mirror of
https://github.com/openwrt/openwrt.git
synced 2025-01-08 22:12:49 +00:00
f490295bf2
Buffalo WXR-5950AX12 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on IPQ8074A. Specification: - SoC : Qualcomm IPQ8074A - RAM : DDR3 1024 MiB (2x Nanya NT5CC256M16ER-EK) - Flash : RAW NAND 256 MiB (Winbond W29N02GZBIBA) - WLAN : 2.4/5 GHz (IPQ8074A) - Ethernet : 5 ports - WAN : 100/1000/2500/10000 Mbps x1 (AQR113C) - LAN : 100/1000/2500/10000 Mbps x1 (AQR113C), 10/100/1000 Mbps x3 (QCA8075) - LED/Keys : 8x/5x - UART : pin header on PCB (J7) - assignment: 3.3V, GND, TX, RX from disc marking - settings : 115200n8 - Power : 12 VDC, 4 A Flash instruction using initramfs image: 1. Prepare TFTP server with IP address 192.168.11.10 2. Rename OpenWrt initramfs image to "WXR-5950AX12-initramfs.uImage and place it to TFTP directory 3. Hold AOSS (WPS) button and power on WXR-5950AX12 4. WXR-5950AX12 downloads initramfs image from TFTP server and boots with it automatically 5. Upload sysupgrade image to WXR-5950AX12 and perform sysupgrade 6. Wait ~120 seconds to complete flashing Partition layout: 0x000000000000-0x000000100000 : "0:sbl1" 0x000000100000-0x000000200000 : "0:mibib" 0x000000200000-0x000000280000 : "0:bootconfig" 0x000000280000-0x000000300000 : "0:bootconfig1" 0x000000300000-0x000000600000 : "0:qsee" 0x000000600000-0x000000900000 : "0:qsee_1" 0x000000900000-0x000000980000 : "0:devcfg" 0x000000980000-0x000000a00000 : "0:devcfg_1" 0x000000a00000-0x000000a80000 : "0:apdp" 0x000000a80000-0x000000b00000 : "0:apdp_1" 0x000000b00000-0x000000b80000 : "0:rpm" 0x000000b80000-0x000000c00000 : "0:rpm_1" 0x000000c00000-0x000000c80000 : "0:cdt" 0x000000c80000-0x000000d00000 : "0:cdt_1" 0x000000d00000-0x000000d80000 : "0:appsblenv" 0x000000d80000-0x000000e80000 : "0:appsbl" 0x000000e80000-0x000000f80000 : "0:appsbl_1" 0x000000f80000-0x000001000000 : "0:art" 0x000001000000-0x000001080000 : "0:art_1" 0x000001080000-0x000001100000 : "0:orgdata" 0x000001100000-0x000001180000 : "0:orgdata_1" 0x000001180000-0x000005180000 : "rootfs" 0x000005180000-0x000009180000 : "rootfs_recover" 0x000009180000-0x000010000000 : "user_property" Notes: - WXR-5950AX12 has 2x OS images on NAND flash. The 1st image is for normal operation and the 2nd one is for recoverying or firmware upgrading on stock. - Stock U-Boot checks MD5 hashes in "fw_hash" volume in each "root*" partition when booting. This is just a comparation of hash strings. Behaviors: - both "fw_hash" volumes exist, hashes are rootfs == rootfs_recover ---> boot from rootfs - both "fw_hash" volumes exist, hashes are rootfs != rootfs_recover ---> boot from rootfs_recover Note: this behavior is used for firmware upgrading on stock - "fw_hash" volume in rootfs is missing ---> boot from rootfs_recover - "fw_hash" volume in rootfs_recover is missing ---> boot from rootfs - "fw_hash" volumes in both root* partition are missing ---> boot from rootfs_recover Reverting to stock firmware: 1. Decrypt official image by buffalo-enc and remove header example of decryption: $ buffalo-enc -i wxr_5950ax12_jp_305 -o wxr_5950ax12_jp_305.dec \ -d -k olaffuB -O 0xc8 example of removing header (v3.05): - before $ hexdump -n 64 -v -C wxr_5950ax12_jp_305.dec 00000000 57 58 52 2d 35 39 35 30 41 58 31 32 5f 33 2e 30 |WXR-5950AX12_3.0| 00000010 35 5f 31 2e 30 31 5f 4a 50 5f 6a 70 5f 71 63 61 |5_1.01_JP_jp_qca| 00000020 0a 66 69 6c 65 6c 65 6e 3d 34 35 33 35 30 39 31 |.filelen=4535091| 00000030 32 0a 55 42 49 23 01 00 00 00 00 00 00 00 00 00 |2.UBI#..........| 00000040 - after $ hexdump -n 64 -v -C wxr_5950ax12_jp_305.ubi 00000000 55 42 49 23 01 00 00 00 00 00 00 00 00 00 00 00 |UBI#............| 00000010 00 00 08 00 00 00 10 00 78 cf c4 91 00 00 00 00 |........x.......| 00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000030 00 00 00 00 00 00 00 00 00 00 00 00 3d 2a 64 fd |............=*d.| 00000040 2. Boot WXR-5950AX12 with OpenWrt initramfs image 3. Upload modified stock image to WXR-5950AX12 4. Find partitions "rootfs" and "rootfs_recover" example: root@OpenWrt:/# cat /proc/mtd dev: size erasesize name ... mtd22: 04000000 00020000 "rootfs" mtd23: 04000000 00020000 "rootfs_recover" ... in this case, "rootfs" is mtd22 and "rootfs_recover" is mtd23 5. Format "rootfs"/"rootfs_recover" partition with the uploaded image example: ubiformat /dev/mtd22 -f /tmp/wxr_5950ax12_jp_305.ubi ubiformat /dev/mtd23 -f /tmp/wxr_5950ax12_jp_305.ubi 6. Remove "rootfs"/"rootfs_data" volume from user_property partition example: . /lib/upgrade/nand.sh UBI=$(nand_attach_ubi user_property) ubirmvol /dev/$UBI -N rootfs ubirmvol /dev/$UBI -N rootfs_data 7. Reboot MAC addresses: LAN : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text)) WAN : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text)) 2.4 GHz: 50:C4:DD:xx:xx:30 (0:APPSBLENV, wlan0addr (text)) 5 GHz : 50:C4:DD:xx:xx:38 (0:APPSBLENV, wlan1addr (text)) Reviewed-by: Robert Marko <robimarko@gmail.com> Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
115 lines
2.5 KiB
Bash
115 lines
2.5 KiB
Bash
PART_NAME=firmware
|
|
REQUIRE_IMAGE_METADATA=1
|
|
|
|
RAMFS_COPY_BIN='fw_printenv fw_setenv head'
|
|
RAMFS_COPY_DATA='/etc/fw_env.config /var/lock/fw_printenv.lock'
|
|
|
|
xiaomi_initramfs_prepare() {
|
|
# Wipe UBI if running initramfs
|
|
[ "$(rootfs_type)" = "tmpfs" ] || return 0
|
|
|
|
local rootfs_mtdnum="$( find_mtd_index rootfs )"
|
|
if [ ! "$rootfs_mtdnum" ]; then
|
|
echo "unable to find mtd partition rootfs"
|
|
return 1
|
|
fi
|
|
|
|
local kern_mtdnum="$( find_mtd_index ubi_kernel )"
|
|
if [ ! "$kern_mtdnum" ]; then
|
|
echo "unable to find mtd partition ubi_kernel"
|
|
return 1
|
|
fi
|
|
|
|
ubidetach -m "$rootfs_mtdnum"
|
|
ubiformat /dev/mtd$rootfs_mtdnum -y
|
|
|
|
ubidetach -m "$kern_mtdnum"
|
|
ubiformat /dev/mtd$kern_mtdnum -y
|
|
}
|
|
|
|
platform_check_image() {
|
|
return 0;
|
|
}
|
|
|
|
platform_pre_upgrade() {
|
|
case "$(board_name)" in
|
|
redmi,ax6|\
|
|
xiaomi,ax3600|\
|
|
xiaomi,ax9000)
|
|
xiaomi_initramfs_prepare
|
|
;;
|
|
esac
|
|
}
|
|
|
|
platform_do_upgrade() {
|
|
case "$(board_name)" in
|
|
buffalo,wxr-5950ax12)
|
|
CI_KERN_UBIPART="rootfs"
|
|
CI_ROOT_UBIPART="user_property"
|
|
buffalo_upgrade_prepare
|
|
nand_do_flash_file "$1" || nand_do_upgrade_failed
|
|
nand_do_restore_config || nand_do_upgrade_failed
|
|
buffalo_upgrade_optvol
|
|
;;
|
|
dynalink,dl-wrx36)
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
edgecore,eap102)
|
|
active="$(fw_printenv -n active)"
|
|
if [ "$active" -eq "1" ]; then
|
|
CI_UBIPART="rootfs2"
|
|
else
|
|
CI_UBIPART="rootfs1"
|
|
fi
|
|
# force altbootcmd which handles partition change in u-boot
|
|
fw_setenv bootcount 3
|
|
fw_setenv upgrade_available 1
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
edimax,cax1800)
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
qnap,301w)
|
|
kernelname="0:HLOS"
|
|
rootfsname="rootfs"
|
|
mmc_do_upgrade "$1"
|
|
;;
|
|
zyxel,nbg7815)
|
|
local config_mtdnum="$(find_mtd_index 0:bootconfig)"
|
|
[ -z "$config_mtdnum" ] && reboot
|
|
part_num="$(hexdump -e '1/1 "%01x|"' -n 1 -s 168 -C /dev/mtd$config_mtdnum | cut -f 1 -d "|" | head -n1)"
|
|
if [ "$part_num" -eq "0" ]; then
|
|
kernelname="0:HLOS"
|
|
rootfsname="rootfs"
|
|
mmc_do_upgrade "$1"
|
|
else
|
|
kernelname="0:HLOS_1"
|
|
rootfsname="rootfs_1"
|
|
mmc_do_upgrade "$1"
|
|
fi
|
|
;;
|
|
redmi,ax6|\
|
|
xiaomi,ax3600|\
|
|
xiaomi,ax9000)
|
|
# Make sure that UART is enabled
|
|
fw_setenv boot_wait on
|
|
fw_setenv uart_en 1
|
|
|
|
# Enforce single partition.
|
|
fw_setenv flag_boot_rootfs 0
|
|
fw_setenv flag_last_success 0
|
|
fw_setenv flag_boot_success 1
|
|
fw_setenv flag_try_sys1_failed 8
|
|
fw_setenv flag_try_sys2_failed 8
|
|
|
|
# Kernel and rootfs are placed in 2 different UBI
|
|
CI_KERN_UBIPART="ubi_kernel"
|
|
CI_ROOT_UBIPART="rootfs"
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
*)
|
|
default_do_upgrade "$1"
|
|
;;
|
|
esac
|
|
}
|