mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-22 15:02:32 +00:00
f490295bf2
Buffalo WXR-5950AX12 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on
IPQ8074A.
Specification:
- SoC : Qualcomm IPQ8074A
- RAM : DDR3 1024 MiB (2x Nanya NT5CC256M16ER-EK)
- Flash : RAW NAND 256 MiB (Winbond W29N02GZBIBA)
- WLAN : 2.4/5 GHz (IPQ8074A)
- Ethernet : 5 ports
- WAN : 100/1000/2500/10000 Mbps x1 (AQR113C)
- LAN : 100/1000/2500/10000 Mbps x1 (AQR113C),
10/100/1000 Mbps x3 (QCA8075)
- LED/Keys : 8x/5x
- UART : pin header on PCB (J7)
- assignment: 3.3V, GND, TX, RX from disc marking
- settings : 115200n8
- Power : 12 VDC, 4 A
Flash instruction using initramfs image:
1. Prepare TFTP server with IP address 192.168.11.10
2. Rename OpenWrt initramfs image to "WXR-5950AX12-initramfs.uImage and
place it to TFTP directory
3. Hold AOSS (WPS) button and power on WXR-5950AX12
4. WXR-5950AX12 downloads initramfs image from TFTP server and boots
with it automatically
5. Upload sysupgrade image to WXR-5950AX12 and perform sysupgrade
6. Wait ~120 seconds to complete flashing
Partition layout:
0x000000000000-0x000000100000 : "0:sbl1"
0x000000100000-0x000000200000 : "0:mibib"
0x000000200000-0x000000280000 : "0:bootconfig"
0x000000280000-0x000000300000 : "0:bootconfig1"
0x000000300000-0x000000600000 : "0:qsee"
0x000000600000-0x000000900000 : "0:qsee_1"
0x000000900000-0x000000980000 : "0:devcfg"
0x000000980000-0x000000a00000 : "0:devcfg_1"
0x000000a00000-0x000000a80000 : "0:apdp"
0x000000a80000-0x000000b00000 : "0:apdp_1"
0x000000b00000-0x000000b80000 : "0:rpm"
0x000000b80000-0x000000c00000 : "0:rpm_1"
0x000000c00000-0x000000c80000 : "0:cdt"
0x000000c80000-0x000000d00000 : "0:cdt_1"
0x000000d00000-0x000000d80000 : "0:appsblenv"
0x000000d80000-0x000000e80000 : "0:appsbl"
0x000000e80000-0x000000f80000 : "0:appsbl_1"
0x000000f80000-0x000001000000 : "0:art"
0x000001000000-0x000001080000 : "0:art_1"
0x000001080000-0x000001100000 : "0:orgdata"
0x000001100000-0x000001180000 : "0:orgdata_1"
0x000001180000-0x000005180000 : "rootfs"
0x000005180000-0x000009180000 : "rootfs_recover"
0x000009180000-0x000010000000 : "user_property"
Notes:
- WXR-5950AX12 has 2x OS images on NAND flash. The 1st image is for
normal operation and the 2nd one is for recoverying or firmware
upgrading on stock.
- Stock U-Boot checks MD5 hashes in "fw_hash" volume in each "root*"
partition when booting. This is just a comparation of hash strings.
Behaviors:
- both "fw_hash" volumes exist, hashes are rootfs == rootfs_recover
---> boot from rootfs
- both "fw_hash" volumes exist, hashes are rootfs != rootfs_recover
---> boot from rootfs_recover
Note: this behavior is used for firmware upgrading on stock
- "fw_hash" volume in rootfs is missing
---> boot from rootfs_recover
- "fw_hash" volume in rootfs_recover is missing
---> boot from rootfs
- "fw_hash" volumes in both root* partition are missing
---> boot from rootfs_recover
Reverting to stock firmware:
1. Decrypt official image by buffalo-enc and remove header
example of decryption:
$ buffalo-enc -i wxr_5950ax12_jp_305 -o wxr_5950ax12_jp_305.dec \
-d -k olaffuB -O 0xc8
example of removing header (v3.05):
- before
$ hexdump -n 64 -v -C wxr_5950ax12_jp_305.dec
00000000 57 58 52 2d 35 39 35 30 41 58 31 32 5f 33 2e 30 |WXR-5950AX12_3.0|
00000010 35 5f 31 2e 30 31 5f 4a 50 5f 6a 70 5f 71 63 61 |5_1.01_JP_jp_qca|
00000020 0a 66 69 6c 65 6c 65 6e 3d 34 35 33 35 30 39 31 |.filelen=4535091|
00000030 32 0a 55 42 49 23 01 00 00 00 00 00 00 00 00 00 |2.UBI#..........|
00000040
- after
$ hexdump -n 64 -v -C wxr_5950ax12_jp_305.ubi
00000000 55 42 49 23 01 00 00 00 00 00 00 00 00 00 00 00 |UBI#............|
00000010 00 00 08 00 00 00 10 00 78 cf c4 91 00 00 00 00 |........x.......|
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000030 00 00 00 00 00 00 00 00 00 00 00 00 3d 2a 64 fd |............=*d.|
00000040
2. Boot WXR-5950AX12 with OpenWrt initramfs image
3. Upload modified stock image to WXR-5950AX12
4. Find partitions "rootfs" and "rootfs_recover"
example:
root@OpenWrt:/# cat /proc/mtd
dev: size erasesize name
...
mtd22: 04000000 00020000 "rootfs"
mtd23: 04000000 00020000 "rootfs_recover"
...
in this case, "rootfs" is mtd22 and "rootfs_recover" is mtd23
5. Format "rootfs"/"rootfs_recover" partition with the uploaded image
example:
ubiformat /dev/mtd22 -f /tmp/wxr_5950ax12_jp_305.ubi
ubiformat /dev/mtd23 -f /tmp/wxr_5950ax12_jp_305.ubi
6. Remove "rootfs"/"rootfs_data" volume from user_property partition
example:
. /lib/upgrade/nand.sh
UBI=$(nand_attach_ubi user_property)
ubirmvol /dev/$UBI -N rootfs
ubirmvol /dev/$UBI -N rootfs_data
7. Reboot
MAC addresses:
LAN : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text))
WAN : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text))
2.4 GHz: 50:C4:DD:xx:xx:30 (0:APPSBLENV, wlan0addr (text))
5 GHz : 50:C4:DD:xx:xx:38 (0:APPSBLENV, wlan1addr (text))
Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
56 lines
1.9 KiB
Bash
56 lines
1.9 KiB
Bash
. /lib/functions.sh
|
|
|
|
# Prepare UBI devices for OpenWrt installation
|
|
# - rootfs (mtd22)
|
|
# - remove "ubi_rootfs" volume (rootfs on stock)
|
|
# - remove "fw_hash" volume (firmware hash)
|
|
# - user_property (mtd24)
|
|
# - remove "user_property_ubi" volume (user configuration)
|
|
# - remove "extra_property" volume (gzipped syslog)
|
|
buffalo_upgrade_prepare() {
|
|
local ubi_rootdev ubi_propdev
|
|
|
|
if ! ubi_rootdev="$(nand_attach_ubi rootfs)" || \
|
|
! ubi_propdev="$(nand_attach_ubi user_property)"; then
|
|
echo "failed to attach UBI volume \"rootfs\" or \"user_property\", rebooting..."
|
|
reboot -f
|
|
fi
|
|
|
|
ubirmvol /dev/$ubi_rootdev -N ubi_rootfs &> /dev/null || true
|
|
ubirmvol /dev/$ubi_rootdev -N fw_hash &> /dev/null || true
|
|
|
|
ubirmvol /dev/$ubi_propdev -N user_property_ubi &> /dev/null || true
|
|
ubirmvol /dev/$ubi_propdev -N extra_property &> /dev/null || true
|
|
}
|
|
|
|
# Re-create small dummy ubi_rootfs volume and update
|
|
# fw_hash volume to pass the checking by U-Boot
|
|
# - rootfs (mtd22)
|
|
# - re-create "ubi_rootfs" volume
|
|
# - re-create and update "fw_hash" volume
|
|
# - rootfs_recover (mtd23)
|
|
# - update "fw_hash" volume
|
|
buffalo_upgrade_optvol() {
|
|
local ubi_rootdev ubi_rcvrdev
|
|
local hashvol_root hashvol_rcvr
|
|
|
|
if ! ubi_rootdev="$(nand_attach_ubi rootfs)" || \
|
|
! ubi_rcvrdev="$(nand_attach_ubi rootfs_recover)"; then
|
|
echo "failed to attach UBI volume \"rootfs\" or \"rootfs_recover\", rebooting..."
|
|
reboot -f
|
|
fi
|
|
|
|
ubimkvol /dev/$ubi_rootdev -N ubi_rootfs -S 1
|
|
ubimkvol /dev/$ubi_rootdev -N fw_hash -S 1 -t static
|
|
|
|
if ! hashvol_root="$(nand_find_volume $ubi_rootdev fw_hash)" || \
|
|
! hashvol_rcvr="$(nand_find_volume $ubi_rcvrdev fw_hash)"; then
|
|
echo "\"fw_hash\" volume in \"rootfs\" or \"rootfs_recover\" not found, rebooting..."
|
|
reboot -f
|
|
fi
|
|
|
|
echo -n "00000000000000000000000000000000" > /tmp/dummyhash.txt
|
|
ubiupdatevol /dev/$hashvol_root /tmp/dummyhash.txt
|
|
ubiupdatevol /dev/$hashvol_rcvr /tmp/dummyhash.txt
|
|
}
|