openwrt/target/linux
Bjørn Mork 8c986d2ab9 ramips: mt7621: Add support for ZyXEL NR7101
The ZyXEL NR7101 is an 802.3at PoE powered 5G outdoor (IP68) CPE
with integrated directional 5G/LTE antennas.

Specifications:

 - SoC: MediaTek MT7621AT
 - RAM: 256 MB
 - Flash: 128 MB MB NAND (MX30LF1G18AC)
 - WiFi: MediaTek MT7603E
 - Switch: 1 LAN port (Gigabiti)
 - 5G/LTE: Quectel RG502Q-EA connected by USB3 to SoC
 - SIM: 2 micro-SIM slots under transparent cover
 - Buttons: Reset, WLAN under same cover
 - LEDs: Multicolour green/red/yellow under same cover (visible)
 - Power: 802.3at PoE via LAN port

The device is built as an outdoor ethernet to 5G/LTE bridge or
router. The Wifi interface is intended for installation and/or
temporary management purposes only.

UART Serial:

57600N1
Located on populated 5 pin header J5:

 [o] GND
 [ ] key - no pin
 [o] RX
 [o] TX
 [o] 3.3V Vcc

Remove the SIM/button/LED cover, the WLAN button and 12 screws
holding the back plate and antenna cover together. The GPS antenna
is fixed to the cover, so be careful with the cable.  Remove 4
screws fixing the antenna board to the main board, again being
careful with the cables.

A bluetooth TTL adapter is recommended for permanent console
access, to keep the router water and dustproof. The 3.3V pin is
able to power such an adapter.

MAC addresses:

OpenWrt OEM   Address          Found as
lan     eth2  08:26:97:*:*:BC  Factory 0xe000 (hex), label
wlan0   ra0   08:26:97:*:*:BD  Factory 0x4 (hex)
wwan0   usb0  random

WARNING!!

ISP managed firmware might at any time update itself to a version
where all known workarounds have been disabled.  Never boot an ISP
managed firmware with a SIM in any of the slots if you intend to use
the router with OpenWrt. The bootloader lock can only be disabled with
root access to running firmware. The flash chip is physically
inaccessible without soldering.

Installation from OEM web GUI:

- Log in as "supervisor" on https://172.17.1.1/
- Upload OpenWrt initramfs-recovery.bin image on the
  Maintenance -> Firmware page
- Wait for OpenWrt to boot and ssh to root@192.168.1.1
- (optional) Copy OpenWrt to the recovery partition. See below
- Sysupgrade to the OpenWrt sysupgrade image and reboot

Installation from OEM ssh:

- Log in as "root" on 172.17.1.1 port 22022
- scp OpenWrt initramfs-recovery.bin image to 172.17.1.1:/tmp
- Prepare bootloader config by running:
    nvram setro uboot DebugFlag 0x1
    nvram setro uboot CheckBypass 0
    nvram commit
- Run "mtd_write -w write initramfs-recovery.bin Kernel" and reboot
- Wait for OpenWrt to boot and ssh to root@192.168.1.1
- (optional) Copy OpenWrt to the recovery partition. See below
- Sysupgrade to the OpenWrt sysupgrade image and reboot

Copying OpenWrt to the recovery partition:

- Verify that you are running a working OpenWrt recovery image
  from flash
- ssh to root@192.168.1.1 and run:
    fw_setenv CheckBypass 0
    mtd -r erase Kernel2
- Wait while the bootloader mirrors Image1 to Image2

NOTE: This should only be done after successfully booting the OpenWrt
  recovery image from the primary partition during installation.  Do
  not do this after having sysupgraded OpenWrt!  Reinstalling the
  recovery image on normal upgrades is not required or recommended.

Installation from Z-Loader:

- Halt boot by pressing Escape on console
- Set up a tftp server to serve the OpenWrt initramfs-recovery.bin
  image at 10.10.10.3
- Type "ATNR 1,initramfs-recovery.bin" at the "ZLB>" prompt
- Wait for OpenWrt to boot and ssh to root@192.168.1.1
- Sysupgrade to the OpenWrt sysupgrade image

NOTE: ATNR will write the recovery image to both primary and recovery
  partitions in one go.

Booting from RAM:

- Halt boot by pressing Escape on console
- Type "ATGU" at the "ZLB>" prompt to enter the U-Boot menu
- Press "4" to select "4: Entr boot command line interface."
- Set up a tftp server to serve the OpenWrt initramfs-recovery.bin
  image at 10.10.10.3
- Load it using "tftpboot 0x88000000 initramfs-recovery.bin"
- Boot with "bootm  0x8800017C" to skip the 380 (0x17C) bytes ZyXEL
  header

This method can also be used to RAM boot OEM firmware. The warning
regarding OEM applies!  Never boot an unknown OEM firmware, or any OEM
firmware with a SIM in any slot.

NOTE: U-Boot configuration is incomplete (on some devices?). You may
  have to configure a working mac address before running tftp using
   "setenv eth0addr <mac>"

Unlocking the bootloader:

If you are unebale to halt boot, then the bootloader is locked.

The OEM firmware locks the bootloader on every boot by setting
DebugFlag to 0.  Setting it to 1 is therefore only temporary
when OEM firmware is installed.

- Run "nvram setro uboot DebugFlag 0x1; nvram commit" in OEM firmware
- Run "fw_setenv DebugFlag 0x1" in OpenWrt

  NOTE:
    OpenWrt does this automatically on first boot if necessary

  NOTE2:
    Setting the flag to 0x1 avoids the reset to 0 in known OEM
    versions, but this might change.

  WARNING:
    Writing anything to flash while the bootloader is locked is
    considered extremely risky. Errors might cause a permanent
    brick!

Enabling management access from LAN:

Temporary workaround to allow installing OpenWrt if OEM firmware
has disabled LAN management:

- Connect to console
- Log in as "root"
- Run "iptables -I INPUT -i br0 -j ACCEPT"

Notes on the OEM/bootloader dual partition scheme

The dual partition scheme on this device uses Image2 as a recovery
image only. The device will always boot from Image1, but the
bootloader might copy Image2 to Image1 under specific conditions. This
scheme prevents repurposing of the space occupied by Image2 in any
useful way.

Validation of primary and recovery images is controlled by the
variables CheckBypass, Image1Stable, and Image1Try.

The bootloader sets CheckBypass to 0 and reboots if Image1 fails
validation.

If CheckBypass is 0 and Image1 is invalid then Image2 is copied to
Image1.

If CheckBypass is 0 and Image2 is invalid, then Image1 is copied to
Image2.

If CheckBypass is 1 then all tests are skipped and Image1 is booted
unconditionally.  CheckBypass is set to 1 after each successful
validation of Image1.

Image1Try is incremented if Image1Stable is 0, and Image2 is copied to
Image1 if Image1Try is 3 or larger.  But the bootloader only tests
Image1Try if CheckBypass is 0, which is impossible unless the booted
image sets it to 0 before failing.

The system is therefore not resilient against runtime errors like
failure to mount the rootfs, unless the kernel image sets CheckBypass
to 0 before failing. This is not yet implemented in OpenWrt.

Setting Image1Stable to 1 prevents the bootloader from updating
Image1Try on every boot, saving unnecessary writes to the environment
partition.

Keeping an OpenWrt initramfs recovery as Image2 is recommended
primarily to avoid unwanted OEM firmware boots on failure. Ref the
warning above. It enables console-less recovery in case of some
failures to boot from Image1.

Signed-off-by: Bjørn Mork <bjorn@mork.no>
Tested-by: Bjørn Mork <bjorn@mork.no>
(cherry picked from commit 2449a63208)
2021-06-10 17:09:35 +02:00
..
apm821xx kernel: bump 5.4 to 5.4.123 2021-05-30 23:45:49 +02:00
arc770 arc770: set device vendor and model variables 2021-05-26 23:36:40 +02:00
archs38 archs38: set device vendor and model variables 2021-05-26 23:36:40 +02:00
armvirt kernel: move some disabled symbols to generic 2021-04-11 16:54:22 +02:00
at91 treewide: make AddDepends/usb-serial selective 2021-06-08 22:50:32 +02:00
ath25 kernel: Activate FORTIFY_SOURCE for MIPS kernel 5.4 2021-05-14 23:32:22 +02:00
ath79 treewide: make AddDepends/usb-serial selective 2021-06-08 22:50:32 +02:00
bcm27xx kernel: bump 5.4 to 5.4.123 2021-05-30 23:45:49 +02:00
bcm47xx bcm47xx: make WGT634U NVRAM patch apply again 2021-03-17 23:38:46 +01:00
bcm53xx kernel: bump 5.4 to 5.4.119 2021-05-15 19:32:20 +02:00
bcm63xx bcm63xx: Remove patch already applied upstream 2021-05-23 16:10:41 +02:00
bcm4908 kernel: bump 5.4 to 5.4.111 2021-04-11 17:35:12 +02:00
gemini base-files: generate network config with "device" options 2021-05-27 11:39:15 +02:00
generic kernel: bump 5.4 to 5.4.124 2021-06-06 17:54:51 +02:00
imx6 kernel: move some disabled symbols to generic 2021-04-11 16:54:22 +02:00
ipq40xx ipq40xx: add uboot-envtools to default packages 2021-06-08 20:43:56 +02:00
ipq806x ipq806x: fix LAN and WAN port assignments on TP-Link AD7200 2021-06-08 20:43:52 +02:00
kirkwood kernel: fix parsing fixed subpartitions 2021-05-08 19:29:08 +02:00
lantiq kernel: bump 5.4 to 5.4.119 2021-05-15 19:32:20 +02:00
layerscape kernel: bump 5.4 to 5.4.124 2021-06-06 17:54:51 +02:00
malta target: use SPDX license identifiers on Makefiles 2021-02-10 15:47:18 +01:00
mediatek kernel: bump 5.4 to 5.4.124 2021-06-06 17:54:51 +02:00
mpc85xx mpc85xx: p2020: fix cfi-nor detection 2021-03-01 21:49:55 +01:00
mvebu mvebu: 5.4 fix DVFS caused random boot crashes 2021-05-23 16:10:59 +02:00
mxs target: use SPDX license identifiers on scripts 2021-02-10 15:47:23 +01:00
octeon kernel: move some disabled symbols to generic 2021-04-11 16:54:22 +02:00
octeontx kernel: move some disabled symbols to generic 2021-04-11 16:54:22 +02:00
omap kernel: move some disabled symbols to generic 2021-04-11 16:54:22 +02:00
oxnas gemini,layerscape,oxnas: don't disable option CONFIG_BPF_SYSCALL 2021-04-16 11:42:42 +01:00
pistachio kernel: add pending mtd patches adding NVMEM support 2021-03-17 21:24:22 +01:00
ramips ramips: mt7621: Add support for ZyXEL NR7101 2021-06-10 17:09:35 +02:00
realtek base-files: generate network config with "device" options 2021-05-27 11:39:15 +02:00
rockchip kernel: bump 5.4 to 5.4.111 2021-04-11 17:35:12 +02:00
sunxi sunxi: disable LPAE on cortexa8 2021-04-11 00:00:49 +02:00
tegra kernel: move some disabled symbols to generic 2021-04-11 16:54:22 +02:00
uml target: use SPDX license identifiers on Makefiles 2021-02-10 15:47:18 +01:00
x86 x86: kernel: enable Fusion-MPT SAS driver 2021-06-08 20:44:00 +02:00
zynq kernel: move some disabled symbols to generic 2021-04-11 16:54:22 +02:00
Makefile target: use SPDX license identifiers on Makefiles 2021-02-10 15:47:18 +01:00