Like with some other ipq40xx devices, the kernel image size for the WPJ428
is limited in stock u-boot. For that reason, the current release doesn't
include an image for the board.
By switching to the zImage format, the kernel image size is reduced which
re-enables the build process. The image boots and behaved normally through
a few days of testing.
Before the switch to kernel version 6.1, it was possible to reduce the
image size by enough when disabling UBIFS and its otherwise unneeded
dependencies.
Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
Doing a simple ping to my device shows this:
64 bytes from 10.0.253.101: icmp_seq=1 ttl=64 time=2.00 ms
64 bytes from 10.0.253.101: icmp_seq=2 ttl=64 time=2.02 ms
64 bytes from 10.0.253.101: icmp_seq=3 ttl=64 time=1.68 ms
64 bytes from 10.0.253.101: icmp_seq=4 ttl=64 time=1.91 ms
64 bytes from 10.0.253.101: icmp_seq=5 ttl=64 time=1.92 ms
64 bytes from 10.0.253.101: icmp_seq=6 ttl=64 time=2.04 ms
Some users even report higher values on older kernels:
64 bytes from 192.168.1.10: seq=0 ttl=64 time=0.612 ms
64 bytes from 192.168.1.10: seq=1 ttl=64 time=2.852 ms
64 bytes from 192.168.1.10: seq=2 ttl=64 time=2.719 ms
64 bytes from 192.168.1.10: seq=3 ttl=64 time=2.741 ms
64 bytes from 192.168.1.10: seq=4 ttl=64 time=2.808 ms
The problem is that the governor is set to Ondemand, which causes
the CPU to clock all the way down to 48MHz in some cases.
Switching to performance governor:
64 bytes from 10.0.253.101: icmp_seq=1 ttl=64 time=0.528 ms
64 bytes from 10.0.253.101: icmp_seq=2 ttl=64 time=0.561 ms
64 bytes from 10.0.253.101: icmp_seq=3 ttl=64 time=0.633 ms
64 bytes from 10.0.253.101: icmp_seq=4 ttl=64 time=0.526 ms
In theory, using the Performance governor should increase power draw,
but it looks like it really does not matter for this soc.
Using a calibrated precision DC power supply (cpu idle):
Ondemand
24.00V * 0.134A = 3.216 Watts
48.00V * 0.096A = 4.608 Watts
Performance
24.00V * 0.135A = 3.240 Watts
48.00V * 0.096A = 4.608 Watts
Let's simply switch to the Performance governor by default
to fix the general jittery behaviour on devices using this soc.
Tested on: MikroTik wAP ac
Fixes: #13649
Reviewed-by: Robert Marko <robimarko@gmail.com>
Reviewed-by: Thibaut VARÈNE <hacks@slashdirt.org>
Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
Google WiFi board has what seems as debug version of TZ/QSEE and it is
always enabling SDI (Secure Debug Image) and in order to do a regular
reboot it must be disabled, as otherwise you are stuck in a debug state
where you are supposed to extract debug logs via QCA tooling which is not
helpfull at all for regular users.
So, instead of using our downstream version to disable SDI lets use the
version that was merged upstream and relies on a boolean property in the
SCM node instead of checking the compatible.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Tested-by: Brian Norris <computersforpeace@gmail.com>
This in a single image to run many types of hardware in the AP391x
series (AP3912/AP3915/AP3916/AP3917/AP7662).
Hardware
--------
Qualcomm IPQ4029 WiSoC
2T2R 802.11 abgn
2T2R 802.11 nac
Macronix MX25L25635E SPI-NOR (32M)
512M DDR3 RAM
1-4x Gigabit Ethernet
Senao EXT1025 HD Camera (AP3916 only)
USB 2.0 Port (AP3915e only)
1x Cisco RJ-45 Console port
- except for AP3916 and AP3912 where there is no external serial
console and it is TDB how to solder one. Possibly J12 is UART with
pin1 = 3.3V, pin2 = GND, pin3 = TXD, pin4 = RXD.
- Settings: 115200 8N1
Installation With Serial Console
--------------------------------
1. Attach to the Console port. Power up the device and press the s key
to interrupt autoboot.
2. The default username / password to the bootloader is admin / new2day
3. Check uboot variables using printenv, and update if necessary:
$ setenv AP_MODE 0
$ setenv WATCHDOG_COUNT 0
$ setenv WATCHDOG_LIMIT 0
$ setenv AP_PERSONALITY identifi
$ setenv serverip <SERVER_IPADDR>
$ setenv ipaddr <UNIQUE_IPADDR>
$ setenv MOSTRECENTKERNEL 0; ## OpenWRT only uses the primary image
$ saveenv
$ saveenv ## 2nd time to write the secondary copy
4. On the TFTP server located at <SERVER_IPADDR>, download the OpenWrt
initramfs image. Rename and serve it as vmlinux.gz.uImage.3912
5. TFTP boot the OpenWrt initramfs image from the AP serial console:
$ run boot_net
6. Wait for OpenWrt to start. Internet port sw-eth5 is assiged to LAN
bridge and sw-eth4 (if available) is assigned to WAN. The LAN port
will use default IP address 192.168.1.1 and run a DHCP server.
If you already have a working DHCP server or already have 192.168.1.1
on your network you MUST DISCONNECT the LAN cable from your active
network immediately after the power/status LED turns green!
At this point, you need to temporarily reconfigure the AP to have
a way to transfer the OpenWRT sysupgrade image to it.
Reconfigure the newly converted OpenWRT AP using serial console or
plug in a PC to a sw-eth5 as a separate network. Note -- the LAN/WAN
port assignments were designed to make it possible to convert to
OpenWRT without serial console and using a common firmware
image for many AP models -- they may not make the most sense when
fully deployed.
7. Download and transfer the sysupgrade image to the device using e.g.
SCP.
8. Install OpenWrt to the device using "sysupgrade"
$ sysupgrade -n /path/to/openwrt.bin
9. After it boots up again, as in step 6, connect to AP and reconfigure
for final deployment.
This build supports APs in the AP391x series and similar such as WiNG
AP7662.
Ethernet devices within OpenWRT are named "sw-eth1" thru "sw-eth5".
Mapping from OpenWRT internal naming to external naming on the case is
as follows:
```
|sw-eth1|sw-eth2|sw-eth3|sw-eth4|sw-eth5
------------+-------+-------+-------+-------+-------
AP3917 | | | | GE2 | GE1
------------+-------+-------+-------+-------+-------
AP7662 | | | | GE2 | GE1
------------+-------+-------+-------+-------+-------
AP3916 | | | | CAM* | GE1
------------+-------+-------+-------+-------+-------
AP3915 | | | | | GE1
------------+-------+-------+-------+-------+-------
AP3912 | | P1 | P2 | P3 | LAN1
------------+-------+-------+-------+-------+-------
```
By default sw-eth4 is mapped to WAN. All others are assigned to the
LAN.
CAM* - On AP3916, sw-eth4 is the camera's interface. You should
reconfigure this to be on LAN after OpenWRT boots from flash.
Installation Without Serial Console
-----------------------------------
The main premise is to set u-boot environment variables using the
Extreme Networks firmware's rdwr_boot_cfg program.
$ rdwr_boot_cfg
Utility to manipulate the boot ROM config blocks
All errors are written to the sytem log file (/tmp/log/ap.log)
```
Usage: rdwr_boot_cfg <read_all|read_var|read_var_f|write_var|rm_var> ...
read_all read the entire active block
read_var <var> read a single variable from the active block
read_var_f <var> read a single variable from the active block
(formatted)
write_var <var=val> write a single variable/value pair to both
blocks
rm_var <var> delete a single variable from both blocks
```
WARNING: Be very sure you have set the u-boot environment correctly.
If not, it can only be fixed by attaching serial console!
Be aware that the Extreme Networks shell environment will automatically
reboot every 5 minutes if there is no controller present.
Read and understand these steps fully before attempting. It is easy
to make mistakes!
1. Place the OpenWRT initramfs on the TFTP server and name it as
vmlinux.gz.uImage.3912
2. Boot up to Extreme Networks WING-Campus mode OS. Port GE1/LAN1
will be a DHCP **client**. Find out the IP address from your DHCP
server and SSH in. Default user/passwd is admin/new2day or
admin/admin123.
If it is booting to WING-Distributed mode, use this command to
convert to Campus mode.
$ operational-mode centralized
3. Upon bootup you have about 5mins to changed these u-boot variables
if necessary using the rdwr_boot_cfg command in Linux shell:
$ rdwr_boot_cfg write_var AP_MODE=0
$ rdwr_boot_cfg write_var MOSTRECENTKERNEL=0
$ rdwr_boot_cfg write_var WATCHDOG_COUNT=0
$ rdwr_boot_cfg write_var WATCHDOG_LIMIT=0
$ rdwr_boot_cfg write_var AP_PERSONALITY=identifi
$ rdwr_boot_cfg write_var serverip=<SERVER_IPADDR>
$ rdwr_boot_cfg write_var ipaddr=<UNIQUE_IPADDR>
$ rdwr_boot_cfg write_var bootcmd="run boot_net"
4. Reboot AP.
5. Connect PC with ethernet to GE1/LAN1 port. You should get a
DHCP address in the 192.168.1.x range and should be able to
SSH to the new OpenWRT TFTP recovery/installation shell.
6. At this point, u-boot is still set to TFTP boot, so you have to
replace the TFTP image with the original Extreme Networks image so
that you can change the u-boot environment.
See the instructions for Extracting Extreme Networks firmware
image.
DON'T REBOOT YET!
7. Next you must follow steps 6 thru 8 from the Installation with serial
console. After which you should have OpenWRT installed to primary
flash firmware.
8. Now Reboot. This time it will boot using TFTP into Extreme Networks
image. You may need to reconnect cables at this point -- GE1/LAN1
will be a DHCP **client** and you can SSH in -- just like step 2.
Get the IP address from you own DHCP server.
9. Set u-boot env as follows:
$ rdwr_boot_cfg write_var MOSTRECENTKERNEL=0
$ rdwr_boot_cfg write_var WATCHDOG_COUNT=0
$ rdwr_boot_cfg write_var bootcmd="run boot_flash"
10. Reboot AP. This time it should be into OpenWRT. GE1/LAN1 will be
a DHCP **server** and have static IP 192.168.1.1 -- just like step 5.
11. SSH into the LAN port and reconfigure to final configuration. Don't
make any changes that prevent you from SSH or Luci access!
Restoring Extreme Networks firmware
-----------------------------------
Assuming you have the original Extreme Networks image:
1. Login to OpenWRT shell
2. scp the Extreme Networks packaged firmware image file AP391x-*.img to
/tmp
3. Extract the firmware uimage file:
$ tar xjf AP391x-*.img vmlinux.gz.uImage
4. Force run sysupgrade:
$ sysupgrade -F /tmp/AP391x-*.img /
5. Restore the u-boot varable(s):
$ rdwr_boot_cfg write_var WATCHDOG_LIMIT=3
USB 2.0 Port on AP3915e
-----------------------
Enable this by setting LED "eth:amber_or_usb_enable" to ALWAYS ON.
Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Glen Lee <g2lee@yahoo.com>
While adding support for the MF282 Plus, an entry in platform.sh was
overlooked - this fixes sysupgrade on this devices.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
While refactoring support for the MF287 series, an entry in platform.sh
was overlooked - this fixes sysupgrade on this devices.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
Apparently, a few ipq40xx devices have sporadic problems when reading the
flash over SPI. When that happens, the result of the faulty SPI read is
cached and it isn't re-attempted. Depending on when it happens, the router
either panics and reboots or is left in a partially broken state (an
application wont start).
The data on the flash is alright.
This wasn't the case with Openwrt with Linux < 5.x but I wasn't able to
work out which software change was responsible.
Github user karlpip created a patch for testing that disabled the cache
entirely and added logs. Typically, only one or two SPI operations fail at
a time:
[689200.631152] spi-nor spi0.0: SPI transfer failed: -110
[689200.631280] spi_master spi0: failed to transfer one message from queue
[689200.635369] jffs2: Write of 68 bytes at 0x00ffccf4 failed. returned -110, retlen 0
[689200.642014] jffs2: Not marking the space at 0x00ffccf4 as dirty because the flash driver returned retlen zero
Because reads aren't re-attempted, squashfs can't recover:
[3171844.279235] SQUASHFS error: Failed to read block 0x2bb912: -5
[3171844.279284] SQUASHFS error: Unable to read fragment cache entry [2bb912]
[3171844.283980] SQUASHFS error: Unable to read page, block 2bb912, size 14e6c
[3171844.291650] SQUASHFS error: Unable to read fragment cache entry [2bb912]
[3171844.297831] SQUASHFS error: Unable to read page, block 2bb912, size 14e6c
I assume there to be some kind of underlying electrical problem because,
in my experience, this happens a lot more when PoE is used.
NoTengoBattery has made an in-depth investigation:
https://forum.openwrt.org/t/patch-squashfs-data-probably-corrupt/70480
.. and created a patch that evicts the page cache and retries reading:
https://github.com/NoTengoBattery/openwrt/blob/linksys-ea6350v3-mastertrack/target/linux/ipq40xx/patches-5.4/9996-fs_squashfs_improve_squashfs_error_resistance.patch
The patch also works well with the WPJ428 but NoTengoBattery didn't try to
upstream it ("This is not the solution that should be used").
In 2020, I tried and failed to create a working patch that prevents faulty pages to
be cached in the first place. Because I needed a solution, I backported
"squashfs: add option to panic on errors " (10dde05b89980ef)
which has since become available in Openwrt.
The 'error=panic' option has been tested on a fleet of multiple hundred
WPJ428s over multiple years. Without this patch, devices regularly went
into 'limbo' on reboot or update and required a manual reboot.
Devices with this patch don't. I was initially concerned that the kernel
panic would leave devices with a real corrupted data but I haven't seen a
case of actual corruption since (outside of people turning off the power
during upgrades).
The WPJ428 is the only device I tested this patch on - others might also
benefit.
Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
The ZTE MF282 Plus is a LTE router used (exclusively?) by the network
operator "3". It is very similar to the MF286/MF287 but in the form factor
of the MF282.
Specifications
==============
SoC: IPQ4019
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 1x GBit LAN
LTE: ZTE Cat6
WiFi: 802.11a/b/g/n/ac SoC-integrated
MAC addresses
=============
LAN: from config
WiFi 1: from config + 1
WiFi 2: from config + 2
Installation
============
Option 1 - TFTP
---------------
TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:
setenv serverip 192.168.1.100
setenv ipaddr 192.168.1.1
tftpboot 0x84000000 openwrt.bin
bootm 0x84000000
From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:
ubiattach -m9
cat /dev/ubi0_0 > /tmp/ubi0_0
cat /dev/ubi0_1 > /tmp/ubi0_1
Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.
Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:
ubirmvol /dev/ubi0 -N ubi_rootfs
ubirmvol /dev/ubi0 -N kernel
Option 2 - From stock firmware
------------------------------
The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.
The exploit will be available at the device wiki page.
Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".
ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd9 is the partition labelled "rootfs" by calling
"cat /proc/mtd".
Complete commands:
cd /tmp
tftp -g -r factory.bin 192.168.0.22
cat /proc/driver/sensor_id
flash_erase /dev/mtd9 0 0
dd if=/tmp/factory.bin of=/dev/mtdblock9 bs=131072
Afterwards, reboot your device and you should have a working OpenWrt
installation.
Restore Stock
=============
Option 1 - via UART
-------------------
Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.
Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.
ubiattach -m 9
ubirmvol /dev/ubi0 -N kernel
ubirmvol /dev/ubi0 -N rootfs
ubirmvol /dev/ubi0 -N rootfs_data
ubimkvol /dev/ubi0 -N kernel -s $kernel_length
ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1
Option 2 - from within OpenWrt
------------------------------
This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.
Follow the commands from Option 1 to flash back to stock.
LTE Modem
=========
The LTE modem is similar to the MF286R, it provides an RNDIS interface
and an AT interface.
Other Notes
===========
There is one GPIO Switch "Power button blocker" which, if enabled, does not
trigger a reset of the SoC if the modem reboots. If disabled, the SoC is
rebooted along with the modem. The modem can be rebooted via the exported
GPIO "modem-reset" in /sys/class/gpio.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
Turn the "gpio-restart" node into a "gpio-export" node for all MF287
variants, similar to the MF287 Pro. Unfortunately, there doesn't seem to be
a "power button blocker" GPIO for the MF287 and MF287 Plus, so a modem
reset always triggers a system reset.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
The ZTE MF287 requires a different board calibration file for ath10k than
the ZTE MF287+. The two devices receive their own DTS, thus the device tree
is slightly refactored.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
For the ZTE MF287 series, a special recovery image is built. The Makefile
worked fine on snapshot, but created corrupt images on the 23.05 images.
By using the appropriate variable, this should be fixed.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
Kernel config for 6.1 on ipq40xx is missing the config for
CONFIG_NVMEM_QCOM_SEC_QFPROM which them makes the build stop with a prompt.
Symbol is there in 5.15 config but 6.1 config was based of a version that
does not yet have it set as it was introduced after the 6.1 PR.
So, disable CONFIG_NVMEM_QCOM_SEC_QFPROM to fix building on 6.1.
Fixes: 825cfa4e36 ("ipq40xx: 6.1: refresh kernel config")
Signed-off-by: Robert Marko <robimarko@gmail.com>
This pulls-in the latest version of qca8k based IPQ4019 driver as well as
the latest version of IPQESS that was sent upstream.
Both qca8k and IPQESS have been improved and cleaned up compared to current
version of patches.
PSGMII PHY mode and missing reset have been upstreamed and will be in
the kernel 6.6.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Adapt and refresh patches to apply.
DSA and ethernet driver patches are dropped as they will be replaced with
the latest version that was sent upstream.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Kernel 6.1 has changed format of sfp_parse_support(), so lets adapt to
those changes so it works on newer kernels as well.
Signed-off-by: Robert Marko <robimarko@gmail.com>
As a preparation to move to 6.1, we need to move the DSA and ethernet
drivers to a 5.15 specific directory as 6.1 will use the latest patchset
that was sent upstream which is too hard to backport to 5.15.
Signed-off-by: Robert Marko <robimarko@gmail.com>
This adds support for the RBR40 and RBS40 (sold together as RBK40),
two netgear routers identical to SRR60/SRS60 in all but antennae (and
hardware id). See 2cb24b3f3c for details.
Signed-off-by: Thomas Makin <halorocker89@gmail.com>
The bootcmd limits the kernel to 4 MiB which is
exceeded when using Device/FitImage. Device/FitzImage
reduces the size to around 3 MiB.
Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Thomas Bong <thomas.bong@devolo.de>
Renamed the interfaces to match the other devices.
Name the interface connected to the builtin G.hn chip 'ghn'.
This might toggle at runtime while the G.hn chip is in the
bootloader.
Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Thomas Bong <thomas.bong@devolo.de>
Import commits from upstream Linux replacing some downstream patches.
Move accepted patches from pending-{5.15,6.1} to backport-{5.15,6.1}.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The MAC address of the GMAC is contained inside the CWMP-Account
number on the label.
The label MAC address alias was defined previously, but it has been
removed with the switch to IPQESS / DSA.
Restore the label MAC address alias.
Fixes: 27b441cbaf ("ipq40xx: drop ESSEDMA + AR40xx DTS nodes")
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Marko <robimarko@gmail.com>
qca8k driver we are currently based of is rather out of date and is lacking
support for setting the ageing time or fast ageing so until we update the
driver lets just backport support for those from qca8k.
Signed-off-by: Robert Marko <robimarko@gmail.com>
The ZTE MF287 Pro is a LTE router used (exclusively?) by the network
operator "3". It is very similar to the MF287+, but the hardware layout
and partition layout have changed quite a bit.
Specifications
==============
SoC: IPQ4018
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 4x GBit LAN
LTE: ZTE Cat12
WiFi: 802.11a/b/g/n/ac SoC-integrated
USB: 1x 2.0
MAC addresses
=============
LAN: from config + 2
WiFi 1: from config
WiFi 2: from config + 1
Installation
============
Option 1 - TFTP
---------------
TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:
setenv serverip 192.168.1.100
setenv ipaddr 192.168.1.1
tftpboot 0x82000000 openwrt.bin
bootm 0x82000000
From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:
ubiattach -m17
cat /dev/ubi0_0 > /tmp/ubi0_0
cat /dev/ubi0_1 > /tmp/ubi0_1
Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.
Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:
ubirmvol /dev/ubi0 -N ubi_rootfs
ubirmvol /dev/ubi0 -N kernel
Option 2 - From stock firmware
------------------------------
The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.
The exploit will be available at the device wiki page.
Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".
ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd13 is the partition labelled "rootfs" by calling
"cat /proc/mtd".
Complete commands:
cd /tmp
tftp -g -r factory.bin 192.168.0.22
cat /proc/driver/sensor_id
flash_erase /dev/mtd17 0 0
dd if=/tmp/factory.bin of=/dev/mtdblock17 bs=131072
Afterwards, reboot your device and you should have a working OpenWrt
installation.
Restore Stock
=============
Option 1 - via UART
-------------------
Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.
Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.
ubiattach -m 17
ubirmvol /dev/ubi0 -N kernel
ubirmvol /dev/ubi0 -N rootfs
ubirmvol /dev/ubi0 -N rootfs_data
ubimkvol /dev/ubi0 -N kernel -s $kernel_length
ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1
Option 2 - from within OpenWrt
------------------------------
This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.
Follow the commands from Option 1 to flash back to stock.
LTE Modem
=========
The LTE modem is similar to other ZTE devices and controls some more LEDs
and battery management.
Configuring the connection using uqmi works properly, the modem
provides three serial ports and a QMI CDC ethernet interface.
Other Notes
===========
Contrary to the stock firmware, the USB port on the back can be used.
There is one GPIO Switch "Power button blocker" which, if enabled, does not
trigger a reset of the SoC if the modem reboots. If disabled, the SoC is
rebooted along with the modem. The modem can be rebooted via the exported
GPIO "modem-reset" in /sys/class/gpio.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
DK01 and DK04 board support has been in a form of 2 patches that we have
been carrying for a long time.
Both of the patches contain weird changes, dont follow any DT syntax and I
honestly doubt they are even valid.
DK01 and DK04 also have not been converted to DSA even after a long time
and I doubt that anybody in the community even has these boards as they are
QCA reference boards that are not even obtainable anymore.
Since patches for these 2 boards have been just causing us pain when trying
to update the kernel to a new major release or even point releases lets
remove the support for these boards, and if there are users they can easily
be reinstated.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Teltonika RUTX currently is the only device pulling in DK01 DTSI and thus
preventing removal of DK01 and DK04 support.
So, lets add the missing nodes from DK01 DTSI and use the SoC DTSI instead.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Lets add a proper commit title and description to the SCM cold boot
patch so it applies with a git apply or git-am.
Signed-off-by: Robert Marko <robimarko@gmail.com>
SCM SDI disable support is pending upstream, so lets use that instead.
Since the board check needs to be split out, export it with a header so
it applies with git-am.
Signed-off-by: Robert Marko <robimarko@gmail.com>
It seems that the Meraki bootloader does not respect the kernel ARM booting
specification[1] that requires that address where DTB is located needs to
be 64-bit aligned and often places the DTB on a non 64-bit aligned address
and then kernel fails to find the DTB magic and fails to boot.
Even worse, there is no prints until early printk is enabled and then its
visible that kernel is trying to find the ATAG-s as DTB was not found or
is invalid.
Unifi 6 devices had the same issue and it can be solved by passing the
load adress as part of the FIT image.
It seems that the vendor was aware of the issue and is always relocating
the DTB to 0x89000000, so lets just do the same.
Now that booting is reliable, reenable default images for the Meraki MR33
and MR74 devices.
Reviewed-by: Lech Perczak lech.perczak@gmail.com
Signed-off-by: Robert Marko <robimarko@gmail.com>
ipq40xx was converted to DSA and swconfig is not being included at all in
the default packages so there is no need to drop it from device packages.
Signed-off-by: Robert Marko <robimarko@gmail.com>
MR33 and MR74 share pretty much everything in the image recipe, so lets
extract a common recipe to avoid duplication.
Signed-off-by: Robert Marko <robimarko@gmail.com>
new versions of the device have NAND with 8bit ECC
which was not yet supported before. This change removes
ECC restrictions.
Signed-off-by: Alexander Friese <af944580@googlemail.com>
Hardware
--------
CPU: Qualcomm IPQ4018
RAM: 256M
Flash: 16MB SPI-NOR (W25Q128)
128MB SPI-NAND (XTX)
WiFi: 2T2R (2GHz 802.11n ; 5 GHz 802.11ac)
ETH: 4x LAN ; 1x WAN (Gigabit)
CELL: Quectel RG501Q 3G/4G/5G
UART: Available on the goldfinger connector (Pinout silkscreened)
115200 8N1 3V3 - Only connect RX / TX / GND
Installation
------------
1. Enable SSH in the Teltonika UI
(System --> Administration --> Access Control)
2. Check from which partition set the device is currently running from.
$ cat /proc/boot_info/rootfs/primaryboot
In case this output reads 0, install a Software update from Teltonika
first. After upgrade completion, check this file now reads 1 before
continuing.
2. Transfer the OpenWrt factory image to the device using scp. Use the
same password (user root!) as used for the Web-UI.
$ scp -O openwrt-factory.bin root@192.168.1.1:/tmp
3. Connect to the device using ssh as the root user.
4. Install OpenWrt by writing the factory image to flash.
$ ubiformat /dev/mtd16 -y -f /tmp/openwrt-factory.bin
5. Instruct the bootloaer to boot from the first partition set.
$ echo 0 > /proc/boot_info/rootfs/primaryboot
$ cat /proc/boot_info/getbinary_bootconfig > /tmp/bootconfig.bin
$ cat /proc/boot_info/getbinary_bootconfig1 > /tmp/bootconfig1.bin
$ mtd write /tmp/bootconfig.bin /dev/mtd2
$ mtd write /tmp/bootconfig1.bin /dev/mtd3
6. Reboot the device.
$ reboot
Signed-off-by: David Bauer <mail@david-bauer.net>
The upstream board-2.bin file in the linux-firmware.git
repository for the QCA4019 contains a packed board-2.bin
for this device for both 2.4G and 5G wifis. This isn't
something that the ath10k driver supports.
Until this feature either gets implemented - which is
very unlikely -, or the upstream boardfile is mended
(both, the original submitter and ath10k-firmware
custodian have been notified). OpenWrt will go back
and use its own bespoke boardfile. This unfortunately
means that 2.4G and on some revisions the 5G WiFi is
not available in the initramfs image for this device.
Fixes: #12886
Reported-by: Christian Heuff <christian@heuff.at>
Debugged-by: Georgios Kourachanis <geo.kourachanis@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
The ZTE MF287+ is a LTE router used (exclusively?) by the network operator
"3". The MF287 (i.e. non-plus aka 3Neo) is also supported (the only
difference is the LTE modem)
Specifications
==============
SoC: IPQ4018
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 4x GBit LAN
LTE: ZTE Cat12 (MF287+) / ZTE Cat6 (MF287)
WiFi: 802.11a/b/g/n/ac SoC-integrated
MAC addresses
=============
LAN: from config + 2
WiFi 1: from config
WiFi 2: from config + 1
Installation
============
Option 1 - TFTP
---------------
TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:
setenv serverip 192.168.1.100
setenv ipaddr 192.168.1.1
tftpboot 0x82000000 openwrt.bin
bootm 0x82000000
From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:
ubiattach -m14
cat /dev/ubi0_0 > /tmp/ubi0_0
cat /dev/ubi0_1 > /tmp/ubi0_1
Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.
Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:
ubirmvol /dev/ubi0 -N ubi_rootfs
ubirmvol /dev/ubi0 -N kernel
Option 2 - From stock firmware
------------------------------
The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.
The exploit will be available at the device wiki page.
Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".
ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd13 is the partition labelled "rootfs" by calling
"cat /proc/mtd".
Complete commands:
cd /tmp
tftp -g -r factory.bin 192.168.0.22
cat /proc/driver/sensor_id
flash_erase /dev/mtd13 0 0
dd if=/tmp/factory.bin of=/dev/mtdblock13 bs=131072
Afterwards, reboot your device and you should have a working OpenWrt
installation.
Restore Stock
=============
Option 1 - via UART
-------------------
Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.
Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.
ubiattach -m 14
ubirmvol /dev/ubi0 -N kernel
ubirmvol /dev/ubi0 -N rootfs
ubirmvol /dev/ubi0 -N rootfs_data
ubimkvol /dev/ubi0 -N kernel -s $kernel_length
ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1
Option 2 - from within OpenWrt
------------------------------
This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.
Follow the commands from Option 1 to flash back to stock.
LTE Modem
=========
The LTE modem is similar to other ZTE devices and controls some more LEDs
and battery management.
Configuring the connection using uqmi works properly, the modem
provides three serial ports and a QMI CDC ethernet interface.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
