This pull request is based on
- the discussions in https://forum.openwrt.org/t/adding-openwrt-support-for-linksys-mr6350
- https://github.com/openwrt/openwrt/pull/11405 which added support for similar devices.
Device Specs:
- IPQ4019
- Quad Core CPU
- 256 MB RAM
- 256 MB FLASH
- 4 LAN ports, 1 WAN port
- 2.4GHz (802.11n) and 5GHz (802.11c) wifi
- 3 LEDs (Red, blue, green) which are routed to one indicator at the top of the case
- 2 buttons (Reset, WPS)
Disassembling the device:
- There are 4 screws at the bottom of the device which must be removed
- Two are under the fron rubber feets
- Two are under the labels in the back (corner next to the rear rubber feets)
Serial interface:
- The serial interface is already populated on the device with a 6-pin header
- Pin 1 is next to the heatsink
- Pinout: 1: 3.3V, 2: TX, 3: RX, 4: unknown, 5: GND, 6: GND
- Settings: 115200, 8N1
Migrating to OpenWrt requires multiple steps:
- Load and boot the initramfs image
- Adapt U-Boot settings to support bigger kernels
- Flash the sysupgrade image
Load and boot initramfs:
- Connect serial interface
- Set up a TFTP server on IP 192.168.1.254
- Copy openwrt-ipq40xx-generic-linksys_mr6350-initramfs-zImage.itb to TFTP server
- Rename file to C0A80101.img
- Boot up the device and stop in U-Boot
- Run the following U-Boot commands after a link has been established:
tftp
bootm
- Initramfs image is started now.
Adapt U-Boot settings to support bigger kernels:
- Run "fw_printenv" in the initramfs image after booting
- There should be an entry kernsize=300000 which indicates the maximum size for the kernel is 3MB
- Execute "fw_setenv kernsize 500000" to increase the max kernel size to 5MB
- Check that the change are applied with "fw_printenv"
Flash the sysupgrade image:
- Default sysupgrade routine either with a initramfs image containing LuCI or via command line.
Revert back to OEM firmware:
- Only tested with FW_MR6350_1.1.3.210129_prod.img
- Flash the OEM firmware via sysupgrade
- Forced update is required
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17977
Signed-off-by: Robert Marko <robimarko@gmail.com>
This device has only half the flash and ram of the RBR20. It also has
two lan ports instead of wan and lan.
Hardware
--------
SOC: Qualcomm IPQ4019
FLASH: 128MB (Winbond W29N01HVSINF)
RAM: 256MB (Winbond W632GU6MB-12)
WIFI: Qualcomm IPQ4019
Qualcomm Atheros QCA9886
ETH: 2x LAN
LED: 5 (4 RGB at top, 1 RG at back)
BTN: WPS, Reset
UART: 115200 8N1 (dotted Pin = VCC) VCC-TX-RX-GND
MAC addresses
-------------
LAN Label MAC (stored in boarddata1 offset 0x0)
2.4G LAN
5GLow LAN + 3 (stored in boarddata1 offset 0xc)
5GUpper LAN + 2 (stored in boarddata1 offset 0x12)
Installation
------------
Either use the vendor ui upgrade method or nmrpflash to install the
factory image.
Signed-off-by: Christoph Krapp <achterin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20560
Signed-off-by: Robert Marko <robimarko@gmail.com>
This device shares a lot of similarities with the LBR20 - the RBR20 just
misses the LTE modem and its formfactor is alot smaller. Other than that
the LED configuration matches other RBR devices but the RBR20 has less
LEDs than its larger counterparts.
Hardware
--------
SOC: Qualcomm IPQ4019
FLASH: 256MB (Winbond W29N02GVSIAF)
RAM: 512MB (Nanya NT5CC256M16EP-EK)
WIFI: Qualcomm IPQ4019
Qualcomm Atheros QCA9886
ETH: 1x WAN, 1x LAN
LED: 5 (4 RGB at top, 1 RG at back)
BTN: WPS, Reset
UART: 115200 8N1 (dotted Pin = VCC) VCC-TX-RX-GND
MAC addresses
-------------
LAN Label MAC (stored in boarddata1 offset 0x0)
WAN LAN + 1 (stored in boarddata1 offset 0x6)
2.4G LAN
5GLow LAN + 3 (stored in boarddata1 offset 0xc)
5GUpper LAN + 2 (stored in boarddata1 offset 0x12)
Installation
------------
Either use the vendor ui upgrade method or nmrpflash to install the
factory image.
Signed-off-by: Christoph Krapp <achterin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20560
Signed-off-by: Robert Marko <robimarko@gmail.com>
Switch the mac lookup to NVMEM on UBI layout and add label-mac
Signed-off-by: Steffen Förster <nemesis@chemnitz.freifunk.net>
Link: https://github.com/openwrt/openwrt/pull/20612
Signed-off-by: Robert Marko <robimarko@gmail.com>
The device is the little brother of the already supported ASUS Lyra but
with the flash configuration/layout of the RT-AC58U.
Hardware
--------
SOC: Qualcomm IPQ4019
FLASH: 2MB (Macronix MX25L1606E)
128MB (GigaDevice GD5F1GQ4UCYIG)
RAM: 256MB (Nanya NT5CC128M16IP-DI)
WIFI: Qualcomm IPQ4019
BT: Atheros AR3012-BL3D
ETH: 1x WAN, 1x LAN
LED: 1 RBG LED
BTN: WPS, Reset
UART: 115200 8N1 (square pin = VCC) VCC-TX-RX-GND
MAC addresses
-------------
LAN 2.4G + 1
WAN 2.4G + 3
2.4G Label MAC (stored in factory offset 0x1006)
5G 2.4G + 2 (stored in factory offset 0x5006)
Installation
------------
SSH
---
1. Reset the device, setup and enable SSH.
2. Transfer initramfs.itb to /tmp on the device.
3. SSH into the router, credentials are the same as in the web ui.
4. Write initramfs to linux partition:
mtd-write -d linux -i initramfs.itb
5. Reboot and wait for OpenWrt to boot.
6. Transfer sysupgrade.bin to /tmp on the device.
7. SSH into the router, user root, no pw.
8. Delete jffs2 ubi partition:
ubirmvol /dev/ubi0 --name=jffs2
9. Flash OpenWrt:
sysupgrade -n sysupgrade.bin
Signed-off-by: Christoph Krapp <achterin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20573
Signed-off-by: Robert Marko <robimarko@gmail.com>
Align the sorting of cases with other targets.
Signed-off-by: Christoph Krapp <achterin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20518
Signed-off-by: Robert Marko <robimarko@gmail.com>
Merge some identical cases in base-files.
Signed-off-by: Christoph Krapp <achterin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20518
Signed-off-by: Robert Marko <robimarko@gmail.com>
This changes the use of spaces to tabs in all base-files to be in line
with other targets.
Signed-off-by: Christoph Krapp <achterin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20518
Signed-off-by: Robert Marko <robimarko@gmail.com>
This removes the obsolete trailing whitespaces from all base-files cases
to be in line with other targets.
Signed-off-by: Christoph Krapp <achterin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20518
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit changes the Meraki MR33 and MR74 device trees to use nvmem
for ART calibration.
The WiFi BDF was moved from insect-common.dtsi to the respective
device files in preparation for additional insect-family devices being added.
Signed-off-by: Hal Martin <hal.martin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20474
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit adds support for the Cisco Meraki MR30H. The MR30H is a POE
powered 802.11ac access point with an integrated 5 port Gigabit switch.
MR30H hardware info:
* CPU: Qualcomm IPQ4029
* RAM: 256MB DDR3
* Storage: 128 MB (S34ML01G200TFV00)
* Networking: QCA8075 internal switch (5x 1GbE ports)
* WiFi: QCA4019 802.11b/g/n/ac, QCA9889 802.11/b/g/n/ac scanning radio
* Serial: Internal header (J8, 2.54mm, populated)
LAN5 (rear) is for POE input. LAN4 has POE output (802.3af) when powered
by an 802.3at source.
The LAN4 port is used for tftp booting in U-Boot.
This device does not have secure boot, but cannot be flashed without
external programmers (TSOP48 NAND) as Meraki disabled interrupting U-Boot
for any device that updated after ~2017.
Disassembly:
* Remove the two T10 screws on the rear of the AP.
* Using a guitar pick or similar plastic tool, insert it on the side between
the grey metal plate and the white plastic body and pry up gently.
* The rubberised border on the metal plate does not need to be removed.
* The metal back plate has several latches around the perimeter (but none on
the bottom by the Ethernet ports).
* Once you have removed the metal back plate, push up gently on the bottom
Ethernet ports while pulling gently on the rear-mounted Ethernet port to remove
the PCB.
* The PCB should come free from the plastic housing, pull the bottom
(4 Ethernet ports) up as if you are opening a book.
* If done carefully, there is no need to remove the WiFi antenna connectors
to access the NAND flash.
* The TSOP48 NAND flash (U30, Spansion S34ML01G200TFV00) is located on the
opposite side of the PCB.
* To flash, you need to desolder the TSOP48 or use a 360 clip.
Installation:
The dumps to flash can be found in this repository:
https://github.com/halmartin/meraki-openwrt-docs/tree/main/mr30h
The device has the following flash layout (offsets with OOB data):
```
0x000000000000-0x000000100000 : "sbl1"
0x000000100000-0x000000200000 : "mibib"
0x000000200000-0x000000300000 : "bootconfig"
0x000000300000-0x000000400000 : "qsee"
0x000000400000-0x000000500000 : "qsee_alt"
0x000000500000-0x000000580000 : "cdt"
0x000000580000-0x000000600000 : "cdt_alt"
0x000000600000-0x000000680000 : "ddrparams"
0x000000700000-0x000000900000 : "u-boot"
0x000000900000-0x000000b00000 : "u-boot-backup"
0x000000b00000-0x000000b80000 : "ART"
0x000000c00000-0x000007c00000 : "ubi"
```
* Dump your original NAND (if using nanddump, include OOB data).
* Decompress `u-boot.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `u-boot` portion of NAND from
`0x738000`-`0x948000` (length `0x210000`). Offsets here include OOB data.
* Resolder the NAND after overwriting the `u-boot` regions.
OpenWrt Installation:
* After flashing NAND with the external programmer. Plug an Ethernet
cable into port 4. Power up the device.
* The new U-Boot build uses the space character `" "` (without quotes) to
interrupt boot.
* Interrupt U-Boot and `tftpboot` the OpenWrt initramfs image from your
tftp server
```
dhcp
setenv serverip <your_tftp>
tftpboot openwrt-ipq40xx-generic-meraki_mr30h-initramfs-uImage.itb
```
* Once booted into the OpenWrt initramfs, `scp` the `sysupgrade` image to
the device and run the normal `sysupgrade` procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin"
```
* OpenWrt should now be installed on the device.
Alternative installation steps if your device has U-Boot older than:
`U-Boot 2017.07-RELEASE-g78ed34f31579 (Sep 29 2017 - 07:43:44 -0700)`
**BIG FAT WARNING BEGIN**
Attmping to interrupt boot on a newer U-Boot release may permanently
brick your device! See: riptidewave93/LEDE-MR33#13
**BIG FAT WARNING END**
* Use `ubootwrite.py` from the above GitHub repository to transfer the
`u-boot.itb`
image to the router.
```
./ubootwrite.py --serial=/dev/ttyUSB0 --write u-boot.itb
```
* To avoid bricking your router, it is highly recommended at this point that
you flash the unlocked U-Boot to the `part.safe` ubi volume.
```
run set_ubi && ubi write $loadaddr part.safe 0x2fd48
```
* Power cycle the router. The stock Meraki U-Boot will boot `part.safe` which
is now the unlocked U-Boot.
* Use the new U-Boot build (`" "` to interrupt boot) to
`tftpboot` the OpenWrt initramfs image:
```
dhcp
setenv serverip <tftp_server_addr>
tftpboot openwrt-ipq40xx-generic-meraki_mr30h-initramfs-uImage.itb
bootm
```
* It is only recommended to flash U-Boot to the `u-boot` NAND region from
Linux:
```
insmod mtd-rw i_want_a_brick=1
```
* Copy `u-boot.elf` to the router:
```
scp -O u-boot.elf root@192.168.1.1:/tmp/
```
Note: If any of the below commands fails, YOU WILL HAVE A BRICK IF YOU
REBOOT OR LOSE POWER. Only a hardware programmer can recover the device.
```
flash_erase /dev/mtd8 0 0
nandwrite -p /dev/mtd8 /tmp/u-boot.elf
```
Note: ONLY use `u-boot.elf` when flashing the `u-boot` region (`/dev/mtd8`);
`u-boot.bin` or `u-boot.itb` will BRICK YOUR DEVICE
* `scp` the `sysupgrade` image to the device and run the normal `sysupgrade`
procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin"
```
* OpenWrt should now be installed on the device.
Signed-off-by: Hal Martin <hal.martin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17026
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit adds support for the Cisco Meraki Go GX20. The Go GX20 is a wired
router with 5 port Gigabit switch. It shares the same PCB as the Meraki Z3,
but without the WiFi radios.
GX20 hardware info:
* CPU: Qualcomm IPQ4029
* RAM: 512MB DDR3
* Storage: 128 MB (S34ML01G200TFV00)
* Networking: QCA8075 internal switch (5x 1GbE ports)
* USB: 1x USB3.0
* Serial: Internal header (J8, 2.54mm, populated)
Port 5 has POE output (802.3af). The Internet/WAN port is used for tftp booting
in U-Boot.
This device ships with secure boot, and cannot be flashed without
external programmers (TSOP48 NAND and I2C EEEPROM)!
Disassembly:
* Remove the four T8 screws on the bottom of the device under the rubber feet.
* Using a guitar pick or similar plastic tool, insert it on the side between
the bottom case and the side, pry up gently. The plastic bottom has several
latches around the perimeter (but none on the rear by the Ethernet ports).
* The TSOP48 NAND flash (U30, Spansion S34ML01G200TFV00) is located on the
bottom side of the PCB (facing you as you remove the bottom plastic).
To flash, you will need to desolder the TSOP48. Attempts to flash in-circuit
using a 360 clip were unsuccessful.
* The SOIC8 I2C EEPROM (U32, Atmel 24C64) is located on the bottom side of
the PCB (facing you as you remove the bottom plastic). It can be flashed in
circuit using a SOIC8 chip clip.
Installation:
The dumps to flash can be found in this repository:
https://github.com/halmartin/meraki-openwrt-docs/tree/main/z3_gx20
The device has the following flash layout (offsets with OOB data):
```
0x000000000000-0x000000100000 : "sbl1"
0x000000100000-0x000000200000 : "mibib"
0x000000200000-0x000000300000 : "bootconfig"
0x000000300000-0x000000400000 : "qsee"
0x000000400000-0x000000500000 : "qsee_alt"
0x000000500000-0x000000580000 : "cdt"
0x000000580000-0x000000600000 : "cdt_alt"
0x000000600000-0x000000680000 : "ddrparams"
0x000000700000-0x000000900000 : "u-boot"
0x000000900000-0x000000b00000 : "u-boot-backup"
0x000000b00000-0x000000b80000 : "ART"
0x000000c00000-0x000007c00000 : "ubi"
```
* Dump your original NAND (if using nanddump, include OOB data).
* Decompress `u-boot.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `u-boot` portion of NAND from
`0x738000`-`0x948000` (length `0x210000`). Offsets here include OOB data.
* Decompress `ubi.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `ubi` portion of NAND from
`0xc60000`-`0x8400000` (length `0x77a0000`). Offsets here include OOB data.
* Dump your original EEPROM. Change the byte at offset `0x49` to `0x1e`
(originally `0x2b`). Remember to re-write the EEPROM with the modified data.
* This can be done on Linux via the following command:
`printf "\x1e" | dd of=/tmp/eeprom.bin bs=1 seek=$((0x49)) conv=notrunc`
**Note**: the device will not boot if you modify the board major number and
have not yet overwritten the `ubi` and `u-boot` regions of NAND.
* Resolder the NAND after overwriting the `u-boot` and `ubi` regions.
OpenWrt Installation:
* After flashing NAND and EEPROM with external programmers. Plug an Ethernet
cable into the Internet/WAN port. Power up the device.
* The new U-Boot build uses the space character `" "` (without quotes) to
interrupt boot.
* Interrupt U-Boot and `tftpboot` the OpenWrt initramfs image from your
tftp server
```
dhcp
setenv serverip <your_tftp>
tftpboot openwrt-ipq40xx-generic-meraki_gx20-initramfs-uImage.itb
```
* Once booted into the OpenWrt initramfs, `scp` the `sysupgrade` image to
the device and run the normal `sysupgrade` procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_gx20-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_gx20-squashfs-sysupgrade.bin"
```
* OpenWrt should now be installed on the device.
Signed-off-by: Hal Martin <hal.martin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17026
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit adds support for the Cisco Meraki Z3. The Z3 is a "teleworker"
device with 802.11ac and an integrated 5 port Gigabit switch.
Z3 hardware info:
* CPU: Qualcomm IPQ4029
* RAM: 512MB DDR3
* Storage: 128 MB (S34ML01G200TFV00)
* Networking: QCA8075 internal switch (5x 1GbE ports)
* WiFi: QCA4019 802.11b/g/n/ac
* USB: 1x USB3.0
* Serial: Internal header (J8, 2.54mm, populated)
Port 5 has POE output (802.3af). The Internet/WAN port is used for tftp booting
in U-Boot.
This device ships with secure boot, and cannot be flashed without
external programmers (TSOP48 NAND and I2C EEEPROM)!
Disassembly:
* Remove the four T8 screws on the bottom of the device under the rubber feet.
* Using a guitar pick or similar plastic tool, insert it on the side between
the bottom case and the side, pry up gently. The plastic bottom has several
latches around the perimeter (but none on the rear by the Ethernet ports).
* The TSOP48 NAND flash (U30, Spansion S34ML01G200TFV00) is located on the
bottom side of the PCB (facing you as you remove the bottom plastic).
To flash, you will need to desolder the TSOP48. Attempts to flash in-circuit
using a 360 clip were unsuccessful.
* The SOIC8 I2C EEPROM (U32, Atmel 24C64) is located on the bottom side of
the PCB (facing you as you remove the bottom plastic). It can be flashed in
circuit using a SOIC8 chip clip.
Installation:
The dumps to flash can be found in this repository:
https://github.com/halmartin/meraki-openwrt-docs/tree/main/z3_gx20
The device has the following flash layout (offsets with OOB data):
```
0x000000000000-0x000000100000 : "sbl1"
0x000000100000-0x000000200000 : "mibib"
0x000000200000-0x000000300000 : "bootconfig"
0x000000300000-0x000000400000 : "qsee"
0x000000400000-0x000000500000 : "qsee_alt"
0x000000500000-0x000000580000 : "cdt"
0x000000580000-0x000000600000 : "cdt_alt"
0x000000600000-0x000000680000 : "ddrparams"
0x000000700000-0x000000900000 : "u-boot"
0x000000900000-0x000000b00000 : "u-boot-backup"
0x000000b00000-0x000000b80000 : "ART"
0x000000c00000-0x000007c00000 : "ubi"
```
* Dump your original NAND (if using nanddump, include OOB data).
* Decompress `u-boot.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `u-boot` portion of NAND from
`0x738000`-`0x948000` (length `0x210000`). Offsets here include OOB data.
* Decompress `ubi.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `ubi` portion of NAND from
`0xc60000`-`0x8400000` (length `0x77a0000`). Offsets here include OOB data.
* Dump your original EEPROM. Change the byte at offset `0x49` to `0x1e`
(originally `0x24`). Remember to re-write the EEPROM with the modified data.
* This can be done on Linux via the following command:
`printf "\x1e" | dd of=/tmp/eeprom.bin bs=1 seek=$((0x49)) conv=notrunc`
**Note**: the device will not boot if you modify the board major number and
have not yet overwritten the `ubi` and `u-boot` regions of NAND.
* Resolder the NAND after overwriting the `u-boot` and `ubi` regions.
OpenWrt Installation:
* After flashing NAND and EEPROM with external programmers. Plug an Ethernet
cable into the Internet/WAN port. Power up the device.
* The new U-Boot build uses the space character `" "` (without quotes) to
interrupt boot.
* Interrupt U-Boot and `tftpboot` the OpenWrt initramfs image from your
tftp server
```
dhcp
setenv serverip <your_tftp>
tftpboot openwrt-ipq40xx-generic-meraki_z3-initramfs-uImage.itb
```
* Once booted into the OpenWrt initramfs, created the `ART` ubivol with
the WiFi radio calibration from the mtd partition:
```
cat /dev/mtd10 > /tmp/ART.bin
ubimkvol /dev/ubi0 -N ART -s 524288
ubiupdatevol /dev/ubi0_1 /tmp/ART.bin
```
* `scp` the `sysupgrade` image to
the device and run the normal `sysupgrade` procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_z3-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_z3-squashfs-sysupgrade.bin"
```
* OpenWrt should now be installed on the device.
Signed-off-by: Hal Martin <hal.martin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17026
Signed-off-by: Robert Marko <robimarko@gmail.com>
Convert the router to DSA.
Co-Developed-by: Matt Beaumont <github@beaum.xyz>
Tested-by: Matt Beaumont <github@beaum.xyz>
Link: https://github.com/openwrt/openwrt/pull/12478
Signed-off-by: Nick Hainke <vincent@systemli.org>
The Teltonika RUTX50 mac-addresses on its wired interfaces are currently
random on every boot.
Setting the mac-addresses from device-tree using nvmem does not work, as
the vendor bootloader mangles the mtd partitions, removing the
nvmem-cells property.
To remedy the random mac-addresse, set the correct ones in preinit.
Signed-off-by: David Bauer <mail@david-bauer.net>
set macaddress correctly for board
Signed-off-by: Florian Maurer <f.maurer@outlook.de>
Link: https://github.com/openwrt/openwrt/pull/17305
Signed-off-by: Robert Marko <robimarko@gmail.com>
Specification
-------------
- SoC : Qualcomm IPQ4019
- RAM : 256 MiB DDR3 (NT5CC128M16JR-EK)
- Flash : 64 MiB SPI NOR (Winbond W25Q512JVFQ)
- WLAN : IPQ4019 built-in
- 2.4 GHz : 2x2 MIMO WiFi4
- 5 GHz : 2x2 MIMO WiFi5
- Ethernet : QCA8075 10/100/1000 Mbps 1x WAN (ETH1, PoE); 1x LAN (ETH2)
- USB : 1x 2.0 Type-A
- UART : 3.3V, 115200n8
- Buttons : 1x Reset
- LEDs : 1x RUN (lime & red)
1x WiFi 2.4 GHz (lime)
1x WiFi 5 GHz (lime)
2x ETH (lime), controlled by the QCA8075 phy
- Power : DC 12V & 802.3at PoE
- FCC ID : 2AHKT-WIA3300-20
- TFTP IP :
- client : 192.168.18.254
- router : 192.168.18.1
Installation
------------
1. Open uart console and start TFTP server. Copy initramfs image to
the TFTP root directory and rename it to 'ipqinitramfs.bin'.
2. Power on and press 'Enter' to exit to the u-boot console according
to the TTL log prompt.
3. Execute commands to load the initramfs image:
tftpboot && bootm
4. Enter into OpenWrt to backup the partitions if you want to restore
the stock firmware one day.
5. Override default 'bootcmd' environment variable in u-boot console:
env set bootcmd 'sf probe && sf read $loadaddr 0x980000 0x800000 && bootm $loadaddr'
env save
6. Repeat step 3 and flash 'sysupgrade' image in OpenWrt.
Recovery and return to stock
----------------------------
1. Restore the backup firmware partitions in the installation step 4.
2. Restore `bootcmd` environment variable via commands:
env set bootcmd bootipq && env save
MAC addresses
-------------
+---------+-------------------+
| | MAC example |
+---------+-------------------+
| LABEL | xx:xx:xx:xx:xx:25 |
| LAN | xx:xx:xx:xx:xx:26 |
| WAN | xx:xx:xx:xx:xx:25 |
| WLAN 2g | xx:xx:xx:xx:xx:28 |
| WLAN 5g | xx:xx:xx:xx:xx:29 |
+---------+-------------------+
Notice
-----------
1. Some CH340 USB-TTL module doesn't work on this device.
2. The 'firmware' partition consists of four parts in the vendor
layout:
* Name Start Size
* rootfs 0x980000 0x1680000
* 0:HLOS1 0x2000000 0x800000
* rootfs_1 0x2800000 0x1400000
* rootfs_data 0x3c00000 0x350000
3. User can control the USB power supply via commands:
echo enabled > /sys/devices/platform/output-usb-power/state
echo disabled > /sys/devices/platform/output-usb-power/state
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/16476
Signed-off-by: Robert Marko <robimarko@gmail.com>
Add the GPIO pin of the PoE passthrough switch on the Aruba AP-303H.
Power is activated when the pin is low. It enables a PSE chip, so power
is only supplied to downstream devices when they are 802.3af/at
compliant devices.
Ensure you use a sufficient power supply when chaining a consuming
device after the AP.
Signed-off-by: David Bauer <mail@david-bauer.net>
The bump to kernel 6.6 increased the GPIO base from
412 to 512 on this target.
We need to compensate for that in the GPIO numbers being passed
to uci to fix following kernel report:
[ 24.176183] export_store: invalid GPIO 423
Tested on a Wallys DR40x9 board.
Please note that:
Boards "rtl30vw" and "wpj428" are not being altered here.
They define GPIO numbers which are even below the previous
base of 412 which looks wrong.
Actual testing on these boards should be conducted to validate
and optionally fix GPIO numbering.
Suggested-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
Instead of extracting WiFi precal as well as MAC addresses in userspace
use recently introduced NVMEM-on-UBI instead.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Tested-by: Christian Lamparter <chunkeey@gmail.com>
This commit converts the EAP1300 to DSA setup.
Signed-off-by: Corey Minyard <minyard@acm.org>
Link: https://github.com/openwrt/openwrt/pull/15358
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Hardware:
=========
SOC: Qualcomm IPQ4019
WiFi 1: QCA4019 IEEE 802.11b/g/n
WiFi 2: QCA4019 IEEE 802.11a/n/ac
WiFi 3: QCA9886 IEEE 802.11a/n/ac
Bluetooth: Qualcomm CSR8510 (A10)
Zigbee: Silicon Labs EM3581 NCP + Skyworks SE2432L
Ethernet: Qualcomm Atheros QCA8072 (2-port)
Flash: Samsung KLM4G1FEPD (4GB eMMC)
RAM (NAND): 512MB
LED Controller: NXP PCA9633 (I2C)
Buttons: Single reset button (GPIO).
Ethernet:
=========
The device has 2 ethernet ports, configured as follows by default:
- left port: WAN
- right port: LAN
Wifi:
=====
The Wifi radios are turned off by default. To configure the router,
you will need to connect your computer to the LAN port of the device.
Bluetooth and Zigbee:
=====================
Configuration included but not tested.
Storage:
========
For compatibility with stock firmware, all of OpenWrt runs in a 136 MiB
eMMC partition (of which there are two copies, see below). You can also
use partition /dev/mmcblk0p19 "syscfg" (3.4 GiB) any way you see fit.
During very limited tests, stock firmware did not mount this partition.
However, backing up its stock content before use is recommended anyway.
Firmware:
=========
The device uses a dual firmware mechanism: it automatically reverts to
the previous firmware after 3 failed boot attempts.
You can switch to the inactive firmware copy by changing the "boot_part"
U-Boot environment variable. You can also do it by turning on the device
for a couple of seconds and then back off, 3 times in a row.
Installation:
=============
OpenWrt's "factory" image can be installed via the stock web UI:
1. Login to the UI. (The default password is printed on the label.)
2. Enter support mode by clicking on the "CA" link at the bottom.
3. Click "Connectivity", "Choose file", "Start", and ignore warnings.
This port is based on work done by flipy (https://github.com/flipy).
Signed-off-by: Rodrigo Balerdi <lanchon@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15345
Signed-off-by: Robert Marko <robimarko@gmail.com>
**Netgear LBR20** is a router with two gigabit ethernets , three wifi radios and integrated LTE cat.18 modem.
SoC Type: Qualcomm IPQ4019
RAM: 512 MiB
Flash: 256 MiB , SLC NAND, 2 Gbit (Macronix MX30LF2G18AC)
Bootloader: U-Boot
Modem: LTE CAT.18 Quectel EG-18EA , Max. 1.2Gbps downlink / 150Mbps uplink
WiFi class AC2200:
- radio0 : 5G on QCA9888 , WiFi5- 802.11a/n/ac MU-MIMO 2x2 , 887Mbps , 80MHz - limited for low channels
- radio1: 2,4G on IPQ4019 ,WiFi4- 802.11b/g/n MIMO2x2 300Mbps 40Mhz
- radio2: 5G on IPQ4019 , WiFi5- 802.11a/n/ac MU-MIMO 2x2 , 887Mbps ,80Mhz - limited for high channels (from 100 up to 165) . Becouse of DFS remember to set country before turning on.
Ethernet: 2x1GbE (WAN/LAN1, LAN2)
LEDs: section power : green and red , section on top (orbi) drived by TLC59208F: red, green ,blue and white
USB ports: No
Buttons: 2 Reset and SYNC(WPS)
Power: 12 VDC, 2,5 A
Connector type: Barrel
OpenWRT Installation
1. Simplest way is just do upgrade from webpage with *factory.img
2. You can also do it with standard tool for Netgear's debricking - NMPRFlash
3. Most advanced way is to open device , connect to UART console and :
- Prepare OpenWrt initramfs image in TFTP server root (server IP 192.168.1.10)
- Connect serial console (115200,8n1) to UART connector
- Connect TFTP server to RJ-45 port
- Stop in u-Boot and run u-Boot command:
> setenv serverip 192.168.1.10
> set fdt_high 0x85000000
> tftpboot 0x83000000 openwrt-ipq40xx-generic-netgear_lbr20-initramfs-zImage.itb
> bootm 0x83000000
- Login via ssh
- upload or download *sysupgrade.bin ( like wget ... or scp transfer)
- Install image via "sysupgrade -n" (like “sysupgrade -n /tmp/openwrt-ipq40xx-generic-netgear_lbr20-squashfs-sysupgrade.bin”)
Back to Stock
- Download firmware from official Netgear's webpage , it will be *.img file after decompressing.
- Use NMRPFlash tool ( detailed insructions on project page https://github.com/jclehner/nmrpflash )
Open the case
- Unscrew nuts and remove washers from antenna's conectors.
- There are two Torx T10 screws under the label next to antenna conectors. You have to unglue this label from left and right corner to get it
- Two parts of shell covers will slide out from eachother , you have to unglue two small rubber pads and namplate sticker on bottom to do that.
- PCB is screwed with 4Pcs of Torx T10 screws
- Before lifting up PCB remove pigtiles for LTE antennas and release them from PCB and radiator (black and white wires)
- On other side of PCB ,in left bottom corner there is already soldered with 4 pins UART connector for console. Counting from left it is +3,3V , TX , RX ,GND (reffer to this picture: https://i.ibb.co/Pmrf9KB/20240116-103524.jpg )
BDF's files are in firmware_qca-wireless https://github.com/openwrt/firmware_qca-wireless/ and in parallel sent to ath10k@lists.infradead.org.
Signed-off-by: Marcin Gajda <mgajda@o2.pl>
- use color, function, function-enumerator properties.
- removes the label properties from LED nodes.
- add panic-indicator to the blue power/status LED.
Note: yes this brings the combined LAN/"switch" LED sort of back,
though I fully admit, it's a bit jank. Do you know a better option?
then please tell/make a PR!
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This in a single image to run many types of hardware in the AP391x
series (AP3912/AP3915/AP3916/AP3917/AP7662).
Hardware
--------
Qualcomm IPQ4029 WiSoC
2T2R 802.11 abgn
2T2R 802.11 nac
Macronix MX25L25635E SPI-NOR (32M)
512M DDR3 RAM
1-4x Gigabit Ethernet
Senao EXT1025 HD Camera (AP3916 only)
USB 2.0 Port (AP3915e only)
1x Cisco RJ-45 Console port
- except for AP3916 and AP3912 where there is no external serial
console and it is TDB how to solder one. Possibly J12 is UART with
pin1 = 3.3V, pin2 = GND, pin3 = TXD, pin4 = RXD.
- Settings: 115200 8N1
Installation With Serial Console
--------------------------------
1. Attach to the Console port. Power up the device and press the s key
to interrupt autoboot.
2. The default username / password to the bootloader is admin / new2day
3. Check uboot variables using printenv, and update if necessary:
$ setenv AP_MODE 0
$ setenv WATCHDOG_COUNT 0
$ setenv WATCHDOG_LIMIT 0
$ setenv AP_PERSONALITY identifi
$ setenv serverip <SERVER_IPADDR>
$ setenv ipaddr <UNIQUE_IPADDR>
$ setenv MOSTRECENTKERNEL 0; ## OpenWRT only uses the primary image
$ saveenv
$ saveenv ## 2nd time to write the secondary copy
4. On the TFTP server located at <SERVER_IPADDR>, download the OpenWrt
initramfs image. Rename and serve it as vmlinux.gz.uImage.3912
5. TFTP boot the OpenWrt initramfs image from the AP serial console:
$ run boot_net
6. Wait for OpenWrt to start. Internet port sw-eth5 is assiged to LAN
bridge and sw-eth4 (if available) is assigned to WAN. The LAN port
will use default IP address 192.168.1.1 and run a DHCP server.
If you already have a working DHCP server or already have 192.168.1.1
on your network you MUST DISCONNECT the LAN cable from your active
network immediately after the power/status LED turns green!
At this point, you need to temporarily reconfigure the AP to have
a way to transfer the OpenWRT sysupgrade image to it.
Reconfigure the newly converted OpenWRT AP using serial console or
plug in a PC to a sw-eth5 as a separate network. Note -- the LAN/WAN
port assignments were designed to make it possible to convert to
OpenWRT without serial console and using a common firmware
image for many AP models -- they may not make the most sense when
fully deployed.
7. Download and transfer the sysupgrade image to the device using e.g.
SCP.
8. Install OpenWrt to the device using "sysupgrade"
$ sysupgrade -n /path/to/openwrt.bin
9. After it boots up again, as in step 6, connect to AP and reconfigure
for final deployment.
This build supports APs in the AP391x series and similar such as WiNG
AP7662.
Ethernet devices within OpenWRT are named "sw-eth1" thru "sw-eth5".
Mapping from OpenWRT internal naming to external naming on the case is
as follows:
```
|sw-eth1|sw-eth2|sw-eth3|sw-eth4|sw-eth5
------------+-------+-------+-------+-------+-------
AP3917 | | | | GE2 | GE1
------------+-------+-------+-------+-------+-------
AP7662 | | | | GE2 | GE1
------------+-------+-------+-------+-------+-------
AP3916 | | | | CAM* | GE1
------------+-------+-------+-------+-------+-------
AP3915 | | | | | GE1
------------+-------+-------+-------+-------+-------
AP3912 | | P1 | P2 | P3 | LAN1
------------+-------+-------+-------+-------+-------
```
By default sw-eth4 is mapped to WAN. All others are assigned to the
LAN.
CAM* - On AP3916, sw-eth4 is the camera's interface. You should
reconfigure this to be on LAN after OpenWRT boots from flash.
Installation Without Serial Console
-----------------------------------
The main premise is to set u-boot environment variables using the
Extreme Networks firmware's rdwr_boot_cfg program.
$ rdwr_boot_cfg
Utility to manipulate the boot ROM config blocks
All errors are written to the sytem log file (/tmp/log/ap.log)
```
Usage: rdwr_boot_cfg <read_all|read_var|read_var_f|write_var|rm_var> ...
read_all read the entire active block
read_var <var> read a single variable from the active block
read_var_f <var> read a single variable from the active block
(formatted)
write_var <var=val> write a single variable/value pair to both
blocks
rm_var <var> delete a single variable from both blocks
```
WARNING: Be very sure you have set the u-boot environment correctly.
If not, it can only be fixed by attaching serial console!
Be aware that the Extreme Networks shell environment will automatically
reboot every 5 minutes if there is no controller present.
Read and understand these steps fully before attempting. It is easy
to make mistakes!
1. Place the OpenWRT initramfs on the TFTP server and name it as
vmlinux.gz.uImage.3912
2. Boot up to Extreme Networks WING-Campus mode OS. Port GE1/LAN1
will be a DHCP **client**. Find out the IP address from your DHCP
server and SSH in. Default user/passwd is admin/new2day or
admin/admin123.
If it is booting to WING-Distributed mode, use this command to
convert to Campus mode.
$ operational-mode centralized
3. Upon bootup you have about 5mins to changed these u-boot variables
if necessary using the rdwr_boot_cfg command in Linux shell:
$ rdwr_boot_cfg write_var AP_MODE=0
$ rdwr_boot_cfg write_var MOSTRECENTKERNEL=0
$ rdwr_boot_cfg write_var WATCHDOG_COUNT=0
$ rdwr_boot_cfg write_var WATCHDOG_LIMIT=0
$ rdwr_boot_cfg write_var AP_PERSONALITY=identifi
$ rdwr_boot_cfg write_var serverip=<SERVER_IPADDR>
$ rdwr_boot_cfg write_var ipaddr=<UNIQUE_IPADDR>
$ rdwr_boot_cfg write_var bootcmd="run boot_net"
4. Reboot AP.
5. Connect PC with ethernet to GE1/LAN1 port. You should get a
DHCP address in the 192.168.1.x range and should be able to
SSH to the new OpenWRT TFTP recovery/installation shell.
6. At this point, u-boot is still set to TFTP boot, so you have to
replace the TFTP image with the original Extreme Networks image so
that you can change the u-boot environment.
See the instructions for Extracting Extreme Networks firmware
image.
DON'T REBOOT YET!
7. Next you must follow steps 6 thru 8 from the Installation with serial
console. After which you should have OpenWRT installed to primary
flash firmware.
8. Now Reboot. This time it will boot using TFTP into Extreme Networks
image. You may need to reconnect cables at this point -- GE1/LAN1
will be a DHCP **client** and you can SSH in -- just like step 2.
Get the IP address from you own DHCP server.
9. Set u-boot env as follows:
$ rdwr_boot_cfg write_var MOSTRECENTKERNEL=0
$ rdwr_boot_cfg write_var WATCHDOG_COUNT=0
$ rdwr_boot_cfg write_var bootcmd="run boot_flash"
10. Reboot AP. This time it should be into OpenWRT. GE1/LAN1 will be
a DHCP **server** and have static IP 192.168.1.1 -- just like step 5.
11. SSH into the LAN port and reconfigure to final configuration. Don't
make any changes that prevent you from SSH or Luci access!
Restoring Extreme Networks firmware
-----------------------------------
Assuming you have the original Extreme Networks image:
1. Login to OpenWRT shell
2. scp the Extreme Networks packaged firmware image file AP391x-*.img to
/tmp
3. Extract the firmware uimage file:
$ tar xjf AP391x-*.img vmlinux.gz.uImage
4. Force run sysupgrade:
$ sysupgrade -F /tmp/AP391x-*.img /
5. Restore the u-boot varable(s):
$ rdwr_boot_cfg write_var WATCHDOG_LIMIT=3
USB 2.0 Port on AP3915e
-----------------------
Enable this by setting LED "eth:amber_or_usb_enable" to ALWAYS ON.
Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Glen Lee <g2lee@yahoo.com>
While adding support for the MF282 Plus, an entry in platform.sh was
overlooked - this fixes sysupgrade on this devices.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
While refactoring support for the MF287 series, an entry in platform.sh
was overlooked - this fixes sysupgrade on this devices.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
The ZTE MF282 Plus is a LTE router used (exclusively?) by the network
operator "3". It is very similar to the MF286/MF287 but in the form factor
of the MF282.
Specifications
==============
SoC: IPQ4019
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 1x GBit LAN
LTE: ZTE Cat6
WiFi: 802.11a/b/g/n/ac SoC-integrated
MAC addresses
=============
LAN: from config
WiFi 1: from config + 1
WiFi 2: from config + 2
Installation
============
Option 1 - TFTP
---------------
TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:
setenv serverip 192.168.1.100
setenv ipaddr 192.168.1.1
tftpboot 0x84000000 openwrt.bin
bootm 0x84000000
From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:
ubiattach -m9
cat /dev/ubi0_0 > /tmp/ubi0_0
cat /dev/ubi0_1 > /tmp/ubi0_1
Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.
Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:
ubirmvol /dev/ubi0 -N ubi_rootfs
ubirmvol /dev/ubi0 -N kernel
Option 2 - From stock firmware
------------------------------
The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.
The exploit will be available at the device wiki page.
Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".
ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd9 is the partition labelled "rootfs" by calling
"cat /proc/mtd".
Complete commands:
cd /tmp
tftp -g -r factory.bin 192.168.0.22
cat /proc/driver/sensor_id
flash_erase /dev/mtd9 0 0
dd if=/tmp/factory.bin of=/dev/mtdblock9 bs=131072
Afterwards, reboot your device and you should have a working OpenWrt
installation.
Restore Stock
=============
Option 1 - via UART
-------------------
Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.
Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.
ubiattach -m 9
ubirmvol /dev/ubi0 -N kernel
ubirmvol /dev/ubi0 -N rootfs
ubirmvol /dev/ubi0 -N rootfs_data
ubimkvol /dev/ubi0 -N kernel -s $kernel_length
ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1
Option 2 - from within OpenWrt
------------------------------
This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.
Follow the commands from Option 1 to flash back to stock.
LTE Modem
=========
The LTE modem is similar to the MF286R, it provides an RNDIS interface
and an AT interface.
Other Notes
===========
There is one GPIO Switch "Power button blocker" which, if enabled, does not
trigger a reset of the SoC if the modem reboots. If disabled, the SoC is
rebooted along with the modem. The modem can be rebooted via the exported
GPIO "modem-reset" in /sys/class/gpio.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
The ZTE MF287 requires a different board calibration file for ath10k than
the ZTE MF287+. The two devices receive their own DTS, thus the device tree
is slightly refactored.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
This adds support for the RBR40 and RBS40 (sold together as RBK40),
two netgear routers identical to SRR60/SRS60 in all but antennae (and
hardware id). See 2cb24b3f3c for details.
Signed-off-by: Thomas Makin <halorocker89@gmail.com>
Renamed the interfaces to match the other devices.
Name the interface connected to the builtin G.hn chip 'ghn'.
This might toggle at runtime while the G.hn chip is in the
bootloader.
Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Thomas Bong <thomas.bong@devolo.de>
The ZTE MF287 Pro is a LTE router used (exclusively?) by the network
operator "3". It is very similar to the MF287+, but the hardware layout
and partition layout have changed quite a bit.
Specifications
==============
SoC: IPQ4018
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 4x GBit LAN
LTE: ZTE Cat12
WiFi: 802.11a/b/g/n/ac SoC-integrated
USB: 1x 2.0
MAC addresses
=============
LAN: from config + 2
WiFi 1: from config
WiFi 2: from config + 1
Installation
============
Option 1 - TFTP
---------------
TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:
setenv serverip 192.168.1.100
setenv ipaddr 192.168.1.1
tftpboot 0x82000000 openwrt.bin
bootm 0x82000000
From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:
ubiattach -m17
cat /dev/ubi0_0 > /tmp/ubi0_0
cat /dev/ubi0_1 > /tmp/ubi0_1
Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.
Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:
ubirmvol /dev/ubi0 -N ubi_rootfs
ubirmvol /dev/ubi0 -N kernel
Option 2 - From stock firmware
------------------------------
The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.
The exploit will be available at the device wiki page.
Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".
ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd13 is the partition labelled "rootfs" by calling
"cat /proc/mtd".
Complete commands:
cd /tmp
tftp -g -r factory.bin 192.168.0.22
cat /proc/driver/sensor_id
flash_erase /dev/mtd17 0 0
dd if=/tmp/factory.bin of=/dev/mtdblock17 bs=131072
Afterwards, reboot your device and you should have a working OpenWrt
installation.
Restore Stock
=============
Option 1 - via UART
-------------------
Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.
Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.
ubiattach -m 17
ubirmvol /dev/ubi0 -N kernel
ubirmvol /dev/ubi0 -N rootfs
ubirmvol /dev/ubi0 -N rootfs_data
ubimkvol /dev/ubi0 -N kernel -s $kernel_length
ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1
Option 2 - from within OpenWrt
------------------------------
This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.
Follow the commands from Option 1 to flash back to stock.
LTE Modem
=========
The LTE modem is similar to other ZTE devices and controls some more LEDs
and battery management.
Configuring the connection using uqmi works properly, the modem
provides three serial ports and a QMI CDC ethernet interface.
Other Notes
===========
Contrary to the stock firmware, the USB port on the back can be used.
There is one GPIO Switch "Power button blocker" which, if enabled, does not
trigger a reset of the SoC if the modem reboots. If disabled, the SoC is
rebooted along with the modem. The modem can be rebooted via the exported
GPIO "modem-reset" in /sys/class/gpio.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
DK01 and DK04 board support has been in a form of 2 patches that we have
been carrying for a long time.
Both of the patches contain weird changes, dont follow any DT syntax and I
honestly doubt they are even valid.
DK01 and DK04 also have not been converted to DSA even after a long time
and I doubt that anybody in the community even has these boards as they are
QCA reference boards that are not even obtainable anymore.
Since patches for these 2 boards have been just causing us pain when trying
to update the kernel to a new major release or even point releases lets
remove the support for these boards, and if there are users they can easily
be reinstated.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Hardware
--------
CPU: Qualcomm IPQ4018
RAM: 256M
Flash: 16MB SPI-NOR (W25Q128)
128MB SPI-NAND (XTX)
WiFi: 2T2R (2GHz 802.11n ; 5 GHz 802.11ac)
ETH: 4x LAN ; 1x WAN (Gigabit)
CELL: Quectel RG501Q 3G/4G/5G
UART: Available on the goldfinger connector (Pinout silkscreened)
115200 8N1 3V3 - Only connect RX / TX / GND
Installation
------------
1. Enable SSH in the Teltonika UI
(System --> Administration --> Access Control)
2. Check from which partition set the device is currently running from.
$ cat /proc/boot_info/rootfs/primaryboot
In case this output reads 0, install a Software update from Teltonika
first. After upgrade completion, check this file now reads 1 before
continuing.
2. Transfer the OpenWrt factory image to the device using scp. Use the
same password (user root!) as used for the Web-UI.
$ scp -O openwrt-factory.bin root@192.168.1.1:/tmp
3. Connect to the device using ssh as the root user.
4. Install OpenWrt by writing the factory image to flash.
$ ubiformat /dev/mtd16 -y -f /tmp/openwrt-factory.bin
5. Instruct the bootloaer to boot from the first partition set.
$ echo 0 > /proc/boot_info/rootfs/primaryboot
$ cat /proc/boot_info/getbinary_bootconfig > /tmp/bootconfig.bin
$ cat /proc/boot_info/getbinary_bootconfig1 > /tmp/bootconfig1.bin
$ mtd write /tmp/bootconfig.bin /dev/mtd2
$ mtd write /tmp/bootconfig1.bin /dev/mtd3
6. Reboot the device.
$ reboot
Signed-off-by: David Bauer <mail@david-bauer.net>
The ZTE MF287+ is a LTE router used (exclusively?) by the network operator
"3". The MF287 (i.e. non-plus aka 3Neo) is also supported (the only
difference is the LTE modem)
Specifications
==============
SoC: IPQ4018
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 4x GBit LAN
LTE: ZTE Cat12 (MF287+) / ZTE Cat6 (MF287)
WiFi: 802.11a/b/g/n/ac SoC-integrated
MAC addresses
=============
LAN: from config + 2
WiFi 1: from config
WiFi 2: from config + 1
Installation
============
Option 1 - TFTP
---------------
TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:
setenv serverip 192.168.1.100
setenv ipaddr 192.168.1.1
tftpboot 0x82000000 openwrt.bin
bootm 0x82000000
From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:
ubiattach -m14
cat /dev/ubi0_0 > /tmp/ubi0_0
cat /dev/ubi0_1 > /tmp/ubi0_1
Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.
Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:
ubirmvol /dev/ubi0 -N ubi_rootfs
ubirmvol /dev/ubi0 -N kernel
Option 2 - From stock firmware
------------------------------
The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.
The exploit will be available at the device wiki page.
Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".
ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd13 is the partition labelled "rootfs" by calling
"cat /proc/mtd".
Complete commands:
cd /tmp
tftp -g -r factory.bin 192.168.0.22
cat /proc/driver/sensor_id
flash_erase /dev/mtd13 0 0
dd if=/tmp/factory.bin of=/dev/mtdblock13 bs=131072
Afterwards, reboot your device and you should have a working OpenWrt
installation.
Restore Stock
=============
Option 1 - via UART
-------------------
Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.
Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.
ubiattach -m 14
ubirmvol /dev/ubi0 -N kernel
ubirmvol /dev/ubi0 -N rootfs
ubirmvol /dev/ubi0 -N rootfs_data
ubimkvol /dev/ubi0 -N kernel -s $kernel_length
ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1
Option 2 - from within OpenWrt
------------------------------
This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.
Follow the commands from Option 1 to flash back to stock.
LTE Modem
=========
The LTE modem is similar to other ZTE devices and controls some more LEDs
and battery management.
Configuring the connection using uqmi works properly, the modem
provides three serial ports and a QMI CDC ethernet interface.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
Convert E2600ac c2 to DSA and enable it.
Signed-off-by: 张 鹏 <sd20@qxwlan.com>
[ rename port to more generic name ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Convert E2600ac c1 to DSA and enable it.
Signed-off-by: 张 鹏 <sd20@qxwlan.com>
[ rename port to more generic name ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Convert GL-AP1300 to DSA and enable it.
While working on it rename the GL-AP1300 leds from green to white.
Tested-by: Rob White <rob@blue-wave.net>
Tested-by: Robert Sommer <frauhottelmann@gmail.com>
Signed-off-by: Nick Hainke <vincent@systemli.org>
Re-enable the Aruba AP-365 with DSA support. Changes are trvivial, as
the board design is pretty much the already updated AP-303.
Run-tested on the device.
Signed-off-by: David Bauer <mail@david-bauer.net>
It appears that the refactor of the upgrade process for NAND devices resulted in the nand_do_upgrade_success step not being called for
devices using the linksys.sh script. As a result, configuration was
not preserved over sysupgrade steps.
This corrects a typo in the call of nand_do_upgrade_failed for ipq40xx
and ipq806x devices using the linksys.sh script.
Fixes: 8634c1080d ("ipq40xx: Fix Linksys upgrade, restore config step")
Fixes: 2715aff5df ("ipq806x: Fix Linksys upgrade, restore config step")
Signed-off-by: Michael Trinidad <trinidude4@hotmail.com>
It appears that the refactor of the upgrade process for NAND devices
resulted in the nand_do_upgrade_success step not being called for
devices using the linksys.sh script. As a result, configuration
was not preserved over sysupgrade steps.
This was restored for some devices in
commit 84ff6c90dd ("base-files: bring back nand_do_upgrade_success").
This restored preservation of config for ipq40xx devices using the
linksys.sh script. Other devices and targets have not been examined.
Closes: #11677
Fixes: e25e6d8e54 ("base-files: fix and clean up nand sysupgrade code")
Tested-on: EA8300
Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
(checkpatch nitpick)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Adds support for the Wallys DR40x9 series boards.
They come in IPQ4019 and IPQ4029 versions.
IPQ4019/4029 only differ in that that IPQ4029 is the industrial version that is rated to higher temperatures.
Specifications are:
* CPU: Qualcomm IPQ40x9 (4x ARMv7A Cortex A7) at 716 MHz
* RAM: 512 MB
* Storage: 2MB of SPI-NOR, 128 MB of parallel NAND
* USB 3.0 TypeA port for users
* MiniPCI-E with PCI-E 2.0 link
* MiniPCI-E for LTE modems with only USB2.0 link
* 2 SIM card slots that are selected via GPIO11
* MicroSD card slot
* Ethernet: 2x GBe with 24~48V passive POE
* SFP port (Does not work, I2C and GPIO's not connected on hardware)
* DC Jack
* UART header
* WLAN: In-SoC 2x2 802.11b/g/n and 2x2 802.11a/n/ac
* 4x MMCX connectors for WLAN
* Reset button
* 8x LED-s
Installation instructions:
Connect to UART, pins are like this:
-> 3.3V | TX | RX | GND
Settings are 115200 8n1
Boot initramfs from TFTP:
tftpboot 0x84000000 openwrt-ipq40xx-generic-wallys_dr40x9-initramfs-fit-uImage.itb
bootm
Then copy the sysupgrade image to the /tmp folder and execute sysupgrade -n <image_name>
The board file binary was provided from Wallystech on March 14th 2023
including full permission to use and distribute.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
Starting from Linux Kernel version 6.3 UBI devices will no longer be
considered virtual, but rather have an MTD device parent. Hence they
will no longer be listed under /sys/devices/virtual/ubi which is
used in multiple places in OpenWrt. Prepare for future kernels by
using /sys/class/ubi instead of /sys/devuces/virtual/ubi.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
