port!
Aruba/HPE simply put UART on the micro-USB pins. You can solder yourself
an adapter cable:
VCC - NC
D+ - TX
D- - RX
GND - GND
The console setting in bootloader and OS is 9600 8N1. Voltage level is
3.3V.
To enable a full list of commands in the U-Boot "help" command, execute
the literal "diag" command.
Installation
------------
1. Get the OpenWrt initramfs image. Rename it to ipq40xx.ari and put it
into the TFTP server root directory. Configure the TFTP server to
be reachable at 192.168.1.75/24. Connect the machine running the TFTP
server to the ethernet port of the access point.
2. Connect to the serial console. Interrupt autobooting by pressing
Enter when prompted.
3. Configure the bootargs and bootcmd for OpenWrt.
$ setenv bootargs_openwrt "setenv bootargs console=ttyMSM1,9600n8"
$ setenv nandboot_openwrt "run bootargs_openwrt; ubi part aos1;
ubi read 0x85000000 kernel; bootm 0x85000000"
$ setenv ramboot_openwrt "run bootargs_openwrt;
setenv ipaddr 192.168.1.105; setenv serverip 192.168.1.75;
netget; set fdt_high 0x87000000; bootm"
$ setenv bootcmd "run nandboot_openwrt"
$ saveenv
4. Load OpenWrt into RAM:
$ run ramboot_openwrt
5. After OpenWrt booted, transfer the OpenWrt sysupgrade image to the
/tmp folder on the device.
6. Flash OpenWrt:
$ ubidetach -p /dev/mtd1
$ ubiformat /dev/mtd1
$ sysupgrade -n /tmp/openwrt-sysupgrade.bin
To go back to the stock firmware, simply reset the bootcmd in the
bootloader to the original value:
$ setenv bootcmd "boot"
$ saveenv
Signed-off-by: David Bauer <mail@david-bauer.net>
MeshPoint.One is Wi-Fi hotspot and smart IoT gateway (based upon
Jalapeno module from 8Devices).
MeshPoint.One (https://meshpointone.com) is a unique Wi-Fi hotspot and
smart city gateway that can be installed and powered from street
lighting (even solar power in the future). MeshPoint provides up to 27
hours of interrupted Wi-Fi and IoT services from internal battery even
when external power is not available. MeshPoint.One can be used for
disaster relief efforts in order to provide instant Wi-Fi coverage that
can be easily expanded by just adding more devices that create wide area
mesh network. MeshPoint.One devices have standard Luci UI for
management.
Features:
- 1x 1Gpbs WAN
- 1x 1Gbps LAN
- POE input (eth0)
- POE output (eth1)
- Sensor for temperature, humidity and pressure (Bosch BME280)
- current, voltage and power measurement via TI INA230
- Hardware real time clock
- optional power via Li-Ion battery
- micro USB port with USB to serial chip for easy OpenWrt terminal
access
- I2C header for connecting additional sensors
Installation:
-------------
Simply flash the sysupgrade image from stock firmware.
Or use the built in Web recovery into bootloader:
Hold Reset button for 5 to 20 seconds or use UART and httpd command.
Web UI will appear on 192.168.2.100 by default.
For web recovery use the factory.ubi image.
Signed-off-by: Damir Samardzic <damir.samardzic@sartura.hr>
Signed-off-by: Damir Franusic <damir.franusic@sartura.hr>
Signed-off-by: Valent Turkovic <valent@meshpoint.me>
Signed-off-by: Robert Marko <robert@meshpoint.me>
[commit description long line wrap, usb->USB]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
This device contains 2 flash devices. One NOR (32M) and one NAND (128M).
U-boot and caldata are on the NOR, the firmware on the NAND.
SoC: IPQ4019
CPU: 4x 710MHz ARMv7
RAM: 256MB
FLASH: NOR:32MB NAND:128MB
ETH: 2x GMAC Gigabit
POE: 802.3 af/at POE, IEEE802.3af/IEEE802.3at(48-56V)
WIFI: 1x 2.4Ghz Atheros qca4019 2x2 MU-MIMO
1x 5.0Ghz Atheros qca4019 2x2 MU-MIMO
USB: 1x 3.0
PCI: 1x Mini PCIe
SIM: 1x Slot
SD: 1x MicroSD slot
BTN: Reset
LED: - Power
- Ethernet
UART: 1x Serial Port 4 Pin Connector (UART)
1x Serial Port 6 Pin Connector (High Speed UART)
POWER: 12V 2A
Installation
------------
Initial flashing can only be done via u-boot using the following commands:
tftpboot openwrt-ipq40xx-generic-compex_wpj419-squashfs-nand-factory.ubi
nand erase.chip; nand write ${fileaddr} 0x0 ${filesize}
res
Signed-off-by: Daniel Danzberger <daniel@dd-wrt.com>
Hardware
--------
SoC: Qualcomm IPQ4019
RAM: 256M DDR3
FLASH: 128M NAND
WiFi: 2T2R IPQ4019 bgn
2T2R IPQ4019 a/n/ac
ETH: Atheros AR8033 RGMII PHY
BTN: 1x Connect (WPS)
LED: Power (green/red/yellow)
Installation
------------
1. Grab the uboot for the Device from the 'u-boot-fritz1200'
subdirectory. Place it in the same directory as the 'eva_ramboot.py'
script. It is located in the 'scripts/flashing' subdirectory of the
OpenWRT tree.
2. Assign yourself the IP address 192.168.178.10/24. Connect your
Computer to one of the boxes LAN ports.
3. Connect Power to the Box. As soon as the LAN port of your computer
shows link, load the U-Boot to the box using following command.
> ./eva_ramboot.py --offset 0x85000000 192.168.178.1 uboot-fritz1200.bin
4. The U-Boot will now start. Now assign yourself the IP address
192.168.1.70/24. Copy the OpenWRT initramfs (!) image to a TFTP
server root directory and rename it to 'FRITZ1200.bin'.
5. The Box will now boot OpenWRT from RAM. This can take up to two
minutes.
6. Copy the U-Boot and the OpenWRT sysupgrade (!) image to the Box using
scp. SSH into the Box and first write the Bootloader to both previous
kernel partitions.
> mtd write /path/to/uboot-fritz1200.bin uboot0
> mtd write /path/to/uboot-fritz1200.bin uboot1
7. Remove the AVM filesystem partitions to make room for our kernel +
rootfs + overlayfs.
> ubirmvol /dev/ubi0 --name=avm_filesys_0
> ubirmvol /dev/ubi0 --name=avm_filesys_1
8. Flash OpenWRT peristently using sysupgrade.
> sysupgrade -n /path/to/openwrt-sysupgrade.bin
Signed-off-by: David Bauer <mail@david-bauer.net>
This adds a missing backslash in the caldata-extraction script. Without
this fix, caldata extraction fails for every device.
Signed-off-by: David Bauer <mail@david-bauer.net>
This commit adds support for the 32MB storage/512MB RAM version of the U4019
IPQ4019-based board from Unielec. The board has the following specifications:
* Qualcomm IPQ4019 (running at 717MHz)
* 512MB DDR3 RAM (optional 256MB/1GB)
* 32MB SPI NOR (optional 8/16MB or NAND)
* Five gigabit ports (Qualcomm QCA8075)
* 1x 2.4 GHz wifi (QCA4019 hw1.0)
* 1x 5 Ghz wifi (QCA4019 hw1.0)
* 1x mini-PCIe slot (only USB-pins connected)
* 1x SIM slot (mini-SIM)
* 1x USB2.0 port
* 1x button
* 1x controllable LED
* 1x micro SD-card reader
Working:
* Ethernet
* Wifi
* USB-port
* mini-PCIe slot + SIM slot
* Button
* Sysupgrade
Not working:
* SD card slot (no upstream support)
Installation instructions:
In order to install OpenWRT on the U4019, you need to go via the
initramfs-image. The installation steps are as follows:
* Connect to board via serial (header exposed and clearly marked).
* Interrupt bootloader by pressing a button.
* Copy the initramfs-image to your tftp folder, call the file C0A80079.img.
* Give the network interface connected to the U4019 the address
192.168.0.156/24.
* Start your tftp-server and run tftpboot on the board.
* Run bootm when the file has been transferred, to boot OpenWRT.
* Once OpenWRT has booted, copy the sysupgrade-image to the device and run
sysupgrade to install OpenWRT on the U4019.
Notes:
- Since IPQ4019 has been moved to 4.19, I have not added support for kernel
4.14.
- There is a bug with hardware encryption on IPQ4019, causing poor performance
with TCP and ipsec (see for example FS#2355). In order to improve performance,
I have disabled hardware encryption in the DTS. We can enable hw. enc. once/if
bug is fixed.
- In order for Ethernet to work, the phy has to be reset by setting gpio 47
low/high. Adding support for phy reset via gpio required patching the
mdio-driver, and the code added comes from the vendor driver. I do not know if
patching the driver is an acceptable approach or not.
v1->v2:
* Do not use wildcard as identifier in the board.d-scripts (thanks
Adrian Schmutzler).
Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
While all ath10k eeproms have a checksum field, so far two
functions for patching ath10k MAC address have been present (and
been used).
This merges code to provide a single function ath10k_patch_mac
in caldata.sh, having its name in accordance with ath9k functions.
By doing so, correct MAC patching for current and future ath10k
devices should be ensured.
This patch adds checksum adjustments for several targets on
ath79 and lantiq.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This unifies MAC address patch functions and moves them to a
common script. While those were implemented differently for
different targets, they all seem to do the same. The number of
different variants is significantly reduced by this patch.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This moves the almost identical calibration data extraction
functions present multiple times in several targets to a single
library file /lib/functions/caldata.sh.
Functions are renamed with more generic names to merge different
variants that only differ in their names.
Most of the targets used find_mtd_chardev, while some used
find_mtd_part inside the extraction code. To merge them, the more
abundant version with find_mtd_chardev is used in the common code.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
[rebase on latest master; add mpc85xx]
Signed-off-by: David Bauer <mail@david-bauer.net>
The xor() function is defined in each of the caldata extraction
scripts for several targets. Move it to functions.sh to reduce
duplicate code.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Now that $UPGRADE_BACKUP is set conditionally there is no need to check
the $UPGRADE_OPT_SAVE_CONFIG anymore. All conditions can be simplified.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
It's a variable set by procd that should replace hardcoded
/tmp/sysupgrade.tgz.
This change requires the most recent procd with the commit 0f3c136
("sysupgrade: set UPGRADE_BACKUP env variable").
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
This var has been replaced by the $UPGRADE_OPT_UPGRADE_OPT_SAVE_CONFIG
Fixes: b534ba9611 ("base-files: pass "save_config" option to the "sysupgrade" method")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
This commit made the following changes to sync all bootcount scripts:
1. use boot() instead of start()
This script only needs to be executed once when boot is complete.
use boot() to make this explicit.
2. drop sourcing of /lib/functions.sh
This is aready done in /etc/rc.common.
3. ramips: replace board name checking with a case
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
The AVM Fritz!Box 7530 (and probably other AVM IPQ4019 NAND devices)
has it's caldata not stored consistently, but instead at currently
3 known possible offsets.
As we get a non-zero exit code from fritz_cal_extract, simply try all
three possible offsets on both bootloader partitions, until a matching
caldata for each radio is found.
Reported-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: David Bauer <mail@david-bauer.net>
This changes size and offset set for WiFi caldata extraction and
MAC address adjustment to hexadecimal notation.
This will be much clearer for the reader when numbers are big, and
will also match the style used for mtd-cal-data in DTS files.
Since dd cannot deal with hexadecimal notation, one has to convert
back to decimal by simple $(($hexnum)).
Acked-by: Alexander Couzens <lynxis@fe80.eu>
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This changes the offsets for the MAC address location in
mtd_get_mac_binary* and mtd_get_mac_text to hexadecimal notation.
This will be much clearer for the reader when numbers are big, and
will also match the style used for mtd-mac-address in DTS files.
(e.g. 0x1006 and 0x5006 are much more useful than 4102 and 20486)
Acked-by: Alexander Couzens <lynxis@fe80.eu>
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
1) nand_do_upgrade() is always called by a target code
2) nand_do_upgrade() starts with calling platform_nand_pre_upgrade()
It means there is no need for the platform_nand_pre_upgrade() callback
at all. All code that was present there could bo moved & simplly called
by a target right before the nand_do_upgrade().
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
When OEM volumes are present in the [alt_]firmware partition,
sysupgrade will write a new kernel, but will fail to write
the root file system. The next boot will hang indefinitely
Waiting for root device /dev/ubiblock0_0...
Modified ipq40xx/base-files/lib/upgrade/linksys.sh
to remove both `squashfs` and `ubifs` if found
on the target firmware partition's UBI device.
Run-tested-on: Linksys EA8300
Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
[applied some shellcheck suggestions as well]
The Linksys EA8300 is based on QCA4019 and QCA9888 and provides three,
independent radios. NAND provides two, alternate kernel/firmware
images with fail-over provided by the OEM U-Boot.
Installation:
"Factory" images may be installed directly through the OEM GUI.
Hardware Highlights:
* IPQ4019 at 717 MHz (4 CPUs)
* 256 MB NAND (Winbond W29N02GV, 8-bit parallel)
* 256 MB RAM
* Three, fully-functional radios; `iw phy` reports (FCC/US, -CT):
* 2.4 GHz radio at 30 dBm
* 5 GHz radio on ch. 36-64 at 23 dBm
* 5 GHz radio on ch. 100-144 at 23 dBm (DFS), 149-165 at 30 dBm
#{ managed } <= 16, #{ AP, mesh point } <= 16, #{ IBSS } <= 1
* All two-stream, MCS 0-9
* 4x GigE LAN, 1x GigE Internet Ethernet jacks with port lights
* USB3, single port on rear with LED
* WPS and reset buttons
* Four status lights on top
* Serial pads internal (unpopulated)
"Linksys Dallas WiFi AP router based on Qualcomm AP DK07.1-c1"
Implementation Notes:
The OEM flash layout is preserved at this time with 3 MB kernel and
~69 MB UBIFS for each firmware version. The sysdiag (1 MB) and
syscfg (56 MB) partitions are untouched, available as read-only.
Serial Connectivity:
Serial connectivity is *not* required to flash.
Serial may be accessed by opening the device and connecting
a 3.3-V adapter using 115200, 8n1. U-Boot access is good,
including the ability to load images over TFTP and
either run or flash them.
Looking at the top of the board, from the front of the unit,
J3 can be found on the right edge of the board, near the rear
|
J3 |
|-| |
|O| | (3.3V seen, open-circuit)
|O| | TXD
|O| | RXD
|O| |
|O| | GND
|-| |
|
Unimplemented:
* serial1 "ttyQHS0" (serial0 works as console)
* Bluetooth; Qualcomm CSR8811 (potentially conected to serial1)
Other Notes:
https://wikidevi.com/wiki/Linksys_EA8300 states
FCC docs also cover the Linksys EA8250. According to the
RF Test Report BT BR+EDR, "All models are identical except
for the EA8300 supports 256QAM and the EA8250 disable 256QAM."
Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
Consistently handle boot-count reset and upgrade across
ipq40xx, ipq806x, kirkwood, mvebu
Dual-firmware devices often utilize a specific MTD partition
to record the number of times the boot loader has initiated boot.
Most of these devices are NAND, typically with a 2k erase size.
When this code was ported to the ipq40xx platform, the device in hand
used NOR for this partition, with a 16-byte "record" size. As the
implementation of `mtd resetbc` is by-platform, the hard-coded nature
of this change prevented proper operation of a NAND-based device.
* Unified the "NOR" variant with the rest of the Linksys variants
* Added logging to indicate success and failure
* Provided a meaningful return value for scripting
* "Protected" the use of `mtd resetbc` in start-up scripts so that
failure does not end the boot sequence
* Moved Linksys-specific actions into common `/etc/init.d/bootcount`
For upgrade, these devices need to determine which partition to flash,
as well as set certain U-Boot envirnment variables to change the next
boot to the newly flashed version.
* Moved upgrade-related environment changes out of bootcount
* Combined multiple flashes of environment into single one
* Current-partition detection now handles absence of `boot_part`
Runtime-tested: Linksys EA8300
Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
[checkpatch.pl fixes, traded split strings for 80+ chars per line]
Hardware
--------
CPU: Qualcomm IPQ4018
RAM: 256M
FLASH: 32M SPI NOR W25Q256
ETH: QCA8075
WiFi2: IPQ4018 2T2R 2SS b/g/n
WiFi5: IPQ4018 2T2R 2SS n/ac
LED: - Power amber
- LAN1(PoE) green
- LAN2 green
- Wi-Fi 2.4GHz green
- Wi-Fi 5GHz green
BTN: - WPS
UART: 115200n8 3.3V J1
VCC(1) - GND(2) - TX(3) - RX(4)
Added basic support to get the device up and running for a sysupgrade
image only.
There is currently no way back to factory firmware, so this is a one-way
street to OpenWRT.
Install from factory condition is convoluted, and may brick your device:
1) Enable SSH and disable the CLI on the factory device from the web user
interface (Management->Advanced)
2) Reboot the device
3) Override the default, limited SSH shell:
a) Get into the ssh shell:
ssh admin@192.168.1.1 /bin/sh --login
b) Change the dropbear script to disable the limited shell. At the
empty command prompt type:
sed -i '/login_ssh/s/^/#/g’ dropbear
/etc/init.d/dropbear restart
exit
4) ssh in to a (now-) normal OpenWRT SSH session
5) Flash your built image
a) scp openwrt-ipq40xx-engenius_ens620ext-squashfs-sysupgrade.bin
admin@192.168.1.1:/tmp/
b) ssh admin@192.168.1.1
c) sysupgrade -n
/tmp/openwrt-ipq40xx-engenius_ens620ext-squashfs-sysupgrade.bin
6) After flash completes (it may say "Upgrade failed" followed by
"Upgrade completed") and device reboots, log in to newly flashed
system. Note you will now need to ssh as root rather than admin.
Signed-off-by: Steve Glennon <s.glennon@cablelabs.com>
[whitespace fixes, reordered partitions, removed rng node from 4.14,
fixed 901-arm-boot-add-dts-files.patch]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Hardware
--------
CPU: Qualcomm IPQ4019
RAM: 256M (NANYA NT5CC128M16JR-EK)
FLASH: 128M NAND (Macronix MX30LF1G18AC-XKI)
ETH: Qualcomm QCA8072
WiFi2: IPQ4019 2T2R 2SS b/g/n
WiFi5: IPQ4019 2T2R 2SS n/ac
WiFi5: QCA9984 4T4R 4SS n/ac
LED: - Connect green/blue/red
- Power green
BTN: WPS/Connect
UART: 115200n8 3.3V
VCC - RX - TX - GND (Square is VCC)
Installation
------------
1. Grab the uboot for the Device from the 'u-boot-fritz3000'
subdirectory. Place it in the same directory as the 'eva_ramboot.py'
script. It is located in the 'scripts/flashing' subdirectory of the
OpenWRT tree.
2. Assign yourself the IP address 192.168.178.10/24. Connect your
Computer to one of the boxes LAN ports.
3. Connect Power to the Box. As soon as the LAN port of your computer
shows link, load the U-Boot to the box using following command.
> ./eva_ramboot.py --offset 0x85000000 192.168.178.1 uboot-fritz3000.bin
4. The U-Boot will now start. Now assign yourself the IP address
192.168.1.70/24. Copy the OpenWRT initramfs (!) image to a TFTP
server root directory and rename it to 'FRITZ3000.bin'.
5. The Box will now boot OpenWRT from RAM. This can take up to two
minutes.
6. Copy the U-Boot and the OpenWRT sysupgrade (!) image to the Box using
scp. SSH into the Box and first write the Bootloader to both previous
kernel partitions.
> mtd write /path/to/uboot-fritz3000.bin uboot0
> mtd write /path/to/uboot-fritz3000.bin uboot1
7. Remove the AVM filesystem partitions to make room for our kernel +
rootfs + overlayfs.
> ubirmvol /dev/ubi0 --name=avm_filesys_0
> ubirmvol /dev/ubi0 --name=avm_filesys_1
8. Flash OpenWRT peristently using sysupgrade.
> sysupgrade -n /path/to/openwrt-sysupgrade.bin
Signed-off-by: David Bauer <mail@david-bauer.net>
Hardware
--------
CPU: Qualcomm IPQ4019
RAM: 256M
FLASH: 128M NAND
ETH: QCA8075
VDSL: Intel/Lantiq VRX518 PCIe attached
currently not supported
DECT: Dialog SC14448
currently not supported
WiFi2: IPQ4019 2T2R 2SS b/g/n
WiFi5: IPQ4019 2T2R 2SS n/ac
LED: - Power/DSL green
- WLAN green
- FON/DECT green
- Connect/WPS green
- Info green
- Info red
BTN: - WLAN
- FON
- WPS/Connect
UART: 115200n8 3.3V (located under the Dialog chip)
VCC - RX - TX - GND (Square is VCC)
Installation
------------
1. Grab the uboot for the Device from the 'u-boot-fritz7530'
subdirectory. Place it in the same directory as the 'eva_ramboot.py'
script. It is located in the 'scripts/flashing' subdirectory of the
OpenWRT tree.
2. Assign yourself the IP address 192.168.178.10/24. Connect your
Computer to one of the boxes LAN ports.
3. Connect Power to the Box. As soon as the LAN port of your computer
shows link, load the U-Boot to the box using following command.
> ./eva_ramboot.py --offset 0x85000000 192.168.178.1 uboot-fritz7530.bin
4. The U-Boot will now start. Now assign yourself the IP address
192.168.1.70/24. Copy the OpenWRT initramfs (!) image to a TFTP
server root directory and rename it to 'FRITZ7530.bin'.
5. The Box will now boot OpenWRT from RAM. This can take up to two
minutes.
6. Copy the U-Boot and the OpenWRT sysupgrade (!) image to the Box using
scp. SSH into the Box and first write the Bootloader to both previous
kernel partitions.
> mtd write /path/to/uboot-fritz7530.bin uboot0
> mtd write /path/to/uboot-fritz7530.bin uboot1
7. Remove the AVM filesystem partitions to make room for our kernel +
rootfs + overlayfs.
> ubirmvol /dev/ubi0 --name=avm_filesys_0
> ubirmvol /dev/ubi0 --name=avm_filesys_1
8. Flash OpenWRT peristently using sysupgrade.
> sysupgrade -n /path/to/openwrt-sysupgrade.bin
Signed-off-by: David Bauer <mail@david-bauer.net>
[removed pcie-dts range node, refreshed on top of AP120-AC/E2600AC]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Qxwlan E2600AC C1 based on IPQ4019
Specifications:
SOC: Qualcomm IPQ4019
DRAM: 256 MiB
FLASH: 32 MiB Winbond W25Q256
ETH: Qualcomm QCA8075
WLAN: 5G + 5G/2.4G
* 2T2R 2.4/5 GHz
- QCA4019 hw1.0 (SoC)
* 2T2R 5 GHz
- QCA4019 hw1.0 (SoC)
INPUT: Reset buutton
LED: 1x Power ,6 driven by gpio
SERIAL: UART (J5)
UUSB: USB3.0
POWER: 1x DC jack for main power input (9-24 V)
SLOT: Pcie (J25), sim card (J11), SD card (J51)
Flash instruction (using U-Boot CLI and tftp server):
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "sysupgrade" filename to "firmware.bin" and place it in tftp
server directory.
- Connect PC with one of RJ45 ports, power up the board and press
"enter" key to access U-Boot CLI.
- Use the following command to update the device to OpenWrt: "run lfw".
Flash instruction (using U-Boot web-based recovery):
- Configure PC with static IP 192.168.1.xxx(2-254)/24.
- Connect PC with one of RJ45 ports, press the reset button, power up
the board and keep button pressed for around 6-7 seconds, until LEDs
start flashing.
- Open your browser and enter 192.168.1.1, select "sysupgrade" image
and click the upgrade button.
Qxwlan E2600AC C2 based on IPQ4019
Specifications:
SOC: Qualcomm IPQ4019
DRAM: 256 MiB
NOR: 16 MiB Winbond W25Q128
NAND: 128MiB Micron MT29F1G08ABAEAWP
ETH: Qualcomm QCA8075
WLAN: 5G + 5G/2.4G
* 2T2R 2.4/5 GHz
- QCA4019 hw1.0 (SoC)
* 2T2R 5 GHz
- QCA4019 hw1.0 (SoC)
INPUT: Reset buutton
LED: 1x Power, 6 driven by gpio
SERIAL: UART (J5)
USB: USB3.0
POWER: 1x DC jack for main power input (9-24 V)
SLOT: Pcie (J25), sim card (J11), SD card (J51)
Flash instruction (using U-Boot CLI and tftp server):
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "ubi" filename to "ubi-firmware.bin" and place it in tftp
server directory.
- Connect PC with one of RJ45 ports, power up the board and press
"enter" key to access U-Boot CLI.
- Use the following command to update the device to OpenWrt: "run lfw".
Flash instruction (using U-Boot web-based recovery):
- Configure PC with static IP 192.168.1.xxx(2-254)/24.
- Connect PC with one of RJ45 ports, press the reset button, power up
the board and keep button pressed for around 6-7 seconds, until LEDs
start flashing.
- Open your browser and enter 192.168.1.1, select "ubi" image
and click the upgrade button.
Signed-off-by: 张鹏 <sd20@qxwlan.com>
[ added rng node. whitespace fixes, ported 02_network,
ipq-wifi Makefile, misc dts fixes, trivial message changes ]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
ALFA Network AP120C-AC is a dual-band ceiling AP, based on Qualcomm
IPQ4018 + QCA8075 platform.
Specification:
- Qualcomm IPQ4018 (717 MHz)
- 256 MB of RAM (DDR3)
- 16 MB (SPI NOR) + 128 MB (SPI NAND) of flash
- 2x Gbps Ethernet, with 802.3af PoE support in one port
- 2T2R 2.4/5 GHz (IPQ4018), with ext. FEMs (QFE1952, QFE1922)
- 3x U.FL connectors
- 1x 1.8 dBi (Bluetooth) and 2x 3/5 dBi dual-band (Wi-Fi) antennas
- Atmel/Microchip AT97SC3205T TPM module (I2C bus)
- TI CC2540 Bluetooth LE module (USB 2.0 bus)
- 4x LED (all driven by GPIO)
- 1x button (reset)
- 1x USB 2.0 (optional, not installed in indoor version)
- DC jack for main power input (12 V)
- UART header available on PCB (2.0 mm pitch)
Flash instruction:
1. This board uses dual-image feature (128 MB NAND is divided into two
64 MB partitions: 'rootfs1' and 'rootfs2').
2. Before update, make sure your device is running firmware no older
than v1.1 (previous versions have incompatible U-Boot).
3. Use 'factory' image in vendor GUI or for sysupgrade tool, without
preserving settings.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Reading and writing to and from flash storage is slow and currently,
the ath10kcal_extract() scripts are even more at an disadvantage
because they use a block size of 1 to be able skip.
This patch reworks the extraction scripts to be much faster and
efficient by reading and writing the calibration data in possibly
one big block.
before: (Tested on a RT-AC58U, which has SPI-NAND).
# time dd if=/dev/ubi0_1 of=/lib/firmware/... bs=1 skip=4096 count=12064
12064+0 records in
12064+0 records out
real 0m 0.28s
user 0m 0.02s
sys 0m 0.24s
after:
# time dd if=/dev/ubi0_1 of=/lib/firmware/... bs=12064 skip=4096 count=1 iflag=skip_bytes
1+0 records in
1+0 records out
real 0m 0.01s
user 0m 0.00s
sys 0m 0.00s
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This commit fixes the script that sets the MAC address of the LAN
switch. The LAN MAC address should be the WAN MAC address plus one.
Without this patch the WAN and the LAN interface will use the same
MAC address and an error will be generated.
With this patch all interfaces will have a different MAC address,
consecutive in the following order: WAN, LAN, radio0 and radio1.
Signed-off-by: Oever González <notengobattery@gmail.com>
SoC: Qualcomm IPQ4019 (Dakota) 717 MHz, 4 cores
RAM: 256 MiB (Nanya NT5CC128M16IP-DI)
FLASH: 128 MiB (Macronix NAND)
WiFi0: Qualcomm IPQ4019 b/g/n 2x2
WiFi1: Qualcomm IPQ4019 a/n/ac 2x2
WiFi2: Qualcomm Atheros QCA9886 a/n/ac
BT: Atheros AR3012
IN: WPS Button, Reset Button
OUT: RGB-LED via TI LP5523 9-channel Controller
UART: Front of Device - 115200 N-8
Pinout 3.3v - RX - TX - GND (Square is VCC)
Installation:
1. Transfer OpenWRT-initramfs image to the device via SSH to /tmp.
Login credentials are identical to the Web UI.
2. Login to the device via SSH.
3. Flash the initramfs image using
> mtd-write -d linux -i openwrt-image-file
4. Power-cycle the device and wait for OpenWRT to boot.
5. From there flash the OpenWRT-sysupgrade image.
Ethernet-Ports: Although labeled identically, the port next to
the power socket is the LAN port and the other one is WAN. This
is the same behavior as in the stock firmware.
Signed-off-by: Marius Genheimer <mail@f0wl.cc>
[Dropped setup_mac 02_network in favour of 05_set_iface_mac_ipq40xx.sh,
reorderd 02_network entries, added board.bin WA for the QCA9886 from ath79,
minor dts touchup, added rng to 4.19 dts]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This patch fixes the ASUS' RT-AC58U port order by
unifying the configuration with the NBG6617.
Reported-by: Roberto Socrates (rtac58u-user on the forum)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This patch splits the big board case switch in 02_network in
two functions ipq40xx_setup_interfaces() and ipq40xx_setup_macs()
just like ath79 and ramips do.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Specifications:
SOC: Qualcomm IPQ4018
RAM: 256 MiB Samsung K4B2G1646F-BYK0
FLASH1: MX25L1605D 2 MB
FLASH2: Winbond W25N01GV 128Mb
ETH: Qualcomm QCA8075
WLAN0: Qualcomm Atheros QCA4018 2.4GHz 802.11b/g/n 2x2
WLAN1: Qualcomm Atheros QCA4018 5GHz 802.11n/ac W2 2x2
INPUT: WPS, Reset
LED: Status - Green
SERIAL: Header at J19, Beneath DC Power Jack
1-VCC ; 2-TX ; 3-RX; 4-GND;
Serial 115200-8-N-1.
Tested and working:
- USB (requires extra packages)
- LAN Ethernet (Correct MAC-address)
- WAN Ethernet (Correct MAC-address)
- 2.4 GHz WiFi (Correct MAC-address)
- 5 GHz WiFi (Correct MAC-address)
- Factory installation from Web UI
- OpenWRT sysupgrade
- LED
- Reset Button
Need Testing:
- WPS button
Install via Web UI:
- Attach to a LAN port on the router.
- Connect to the Linksys Smart WiFi Page (default 192.168.1.1) and login
- Select the connectivity tab on the left
- In the manual update box on the right
- Select browse, and browse to
openwrt-ipq40xx-linksys_ea6350v3-squashfs-factory.bin
- Click update.
- Read and accept the warning
- The router LED will start blinking. When the router LED goes solid, you
can now navigate to 192.168.1.1 to your new OpenWrt installation.
Sysupgrade:
- Flash the sysupgrade image as usual. Please: try to do a reset everytime
you can (doing it with LuCI is easy and can be done in the same step).
Recovery (Automatic):
- If the device fails to boot after install or upgrade, whilst the unit is
turned on:
1 - Wait 15 seconds
2 - Switch Off and Wait 10 seconds
3 - Switch on
4 - Repeat steps 1 to 3, 3 times then go to 5.
5 - U-boot will have now erased the failed update and switched back to the
last working firmware - you should be able to access your router on
LAN.
Recovery (Manual):
- The steps for manual recovery are the same as the generic u-boot tftp
client method.
Back To Stock:
- Use the generic recovery using the tftp client method to flash the
"civic.img". Also you can strip-and-pad the original image and use
the generic "mtd" method by flashing over the "kernel" partition.
* Just be careful to flash in the partition that the device is currently
booted.
Signed-off-by: Ryan Pannell <ryan@osukl.com>
Signed-off-by: Oever González <notengobattery@gmail.com>
[minor edits, removed second compatible of nand, added dtb entry to 4.19]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This removes the misplaced UCI-network configuration for the MR33. The
LAN port is set in 01_leds while it is already correctly defined in
02_network.
This was most likely an oversight as no network configuration belongs
into 01_leds.
Signed-off-by: David Bauer <mail@david-bauer.net>
Thanks to the ledtrig-usb.c the USB LED trigger can be
setup in the device-tree definition for the Asus RT-AC58U
and ZyXEL NBG6617.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
In the thread: "ipq806x: add ath10k calibration data MAC addresses patching"
Chuanhong Guo <gch981213@gmail.com> noted that:
"All ath10k calibration data have a checksum at 0x2.
ath10kcal_patch_mac works for QCA9880/QCA9882 only because
the ath10k firmware for these two chips doesn't check the
checksum value. (QCA proprietary driver checks this and
refuses to use caldata with incorrect checksum.)"
This patch updates 11-ath10k-caldata of the ipq40xx target accordingly.
Reported-by: Chuanhong Guo <gch981213@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
I wanted to add status LEDs support to my imx6 based board and have found out,
that I could use diag.sh script found in ramips platform, which seems to be
also shared in a few other platforms:
4801276bc2078c5bcf03003c831e3b0a target/linux/ramips/base-files/etc/diag.sh
4801276bc2078c5bcf03003c831e3b0a target/linux/ipq40xx/base-files/etc/diag.sh
4801276bc2078c5bcf03003c831e3b0a target/linux/ath79/base-files/etc/diag.sh
And @chunkeey suggested to me, that I can also add lantiq, ipq806x and
apm821xx to the list of platforms which could share this generic
diag.sh.
I've extended the base diag.sh in a way, that if it detects any of the
DTS LED aliases, then it would use the generic DTS set_led_state code.
The code in platform's diag.sh has moved to base-files package in this
commit:
base-files: diag.sh: Make it more generic towards DTS so it could be reused
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Tested-by: Christian Lamparter <chunkeey@gmail.com> (apm821xx and ipq40xx)
The tar extraction depends on the order in which the files
are added to the tar file. Since the order is not guaranteed
and depends on the host system, the combined mtd write fails
with sysupgrade images built on some systems.
Fix by changing to tar file order independent mtd write.
Fixes: 86e18f6706 ("ipq806x: add support for OpenMesh A42")
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
SOC: IPQ4018 / QCA Dakota
CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7
DRAM: 256 MiB
NOR: 32 MiB
ETH: Qualcomm Atheros QCA8072
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
INPUT: RESET Button
LEDS: Power, LAN, MESH, WLAN 2.4GHz, WLAN 5GHz
1. Load Ramdisk via U-Boot
To set up the flash memory environment, do the following:
a. As a preliminary step, ensure that the board console port is connected to the PC using these RS232 parameters:
* 115200bps
* 8N1
b. Confirm that the PC is connected to the board using one of the Ethernet ports. Set a static ip 192.168.99.8 for Ethernet that connects to board. The PC must have a TFTP server launched and listening on the interface to which the board is connected. At this stage power up the board and, after a few seconds, press 4 and then any key during the countdown.
U-BOOT> set serverip 192.168.99.8 && set ipaddr 192.168.99.9 && tftpboot 0x84000000 openwrt.itb && bootm
2. Load image via GUI
a. Upgrade EAP1300 to FW v3.5.3.2
In the GUI, System Manager > Firmware > Firmware Upgrade, to do upgrade.
b. Transfer to OpenWrt from EnGenius.
In Firmware Upgrade page, to upgrade yours openwrt-ipq40xx-engenius_eap1300-squashfs-sysupgrade.bin.
3. Revert to EnGenius EAP1300
To flash openwrt-ipq40xx-engenius_eap1300-squashfs-factory.bin by using sysupgrade command and "DO NOT" keep configuration.
$ sysupgrade –n openwrt-ipq40xx-engenius_eap1300-squashfs-factory.bin
Signed-off-by: Steven Lin <steven.lin@senao.com>
The NBG6617's LEDs are wrongly identified in the 01_leds boardinit
script (board instead of boardname), resulting in referencing
non-existent LEDs in UCI.
Signed-off-by: David Bauer <mail@david-bauer.net>
The sysupgrade_pre_upgrade hook was removed with 5e1b4c57de ("base-files:
drop fwtool_pre_upgrade") while there were still scripts using it:
* target/linux/ar71xx/base-files/lib/upgrade/allnet.sh
* target/linux/ar71xx/base-files/lib/upgrade/openmesh.sh
* target/linux/ipq40xx/base-files/lib/upgrade/openmesh.sh
Not running the hooks can either prevent a successful upgrade or brick the
device because the fw_setenv program cannot be started correctly.
Instead of adding this hook again, the directory /var/lock for fw_setenv
can also just be created directly before fw_setenv is called.
Fixes: 5e1b4c57de ("base-files: drop fwtool_pre_upgrade")
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
The upgrade led is only used if a running led is defined. If no running
led is defined, the upgrade led is ignored and upgrade isn't indicated
at all.
Instead, turn off the running led prior to turning the upgrade led on.
In most cases there isn't any visual change, but it allows to use an
independent led for upgrade indication.
Signed-off-by: Mathias Kresin <dev@kresin.me>
Set the (sys)upgrade state when sourcing the stage2 script instead of
setting the state for each target individual.
This change fixes the, due to a missing state set, not working upgrade
led on ath79 and apm821xx.
Signed-off-by: Mathias Kresin <dev@kresin.me>
This patch adds support for ZyXEL NBG6617
Hardware highlights:
SOC: IPQ4018 / QCA Dakota
CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7
DRAM: 256 MiB DDR3L-1600/1866 Nanya NT5CC128M16IP-DI @ 537 MHz
NOR: 32 MiB Macronix MX25L25635F
ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN)
USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC)
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
INPUT: RESET Button, WIFI/Rfkill Togglebutton, WPS Button
LEDS: Power, WAN, LAN 1-4, WLAN 2.4GHz, WLAN 5GHz, USB, WPS
Serial:
WARNING: The serial port needs a TTL/RS-232 3.3v level converter!
The Serial setting is 115200-8-N-1. The 1x4 .1" header comes
pre-soldered. Pinout:
1. 3v3 (Label printed on the PCB), 2. RX, 3. GND, 4. TX
first install / debricking / restore stock:
0. Have a PC running a tftp-server @ 192.168.1.99/24
1. connect the PC to any LAN-Ports
2. put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file
into the tftp-server root directory and rename it to just "ras.bin".
3. power-cycle the router and hold down the the WPS button (for 30sek)
4. Wait (for a long time - the serial console provides some progress
reports. The u-boot says it best: "Please be patient".
5. Once the power LED starts to flashes slowly and the USB + WPS LEDs
flashes fast at the same time. You have to reboot the device and
it should then come right up.
Installation via Web-UI:
0. Connect a PC to the powered-on router. It will assign your PC a
IP-address via DHCP
1. Access the Web-UI at 192.168.1.1 (Default Passwort: 1234)
2. Go to the "Expert Mode"
3. Under "Maintenance", select "Firmware-Upgrade"
4. Upload the OpenWRT factory image
5. Wait for the Device to finish.
It will reboot into OpenWRT without any additional actions needed.
To open the ZyXEL NBG6617:
0. remove the four rubber feet glued on the backside
1. remove the four philips screws and pry open the top cover
(by applying force between the plastic top housing from the
backside/lan-port side)
Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
|NBG6617> HELP
|ATEN x[,y] set BootExtension Debug Flag (y=password)
|ATSE x show the seed of password generator
|ATSH dump manufacturer related data in ROM
|ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO boot up whole system
|ATUR x upgrade RAS image (filename)
|NBG6617>
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
|NBG6617> ATSE NBG6617
|012345678901
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711
copy and paste the result into the shell to unlock zloader.
|NBG6617> ATEN 1,0046B0017430
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
|NBG6617> ATGU
|NBG6617#
Co-authored-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: David Bauer <mail@david-bauer.net>
Specifications:
SOC: Qualcomm IPQ4018 (DAKOTA) ARM Quad-Core
RAM: 128 MB Nanya NT5CC64M16GP-DI
FLASH: 16 MiB Macronix MX25L12845EMI-12G
ETH: Qualcomm QCA8072
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11b/g/n 2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11n/ac W2 2x2
INPUT: WPS, Mode-toggle-switch
LED: Power, WLAN 2.4GHz, WLAN 5GHz, LAN, WPS
(LAN not controllable by software)
(WLAN each green / red)
SERIAL: Header next to eth-phy.
VCC, TX, GND, RX (Square hole is VCC)
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet (Correct MAC-address)
- 2.4 GHz WiFi (Correct MAC-address)
- 5 GHz WiFi (Correct MAC-address)
- Factory installation from tftp
- OpenWRT sysupgrade
- LEDs
- WPS Button
Not Working:
- Mode-toggle-switch
Install via TFTP:
Connect to the devices serial. Hit Enter-Key in bootloader to stop
autobooting. Command `tftpboot` will pull an initramfs image named
`C0A86302.img` from a tftp server at `192.168.99.08/24`.
After successfull transfer, boot the image with `bootm`.
To persistently write the firmware, flash an openwrt sysupgrade image
from inside the initramfs, for example transfer
via `scp <sysupgrade> root@192.168.1.1:/tmp` and flash on the device
with `sysupgrade -n /tmp/<sysupgrade>`.
append-cmdline patch taken from chunkeeys work on the NBG6617.
Signed-off-by: Magnus Frühling <skorpy@frankfurt.ccc.de>
Co-authored-by: David Bauer <mail@david-bauer.net>
Co-authored-by: Christian Lamparter <chunkeey@googlemail.com>
This commit adds the get_status_led method to diag.sh, which sets the
boot-led as status-led for scripts using this method to get a
status-led.
This method is used platform-independent in downstream project gluon to
set the LED used to indicate the config-mode.
Signed-off-by: David Bauer <mail@david-bauer.net>
* QCA IPQ4019
* 256 MB of RAM
* 32 MB of SPI NOR flash (s25fl256s1)
- 2x 15 MB available; but one of the 15 MB regions is the recovery image
* 2T2R 2.4 GHz
- QCA4019 hw1.0 (SoC)
- requires special BDF in QCA4019/hw1.0/board-2.bin with
bus=ahb,bmi-chip-id=0,bmi-board-id=20,variant=OM-A62
* 2T2R 5 GHz (channel 36-64)
- QCA9888 hw2.0 (PCI)
- requires special BDF in QCA9888/hw2.0/board-2.bin
bus=pci,bmi-chip-id=0,bmi-board-id=16,variant=OM-A62
* 2T2R 5 GHz (channel 100-165)
- QCA4019 hw1.0 (SoC)
- requires special BDF in QCA4019/hw1.0/board-2.bin with
bus=ahb,bmi-chip-id=0,bmi-board-id=21,variant=OM-A62
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x button (reset; kmod-input-gpio-keys compatible)
* external watchdog
- triggered GPIO
* 1x USB (xHCI)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x gigabit ethernet
- phy@mdio3:
+ Label: Ethernet 1
+ gmac0 (ethaddr) in original firmware
+ 802.3at POE+
- phy@mdio4:
+ Label: Ethernet 2
+ gmac1 (eth1addr) in original firmware
+ 18-24V passive POE (mode B)
* powered only via POE
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the factory image to the u-boot when the device boots up.
The initramfs image can be started using
setenv bootargs 'loglevel=8 earlycon=msm_serial_dm,0x78af000 console=ttyMSM0,115200 mtdparts=spi0.0:256k(0:SBL1),128k(0:MIBIB),384k(0:QSEE),64k(0:CDT),64k(0:DDRPARAMS),64k(0:APPSBLENV),512k(0:APPSBL),64k(0:ART),64k(0:custom),64k(0:KEYS),15552k(inactive),15552k(inactive2)'
tftpboot 0x84000000 openwrt-ipq40xx-openmesh_a62-initramfs-fit-uImage.itb
set fdt_high 0x85000000
bootm 0x84000000
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Specifications:
SOC: Qualcomm IPQ4018 (DAKOTA) ARM Quad-Core
RAM: 256 MB Winbond W632GU6KB12J
FLASH: 16 MiB Macronix MX25L12805D
ETH: Qualcomm QCA8072
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11b/g/n/ac 2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11n/ac
1x1 (EX6100)
2x2 (EX6150)
INPUT: Power, WPS, reset button
AP / Range-extender toggle
LED: Power, Router, Extender (dual), WPS, Left-/Right-arrow
SERIAL: Header next to QCA8072 chip.
VCC, TX, RX, GND (Square hole is VCC)
WARNING: The serial port needs a TTL/RS-232 v3.3 level converter!
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet
- 2.4 GHz WiFi (Correct MAC-address)
- 5 GHz WiFi (Correct MAC-address)
- Factory installation from WebIF
- Factory installation from tftp
- OpenWRT sysupgrade (Preserving and non-preserving)
- LEDs
- Buttons
Not Working:
- AP/Extender toggle-switch
Untested:
- Support on EX6100v2. They share the same GPL-Code and vendor-images.
The 6100v2 seems to lack one 5GHz stream and differs in the 5GHz
board-blob. I only own a EX6150v2, therefore i am only able to verify
functionality on this device.
Install via Web-Interface:
Upload the factory image to the device to the Netgear Web-Interface.
The device might asks you to confirm the update a second time due to
detecting the OpenWRT firmware as older. The device will automatically
reboot after the image is written to flash.
Install via TFTP:
Connect to the devices serial. Hit Enter-Key in bootloader to stop
autobooting. Command "fw_recovery" will start a tftp server, waiting for
a DNI image to be pushed.
Assign your computer the IP-address 192.168.1.10/24. Push image with
tftp -4 -v -m binary 192.168.1.1 -c put <OPENWRT_FACTORY>
Device will erase factory-partition first, then writes the pushed image
to flash and reboots.
Parts of this commit are based on Thomas Hebb's work on the
openwrt-devel mailinglist.
See https://lists.openwrt.org/pipermail/openwrt-devel/2018-January/043418.html
Signed-off-by: David Bauer <mail@david-bauer.net>
This patch adds support for 8devices Jalapeno.
Specification:
QCA IPQ4018, Quad core ARM v7 Cortex A7 717MHz
256 MB of DDR3 RAM
8 MB of SPI NOR flash
128 MB of Winbond SPI NAND flash
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
requires special BDF in QCA4019/hw1.0/board-2.bin with:
bus=ahb,bmi-chip-id=0,bmi-board-id=16,variant=8devices-Jalapeno
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
requires special BDF in QCA4019/hw1.0/board-2.bin with:
bus=ahb,bmi-chip-id=0,bmi-board-id=17,variant=8devices-Jalapeno
ETH: Qualcomm Atheros QCA8072 Gigabit Switch (1 x LAN, 1 x WAN)
phy@mdio3:
Label: eth0
gmac0
phy@mdio4:
Label: eth1
gmac1
Installation instructions:
Since boards ship with old version of LEDE installation is simple.
Just use sysupgrade -n -F sysupgrade.bin
Syuspgrade needs to be forced since OpenWRT uses DT detection in recent
releases.
If you get error that FIT configuration is not found during boot it is
due to older U-boot used on your board.
That is because 8devices used custom FIT configuration partition name
as they internally had v1 and v2 boards.
Only v2 boards are sold so now they are shipping boards with never
U-boot using generic config@1 FIT partition name.
Also for old uboot it is possible to force loading config@1 by changing
uboot environment:
setenv boot5 'bootm 0x84000000#config@1’
saveenv
Signed-off-by: Robert Marko <robimarko@gmail.com>
* QCA IPQ4028
* 256 MB of RAM
* 32 MB of SPI NOR flash (mx25l25635e)
* 128 MB of SPI NAND flash (gd5f1gq4ucy1g)
* 2T2R 2.4 GHz
- QCA4019 hw1.0 (SoC)
- uses AP-DK03 BDF from QCA4019/hw1.0/board-2.bin
* 2T2R 5 GHz
- QCA4019 hw1.0 (SoC)
- uses AP-DK03 BDF from QCA4019/hw1.0/board-2.bin
* 2 fully software controllable GPIO-LEDs
* 2 additional GPIO-LEDs which also affect the SIM card detection
* 1x button (reset)
* 1x GPIO buzzer
* 1x USB (xHCI)
* 1x NGFF (USB-only with Dual-SIM support, untested)
* TTL pins are on board (R124 is next to GND, then follows: RX, TX, VCC)
* 2x gigabit ethernet
- phy@mdio4:
+ Manual: Ethernet port 0
+ gmac0 (ethaddr) in original firmware
+ 802.3af POE (HV version)
+ 24v passive POE (LV version)
- phy@mdio3:
+ Manual: Ethernet port 1
+ gmac1 (eth1addr) in original firmware
* DC Jack connector
+ 24-56V (HV version)
+ 12-24V (LV version)
The SPI NAND flash isn't supported at the moment.
The bootloader has to be updated before OpenWrt is installed to fix a
reboot problem. The nor-ipq40xx-single.img from
https://downloads.compex.com.sg/?dir=uploads/QSDK/QCA-Reference/WPJ428/b170123-IPQ40xx-Reference-Firmware
has to be downloaded and the transfered in u-boot via TFTP
set ipaddr 192.168.1.11
set serverip 192.168.1.10
ping ${serverip}
tftpboot 0x84000000 nor-ipq40xx-single.img
imgaddr=0x84000000 && source $imgaddr:script
The sysupgrade image can be installed directly on flash using u-boot:
sf probe
tftpboot 0x84000000 openwrt-ipq40xx-compex_wpj428-squashfs-sysupgrade.bin
sf erase 0x00180000 +$filesize
sf write 0x84000000 0x00180000 $filesize
bootipq
The initramfs image can be started using
tftpboot 0x82000000 openwrt-ipq40xx-compex_wpj428-initramfs-fit-uImage.itb
set fdt_high 0x83000000
bootm 0x82000000
The used SIM card slot can be changed using
# slot 1 (also enables orange LED)
echo 1 > /sys/class/gpio/gpio3/value
# slot 2
echo 0 > /sys/class/gpio/gpio3/value
It can be checked whether a SIM card is inserted in the current slot and
the red LED is subsequently on via:
echo 2 > /sys/class/gpio/export
cat /sys/class/gpio/gpio2/value
Signed-off-by: Sven Eckelmann <sven@narfation.org>
This patch adds support for Cisco Meraki MR33
hardware highlights:
SOC: IPQ4029 Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7
DRAM: 256 MiB DDR3L-1600 @ 627 MHz Micron MT41K128M16JT-125IT
NAND: 128 MiB SLC NAND Spansion S34ML01G200TFV00 (106 MiB usable)
ETH: Qualcomm Atheros AR8035 Gigabit PHY (1 x LAN/WAN) + PoE
WLAN1: QCA9887 (168c:0050) PCIe 1x1:1 802.11abgn ac Dualband VHT80
WLAN2: Qualcomm Atheros QCA4029 2.4GHz 802.11bgn 2:2x2
WLAN3: Qualcomm Atheros QCA4029 5GHz 802.11a/n/ac 2:2x2 VHT80
LEDS: 1 x Programmable RGB+White Status LED (driven by Ti LP5562 on i2c-1)
1 x Orange LED Fault Indicator (shared with LP5562)
2 x LAN Activity / Speed LEDs (On the RJ45 Port)
BUTTON: one Reset button
MISC: Bluetooth LE Ti cc2650 PG2.3 4x4mm - BL_CONFIG at 0x0001FFD8
AT24C64 8KiB EEPROM
Kensington Lock
Serial:
WARNING: The serial port needs a TTL/RS-232 3V3 level converter!
The Serial setting is 115200-8-N-1. The board has a populated
1x4 0.1" header with half-height/low profile pins.
The pinout is: VCC (little white arrow), RX, TX, GND.
Flashing needs a serial adaptor, as well as patched ubootwrite utility
(needs Little-Endian support). And a modified u-boot (enabled Ethernet).
Meraki's original u-boot source can be found in:
<https://github.com/riptidewave93/meraki-uboot/tree/mr33-20170427>
Add images to do an installation via bootloader:
0. open up the MR33 and connect the serial console.
1. start the 2nd stage bootloader transfer from client pc:
# ubootwrite.py --write=mr33-uboot.bin
(The ubootwrite tool will interrupt the boot-process and hence
it needs to listen for cues. If the connection is bad (due to
the low-profile pins), the tool can fail multiple times and in
weird ways. If you are not sure, just use a terminal program
and see what the device is doing there.
2. power on the MR33 (with ethernet + serial cables attached)
Warning: Make sure you do this in a private LAN that has
no connection to the internet.
- let it upload the u-boot this can take 250-300 seconds -
3. use a tftp client (in binary mode!) on your PC to upload the sysupgrade.bin
(the u-boot is listening on 192.168.1.1)
# tftp 192.168.1.1
binary
put openwrt-ipq40xx-meraki_mr33-squashfs-sysupgrade.bin
4. wait for it to reboot
5. connect to your MR33 via ssh on 192.168.1.1
For more detailed instructions, please take a look at the:
"Flashing Instructions for the MR33" PDF. This can be found
on the wiki: <https://openwrt.org/toh/meraki/mr33>
(A link to the mr33-uboot.bin + the modified ubootwrite is
also there)
Thanks to Jerome C. for sending an MR33 to Chris.
Signed-off-by: Chris Blake <chrisrblake93@gmail.com>
Signed-off-by: Mathias Kresin <dev@kresin.me>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This patch adds support for ASUS RT-AC58U/RT-ACRH13.
hardware highlights:
SOC: IPQ4018 / QCA Dakota
CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7
DRAM: 128 MiB DDR3L-1066 @ 537 MHz (1074?) NT5CC64M16GP-DI
NOR: 2 MiB Macronix MX25L1606E (for boot, QSEE)
NAND: 128 MiB Winbond W25NO1GVZE1G (cal + kernel + root, UBI)
ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN)
USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC)
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
INPUT: one Reset and one WPS button
LEDS: Status, WAN, WIFI1/2, USB and LAN (one blue LED for each)
Serial:
WARNING: The serial port needs a TTL/RS-232 3V3 level converter!
The Serial setting is 115200-8-N-1. The board has an unpopulated
1x4 0.1" header. The pinout (VDD, RX, GND, TX) is printed on the
PCB right next to the connector.
U-Boot Note: The ethernet driver isn't always reliable and can sometime
time out... Don't worry, just retry.
Access via the serial console is required. As well as a working
TFTP-server setup and the initramfs image. (If not provided, it
has to be built from the OpenWrt source. Make sure to enable
LZMA as the compression for the INITRAMFS!)
To install the image permanently, you have to do the following
steps in the listed order.
1. Open up the router.
There are four phillips screws hiding behind the four plastic
feets on the underside.
2. Connect the serial cable (See notes above)
3. Connect your router via one of the four LAN-ports (yellow)
to a PC which can set the IP-Address and ssh and scp from.
If possible set your PC's IPv4 Address to 192.168.1.70
(As this is the IP-Address the Router's bootloader expects
for the tftp server)
4. power up the router and enter the u-boot
choose option 1 to upload the initramfs image. And follow
through the ipv4 setup.
Wait for your router's status LED to stop blinking rapidly and
glow just blue. (The LAN LED should also be glowing blue).
3. Connect to the OpenWrt running in RAM
The default IPv4-Address of your router will be 192.168.1.1.
1. Copy over the openwrt-sysupgrade.bin image to your router's
temporary directory
# scp openwrt-sysupgrade.bin root@192.168.1.1:/tmp
2. ssh from your PC into your router as root.
# ssh root@192.168.1.1
The default OpenWrt-Image won't ask for a password. Simply hit the Enter-Key.
Once connected...: run the following commands on your temporary installation
3. delete the "jffs2" ubi partition to make room for your new root partition
# ubirmvol /dev/ubi0 --name=jffs2
4. install OpenWrt on the NAND Flash.
# sysupgrade -v /tmp/openwrt-sysupgrade.bin
- This will will automatically reboot the router -
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Rename the dts file to match the used SoC type and drop the unnecessary
KERNEL_INSTALL from the image build code.
Remove the fixed rootfs and kernel partitions and create an image with
rootfs appended after kernel.
Setup a switch portmap matching the hardware and a default network/switch
configuration to make make the second lan port working. Use eth0 as lan
to have it consistent accross the target.
Use the power LED to indicate the boot status.
Sort the SoC entries within the dts by address and use dtc labels
whenever possible.
Signed-off-by: Mathias Kresin <dev@kresin.me>
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
