ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2024-12-26 17:01:14 +00:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity
60,971 Commits 9 Branches 76 Tags 922 MiB
f75b530d20
Commit Graph

573 Commits

Author SHA1 Message Date
Zoltan HERPAI
8619d7af67 kirkwood: add D-Link DNS-320L support 
Dual-slot NAS based on Marvell Kirkwood.

Specifications:
 - Marvell 88F6702 @1GHz
 - 256Mb RAM
 - 128Mb NAND
 - 1x GbE LAN (Marvell 88E1318R)
 - 1x USB 2.0
 - 2x SATA
 - Weltrend WT69P3 ("supervisor" MCU chip)
 - Serial on J2 (115200,8n1)
 - Newer bootROM so kwboot-ing via serial is possible

Notes:
 - The Weltrend MCU is controlled by the package added in utils/dns320l-mcu.
 - The original MAC address is stored in the "mini firmware" image's first
   17 bytes.
 - Compared to the original MTD layout, the uImage+rootfs are now stored in
   a common ubi partition.

Installation:
1. Serial console
 - Connect your levelshifter to the serial console
   on J2 (refer to the wiki page for pinout)
2. Update u-boot
 - Download the u-boot.kwb image for the device
 - Powercycle the NAS
 - Run "kwboot -b u-boot-dns320l/u-boot.kwb /dev/ttyUSB0 -p"
 - Connect to the serial console with minicom
 - tftp 0x0800000 u-boot-dns320l/u-boot.kwb
   (Please note that "PHY reset timed out" seems to be customary
    on kirkwood devices, the egiga0 interface works regardless.)
 - nand erase 0x0 100000
 - nand write 0x0800000 0x0 0x100000
 - reset
3. Install OpenWrt
 - Boot up the initramfs image
 - tftpboot 0x800000 openwrt-kirkwood-generic-dlink_dns320l-initramfs-uImage; bootm 0x800000
 - Download the sysupgrade image and perform sysupgrade

Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
Reviewed-by: Pawel Dembicki <paweldembicki@gmail.com>
 2024-06-01 01:29:09 +02:00
Tomasz Maciej Nowak
f7f8099aa3 ath79: add support for Dell SonicPoint ACe APL26-0AE 
Dell/SonicWall APL26-0AE (marketed as SonicPoint ACe) is a dual band
wireless access point. End of life as of 2022-07-31.

Specification
SoC: QualcommAtheros QCA9550
RAM: 256 MB DDR2
Flash: 32 MB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
      5 GHz 3T3R QCA9890 oversized Mini PCIe card
Ethernet: 2x 10/100/1000 Mbps QCA8334
          port labeled lan1 is PoE capable (802.3at)
USB: 1x 2.0
LEDs: LEDs: 6x which 5 are GPIO controlled and two of them are dual color
Buttons: 2x GPIO controlled
Serial: RJ-45 port, SonicWall pinout
        baud: 115200, parity: none, flow control: none

Before flashing, be sure to have a copy of factory firmware, in case You
wish to revert to original firmware.
All described procedures were done in following environment:
ROM Version: SonicROM (U-Boot) 8.0.0.0-11o
SafeMode Firmware Version: SonicOS 8.0.0.0-14o
Firmware Version: SonicOS 9.0.1.0
In case of other versions, following installation instructions might be
ineffective.

Installation
1. Prepare TFTP server with OpenWrt sysupgrade image and rename that
   image to "sp_fw.bin".
2. Connect to one of LAN ports.
3. Connect to serial port.
4. Hold the reset button (small through hole on side of the unit),
   power on the device and when prompted to stop autoboot, hit any key.
   The held button can now be released.
5. Alter U-Boot environment with following commands:
    setenv bootcmd bootm 0x9F110000
    saveenv
6. Adjust "ipaddr" (access point, default is 192.168.1.1) and "serverip"
   (TFTP server, default is 192.168.1.10) addresses in U-Boot
   environment, then run following commands:
    tftp 0x80060000 sp_fw.bin
    erase 0x9F110000 +0x1EF0000
    cp.b 0x80060000 0x9F110000 $filesize
7. After successful flashing, execute:
    boot
8. The access point will boot to OpenWrt. Wait few minutes, until the
    wrench LED will stop blinking, then it's ready for configuration.

Known issues
Initramfs image can't be bigger than specified kernel size, otherwise
bootloader will throw LZMA decompressing error. Switching to lzma-loader
should workaround that.
This device has Winbond 25Q256FVFG and doesn't have reliable reset, which
causes hang on reboot, thus broken-flash-reset needs to be added. This
property addition causes dispaly of "scary" warning on each boot, take
this warnig into consideration.

Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
 2024-05-27 00:32:57 +02:00
INAGAKI Hiroshi
8366e0d606 uboot-envtools: add support for ELECOM WRC-X1800GS 
Add support for ELECOM WRC-X1800GS on uboot-envtools, to update
bootmenu_delay variable on sysupgrade.

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
 2024-05-25 19:33:28 +02:00
Daniel Golle
c71b68acdd mediatek: filogic: add Adtran SmartRG Mount Stuart series 
Common specifications:
 * Mediatek MT7988A (4x Cortex-A73, up to 1.8 GHz clock speed)
 * 8 GiB eMMC
 * 2 GiB DDR4 RAM
 * 1x 10000M/1000M/100M + 3x 1000M/100M/10M LAN ports
 * MT7996 Tri-band (2.4G, 5G, 6G) 4T4R 802.11be Wi-Fi
 * Airoha AG3352 GPS
 * Renesas DA14531MOD Bluetooth
 * 2 buttons (Reset, Mesh/WPS)
 * uC-controlled RGB LED via I2C
 * 2x LED for each 1G port, 3x LED for each 10G port
 * USB 3.0 type A port
 * 3.3V-level 115200 baud UART console via 4-pin Dupont connector
   exposed at the bottom of the device
 * USB-C PD power input

SDG-8733: 1x 10000M/1000M/100M WAN port
SDG-8734: 1x USXGMII/10GBase-R/5GBase-R/2500Base-X/1000Base-X/SGMII SFP+

Both models are also available in versions including 2x FXS POTS interfaces
for analog phones. Those interfaces are not supported by OpenWrt.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 2024-05-24 18:34:13 +01:00
Andrew Smith
0f5c28b96b qualcommax: ipq807x support Netgear Orbi Pro SXK80 
This commit adds support for Netgear Orbi Pro SXR80 and SXS80 (collectively known as SXK80)

Specifications:
---------------
* CPU: Qualcomm IPQ8074A Quad core Cortex-A53
* RAM: 1024MB
* Storage: SPI-NAND 512 MiB (Winbond W29N04GZ)
* Ethernet: 4x 1G RJ45 ports (QCA8075) 1x 2.5G RJ45 LAN/WAN (QCA8081)
* WLAN:
    - 2.4 GHz: Qualcomm QCN5024 4x4
    - 2x 5 GHz: Qualcomm QCN5054 4x4 (second radio high channels only)
* LEDs:
    - Power: (Green and red)
    - Front: (Blue, green, red and white)
* Buttons:
    - 1x Soft reset
    - 1x Sync/WPS
* Power: 12V DC Jack

Installation instructions (Telnet):
-----------------------------------

*Note, this guide assumes SXR80, for SXS80 change the firmware file name as appropriate

1. Put firmware file openwrt-qualcommax-ipq807x-netgear_sxr80-initramfs-uImage.itb in root of TFTP server available at 192.168.1.10.
2. Enable telnet by going to http://[ip of device]/debug.htm and clicking on the tickbox 'Enable telnet'
3. Telnet into the device and login using the same username and password as the web interface:
4. Run the following command:

`fw_setenv bootcmd 'env default -a; saveenv; reset'`

5. Reboot the router, once the web interface is available again re-enable telnet via http://[ip of device]/debug.htm and telnet into the device.

6. Run the following command:

`fw_printenv`

It should look similar to the below:

```
baudrate=115200
bootargs=console=ttyMSM0,115200n8
bootcmd=mii write 0x0 0x0 0x800; sleep 1; nmrp; bootdni; boot_DNI_secureboot
bootdelay=2
ipaddr=192.168.1.1
netmask=255.255.255.0
serverip=192.168.1.10
soc_version_major=2
soc_version_minor=0
```

**If you see the message:**
`Warning: Bad CRC, using default environment`
**DO NOT CONTINUE, YOU WILL BRICK YOUR DEVICE**

7. Run the following command:

`fw_setenv originalboot 'mii write 0x0 0x0 0x800; sleep 1; nmrp; bootdni; boot_DNI_secureboot'`

(This should match what's in the bootcmd variable displayed in step 6)

8. Run the following commands:
```
fw_setenv wrttftp 'mii write 0x0 0x0 0x800; sleep 1; nmrp; if tftpboot openwrt-qualcommax-ipq807x-netgear_sxr80-initramfs-uImage.itb; then bootm; fi; bootdni; boot_DNI_secureboot'
fw_setenv wrtboot 'mii write 0x0 0x0 0x800; sleep 1; nmrp; nand read 0x40000000 0x1980000 0x06d00000; bootm 0x40000000'
fw_setenv bootcmd 'run wrttftp'
```

9. Ensure SXR/S device is attached via ethernet (LAN port) to the same ethernet segment as the TFTP server.

10. Reboot the device, it should reboot into OpenWrt and be available on 192.168.1.1

11. Once OpenWrt has booted, update the bootcmd using the following command:

`fw_setenv bootcmd 'run wrtboot'`

12. Flash the sysupgrade image

13. It should boot into OpenWrt

References to SXK80 GPL source:
https://www.downloads.netgear.com/files/GPL/SXK80-V3.2.0.108_gpl_src.tar.bz2.zip

Signed-off-by: Flole Systems <flole@flole.de>
Signed-off-by: Andrew Smith <gul.code@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/14939
Signed-off-by: Robert Marko <robimarko@gmail.com>
 2024-05-22 14:51:36 +02:00
Paweł Owoc
9bdaebaff3 qualcommax: ipq807x: add support for Linksys MX8500 
Hardware specification:
========
SoC: Qualcomm IPQ8072A
Flash: 512MB (Fidelix FMND4G08S3J-ID)
RAM: 1GB (2x Kingston DDR3L D2516ECMDXGJD)
Ethernet: 1x 10/100/1000/2500/5000Mbps (Marvell AQR114C)
Ethernet: 4x 10/100/1000Mbps (Qualcomm QCA8075)
WiFi1: 6GHz ax 4x4 (Qualcomm QCN9024 + Skyworks SKY85784-11) - channels 33-229
WiFi2: 5GHz ax 4x4 (Qualcomm QCN5054 + Skyworks SKY85755-11) - channels 36-177
WiFi3: 2.4GHz ax 4x4 (Qualcomm QCN5024 + Skyworks SKY8340-11)
IoT: Bluetooth 5, Zigbee and Thread (NXP K32W041)
LED: 1x RGB status (NXP PCA9633)
USB: 1x USB 3.0
Button: WPS, Reset

Flash instructions:
========
1. Manually upgrade firmware using openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin image.
More details can be found here: https://www.linksys.com/support-article?articleNum=47547
After first boot check actual partition:
- fw_printenv -n boot_part
and install firmware on second partition using command in case of 2:
- mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin kernel
and in case of 1:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin alt_kernel

2. Installation using serial connection from OEM firmware (default login: root, password: admin):
- fw_printenv -n boot_part
In case of 2:
- flash_erase /dev/mtd21 0 0
- nandwrite -p /dev/mtd21 openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin
or in case of 1:
- flash_erase /dev/mtd23 0 0
- nandwrite -p /dev/mtd23 openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin
After first boot install firmware on second partition:
- mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin kernel
or:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin alt_kernel

3. Installation from initramfs image using USB drive:
Put the initramfs image on the USB drive:
- dd bs=1M if=openwrt-qualcommax-ipq807x-linksys_mx8500-initramfs-uImage.itb of=/dev/sda
Stop u-boot and run:
- usb start && usbboot $loadaddr 0 && bootm $loadaddr
Write firmware to the flash from initramfs:
- mtd -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin kernel
and:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx8500-squashfs-factory.bin alt_kernel

4. Back to the OEM firmware:
- mtd -e kernel -n write FW_MX8500_1.0.11.208937_prod.img kernel
and:
- mtd -r -e alt_kernel -n write FW_MX8500_1.0.11.208937_prod.img alt_kernel

5. USB recovery:
Put the initramfs image on the USB:
- dd bs=1M if=openwrt-qualcommax-ipq807x-linksys_mx8500-initramfs-uImage.itb of=/dev/sda
Set u-boot env:
- fw_setenv bootusb 'usb start && usbboot $loadaddr 0 && bootm $loadaddr'
- fw_setenv bootcmd 'run bootusb; if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'

AQR firmware:
========
1. Firmware loading:
To properly load the firmware and initialize AQR PHY, we must use the u-boot aq_load_fw function.
To do this, you need to modify u-boot env:
With USB recovery:
- fw_setenv bootcmd 'aq_load_fw; run bootusb; if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'
and without:
- fw_setenv bootcmd 'aq_load_fw; if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'

2. Firmware updating:
Newer firmware (AQR-G4_v5.6.5-AQR_WNC_SAQA-L2_GT_ID45287_VER24005.cld) is available in the latest OEM firmware.
To load this firmware via u-boot, we need to add the MBN header and update 0:ethphyfw partition.
For MBN header we can use script from this repository: https://github.com/testuser7/aqr_mbn_tool
- python aqr_mbn_tool.py AQR-G4_v5.6.5-AQR_WNC_SAQA-L2_GT_ID45287_VER24005.cld
To update partition we need to install kmod-mtd-rw package first:
- insmod mtd-rw.ko i_want_a_brick=1
- mtd -e /dev/mtd26 -n write aqr_fw.mbn /dev/mtd26

Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/14883
Signed-off-by: Robert Marko <robimarko@gmail.com>
 2024-05-16 20:27:36 +02:00
Kevin Abraham
1045bd4a04 uboot-envtools: ath79: remove env config for Senao Loader devices 
uboot-envtools can automatically parse the 'u-boot,env' compatible string from the dts.

Signed-off-by: Kevin Abraham <kevin@westhousefarm.com>
 2024-05-11 16:57:28 +02:00
Kevin Abraham
1dd036a659 ath79: add support for Senao Engenius ENS1750 
FCC ID: A8J-EWS660AP

Engenius ENS1750 is an outdoor wireless access point with
2 gigabit ethernet ports, dual-band wireless,
internal antenna plates, and 802.3at PoE+

Engenius EWS660AP, ENS1750, and ENS1200 are "electrically identical,
different model names are for marketing purpose" according to docs
provided by Engenius to the FCC.

**Specification:**

  - QCA9558 SOC		2.4 GHz, 3x3
  - QCA9880 WLAN	mini PCIe card, 5 GHz, 3x3, 26dBm
  - AR8035-A PHY	RGMII GbE with PoE+ IN
  - AR8033 PHY		SGMII GbE with PoE+ OUT
  - 40 MHz clock
  - 16 MB FLASH		MX25L12845EMI-10G
  - 2x 64 MB RAM
  - UART at J1		populated, RX grounded
  - 6 internal antenna plates (5 dbi, omni-directional)
  - 5 LEDs, 1 button (power, eth0, eth1, 2G, 5G) (reset)

**MAC addresses:**

  Base MAC addressed labeled as "MAC"
  Only one Vendor MAC address in flash

  eth0 *:d4 MAC art 0x0
  eth1 *:d5 --- art 0x0 +1
  phy1 *:d6 --- art 0x0 +2
  phy0 *:d7 --- art 0x0 +3

**Serial Access:**

  the RX line on the board for UART is shorted to ground by resistor R176
  therefore it must be removed to use the console
  but it is not necessary to remove to view boot log

  optionally, R175 can be replaced with a solder bridge short

  the resistors R175 and R176 are next to the UART RX pin

**Installation:**

  2 ways to flash factory.bin from OEM:

  Method 1: Firmware upgrade page:

    OEM webpage at 192.168.1.1
    username and password "admin"
    Navigate to "Firmware Upgrade" page from left pane
    Click Browse and select the factory.bin image
    Upload and verify checksum
    Click Continue to confirm and wait 3 minutes

  Method 2: Serial to load Failsafe webpage:

    After connecting to serial console and rebooting...
    Interrupt uboot with any key pressed rapidly
    execute `run failsafe_boot` OR `bootm 0x9fd70000`
    wait a minute
    connect to ethernet and navigate to
    "192.168.1.1/index.htm"
    Select the factory.bin image and upload
    wait about 3 minutes

**Return to OEM:**

  If you have a serial cable, see Serial Failsafe instructions
  otherwise, uboot-env can be used to make uboot load the failsafe image

  ssh into openwrt and run
  `fw_setenv rootfs_checksum 0`
  reboot, wait 3 minutes
  connect to ethernet and navigate to 192.168.1.1/index.htm
  select OEM firmware image from Engenius and click upgrade

**TFTP recovery:**

  Requires serial console, reset button does nothing

  rename initramfs.bin to '0101A8C0.img'
  make available on TFTP server at 192.168.1.101
  power board, interrupt boot
  execute tftpboot and bootm 0x81000000

**Format of OEM firmware image:**

  The OEM software of ENS1750 is a heavily modified version
  of Openwrt Kamikaze. One of the many modifications
  is to the sysupgrade program. Image verification is performed
  simply by the successful ungzip and untar of the supplied file
  and name check and header verification of the resulting contents.
  To form a factory.bin that is accepted by OEM Openwrt build,
  the kernel and rootfs must have specific names...

    openwrt-ar71xx-generic-ens1750-uImage-lzma.bin
    openwrt-ar71xx-generic-ens1750-root.squashfs

  and begin with the respective headers (uImage, squashfs).
  Then the files must be tarballed and gzipped.
  The resulting binary is actually a tar.gz file in disguise.
  This can be verified by using binwalk on the OEM firmware images,
  ungzipping then untaring.

  Newer EnGenius software requires more checks but their script
  includes a way to skip them, otherwise the tar must include
  a text file with the version and md5sums in a deprecated format.

  The OEM upgrade script is at /etc/fwupgrade.sh.

  OKLI kernel loader is required because the OEM software
  expects the kernel to be no greater than 1536k
  and the factory.bin upgrade procedure would otherwise
  overwrite part of the kernel when writing rootfs.

Note on PLL-data cells:

  The default PLL register values will not work
  because of the external AR8035 switch between
  the SOC and the ethernet port.

  For QCA955x series, the PLL registers for eth0 and eth1
  can be see in the DTSI as 0x28 and 0x48 respectively.
  Therefore the PLL registers can be read from uboot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x18050028 1` and `md 0x18050048 1`.

  The clock delay required for RGMII can be applied
  at the PHY side, using the at803x driver `phy-mode`.
  Therefore the PLL registers for GMAC0
  do not need the bits for delay on the MAC side.
  This is possible due to fixes in at803x driver
  since Linux 5.1 and 5.3

Tested-by: Kevin Abraham <kevin@westhousefarm.com>
Signed-off-by: Kevin Abraham <kevin@westhousefarm.com>
 2024-05-11 16:57:28 +02:00
Joel Low
587f3531fa
uboot-envtools: add env settings for ubnt,unifi-6-lr-v2 
This has been tested on two of my Unifi 6 LR v2s:

```bash
$ fw_printenv # before
Cannot parse config file '/etc/fw_env.config': No such file or directory
$ cat /etc/fw_env.config
/dev/mtd3 0x0000 0x1000 0x1000 1
$ fw_printenv
arch=arm
baudrate=115200
board=mt7622_evb
board_name=mt7622_evb
bootcmd=bootubnt
bootdelay=3
bootfile=uImage
cpu=armv7
device_model=U6-LR
ethact=mtk_eth
ethaddr=<redacted>
ethcard=AQR112C
ipaddr=<redacted>
is_default=true
loadaddr=0x5007FF28
macaddr=<redacted>
serverip=<redacted>
soc=mt7622
stderr=serial
stdin=serial
stdout=serial
vendor=mediatek
is_ble_stp=true
```

I had to reverse-engineer the working settings above to the UCI script.

Signed-off-by: Joel Low <joel@joelsplace.sg>
Link: https://github.com/openwrt/openwrt/pull/13897
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 2024-05-06 13:49:19 +02:00
Martin Schiller
357fe33d2c uboot-envtools: filogic: add support for BananaPi R4 PoE 
This adds support for the bpi-r4 variant with internal 2.5G PHY and
additional ethernet port instead of second sfp.

Signed-off-by: Martin Schiller <ms@dev.tdt.de>
 2024-05-06 09:12:05 +02:00
Rodrigo Balerdi
c904875562 ipq40xx: add support for Linksys WHW03 V1 
Hardware:
=========
SOC:             Qualcomm IPQ4019
WiFi 1:          QCA4019 IEEE 802.11b/g/n
WiFi 2:          QCA4019 IEEE 802.11a/n/ac
WiFi 3:          QCA9886 IEEE 802.11a/n/ac
Bluetooth:       Qualcomm CSR8510 (A10)
Zigbee:          Silicon Labs EM3581 NCP + Skyworks SE2432L
Ethernet:        Qualcomm Atheros QCA8072 (2-port)
Flash:           Samsung KLM4G1FEPD (4GB eMMC)
RAM (NAND):      512MB
LED Controller:  NXP PCA9633 (I2C)
Buttons:         Single reset button (GPIO).

Ethernet:
=========
The device has 2 ethernet ports, configured as follows by default:
- left port: WAN
- right port: LAN

Wifi:
=====
The Wifi radios are turned off by default. To configure the router,
you will need to connect your computer to the LAN port of the device.

Bluetooth and Zigbee:
=====================
Configuration included but not tested.

Storage:
========
For compatibility with stock firmware, all of OpenWrt runs in a 136 MiB
eMMC partition (of which there are two copies, see below). You can also
use partition /dev/mmcblk0p19 "syscfg" (3.4 GiB) any way you see fit.
During very limited tests, stock firmware did not mount this partition.
However, backing up its stock content before use is recommended anyway.

Firmware:
=========
The device uses a dual firmware mechanism: it automatically reverts to
the previous firmware after 3 failed boot attempts.

You can switch to the inactive firmware copy by changing the "boot_part"
U-Boot environment variable. You can also do it by turning on the device
for a couple of seconds and then back off, 3 times in a row.

Installation:
=============
OpenWrt's "factory" image can be installed via the stock web UI:
1. Login to the UI. (The default password is printed on the label.)
2. Enter support mode by clicking on the "CA" link at the bottom.
3. Click "Connectivity", "Choose file", "Start", and ignore warnings.

This port is based on work done by flipy (https://github.com/flipy).

Signed-off-by: Rodrigo Balerdi <lanchon@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15345
Signed-off-by: Robert Marko <robimarko@gmail.com>
 2024-05-05 10:33:13 +02:00
Tianling Shen
790082098e
mediatek: switch to fitblk for JDCloud RE-CP-03 
Use the new fitblk driver.

Tested-By: Yangyu Chen <cyy@cyyself.name>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
 2024-04-30 03:28:13 +01:00
Tim Lunn
99eb0d0e33 uboot-envtools: add env settings for Edgerouter-X 
uboot-envtools is currently missing config for Edgerouter-X
and its not immediately obvious what settings to manually
apply.

Provide default configuration for envtools on Edgerouter-X.

Signed-off-by: Tim Lunn <tim@feathertop.org>
 2024-04-25 21:33:16 +02:00
Connor Yoon
3569b37b15 ipq807x: add Spectrum SAX1V1K 
Spectrum SAX1V1K is a AX WIFI router with 3 1G and 1 2.5G ports.
The router is provided to Spectrum customers.
It is OEM of Askey RT5010W
https://forum.openwrt.org/t/spectrum-sax1v1k-askey-rt5010w-openwrt-support/149923

It continues the original work by @MeisterLone to get this device supported.

Specifications:
```
  •  CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz
  •  RAM: 2048MB of DDR3
  •  Storage: 1024MB eMMC
  •  Ethernet: 3x 1G RJ45 ports (QCA8075) + 1 2.5G Port (QCA8081)
  •  WLAN:
     • 2.4GHz: Qualcomm QCN5024 4x4 802.11b/g/n/ax 1174 Mbps PHY rate
     • 5GHz: Qualcomm QCN5054 4x4 802.11a/b/g/n/ac/ax 2402 PHY rate

  •  LED: 1 gpio-controlled dual color led (blue/red)
  •  Buttons: 1x reset
  •  Power: 12V DC jack
```

Notes:
```
  •  This commit adds only single partition support, that means
     sysupgrade is upgrading the current rootfs partition.
  •  Installation can be done by serial connection only.
  •  A poulated serial header is onboard
     https://forum.openwrt.org/t/spectrum-sax1v1k-askey-rt5010w-openwrt-support/149923/6
  •  RX/TX is working, u-boot bootwait is active, secure boot is enabled.
```

Installation Instructions:

	**Most part of the installation is performed from an initramfs image.**

	Boot initramfs : Using serial connection
	1. Boot up the device and wait till it displays "VERIFY_IB: Success. verify IB ok"
	2. Once that message appears,
	    login with username 'root'
	    password serial number of your router in uppercase.
	3. Use vi to paste the 'open.sh' script from @MeisterLone github on your device
	    https://github.com/MeisterLone/Askey-RT5010W-D187-REV6/blob/master/Patch/open.sh
	4. chmod 755 open.sh
	5. ./open.sh
	6. Set your ip to 192.168.0.1
	7. Run a TFTP server and host the initramfs image on the TFTP server and name it "recovery.img"
	8. Reboot device. On boot it will try TFTP.

	Install OpenWrt from initramfs image:
	1. Use SCP (or other way) to transfer OpenWrt factory image
	2. Connect to device using SSH (on a LAN port)
	3. Flash firmware: sysupgrade
	   # sysupgrade -n -v /tmp/openwrt_sysupgrade.bin
	4. Set U-boot env variable: bootcmd
	   # fw_setenv bootcmd "run fix_uboot; run setup_and_boot"
	5. Reboot the device
	   # reboot
	6. Once device is booted, residue of previous firmware will prevent openwrt to work properly.
	    Factory Reset is MUST required
	    # Once serial console is displaying to login, hold reset button for 10 sec
	7. Now everything should be operational.

        Note: this PR adds only single partition support, that means sysupgrade is
              upgrading the current rootfs partition

Signed-off-by: Connor Yoon <j_connor@taliaent.com>
 2024-04-23 21:48:34 +02:00
Robert Marko
923d7c5531
mediatek: filogic: add support for Edgecore EAP111 
HW specifications:
* Mediatek MT7981A
* 256MB SPI-NAND
* 512MB DRAM
* Uplink: 1 x 10/100/1000Base-T Ethernet, Auto MDIX, RJ-45 with 802.3at
PoE (Built-in GBe PHY)
* LAN: 1 x 10/100/1000Base-T Ethernet, Auto MDIX, RJ-45 (Airoha EN8801SC)
* 1 Tricolor LED
* Reset button
* 12V/2.0A DC input

Installation:
Board comes with OpenWifi/TIP which is OpenWrt based, so sysupgrade can
be used directly over SSH.

Signed-off-by: Robert Marko <robert.marko@sartura.hr>
 2024-04-11 13:25:11 +02:00
Christian Lamparter
82c8c38a5c apm821xx: prepare WNDR4700 for 6.6 - add preliminary u-boot-env access 
With the default BUILD_BOT configuration on a linux 6.6 kernel,
the WNDR4700's kernel no longer fits into the alloted ~3.5MiB,
even with LZMA compression.

Bigger kernels are possible, but there's a problem with Netgear's
"bootcmd":

> if loadn_dniimg 0 0x180000 0x4e0000 && chk_dniimg 0x4e0000; then nand read 0x800000 0x180000 0x20000;bootm 0x500000 - 0x800040;else fw_recovery; fi"

This loads the dni-image starting offset 0x180000 from the NAND
flash (which is the DTB partition) to 0x4e0000 in the RAM. It then
checks whenever the provided image is "valid". If it is then it
reads the DTB again to 0x800000 in the RAM and starts the extraction
and boot process. (If the image wasn't valid then it starts the
automated firmware recovery).

The issues here are that first: the kernel image gets "squeezed"
between 0x500040 and 0x7fffff... And second, the decompressor
only has area 0x0 - 0x500000 for decompression.

Hence the image now requires to update the bootcmd by providing
new values (which have been successfully tested with the original
Netgear WNDR4700 v1.0.0.56 firmware) for the RAM locations and
make full use of the fact that loadn_dniimg loads the DTB as well.

This needs to be done only once. Just connect a serial adapter to
interface with uboot and overwrite (and save) the new bootcmd.

WARNING: The serial port needs a TTL/RS-232 3.3v level converter!

Steps:
 0. Power-off the WNDR4700
 1. Connect the serial interface (you need to open the WNDR4700)
 2. Power-up the WNDR4700
 3. Monitor the boot-sequence and hit "Enter"-key when it says:

  "Hit any key to stop autoboot" (Be quick, you have a ~2 second window)

 4. in the Prompt enter the following commands (copy & paste)

 setenv bootcmd "if loadn_dniimg 0 0x180000 0xce0000 && chk_dniimg 0xce0000; then bootm 0xd00000 - 0xce0040;else fw_recovery; fi"
 saveenv
 run bootcmd

Note: This new bootcmd will also unbrick devices that were bricked
by the bigger 4.19-6.1 kernels.

Note2: This method was tested with a WNDR4700. A big kernel with most
debug features enabled on v6.6.22 measured 4.30 MiB when compressed
with lzma. The uncompressed kernel is 12.34 MiB. This is over the 3 MiB,
the device reserves for the kernel... But it booted! For bigger kernels,
the device needs repartitioning of the the ubi partition due to the
kernel+dtb not fitting into the partition.

Note3: For initramfs development. I would advice to load the initramfs
images to 0x800000 (or higher). i.e.: tftp 800000 wndr4700.bin

Note4: the fw_recovery uboot command to transfer the factory image to
the flash still works.

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
 2024-04-05 09:26:26 +02:00
Isaev Ruslan
9ef4f7f919 qualcommax: ipq60xx: add yuncore fap650 support 
This commit adds support for the Yuncore FAP650 device.

Specifications:
- Qualcomm IPQ6018+QCA8075+QCN5022+QCN5052
- 512 MB of RAM (DDR3)
- 8 MB of serial flash (SPI NOR)
- 128 MB of parallel flash (NAND)
- 2x2 2.4 GHz WiFi (IPQ6010)
- 2x2 5 GHz WiFi (IPQ6010)
- 2x 2dBi 2.4G MIMO antenna
- 2x 3dBi 5.8G MIMO antenna
- 5x 1 Gbps Ethernet (QCA8075)
- POE: 48V (IEEE 802.3af)
- power: 12V (~1.5A)
- 1x passthru port (rj45 - rj45)
- 1x cisco rj45 console port
- size: 160mm*86mm*29mm

BACKUP YOUR STOCK FIRMWARE:
```
export device=fap650
mkdir -p /tmp/fw_dump_$device
cd /tmp/fw_dump_$device
dmesg > dmesg_$device.log
dtc -I fs /sys/firmware/devicetree/base > $device.dts
cat /proc/device-tree/model > model
cat /proc/mtd > proc_mtd
while read p; do
mtd_dev=$(echo $p | cut -d: -f1)
echo $mtd_dev
dd if=/dev/$mtd_dev of=$mtd_dev
done < proc_mtd
md5sum * > md5sum.log
tar -cvzf ../$device.tar.gz .
export sum=$(md5sum /tmp/$device.tar.gz | cut -d' ' -f1)
mv ../$device.tar.gz /tmp/${device}_${sum}.tar.gz
echo fw backup saved to: /tmp/${device}_${sum}.tar.gz
```
Upload your backup via tftp to the safe place.

INSTALLATION:
1. stock firmware web ui
Rename factory.bin fw image file to factory.ubin. Flash this image
like ordinary stock fw upgrade.

2. stock firmware telnet method
Enter telnet cli (login: root, password: 476t*_f0%g09y) and upload
 factory.bin fw image and rename it to factory.ubin
`cd /tmp && wget <your_web_server_ip>/factory.ubin`
`sysupgrade factory.ubin

3. initramfs method
    Put imitramfs image to your TFTP server and rename it for example to fap650.initram
    Enable serial console and enter to the u-boot cli.
    Exec these commands:
    `tftpboot <your_tftp_server_ip>:fap650.initram`
    `dhcp`

    When downloading is finished:
    `bootm`
    After booting the device, you need to upload to the device factory.ubi fw image.
    ```
    cd /tmp && wget <your_web_server_ip>/factory.ubi`
    export rootfs=$(cat /proc/mtd | grep rootfs | cut -d: -f1)
    export rootfs_1=$(cat /proc/mtd | grep rootfs_1 | cut -d: -f1)
    ubiformat /dev/${rootfs} -y -f factory.ubi
    ubiformat /dev/${rootfs_1} -y -f factory.ubi
    reboot
    ```

4. u-boot factory.ubi image method
    Put factory.ubi to your TFTP server
    Enter u-boot cli and exec these commands:
    `tftpboot <your_tftp_server_ip>:factory.ubi`
    `dhcp`
    After downloading is finished:
    `flash rootfs`
    `flash rootfs_1`
    `reset`

STOCK FIRMWARE RECOVERY:
Boot initramfs image.
Upload your rootfs mtd partition to the device using scp or download
it from the device using wget.
Enter device ssh cli and exec:
```
cd /tmp && wget <your_web_server_ip>/rootfs_mtd`
export rootfs=$(cat /proc/mtd | grep rootfs | cut -d: -f1)
export rootfs_1=$(cat /proc/mtd | grep rootfs_1 | cut -d: -f1)
ubiformat /dev/${rootfs} -y -f /tmp/rootfs_mtd
ubiformat /dev/${rootfs_1} -y -f /tmp/rootfs_mtd
reboot
```

Signed-off-by: Isaev Ruslan <legale.legale@gmail.com>
 2024-04-04 09:29:17 +02:00
Tianling Shen
cc6c3a6ee8 mediatek: add support for OpenEmbed SOM7981 
Hardware specification:
  SoC: MediaTek MT7981B 2x A53
  Flash: 256 MiB SPI-NAND, 32 GB eMMC optional
  RAM: 0.5/1 GB DDR4
  Ethernet: 1x 1GbE, 1x 2.5GbE (RTL8221B)
  WiFi: MediaTek MT7976C
  USB: 1x USB 3.0
  GPIO: 26-Pin header
  UART: 6 GND, 8 TX, 10 RX (in Pin header)
  Button: Reset, WPS
  Power: Type-C PD

Installation:
The board comes with a third-party custom OpenWrt image, you can upload
sysupgrade image via LuCI directly WITHOUT keeping configurations.

Or power on the board with pressing reset button for 5 second, then visit
http://192.168.1.1 and upload -factory.bin firmware.

Signed-off-by: Tianling Shen <cnsztl@gmail.com>
 2024-03-31 20:20:59 +02:00
Roland Reinl
29cca6cfee filogic: Add support for D-Link AQUILA PRO AI M30 
Specification:
 - MT7981 CPU using 2.4GHz and 5GHz WiFi (both AX)
 - MT7531 switch
 - 512MB RAM
 - 128MB NAND flash with two UBI partitions with identical size
 - 1 multi color LED (red, green, blue, white) connected via GCA230718
 - 3 buttons (WPS, reset, LED on/off)
 - 1 1Gbit WAN port
 - 4 1Gbit LAN ports

Disassembly:
 - There are four screws at the bottom: 2 under the rubber feets, 2 under the label.
 - After removing the screws, the white plastic part can be shifted out of the blue part.
 - Be careful because the antennas are mounted on the side and the top of the white part.

Serial Interface
 - The serial interface can be connected to the 4 pin holes on the side of the board.
 - Pins (from front to rear):
   - 3.3V
   - RX
   - TX
   - GND
 - Settings: 115200, 8N1

MAC addresses:
 - WAN MAC is stored in partition "Odm" at offset 0x81
 - LAN (as printed on the device) is WAN MAC + 1
 - WLAN MAC (2.4 GHz) is WAN MAC + 2
 - WLAN MAC (5GHz) is WAN MAC + 3

Flashing via Recovery Web Interface:
 - The recovery web interface always flashes to the currently active partition.
 - If OpenWrt is flahsed to the second partition, it will not boot.
 - Ensure that you have an OEM image available (encrypted and decrypted version). Decryption is described in the end.
 - Set your IP address to 192.168.200.10, subnetmask 255.255.255.0
 - Press the reset button while powering on the device
 - Keep the reset button pressed until the LED blinks red
 - Open a Chromium based and goto http://192.168.200.1 (recovery web interface)
 - Download openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-recovery.bin
 - The recovery web interface always reports successful flashing, even if it fails
 - After flashing, the recovery web interface will try to forward the browser to 192.168.0.1 (can be ignored)
 - If OpenWrt was flashed to the first partition, OpenWrt will boot (The status LED will start blinking white and stay white in the end). In this case you're done and can use OpenWrt.
 - If OpenWrt was flashed to the second partition, OpenWrt won't boot (The status LED will stay red forever). In this case, the following steps are reuqired:
   - Start the web recovery interface again and flash the **decrypted OEM image**. This will be flashed to the second partition as well. The OEM firmware web interface is afterwards accessible via http://192.168.200.1.
   - Now flash the **encrypted OEM image** via OEM firmware web interface. In this case, the new firmware is flashed to the first partition. After flashing and the following reboot, the OEM firmware web interface should still be accessible via http://192.168.200.1.
   - Start the web recovery interface again and flash the OpenWrt recovery image. Now it will be flashed to the first partition, OpenWrt will boot correctly afterwards and is accessible via 192.168.1.1.

Flashing via U-Boot:
 - Open the case, connect to the UART console
 - Set your IP address to 192.168.200.2, subnet mask 255.255.255.0. Connect to one of the LAN interfaces of the router
 - Run a tftp server which provides openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-initramfs-kernel.bin.
 - Power on the device and select "7. Load image" in the U-Boot menu
 - Enter image file, tftp server IP and device IP (if they differ from the default).
 - TFTP download to RAM will start. After a few seconds OpenWrt initramfs should start
 - The initramfs is accessible via 192.168.1.1, change your IP address accordingly (or use multiple IP addresses on your interface)
 - Perform a sysupgrade using openwrt-mediatek-filogic-dlink_aquila-pro-ai-m30-a1-squashfs-sysupgrade.bin
 - Reboot the device. OpenWrt should start from flash now

Revert back to stock using the Recovery Web Interface:
 - Set your IP address to 192.168.200.2, subnetmask 255.255.255.0
 - Press the reset button while powering on the device
 - Keep the reset button pressed until the LED blinks red
 - Open a Chromium based and goto http://192.168.200.1 (recovery web interface)
 - Flash a decrypted firmware image from D-Link. Decrypting an firmware image is described below.

Decrypting a D-Link firmware image:
 - Download https://github.com/RolandoMagico/firmware-utils/blob/M32/src/m32-firmware-util.c
 - Compile a binary from the downloaded file, e.g. gcc m32-firmware-util.c -lcrypto -o m32-firmware-util
 - Run ./m32-firmware-util M30 --DecryptFactoryImage <OriginalFirmware> <OutputFile>
 - Example for firmware M30A1_FW101B05: ./m32-firmware-util M30 --DecryptFactoryImage M30A1_FW101B05\(0725091522\).bin M30A1_FW101B05\(0725091522\)_decrypted.bin

Flashing via OEM web interface is not possible, as it will change the active partition and OpenWrt is only running on the first UBI partition.

Controlling the LEDs:
 - The LEDs are controlled by a chip called "GCA230718" which is connected to the main CPU via I2C (address 0x40)
 - I didn't find any documentation or driver for it, so the information below is purely based on my investigations
 - If there is already I driver for it, please tell me. Maybe I didn't search enough
 - I implemented a kernel module (leds-gca230718) to access the LEDs via DTS
 - The LED controller supports PWM for brightness control and ramp control for smooth blinking. This is not implemented in the driver
 - The LED controller supports toggling (on -> off -> on -> off) where the brightness of the LEDs can be set individually for each on cycle
 - Until now, only simple active/inactive control is implemented (like when the LEDs would have been connected via GPIO)
 - Controlling the LEDs requires three sequences sent to the chip. Each sequence consists of
   - A reset command (0x81 0xE4) written to register 0x00
   - A control command (for example 0x0C 0x02 0x01 0x00 0x00 0x00 0xFF 0x01 0x00 0x00 0x00 0xFF 0x87 written to register 0x03)
 - The reset command is always the same
 - In the control command
   - byte 0 is always the same
   - byte 1 (0x02 in the example above) must be changed in every sequence: 0x02 -> 0x01 -> 0x03)
   - byte 2 is set to 0x01 which disables toggling. 0x02 would be LED toggling without ramp control, 0x03 would be toggling with ramp control
   - byte 3 to 6 define the brightness values for the LEDs (R,G,B,W) for the first on cycle when toggling
   - byte 7 defines the toggling frequency (if toggling enabled)
   - byte 8 to 11 define the brightness values for the LEDs (R,G,B,W) for the second on cycle when toggling
   - byte 12 is constant 0x87

Comparison to M32/R32:
 - The algorithms for decrypting the OEM firmware are the same for M30/M32/R32, only the keys differ
 - The keys are available in the GPL sources for the M32
 - The M32/R32 contained raw data in the firmware images (kernel, rootfs), the R30 uses a sysupgrade tar instead
 - Creation of the recovery image is quite similar, only the header start string changes. So mostly takeover from M32/R32 for that.
 - Turned out that the bytes at offset 0x0E and 0x0F in the recovery image header are the checksum over the data area
 - This checksum was not checked in the recovery web interface of M32/R32 devices, but is now active in R30
 - I adapted the recovery image creation to also calculate the checksum over the data area
 - The recovery image header for M30 contains addresses which don't match the memory layout in the DTS. The same addresses are also present in the OEM images
 - The recovery web interface either calculates the correct addresses from it or has it's own logic to determine where which information must be written

Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
 2024-03-31 19:01:20 +02:00
Marco von Rosenberg
06cdc07f8c ath79: add support for Huawei AP5030DN 
Huawei AP5030DN is a dual-band, dual-radio 802.11ac Wave 1 3x3 MIMO
enterprise access point with two Gigabit Ethernet ports and PoE
support.

Hardware highlights:
- CPU: QCA9550 SoC at 720MHz
- RAM: 256MB DDR2
- Flash: 32MB SPI-NOR
- Wi-Fi 2.4GHz: QCA9550-internal radio
- Wi-Fi 5GHz: QCA9880 PCIe WLAN SoC
- Ethernet 1: 10/100/1000 Mbps Ethernet through Broadcom B50612E PHY
- Ethernet 2: 10/100/1000 Mbps Ethernet through Marvell 88E1510 PHY
- PoE: input through Ethernet 1 port
- Standalone 12V/2A power input
- Serial console externally available through RJ45 port
- External watchdog: SGM706 (1.6s timeout)

Serial console:
  9600n8 (9600 baud, no stop bits, no parity, 8 data bits)

MAC addresses:
  Each device has 32 consecutive MAC addresses allocated by
  the vendor, which don't overlap between devices.
  This was confirmed with multiple devices with consecutive
  serial numbers.
  The MAC address range starts with the address on the label.
  To be able to distinguish between the interfaces,
  the following MAC address scheme is used:
    - eth0 = label MAC
    - eth1 = label MAC + 1
    - radio0 (Wi-Fi 5GHz) = label MAC + 2
    - radio1 (Wi-Fi 2.4GHz) = label MAC + 3

Installation:
0. Connect some sort of RJ45-to-USB adapter to "Console" port of the AP

1. Power up the AP

2. At prompt "Press f or F  to stop Auto-Boot in 3 seconds",
   do what they say.
   Log in with default admin password "admin@huawei.com".

3. Boot the OpenWrt initramfs from TFTP using the hidden script
   "run ramboot". Replace IP address as needed:

   > setenv serverip 192.168.1.10
   > setenv ipaddr 192.168.1.1
   > setenv rambootfile
     openwrt-ath79-generic-huawei_ap5030dn-initramfs-kernel.bin
   > saveenv
   > run ramboot

4. Optional but recommended as the factory firmware cannot
   be downloaded publicly:
   Back up contents of "firmware" partition using the web interface or ssh:

   $ ssh root@192.168.1.1 cat /dev/mtd11 > huawei_ap5030dn_fw_backup.bin

5. Run sysupgrade using sysupgrade image. OpenWrt
   shall boot from flash afterwards.

Return to factory firmware (using firmware upgrade package downloaded from
non-public Huawei website):
1. Start a TFTP server in the directory where
   the firmware upgrade package is located

2. Boot to u-boot as described above

3. Install firmware upgrade package and format the config partitions:

   > update system FatAP5X30XN_SOMEVERSION.bin
   > format_fs

Return to factory firmware (from previously created backup):
1. Copy over the firmware partition backup to /tmp,
   for example using scp

2. Use sysupgrade with force to restore the backup:
   sysupgrade -F huawei_ap5030dn_fw_backup.bin

3. Boot AP to U-Boot as described above

Quirks and known issues
-----------------------

- On initial power-up, the Huawei-modified bootloader suspends both
ethernet PHYs (it sets the "Power Down" bit in the MII control
register). Unfortunately, at the time of the initial port, the kernel
driver for the B50612E/BCM54612E PHY behind eth0 doesn't have a resume
callback defined which would clear this bit. This makes the PHY unusable
since it remains suspended forever. This is why the backported kernel
patches in this commit are required which add this callback and for
completeness also a suspend callback.

- The stock firmware has a semi dual boot concept where the primary
kernel uses a squashfs as root partition and the secondary kernel uses
an initramfs. This dual boot concept is circumvented on purpose to gain
more flash space and since the stock firmware's flash layout isn't
compatible with mtdsplit.

- The external watchdog's timeout of 1.6s is very hard to satisfy
during bootup. This is why the GPIO15 pin connected to the watchdog input
is configured directly in the LZMA loader to output the CPU_CLK/4 signal
which keeps the watchdog happy until the wdt-gpio kernel driver takes
over. Because it would also take too long to read the whole kernel image
from flash, the uImage header only includes the loader which then reads
the kernel image from flash after GPIO15 is configured.

Signed-off-by: Marco von Rosenberg <marcovr@selfnet.de>
[fixed 6.6 backport patch naming]
Signed-off-by: David Bauer <mail@david-bauer.net>
 2024-03-31 18:09:43 +02:00
Shiji Yang
d7d94a8d91 uboot-envtools: ath79: remove D-Link DIR-8x9 and DAP-1720 env config 
The uboot-envtools can automatically parse the dts 'u-boot,env'
compatible string. So the env config file is now useless.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
 2024-03-30 01:04:17 +01:00
Chukun Pan
0170666d89 uboot-mediatek: add Netcore N60 support 
The vendor uboot requires special fit verification.
So add a custom uboot build for this device.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
 2024-03-29 22:53:53 +01:00
Sander van Deijck
2cfe86d383 kirkwood: add ix4-200d support to uboot-envtools 
This adds support for the Iomega ix4-200d device in uboot-envtools.

Signed-off-by: Sander van Deijck <sander@vandeijck.com>
 2024-03-23 14:56:50 +01:00
Sungbo Eo
ec45f2f246 ramips: rename mtd partition of ipTIME NAND devices 
Contrary to common ipTIME NOR devices, the "Config" partition of T5004
and AX2004M contain normal U-Boot environment variables. Renaming the
partition into "u-boot-env" serves for better description, and it also
conforms to common naming practice in OpenWrt.

This patch might also be extended to A3004T, but its u-boot-env
partition layout has not been confirmed yet.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
 2024-03-10 16:32:14 +09:00
Dirk Buchwalder
93610492b6 qualcommax: ipq60xx: add support for netgear wax214 
Netgear WAX214 is a 802.11 ax dual-band AP
    with PoE. (similar to Engenius EWS357APV3)

    Specifications:

        •     CPU: Qualcomm IPQ6010 Quad core Cortex-A53
        •     RAM: 512MB of DDR3
        •     Storage: 128MB NAND (Macronix MX30UF1G18AC)
        •     Ethernet: 1x 1G RJ45 port (QCA8072) PoE
        •     WIFI:
              2.4GHz: Qualcomm QCN5022 2x2 802.11b/g/n/ax 574 Mbps PHY rate
              5GHz: Qualcomm QCN5052 2x2 802.11a/b/g/n/ac/ax 1201 PHY rate

        •     LEDs:
              4 x GPIO-controlled LEDs
                - 1 Power LED (orange)
                - 1 LAN LED (blue)
                - 1 WIFI 5g LED (blue)
                - 1 WIFI 2g LED (blue)
                black_small_square  Buttons: 1x soft reset
                black_small_square  Power: 12V DC jack or PoE (802.3af )

            An populated serial header is onboard, format is
             1.25mm 4p (DF13A-4P-1.25H)
            RX/TX is working, bootwait is active, secure boot is not
            enabled.

            The root password of the stock firmware is unknown,
            but failsafe mode can be entered to reset the password.

            Installation Instructions:

                - obtain serial access
                - stop auto boot (press "4", Entr boot command line
		  interface)
                - setenv active_fw 0 (to boot from the primary rootfs,
                  or set to 1 to boot from the secondary rootfs
                  partition)
                - saveenv

                - tftpboot the initramfs image
                - bootm

                - copy
		  openwrt-qualcommax-ipq60xx-netgear_wax214-squashfs-factory.ubi
                  to the device
                - write the image to the NAND:
                   - cat /proc/mtd and look for rootfs partition (should
		     be mtd11,
                     or mtd12 if you choose active_fw 1)
                   - ubiformat /dev/mtd11 -f -y
		     openwrt-qualcommax-ipq60xx-netgear_wax214-squashfs-factory.ubi
                - reboot

            Note: the firmware is senao-based. But I was unable to build
                  a valid senao-header into the image.
                  Maybe they changed the header format and senaoFW isn't
                  working any more.

Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
 2024-03-05 06:34:35 +01:00
Daniel Golle
fc865eb3ae uboot-envtools: replace use of platform_get_bootdev 
Use new function fitblk_get_bootdev in /lib/upgrade/common.sh instead.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 2024-02-26 01:29:22 +00:00
Daniel Golle
6368ed1ae5 mediatek: mt7623: phase out uImage.FIT partition parser 
Use the new fitblk driver on the BananaPi R2 as well as UniElec U7623.
Introduce boot device selection for fitblk's /chosen/rootdisk
handle, similar to how it is already done on MT7622, MT7986 and MT7988.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 2024-02-24 03:02:35 +00:00
Marcin Gajda
07b9186e88 ipq40xx: Add support Netgear LBR20 
**Netgear LBR20** is a router with two gigabit ethernets , three wifi radios and integrated LTE cat.18 modem.

SoC Type: Qualcomm IPQ4019
RAM: 512 MiB
Flash: 256 MiB , SLC NAND, 2 Gbit (Macronix MX30LF2G18AC)
Bootloader: U-Boot
Modem: LTE CAT.18 Quectel EG-18EA ,  Max. 1.2Gbps downlink / 150Mbps uplink

WiFi class AC2200:
- radio0 : 5G on QCA9888 , WiFi5- 802.11a/n/ac MU-MIMO 2x2 , 887Mbps , 80MHz - limited for low channels
- radio1: 2,4G on IPQ4019 ,WiFi4- 802.11b/g/n MIMO2x2 300Mbps 40Mhz
- radio2: 5G on IPQ4019 , WiFi5- 802.11a/n/ac MU-MIMO 2x2 , 887Mbps ,80Mhz - limited for high channels  (from 100 up to 165) . Becouse of DFS remember to set country before turning on.

Ethernet: 2x1GbE (WAN/LAN1, LAN2)
LEDs:  section power : green and red  , section on top (orbi) drived by TLC59208F: red, green ,blue and white
USB ports: No
Buttons:  2 Reset and SYNC(WPS)
Power: 12 VDC, 2,5 A
Connector type: Barrel

OpenWRT Installation
1. Simplest way is just do upgrade from webpage with *factory.img
2. You can also do it with standard tool for Netgear's debricking - NMPRFlash
3. Most advanced way is to open device , connect to UART console and :
- Prepare OpenWrt initramfs image in TFTP server root (server IP 192.168.1.10)
- Connect serial console (115200,8n1) to UART connector
- Connect TFTP server to RJ-45 port
- Stop in u-Boot and run u-Boot command:

> setenv serverip 192.168.1.10
> set fdt_high 0x85000000
> tftpboot 0x83000000 openwrt-ipq40xx-generic-netgear_lbr20-initramfs-zImage.itb
> bootm 0x83000000

- Login via ssh
- upload or download *sysupgrade.bin ( like wget ... or scp transfer)
-  Install image via "sysupgrade -n" (like “sysupgrade -n /tmp/openwrt-ipq40xx-generic-netgear_lbr20-squashfs-sysupgrade.bin”)

Back to Stock
- Download firmware from official Netgear's webpage , it will be *.img file after decompressing.
- Use NMRPFlash tool  ( detailed insructions on project page https://github.com/jclehner/nmrpflash )

Open the case
- Unscrew nuts and remove washers from antenna's conectors.
- There are two Torx T10 screws under the label next to antenna conectors. You have to unglue this label from left and right corner to get it
- Two parts of shell covers will slide out from eachother , you have to unglue two small rubber pads and namplate sticker on bottom to do that.
- PCB is screwed with 4Pcs of Torx T10 screws
- Before lifting up PCB remove pigtiles for LTE antennas and release them from PCB and radiator (black and white wires)
- On other side of PCB ,in left bottom corner there is already soldered with 4 pins UART connector for console. Counting from left it is  +3,3V , TX , RX ,GND (reffer to this picture: https://i.ibb.co/Pmrf9KB/20240116-103524.jpg )

BDF's files are in firmware_qca-wireless  https://github.com/openwrt/firmware_qca-wireless/ and in parallel sent to ath10k@lists.infradead.org.

Signed-off-by: Marcin Gajda <mgajda@o2.pl>
 2024-02-23 19:46:23 +01:00
Paweł Owoc
70fd815e57 qualcommax: ipq807x: add support for Linksys MX5300 
Hardware specification:
========
SoC: Qualcomm IPQ8072A
Flash: 512MB (Winbond W29N04GZBIBA)
RAM: 1GB (2x Nanya DDR3L NT5CC256M16ER-EK)
Ethernet: 5x 10/100/1000Mbps (Qualcomm QCA8075)
WiFi1: 5GHz ac 4x4 (Qualcomm QCA9984 + Skyworks SKY85746-11) - channels 100-169
WiFi2: 5GHz ax 4x4 (Qualcomm QCN5054 + Skyworks SKY85755-11) - channels 36-64
WiFi3: 2.4GHz ax 4x4 (Qualcomm QCN5024 + Skyworks SKY8340-11)
IoT: Bluetooth 5, Zigbee and Thread (Qualcomm QCA4024 + Skyworks SE2433T-R)
IoT Flash: 4MB (Macronix MX25R3235F)
RTC: ST M41T00S
LED: 1x RGB status (NXP PCA9633)
USB: 1x USB 3.0
Button: WPS, Reset

Flash instructions:
========
1. Manually upgrade firmware using openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin image.
More details can be found here: https://www.linksys.com/hk/support-article?articleNum=274497
After first boot check actual partition:
- fw_printenv -n boot_part
and install firmware on second partition using command in case of 2:
- mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin kernel
and in case of 1:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel

2. Installation using serial connection from OEM firmware (default login: root, password: admin):
- fw_printenv -n boot_part
In case of 2:
- flash_erase /dev/mtd21 0 0
  nandwrite -p /dev/mtd21 openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin
or in case of 1:
- flash_erase /dev/mtd23 0 0
  nandwrite -p /dev/mtd23 openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin
After first boot install firmware on second partition:
- mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin kernel
or:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel

3. Installation from initramfs image using USB FAT32 formatted drive:
Stop u-boot and run:
- usb start && fatload usb 0:1 $loadaddr openwrt-qualcommax-ipq807x-linksys_mx5300-initramfs-uImage.itb && bootm $loadaddr
Write firmware to the flash from initramfs:
- mtd -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin kernel
and:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel

4. Back to the OEM firmware:
- mtd -e kernel -n write FW_MX5300_1.1.9.200251_prod.img kernel
and:
- mtd -r -e alt_kernel -n write FW_MX5300_1.1.9.200251_prod.img alt_kernel

5. USB recovery:
- fw_setenv usbimage 'openwrt-qualcommax-ipq807x-linksys_mx5300-initramfs-uImage.itb'
  fw_setenv bootusb 'usb start && fatload usb 0:1 $loadaddr $usbimage && bootm $loadaddr'
  fw_setenv bootcmd 'run bootusb; aq_load_fw && if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'

Notes:
========
IoT device is accesible over spi. Not yet supported.

Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
 2024-02-23 13:34:59 +01:00
Mantas Pucka
44168fda78 qualcommax: ipq60xx: Add 8devices Mango DVK 
8devices Mango DVK is a single board computer / devkit for 8devices Mango
system-on-module (SoM).

Specifications:
* CPU: Qualcomm IPQ6010 Quad core Cortex-A53 1.8GHz
* RAM: 512 MB
* Storage:
    * 32 MB serial NOR flash (on SoM)
    * 256 MB parallel NAND flash (on DVK)
* Ethernet:
    * 2x1G RJ45 ports(QCA8072 or QCA8075)
    * 1x2.5G RJ45 port (QCA8081)
    * 1xSFP (shares SGMII with QCA8081)
* Switch: Qualcomm Atheros IPQ6010
* WLAN:
    * 2.4GHz: QCN5121 2x2 802.11b/g/n/ax 574 Mbps PHY rate
    * 5GHz: QCN5152 2x2 802.11a/n/ac/ax 1201 Mbps PHY rate
* USB:
    * 1x USB3.0 Type-A port
    * 1x USB2.0 available at mini PCIe slot
* PCIe: 1x mini PCIe slot 1xLane Gen3 (8GT/s)
* SD/eMMC (on a single shared bus - only one can be active):
    * micro SD slot
    * eMMC module connector
* LEDs:
    * Green power led (not controllable)
    * Green 2.4GHz radio led (GPIO 67)
    * Green 5GHz radio led (GPIO 66)
* Buttons:
    * 1x (WPS GPIO79) button
* GPIOs: 2.54mm header brings out 18 GPIOs (1.8V level)
* UART: 4-pin UART header (3.3V level)
    * 115200 8N1, 3.3V-Tx-Rx-GND (3.3V is pin 1 close to boot-switch SW2)
* Power:
    * PoE IN on 2.5G port (passive 24-48V)
    * DC power terminal (12-58V)

Installation instructions:

Vendor image format is compatible with squashfs-sysupgrade image. Run:

sysupgrade -n -F openwrt-qualcommax-ipq60xx-8devices_mango-dvk-squashfs-sysupgrade.bin

Signed-off-by: Mantas Pucka <mantas@8devices.com>
 2024-02-21 21:42:23 +01:00
Daniel Golle
b03d3644cf mediatek: filogic: add BananaPi BPi-R3 mini 
Hardware specification
----------------------
 SoC: MediaTek MT7986A 4x A53
 Flash: 128MB SPI-NAND, 8GB eMMC
 RAM: 2GB DDR4
 Ethernet: 2x 2.5GbE (Airoha EN8811H)
 WiFi: MediaTek MT7976C 2x2 2.4G + 3x3 5G
 Interfaces:
  * M.2 Key-M: PCIe 2.0 x2 for NVMe SSD
  * M.2 Key-B: USB 3.0 with SIM slot
  * front USB 2.0 port
 LED: Power, Status, WLAN2G, WLAN5G, LTE, SSD
 Button: Reset, internal boot switch
 Fan: PWM-controlled 5V fan
 Power: 12V Type-C PD

Installation instructions for eMMC
----------------------------------
0. Set boot switch to boot from SPI-NAND (assuming stock rom or immortalwrt
   running there).
1. Write GPT partition table to eMMC
   Move openwrt-mediatek-filogic-bananapi_bpi-r3-mini-emmc-gpt.bin to
   the device /tmp using scp and write it to /dev/mmcblk0:
    dd if=/tmp/openwrt-*-r3-mini-emmc-gpt.bin of=/dev/mmcblk0
2. Reboot (to reload partition table)
3. Write bootloader and OpenWrt images
   Move files to the device /tmp using scp:
    - openwrt-*-bananapi_bpi-r3-mini-emmc-preloader.bin
    - openwrt-*-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip
    - openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb
    - openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb
   Write them to the appropriate partitions:
    echo 0 > /sys/block/mmcblk0boot0/force_ro
    dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-preloader.bin of=/dev/mmcblk0boot0
    dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip of=/dev/mmcblk0p3
    dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb of=/dev/mmcblk0p4
    dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb of=/dev/mmcblk0p5
    sync

4. Remove the device from power, set boot switch to eMMC and boot into
   OpenWrt. The device will come up with IP 192.168.1.1 and assume the
   Ethernet port closer to the USB-C power connector as LAN port.

5. If you like to have Ethernet support inside U-Boot (eg. to boot via
   TFTP) you also need to write the PHY firmware to /dev/mmcblk0boot1:
    echo 0 > /sys/block/mmcblk0boot1/force_ro
    dd if=/lib/firmware/airoha/EthMD32.dm.bin of=/dev/mmcblk0boot1
    dd if=/lib/firmware/airoha/EthMD32.DSP.bin bs=16384 seek=1 of=/dev/mmcblk0boot1

Installation instructions for NAND
----------------------------------
0. Set boot switch to boot from eMMC (assuming OpenWrt is installed there
   by instructions above. Using stock rom or immortalwrt does NOT work!)

1. Write things to NAND
   Move files to the device /tmp using scp:
    - openwrt-*-bananapi_bpi-r3-mini-snand-preloader.bin
    - openwrt-*-bananapi_bpi-r3-mini-snand-bl31-uboot.fip
    - openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb
    - openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb
   Write them to the appropriate locations:
    mtd write /tmp/openwrt-*-bananapi_bpi-r3-mini-snand-preloader.bin /dev/mtd0
    ubidetach -m 1
    ubiformat /dev/mtd1
    ubiattach -m 1
    volsize=$(wc -c < /tmp/openwrt-*-bananapi_bpi-r3-mini-snand-bl31-uboot.fip)
    ubimkvol /dev/ubi0 -N fip -n 0 -s $volsize -t static
    ubiupdatevol /dev/ubi0_0 /tmp/openwrt-*-bananapi_bpi-r3-mini-snand-bl31-uboot.fip
    cd /lib/firmware/airoha
    cat EthMD32.dm.bin EthMD32.DSP.bin > /tmp/en8811h-fw.bin
    ubimkvol /dev/ubi0 -N en8811h-firmware -n 1 -s 147456 -t static
    ubiupdatevol /dev/ubi0_1 /tmp/en8811h-fw.bin
    ubimkvol /dev/ubi0 -n 2 -N ubootenv -s 126976
    ubimkvol /dev/ubi0 -n 3 -N ubootenv2 -s 126976
    volsize=$(wc -c < /tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb)
    ubimkvol /dev/ubi0 -n 4 -N recovery -s $volsize
    ubiupdatevol /dev/ubi0_4 /tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb
    volsize=$(wc -c < /tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb)
    ubimkvol /dev/ubi0 -n 4 -N recovery -s $volsize
    ubiupdatevol /dev/ubi0_4 /tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb

3. Remove the device from power, set boot switch to NAND, power up and
   boot into OpenWrt.

Partially based on immortalwrt support for the R3 mini, big thanks for
doing the ground work!

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 2024-02-15 19:30:08 +00:00
Daniel Golle
41c053141e mediatek: mt7622: convert unifi6lr-v{1,2,3}-ubootmod to fitblk 
No bootloader changes needed in this case, smooth transition.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 2024-02-15 19:30:08 +00:00
Daniel Golle
208f6c1232 mediatek: mt7622: convert BPi-R64 to all-UBI layout and fitblk 
Modernize bootloader and flash memory layout of the BPi-R64 similar to
how it has also been done for the BPi-R3.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 2024-02-15 19:30:08 +00:00
Daniel Golle
8afce4893b uboot-envtools: mediatek_filogic: update bpi-r3 
Unify env configuration now that BPi-R4 and BPi-R3 both use fitblk.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 2024-02-15 19:30:08 +00:00
Daniel Golle
1192554d56 uboot-envtools: filogic: add support for BananaPi R4 
Add environment settings for the BananaPi BPI-R4 router board which
can boot from (and store its bootloader environment on) micro SD card,
SPI-NAND and eMMC.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 2024-02-15 19:30:08 +00:00
Daniel Golle
13ddc65b2c uboot-envtools: filogic: de-duplicate UBI env settings 
Use function instead of duplicating the env settings on UBI for
OpenWrt-built U-Boot over and over.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 2024-02-15 19:30:08 +00:00
Shiji Yang
3b74ae780c uboot-envtools: backport some usefull patches from v2024.04-rc1 
Highlights:
- Silence small page read warning.
- Autodetect NAND erase size and env sectors.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
 2024-02-11 10:48:59 +01:00
Nick Hainke
5a016cc3af uboot-envtools: update to 2024.01 
Update to latest version.

Refresh patches:
- 002-Revert-tools-env-use-run-to-store-lockfile.patch

Signed-off-by: Nick Hainke <vincent@systemli.org>
 2024-02-09 13:55:18 +01:00
David Bentham
d8f4453bf2 mediatek: add Comfast CF-E393AX support 
Comfast CF-E393AX is a dual-band Wi-Fi 6 POE ceiling mount access point.

Oem firmware is a custom openwrt 21.02 snapshot version.

We can gain access via ssh once we remove the root password.

Hardware specification:
  SoC: MediaTek MT7981A 2x A53
  Flash: 128 MB SPI-NAND
  RAM: 256MB DDR3
  Ethernet: 1x 10/100/1000 Mbps built-in PHY (WAN)
            1x 10/100/1000/2500 Mbps MaxLinear GPY211C (LAN)
  Switch: MediaTek MT7531AE
  WiFi: MediaTek MT7976D
  LEDS: 1x (Red, Blue and Green)
  Button: Reset
  UART: 3.3v, 115200n8
  --------------------------
  | Layout |
  | ----------------- |
  | 4 | VCC GND TX RX | <= |
  | ----------------- |
  --------------------------

Gain SSH access:
1. Login into web interface (http://apipaddress/computer/login.html),
   and download the
   configuration(http://apipaddress/computer/config.html).

2. Rename downloaded backup config - 'backup.file to backup.tar.gz',
   Enter 'fakeroot' command then decompress the configuration:
   tar -zxf backup.tar.gz

3. Edit 'etc/shadow', update (remove) root password:
   With password =
   'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
   'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
   to
   Without password =
   'root::0:99999:7:::'
   'root::0:99999:7:::'

4. Repack 'etc' directory back to a new backup file:
   tar -zcf backup-ssh.tar.gz etc/
5. Rename new config tar.gz file to 'backup-ssh.file'
   Exit fakeroot - 'exit'

6. Upload new configuration via web interface, now you
   can SSH with the following:

   'ssh -vv -o HostKeyAlgorithms=+ssh-rsa \
   -o PubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.10.1'.

   Backup the mtd partitions
   - https://openwrt.org/docs/guide-user/installation/generic.backup

7. Copy openwrt factory firmware to the tmp folder to install via ssh:

   'scp -o HostKeyAlgorithms=+ssh-rsa \
   -o PubkeyAcceptedAlgorithms=+ssh-rsa \
   *-mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin \
   root@192.168.10.1:/tmp/'

   'sysupgrade -n -F \
   /tmp/*--mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin'

8. Once led has stopped flashing - Connect via ssh with the
   default openwrt ip address - 'ssh root@192.168.1.1'

9. SSH copy the openwrt sysupgrade firmware and upgrade
   as per the default instructions.

Signed-off-by: David Bentham <db260179@gmail.com>
 2024-02-02 13:01:38 +01:00
Chuanhong Guo
1b7e62b20b mediatek: drop NMBM layout for Xiaomi WR30U 
This reverts commit dcdcfc1511.

This is a firmware for third-party u-boot mod, which should not
be carried here by us.

Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
 2024-01-23 19:24:32 +08:00
Tianling Shen
c0c3234e17 mediatek: add support for JDCloud RE-CP-03 
Hardware specification:
  SoC: MediaTek MT7986A 4x A53
  Flash: 128GB eMMC
  RAM: 1GB DDR4
  Ethernet: 4x 1GbE, 1x 2.5GbE (RTL8221B)
  Switch: MediaTek MT7531AE
  WiFi: MediaTek MT7976C
  Button: Reset, Joylink
  Power: DC 12V 2A

Flash instructions:
1. Download and flash the vendor migration firmware via webUI:
   https://firmware.download.immortalwrt.eu.org/cnsztl/mediatek/filogic/openwrt-mediatek-mt7986-jdcloud_re-cp-03-vendor-migration.bin
   (Default address is 192.168.68.1, user root, no password)
2. After device has booted up, write new GPT table:
   dd if=openwrt-mediatek-filogic-jdcloud_re-cp-03-gpt.bin of=/dev/mmcblk0 bs=512 seek=0 count=34 conv=fsync
3. Erase and write new BL2:
   echo 0 > /sys/block/mmcblk0boot0/force_ro
   dd if=/dev/zero of=/dev/mmcblk0boot0 bs=512 count=8192 conv=fsync
   dd if=openwrt-mediatek-filogic-jdcloud_re-cp-03-preloader.bin of=/dev/mmcblk0boot0 bs=512 conv=fsync
4. Erase and write new FIP:
   dd if=/dev/zero of=/dev/mmcblk0 bs=512 seek=13312 count=8192 conv=fsync
   dd if=openwrt-mediatek-filogic-jdcloud_re-cp-03-bl31-uboot.fip of=/dev/mmcblk0 bs=512 seek=13312 conv=fsync
5. Set static IP on your PC:
   IP 192.168.1.254/24, GW 192.168.1.1
6. Serve OpenWrt initramfs image using TFTP server.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt has booted, perform sysupgrade.
9. Additionally, if you want to have eMMC recovery boot feature:
     (Don't worry! You will always have TFTP recovery boot feature.)
   dd if=openwrt-mediatek-filogic-jdcloud_re-cp-03-initramfs-recovery.itb of=/dev/mmcblk0p4 bs=512 conv=fsync

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
 2024-01-19 21:43:32 +01:00
Dim Fish
7dbcc1215a mediatek: filogic: add support for Xiaomi AX3000T 
**SoC**: MediaTek MT7981B 2x A53
  **Flash**: ESMT F50L1G41LB 128MB
  **RAM**: NT52B128M16JR-FL 256MB
  **Ethernet**: 4x 10/100/1000 Mbps
  **Switch**: MediaTek MT7531AE
  **WiFi**: MediaTek MT7976C
  **Buttons**: Reset, Mesh
  **Power**: DC 12V 1A

1. Get ssh access. Supported stock firmware **1.0.47**
   ```
   curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=*******/api/misystem/arn_switch" -d "open=1&model=1&level=%0Anvram%20set%20ssh_en%3D1%0A"
   curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=*******/api/misystem/arn_switch" -d "open=1&model=1&level=%0Anvram%20commit%0A"
   curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=*******/api/misystem/arn_switch" -d "open=1&model=1&level=%0Ased%20-i%20's%2Fchannel%3D.*%2Fchannel%3D%22debug%22%2Fg'%20%2Fetc%2Finit.d%2Fdropbear%0A"
   curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=*******/api/misystem/arn_switch" -d "open=1&model=1&level=%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A"
   curl -X POST "http://192.168.31.1/cgi-bin/luci/;stok=********/api/misystem/arn_switch" -d "open=1&model=1&level=%0Apasswd%20-d%20root%0A
   ```

2. Backup stock partitions
   ```
   nanddump -f /tmp/BL2.bin /dev/mtd1
   nanddump -f /tmp/Nvram.bin /dev/mtd2
   nanddump -f /tmp/Bdata.bin /dev/mtd3
   nanddump -f /tmp/Factory.bin /dev/mtd4
   nanddump -f /tmp/FIP.bin /dev/mtd5
   nanddump -f /tmp/ubi.bin /dev/mtd8
   nanddump -f /tmp/KF.bin /dev/mtd12
   ```
   Then transfer them to your computer in a safe place.

3. Get firmware information `cat /proc/cmdline`

4. Copy openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi to **/tmp** and flash
   If **firmware=0**
   ```
   ubiformat /dev/mtd9 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi
   nvram set boot_wait=on
   nvram set uart_en=1
   nvram set flag_boot_rootfs=1
   nvram set flag_last_success=1
   nvram set flag_boot_success=1
   nvram set flag_try_sys1_failed=0
   nvram set flag_try_sys2_failed=0
   nvram commit
   reboot
   ```
   If **firmware=1**
   ```
   ubiformat /dev/mtd8 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi
   nvram set boot_wait=on
   nvram set uart_en=1
   nvram set flag_boot_rootfs=0
   nvram set flag_last_success=0
   nvram set flag_boot_success=1
   nvram set flag_try_sys1_failed=0
   nvram set flag_try_sys2_failed=0
   nvram commit
   reboot
   ```

   Then reboot your router, it should boot to the OpenWrt initramfs system now.

5. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin
   `sysupgrade -n /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin`

1. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb
   `ubiformat /dev/mtd8 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb`

   `reboot`

2. Install kmod-mtd-rw
   `opkg update && opkg install kmod-mtd-rw`

   `insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1`

3. Format ubi and create new ubootenv volume
   ```
   ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8
   ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
   ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
   ```

4. *(Optional **-10Mb** free space) Add recovery boot feature.*
   ```
   ubimkvol /dev/ubi0 -n 2 -N recovery -s 10MiB
   ubiupdatevol /dev/ubi0_2 /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb
   ```

5. Flash Openwrt U-Boot
   ```
   mtd write /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-preloader.bin BL2
   mtd write /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip FIP
   ```

6. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-squashfs-sysupgrade.itb
   `sysupgrade -n /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-squashfs-sysupgrade.itb`

1. Force flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb
   `sysupgrade -F -n /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb`

2. Format ubi and Nvram
   ```
   ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8
   mtd erase Nvram
   ```

3. Install kmod-mtd-rw
   `opkg update && opkg install kmod-mtd-rw`

   `insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1`

4. Flash stock images from backup
   ```
   mtd write /tmp/BL2.bin BL2
   mtd write /tmp/FIP.bin FIP
   mtd write /tmp/ubi.bin ubi
   ```
   Then reboot your router, waiting it finished rollback in minutes.

   `ubiformat /dev/mtd7 -y -f /tmp/ubi.bin`
   Then reboot your router, waiting it finished rollback in minutes.

Signed-off-by: Dim Fish <dimfish@gmail.com>
 2024-01-06 17:51:11 +01:00
Mohammad Sayful Islam
46a2490e8f ipq807x: add support for Linksys MX4200 V1 and V2 
Linksys MX4200 is a 802.11ax Tri-band router/AP.
Specifications:
* CPU: Qualcomm IPQ8174 Quad core Cortex-A53 1.4GHz
* RAM: 512MB of DDR3
* Storage: 512Mb NAND
* Ethernet: 4x1G RJ45 ports (QCA8075)
* WLAN:
	* 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate
	* 5GHz: Qualcomm QCN5054 2x2@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate
	* 5GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate
* LED-s:
	* RGB system led

* Buttons: 1x Soft reset 1x WPS
* Power: 12V DC Jack

Installation instructions:
Open Linksys Web UI - http://192.168.1.1/ca or http://10.65.1.1/ca depending on your setup.
Login with your admin password. The default password can be found on a sticker under the device.
To enter into the support mode, click on the “CA” link and the bottom of the page.
Open the “Connectivity” menu and upload the squash-factory image with the “Choose file” button.
Click start. Ignore all the prompts and warnings by click “yes” in all the popups.
The Wifi radios are turned off by default. To configure the router, you will need to connect your computer to the LAN port of the device.
Then you would need to write openwrt to the other partition for it to work
- First Check booted partition
fw_printenv -n boot_part

- Then install Openwrt to the other partition if booted in slot 1:
mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4200v(X)-squashfs-factory.bin alt_kernel

- If in slot 2:
mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4200v(X)-squashfs-factory.bin kernel

Replace (X) with your model version either 1 or 2

Signed-off-by: Mohammad Sayful Islam <sayf.mohammad01@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
 2024-01-06 16:13:23 +01:00
Roland Reinl
fdb87a91b4 mediatek: Add support for D-Link EAGLE PRO AI R32 
R32 is like the M32 part of the EAGLE PRO AI series from D-Link.

Specification:
 - MT7622BV SoC with 2.4GHz wifi
 - MT7975AN + MT7915AN for 5GHz
 - MT7531BE Switch
 - 512MB RAM
 - 128 MB flash
 - 2 LEDs (Status and Internet, both can be either orange or white)
 - 2 buttons (WPS and Reset)

Compared to M32, the R32 has the following differences:
 - 4 LAN ports instead of 2
 - The recory image starts with DLK6E6015001 instaed of DLK6E6010001
 - Individual LEDs for power and internet
 - MAC address is stored at another offset in the ODM partition

MAC addresses:
 - WAN MAC is stored in partition "Odm" at offset 0x81
 - LAN (as printed on the device) is WAN MAC + 1
 - WLAN MAC (2.4 GHz) is WAN MAC + 2
 - WLAN MAC (5GHz) is WAN MAC + 3

Flashing via Recovery Web Interface:
 - Set your IP address to 192.168.0.10, subnetmask 255.255.255.0
 - Press the reset button while powering on the deivce
 - Keep the reset button pressed until the internet LED blinks fast
 - Open a Chromium based and goto http://192.168.0.1
 - Download openwrt-mediatek-mt7622-dlink_eagle-pro-ai-r32-a1-squashfs-recovery.bin

Flashing via uBoot:
 - Open the case, connect to the UART console
 - Set your IP address to 10.10.10.3, subnet mask 255.255.255.0. Connect to one of the LAN interfaces of the router
 - Run a tftp server which provides openwrt-mediatek-mt7622-dlink_eagle-pro-ai-r32-initramfs-kernel.bin.
 - You can rename the file to iverson_uImage (no extension), then you don't have to enter the whole file name in uboot later.
 - Power on the device and select "1. System Load Linux to SDRAM via TFTP." in the boot menu
 - Enter image file, tftp server IP and device IP (if they differ from the default).
 - TFTP download to RAM will start. After a few seconds OpenWrt initramfs should start
 - The initramfs is accessible via 192.168.1.1, change your IP address accordingly (or use multiple IP addresses on your interface)
 - Create a backup of the Kernel1 partition, this file is required if a revert to stock should be done later
 - Perform a sysupgrade using openwrt-mediatek-mt7622-dlink_eagle-pro-ai-r32-squashfs-sysupgrade.bin
 - Reboot the device. OpenWrt should start from flash now

Revert back to stock using the Recovery Web Interface:
 - Set your IP address to 192.168.0.10, subnetmask 255.255.255.0
 - Press the reset button while powering on the deivce
 - Keep the reset button pressed until the internet LED blinks fast
 - Open a Chromium based and goto http://192.168.0.1
 - Flash a decrypted firmware image from D-Link. Decrypting an firmware image is described below.

Decrypting a D-Link firmware image:
 - Download https://github.com/RolandoMagico/firmware-utils/blob/M32/src/m32-firmware-util.c
 - Compile a binary from the downloaded file, e.g. gcc m32-firmware-util.c -lcrypto -o m32-firmware-util
 - Run ./m32-firmware-util R32 --DecryptFactoryImage <OriginalFirmware> <OutputFile>
 - Example for firmware R32A1_FW103B01: ./m32-firmware-util R32 --DecryptFactoryImage R32A1_FW103B01.bin R32A1_FW103B01.decrypted.bin

Revert back to stock using uBoot:
 - Open the case, connect to the UART console
 - Set your IP address to 10.10.10.3, subnet mask 255.255.255.0. Connect to one of the LAN interfaces of the router
 - Run a tftp server which provides the previously created backup of the Kernel1 partition.
 - You can rename the file to iverson_uImage (no extension), then you don't have to enter the whole file name in uboot later.
 - Power on the device and select "2. System Load Linux Kernel then write to Flash via TFTP." in the boot menu
 - Enter image file, tftp server IP and device IP (if they differ from the default).
 - TFTP download to FLASH will start. After a few seconds the stock firmware should start again

There is also an image openwrt-mediatek-mt7622-dlink_eagle-pro-ai-r32-a1-squashfs-tftp.bin which can directly be flashed via U-Boot and TFTP.
It can be used if no backup of the Kernel1 partition is reuqired.

Flahsing via OEM web interface is currently not possible, the OEM images are encrypted. Creating images is only possible manually at the moment.
The support for the M32/R32 already includes support for flashing from the OEM web interface:
 - The device tree contains both partitions (Kernel1 and Kernel2) with conditions to select the correct one based on the kernel command line
 - The U-Boot variable "boot_part" is set accordingly during startup to finish the partition swap after flashing from the OEM web interface
 - OpenWrt sysupgrade flashing always uses the partition where it was initially flashed to (no partition swap)

Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
 2024-01-02 21:22:46 +01:00
Xavier Franquet
782eb05008 mediatek: filogic: add support ASUS RT-AX59U 
(based on support for ASUS RT-AX59U by liushiyou006)

SOC: MediaTek MT7986
RAM: 512MB DDR4
FLASH: 128MB SPI-NAND (Winbond W25N01GV)
WIFI: Mediatek MT7986 DBDC 802.11ax 2.4/5 GHz
ETH: MediaTek MT7531 Switch
UART: 3V3 115200 8N1 (Pinout silkscreened / Do not connect VCC)

Upgrade from AsusWRT to OpenWRT using UART

    Download the OpenWrt initramfs image.
    Copy the image to a TFTP server reachable at 192.168.1.70/24. Rename the image to rtax59u.bin.

    Connect the PC with TFTP server to the RT-AX59U.
    Set a static ip on the ethernet interface of your PC.
    (ip address: 192.168.1.70, subnet mask:255.255.255.0)
    Conect to the serial console, interrupt the autoboot process by pressing '4' when prompted.

    Download & Boot the OpenWrt initramfs image.

    $ setenv ipaddr 192.168.1.1
    $ setenv serverip 192.168.1.70
    $ tftpboot 0x46000000 rtax59u.bin
    $ bootm 0x46000000

    Wait for OpenWrt to boot. Transfer the sysupgrade image to the device using scp and install using sysupgrade.

    $ sysupgrade -n <path-to-sysupgrade.bin>

Upgrade from AsusWRT to OpenWRT using WebUI

    Download transit TRX file from https://drive.google.com/drive/folders/1A20QdjK7Udagu31FSszpWAk8-cGlCwsq

    Upgrade firmware from WebUI (192.168.50.1) using downloaded TRX file

    Wait for OpenWRT to boot (192.168.1.1).

    Upgrade system with sysupgrade image using luci or uploading it through scp and executing sysupgrade command

MAC Address for WLAN 5g is not following the same algorithm as in AsusWRT.
We have increased by one the WLAN 5g to avoid collisions with other networks from WLAN 2g
when bit 28 is already set.

              : Stock             : OpenWrt
  WLAN 2g (1) : C8:xx:xx:0D:xx:D4 : C8:xx:xx:0D:xx:D4
  WLAN 2g (2) :                   : CA:xx:xx:0D:xx:D4
  WLAN 2g (3) :                   : CE:xx:xx:0D:xx:D4
  WLAN 5g (1) : CA:xx:xx:1D:xx:D4 : CA:xx:xx:1D:xx:D5
  WLAN 5g (2) :                   : CE:xx:xx:1D:xx:D5
  WLAN 5g (3) :                   : C2:xx:xx:1D:xx:D5

  WLAN 2g (1) : 08:xx:xx:76:xx:BE : 08:xx:xx:76:xx:BE
  WLAN 2g (2) :                   : 0A:xx:xx:76:xx:BE
  WLAN 2g (3) :                   : 0E:xx:xx:76:xx:BE
  WLAN 5g (1) : 0A:xx:xx:76:xx:BE : 0A:xx:xx:76:xx:BF
  WLAN 5g (2) :                   : 0E:xx:xx:76:xx:BF
  WLAN 5g (3) :                   : 02:xx:xx:76:xx:BF

Signed-off-by: Xavier Franquet <xavier@franquet.es>
 2023-12-31 00:03:24 +01:00
Mikhail Zhilkin
485adc9d3c mediatek: add support for Routerich AX3000 
This PR is continuation of work under "mediatek: add support for Routerich
AX3000" #13703 by the agreement with PR #13703 original author (Maximilian
Weinmann <x1@disroot.org>). All reviews from the previous PR were taken
into into account.

Routerich AX3000 is a wireless WiFi 6 router.

Specification
-------------
- SoC       : MediaTek MT7981BA dual-core ARM Cortex-A53 1.3 GHz
- RAM       : DDR3 256 MiB (ESMT M15T2G16128A)
- Flash     : SPI-NAND 128 MiB (ESMT F50L1G41LB)
- WLAN      : MediaTek MT7976CN dual-band WiFi 6
  - 2.4 GHz : b/g/n/ax, MIMO 2x2
  - 5 GHz   : a/n/ac/ax, MIMO 2x2
- Ethernet  : 10/100/1000 Mbps x4 (MediaTek MT7531AE)
- USB       : 1x 2.0
- UART      : through-hole on PCB
  - [J500] GND, TX, RX, 3.3V (115200n8)
- Buttons   : Mesh, Reset
- LEDs      : 1x Power (Blue)
              1x WiFi 2.4 GHz (Blue)
              1x WiFi 5 GHz (Red)
              1x Mesh (Blue)
              3x LAN activity (Blue)
              1x WAN activity (Blue)
              2x WAN no-internet (Red)
- Power     : 12 VDC, 1.5 A

Installation
------------
Flash OpenWrt 'sysupgrade.bin' image using stock firmware web-interface
(without keeping settings).

Return to stock
---------------
Install stock firmware image (without keeping settings) using OpenWrt
sysupgrade method.

Recovery
--------
Connect uart, use u-boot menu to flash stock firmware image or boot
OpenWrt initramfs image.

MAC addresses
-------------
+---------+-------------------+-----------+
|         | MAC               | Algorithm |
+---------+-------------------+-----------+
| WAN     | 24:0f:5e:xx:xx:b4 | label     |
| LAN     | 24:0f:5e:xx:xx:b5 | label+1   |
| WLAN 2g | 24:0f:5e:xx:xx:b6 | label+2   |
| WLAN 5g | 24:0f:5e:xx:xx:b7 | label+3   |
+---------+-------------------+-----------+
The WLAN 2g MAC was found in 'Factory', 0x4

Co-authored-by: Maximilian Weinmann <x1@disroot.org>
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
 2023-12-26 17:17:23 +01:00
Ian Oderon
4300bc6688 mediatek: add support for Zbtlink ZBT-Z8103AX 
Specifications:
SoC: MediaTek MT7981B
RAM: 256MiB
Flash: SPI-NAND 128 MiB
Switch: 1 WAN, 3 LAN (Gigabit)
Buttons: Reset, Mesh
Power: DC 12V 1A
WiFi: MT7976CN
UART: 115200n8
UART Layout:
VCC-RX-TX-GND

No. of Antennas: 6
Note: Upon opening the router, only 5 antennas were connected
to the mainboard.

Led Layout:
Power-Mesh-5gwifi-WAN-LAN3-LAN2-LAN1-2gWiFi

Buttons:
Reset-Mesh

Installation:
A. Through OpenWrt Dashboard:
If your router comes with OpenWrt preinstalled (modified by the seller),
you can easily upgrade by going to the dashboard (192.168.1.1) and then
navigate to System -> Backup/Flash firmware, then flash the firmware

B. Through TFTP
Standard installation via UART:

1. Connect USB Serial Adapter to the UART, (NOTE: Don't connect the VCC pin).
2. Power on the router. Make sure that you can access your router via UART.
3. Restart the router then repeatedly press ctrl + c to skip default boot.
4. Type > bootmenu
5. Press '2' to select upgrade firmware
6. Press 'Y' on 'Run image after upgrading?'
7. Press '0' and hit 'enter' to select TFTP client (default)
8. Fill the U-Boot's IP address and TFTP server's IP address.
9. Finally, enter the 'firmware' filename.

Signed-off-by: Ian Oderon <ianoderon@gmail.com>
 2023-12-26 00:02:19 +01:00
Rafał Miłecki
de94eceee6 uboot-envtools: bump PKG_RELEASE 
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 2023-12-13 08:53:36 +01:00
Rafał Miłecki
3ed7abfc5a uboot-envtools: fix reading NVMEM device's compatible value 
Fixes: fea4ffdef2 ("uboot-envtools: update to 2023.04")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 2023-12-13 08:52:23 +01:00
Mikhail Zhilkin
f3cdc9f988 ramips: add support for Rostelecom RT-FE-1A 
Rostelecom RT-FE-1A is a wireless WiFi 5 router manufactured by Sercomm
company.

Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 256 MiB
Flash: 128 MiB
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7615E): a/n/ac, 4x4
Ethernet: 5x GbE (WAN, LAN1, LAN2, LAN3, LAN4)
USB ports: No
Button: 2 buttons (Reset & WPS)
LEDs:
   - 1x Power (green, unmanaged)
   - 1x Status (green, gpio)
   - 1x 2.4G (green, hardware, mt76-phy0)
   - 1x 2.4G (blue, gpio)
   - 1x 5G (green, hardware, mt76-phy1)
   - 1x 5G (blue, gpio)
   - 5x Ethernet (green, hardware, 4x LAN & WAN)
Power: 12 VDC, 1.5 A
Connector type: barrel
Bootloader: U-Boot

Installation
-----------------

1.  Login to the router web interface (default http://192.168.0.1/)
    under "admin" account

2.  Navigate to Settings -> Configuration -> Save to Computer

3.  Decode the configuration. For example, using cfgtool.py tool (see
    related section):
    cfgtool.py -u configurationBackup.cfg

4.  Open configurationBackup.xml and find the following block:

<OBJECT name="User." type="object" writable="1" encryption="0" >
<OBJECT name="1." type="object" writable="1" encryption="0" >
<PARAMETER name="Password" type="string" value="<some value>" writable="1" encryption="1" password="1" />
</OBJECT>

5.  Replace <some value> by a new superadmin password and add a line
    which enabling superadmin login after. For example, the block after
    the changes:

<OBJECT name="User." type="object" writable="1" encryption="0" >
<OBJECT name="1." type="object" writable="1" encryption="0" >
<PARAMETER name="Password" type="string" value="s0meP@ss" writable="1" encryption="1" password="1" />
<PARAMETER name="Enable" type="boolean" value="1" writable="1" encryption="0"/>
</OBJECT>

6.  Encode the configuration. For example, using cfgtool.py tool:
       cfgtool.py -p configurationBackup.xml

7.  Upload the changed configuration (configurationBackup_changed.cfg) to
    the router

8.  Login to the router web interface (superadmin:xxxxxxxxxx, where
    xxxxxxxxxx is a new password from the p.5)

9.  Enable SSH access to the router (Settings -> Access control -> SSH)

10. Connect to the router using SSH shell using superadmin account

11. Run in SSH shell:
    sh

12. Make a mtd backup (optional, see related section)

13. Change bootflag to Sercomm1 and reboot:
    printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
    reboot

14. Login to the router web interface under admin account

15. Remove dots from the OpenWrt factory image filename

16. Update firmware via web using OpenWrt factory image

Revert to stock
---------------
Change bootflag to Sercomm1 in OpenWrt CLI and then reboot:
   printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3

mtd backup
----------
1. Set up a tftp server (e.g. tftpd64 for windows)
2. Connect to a router using SSH shell and run the following commands:
   cd /tmp
   for i in 0 1 2 3 4 5 6 7 8 9; do nanddump -f mtd$i /dev/mtd$i; \
   tftp -l mtd$i -p 192.168.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done
   tftp -l mtd.md5 -p 192.168.0.2

MAC Addresses
-------------
+-----+------------+---------+
| use | address    | example |
+-----+------------+---------+
| LAN | label      | f4:*:66 |
| WAN | label + 11 | f4:*:71 |
| 2g  | label + 2  | f4:*:68 |
| 5g  | label + 3  | f4:*:69 |
+-----+------------+---------+
The label MAC address was found in Factory, 0x21000

cfgtool.py
----------
A tool for decoding and encoding Sercomm configs.
Link: https://github.com/r3d5ky/sercomm_cfg_unpacker

Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
 2023-12-06 00:12:56 +01:00