It's no longer able to generate images for devices with limited flash
(<= 8 MiB), so just use the full feature wpad.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Now, that initramfs images built for ZTE devices work, by moving
LZMA_TEXT_START further up the available RAM - same fix works
successfully for Meraki MR18 too. Apply it and reenable initramfs
generation again.
Fixes: 1d49310fdb ("ath79: add Cisco Meraki MR18")
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17680
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 7423e67e1b)
initramfs for some devices grew so big, that it can't be loaded within
the previous 32MB RAM limit. Make the LZMA_TEXT_ADDRESS configurable
per-target once again, to fix it for bigger devices, while maintaining
compatibility with previous ones.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17616
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 6720958659)
Referencing commit a1837135e0
Hardware
--------
SoC: Qualcomm Atheros QCA9558
RAM: 128M DDR2 (Nanya NT5TU64M16HG-AC)
FLASH: 128M SPI-NAND (Spansion S34ML01G100TFI00)
WLAN: QCA9558 3T3R 802.11 bgn
ETH: Qualcomm Atheros QCA8337
UART: 115200 8n1
BUTTON: Reset - WPS - "Router" switch
LED: 2x system-LED, 2x wlan-LED, 1x internet-LED,
2x routing-LED
LEDs besides the ethernet ports are controlled
by the ethernet switch
MAC Address:
use address(sample 1) source
label cc:e1:d5:xx:xx:ed art@macaddr_wan
lan cc:e1:d5:xx:xx:ec art@macaddr_lan
wan cc:e1:d5:xx:xx:ed $label
WiFi4_2G cc:e1:d5:xx:xx:ec art@cal_ath9k
Installation from Serial Console
------------
1. Connect to the serial console. Power up the device and interrupt
autoboot when prompted
2. Connect a TFTP server reachable at 192.168.11.10/24
to the ethernet port. Serve the OpenWrt initramfs image as
"openwrt.bin"
3. Boot the initramfs image using U-Boot
ath> tftpboot 0x84000000 openwrt.bin
ath> bootm 0x84000000
4. Copy the OpenWrt sysupgrade image to the device using scp and
install it like a normal upgrade (with no need to keeping config
since no config from "previous OpenWRT installation" could be kept
at all)
# sysupgrade -n /path/to/openwrt/sysupgrade.bin
Installation from Web Interface
------------
To flash just do a firmware upgrade from the stock firmware (Buffalo
branded dd-wrt) with squashfs-factory.bin
Signed-off-by: Edward Chow <equu@openmail.cc>
Link: https://github.com/openwrt/openwrt/pull/17227
(cherry picked from commit 42254d3f5f)
Link: https://github.com/openwrt/openwrt/pull/17359
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The KuWFi N650 is a 5GHz outdoor wireless bridge based on QCA9563.
Specs
=====
CPU: QCA9563, 775MHz
RAM: 128MiB
Flash: 16MiB
Wireless: QCA9888 (5GHz only)
Ethernet: 2x GBit (via QCA8337), 48V passive PoE
Installation
============
From OEM firmware
-----------------
The OEM firmware has telnet enabled by default. If not, it can be enabled
from the firmware web interface. You need a TFTP server on your computer
and the OpenWrt factory image should be available as "n650factory.bin".
It is assumed that your computer has the IP 192.168.1.1 and the N650
192.168.1.20 (default IP address).
1. Connect via Telnet to the device and log in with the default credentials
"admin:admin"
2. Exploit the limited interface by typing "ps & /bin/sh"
3. Press <ENTER> to start the shell
4. Enter the following commands:
$ cd /tmp
$ tftp -r n650factory.bin -g 192.168.1.1
$ cat << EOF > /tmp/openwrt.sh
IMAGE_NAME="\$1"
if [ ! -e \${IMAGE_NAME} ]; then
echo "Image file not found: \${IMAGE_NAME}"
exit 1
fi
. /usr/sbin/common.sh
kill_remaining TERM
sleep 3
kill_remaining KILL
run_ramfs mtd write \${IMAGE_NAME} firmware
sleep 2
reboot -f
EOF
$ chmod +x /tmp/openwrt.sh
$ /tmp/openwrt.sh n650factory.bin
Once the device reboots, it should load OpenWrt.
From UART
---------
UART installation is possible since the serial header is already soldered
on. The pinout is GND - Tx - Rx - VCC from top to bottom (RJ45 ports are
at the bottom). Connect with 115200 8N1.
First, boot OpenWrt from TFTP. Enter the following commands in the U-Boot
shell, assuming your computer has the IP address 192.168.1.1 and a TFTP
server running where the initramfs image is provided as n650.bin:
setenv ipaddr 192.168.1.20
setenv serverip 192.168.1.1
tftpboot 0x84000000 n650.bin
bootm
Once booted, transfer -loader.bin and -sysupgrade.bin images to the device
at /tmp. Enter the following commands, replacing the filenames:
mtd write /tmp/loader.bin loader
sysupgrade /tmp/sysupgrade.bin
Reboot and OpenWrt should load from flash.
Back to Stock
-------------
Back to stock is only possible if you saved a partition backup before
installing OpenWrt. Assuming you have fullbackup.bin covering the whole
flash, you need to prepare the image as follows:
$ dd if=fullbackup.bin of=fwconcat0.bin bs=65536 skip=4 count=212
$ dd if=fullbackup.bin of=loader.bin bs=65536 skip=216 count=1
$ dd if=fullbackup.bin of=fwconcat1.bin bs=65536 skip=217 count=22
$ cat fwconcat0.bin fwconcat1.bin > firmware.bin
Transfer firmware.bin and loader.bin to the OpenWrt device. First, flash
loader.bin to mtd device loader, then force sysupgrade:
$ mtd write loader.bin loader
$ sysupgrade -F firmware.bin
The reason for the two-step process is the way the flash layout is designed
for OpenWrt in contrast to the OEM firmware partition.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
Link: https://github.com/openwrt/openwrt/pull/17089
Link: https://github.com/openwrt/openwrt/pull/17247
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit dde510cf97)
TP-Link CPE710-v2 is an outdoor wireless CPE for 5 GHz with one Ethernet
port based on the AP152 reference board. Compared to the CPE710-v1, the
only change observed in hardware is that the mdio address of the ethernet
physical changed from 0x4 to 0x0.
Specifications:
- SoC: QCA9563-AL3A MIPS 74kc @ 775MHz, AHB @ 258MHz
- RAM: 128MiB DDR2 @ 650MHz
- Flash: 16MiB SPI NOR Based on the GD25Q128
- Wi-Fi 5Ghz: ath10k chip (802.11ac for up to 867Mbps on 5GHz wireless
data rate), based on the QCA9896
- Ethernet: one 1GbE port
- 23dBi high-gain directional 2×2 MIMO parabolic antenna
- Power, LAN, WLAN5G Blue LEDs
Flashing instructions:
Flash factory image through stock firmware WEB UI or through TFTP
To get to TFTP recovery just hold reset button while powering on for around
30-40 seconds and release.
Rename factory image to recovery.bin
Stock TFTP server IP:192.168.0.100
Stock device TFTP address:192.168.0.254
Signed-off-by: Tim Noack <tim@noack.id>
Link: https://github.com/openwrt/openwrt/pull/16637
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 5572e0196a)
Link: https://github.com/openwrt/openwrt/pull/17097
Signed-off-by: Petr Štetiar <ynezz@true.cz>
The Sophos AP15C uses the same hardware as the AP15, but has a reset button.
Based on:
commit 6f1efb2898 ("ath79: add support for Sophos AP100/AP55 family")
author Andrew Powers-Holmes <andrew@omnom.net>
Fri, 3 Sep 2021 15:53:57 +0200 (23:53 +1000)
committer Hauke Mehrtens <hauke@hauke-m.de>
Sat, 16 Apr 2022 16:59:29 +0200 (16:59 +0200)
Unique to AP15C:
- Reset button
- External RJ45 serial console port
Flashing instructions:
This firmware can be flashed either via a compatible Sophos SG or XG
firewall appliance, which does not require disassembling the device, or via
the U-Boot console available on the internal UART header.
To flash via XG appliance:
- Register on Sophos' website for a no-cost Home Use XG firewall license
- Download and install the XG software on a compatible PC or virtual
machine, complete initial appliance setup, and enable SSH console access
- Connect the target AP device to the XG appliance's LAN interface
- Approve the AP from the XG Web UI and wait until it shows as Active
(this can take 3-5 minutes)
- Connect to the XG appliance over SSH and access the Advanced Console
(Menu option 5, then menu option 3)
- Run `sudo awetool` and select the menu option to connect to an AP via
SSH. When prompted to enable SSH on the target AP, select Yes.
- Wait 2-3 minutes, then select the AP from the awetool menu again. This
will connect you to a root shell on the target AP.
- Copy the firmware to /tmp/openwrt.bin on the target AP via SCP/TFTP/etc
- Run `mtd -r write /tmp/openwrt.bin astaro_image`
- When complete, the access point will reboot to OpenWRT.
To flash via U-Boot serial console:
- Configure a TFTP server on your PC, and set IP address 192.168.99.8 with
netmask 255.255.255.0
- Copy the firmware .bin to the TFTP server and rename to 'uImage_AP15C'
- Open the target AP's enclosure and locate the 4-pin 3.3V UART header [4]
- Connect the AP ethernet to your PC's ethernet port
- Connect a terminal to the UART at 115200 8/N/1 as usual
- Power on the AP and press a key to cancel autoboot when prompted
- Run the following commands at the U-Boot console:
- `tftpboot`
- `cp.b $fileaddr 0x9f070000 $filesize`
- `boot`
- The access point will boot to OpenWRT.
Signed-off-by: David Lutz <kpanic@hirnduenger.de>
(cherry picked from commit a7abc7ec3b)
The last "syscfg" partition of the OEM firmware turns out to be a
UBIFS used to store user data, just as the "rootfs_data" of OpenWrt,
so it should be reasonable to absorb it into the "ubi" partition.
Factory installations via either OEM firmware or tftp, or by forcibly
flashing factory image to mtd5 (firmware) partition with mtd tool are
confirmed working, but the UBI remaining inside "syscfg" partition
could break upgrade. Fortunately, installing kmod-mtd-rw and erasing
"syscfg" partition before upgrade is confirmed working, in which case,
"ubi" will automatically expand to the blank space once occupied by
the former mtd8 (syscfg), with the total block number increased, but
the UBIFS for rootfs_data will not automatically claim the newly
available space (since it is created when mtd8 still exists, and
sysupgrade does not set "autoresize" flag to rootfs_data). These space
will be claimed during the next upgrade, when rootfs_data is removed
and created again.
Fixes: 50f727b773 ("ath79: add support for Linksys EA4500 v3")
Signed-off-by: Edward Chow <equu@openmail.cc>
Link: https://github.com/openwrt/openwrt/pull/14791
Signed-off-by: Robert Marko <robimarko@gmail.com>
ALFA Network WiFi CampPro Nano Duo is a dual-radio Wi-Fi signal extender
(router) in USB dongle form-factor (Type-A plug is used only for power),
based on combination of two radio chipsets: Qualcomm QCA9531 (main SOC)
and MediaTek MT7610U (connected over USB 2.0 interface).
Specifications:
- SOC: QCA9531 v2 (650 MHz)
- DRAM: DDR2 128 MiB (Nanya NT5TU64M16HG-AC)
- Flash: 16 MiB SPI NOR (Macronix MX25L12835F)
- Ethernet: 1x 10/100 Mbps Ethernet (QCA9531)
- Wi-Fi: 2x2:2 2.4 GHz Wi-Fi 4 (QCA9531)
1x1:1 2.4/5 GHz Wi-Fi 5 (MT7610U)
- Antenna: 3x RP-SMA (female) antenna connectors
- LED: 1x orange (RJ45, power indicator)
2x green (status + RJ45 activity/link)
1x blue (Wi-Fi 2.4 GHz status)
- Button: 1x button (reset)
- UART: 1x 4-pin, 2.00 mm pitch header on PCB
- Other: external h/w watchdog (EM6324QYSP5B, enabled by default)
GPIO-controlled USB power for MT7610U
MAC addresses:
- LAN: 00:c0:ca:xx:xx:6d (art 0x2, -1)
- 2.4 GHz (QCA9531): 00:c0:ca:xx:xx:6e (art 0x2, device's label)
- 2.4/5 GHz (MT7610U): 00:c0:ca:xx:xx:6f (from eeprom)
Flash instructions:
You can use sysupgrade image directly in vendor firmware which is based
on LEDE/OpenWrt. Alternatively, you can use web recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with RJ45 port, press the reset button, power up device,
wait for first blink of status LED (indicates network setup), then
keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
COMFAST CF-E355AC v2 is a ceiling mount AP with PoE support,
based on Qualcomm/Atheros QCA9531 + QCA9886.
Short specification:
- 1x 10/100 Mbps Ethernet, with PoE support (wan/eth1)
- 1x 10/100/1000 Mbps Ethernet, with PoE support (lan/eth0)
- 128MB of RAM (DDR2)
- 16 MB of FLASH
- 2T2R 2.4 GHz, 802.11b/g/n (wlan2g)
- 2T2R 5 GHz, 802.11ac/n/a, WAVE 2 (wlan5g)
- built-in 4x 3 dBi antennas
- output power (max): 500 mW (27 dBm)
- 1x RGB LED, 1x button
- separate watchdog chip via GPIO (bottom of PCB?)
- UART header on PCB with proper labelling
Markings on PCB:
* R121QH_VER2.1 (silkscreen, bottom)
* CF-WA800 (sticker, top)
Initial flashing instructions:
Original firmware is based on OpenWrt.
a) Use sysupgrade image directly in vendor GUI.
b) Or via tftp:
ipaddr=192.168.1.1
serverip=192.168.1.10
bootfile="firmware.bin"
c) Or possibly via u-boot's `httpd` command.
MAC-address mapping follows original firmware:
* eth1 (wan) is the lowest mac address (art @ 0x0)
* eth0 (lan) uses eth1 + 1 (art @ 0x1002)
* wlan2g (phy1) uses eth1 + 2 (art @ 0x06)
* wlan5g (phy0) uses eth1 + 10 (not present in art)
* unused MAC (eth1 + 3) (art @ 0x5006)
Art dump (`hexdump /dev/mtd1 |grep ZZZZ`):
0000000 ZZZZ XXXX XXX0 ZZZZ XXXX XXX2 ffff ffff
0001000 0202 ZZZZ XXXX XXX1 0000 0000 0000 0000
0005000 202f bd21 0101 ZZZZ XXXX XXX3 0000 2000
Root access to original firmware (only via UART) can be achieved by
making a backup of configuration from web interface. Backup contains
whole `/etc` directory...
Signed-off-by: Priit Laes <plaes@plaes.org>
Link: https://github.com/openwrt/openwrt/pull/16556
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
NEC Aterm WG1800HP2 is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on
QCA9558.
Specification:
- SoC : Qualcomm Atheros QCA9558
- RAM : DDR2 128 MiB (2x Nanya NT5TU32M16DG-AC)
- Flash : SPI-NOR 16 MiB (Macronix MX25L12845EMI-10G)
- WLAN : 2.4/5 GHz
- 2.4 GHz : 3T3R (Qualcomm Atheros QCA9558 (SoC))
- 5 GHz : 3T3R (Qualcomm Atheros QCA9880)
- Ethernet : 5x 10/100/1000 Mbps
- switch : Atheros AR8327
- LEDs/Keys (GPIO) : 12x/5x
- UART : through-hole on PCB
- assignment : 3.3V, GND, NC, TX, RX from tri-angle marking
- settings : 9600n8
- USB : 1x USB 2.0 Type-A
- hub (internal) : NEC uPD720114
- Power : 12 VDC, 1.5 A (Max. 17 W)
- Stock OS : NetBSD based
Flash instruction using initramfs-factory.bin image (StockFW WebUI):
1. Boot WG1800HP2 with router mode normally
2. Access to the WebUI ("http://aterm.me/" or "http://192.168.0.1/") on
the device and open firmware update page ("ファームウェア更新")
3. Select the OpenWrt initramfs-factory.bin image and click update
("更新") button
4. After updating, the device will be rebooted and booted with OpenWrt
initramfs image
5. On the initramfs image, upload (or download) uboot.bin and
sysupgrade.bin image to the device
6. Replace the bootloader with a uboot.bin image
mtd write <uboot.bin image> bootloader
7. Perform sysupgrade with a sysupgrade.bin image
sysupgrade <sysupgrade image>
8. Wait ~120 seconds to complete flashing
Flash instruction using initramfs-factory.bin image (bootloader CLI):
1. Connect and open serial console
2. Power on WG1800HP2 and interrupt bootloader by ESC key
3. Login to the bootloader CLI with a password "chiron"
4. Start TFTP server by "tftpd" command
5. Upload initramfs-factory.bin via tftp from your computer
example (Windows): tftp -i 192.168.0.1 PUT initramfs-factory.bin
6. Boot initramfs image by "boot" command
7. On the initramfs image, back up the stock bootloader and firmware if
needed
8. Upload (or download) uboot.bin and sysupgrade.bin image to the device
9. Replace the bootloader with a uboot.bin image
10. Perform sysupgrade with a sysupgrade.bin image
11. Wait ~120 seconds to complete flashing
Notes:
- All LEDs are connected to the TI TCA6416A (marking: PH416A) I2C
Expander chip.
- The stock bootloader requires an unknown filesystem on firmware area
in the flash. Booting of OpenWrt from that filesystem cannot be
handled, so the bootloader needs to be replaced to mainline U-Boot
before OpenWrt installation.
MAC addresses:
LAN : A4:12:42:xx:xx:44 (config, 0x6 (hex))
WAN : A4:12:42:xx:xx:45 (config, 0xc (hex))
2.4 GHz: A4:12:42:xx:xx:46 (config, 0x0 (hex))
5 GHz : A4:12:42:xx:xx:47 (config, 0x12 (hex))
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16297
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
NEC Aterm WG1800HP is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on
QCA9558.
Specification:
- SoC : Qualcomm Atheros QCA9558
- RAM : DDR2 128 MiB (2x Nanya NT5TU32M16DG-AC)
- Flash : SPI-NOR 16 MiB (Macronix MX25L12845EMI-10G)
- WLAN : 2.4/5 GHz
- 2.4 GHz : 3T3R (Qualcomm Atheros QCA9558 (SoC))
- 5 GHz : 3T3R (Qualcomm Atheros QCA9880)
- Ethernet : 5x 10/100/1000 Mbps
- switch : Atheros AR8327
- LEDs/Keys (GPIO) : 12x/5x
- UART : through-hole on PCB
- assignment : 3.3V, GND, NC, TX, RX from tri-angle marking
- settings : 9600n8
- USB : 1x USB 2.0 Type-A
- hub (internal) : NEC uPD720114
- Power : 12 VDC, 1.5 A (Max. 17 W)
- Stock OS : NetBSD based
Flash instruction using initramfs-factory.bin image (StockFW WebUI):
1. Boot WG1800HP with router mode normally
2. Access to the WebUI ("http://aterm.me/" or "http://192.168.0.1/") on
the device and open firmware update page ("ファームウェア更新")
3. Downgrade the stock firmware to v1.0.2
4. After downgrading, select the OpenWrt initramfs-factory.bin image and
click update ("更新") button
5. After updating, the device will be rebooted and booted with OpenWrt
initramfs image
6. On the initramfs image, upload (or download) uboot.bin and
sysupgrade.bin image to the device
7. Replace the bootloader with a uboot.bin image
mtd write <uboot.bin image> bootloader
8. Perform sysupgrade with a sysupgrade.bin image
sysupgrade <sysupgrade image>
9. Wait ~120 seconds to complete flashing
Flash instruction using initramfs-factory.bin image (bootloader CLI):
1. Connect and open serial console
2. Power on WG1800HP and interrupt bootloader by ESC key
3. Login to the bootloader CLI with a password "chiron"
4. Start TFTP server by "tftpd" command
5. Upload initramfs-factory.bin via tftp from your computer
example (Windows): tftp -i 192.168.0.1 PUT initramfs-factory.bin
6. Boot initramfs image by "boot" command
7. On the initramfs image, back up the stock bootloader and firmware if
needed
8. Upload (or download) uboot.bin and sysupgrade.bin image to the device
9. Replace the bootloader with a uboot.bin image
10. Perform sysupgrade with a sysupgrade.bin image
11. Wait ~120 seconds to complete flashing
Notes:
- All LEDs are connected to the TI TCA6416A (marking: PH416A) I2C
Expander chip.
- The stock bootloader requires an unknown filesystem on firmware area
in the flash. Booting of OpenWrt from that filesystem cannot be
handled, so the bootloader needs to be replaced to mainline U-Boot
before OpenWrt installation.
- The data length of blocks in firmware image will be checked
(4M < threshold < 6M) on the stock WebUI on some versions (v1.0.28,
v1.0.30(latest), ...), so needs to be downgraded before OpenWrt
installation with initramfs-factory image.
MAC addresses:
LAN : 10:66:82:xx:xx:04 (config, 0x6 (hex))
WAN : 10:66:82:xx:xx:05 (config, 0xc (hex))
2.4 GHz: 10:66:82:xx:xx:06 (config, 0x0 (hex))
5 G : 10:66:82:xx:xx:07 (config, 0x12 (hex))
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16297
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
NEC Aterm WG1400HP is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on
QCA9558.
Specification:
- SoC : Qualcomm Atheros QCA9558
- RAM : DDR2 128 MiB (2x Nanya NT5TU32M16DG-AC)
- Flash : SPI-NOR 16 MiB (Macronix MX25L12845EMI-10G)
- WLAN : 2.4/5 GHz
- 2.4 GHz : 3T3R (Qualcomm Atheros QCA9558 (SoC))
- 5 GHz : 2T2R (Qualcomm Atheros QCA9882)
- Ethernet : 5x 10/100/1000 Mbps
- switch : Atheros AR8327
- LEDs/Keys (GPIO) : 12x/5x
- UART : through-hole on PCB
- assignment : 3.3V, GND, NC, TX, RX from tri-angle marking
- settings : 9600n8
- USB : 1x USB 2.0 Type-A
- hub (internal) : NEC uPD720114
- Power : 12 VDC, 1.5 A (Max. 17 W)
- Stock OS : NetBSD based
Flash instruction using initramfs-factory.bin image (StockFW WebUI):
1. Boot WG1400HP with router mode normally
2. Access to the WebUI ("http://aterm.me/" or "http://192.168.0.1/") on
the device and open firmware update page ("ファームウェア更新")
3. Select the OpenWrt initramfs-factory.bin image and click update
("更新") button
4. After updating, the device will be rebooted and booted with OpenWrt
initramfs image
5. On the initramfs image, upload (or download) uboot.bin and
sysupgrade.bin image to the device
6. Replace the bootloader with a uboot.bin image
mtd write <uboot.bin image> bootloader
7. Perform sysupgrade with a sysupgrade.bin image
sysupgrade <sysupgrade image>
8. Wait ~120 seconds to complete flashing
Flash instruction using initramfs-factory.bin image (bootloader CLI):
1. Connect and open serial console
2. Power on WG1400HP and interrupt bootloader by ESC key
3. Login to the bootloader CLI with a password "chiron"
4. Start TFTP server by "tftpd" command
5. Upload initramfs-factory.bin via tftp from your computer
example (Windows): tftp -i 192.168.0.1 PUT initramfs-factory.bin
6. Boot initramfs image by "boot" command
7. On the initramfs image, back up the stock bootloader and firmware if
needed
8. Upload (or download) uboot.bin and sysupgrade.bin image to the device
9. Replace the bootloader with a uboot.bin image
10. Perform sysupgrade with a sysupgrade.bin image
11. Wait ~120 seconds to complete flashing
Notes:
- All LEDs are connected to the TI TCA6416A (marking: PH416A) I2C
Expander chip.
- The stock bootloader requires an unknown filesystem on firmware area
in the flash. Booting of OpenWrt from that filesystem cannot be
handled, so the bootloader needs to be replaced to mainline U-Boot
before OpenWrt installation.
MAC addresses:
LAN : 10:66:82:xx:xx:20 (config, 0x6 (hex))
WAN : 10:66:82:xx:xx:21 (config, 0xc (hex))
2.4 GHz: 10:66:82:xx:xx:22 (config, 0x0 (hex))
5 GHz : 10:66:82:xx:xx:23 (config, 0x12 (hex))
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16297
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The swconfig-based b53 driver for the BCM53128 switch stopped working
after commits b2cfed48f6 (Revert "swconfig: fix Broadcom b53 support")
and e4e410733f (kernel: export switch_generic_set_link() symbol). This
rendered the 8 LAN ports of the EdgeSwitch 8XP non-functional, so the
image compilation for the device was disabled (5a1d7d8c1b).
This commit adds the kmod-dsa-b53-mdio and kmod-dsa-b53 packages
with the upstream B53 DSA driver, replacing the swconfig-based
kmod and kmod-switch-bcm53xx-mdio downstream ones that are not used by
any other device.
The 8 LAN ports of the EdgeSwitch 8XP are usable again. The 02_network
init script has been updated with the new DSA interfaces lan1 .. lan8.
Image building has been reenabled for the device, adding the usual DSA
incompatibility notice.
Tested on a Ubiquiti EdgeSwitch 8XP.
Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
Link: https://github.com/openwrt/openwrt/pull/11680
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The company Zyxel rebranded some years ago.
Currently the casing is according to the old branding even
for newer devices which already use the new branding.
This commit aligns the casing of Zyxel everywhere.
Signed-off-by: Goetz Goerisch <ggoerisch@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15652
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Device support for Sophos AP15 is based on Sophos AP55(C) and AP100(C).
Those other Sophos access points uss a QCA9558 SoC (some of them with
one of the three chains on the built-in SoC's wifi disabled) while the
AP15 uses a QCA9557 SoC (which only has two chains enabled in the
package or silicon).
This is mostly cosmetic since QCA9558 and QCA9557 are virtually
identical and all differences are automatically detected and/or managed
by the ART calibration.
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Link: https://github.com/openwrt/openwrt/pull/16187
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
NEC Aterm WG600HP is a 2.4/5 GHz band 11n (Wi-Fi 4) router, based on
AR9344.
Specification:
- SoC : Atheros AR9344
- RAM : DDR2 128 MiB (2x Hynix H5PS5162GFR-S6C)
- Flash : SPI-NOR 8 MiB (Macronix MX25L6406EMI-12G)
- WLAN : 2.4/5 GHz 2T2R
- 2.4 GHz : Atheros AR9344 (SoC)
- 5 GHz : Atheros AR9382
- Ethernet : 5x 10/100/1000 Mbps
- switch : Atheros AR8327
- LEDs/Keys (GPIO): 10x/4x
- note : all LEDs are controlled by ath9k chip (AR9382)
- UART : through-hole on PCB
- assignment : 3.3V, GND, NC, TX, RX from tri-angle marking
- settings : 9600n8
- USB : 1x USB 2.0 Type-A
- hub (internal): NEC uPD720114
- Power : 12 VDC, 1.5 A (Max. 16 W)
- Stock OS : NetBSD based
Flash instruction using initramfs-factory.bin image (StockFW WebUI):
1. Boot WG600HP with router mode normally
2. Access to the WebUI ("http://aterm.me/" or "http://192.168.0.1/") on
the device and open firmware update page ("ファームウェア更新")
3. Select the OpenWrt initramfs-factory.bin image and click update
("更新") button
4. After updating, the device will be rebooted and booted with OpenWrt
initramfs image
5. On the initramfs image, upload (or download) uboot.bin and
sysupgrade.bin image to the device
6. Replace the bootloader with a uboot.bin image
mtd write <uboot.bin image> bootloader
7. Perform sysupgrade with a sysupgrade.bin image
sysupgrade <sysupgrade image>
8. Wait ~120 seconds to complete flashing
Flash instruction using initramfs-factory.bin image (bootloader CLI):
1. Connect and open serial console
2. Power on WG600HP and interrupt bootloader by ESC key
3. Login to the bootloader CLI with a password "chiron"
4. Start TFTP server by "tftpd" command
5. Upload initramfs-factory.bin via tftp from your computer
example (Windows): tftp -i 192.168.0.1 PUT initramfs-factory.bin
6. Boot initramfs image by "boot" command
7. On the initramfs image, back up the stock bootloader and firmware if
needed
8. Upload (or download) uboot.bin and sysupgrade.bin image to the device
9. Replace the bootloader with a uboot.bin image
10. Perform sysupgrade with a sysupgrade.bin image
11. Wait ~120 seconds to complete flashing
Notes:
- All LEDs are connected to the GPIO controller on the ath9k chip
(AR9382) and controlled by it. Those LEDs are probed after probing of
ath9k chip, so they cannot be handled as status LEDs of OpenWrt while
booting.
- A reset pin of the internal USB hub is connected to the GPIO
controller of the ath9k chip, like LEDs above. That hub will be
detected after probing of the ath9k chip.
- The stock bootloader requires an unknown filesystem on firmware area
in the flash. Booting of OpenWrt from that filesystem cannot be
handled, so the bootloader needs to be replaced to mainline U-Boot
before OpenWrt installation.
MAC Addresses:
LAN : A4:12:42:xx:xx:A0 (config, 0x6 (hex))
WAN : A4:12:42:xx:xx:A1 (config, 0xc (hex))
2.4 GHz: A4:12:42:xx:xx:A2 (config, 0x0 (hex) / art, 0x1002 (hex))
5 GHz : A4:12:42:xx:xx:A3 (config, 0x12 (hex) / art, 0x5002 (hex))
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15432
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
NEC Aterm WR9500N is a 2.4/5 GHz band 11n (Wi-Fi 4) router, based on
AR9344.
Specification:
- SoC : Atheros AR9344
- RAM : DDR2 128 MiB (2x Nanya NT5TU32M16DG-AC)
- Flash : SPI-NOR 16 MiB (Macronix MX25L12845EMI-10G)
- WLAN : 2.4/5 GHz
- 2.4 GHz : 2T2R, Atheros AR9344 (SoC)
- 5 GHz : 3T3R, Atheros AR9380
- Ethernet : 5x 10/100/1000 Mbps
- switch : Atheros AR8327
- LEDs/Keys (GPIO): 12x/4x
- note : all LEDs are controlled by ath9k chip (AR9380)
- UART : pad on PCB (near shielded ath9k chip, white circle)
- assignment : 3.3V, GND, TX, RX from AR8327 side
- settings : 9600n8
- USB : 1x USB 2.0 Type-A
- hub (internal): NEC uPD720114
- Power : 12 VDC, 1.5 A (Max. 17 W)
- Stock OS : NetBSD based
Flash instruction using initramfs-factory.bin image (StockFW WebUI):
1. Boot WR9500N with router mode normally
2. Access to the WebUI ("http://aterm.me/" or "http://192.168.0.1/") on
the device and open firmware update page ("ファームウェア更新")
3. Select the OpenWrt initramfs-factory.bin image and click update
("更新") button
4. After updating, the device will be rebooted and booted with OpenWrt
initramfs image
5. On the initramfs image, upload (or download) uboot.bin and
sysupgrade.bin image to the device
6. Replace the bootloader with a uboot.bin image
mtd write <uboot.bin image> bootloader
7. Perform sysupgrade with a sysupgrade.bin image
sysupgrade <sysupgrade image>
8. Wait ~120 seconds to complete flashing
Flash instruction using initramfs-factory.bin image (bootloader CLI):
1. Connect and open serial console
2. Power on WR9500N and interrupt bootloader by ESC key
3. Login to the bootloader CLI with a password "chiron"
4. Start TFTP server by "tftpd" command
5. Upload initramfs-factory.bin via tftp from your computer
example (Windows): tftp -i 192.168.0.1 PUT initramfs-factory.bin
6. Boot initramfs image by "boot" command
7. On the initramfs image, back up the stock bootloader and firmware if
needed
8. Upload (or download) uboot.bin and sysupgrade.bin image to the device
9. Replace the bootloader with a uboot.bin image
10. Perform sysupgrade with a sysupgrade.bin image
11. Wait ~120 seconds to complete flashing
Notes:
- All LEDs are connected to the GPIO controller on the ath9k chip
(AR9380) and controlled by it. Those LEDs are probed after probing of
ath9k chip, so they cannot be handled as status LEDs of OpenWrt while
booting.
- A reset pin of the internal USB hub is connected to the GPIO
controller of the ath9k chip, like LEDs above. That hub will be
detected after probing of the ath9k chip.
- The stock bootloader requires an unknown filesystem on firmware area
in the flash. Booting of OpenWrt from that filesystem cannot be
handled, so the bootloader needs to be replaced to mainline U-Boot
before OpenWrt installation.
MAC Addresses:
LAN : 1C:B1:7F:xx:xx:60 (config, 0x6 (hex))
WAN : 1C:B1:7F:xx:xx:61 (config, 0xc (hex))
2.4 GHz: 1C:B1:7F:xx:xx:62 (config, 0x0 (hex) / art, 0x1002 (hex))
5 GHz : 1C:B1:7F:xx:xx:63 (config, 0x12 (hex) / art, 0x5002 (hex))
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15432
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
NEC Aterm WR8750N is a 2.4/5 GHz band 11n (Wi-Fi 4) router, based on
AR9344.
Specification:
- SoC : Atheros AR9344
- RAM : DDR2 128 MiB (2x Hynix H5PS5162GFR-S6C)
- Flash : SPI-NOR 8 MiB (Macronix MX25L6406EMI-12G)
- WLAN : 2.4/5 GHz 2T2R
- 2.4 GHz : Atheros AR9344 (SoC)
- 5 GHz : Atheros AR9382
- Ethernet : 5x 10/100/1000 Mbps
- switch : Atheros AR8327
- LEDs/Keys (GPIO): 10x/4x
- note : all LEDs are controlled by ath9k chip (AR9382)
- UART : through-hole on PCB
- assignment : 3.3V, GND, NC, TX, RX from tri-angle marking
- settings : 9600n8
- USB : 1x USB 2.0 Type-A
- hub (internal): NEC uPD720114
- Power : 12 VDC, 1.5 A (Max. 16 W)
- Stock OS : NetBSD based
Flash instruction using initramfs-factory.bin image (StockFW WebUI):
1. Boot WR8750N with router mode normally
2. Access to the WebUI ("http://aterm.me/" or "http://192.168.0.1/") on
the device and open firmware update page ("ファームウェア更新")
3. Select the OpenWrt initramfs-factory.bin image and click update
("更新") button
4. After updating, the device will be rebooted and booted with OpenWrt
initramfs image
5. On the initramfs image, upload (or download) uboot.bin and
sysupgrade.bin image to the device
6. Replace the bootloader with a uboot.bin image
mtd write <uboot.bin image> bootloader
7. Perform sysupgrade with a sysupgrade.bin image
sysupgrade <sysupgrade image>
8. Wait ~120 seconds to complete flashing
Flash instruction using initramfs-factory.bin image (bootloader CLI):
1. Connect and open serial console
2. Power on WR8750N and interrupt bootloader by ESC key
3. Login to the bootloader CLI with a password "chiron"
4. Start TFTP server by "tftpd" command
5. Upload initramfs-factory.bin via tftp from your computer
example (Windows): tftp -i 192.168.0.1 PUT initramfs-factory.bin
6. Boot initramfs image by "boot" command
7. On the initramfs image, back up the stock bootloader and firmware if
needed
8. Upload (or download) uboot.bin and sysupgrade.bin image to the device
9. Replace the bootloader with a uboot.bin image
10. Perform sysupgrade with a sysupgrade.bin image
11. Wait ~120 seconds to complete flashing
Notes:
- All LEDs are connected to the GPIO controller on the ath9k chip
(AR9382) and controlled by it. Those LEDs are probed after probing of
ath9k chip, so they cannot be handled as status LEDs of OpenWrt while
booting.
- A reset pin of the internal USB hub is connected to the GPIO
controller of the ath9k chip, like LEDs above. That hub will be
detected after probing of the ath9k chip.
- The stock bootloader requires an unknown filesystem on firmware area
in the flash. Booting of OpenWrt from that filesystem cannot be
handled, so the bootloader needs to be replaced to mainline U-Boot
before OpenWrt installation.
MAC Addresses:
LAN : 1C:B1:7F:xx:xx:00 (config, 0x6 (hex))
WAN : 1C:B1:7F:xx:xx:01 (config, 0xc (hex))
2.4 GHz: 1C:B1:7F:xx:xx:02 (config, 0x0 (hex) / art, 0x1002 (hex))
5 GHz : 1C:B1:7F:xx:xx:03 (config, 0x12 (hex) / art, 0x5002 (hex))
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15432
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
In make menuconfig the name is [Amplifi Router HD], and
is missing Ubiquiti. Lets fix that by adding
DEVICE_VENDOR := Ubiquiti to generic-ubnt.mk so the name is:
[Ubiquiti Amplifi Router HD].
Signed-off-by: Kristian Skramstad <kristian+github@83.no>
Link: https://github.com/openwrt/openwrt/pull/15932
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Huawei AP6010DN is a dual-band, dual-radio 802.11a/b/g/n 2x2 MIMO
enterprise access point with one Gigabit Ethernet port and PoE
support.
Hardware highlights:
- CPU: AR9344 SoC at 480MHz
- RAM: 128MB DDR2
- Flash: 32MB SPI-NOR
- Wi-Fi 2.4GHz: AR9344-internal radio
- Wi-Fi 5GHz: AR9580 PCIe WLAN SoC
- Ethernet: 10/100/1000 Mbps Ethernet through Atheros AR8035 PHY
- PoE: yes
- Standalone 12V/2A power input
- Serial console externally available through RJ45 port
- External watchdog: CAT706SVI (1.6s timeout)
Serial console:
9600n8 (9600 baud, no stop bits, no parity, 8 data bits)
MAC addresses:
Each device has 32 consecutive MAC addresses allocated by
the vendor, which don't overlap between devices.
This was confirmed with multiple devices with consecutive
serial numbers.
The MAC address range starts with the address on the label.
To be able to distinguish between the interfaces,
the following MAC address scheme is used:
- eth0 = label MAC
- radio0 (Wi-Fi 2.4GHz) = label MAC + 1
- radio1 (Wi-Fi 5GHz) = label MAC + 2
Installation:
0. Connect some sort of RJ45-to-USB adapter to "Console" port of the AP
1. Power up the AP
2. At prompt "Press f or F to stop Auto-Boot in 3 seconds",
do what they say.
Log in with default admin password "admin@huawei.com".
3. Boot the OpenWrt initramfs from TFTP using the hidden script "run ramboot".
Replace IP address as needed:
> setenv serverip 192.168.1.10
> setenv ipaddr 192.168.1.1
> setenv rambootfile openwrt-ath79-generic-huawei_ap6010dn-initramfs-kernel.bin
> saveenv
> run ramboot
4. Optional but recommended as the factory firmware cannot be downloaded publicly:
Back up contents of "firmware" partition using the web interface or ssh:
$ ssh root@192.168.1.1 cat /dev/mtd11 > huawei_ap6010dn_fw_backup.bin
5. Run sysupgrade using sysupgrade image. OpenWrt
shall boot from flash afterwards.
Return to factory firmware (using firmware upgrade package downloaded from non-public Huawei website):
1. Start a TFTP server in the directory where
the firmware upgrade package is located
2. Boot to u-boot as described above
3. Install firmware upgrade package and format the config partitions:
> update system FatAP6X10XN_SOMEVERSION.bin
> format_fs
Return to factory firmware (from previously created backup):
1. Copy over the firmware partition backup to /tmp,
for example using scp
2. Use sysupgrade with force to restore the backup:
sysupgrade -F huawei_ap6010dn_fw_backup.bin
3. Boot AP to U-Boot as described above
Quirks and known issues:
- The stock firmware has a semi dual boot concept where the primary
kernel uses a squashfs as root partition and the secondary kernel uses
an initramfs. This dual boot concept is circumvented on purpose to gain
more flash space and since the stock firmware's flash layout isn't
compatible with mtdsplit.
- The external watchdog's timeout of 1.6s is very hard to satisfy
during bootup. This is why the GPIO15 pin connected to the watchdog input
is configured directly in the LZMA loader to output the AHB_CLK/2 signal
which keeps the watchdog happy until the wdt-gpio kernel driver takes
over. Because it would also take too long to read the whole kernel image
from flash, the uImage header only includes the loader which then reads
the kernel image from flash after GPIO15 is configured.
Signed-off-by: Marco von Rosenberg <marcovr@selfnet.de>
Link: https://github.com/openwrt/openwrt/pull/15941
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
