mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-27 17:18:59 +00:00
51fe956c4f
Buffalo WXR-2533DHP is a 2.4/5 GHz band 11ac router, based on Qualcomm IPQ8064. The U-Boot on WXR-2533DHP employs a complicated dual firmware protection scheme against corruptions of the kernel and rootfs images. See the notes in buffalo.sh for details. specifications: - Qualcomm IPQ8064 (384 - 1,400 MHz, 2C2T) - 512 MB of RAM (DDR3) - 256 MB of Flash (NAND) - 4T4R 2.4/5 GHz Wlan (QCA9980) - 5x 10/100/1000 Mbps Ethernet - 10x LEDs, 8x keys (6x buttons, 2x slide-switches) - 2x USB 3.0 Type-A - 12VDC/4A AC Adapter - UART through-hole on PCB - J3: Vcc, GND, TX, RX from USB port side - 115200n8 Boot instructions for the initramfs image: 1. Prepare the TFTP server with the initramfs image renamed to "wxr2300dhp-initramfs.uImage" and IP address "192.168.11.10". 2. Press the "AOSS" button while powering on the WXR-2533DHP. 3. Wait until the "Wireless" LED flashes before releasing the AOSS button. The WXR-2533DHP will grab the image from TFTP server and will boot it. Flashing instructions: To persistently write the firmware, flash an openwrt sysupgrade image from inside the initramfs, for example transfer via `scp <sysupgrade> root@192.168.1.1:/tmp` and flash on the device with `sysupgrade -n /tmp/<sysupgrade>`. Then wait ~120 seconds to let it finish the flashing process. Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com> Signed-off-by: Christian Lamparter <chunkeey@gmail.com> [reworded message]
152 lines
3.7 KiB
Bash
152 lines
3.7 KiB
Bash
#!/bin/sh
|
|
|
|
# xor multiple hex values of the same length
|
|
xor() {
|
|
local val
|
|
local ret="0x$1"
|
|
local retlen=${#1}
|
|
|
|
shift
|
|
while [ -n "$1" ]; do
|
|
val="0x$1"
|
|
ret=$((ret ^ val))
|
|
shift
|
|
done
|
|
|
|
printf "%0${retlen}x" "$ret"
|
|
}
|
|
|
|
ath10kcal_die() {
|
|
echo "ath10cal: " "$*"
|
|
exit 1
|
|
}
|
|
|
|
ath10kcal_from_file() {
|
|
local source=$1
|
|
local offset=$2
|
|
local count=$3
|
|
|
|
dd if=$source of=/lib/firmware/$FIRMWARE bs=1 skip=$offset count=$count 2>/dev/null || \
|
|
ath10kcal_die "failed to extract calibration data from $source"
|
|
}
|
|
|
|
ath10kcal_extract() {
|
|
local part=$1
|
|
local offset=$2
|
|
local count=$3
|
|
local mtd
|
|
|
|
mtd=$(find_mtd_chardev $part)
|
|
[ -n "$mtd" ] || \
|
|
ath10kcal_die "no mtd device found for partition $part"
|
|
|
|
dd if=$mtd of=/lib/firmware/$FIRMWARE bs=1 skip=$offset count=$count 2>/dev/null || \
|
|
ath10kcal_die "failed to extract calibration data from $mtd"
|
|
}
|
|
|
|
ath10kcal_patch_mac_crc() {
|
|
local mac=$1
|
|
local mac_offset=6
|
|
local chksum_offset=2
|
|
local xor_mac
|
|
local xor_fw_mac
|
|
local xor_fw_chksum
|
|
|
|
[ -z "$mac" ] && return
|
|
|
|
xor_fw_mac=$(hexdump -v -n 6 -s $mac_offset -e '/1 "%02x"' /lib/firmware/$FIRMWARE)
|
|
xor_fw_mac="${xor_fw_mac:0:4} ${xor_fw_mac:4:4} ${xor_fw_mac:8:4}"
|
|
|
|
macaddr_2bin $mac | dd of=/lib/firmware/$FIRMWARE conv=notrunc bs=1 seek=6 count=6
|
|
|
|
xor_mac=${mac//:/}
|
|
xor_mac="${xor_mac:0:4} ${xor_mac:4:4} ${xor_mac:8:4}"
|
|
|
|
xor_fw_chksum=$(hexdump -v -n 2 -s $chksum_offset -e '/1 "%02x"' /lib/firmware/$FIRMWARE)
|
|
xor_fw_chksum=$(xor $xor_fw_chksum $xor_fw_mac $xor_mac)
|
|
|
|
printf "%b" "\x${xor_fw_chksum:0:2}\x${xor_fw_chksum:2:2}" | \
|
|
dd of=/lib/firmware/$FIRMWARE conv=notrunc bs=1 seek=$chksum_offset count=2
|
|
}
|
|
|
|
[ -e /lib/firmware/$FIRMWARE ] && exit 0
|
|
|
|
. /lib/functions.sh
|
|
. /lib/functions/system.sh
|
|
|
|
board=$(board_name)
|
|
|
|
case "$FIRMWARE" in
|
|
"ath10k/pre-cal-pci-0000:01:00.0.bin")
|
|
case $board in
|
|
buffalo,wxr-2533dhp)
|
|
ath10kcal_extract "ART" 4096 12064
|
|
ath10kcal_patch_mac_crc $(mtd_get_mac_binary ART 30)
|
|
;;
|
|
linksys,ea8500)
|
|
ath10kcal_extract "art" 4096 12064
|
|
ath10kcal_patch_mac_crc $(macaddr_add $(mtd_get_mac_ascii devinfo hw_mac_addr) +1)
|
|
;;
|
|
nec,wg2600hp)
|
|
ath10kcal_extract "ART" 4096 12064
|
|
ath10kcal_patch_mac_crc $(macaddr_add $(mtd_get_mac_binary PRODUCTDATA 12) +1)
|
|
;;
|
|
netgear,d7800 |\
|
|
netgear,r7500v2 |\
|
|
netgear,r7800)
|
|
ath10kcal_extract "art" 4096 12064
|
|
ath10kcal_patch_mac_crc $(macaddr_add $(mtd_get_mac_binary art 6) +1)
|
|
;;
|
|
tplink,c2600)
|
|
ath10kcal_extract "radio" 4096 12064
|
|
ath10kcal_patch_mac_crc $(macaddr_add $(mtd_get_mac_binary default-mac 8) -1)
|
|
;;
|
|
tplink,vr2600v)
|
|
ath10kcal_extract "ART" 4096 12064
|
|
ath10kcal_patch_mac_crc $(macaddr_add $(mtd_get_mac_binary default-mac 0) -1)
|
|
;;
|
|
zyxel,nbg6817)
|
|
ath10kcal_extract "0:ART" 4096 12064
|
|
ath10kcal_patch_mac_crc $(macaddr_add $(mtd_get_mac_ascii 0:APPSBLENV ethaddr) +1)
|
|
;;
|
|
esac
|
|
;;
|
|
"ath10k/pre-cal-pci-0001:01:00.0.bin")
|
|
case $board in
|
|
buffalo,wxr-2533dhp)
|
|
ath10kcal_extract "ART" 20480 12064
|
|
ath10kcal_patch_mac_crc $(mtd_get_mac_binary ART 24)
|
|
;;
|
|
linksys,ea8500)
|
|
ath10kcal_extract "art" 20480 12064
|
|
ath10kcal_patch_mac_crc $(macaddr_add $(mtd_get_mac_ascii devinfo hw_mac_addr) +2)
|
|
;;
|
|
nec,wg2600hp)
|
|
ath10kcal_extract "ART" 20480 12064
|
|
ath10kcal_patch_mac_crc $(mtd_get_mac_binary PRODUCTDATA 12)
|
|
;;
|
|
netgear,d7800 |\
|
|
netgear,r7500v2 |\
|
|
netgear,r7800)
|
|
ath10kcal_extract "art" 20480 12064
|
|
ath10kcal_patch_mac_crc $(macaddr_add $(mtd_get_mac_binary art 6) +2)
|
|
;;
|
|
tplink,c2600)
|
|
ath10kcal_extract "radio" 20480 12064
|
|
ath10kcal_patch_mac_crc $(mtd_get_mac_binary default-mac 8)
|
|
;;
|
|
tplink,vr2600v)
|
|
ath10kcal_extract "ART" 20480 12064
|
|
ath10kcal_patch_mac_crc $(mtd_get_mac_binary default-mac 0)
|
|
;;
|
|
zyxel,nbg6817)
|
|
ath10kcal_extract "0:ART" 20480 12064
|
|
ath10kcal_patch_mac_crc $(mtd_get_mac_ascii 0:APPSBLENV ethaddr)
|
|
;;
|
|
esac
|
|
;;
|
|
*)
|
|
exit 1
|
|
;;
|
|
esac
|