FCC ID: A8J-ENSTAC
Engenius EnStationAC v1 is an outdoor wireless access point/bridge with
2 gigabit ethernet ports on 2 external ethernet switches,
5 GHz only wireless, internal antenna plates, and proprietery PoE.
Specification:
- QCA9557 SOC
- QCA9882 WLAN (PCI card, 5 GHz, 2x2, 26dBm)
- AR8035-A switch (RGMII GbE with PoE+ IN)
- AR8031 switch (SGMII GbE with PoE OUT)
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 2x 64 MB RAM NT5TU32M16FG
- UART at J10 (unpopulated)
- internal antenna plates (19 dbi, directional)
- 7 LEDs, 1 button (power, eth, wlan, RSSI) (reset)
MAC addresses:
MAC addresses are labeled as ETH and 5GHz
Vendor MAC addresses in flash are duplicate
eth0 ETH *:d3 art 0x0/0x6
eth1 ---- *:d4 ---
phy0 5GHz *:d5 ---
Installation:
2 ways to flash factory.bin from OEM:
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fd70000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
TFTP recovery:
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board
hold or press reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
Format of OEM firmware image:
The OEM software of EnStationAC is a heavily modified version
of Openwrt Altitude Adjustment 12.09. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-ar71xx-enstationac-uImage-lzma.bin
openwrt-ar71xx-enstationac-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
Newer EnGenius software requires more checks but their script
includes a way to skip them, otherwise the tar must include
a text file with the version and md5sums in a deprecated format.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel to be no greater than 1536k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on PLL-data cells:
The default PLL register values will not work
because of the external AR8033 switch between
the SOC and the ethernet PHY chips.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
For eth0 at 1000 speed, the value returned was
ae000000 but that didn't work, so following
the logical pattern from the rest of the values,
the guessed value of a3000000 works better.
later discovered that delay can be placed on the PHY end only
with phy-mode as 'rgmii-id' and set register to 0x82...
Tested from master, all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[fixed SoB to match From:]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Specifications:
* QCA9557, 16 MiB Flash, 128 MiB RAM, 802.11n 2T2R
* QCA9882, 802.11ac 2T2R
* Gigabit LAN Port (AR8035), 802.11af PoE
Installation:
* Factory Web UI is at 192.168.0.50
login with 'admin' and blank password, flash factory.bin
* Recovery Web UI is at 192.168.0.50
connect network cable, hold reset button during power-on and keep it
pressed until uploading has started (only required when checksum is ok,
e.g. for reverting back to oem firmware), flash factory.bin
After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
The Ubiquiti Network airCube AC is a cube shaped device supporting
2.4 GHz and 5 GHz with internal 2x2 MIMO antennas.
It can be powered with either one of:
- 24v power supply with 3.0mm x 1.0mm barrel plug
- 24v passive PoE on first LAN port
There are four 10/100/1000 Mbps ports (1 * WAN + 3 * LAN).
First LAN port have optional PoE passthrough to the WAN port.
SoC: Qualcomm / Atheros AR9342
RAM: 64 MB DDR2
Flash: 16 MB SPI NOR
Ethernet: 4x 10/100/1000 Mbps (1 WAN + 3 LAN)
LEDS: 1x via a SPI controller (not yet supported)
Buttons: 1x Reset
Serial: 1x (only RX and TX); 115200 baud, 8N1
Missing features:
- LED control is not supported
Physical to internal switch port mapping:
- physical port #1 (poe in) = switchport 2
- physical port #2 = switchport 3
- physical port #3 = switchport 5
- physical port #4 (wan/poe out) = switchport 4
Factory update is tested and is the same as for Ubiquiti AirCube ISP
hence the shared configuration between that devices.
Signed-off-by: Roman Kuzmitskii <damex.pp@icloud.com>
FCC ID: A8J-ECB1200
Engenius ECB1200 is an indoor wireless access point with a GbE port,
2.4 GHz and 5 GHz wireless, external antennas, and 802.3af PoE.
**Specification:**
- QCA9557 SOC MIPS, 2.4 GHz (2x2)
- QCA9882 WLAN PCIe card, 5 GHz (2x2)
- AR8035-A switch RGMII, GbE with 802.3af PoE, 25 MHz clock
- 40 MHz reference clock
- 16 MB FLASH 25L12845EMI-10G
- 2x 64 MB RAM 1538ZFZ V59C1512164QEJ25
- UART at JP1 (unpopulated, RX shorted to ground)
- 4 external antennas
- 4 LEDs, 1 button (power, eth, wifi2g, wifi5g) (reset)
**MAC addresses:**
MAC Addresses are labeled as ETH and 5GHZ
U-boot environment has the vendor MAC addresses
MAC addresses in ART do not match vendor
eth0 ETH *:5c u-boot-env ethaddr
phy0 5GHZ *:5d u-boot-env athaddr
---- ---- ???? art 0x0/0x6
**Installation:**
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
(see TFTP recovery)
perform a sysupgrade
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART pinout at JP1
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
Unlike most Engenius boards, this does not have a 'failsafe' image
the only way to return to OEM is TFTP or serial access to u-boot
**TFTP recovery:**
Unlike most Engenius boards, TFTP is reliable here
rename initramfs-kernel.bin to 'ap.bin'
make the file available on a TFTP server at 192.168.1.10
power board while holding or pressing reset button repeatedly
or with serial access:
run `tftpboot` or `run factory_boot` with initramfs-kernel.bin
then `bootm` with the load address
**Format of OEM firmware image:**
The OEM software of ECB1200 is a heavily modified version
of Openwrt Altitude Adjustment 12.09.
This Engenius board, like ECB1750, uses a proprietary header
with a unique Product ID. The header for factory.bin is
generated by the mksenaofw program included in openwrt.
**Note on PLL-data cells:**
The default PLL register values will not work
because of the AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
However the registers that u-boot sets are not ideal and sometimes wrong...
the at803x driver supports setting the RGMII clock/data delay on the PHY side.
This way the pll-data register only needs to handle invert and phase.
for this board clock invert is needed on the MAC side
all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
This ports support for the TP-Link TL-WDR7500 v3 from ar71xx to ath79.
The basic features appear to be identical to the Archer C7 v1, however
it has the (supported) QCA9880-BR4A chip of the C7 v2.
Specifications:
SoC: QCA9558
CPU: 720 MHz
Flash: 8 MiB
RAM: 128 MiB
WLAN: 2.4 GHz b/g/n, 5 GHz a/n/ac
Qualcomm Atheros QCA9880-BR4A
Ethernet: 5x Gbit ports
USB: 2x 2.0 ports
Flashing instructions:
Upload the factory image via the OEM firmware GUI.
TFTP recovery appears to be available as well.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
TP-Link EAP225 v3 is an AC1350 (802.11ac Wave-2) ceiling mount access
point. Serial port access for debricking requires fine soldering.
Device specifications:
* SoC: QCA9563 @ 775MHz
* RAM: 128MiB DDR2
* Flash: 16MiB SPI-NOR
* Wireless 2.4GHz (SoC): b/g/n, 3x3
* Wireless 5Ghz (QCA9886): a/n/ac, 2x2 MU-MINO
* Ethernet (AR8033): 1× 1GbE, 802.3at PoE
Flashing instructions:
* ssh into target device and run `cliclientd stopcs`
* Upgrade with factory image via web interface
Debricking:
* Serial port can be soldered on PCB J3 (1: TXD, 2: RXD, 3: GND, 4: VCC)
* Bridge unpopulated resistors R225 (TXD) and R237 (RXD).
Do NOT bridge R230.
* Use 3.3V, 115200 baud, 8n1
* Interrupt bootloader by holding CTRL+B during boot
* tftp initramfs to flash via LuCI web interface
setenv ipaddr 192.168.1.1 # default, change as required
setenv serverip 192.168.1.10 # default, change as required
tftp 0x80800000 initramfs.bin
bootelf $fileaddr
MAC addresses:
MAC address (as on device label) is stored in device info partition at
an offset of 8 bytes. ath9k device has same address as ethernet, ath10k
uses address incremented by 1.
From OEM boot log:
Using interface ath0 with hwaddr b0:...:3e and ssid "..."
Using interface ath10 with hwaddr b0:...:3f and ssid "..."
Tested by forum user blinkstar88
Signed-off-by: Sander Vanheule <sander@svanheule.net>
TP-Link EAP225-Outdoor v1 is an AC1200 (802.11ac Wave-2) pole or wall
mount access point. Debricking requires access to the serial port, which
is non-trivial.
Device specifications:
* SoC: QCA9563 @ 775MHz
* Memory: 128MiB DDR2
* Flash: 16MiB SPI-NOR
* Wireless 2.4GHz (SoC): b/g/n 2x2
* Wireless 5GHz (QCA9886): a/n/ac 2x2 MU-MIMO
* Ethernet (AR8033): 1× 1GbE, PoE
Flashing instructions:
* ssh into target device with recent (>= v1.6.0) firmware
* run `cliclientd stopcs` on target device
* upload factory image via web interface
Debricking:
To recover the device, you need access to the serial port. This requires
fine soldering to test points, or the use of probe pins.
* Open the case and solder wires to the test points: RXD, TXD and TPGND4
* Use a 3.3V UART, 115200 baud, 8n1
* Interrupt bootloader by holding ctrl+B during boot
* upload initramfs via built-in tftp client and perform sysupgrade
setenv ipaddr 192.168.1.1 # default, change as required
setenv serverip 192.168.1.10 # default, change as required
tftp 0x80800000 initramfs.bin
bootelf $fileaddr
MAC addresses:
MAC address (as on device label) is stored in device info partition at
an offset of 8 bytes. ath9k device has same address as ethernet, ath10k
uses address incremented by 1.
From stock ifconfig:
ath0 Link encap:Ethernet HWaddr D8:...:2E
ath10 Link encap:Ethernet HWaddr D8:...:2F
br0 Link encap:Ethernet HWaddr D8:...:2E
eth0 Link encap:Ethernet HWaddr D8:...:2E
Tested by forum user PolynomialDivision on firmware v1.7.0.
UART access tested by forum user arinc9.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
TP-Link EAP245 v1 is an AC1750 (802.11ac Wave-1) ceiling mount access point.
Device specifications:
* SoC: QCA9563 @ 775MHz
* RAM: 128MiB DDR2
* Flash: 16MiB SPI-NOR
* Wireless 2.4GHz (SoC): b/g/n, 3x3
* Wireless 5Ghz (QCA9880): a/n/ac, 3x3
* Ethernet (AR8033): 1× 1GbE, 802.3at PoE
Flashing instructions:
* Upgrade the device to firmware v1.4.0 if necessary
* Exploit the user management page in the web interface to start telnetd
by changing the username to `;/usr/sbin/telnetd -l/bin/sh&`.
* Immediately change the malformed username back to something valid
(e.g. 'admin') to make ssh work again.
* Use the root shell via telnet to make /tmp world writeable (chmod 777)
* Extract /usr/bin/uclited from the device via ssh and apply the binary
patch listed below. The patch is required to prevent `uclited -u` in
the last step from crashing.
* Copy the patched uclited programme back to the device at /tmp/uclited
(via ssh)
* Upload the factory image to /tmp/upgrade.bin (via ssh)
* Run `chmod +x /tmp/uclited && /tmp/uclited -u` to install OpenWrt.
--- xxd uclited
+++ xxd uclited-patched
@@ -53796,7 +53796,7 @@
000d2240: 8c44 0000 0320 f809 0000 0000 8fbc 0010 .D... ..........
000d2250: 8fa6 0a4c 02c0 2821 8f82 87b8 0000 0000 ...L..(!........
-000d2260: 8c44 0000 0c13 45e0 27a7 0018 8fbc 0010 .D....E.'.......
+000d2260: 8c44 0000 2402 0000 0000 0000 8fbc 0010 .D..$...........
000d2270: 1040 001d 0000 1821 8f99 8374 3c04 0058 .@.....!...t<..X
000d2280: 3c05 0056 2484 a898 24a5 9a30 0320 f809 <..V$...$..0. ..
Debricking:
* Serial port can be soldered on PCB J3 (1: TXD, 2: RXD, 3: GND, 4: VCC)
* Bridge unpopulated resistors R225 (TXD) and R237 (RXD).
Do NOT bridge R230.
* Use 3.3V, 115200 baud, 8n1
* Interrupt bootloader by holding CTRL+B during boot
* tftp initramfs to flash via the LuCI web interface
setenv ipaddr 192.168.1.1 # default, change as required
setenv serverip 192.168.1.10 # default, change as required
tftp 0x80800000 initramfs.bin
bootelf $fileaddr
Tested on the EAP245 v1 running the latest firmware (v1.4.0). The binary
patch might not apply to uclited from other firmware versions.
EAP245 v1 device support was originally developed and maintained by
Julien Dusser out-of-tree. This patch and "ath79: prepare for 1-port
TP-Link EAP2x5 devices" are based on that work.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
CPU: Atheros AR9342 rev 3 SoC
RAM: 64 MB DDR2
Flash: 16 MB NOR SPI
WLAN 2.4GHz: Atheros AR9342 v3 (ath9k)
WLAN 5.0GHz: QCA988X
Ports: 2x GbE
Flashing procedure is identical to other ubnt devices.
https://openwrt.org/toh/ubiquiti/common
Flashing through factory firmware
1. Ensure firmware version v8.7.0 is installed.
Up/downgrade to this exact version.
2. Patch fwupdate.real binary using
`hexdump -Cv /bin/ubntbox | sed 's/14 40 fe 27/00 00 00 00/g' | \
hexdump -R > /tmp/fwupdate.real`
3. Make the patched fwupdate.real binary executable using
`chmod +x /tmp/fwupdate.real`
4. Copy the squashfs factory image to /tmp on the device
5. Flash OpenWrt using `/tmp/fwupdate.real -m <squashfs-factory image>`
6. Wait for the device to reboot
(copied from Ubiquiti NanoBeam AC and modified)
To keep it consistent, we will add the gen1 variant to
the nanobeam ac gen1.
Signed-off-by: Nick Hainke <vincent@systemli.org>
This adds a missing ";;" in the switch-case in 11-ath10k-caldata.
Fixes: 4d36569b9c ("ath79: fix ath10k caldata extraction on some
D-Link DIR-842 C3 devices")
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
According to forum threads [0][1] and a report on IRC by Doc-Saintly
some of those boards have calibration data in a different place. Only
one alternative location is known.
Without proper board calibration data (board.bin having all 0xff bytes)
ath10k firmware still tries to load but crashes on startup with a
confusing error message.
If you're applying this patch manually on your device do not forget to
remove /lib/firmware/ath10k/pre-cal-pci-0000:00:00.0.bin and reboot to
force caldata re-extraction.
[0] https://forum.openwrt.org/t/support-for-d-link-dir842-rev-c3/41654
[1] https://forum.openwrt.org/t/d-link-dir-842-cant-access-firmware-upload-form/65454
Signed-off-by: Paul Fertser <fercerpav@gmail.com>
E600G v2 based on Qualcomm/Atheros QCA9531
Specification:
- 650/600/200 MHz (CPU/DDR/AHB)
- 128/64 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 2T2R 2.4 GHz
- 2 x 10/100 Mbps Ethernet(RJ45)
- 1 x MiniPCI-e
- 1 x SIM (3G/4G)
- 5 x LED , 1 x Button(SW2-Reset Buttun), 1 x power input
- UART(J100) header on PCB(115200 8N1)
E600GAC v2 based on Qualcomm/Atheros QCA9531 + QCA9887
Specification:
- 650/600/200 MHz (CPU/DDR/AHB)
- 128/64 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 2T2R 2.4 GHz
- 1T1R 5 GHz
- 2 x 10/100 Mbps Ethernet(RJ45)
- 6 x LED (one three-color led), 2 x Button(SW2-Reset Buttun),1 x power input
- UART (J100)header on PCB(115200 8N1)
Flash instruction:
1.Using tftp mode with UART connection and original OpenWrt image
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "openwrt-ath79-generic-xxx-squashfs-sysupgrade.bin"
to "firmware.bin" and place it in tftp server directory.
- Connect PC with one of LAN ports, power up the router and press
key "Enter" to access U-Boot CLI.
- Use the following commands to update the device to OpenWrt:
run lfw
- After that the device will reboot and boot to OpenWrt.
- Wait until all LEDs stops flashing and use the router.
2.Using httpd mode with Web UI connection and original OpenWrt image
- Configure PC with static IP 192.168.1.xxx(2-255) and tftp server.
- Connect PC with one of LAN ports,press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
leds flashing.
- Open your browser and enter 192.168.1.1,You will see the upgrade
interface, select "openwrt-ath79-generic-xxx-squashfs-
sysupgrade.bin" and click the upgrade button.
- After that the device will reboot and boot to OpenWrt.
- Wait until all LEDs stops flashing and use the router.
Signed-off-by: 张鹏 <sd20@qxwlan.com>
[rearrange in generic.mk, fix one case in 04_led_migration, update
commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
E1700AC v2 based on Qualcomm/Atheros QCA9563 + QCA9880.
Specification:
- 750/400/250 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 3T3R 5 GHz
- 2 x 10/1000M Mbps Ethernet (RJ45)
- 1 x MiniPCI-e
- 1 x SIM (3G/4G)
- 1 x USB 2.0 Port
- 5 x LED , 2 x Button(S8-Reset Buttun), 1 x power input
- UART (J5) header on PCB (115200 8N1)
Flash instruction:
1.Using tftp mode with UART connection and original LEDE image
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "openwrt-ar71xx-generic-xxx-squashfs-sysupgrade.bin"
to "firmware.bin" and place it in tftp server directory.
- Connect PC with one of LAN ports, power up the router and press
key "Enter" to access U-Boot CLI.
- Use the following commands to update the device to LEDE:
run lfw
- After that the device will reboot and boot to LEDE.
- Wait until all LEDs stops flashing and use the router.
2.Using httpd mode with Web UI connection and original LEDE image
- Configure PC with static IP 192.168.1.xxx(2-255) and tftp server.
- Connect PC with one of LAN ports,press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
leds flashing.
- Open your browser and enter 192.168.1.1,You will see the upgrade
interface, select "openwrt-ar71xx-generic-xxx-squashfs-
sysupgrade.bin" and click the upgrade button.
- After that the device will reboot and boot to LEDE.
- Wait until all LEDs stops flashing and use the router.
Signed-off-by: 张鹏 <sd20@qxwlan.com>
[cut out of bigger patch, keep swconfig, whitespace fixes]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Since we have a v2.1 (EU) with different partitioning now, rename
the v2.0 to make the difference visible to the user more directly.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This adds support for the TP-Link TL-WPA8630P (EU) in its v2.1
version. The only unique aspect for the firmware compared to v2
layout is the partition layout.
Note that while the EU version has different partitioning for
v2.0 and v2.1, the v2.1 (AU) is supported by the v2-int image.
If you plan to use this device, make sure you have a look at
the Wiki page to check whether the device is supported and
which image needs to be taken.
Specifications
--------------
- QCA9563 750MHz, 2.4GHz WiFi
- QCA9888 5GHz WiFi
- 8MiB SPI Flash
- 128MiB RAM
- 3 GBit Ports (QCA8337)
- PLC (QCA7550)
Installation
------------
Installation is possible from the OEM web interface. Make sure to
install the latest OEM firmware first, so that the PLC firmware is
at the latest version. However, please also check the Wiki page
for hints according to altered partitioning between OEM firmware
revisions.
Notes
-----
The OEM firmware has 0x620000 to 0x680000 unassigned, so we leave
this empty as well. It is complicated enough already ...
Signed-off-by: Joe Mullally <jwmullally@gmail.com>
[improve partitions, use v2 DTSI, add entry in 02_network, rewrite
and extend commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The tp-link safeloader devices typically contain a partition
"default-mac" which stores the MAC addresses. It is followed by other
partitions containing device info, like
{"default-mac", 0x610000, 0x00020},
{"pin", 0x610100, 0x00020},
{"product-info", 0x611100, 0x01000},
In DTS, we typically assign a 0x10000 sized partition for these,
which is mostly labelled "mac" or "info". In rarer cases, the
partitions have been enclosed in a larger "tplink" or "config"
partition.
However, when comparing different devices, the implementation appears
relatively arbitrary at the moment.
Thus, this PR aims at harmonizing these partitions by always using
the name "info" for the DTS partition containing "default-mac".
"info" is preferred over "mac" as we never just have "default-mac"
alone, but always some other device-info partitions as well.
While at it, this also establishes a similar partitioning for the
few devices where the "info" partitions are part of a bigger
unspecific "config" partition or similar.
Besides the harmonization itself, this also allows to merge a few
cases in 11-ath10k-caldata.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
TP-Link EAP225-Wall v2 is an AC1200 (802.11ac Wave-2) wall plate access
point. UART access and debricking require fine soldering.
The device was kindly provided for porting by Stijn Segers.
Device specifications:
* SoC: QCA9561 @ 775MHz
* RAM: 128MiB DDR2
* Flash: 16MiB SPI-NOR (GD25Q127CSIG)
* Wireless 2.4GHz (SoC): b/g/n, 2x2
* Wireless 5Ghz (QCA9886): a/n/ac, 2x2 MU-MIMO
* Ethernet (SoC): 4× 100Mbps
* Eth0 (back): 802.3af/at PoE in
* Eth1, Eth2 (bottom)
* Eth3 (bottom): PoE out (can be toggled by GPIO)
* One status LED
* Two buttons (both work as failsafe)
* LED button, implemented as KEY_BRIGHTNESS_TOGGLE
* Reset button
Flashing instructions, requires recent firmware (tested on 1.20.0):
* ssh into target device and run `cliclientd stopcs`
* Upgrade with factory image via web interface
Debricking:
* Serial port can be soldered on PCB J4 (1: TXD, 2: RXD, 3: GND, 4: VCC)
* Bridge unpopulated resistors R162 (TXD) and R165 (RXD)
Do NOT bridge R164
* Use 3.3V, 115200 baud, 8n1
* Interrupt bootloader by holding CTRL+B during boot
* tftp initramfs to flash via sysupgrade or LuCI web interface
MAC addresses:
MAC address (as on device label) is stored in device info partition at
an offset of 8 bytes. ath9k device has same address as ethernet, ath10k
uses address incremented by 1.
From OEM ifconfig:
br0 Link encap:Ethernet HWaddr 50:...:04
eth0 Link encap:Ethernet HWaddr 50:...:04
wifi0 Link encap:UNSPEC HWaddr 50-...-04-...
wifi1 Link encap:UNSPEC HWaddr 50-...-05-...
Signed-off-by: Sander Vanheule <sander@svanheule.net>
[fix IMAGE_SIZE]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
TP-Link EAP245 v3 is an AC1750 (802.11ac Wave-2) ceiling mount access
point. UART access (for debricking) requires non-trivial soldering.
Specifications:
* SoC: QCA9563 (CPU/DDR/AHB @ 775/650/258 MHz)
* RAM: 128MiB
* Flash: 16MiB SPI-NOR
* Wireless 2.4GHz (SoC): b/g/n 3x3
* Wireless 5GHz (QCA9982): a/n/ac 3x3 with MU-MIMO
* Ethernet (QCA8337N switch): 2× 1GbE, ETH1 (802.3at PoE) and ETH2
* Green and amber status LEDs
* Reset switch (GPIO, available for failsafe)
Flashing instructions:
All recent firmware versions (latest is 2.20.0), can disable firmware
signature verification and use a padded firmware file to flash OpenWrt:
* ssh into target device and run `cliclientd stopcs`
* upload factory image via web interface
The stopcs-method is supported from firmware version 2.3.0. Earlier
versions need to be upgraded to a newer stock version before flashing
OpenWrt.
Factory images for these devices are RSA signed by TP-Link. While the
signature verification can be disabled, the factory image still needs to
have a (fake) 1024 bit signature added to pass file checks.
Debricking instructions:
You can recover using u-boot via the serial port:
* Serial port is available from J3 (1:TX, 2:RX, 3:GND, 4:3.3V)
* Bridge R237 to connect RX, located next to J3
* Bridge R225 to connect TX, located inside can on back-side of board
* Serial port is 115200 baud, 8n1, interrupt u-boot by holding ctrl+B
* Upload initramfs with tftp and upgrade via OpenWrt
Device mac addresses:
Stock firmware has the same mac address for 2.4GHz wireless and
ethernet, 5GHz is incremented by one. The base mac address is stored in
the 'default-mac' partition (offset 0x90000) at an offset of 8 bytes.
ART blobs contain no mac addresses.
From OEM ifconfig:
ath0 Link encap:Ethernet HWaddr 74:..:E2
ath10 Link encap:Ethernet HWaddr 74:..:E3
br0 Link encap:Ethernet HWaddr 74:..:E2
eth0 Link encap:Ethernet HWaddr 74:..:E2
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Tested-by: Stijn Tintel <stijn@linux-ipv6.be>
The base address is used for the LAN and 2G WLAN interfaces.
5G WLAN interface is +1 and the PLC interface uses +2.
Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
[improve commit title, fix assignment in 11-ath10k-caldata]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
ALLNET ALL-WAP02860AC is a dual-band wireless access point.
Specification
SoC: Qualcomm Atheros QCA9558
RAM: 128 MB DDR2
Flash: 16 MB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
5 GHz 3T3R QCA9880 Mini PCIe card
Ethernet: 1x 10/100/1000 Mbps AR8035-A, PoE capable (802.3at)
LEDS: 5x, which four are GPIO controlled
Buttons: 1x GPIO controlled
UART: 4 pin header near Mini PCIe card, starting count from white
triangle on PCB
1. VCC 3.3V, 2. GND, 3. TX, 4. RX
baud: 115200, parity: none, flow control: none
MAC addresses
Calibration data does not contain valid MAC addresses.
The calculated MAC addresses are chosen in accordance with OEM firmware.
Because of:
a) constrained environment (SNMP) when connecting through Telnet
or SSH,
b) hard-coded kernel and rootfs sizes,
c) checksum verification of kerenel and rootfs images in bootloder,
creating factory image accepted by OEM web interface is difficult,
therefore, to install OpenWrt on this device UART connection is needed.
The teardown is simple, unscrew four screws to disassemble the casing,
plus two screws to separate mainboard from the casing.
Before flashing, be sure to have a copy of factory firmware, in case You
wish to revert to original firmware.
Installation
1. Prepare TFTP server with OpenWrt initramfs-kernel image.
2. Connect to LAN port.
3. Connect to UART port.
4. Power on the device and when prompted to stop autoboot, hit any key.
5. Alter U-Boot environment with following commands:
setenv failsafe_boot bootm 0x9f0a0000
saveenv
6. Adjust "ipaddr" and "serverip" addresses in U-Boot environment, use
'setenv' to do that, then run following commands:
tftpboot 0x81000000 <openwrt_initramfs-kernel_image_name>
bootm 0x81000000
7. Wait about 1 minute for OpenWrt to boot.
8. Transfer OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade -n /tmp/<openwrt_sysupgrade_image_name>
9. After flashing, the access point will reboot to OpenWrt. Wait few
minutes, until the Power LED stops blinking, then it's ready for
configuration.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
[add MAC address comment to commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This ports the TP-Link TL-WPA8630 v1 from ar71xx to ath79.
Specifications:
SoC: QCA9563
CPU: 750 MHz
Flash/RAM: 8 / 128 MiB
Ethernet: 3x 1G ports (QCA8337 switch)
WLAN: 2.4 GHz b/g/n, 5 GHz a/n/ac (ath10k)
Buttons, LEDs and network setup appear to be almost identical
to the v2 revision.
Powerline interface is connected to switch port 5 (Label LAN4).
Installation:
No "fresh" device was available for testing the factory image.
It is not known whether flashing via OEM firmware GUI is possible
or not. A discussion from 2018 [1] about that indicates a few
adjustments are necessary, but it is not clear whether those
are already implemented with the TPLINK_HEADER_VERSION = 2 or not.
Note that for the TL-WPA8630P v1, the TPLINK_HWID needs to be
changed to 0x86310001 to allow factory flashing.
[1] https://forum.openwrt.org/t/solved-tl-wpa8630p-lede-does-not-install/8161/27
Recovery:
Recovery is only possible via serial.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Specifications:
SoC: Qualcomm Atheros QCA9557
RAM: 128 MB (Nanya NT5TU32M16EG-AC)
Flash: 16 MB (Macronix MX25L12845EMI-10G)
Ethernet: 5x 10/100/1000 (1x WAN, 4x LAN)
Wireless: QCA9557 2.4GHz (nbg), QCA9882 5GHz (ac)
USB: 2x USB 2.0 port
Buttons: 1x Reset
Switches: 1x Wifi
LEDs: 11 (Pwr, WAN, 4x LAN, 2x Wifi, 2x USB, WPS)
MAC addresses:
WAN *:3f uboot-env ethaddr + 3
LAN *:3e uboot-env ethaddr + 2
2.4GHz *:3c uboot-env ethaddr
5GHz *:3d uboot-env ethaddr + 1
The label contains all four MAC addresses, however the one without
increment is first, so this one is taken for label MAC address.
Notes:
The Wifi is controlled by an on/off button, i.e. has to be implemented
by a switch (EV_SW). Despite, it appears that GPIO_ACTIVE_HIGH needs
to be used, just like recently fixed for the NBG6716.
Both parameters have been wrong at ar71xx.
Flash Instructions:
At first the U-Boot variables need to be changed in order to boot the
new combined image format. ZyXEL uses a split kernel + root setup and
the current kernel is too large to fit into the partition. As resizing
didnt do the trick, I've decided to use the prefered combined image
approach to be future-kernel-enlargement-proof (thanks to blocktrron for
the assistance).
First add a new variable called boot_openwrt:
setenv boot_openwrt bootm 0x9F120000
After that overwrite the bootcmd and save the environment:
setenv bootcmd run boot_openwrt
saveenv
After that you can flash the openwrt factory image via TFTP. The servers
IP has to be 192.168.1.33. Connect to one of the LAN ports and hold the
WPS Button while booting. After a few seconds the NBG6616 will look for
a image file called 'ras.bin' and flash it.
Return to vendor firmware is possible by resetting the bootcmd:
setenv bootcmd run boot_flash
saveenv
and flashing the vendor image via the TFTP method as described above.
Accessing the U-Boot Shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
| NBG6616> ?
| ATEN x,(y) set BootExtension Debug Flag (y=password)
| ATSE x show the seed of password generator
| ATSH dump manufacturer related data in ROM
| ATRT (x,y,z,u) ATRT RAM read/write test (x=level, y=start addr, z=end addr, u=iterations
| ATGO boot up whole system
| ATUR x upgrade RAS image (filename)
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
| NBG6616> ATSE NBG6616
| 00C91D7EAC3C
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
| # bash ./tool.sh 00C91D7EAC3C
| ATEN 1,10FDFF5
Copy and paste the result into the shell to unlock zloader.
| NBG6616> ATEN 1,10FDFF5
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
| NBG6616> ATGU
| NBG6616#
Signed-off-by: Christoph Krapp <achterin@googlemail.com>
[move keys to DTSI, adjust usb_power DT label, remove kernel config
change, extend commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The TL-WPA8630P v2 is a HomePlug AV2 compatible device with a QCA9563 SoC
and 2.4GHz and 5GHz WiFi modules.
Specifications
--------------
- QCA9563 750MHz, 2.4GHz WiFi
- QCA9888 5GHz WiFi
- 8MiB SPI Flash
- 128MiB RAM
- 3 GBit Ports (QCA8337)
- PLC (QCA7550)
MAC address assignment
----------------------
WiFi 2.4GHz and LAN share the same MAC address as printed on the label.
5GHz WiFi uses LAN-1, based on assumptions from similar devices.
LAN Port assignment
-------------------
While there are 3 physical LAN ports on the device, there will be 4
visible ports in OpenWrt. The fourth port (internal port 5) is used
by the PowerLine Communication SoC and thus treated like a regular
LAN port.
Versions
--------
Note that both TL-WPA8630 and TL-WPA8630P, as well as the different
country-versions, differ in partitioning, and therefore shouldn't be
cross-flashed.
This adds support for the two known partitioning variants of the
TL-WPA8630P, where the variants can be safely distinguished via the
tplink-safeloader SupportList. For the non-P variants (TL-WPA8630),
at least two additional partitioning schemes exist, and the same
SupportList entry can have different partitioning.
Thus, we don't support those officially (yet).
Also note that the P version for Germany (DE) requires the international
image version, but is properly protected by SupportList.
In any case, please check the OpenWrt Wiki pages for the device
before flashing anything!
Installation
------------
Installation is possible from the OEM web interface. Make sure to
install the latest OEM firmware first, so that the PLC firmware is
at the latest version. However, please also check the Wiki page
for hints according to altered partitioning between OEM firmware
revisions.
Additional thanks to Jon Davies and Joe Mullally for bringing
order into the partitioning mess.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
[minor DTS adjustments, add label-mac-device, drop chosen, move
common partitions to DTSI, rename de to int, add AU support strings,
adjust TPLINK_BOARD_ID, create common node in generic-tp-link.mk,
adjust commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This commit adds support for the AVM FRITZ!WLAN Repeater DVB-C
SOC: Qualcomm Atheros QCA9556
RAM: 64 MiB
FLASH: 16 MB SPI-NOR
WLAN: QCA9556 3T3R 2.4 GHZ b/g/n and
QCA9880 3T3R 5 GHz n/ac
ETH: Atheros AR8033 1000 Base-T
DVB-C: EM28174 with MaxLinear MXL251 tuner
BTN: WPS Button
LED: Power, WLAN, TV, RSSI0-4
Tested and working:
- Ethernet (correct MAC, gigabit, iperf3 about 200 Mbit/s)
- 2.4 GHz Wi-Fi (correct MAC)
- 5 GHz Wi-Fi (correct MAC)
- WPS Button (tested using wifitoggle)
- LEDs
- Installation via EVA bootloader (FTP recovery)
- OpenWrt sysupgrade (both CLI and LuCI)
- Download of "urlader" (mtd0)
Not working:
- Internal USB
- DVB-C em28174+MxL251 (depends on internal USB)
Installation via EVA bootloader (FTP recovery):
Set NIC to 192.168.178.3/24 gateway 192.168.178.1 and power on the device,
connect to 192.168.178.1 through FTP and sign in with adam2/adam2:
ftp> quote USER adam2
ftp> quote PASS adam2
ftp> binary
ftp> debug
ftp> passive
ftp> quote MEDIA FLSH
ftp> put openwrt-sysupgrade.bin mtd1
Wait for "Transfer complete" together with the transfer details.
Wait two minutes to make sure flash is complete (just to be safe).
Then restart the device (power off and on) to boot into OpenWrt.
Revert your NIC settings to reach OpenWrt at 192.168.1.1
Signed-off-by: Natalie Kagelmacher <nataliek@pm.me>
[fixed sorting - removed change to other board -
prettified commit message]
Signed-off-by: David Bauer <mail@david-bauer.net>
Hardware:
* SoC: Qualcomm Atheros QCA9558
* RAM: 256MB
* Flash: 16MB SPI NOR
* Ethernet: 2x 10/100/1000 (1x 802.3at PoE-PD)
* WiFi 2.4GHz: Qualcomm Atheros QCA9558
* WiFi 5GHz: Qualcomm Ahteros QCA9880-2R4E
* LEDS: 1x 5GHz, 1x 2.4GHz, 1x LAN1(POE), 1x LAN2, 1x POWER
* Buttons: 1x RESET
* UART: 1x RJ45 RS-232 Console port
Installation via stock firmware:
* Install the factory image via the stock firmware web interface
Installation via bootloader Emergency Web Server:
* Connect your PC to the LAN1(PoE) port
* Configure your PC with IP address 192.168.0.90
* Open a serial console to the Console port (115200,8n1)
* Press "q" within 2s when "press 'q' to stop autoboot" appears
* Open http://192.168.0.50 in a browser
* Upload either the factory or the sysupgrade image
* Once you see "write image into flash...OK,dest addr=0x9f070000" you
can power-cycle the device. Ignore "checksum bad" messages.
Setting the MAC addresses for the ethernet interfaces via
/etc/board.d/02_network adds the following snippets to
/etc/config/network:
config device 'lan_eth0_1_dev'
option name 'eth0.1'
option macaddr 'xx:xx:xx:xx:xx:xx'
config device 'wan_eth1_2_dev'
option name 'eth1.2'
option macaddr 'xx:xx:xx:xx:xx:xx'
This would result in the proper MAC addresses being set for the VLAN
subinterfaces, but the parent interfaces would still have a random MAC
address. Using untagged VLANs could solve this, but would still leave
those extra snippets in /etc/config/network, and then the device VLAN
setup would differ from the one used in ar71xx. Therefore, the MAC
addresses of the ethernet interfaces are being set via preinit instead.
The bdcfg partition contains 4 MAC address labels:
- lanmac
- wanmac
- wlanmac
- wlanmac_a
The first 3 all contain the same MAC address, which is also the one on
the label.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
TP-Link RE450 v3 is a dual band router/range-extender based on
Qualcomm/Atheros QCA9563 + QCA9880.
This device is nearly identical to RE450 v2 besides a modified flash
layout (hence I think force-flashing a RE450v2 image will lead to at
least loss of MAC address).
Specification:
- 775 MHz CPU
- 64 MB of RAM (DDR2)
- 8 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 3T3R 5 GHz
- 1x 10/100/1000 Mbps Ethernet (AR8033 PHY)
- 7x LED, 4x button-
- possible UART header on PCB¹
Flash instruction:
Apply factory image in OEM firmware web-gui.
¹ Didn't check to connect as I didn't even manage to connect on
RE450v2 (AFAIU it requires disconnecting some resistors, which I was
too much of a coward to do). But given the similarities to v2 I
think it's the same or very similar procedure (and most likely also
the only way to debrick).
Signed-off-by: Andreas Wiese <aw-openwrt@meterriblecrew.net>
[remove dts-v1 and compatible in DTSI]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The Ubiquiti PowerBeam 5AC Gen 2 (PBE-5AC-Gen2) is an outdoor 802.11ac
5 GHz bridge with a radio feed and a dish antenna. The device is
hardware-compatible with the LiteBeam AC Gen2, plus the 4 extra LEDs.
Specifications:
- SoC: Qualcomm Atheros AR9342 rev 2
- RAM: 64 MB DDR2
- Flash: 16 MB SPI NOR (mx25l12805d)
- Ethernet: 1x 10/100/1000 Mbps Atheros 8035, 24 Vdc PoE-in
- WiFi 5 GHz: QCA988x HW2.0 Ubiquiti target 0x4100016c chip_id 0x043222ff
- WiFi 2.4 GHz: Atheros AR9340 (SoC-based)
- Buttons: 1x (reset)
- LEDs: 1x power, 1x Ethernet, 4x RSSI via GPIO. All blue.
- UART: not tested
Installation from stock airOS firmware:
- Follow instructions for WA-type Ubiquiti devices on OpenWrt wiki
Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
[changed device name in commit title]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This commit adds support for the AVM Fritz!WLAN Repeater 1750E
SOC: Qualcomm QCA9556 (Scorpion) 720MHz MIPS74Kc
RAM: 64MB Zentel A3R12E40CBF DDR2
FLASH: 16MiB Winbond W25Q128 SPI NOR
WLAN1: QCA9556 2.4 GHz 802.11b/g/n 3x3
WLAN2: QCA9880 5 GHz 802.11 n/ac 3x3
INPUT: WPS button
LED: Power, WiFi, LAN, RSSI indicator
Serial: Header Next to Black metal shield
Pinout is 3.3V - RX - TX - GND (Square Pad is 3.3V)
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet
- 2.4 GHz WiFi (correct MAC)
- 5 GHz WiFi (correct MAC)
- Installation via EVA bootloader
- OpenWRT sysupgrade
- Buttons
- LEDs
Installation via EVA:
In the first seconds after Power is connected, the bootloader will
listen for FTP connections on 192.168.178.1. Firmware can be uploaded
like following:
ftp> quote USER adam2
ftp> quote PASS adam2
ftp> binary
ftp> debug
ftp> passive
ftp> quote MEDIA FLSH
ftp> put openwrt-sysupgrade.bin mtd1
Note that this procedure might take up to two minutes.
You need to powercycle the Device afterwards to boot OpenWRT.
Signed-off-by: David Bauer <mail@david-bauer.net>
Specifications:
- Qualcomm QCA9531 + QCA9886
- dual band, antenna 2*3dBi
- Output power 50mW (17dBm)
- 1x 10/100 Mbps LAN RJ45
- 128 MB RAM / 16 MB FLASH (w25q128)
- 3 LEDs (red/green/blue)
incorporated in
"color wheel reset switch"
- UART 115200 8N1
Flashing instructions:
The U-boot bootloader contains a recovery HTTP server
to upload the firmware. Push the reset button while powering the
device on and keep it pressed for ~10 seconds. The device's LEDs will
blink several times and the recovery page will be at
http://192.168.1.1; use it to upload the sysupgrade image.
Alternatively, the original firmware is based on OpenWrt so a
sysupgrade image can be installed via the stock web GUI. Settings from
the original firmware will be saved and restored on the new one, so a
factory reset will be needed. To do so, once the new firmware is flashed,
enter into failsafe mode by pressing the reset button several times during
the boot process, until it starts flashing. Once in failsafe mode, perform
a factory reset as usual.
LED-Info:
The LEDs on the Comfast stock fw have a very proprietary behaviour,
corresponding to the user selected working mode (AP, ROUTER or REPEATER).
In the first two cases, only blue is used for status and LAN signaling. When
using the latter, blue is always off (except for sysupgrade), either red
signals bad rssi on master-link, or green good. Since the default working
mode of OpenWrt resembles that of a router/AP, the default behavior is
implemented accordingly.
MAC addresses (art partition):
location address (example) use in vendor firmware
0x0 xx:xx:xx:xx:xc:f8 -> eth0
0x6 xx:xx:xx:xx:xc:fa -> wlan5g (+2)
0x1002 xx:xx:xx:xx:xc:f9 -> not used
0x5006 xx:xx:xx:xx:xc:fb -> not used
--- xx:xx:xx:xx:xd:02 -> wlan2g (+10)
The same strange situation has already been observed and documented
for COMFAST CF-E560AC.
Signed-off-by: Roman Hampel <rhamp@arcor.de>
Co-developed-by: Joao Albuquerque <joaohccalbu@gmail.com>
Signed-off-by: Joao Albuquerque <joaohccalbu@gmail.com>
[adjust and extend commit message, rebase, minor DTS adjustments,
add correct MAC address for wmac, change RSSI LED names and behavior]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Specifications:
Qualcomm/Atheros QCA9531 + QCA9886
2x 10/100 Mbps Ethernet, with 48v PoE
2T2R 2.4 GHz, 802.11b/g/n
2T2R 5 GHz, 802.11a/n/ac
128MB RAM
16MB SPI Flash
4x LED (Always On Power, LAN, WAN, WLAN)
Flashing Instructions:
Original firmware is based on OpenWRT, so flashing the sysupgrade image on
the factory firmware is sufficient.
Tested: Reset button, WAN LED, LAN LED, Power LED (always on, not much
to test), WLAN LED (one LED only for 2 interfaces, by default it gets
assigned to the first interface), MAC addresses (match factory firmware).
My LAN factory MAC address ends in F2.
use stock_mac art_loc
lan :f2 0x0
wan :f3 0x1002
5g :f4 0x6
2g :f5 0x5006
Since MAC address flash locations do not really match their use in vendor
firmware (e.g. address from 5 GHz calibration data is assigned to 2.4 GHz
WiFi), just calculate the MAC addresses with an offset based on 0x0 address.
Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
[add MAC address comment]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
TP-Link Archer D7 v1 is a dual-band AC1750 router + modem.
The router section is based on Qualcomm/Atheros QCA9558 + QCA9880.
The "DSL" section is based on BCM6318 but it's currently not supported.
The Archer D7b seems to differ from the Archer D7 only in the
partition table.
Router section - Specification:
775/650/258 MHz (CPU/DDR/AHB)
128 MB of RAM (DDR2)
16 MB of FLASH (SPI NOR)
3T3R 2.4 GHz
3T3R 5 GHz
4x 10/100/1000 Mbps Ethernet
7x LED, 2x button
UART header on PCB
Known issues:
- Broadband LED (missing GPIO - probably driven by the BCM6318)
- Internet LED (missing GPIO - probably driven by the BCM6318)
- WIFI LED (working only for one interface at a time, while in the
OEM firmware works for both wifi interfaces; thus, this patch does
not set a trigger by default)
- DSL not working (eth0)
UART connection
---------------
J1 HEADER (Qualcomm CPU)
. VCC
. GND
. RX
O TX
J41 HEADER (Broadcom CPU)
. VCC
. GND
. RX
O TX
The following instructions require a connection to the J1 UART header
and are tested for the Archer D7 v1.
For the Archer D7b v1, names should be changed accordingly.
Flash instructions under U-Boot, using UART
------------------------------------------
1. Press "tpl" to stop autobooting and obtain U-Boot CLI access.
2. Setup ip addresses for U-Boot and your tftp server.
3. Issue below commands:
tftpboot 0x81000000 openwrt-ath79-generic-tplink_archer-d7-v1-squashfs-sysupgrade.bin
erase 0x9f020000 +f90000
cp.b 0x81000000 0x9f020000 0xf90000
reset
Initramfs instructions under U-Boot for testing, using UART
----------------------------------------------------------
1. Press "tpl" to stop autobooting and obtain U-Boot CLI access.
2. Setup ip addresses for U-Boot and your tftp server.
3. Issue below commands:
tftpboot 0x81000000 openwrt-ath79-generic-tplink_archer-d7-v1-initramfs-kernel.bin
bootm 0x81000000
4. Here you can backup the original firmware and/or flash the sysupgrade openwrt if you want
Restore the original firmware
-----------------------------
0. Backup every partition using the OpenWrt web interface
1. Download the OEM firmware from the TP-Link website
2. Extract the bin file in a folder (eg. Archer_D7v1_1.6.0_0.9.1_up_boot(160216)_2016-02-16_15.55.48.bin)
3. Remove the U-Boot and the Broadcom image part from the file.
Issue the following command:
dd if="Archer_D7v1_1.6.0_0.9.1_up_boot(160216)_2016-02-16_15.55.48.bin" of="Archer_D7v1_1.6.0_0.9.1_up_boot(160216)_2016-02-16_15.55.48.bin.mod" skip=257 bs=512 count=31872
4. Double check the .mod file size. It must be 16318464 bytes.
5. Flash it using the OpenWrt web interface. Force the update if needed.
WARNING: Remember to NOT keep settings.
5b. (Alternative to 5.) Flash it using the U-Boot and UART connection.
Issue below commands in the U-Boot:
tftpboot 0x81000000 Archer_D7v1_1.6.0_0.9.1_up_boot(160216)_2016-02-16_15.55.48.bin.mod
erase 0x9f020000 +f90000
cp.b 0x81000000 0x9f020000 0xf90000
reset
Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
[cosmetic DTS changes, remove TPLINK_HWREVADD := 0, do not use two
phyXtpt at once, add missing buttons, minor commit message adjustments]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
TP-Link Archer C60 v3 is a dual-band AC1350 router,
based on Qualcomm/Atheros QCA9561 + QCA9886.
It seems to be identical to the v2 revision, except that
it lacks a WPS LED and has different GPIO for amber WAN LED.
Specification:
- 775/650/258 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 2T2R 5 GHz
- 5x 10/100 Mbps Ethernet
- 6x LED, 2x button
- UART header on PCB
Flash instruction (WebUI):
Download *-factory.bin image and upload it via the firmwary upgrade
function of the stock firmware WebUI.
Flash instruction (TFTP):
1. Set PC to fixed IP address 192.168.0.66
2. Download *-factory.bin image and rename it to tp_recovery.bin
3. Start a tftp server with the file tp_recovery.bin in its root
directory
4. Turn off the router
5. Press and hold reset button
6. Turn on router with the reset button pressed and wait ~15 seconds
7. Release the reset button and after a short time the firmware should
be transferred from the tftp server
8. Wait ~30 second to complete recovery
While TFTP works for OpenWrt images, my device didn't accept the
only available official firmware "Archer C60(EU)_V3.0_190115.bin".
In contrast to earlier revisions (v2), the v3 contains the (same)
MAC address twice, once in 0x1fa08 and again in 0x1fb08.
While the partition-table on the device refers to the latter, the
firmware image contains a different partition-table for that region:
name device firmware
factory-boot 0x00000-0x1fb00 0x00000-0x1fa00
default-mac 0x1fb00-0x1fd00 0x1fa00-0x1fc00
pin 0x1fd00-0x1fe00 0x1fc00-0x1fd00
product-info 0x1fe00-0x1ff00 0x1fd00-0x1ff00
device-id 0x1ff00-0x20000 0x1ff00-0x20000
While the MAC address is present twice, other data like the PIN isn't,
so with the partitioning from the firmware image the PIN on the device
would actually be outside of its partition.
Consequently, the patch uses the MAC location from the device (which
is the same as for the v2).
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This commit creates the ath79/mikrotik subtarget in order to support
MikroTik devices based on Qualcomm Atheros MIPS SoCs.
MikroTik devices need a couple of specific features: the split MiNOR
firmware MTD format, which is not used by other devices, and the 4k
sector erase size on SPI NOR storage, which can not be added to the
ath79/generic and ath79/nand subtargets now.
Additionally, the commit moves the two MikroTik devices already in
the generic and nand subtargets to this new one.
Tested on the RB922 board and the wAP AC router.
Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
Sitecom WLR-8100 v1 002 (marketed as X8 AC1750) is a dual band wireless
router.
Specification:
- Qualcomm Atheros SoC QCA9558
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (Macronix MX25L12845EMI-10G - SPI NOR)
- 5x 10/100/1000 Mbps Ethernet
- 3T3R 2.4 GHz (QCA9558 WMAC)
- 3T3R 5.8 Ghz (QCA9880-BR4A)
- 1x USB 3.0 (Etron EJ168A)
- 1x USB 2.0
- 9x LEDs
- 2x GPIO buttons
Everything working.
Installation and restore procedure tested
Installation
1. Connect to one of LAN (yellow) ethernet ports,
2. Open router configuration interface,
3. Go to Toolbox > Firmware,
4. Browse for OpenWrt factory image with dlf extension and hit Apply,
5. Wait few minutes, after the Power LED will stop blinking, the router
is ready for configuration.
Restore OEM FW (Linux only)
1. Download OEM FW from website (tested with WLR-8100v1002-firmware-v27.dlf)
2. Compile the FW for this router and locate the "mksenaofw" tool
in build_dir/host/firmware-utils/bin/ inside the OpenWrt buildroot
3. Execute "mksenaofw -d WLR-8100v1002-firmware-v27.dlf -o WLR-8100v1002-firmware-v27.dlf.out" where:
WLR-8100v1002-firmware-v27.dlf is the path to the input file
(use the downloaded file)
WLR-8100v1002-firmware-v27.dlf.out is the path to the output file
(you can use the filename you want)
4. Flash the new WLR-8100v1002-firmware-v27.dlf.out file. WARNING: Do not keep settings.
Additional notes.
The original firmware has the following button configuration:
- Press for 2s the 2.4GHz button: WPS for 2.4GHz
- Press for 2s the 5GHz button: WPS for 5GHz
- Press for 15s both 2.4GHz and 5GHz buttons: Reset
I am not able to replicate this behaviour, so I used the following configuration:
- Press the 2.4GHz button: RFKILL (disable/enable every wireless interfaces)
- Press the 5GHz button: Reset
Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
This patch support Devolo Magic 2 WIFI, board devolo_dlan2-2400-ac.
This device is a plc wifi AC2400 router/extender with 2 Ethernet
ports, has a G.hn PLC and uses LCMP protocol from Home Grid Forum.
Hardware:
SoC: AR9344
CPU: 560 MHz
Flash: 16 MiB (W25Q128JVSIQ)
RAM: 128 MiB DDR2
Ethernet: 2xLAN 10/100/1000
PLC: 88LX5152 (MaxLinear G.hn)
PLC Flash: W25Q32JVSSIQ
PLC Uplink: 1Gbps MIMO
PLC Link: RGMII 1Gbps (WAN)
WiFi: Atheros AR9340 2.4GHz 802.11bgn
Atheros AR9882-BR4A 5GHz 802.11ac
Switch: QCA8337, Port0:CPU, Port2:PLC, Port3:LAN1, Port4:LAN2
Button: 3x Buttons (Reset, wifi and plc)
LED: 3x Leds (wifi, plc white, plc red)
GPIO Switch: 11-PLC Pairing (Active Low)
13-PLC Enable
21-WLAN power
MACs Details verified with the stock firmware:
Radio1: 2.4 GHz &wmac *:4c Art location: 0x1002
Radio0: 5.0 GHz &pcie *:4d Art location: 0x5006
Ethernet ðernet *:4e = 2.4 GHz + 2
PLC uplink --- *:4f = 2.4 GHz + 3
Label MAC address is from PLC uplink
OEM SSID: echo devolo-$(grep SerialNumber /dev/mtd1 | grep -o ...$)
OEM WiFi password: grep DlanSecurityID /dev/mtd1|tr -d -|cut -d'=' -f 2
Recommendations: Configure and link your PLC with OEM firmware
BEFORE you flash the device. PLC configuration/link should
remain in different memory and should work straight forward
after flashing.
Restrictions: PLC link detection to trigger plc red led is not
available. PLC G.hn chip is not compatible with open-plc-tools,
it uses LCMP protocol with AES-128 and requires different
software.
Notes: Pairing should be possible with gpio switch. Default
configuration will trigger wifi led with 2.4Ghz wifi traffic
and plc white led with wan traffic.
Flash instruction (TFTP):
1. Set PC to fixed ip address 192.168.0.100
2. Download the sysupgrade image and rename it to uploadfile
3. Start a tftp server with the image file in its root directory
4. Turn off the router
5. Press and hold Reset button
6. Turn on router with the reset button pressed and wait ~15 seconds
7. Release the reset button and after a short time
the firmware should be transferred from the tftp server
8. Allow 1-2 minutes for the first boot.
Signed-off-by: Manuel Giganto <mgigantoregistros@gmail.com>
This commit adds support for the COMFAST CF-E560AC, an ap143 based
in-wall access point.
Specifications:
- SoC: Qualcomm Atheros QCA9531
- RAM: 128 MB DDR2 (Winbond W971GG6SB-25)
- Storage: 16 MB NOR (Winbond 25Q128JVSO)
- WAN: 1x 10/100 PoE ethernet (48v)
- LAN: 4x 10/100 ethernet
- WLAN1: QCA9531 - 802.11b/g/n - 2x SKY85303-21 FEM
- WLAN2: QCA9886 - 802.11ac/n/a - 2x SKY85735-11 FEM
- USB: one external USB2.0 port
- UART: 3.3v, 2.54mm headers already populated on board
- LED: 7x external
- Button: 1x external
- Boot: U-Boot 1.1.4 (pepe2k/u-boot_mod)
MAC addressing:
- stock
LAN *:40 (label)
WAN *:41
5G *:42
2.4G *:4a
- flash (art partition)
0x0 *:40 (label)
0x6 *:42
0x1002 *:41
0x5006 *:43
This device contains valid MAC addresses in art 0x0, 0x6, 0x1002 and
0x5006, however the vendor firmware only reads from art:0x0 for the LAN
interface and then increments in 02_network. They also jump 8 addresses
for the second wifi interface (2.4 GHz). This behavior has been duplicated
in the DTS and ath10k hotplug to align addresses with the vendor firmware
v2.6.0.
Recovery instructions:
This device contains built-in u-boot tftp recovery.
1. Configure PC with static IP 192.168.1.10/24 and tftp server.
2. Place desired image at /firmware_auto.bin at tftp root.
3. Connect device to PC, and power on.
4. Device will fetch flash from tftp, flash and reboot into new image.
Signed-off-by: August Huber <auh@google.com>
[move jtag_disable_pins, remove unnecessary statuses in DTS, remove
duplicate entry in 11-ath10k-caldata, remove hub_port0 label in DTS]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This commit adds support for the MikroTik RouterBOARD wAP G-5HacT2HnD
(wAP AC), a small weatherproof dual band, dual-radio 802.11ac
wireless AP with integrated omnidirectional anntennae and one
10/100/1000 Mbps Ethernet port.
See https://mikrotik.com/product/RBwAPG-5HacT2HnD for more info.
Specifications:
- SoC: Qualcomm Atheros QCA9556
- RAM: 64 MB
- Storage: 16 MB NOR
- Wireless:
· Atheros AR9550 (SoC) 802.11b/g/n 2x2:2, 2 dBi antennae
· Qualcomm QCA9880 802.11a/n/ac 3x3:3, 2 dBi antennae
- Ethernet: Atheros AG71xx (SoC, AR8033), 1x 1000/100/10 port,
passive PoE in
Working:
- Board/system detection
- Sysupgrade
- Serial console
- Ethernet
- 2.4 GHz radio
- 5 GHz radio and LED
- Reset button
Not working/Unsupported:
- 2.4 GHz LED
- AP/CAP LED
- ZT2046Q SPI temperature and voltage sensor
This adds the basic features for supporting MikroTik devices:
- a common recipe for mikrotik images in common-mikrotik.mk
- support for minor (MikroTik NOR) split firmware (only for
generic subtarget so far)
Acknowledgments: Robert Marko <robimarko@gmail.com>
Andrew Cameron <apcameron@softhome.net>
Koen Vandeputte <koen.vandeputte@ncentric.com>
Chuanhong Guo <gch981213@gmail.com>
Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
Co-developed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
TP-Link TL-WR902AC v1 is a pocket-size, dual-band (AC750), successor of
TL-MR3020 (both devices use very similar enclosure, in same size). New
device is based on Qualcomm QCA9531 v2 + QCA9887. FCC ID: TE7WR902AC.
Specification:
- 650/391/216 MHz (CPU/DDR/AHB)
- 1x 10/100 Mbps Ethernet
- 1x USB 2.0 (GPIO-controlled power)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH
- 2T2R 2.4 GHz (QCA9531)
- 1T1R 5 GHz (QCA9887)
- 5x LED (GPIO-controlled), 2x button, 1x 3-pos switch
- UART pads on PCB (TP1 -> TX, TP2 -> RX, TP3 -> GND, TP4 -> 3V3, jumper
resitors are missing on TX/RX lines)
- 1x micro USB (for power only)
Flash instructions:
Use "factory" image under vendor GUI.
Recovery instructions:
This device contains tftp recovery mode inside U-Boot. You can use it to
flash OpenWrt (use "factory" image) or vendor firmware.
1. Configure PC with static IP 192.168.0.66/24 and tftp server.
2. Rename "openwrt-ath79-generic-tplink_tl-wr902ac-v1-squashfs-factory.bin"
to "wr902acv1_un_tp_recovery.bin" and place it in tftp server dir.
3. Connect PC with LAN port, press the reset button, power up the router
and keep button pressed until WPS LED lights up.
4. Router will download file from server, write it to flash and reboot.
MAC Address summary:
- wlan1 (2.4GHz Wi-Fi): Label MAC
- wlan0 (5GHz Wi-Fi): Offset -1 from label
- eth0 (Wired): Offset +1 from label
Root access over serial line in vendor firmware: root/sohoadmin.
Based on support in ar71xx target by: Piotr Dymacz <pepe2k@gmail.com>
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
[remove size-cells from gpio-export]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Hardware:
* SoC: Atheros AR9342-BL1A
* RAM: 64MB DDR2 (Winbond W9751G6KB-25)
* Flash: 16MB SPI NOR (Macronix MX25L12835FZ2I-10G)
* Ethernet: 1x 10/100/1000 Mbps (Atheros AR8035-A) with 24V PoE support
* Wifi 2.4GHz: Atheros AR9340 v2
* WiFi 5GHz: Ubiquiti U-AME-G1-BR4A (rebranded QCA988X v2)
* LEDs: 1x Power, 1x Ethernet
* Buttons: 1x Reset
* UART: 1x TTL 115200n8, 3.3V RX TX GND, 3.3V pin closest to RJ45 port
The LEDs do not seem to be connected to any GPIO, so there is currently
no way to control them.
Installation via U-Boot, TFTP and serial console:
* Configure your TFTP server with IP 192.168.1.254
* Connect serial console and power up the device
* Hit any key to stop autoboot
* tftpboot 0x81000000 openwrt-ath79-generic-ubnt_litebeam-ac-gen2-initramfs-kernel.bin
* bootm 0x81000000
* copy openwrt-ath79-generic-ubnt_litebeam-ac-gen2-squashfs-sysupgrade.bin
to /tmp
* sysupgrade /tmp/openwrt-ath79-generic-ubnt_litebeam-ac-gen2-squashfs-sysupgrade.bin
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Acked-by: Petr Štetiar <ynezz@true.cz>
Acked-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This patch is based on #1689 and adds support for TP-Link Archer
C6 v2 (US) and A6 (US/TW).
The hardware is the same as EU and RU variant, except for GPIOs
(LEDS/Buttons), flash(chip/partitions) and UART being available
on the board.
- SOC: Qualcomm QCA9563 @ 775MHz
- Flash: GigaDevice GD25Q127CS1G (16MiB)
- RAM: Zentel A3R1GE40JBF (128 MiB DDR2)
- Ethernet: Qualcomm QCA8337N: 4x 1Gbps LAN + 1x 1Gbps WAN
- Wireless:
- 2.4GHz (bgn) QCA9563 integrated (3x3)
- 5GHz (ac) Qualcomm QCA9886 (2x2)
- Button: 1x power, 1x reset, 1x wps
- LED: 6x LEDs: power, wlan2g, wlan5g, lan, wan, wps
- UART: 115200, 8n1 (header available on board)
Known issues:
- Wireless: 5GHz is known to have lower RSSI signal, it affects speed and range.
Flash instructions:
Upload openwrt-ath79-generic-tplink_archer-c6-v2-us-squashfs-factory.bin
via the router Web interface.
Flash instruction using tftp recovery:
1. Connect the computer to one of the LAN ports of the router
2. Set the computer IP to 192.168.0.66
3. Start a tftp server with the OpenWrt factory image in the
tftp root directory renamed to ArcherA6v2_tp_recovery.bin.
4. Connect power cable to router, press and hold the
reset button and turn the router on
5. Keep the reset button pressed until the WPS LED lights up
6. Wait ~150 seconds to complete flashing
Flash partitioning: I've followed #1689 for defining the partition layout
for this patch. The partition named as "tplink" @ 0xfd0000 is marked
as read only as it is where some config for stock firmware are stored.
On stock firmware those stock partitions starts at 0xfd9400 however
I had not been able to make it functional starting on the same address as
on stock fw, so it has been partitioned following #1689 and not the stock
partition layout for this specific partition. Due to that firmware/rootfs
partition lenght is 0xf80000 and not 0xf89400 as stock.
According to the GPL code, the EU/RU/JP variant does have different GPIO pins
assignment to LEDs and buttons, also the flash memory layout is different.
GPL Source Code: https://static.tp-link.com/resources/gpl/gpl-A6v2_us.tar.gz
Signed-off-by: Anderson Vulczak <andi@andi.com.br>
[wrap commit message, remove soft_ver change for C6 v2 EU, move LED aliases
to DTS files, remove dts-v1 in DTSI, node/property reorder in DTSI]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This renames all remaining occurrences of "EEPROM" to "art" to
further harmonize the partition labelling in ath79. This will
help to reduce the amount of user-space code and might be
beneficial when code is copy/pasted in the future.
Affected are only devices from Ubiquiti, where the XM board is
already using "art" in ath79.
Acked-by: Piotr Dymacz <pepe2k@gmail.com>
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
YunCore XD4200 ('XD4200_W6.0' marking on PCB) is Qualcomm/Atheros based
(QCA9563, QCA9886, QCA8334) dual-band, Wave-2 AC1200 ceiling AP with PoE
(802.3at) support. A782 model ('T750_V5.1' marking on PCB) is a smaller
version of the XD4200, with similar specification but lower TX power.
Specification:
- QCA9563 (775 MHz)
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 2x 10/100/1000 Mbps Ethernet (QCA8334), with 802.3at PoE support (WAN)
- Wi-Fi 2.4 GHz:
- XD4200: 2T2R (QCA9563), with ext. PA (SKY65174-21) and LNA
- A782: 2T2R (QCA9563), with ext. FEM (SKY85329-11)
- Wi-Fi 5 GHz:
- XD4200: 2T2R (QCA9886), with ext. FEM (SKY85728-11)
- A782: 2T2R (QCA9886), with ext. FEM (SKY85735-11)
- LEDs:
- XD4200: 5x (2x driven by SOC, 1x driven by AC radio, 2x Ethernet)
- A782: 3x (1x RGB, driven by SOC and radio, 2x Ethernet)
- 1x button (reset)
- 1x UART (4-pin, 2.54 mm pitch) header on PCB
- 1x DC jack (12 V)
Flash instructions:
If your device comes with generic QSDK based firmware, you can login
over telnet (login: root, empty password, default IP: 192.168.188.253),
issue first (important!) 'fw_setenv' command and then perform regular
upgrade, using 'sysupgrade -n -F ...' (you can use 'wget' to download
image to the device, SSH server is not available):
fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
sysupgrade -n -F openwrt-...-yuncore_...-squashfs-sysupgrade.bin
In case your device runs firmware with YunCore custom GUI, you can use
U-Boot recovery mode:
1. Set a static IP 192.168.0.141/24 on PC and start TFTP server with
'tftp' image renamed to 'upgrade.bin'
2. Power the device with reset button pressed and release it after 5-7
seconds, recovery mode should start downloading image from server
(unfortunately, there is no visible indication that recovery got
enabled - in case of problems check TFTP server logs)
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
The GL.iNet GL-AR750S has been supported by the ar71xx and ath79
platforms with access to its 16 MB NOR flash, but not its 128 MB
SPI NAND flash.
This commit provides support for the NAND through the upstream
SPI-NAND framework.
At this time, the OEM U-Boot appears to only support loading the
kernel from NOR. This configuration is preserved as this time,
with the glinet,gl-ar750s-nand name reserved for a potential,
future, NAND-only boot.
The family of GL-AR750S devices on the ath79 platform now includes:
* glinet,gl-ar750m-nor-nand "nand" target
* glinet,gl-ar750m-nor "nand" target (NAND-aware)
NB: This commit increases the kernel size from 2 MB to 4 MB
"Force-less" sysupgrade is presently supported from the current
versions of following NOR-based firmwre images to the version of
glinet,gl-ar750s-nor firmware produced by this commit:
* glinet,gl-ar750s -- OpenWrt 19.07 ar71xx
* glinet,gl-ar750s -- OpenWrt 19.07 ath79
Users who have sucessfully upgraded to glinet,gl-ar750m-nor may then
flash glinet,gl-ar750m-nor-nand with sysupgrade to transtion to the
NAND-based variant.
Other upgrades to these images, including directly to the NAND-based
glinet,gl-ar750s-nor-nand firmware, can be accomplished through U-Boot.
NB: See "ath79: restrict GL-AR750S kernel build-size to 2 MB" which
enables flashing of NAND factory.img with the current GL-iNet U-Boot,
"U-Boot 1.1.4-gcf378d80-dirty (Aug 16 2018 - 07:51:15)"
The GL-AR750S OEM U-Boot allows upload and flashing of either NOR
firmware (sysupgrade.bin) or NAND firmware (factory.img) through its
HTTP-based GUI. Serial connectivity is not required.
The glinet,gl-ar750s-nor and glinet,gl-ar750s-nor-nand images
generated after this commit flash each other directly.
This commit changes the control of the USB VBUS to gpio-hog from
regulator-fixed introduced by commit 0f6b944c92. This reduces the
compressed kernel size by ~14 kB, with no apparent loss of
functionality. No other ath79-nand boards are using regulator-fixed
at this time.
Note: mtd_get_mac_binary art 0x5006 does not return the proper MAC
and the GL.iNet source indicates that only the 0x0 offset is valid
The ar71xx targets are unmodified.
Cc: Alexander Wördekemper <alexwoerde@web.de>
Signed-off-by: Jeff Kletsky <git-commits@allycomm.com>
Due to rebase of the base-files split patch after adding support
for the ZyXEL NBG6716, its base-files were added to the generic
subtarget, although the device belongs to the nand subtarget.
This moves the definitions to their proper locations.
Fixes: 0130022bae ("ath79: split base-files into subtargets")
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
[improve commit message, rebase]
Signed-off-by: David Bauer <mail@david-bauer.net>
While most of the target's contents are split into subtargets, the
base-files are maintained for the target as a whole.
However, OpenWrt already implements a mechanism that will use (and
even prefer) files in the subtargets' directories. This can be
exploited to make several scripts subtarget-specific and thus save
some space (especially helpful for the tiny devices).
The only script remaining in parent base-files is
/etc/hotplug.d/ieee80211/00-wifi-migration, everything else is
moved/split.
Note that this will increase overall code lines, but reduce code
per subtarget.
base-files ipk size reduction:
master (generic) 49135 B
split (generic) 48533 B (- 0.6 kiB)
split (tiny) 43337 B (- 5.7 kiB)
split (nand) 44423 B (- 4.6 kiB)
Tested on TL-WR1043ND v4 (generic) and TL-WR841N v12 (tiny).
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2019-10-27 14:24:22 +01:00
Renamed from target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata (Browse further)
