The "netgear,uimage" parser can be replaced by the generic
parser using device specific openwrt,ih-magic and
openwrt,ih-type properties.
Device tree properties for the following devices have not
been set, as they have been dropped from OpenWrt with the
removal of the ar71xx target:
FW_MAGIC_WNR2000V1 0x32303031
FW_MAGIC_WNR2000V4 0x32303034
FW_MAGIC_WNR1000V2_VC 0x31303030
FW_MAGIC_WPN824N 0x31313030
Tested-by: Sander Vanheule <sander@svanheule.net> # WNDR3700v2
Tested-by: Stijn Segers <foss@volatilesystems.org> # WNDR3700v1
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Convert users to the generic "openwrt,uimage" using device specific
"openwrt,ih-magic" properties, and remove "allnet,uimage".
Signed-off-by: Bjørn Mork <bjorn@mork.no>
The only difference between the "openwrt,okli" and the generic
parser is the magic. Set this in device tree for all affected
devices and remove the "openwrt,okli" parser.
Tested-by: Michael Pratt <mcpratt@protonmail.com> # EAP300 v2, ENS202EXT and ENH202
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Convert users of the "fonfxc" and "sge" parsers to the generic
"openwrt,uimage", using device specific "openwrt,padding" properties.
Tested-by: Stijn Segers <foss@volatilesystems.org> [DIR-878 A1]
Signed-off-by: Bjørn Mork <bjorn@mork.no>
It's required for BCM4908. It cannot use "bcm-wfi-fw" parser because
that one requires *two* JFFS2 partitions which is untested / unsupported
on the BCM4908 architecture. With a single JFFS2 partition "bcm-wfi-fw"
parser will:
1. Fail to find "vmlinux.lz" as it doesn't follow "1-openwrt" file
2. Create partitions that don't precisely match bootfs layout
The new parser is described in details in the MTD_SPLIT_CFE_BOOTFS
symbol help message.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Sync ethernet driver code with upstream Linux kernel:
-Reduce xmit_more code changes.
-Combine rx cleanup code into a function.
-Convert to build_skb.
-Improve rx loop by optimizing loop tracking.
https://lore.kernel.org/netdev/20210106144208.1935-1-liew.s.piaw@gmail.com/
Signed-off-by: Sieng Piaw Liew <liew.s.piaw@gmail.com>
[Amend commit description, move patches to the top since they are going to be
upstreamed]
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Hamming ECC devices do not cover OOB data, as opposed to BCH ECC devices.
Therefore, disabling ECC for all devices is preventing BCH devices from
correctly reading and writing the OOB data.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
The OEM assignment of LAN ports is swapped.
Fixes: c2a7bb520a ("ramips: mt7621: add support for Xiaomi Mi Router 4")
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Xiaomi Mi Router 4 is the same as Xiaomi Mi Router 3G, except for
the RAM (256Mib→128Mib), LEDs and gpio (MiNet button).
Specifications:
Power: 12 VDC, 1 A
Connector type: barrel
CPU1: MediaTek MT7621A (880 MHz, 4 cores)
FLA1: 128 MiB (ESMT F59L1G81MA)
RAM1: 128 MiB (ESMT M15T1G1664A)
WI1 chip1: MediaTek MT7603EN
WI1 802dot11 protocols: bgn
WI1 MIMO config: 2x2:2
WI1 antenna connector: U.FL
WI2 chip1: MediaTek MT7612EN
WI2 802dot11 protocols: an+ac
WI2 MIMO config: 2x2:2
WI2 antenna connector: U.FL
ETH chip1: MediaTek MT7621A
Switch: MediaTek MT7621A
UART Serial
[o] TX
[o] GND
[o] RX
[ ] VCC - Do not connect it
MAC addresses as verified by OEM firmware:
use address source
LAN *:c2 factory 0xe000 (label)
WAN *:c3 factory 0xe006
2g *:c4 factory 0x0000
5g *:c5 factory 0x8000
Flashing instructions:
1.Create a simple http server (nginx etc)
2.set uart enable
To enable writing to the console, you must reset to factory settings
Then you see uboot boot, press the keyboard 4 button (enter uboot command line)
If it is not successful, repeat the above operation of restoring the factory settings.
After entering the uboot command line, type:
setenv uart_en 1
saveenv
boot
3.use shell in uart
cd /tmp
wget http://"your_computer_ip:80"/openwrt-ramips-mt7621-xiaomi_mir4-squashfs-kernel1.bin
wget http://"your_computer_ip:80"/openwrt-ramips-mt7621-xiaomi_mir4-squashfs-rootfs0.bin
mtd write openwrt-ramips-mt7621-xiaomi_mir4-squashfs-kernel1.bin kernel1
mtd write openwrt-ramips-mt7621-xiaomi_mir4-squashfs-rootfs0.bin rootfs0
nvram set flag_try_sys1_failed=1
nvram commit
reboot
4.login to the router http://192.168.1.1/
Installation via Software exploit
Find the instructions in the https://github.com/acecilia/OpenWRTInvasion
Signed-off-by: Dmytro Oz <sequentiality@gmail.com>
[commit message facelift, rebase onto shared DTSI/common device
definition, bump uboot-envtools]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This creates a DTSI for Xiaomi devices with 128M NAND.
This allows to consolidate the partitions and a few other nodes for
AC2100 family and Mi Router 3G.
Note that the Mi Router 3 Pro has 256M NAND and differently sized
partitions.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This creates a shared device definition for Xiaomi devices with
NAND and "separate" images, i.e. kernel1.bin and rootfs0.bin.
This allows to consolidate similar/duplicate code for AC2100 family
and Mi Router 3G.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Since generic images have been split to their own
Makefile boards are showing up twice in menuconfig
as $(eval $(call BuildImage)) was not dropped from
the new generic.mk.
Hence $(eval $(call BuildImage)) was being called
twice.
So, lets simply drop it from generic.mk.
Fixes: 378c7ff282 ("ipq40xx: split generic images into own file")
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
There seems to be a problem with setting #WP. On the other hand ignoring
the #WP seems to work. rootfs_data UBI volume seems to persist changes.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
BCM4908 bootloader requires firmware with JFFS2 image containing:
1. cferam.000
2. 94908.dtb
3. vmlinux.lz
4. device custom files
cferam.000 can be obtained from the bcm63xx-cfe repository.
device custom files are stored in images dir.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
procd doesn't work with just serial specified in the DT (using chosen &
stdout-path). It requires tty device to be explicitly specified in the
cmdline.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
1. It's useful for developing & validating DTS files inside OpenWrt
2. This will allow backporting later changes that depend on it
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
All modification made by update_kernel.sh in a fresh clone without
existing toolchains.
Build system: x86_64
Build-tested: ipq806x/R7800, bcm27xx/bcm2711
Run-tested: ipq806x/R7800
No dmesg regressions, everything functional
Signed-off-by: John Audia <graysky@archlinux.us>
Tested-by: Curtis Deptuck <curtdept@me.com> [x86/64]
Device specifications:
======================
* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 3T3R 2.4 GHz Wi-Fi (11n)
* 3T3R 5 GHz Wi-Fi (11ac)
* 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 1x ethernet
- AR8035 ethernet PHY (RGMII)
- 10/100/1000 Mbps Ethernet
- 802.3af POE
- used as LAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
[rebase, add LED migration]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Device specifications:
======================
* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 3T3R 2.4 GHz Wi-Fi (11n)
* 3T3R 5 GHz Wi-Fi (11ac)
* 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 1x ethernet
- AR8035 ethernet PHY (RGMII)
- 10/100/1000 Mbps Ethernet
- 802.3af POE
- used as LAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
[rebase, apply shared DTSI/device node, add LED migration]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The OpenMesh MR900 and to-be-added MR1750 family are very similar.
Make the existing MR900 DTSI more general so it can be used for
the MR1750 devices as well.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The shared image definitions for OpenMesh devices are currently
organized based on device families. This introduces some duplicate
code, as the image creation code is mostly the same for those.
This patch thus derives two basic shared definitions that work for
all devices and only requires a few variables to be moved back to
the device definitions.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The OpenMesh MR900 is a modified version of the Exx900/Exx1750 family.
These devices are shipped with an AR803x PHY and had various problems with
the delay configuration in ar71xx. These problems are now in the past [1]
and parts of the delay configuration should now be done in the PHY only.
Just switch to the configuration of the ECB1750 to have an already well
tested configuration for ath79 with the newer kernel versions.
[1] https://github.com/openwrt/openwrt/pull/3505#issuecomment-716050292
Reported-by: Michael Pratt <mcpratt@pm.me>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Device specifications:
======================
* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 3T3R 2.4 GHz Wi-Fi
* 3T3R 5 GHz Wi-Fi
* 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 1x ethernet
- AR8035 ethernet PHY (RGMII)
- 10/100/1000 Mbps Ethernet
- 802.3af POE
- used as LAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
[rebase, add LED migration]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Device specifications:
======================
* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/240 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 3T3R 2.4 GHz Wi-Fi
* 3T3R 5 GHz Wi-Fi
* 6x GPIO-LEDs (2x wifi, 2x status, 1x lan, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 1x ethernet
- AR8035 ethernet PHY (RGMII)
- 10/100/1000 Mbps Ethernet
- 802.3af POE
- used as LAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
[rebase, add LED migration]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The OpenMesh MR600 is a modified version of the EAP600 family. These
devices are shipped with an AR803x PHY and had various problems with the
delay configuration in ar71xx. These problems are now in the past [1] and
parts of the delay configuration should now be done in the PHY only.
Just switch to the configuration of the EAP600 to have an already well
tested configuration for ath79 with the newer kernel versions.
[1] https://github.com/openwrt/openwrt/pull/3505#issuecomment-716050292
Reported-by: Michael Pratt <mcpratt@pm.me>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Device specifications:
======================
* Qualcomm/Atheros AR9344 rev 2
* 560/450/225 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2T2R 2.4 GHz Wi-Fi
* 2T2R 5 GHz Wi-Fi
* 8x GPIO-LEDs (6x wifi, 1x wps, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 1x ethernet
- AR8035 ethernet PHY (RGMII)
- 10/100/1000 Mbps Ethernet
- 802.3af POE
- used as LAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
[rebase, add LED migration]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Device specifications:
======================
* Qualcomm/Atheros AR9344 rev 2
* 560/450/225 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2T2R 2.4 GHz Wi-Fi
* 2T2R 5 GHz Wi-Fi
* 4x GPIO-LEDs (2x wifi, 1x wps, 1x power)
* 1x GPIO-button (reset)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 1x ethernet
- AR8035 ethernet PHY (RGMII)
- 10/100/1000 Mbps Ethernet
- 802.3af POE
- used as LAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
[rebase, make WLAN LEDs consistent, add LED migration]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
All modification made by update_kernel.sh in a fresh clone without
existing toolchains.
Build system: x86_64
Build-tested: ipq806x/R7800, bcm27xx/bcm2711
Run-tested: ipq806x/R7800
No dmesg regressions, everything functional
Signed-off-by: John Audia <graysky@archlinux.us>
Tested-by: Curtis Deptuck <curtdept@me.com> [x86/64]
These devices do not run Ubiquiti AirOS. Rename the partition to the
name used by other UniFi devices with vendor dualboot support.
Signed-off-by: David Bauer <mail@david-bauer.net>
The NanoPi R2S does not have a board specific MAC address written inside
e.g. an EEPROM, hence why it is randomly generated on first boot.
The issue with that however is the lack of a driver for the PRNG.
It often results to the same MAC address used on multiple boards by
default, as urngd is not active at this early stage resulting in low
available entropy.
There is however a semi-unique identifier available to us, which is the
CID of the used SD card. It is unique to each SD card, hence we can use
it to generate the MAC address used for LAN and WAN.
Signed-off-by: David Bauer <mail@david-bauer.net>
This enables the MikroTik platform driver, it enables us to parse
valuable info from hard_config including WLAN calibration data
extraction from sysfs.
Signed-off-by: Robert Marko <robimarko@gmail.com>
This enables the new MikroTik specific partition parser.
This avoids manually specifying the MikroTik specific partitions as they
can be detected by their magic values.
Signed-off-by: Robert Marko <robimarko@gmail.com>
MikroTik devices require the use of raw vmlinux out of the self
extracting compressed kernels.
They also require 4K sectors, kernel2minor, partition parser as well as
RouterBoard platform drivers.
So in order to not add unnecessary code to the generic sub target lets
introduce a MikroTik sub target.
Signed-off-by: Robert Marko <robimarko@gmail.com>
If the watchdog is enabled, set the timeout to 30 seconds before
decompress is started.
Mikrotik ipq40xx devices running with RouterBoot have the SoC watchdog
enabled and running with a timeout that does not allow time for the
kernel to decompress and manage the watchdog.
On ipq40xx RouterBoot TFTP boot the watchdog countdown is reset before:
Jumping to kernel
Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au>
This adds a appended_dtb section to the ARM decompressor
linker script.
This allows using the existing ARM zImage appended DTB support for
appending a DTB to the raw ELF kernel.
Its size is set to 1MB max to match the zImage appended DTB size limit.
To use it to pass the DTB to the kernel, objcopy is used:
objcopy --set-section-flags=.appended_dtb=alloc,contents \
--update-section=.appended_dtb=<target>.dtb vmlinux
This is based off the following patch:
c063e27e02
Signed-off-by: Robert Marko <robimarko@gmail.com>
The removed config symbols are already enabled by the generic kernel
configuration (or by default), while the added ones are forcefully
enabled by the specific architecture.
Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
The USB port definition is only needed when it is linked to a USB
LED. Since there is none for this device, we might as well remove
the port definition.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
CPU: Atheros AR9342 rev 3 SoC
RAM: 64 MB DDR2
Flash: 16 MB NOR SPI
WLAN 2.4GHz: Atheros AR9342 v3 (ath9k)
WLAN 5.0GHz: QCA988X
Ports: 1x GbE
Flashing procedure is identical to other ubnt devices.
https://openwrt.org/toh/ubiquiti/common
Flashing through factory firmware
1. Ensure firmware version v8.7.0 is installed.
Up/downgrade to this exact version.
2. Patch fwupdate.real binary using
`hexdump -Cv /bin/ubntbox | sed 's/14 40 fe 27/00 00 00 00/g' | \
hexdump -R > /tmp/fwupdate.real`
3. Make the patched fwupdate.real binary executable using
`chmod +x /tmp/fwupdate.real`
4. Copy the squashfs factory image to /tmp on the device
5. Flash OpenWrt using `/tmp/fwupdate.real -m <squashfs-factory image>`
6. Wait for the device to reboot
(copied from Ubiquiti NanoBeam AC and modified)
Flashing from serial console
1. Connect serial console (115200 baud)
2. Connect ethernet to a network with a TFTP server, through a
passive PoE injector.
3. Press a key to obtain a u-boot prompt
4. Set your TFTP server's ip address, with:
setenv serverip <tftp-server-address>
5. Set the Bullet AC's ip address, with:
setenv ipaddr <bullet-ac-address>
6. Set the boot file, with:
setenv bootfile <name-of-initramfs-binary-on-tftp-server>
7. Fetch the binary with tftp:
tftpboot
8. Boot the initramfs binary:
bootm
9. From the initramfs, fetch the sysupgrade binary, and flash it with
sysupgrade.
The Bullet AC is identified as a 2WA board by Ubiquiti. As such, the UBNT_TYPE
must match from the "Flashing through factory firmware" install instructions
to work.
Phy0 is QCA988X which can tune either band (2.4 or 5GHz). Phy1 is AR9342,
on which 5GHz is disabled. It isn't currently known whether phy1 is
routed to the N connector at all.
Signed-off-by: Russell Senior <russell@personaltelco.net>
