Move FIP handling to target now that we compile ATF. This is to have always
in sync new ATF and new U-Boot if one of the 2 is already compiled.
Also add HIDDEN ops to enable autoselection of the U-Boot for the required
target. This is needed to prevent user to deselect the U-Boot package
causing failure on ARTIFACTS generation.
Drop precompiled BL2 and BL31 as they can be now compiled from source.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24257
Signed-off-by: Robert Marko <robimarko@gmail.com>
Add support for compiling Airoha ATF, based on a modified version of the
TF-A based on 2.10.
The package will clone the base TF-A and apply the modified source and
pre-compiled objects (DDR calibration, eFUSE handling, TX/RX path...) to
correctly compile.
An helper script is added to implement the same format used for special BL2
handling. BL2 is composed of 3 sub-phase with a initial BL21, a BL22 that
loads a LZMA decompressor and BL23 that actually calibrate and loads BL31
ATF.
Also a special flash_table is used to handle SPI-NAND externally to the
BL2, a special Host target is added for that.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24257
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit adds support for Teralink TL3020 256mb wireless router.
Specification
-------------
- SoC : MediaTek MT7981B dual-core ARM Cortex-A53
- RAM : DDR3 256 MiB (ESMT M15T2G16128A, DDR3-1866)
- Flash : SPI-NAND 256 MiB (Winbond W25M02GV)
- WLAN : MediaTek MT7976 2.4/5 GHz Wi-Fi 6
- Ethernet : MediaTek MT7531 switch, 1x WAN + 3x LAN 10/100/1000 Mbps
(2.5GbE uplink via gmac0)
- USB : 1x USB 2.0 Type-A (power enable on GPIO 14)
- Buttons : WPS, Reset
- LEDs : 7x blue, 1x red
- UART : 4-pin header on PCB
- assignment : 3.3V, GND, TX, RX
- settings : 115200n8
- Power : 12 VDC, 1.5 A (barrel jack)
MAC addresses
-------------
EEPROM MAC is same for all the devices, but there is a `config2` partition
with unique MAC addresses:
| Interface | MAC source |
|-----------|--------------------------------------------|
| LAN | config2, offset 0x707 (ASCII, "lanmac") |
| WAN | config2, offset 0x787 (ASCII, "wanmac") |
| WLAN 2.4G | config2, offset 0x68a (ASCII, "wifi2gmac") |
| WLAN 5G | config2, offset 0x60a (ASCII, "wifi5gmac") |
The LAN MAC (gmac0) is the one printed on the device label.
Installation
------------
Factory bootloader is locked to 64mb partition layout, so OpenWrt U-Boot
has to be flashed first. Steps 1, 2 and 4 are run from a shell on the
stock firmware, where the 'bl2' and 'fip' partitions are writable - in
OpenWrt they are read-only, so the procedure cannot be repeated from
OpenWrt. Back up both partitions before overwriting them:
mtd read bl2 /tmp/bl2.bin
mtd read fip /tmp/fip.bin
1. Upload OpenWrt 'bl31-uboot.fip' and 'preloader.bin' images to the /tmp
dir of the router using scp protocol
2. Write fip and bl2 (replace bootloader):
mtd write /tmp/openwrt-mediatek-filogic-teralink_tl3020-256mb-bl31-uboot.fip fip
mtd write /tmp/openwrt-mediatek-filogic-teralink_tl3020-256mb-preloader.bin bl2
3. Place OpenWrt
'openwrt-mediatek-filogic-teralink_tl3020-256mb-initramfs-recovery.itb'
image on the tftp server (IP: 192.168.1.254)
4. Erase 'ubi' partition and reboot the router:
mtd erase ubi
reboot
5. U-Boot automatically boots the OpenWrt recovery image from the tftp
server to the RAM
6. Upload OpenWrt
'openwrt-mediatek-filogic-teralink_tl3020-256mb-squashfs-sysupgrade.itb'
image to the /tmp dir of the router (IP: 192.168.1.1) using scp
protocol
7. Connect to the router using ssh and run:
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
sysupgrade -n openwrt-mediatek-filogic-teralink_tl3020-256mb-squashfs-sysupgrade.itb
Recovery
--------
1. Place OpenWrt
'openwrt-mediatek-filogic-teralink_tl3020-256mb-initramfs-recovery.itb'
image on the tftp server (IP: 192.168.1.254)
2. Press "Reset" button and power on the router. After ~10 sec release
the button.
3. Use OpenWrt initramfs system for recovery
Reverting to stock firmware requires writing the 'bl2' and 'fip' backups
taken above back with 'mtd write', then flashing the stock image; without
those backups there is no way back, because the stock bootloader cannot
be downloaded from the vendor.
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24518
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The Comfast CF-WA933[1] is an outdoor dual-band WiFi 6 access
point/router. They also OEM their routers for other providers. This PR
adds support based on, and substantially updates, the downstream device
definition[2] from Wayru, one such white label client.
It can be powered by a 12V DC barrel jack (standard 5.5x2.5mm, center
positive) or via 802.3af POE.
Hardware summary:
- SoC: MediaTek MT7981A
- RAM: 256 MiB
- Flash: SPI-NAND 128 MiB (Factory uses 64M; see details below to use
the full 128M!)
- WiFi (MT7976DA): dual-band 802.11ax
- Ethernet (MT7531AE): 3x gigabit: 1x WAN + 2x LAN (labeled lan1/lan2).
- Button: reset
- LEDs: Power (always on), WLAN, WAN, LAN1, LAN2
- Serial: Internal header (Four unpopulated headers, clearly labeled)
MAC addresses on the tested unit:
- Label: 40:a5:ef:f0:5e:0f
- LAN: 40:a5:ef:f0:5e:0f Factory 0xe000
- WAN: 40:a5:ef:f0:5e:10 Factory 0xe000 + 1
- 2.4 GHz: 40:a5:ef:f0:5e:11 Factory 0x0004
- 5 GHz: 40:a5:ef:f0:5e:13 Factory 0x8000 + 1
The serial number is stored as an ASCII string at Factory 0xe100.
Disassembly:
Unscrew the six 3mm hex bolts on the dome and the six 5mm bolts on the
side of the arm, then lift the dome. For reassembly, make sure the large
O ring is in the groove in the dome.
OpenWrt installation:
1. Connect to Ethernet on the WAN port. Manually set your IP address to
192.168.1.10 (important!)
2. Upload the OpenWrt sysupgrade image at http://192.168.1.1
The default U-Boot partition layout does not expose the full flash
capacity. Change the mtdparts U-Boot environment variable before
rebooting and then installing the image for the 128 MiB variant through
the same bootloader recovery/upgrade page.
Method 1: Using the serial console
1. Disassemble the unit and connect to the serial console (115200 8N1).
Leave 3.3V disconnected.
2. On the boot loader, go straight to "0. U-Boot console"
3. Then enter:
setenv mtdparts 'nmbm0:1024k(bl2),512k(u-boot-env),2048k(factory),2048k(fip),117248k(ubi)'
saveenv
reset
Method 2: From OpenWrt using uboot-envtools
apk add uboot-envtools
fw_setenv mtdparts 'nmbm0:1024k(bl2),512k(u-boot-env),2048k(factory),2048k(fip),117248k(ubi)'
reboot
Return to vendor firmware:
1. If you have changed the mtdparts environment variable, undo the
change by setting:
mtdparts 'nmbm0:1024k(bl2),512k(u-boot-env),2048k(factory),2048k(fip),65536k(ubi)'
2. Re-enter the same bootloader recovery/upgrade page.
3. Upload a stock COMFAST firmware image, e.g. from
http://www.comfast.com.cn/index.php?m=content&c=index&a=show&catid=85&id=773
[1]: https://comfastgroup.com/product/cf-wa933/
[2]: https://github.com/Wayru-Network/wayru-os/tree/main/profiles/prometheus
Signed-off-by: Guillaume RISCHARD <git@stereo.lu>
Link: https://github.com/openwrt/openwrt/pull/22379
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
netis N6 V2 is a MT7981B-based router, hardware-compatible with
netis NX32U (confirmed via bootloader cross-flash). GPIO mappings
not covered by the vendor DTS were verified against NX32U and via
live link/carrier testing on switch ports, plus direct LED-toggle
confirmation on the physical device.
Hardware:
SoC: MediaTek MT7981B (Filogic 820)
RAM: 256 MiB DDR3 (ESMT M15T2G16128A-AZR1-EFB, DDR3-1866)
Flash: 128 MiB SPI-NAND
Ethernet: 4x 1GbE (mt7531 switch: wan, lan1, lan2, lan3),
2.5GbE internal CPU-switch link (gmac0, 2500base-x)
WiFi: MT7981 integrated 2.4GHz + MT7976C 5GHz radio,
802.11ax, 2x2 MU-MIMO, HE160 supported (confirmed live;
vendor firmware ships with HE80 for the AX1800 rating)
USB: 1x USB 3.0 (vbus GPIO 23, active high)
Buttons: mesh/rfkill (GPIO 0), reset (GPIO 1)
LEDs: power (GPIO 4), status (GPIO 5), wan (GPIO 9),
wlan 2.4GHz (GPIO 34, phy0tpt trigger),
wlan 5GHz (GPIO 35, phy1tpt trigger),
usb (GPIO 13, usbport trigger)
all active low
UART: 115200n8, uart0
MAC addresses:
Interface | Source | Offset | Address (this unit)
------------|------------------|----------|--------------------
WAN | Factory mac-base | 0x1fef26 | 30:07:5c:dc:7a:d2
LAN/CPU | Factory mac-base | 0x1fef20 | 30:07:5c:dc:7a:d0 (label)
WiFi 2.4GHz | radio calibration (auto) | 30:07:5c:dc:7a:d1
WiFi 5GHz | radio calibration (auto) | b2:07:5c:dc:7a:d1
LAN address matches the label on the device enclosure. WAN uses
macaddr_factory_1fef26 on switch port@0, LAN/CPU uses
macaddr_factory_1fef20 on port@6 (mt7531 switch). WiFi MACs are not
set explicitly in DTS -- mt76 derives them from the radio's own
calibration data, confirmed live to match the stock firmware value.
The USB LED (GPIO 13) was missed in the initial GPIO mapping pass --
it isn't referenced anywhere in the vendor DTS or any other board
signal, so it went unnoticed until manual GPIO toggling (`gpio clear
13` at the U-Boot prompt) confirmed it live on the physical device.
The USB LED on GPIO 13 uses the usbport trigger with trigger-sources
on both xhci ports, hence kmod-usb-ledtrig-usbport in DEVICE_PACKAGES.
The included U-Boot defenv for this board also avoids a silent
failure in ubi_write_production/ubi_write_recovery: these call
`ubi remove <vol>` without first detaching/reattaching the UBI
device, which fails silently on a busy volume while the boot script
proceeds as if it succeeded. Worked around here by adding
`ubi detach ; ubi part ubi ;` before the remove, a pattern already
used in other boards' defenvs (see issue #18231). Only this board's
defenv is touched -- other boards' defenv files are unchanged.
Known upstream issue (not specific to this port): probing
u-boot-env-layout on the ubootenv/ubootenv2 UBI volumes logs
"Invalid calculated CRC32" on every boot, see mediatek/filogic
issues #21876 and #22383.
Installation:
Requires network access to stock firmware SSH (enabled by default)
and a TFTP server on the same subnet.
1. Set up a TFTP server on your PC at 192.168.1.254, serving the
files from this release.
2. SSH into stock firmware: ssh root@192.168.1.1
3. Copy bl31-uboot.fip to the router and write it to the FIP
partition: mtd write bl31-uboot.fip FIP
4. Erase the ubi partition: mtd erase ubi
5. Reboot. The new bootloader will detect the missing production
image and automatically fetch initramfs-recovery.itb via TFTP.
6. Once recovery has booted, SSH in again and sysupgrade to the
production image: sysupgrade squashfs-sysupgrade.itb
Signed-off-by: Murad Rabadanov <the21.21@mail.ru>
Link: https://github.com/openwrt/openwrt/pull/24089
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The an7581/an7583 configs enable redundant environment support,
but do not define CONFIG_ENV_OFFSET_REDUND.
When running `saveenv`, U-Boot tries to write the redundant environment
to MMC. Without a valid redundant environment offset, the data may be
written to an incorrect location and overwrite critical boot data such
as the GPT, BL2/preloader or BL31+U-Boot FIP.
This causes the board to fail booting after saving the environment.
Define CONFIG_ENV_OFFSET_REDUND so the redundant environment is stored
at a valid eMMC offset and no longer corrupts the bootchain.
Signed-off-by: Yalei Zang <yalei.zang@airoha.com>
Link: https://github.com/openwrt/openwrt/pull/24397
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This commit introduces OpenWrt U-Boot UBI layout support
for the COMFAST CF-WR632AX, enabling:
- Prolonged device lifetime by allocating most of the flash
to UBI (which takes care of wear-leveling)
- Maximum available storage space for OpenWrt
- Fully-featured U-Boot
- Effective recovery mechanisms
OpenWrt U-Boot UBI flash instructions
-------------------------------------
A device running stock firmware should be upgraded to the
latest standard OpenWrt firmware
(https://firmware-selector.openwrt.org/?target=mediatek%2Ffilogic&id=comfast_cf-wr632ax).
Back up critical data
---------------------
Console:
1. While the device is running OpenWrt with stock MTD partitions:
mtd dump BL2 > /tmp/BL2.bin
mtd dump u-boot-env > /tmp/u-boot-env.bin
mtd dump Factory > /tmp/Factory.bin
mtd dump FIP > /tmp/FIP.bin
2. Copy the backup files to your PC via SCP.
LuCI Web-UI:
"System" -> "Backup / Flash Firmware" -> "Save mtdblock contents"
Save mtdblock:
BL2
u-boot-env
Factory
FIP
Make sure the files were successfully downloaded to your downloads directory,
especially the Factory file.
Using the installer image
-------------------------
To simplify the installation process, this method uses a fork
of Daniel Golle's (@dangowrt) UBI Installer
https://github.com/dangowrt/owrt-ubi-installer
1. Ensure your router is running the latest generic OpenWrt firmware.
Upgrade it if necessary.
2. Obtain the installer image:
Build the installer from source
https://github.com/andros-ua/owrt-ubi-installer/tree/cf-wr632ax
or download a prebuilt image from the
https://github.com/andros-ua/owrt-ubi-installer/releases
3. Flash the openwrt*-ubi-initramfs-recovery-installer.itb
image using sysupgrade.
4. Wait for installation: the green status LED will blink rapidly,
indicating that the all-in-UBI installer is running.
5. Once the installation finishes,
the status LED will turn solid amber for 5 seconds.
6. After the device reboots, perform a final sysupgrade using the
openwrt*-ubi-squashfs-sysupgrade.itb image.
Return to stock MTD
-------------------
1. Flash openwrt*comfast_cf-wr632ax-initramfs-kernel.bin
via sysupgrade
2. Copy files to /tmp on the device via SCP:
BL2.bin
u-boot-env.bin
Factory.bin
FIP.bin
openwrt*-squashfs-sysupgrade.bin
3. Restore stock MTD partitions:
apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd write /tmp/BL2.bin BL2
mtd write /tmp/u-boot-env.bin u-boot-env
mtd write /tmp/Factory.bin Factory
mtd write /tmp/FIP.bin FIP
4. Install the system:
sysupgrade /tmp/*sysupgrade.bin
BL2 and FIP Recovery
--------------------
Use mtk_uartboot to recover corrupted BL2 or FIP via UART:
https://github.com/981213/mtk_uartboot
Stock layout
----------------------------------------
| dev: size erasesize name |
| mtd0: 00100000 00020000 "BL2" |
| mtd1: 00080000 00020000 "u-boot-env" |
| mtd2: 00200000 00020000 "Factory" |
| mtd3: 00200000 00020000 "FIP" |
| mtd4: 07000000 00020000 "ubi" |
----------------------------------------
OpenWrt U-Boot UBI layout
----------------------------------
| dev: size erasesize name |
| mtd0: 00100000 00020000 "bl2" |
| mtd1: 07f00000 00020000 "ubi" |
----------------------------------
Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23981
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add an OpenWrt U-Boot ("UBI") layout variant for the TP-Link Archer
BE450. It replaces the vendor bootloader and the stock dual-image
layout with a single large UBI partition, extending the usable flash
to around 95 MiB, and ships a current U-Boot with TFTP recovery.
Hardware
--------
SoC: MediaTek MT7988D (Filogic 880)
Wi-Fi: MediaTek MT7992AV (BE7200, 2.4/5 GHz)
Flash: 128 MiB SPI-NAND
RAM: 512 MiB DDR4
Serial: 115200 8N1, header located next to the heatsink:
heatsink
| |
| |
| | +----+-----+------+-------+ +-----------------+
| | | TX | RX | GND | +3.3V | | power connector |
+---+ +----+-----+------+-------+ +-----------------+
|
Don't connect ----+
MAC addresses
-------------
The label MAC (base) is stored in tp_data/default-mac and is written
into the factory partition at offset 0x4 during installation:
eth0 (LAN): base (factory 0x4)
eth1 (WAN): base + 1
eth2 (LAN): base + 2
Wi-Fi: derived by mt76 from the factory EEPROM (2.4 GHz = base,
5 GHz = base with bit 0x10 set), matching the stock
layout behaviour.
Installation
------------
Requires a serial connection and a TFTP server. The device must be
running the stock-layout OpenWrt (tplink_be450) build.
1. From the running stock-layout OpenWrt, back up the vendor
bootloader and the calibration/MAC data. These cannot be
recovered otherwise:
cat /dev/mtd0 > /tmp/boot.bin
cat /dev/mtd5 > /tmp/tp_data.bin
scp /tmp/boot.bin /tmp/tp_data.bin user@pc:backup/
scp -r /tmp/tp_data user@pc:backup/
Store boot.bin, tp_data.bin and the tp_data file contents
(MT7992_EEPROM.bin, default-mac) somewhere safe.
2. Boot the UBI-layout initramfs. Connect the PC to one of the LAN ports
(LAN1-3) and serve the recovery image from a TFTP server on the PC at
192.168.1.2. Interrupt the vendor U-Boot on the serial console
(Ctrl+C), then:
setenv serverip 192.168.1.2
tftpboot 0x50000000 openwrt-mediatek-filogic-tplink_be450-ubi-initramfs-recovery.itb
bootm 0x50000000
3. Copy the required files to the booted initramfs (192.168.1.1):
scp -O MT7992_EEPROM.bin default-mac \
openwrt-mediatek-filogic-tplink_be450-ubi-bl31-uboot.fip \
openwrt-mediatek-filogic-tplink_be450-ubi-preloader.bin \
openwrt-mediatek-filogic-tplink_be450-ubi-squashfs-sysupgrade.itb \
root@192.168.1.1:/tmp
4. Build the factory image from the EEPROM and MAC data:
cd /tmp
dd if=/dev/zero bs=$((0x100000)) count=1 | tr '\000' '\377' > factory.bin
dd if=MT7992_EEPROM.bin of=factory.bin bs=1 count=$((0x1e00)) conv=notrunc
dd if=default-mac of=factory.bin bs=1 seek=4 conv=notrunc
5. Create the UBI volumes. Warning: this permanently erases the
remaining vendor data, including tp_data - only proceed with the
backups from step 1 stored safely:
ubidetach -p /dev/mtd2
ubiformat /dev/mtd2 -y
ubiattach -p /dev/mtd2
ubimkvol /dev/ubi0 -N fip -t static -s 2MiB
ubiupdatevol /dev/ubi0_0 /tmp/openwrt-mediatek-filogic-tplink_be450-ubi-bl31-uboot.fip
ubimkvol /dev/ubi0 -N ubootenv -s 0x1f000
ubimkvol /dev/ubi0 -N ubootenv2 -s 0x1f000
6. Write the factory data and the BL2 preloader. kmod-mtd-rw is
required to lift the read-only protection of the bl2 partition;
set up internet access first or upload the package manually:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd erase factory
mtd write /tmp/factory.bin factory
mtd erase bl2
mtd write /tmp/openwrt-mediatek-filogic-tplink_be450-ubi-preloader.bin bl2
7. Flash the system:
sysupgrade -n /tmp/openwrt-mediatek-filogic-tplink_be450-ubi-squashfs-sysupgrade.itb
Revert to stock firmware
------------------------
1. From the UBI-layout OpenWrt, force-flash the stock-layout OpenWrt
(tplink_be450) initramfs image; the board name differs, so
sysupgrade must be forced:
sysupgrade -F -n openwrt-mediatek-filogic-tplink_be450-initramfs-kernel.bin
2. After booting into that initramfs, set up network access, copy
boot.bin and tp_data.bin from the backup to /tmp and restore the
vendor bootloader and data:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd erase boot
mtd write /tmp/boot.bin boot
mtd erase ubi0
mtd erase ubi1
mtd erase userconfig
mtd erase tp_data
mtd write /tmp/tp_data.bin tp_data
3. Verify the tp_data restore before rebooting - without it the
device has no ethernet:
md5sum /tmp/tp_data.bin
md5sum /dev/mtd5
If the checksums match, reboot. The vendor U-Boot web recovery
comes up on 192.168.1.1; flash the TP-Link stock firmware from
there.
Signed-off-by: Emre Yavuzalp <emreyavuzalp2@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23211
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add a U-Boot replacement loader for the TP-Link Archer BE450
(MT7988D, 128 MiB SPI-NAND). BL2 boots from spim-nand-ubi with DDR4;
the FIP and the redundant environment are stored in UBI volumes.
This replaces the vendor bootloader and the stock dual-image layout
with a single large UBI partition, freeing around 95 MiB of flash for
OpenWrt. The vendor layout keeps BL2 at flash offset 0x0, which is
where snand_write_bl2 places the first of its four redundant copies.
Signed-off-by: Emre Yavuzalp <emreyavuzalp2@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23211
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Specifications
--------------
- SoC : Qualcomm IPQ4019 (4x ARMv7 Cortex-A7 @ 716 MHz, NEON/VFPv4)
- RAM : 256 MiB DDR3
- SPI-NOR : Macronix MX25L1606E (2 MiB) - bootloader + ART calibration
- SPI-NAND : Winbond W25M02GV (256 MiB, dual-die) - kernel + rootfs (UBI)
- WLAN : IPQ4019 on-chip, 2 radios
- 2.4 GHz : 2x2 802.11b/g/n (wifi0)
- 5 GHz : 2x2 802.11n/ac (wifi1)
- Ethernet : 1x RJ45 via QCA8075 PHY, jack wired to switch port 5
- TPM : Atmel AT97SC3204T on i2c @ 0x29
- Buttons : 1x Reset (gpio2, active low)
- LEDs : green (gpio3, power), red (gpio4, status / panic)
- UART : 115200 8N1 3.3V (gpio60 TX / gpio61 RX)
- Power : DC 12V
MAC addresses
-------------
Read from the ART partition on SPI-NOR flash at offset 0x0,
encoded as a nvmem cell in the DTS.
Flash layout
------------
SPI-NOR (2 MiB) carries the QCA bootloader chain and ART:
SBL1 0x000000 256 KiB (bootloader stage 1)
MIBIB 0x040000 128 KiB (flash partition table)
QSEE 0x060000 384 KiB (TrustZone / secure env)
CDT 0x0c0000 64 KiB (configuration data tbl)
DDRPARAMS 0x0d0000 64 KiB (DDR training parameters)
APPSBLENV 0x0e0000 64 KiB (U-Boot environment)
APPSBL 0x0f0000 512 KiB (U-Boot)
ART 0x170000 64 KiB (WiFi calibration + MAC)
The W25M02GV SPI-NAND is split at the die boundary
(die 0 = rootfs, die 1 = data) to work around a stock U-Boot bug:
the die-select is broken, causing reads from die 1 to return
0xFF. If UBI wear-leveling relocated the layout volume to
die 1, U-Boot would fail to attach UBI, bricking boot.
Splitting the chip keeps all UBI metadata U-Boot reads from
die 0.
Stock U-Boot hardcodes the UBI attach window to 64 MiB;
the bootcmd replacement expands it to 128 MiB to use the
full die 0.
rootfs 0x00000000 128 MiB
data 0x08000000 128 MiB
Installation
------------
1. Build image for sophos_apx120 target
2. Start TFTP server in folder with
openwrt-ipq40xx-generic-sophos_apx120-initramfs-
uImage.itb
3. Plug in Serial TTL Adapter (115200 baud):
| APX 120 | VCC | RX | GND | TX |
|--------|------|-----|-----|-----|
| USB | X | TX | GND | RX |
|--------|------|-----|-----|-----|
3. Short U26 pin 8 (first pin on left, top row on NAND
Chip, with ethernet port facing you) to ground for a
fraction of a second during power-on. Expected output shows
NAND detection and CRC warning, then U-Boot prompt.
4. In U-Boot run:
$ setenv bootdelay 5
$ setenv verify no
$ saveenv
$ tftpboot 0x84000000
openwrt-ipq40xx-generic-sophos_apx120-initramfs-uImage.itb
$ bootm 0x84000000
5. Setup Networking Transfer the sysupgrade image using a
HTTP server or scp
6. In OpenWrt run:
$ fw_setenv bootcmd 'set fdt_high 0x87000000 && \
set bootargs ubi.mtd=rootfs root=mtd:ubi_rootfs \
rootfstype=squashfs rootwait && nand device 1 && \
set mtdids nand1=nand1 && set mtdparts \
mtdparts=nand1:0x8000000@0x0(fs) && \
ubi part fs && ubi read 0x84000000 kernel && \
bootm 0x84000000#config@ap.dk01.1-c2'
$ ubiformat /dev/mtd9 -y
$ sysupgrade -n
openwrt-ipq40xx-generic-sophos_apx120-squashfs-sysupgrade.bin
7. Device should reboot into OpenWrt
Notes
-----
- With firmware version 1.0.019, the image drops directly
into a shell, so NAND glitching may be skipped.
- The platform sysupgrade script reflashes the entire
die-0 UBI partition via `ubiformat` — live volume
manipulation would leave the UBI layout in a state the
stock U-Boot rejects, which bricks the device.
Known Issues
------------
- Some device revisions have an TPM chip that
is not detected/supported or is broken
Signed-off-by: Morice Olbert <synapse7062@spnkr.de>
Link: https://github.com/openwrt/openwrt/pull/24328
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The board enables gdm1 in its DTS, but U-Boot v2026.07 ships
arch/arm/dts/an7581-u-boot.dtsi, which is appended to the end of the
board DTS and declares gdm1 with status = "disabled". The board setting
is overridden and U-Boot ends up without a network device.
Add a board specific an7581-w1700k-ubi-u-boot.dtsi re-enabling gdm1.
U-Boot only pulls in the first matching *-u-boot.dtsi (firstword in
scripts/Makefile.lib), so the board file must include the SoC one
explicitly, otherwise the entire an7581 U-Boot glue is dropped along
with it: uart1 bootph-all, the eth/pcs/snfi/mmc nodes and the ATF
reserved memory.
This is the same fix that was confirmed to restore networking on the
Nokia XG-040G-MD. It is compile tested only and verified by inspecting
the generated DTB - I have no W1700K hardware, so it is unverified on
the actual device and needs testing by someone who has one.
Fixes: baeacca598 ("uboot-airoha: update to v2026.07")
Signed-off-by: Vitaliy Sochnev <sochnev.v.74@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24410
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
U-Boot v2026.07 ships arch/arm/dts/an7581-u-boot.dtsi, which declares
gdm1 with status = "disabled". That file is appended to the end of the
board DTS, so it overrides the MAC enabled by the board and U-Boot ends
up without a network device:
No ethernet found.
Add a board specific an7581-nokia-xg-040g-md-u-boot.dtsi re-enabling
gdm1. U-Boot only pulls in the first matching *-u-boot.dtsi (firstword
in scripts/Makefile.lib), so the board file must include the SoC one
explicitly, otherwise the entire an7581 U-Boot glue is dropped along
with it: uart1 bootph-all, the eth/pcs/snfi/mmc nodes and the ATF
reserved memory. Same approach as en7581-evb and Nokia Valyrian.
Tested on Nokia XG-040G-MD: TFTP recovery boot works again.
Fixes: baeacca598 ("uboot-airoha: update to v2026.07")
Closes: https://github.com/openwrt/openwrt/issues/24385
Signed-off-by: Vitaliy Sochnev <sochnev.v.74@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24410
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Drop upstreamed patches.
Delete device trees in `106-board-rockchip-add-HINLINK-H66K-H68K.patch` that have been added to
U-Boot from upstream Linux.
Rebase `108-07-WIP-rockchip-mkimage-Add-rk3576-align-and-sd-card-wo.patch`
Refresh all other patches.
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/24118
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The ZyXEL GS1900-8HP B2 is an 8-port gigabit switch with PoE+ support. It's a new
hardware revision that uses the `realtek,pse-mcu-gen2` PSE dialect with 115200 baud
like the GS1900-10HP B1. Other hardware changes are unknown, but the switch works
fine using the pre-PSE `zyxel,gs1900-8hp-b1` image with the `realtek-poe` user-space
PoE implementation.
The installation instructions from the initial support for the A1 and B1 revisions
still apply (c4bfe68c83):
* Configure your client with a static 192.168.1.x IP (e.g. 192.168.1.2).
* Set up a TFTP server on your client and make it serve the initramfs
image.
* Connect serial, power up the switch, interrupt U-boot by hitting the
space bar, and enable the network:
> rtk network on
* Since the GS1900-10HP is a dual-partition device, you want to keep the
OEM firmware on the backup partition for the time being. OpenWrt can
only boot off the first partition anyway (hardcoded in the DTS). To
make sure we are manipulating the first partition, issue the following
commands:
> setsys bootpartition 0
> savesys
* Download the image onto the device and boot from it:
> tftpboot 0x84f00000 192.168.1.2:openwrt-realtek-generic-zyxel_gs1900-8hp-b2-initramfs-kernel.bin
> bootm
* Once OpenWrt has booted, scp the sysupgrade image to /tmp and flash it:
> sysupgrade /tmp//tmp/openwrt-realtek-generic-zyxel_gs1900-8hp-b2-squashfs-sysupgrade.bin
Alternatively, after factory-resetting the switch, you can:
* Log in to OEM management web interface. It should be at http://192.168.1.1
* Navigate to `Maintenance > Firmware > Management`
* If "Active Image" has the first option selected, OpenWrt will need to be
flashed to the "Active" partition. If the second option is selected, OpenWrt
will need to be flashed to the "Backup" partition.
* Navigate to `Maintenance > Firmware > Upload`
* Upload the initramfs-kernel.bin file by your preferred method to the previously
determined partition. When prompted, select to boot from the newly flashed image,
and reboot the switch.
* Once OpenWrt has booted, scp the sysupgrade.bin image to /tmp and flash it thought SSH.
- OpenWrt does not include openssh-sftp-server by default. If your SCP client fails due
to lacking an SFTP server on the device, consider using the legacy SCP protocol
instead. With OpenSSH's scp this can be done by adding the -O option on the command
line.
- `sysupgrade -n /tmp/<sysupgrade file name>`
* It may be necessary to restart the network (/etc/init.d/network restart) on the running
initramfs image.
See the GS199-8HP A1 wiki page for more information (https://openwrt.org/toh/zyxel/gs1900-8hp_v1).
Signed-off-by: Peter Putzer <openwrt@mundschenk.at>
Link: https://github.com/openwrt/openwrt/pull/24418
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The CPU port between the MT7981 and MT7531 runs at 2.5 Gbps, but the U-Boot
device tree configures it as SGMII at 1 Gbps. This leaves Ethernet unable
to exchange packets despite an active physical link.
Use 2500base-x and a 2500 Mbps fixed link, matching the Linux device tree.
Fixes: a3105d3f95 ("mediatek: filogic: add support for Globitel BT-R320")
Signed-off-by: Bogdan K <zikwarface134@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24372
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The GS1900-24E B1 is a different hardware revision, not merely a
front-panel relabel as suggested by Zyxel's user guide. Verified
differences vs. A1 (sources: TechInfoDepot for A1 spec data,
https://techinfodepot.shoutwiki.com/wiki/ZyXEL_GS1900-24E):
* PCB: 37ZY-GM2430+212 V1.2 (A1: 37ZY-G724DO+412 V.12)
- different board part number, not a stepping of the same one
* RAM: 128 MiB DDR3, A1: 128 MiB DDR2
* Flash: mx25l12805d, 16 MiB (A1: 16 MiB SPI-NOR)
* External PHYs: RTL8218D (A1: unknown)
* Rear power switch: absent on this B1 unit (inlet only). A1 is
described as having one in the *title* of openwrt/openwrt#18620,
but that issue does not explicitly identify the affected hardware
as "A1" specifically, nor is it confirmed by a spec sheet or photo
* ZYXEL_VERS firmware family unchanged (AAHK)
The existing MDIO bus addressing and switch-port SerDes layout
from -a1.dts work unmodified on B1, since the PHY driver
identifies the external chip by ID registers at runtime rather
than from DT compatible string, regardless of what chip A1
actually uses.
Deliberately omits the gpio0 mdio-reset gpio-hog present in
-a1.dts (ba57225066, #18620) pending confirmation it's needed on
B1's differing reset-line topology. Tagged 802.1Q VLAN traffic
tested clean across software reboot and full AC power-cycle, on
both kernel 6.6/24.10.5 and current master (6.18), with no sign
of the #18620 stuck-RX regression.
Encapsulates the two external RTL8218D PHY packages per the tree-wide
ethernet-phy-package conversion for RTL8218x chips; ports 8-15 use the
SoC-integrated PHY block and aren't part of an external package.
Signed-off-by: Joshua Covington <joshuacov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24377
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Add support for the Comfast CF-EW84 based on the MediaTek MT7621
SoC.
Hardware:
CPU/SoC: MediaTek MT7621DA
RAM: 128 MB DDR3
Flash: Macronix MX25L12805D 16 MB
Switch: MediaTek MT7530
WiFi 2.4 GHz: MediaTek MT7603E
WiFi 5 GHz: MediaTek MT7613B
Ports: 1x WAN, 2x LAN (10/100/1000 Mbps)
LEDs: Power, WAN, LAN1, LAN2, WLAN
Buttons: Reset
UART: through-hole on PCB
pinout: RX, TX, GND, 3.3V
settings: 115200n8
Flash instructions:
1. Connect the bundled PoE injector to power.
2. Connect the PC to the LAN1 or LAN2 port of the device.
3. Configure a static IP on the computer's Ethernet adapter:
IP: 192.168.1.x (x = 2 to 254)
Mask: 255.255.255.0
Gateway: empty
DNS: empty
4. Connect a second Ethernet cable to the PoE port of the
bundled injector.
5. Press and hold the reset button on the device.
6. While holding the reset button, plug the other end of the
second Ethernet cable into the WAN port.
7. Wait at least 3 seconds, then release the reset button.
8. Browse to http://192.168.1.1: the MediaTek U-Boot System
Recovery page should appear.
9. Click Upload and select the *-sysupgrade.bin firmware file.
10. After flashing completes, browse to http://192.168.1.1
again: the LuCI login page should appear.
Factory data:
2.4 GHz EEPROM: factory offset 0x0000
5 GHz EEPROM: factory offset 0x8000
LAN MAC address: factory offset 0xe000
WAN MAC address: factory offset 0xe000 (+1)
LED layout:
The Comfast CF-EW84 has five physical LEDs, but only the WLAN
LED is software-controllable through the Linux GPIO-LEDs
subsystem.
Signed-off-by: Vincenzo Suraci <vincenzo.suraci@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24112
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The GS1900-10HP B1 keeps the RTL8380M SoC and port layout but replaces the
A1's Broadcom PoE (Gen1) with a Realtek RTL8238 PSE fronted by a Nuvoton
MCU speaking the Gen2 protocol at 115200 baud. It reuses the shared
rtl8380_zyxel_gs1900-10hp.dtsi and only overrides the PSE compatible and
UART speed.
Specifications:
- SoC: Realtek RTL8380M
- Ports: 8x 10/100/1000 (PoE+), 2x SFP
- PoE: Realtek RTL8238 via Nuvoton MCU (Gen2, UART 115200)
Tested on hardware: driver probes RTL8238B (8 ports), per-port control via
ethtool, verified across a cold power-cycle.
Signed-off-by: Carlo Szelinsky <github@szelinsky.de>
Link: https://github.com/openwrt/openwrt/pull/24283
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This commit adds initial support for Nokia XG-040G-MF XG-PON ONU.
Specification
-------------
- SoC : Airoha AN7583DT (dual-core ARM Cortex-A53 1.2 GHz)
- RAM : 512 MiB DDR4 (Winbond W664GG6RB-06)
- Flash : SPI-NAND 256 MiB (GigaDevice GD5F2GM7UEYIG)
- WLAN : -
- Ethernet : 1x 2500 Mbps (LAN1, Airoha EN8811HN)
3x 10/100/1000 Mbps (LAN2-LAN4, Airoha AN7583 SoC switch)
- XG-PON : ECONET EN7572, SLIC: MaxLinear PEF32001VSV12
- USB : 1x USB2 (with power control via gpio)
1x USB3 (with power control via gpio)
- Buttons : Reset
- LEDs : 1x Power (green)
1x WAN (green)
1x WAN (red)
4x LAN (green)
2x USB (green)
- Power : 12 VDC, 1 A
Unsupported functions, limitations and known issues
---------------------------------------------------
1. XG-PON won't be available after installing OpenWrt.
2. USB ports: AN7583 SoC in OpenWrt doesn't support USB at this time.
Installation (UART)
-------------------
1. Attach UART and run picocom:
picocom -b 115200 --send-cmd "sb -vv" /dev/ttyUSB0
2. Interrupt boot process by pressing Enter key to enter u-boot
Username: telecomadmin
Password: nE7jA%5m
3. Start download firmware via ymodem protocol (via UART):
loady 0x85000000
4. Press Ctrl + A then Ctrl + S in the picocom terminal (if you are using
a different terminal, please refer to the documentation) to start
upload OpenWrt initramfs image using ymodem protocol. Enter local path
to the OpenWrt initramfs image and press Enter.
5. Load OpenWrt initramfs image from the memory:
bootm 0x85000000
5. Sysupgrade with OpenWrt sysupgrade image
Alternative for the p.3-4. Load and boot OpenWrt initramfs from tftp IP
192.168.1.254:
tftpboot 0x85000000 192.168.1.254:openwrt-initramfs-uImage.itb
bootm 0x85000000
Backup and installation (without UART)
--------------------------------------
1. Unplug Fiber
2. Make ONU Reset
3. Navigate: http://192.168.1.1
Username: CMCCAdmin
Password: aDm8H%MdA
4. Go to Apps -> Home Storage -> FTP and check Enable FTP
5. Go to Apps -> Home Storage -> SAMBA Sharing and check Enable Samba
6. Visit the following URL to open Telnet:
http://192.168.1.1/system.cgi?telnet
7. Telnet account login:
Username: user
Password: <see ONU label>
8. Get root privileges:
su user_ftp
Password: <see ONU label>
9. Copy 'squashfs-factory-kernel.bin', 'squashfs-factory-rootfs.bin' and
'OpenWrt.mtd2.u-boot-env.bin' (backup of 'u-boot-env' partition from
the another Nokia XG-040G-MF with OpenWrt installed)
9. Attach USB flash drive and check the new dir in /mnt:
ls /mnt
10. Change current dir to the flash drive (change D to your flash drive
label):
cd /mnt/D
11. Make backup:
for i in 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16; \
do cat /dev/mtd$i | gzip -9 > mtd$i.bin.gz; done
12. Check image sizes:
ls -l | awk '{if(NR>1) {$5=sprintf("0x%x", $5); print}}'
13. Write images:
mtd_debug erase /dev/mtd0 0x60000 0x20000
mtd_debug write /dev/mtd0 0x60000 0x20000 OpenWrt.mtd2.u-boot-env.bin
mtd_debug erase /dev/mtd14 0x0 0x2880000
mtd_debug write /dev/mtd14 0x0 0x3e6cfc squashfs-factory-kernel.bin
mtd_debug erase /dev/mtd11 0x0 0x80e0000
mtd_debug write /dev/mtd11 0x0 0x440000 squashfs-factory-rootfs.bin
0x3e6cfc - size of your 'squashfs-factory-kernel.bin'
0x440000 - size of your 'squashfs-factory-rootfs.bin'
14. Reboot:
reboot
Recovery
--------
The same as described in Installation (UART).
Return to stock
---------------
1. Follow the steps 1-5 of the Installation (UART)
2. Once in OpenWrt upload you backup to the /tmp dir of the router:
scp -O mtd16.bin.gz root@192.168.1.1:/tmp
5. Connect to the router using ssh and install kmod-mtd-rw:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
6. Unlock bootloader:
mtd unlock bootloader
7. Restore stock:
zcat /tmp/mtd16.bin.gz | mtd write - all_flash
8. Reboot:
reboot
Stock layout
------------
+-------+------------+---------+---------+
| mtd | label | start | size |
+-------+------------+---------+---------+
| mtd0 | bootloader | 0 | 80000 |
| mtd1 | romfile | 80000 | 40000 |
| mtd14 | nsb_master | c0000 | 2880000 |
| mtd15 | nsb_slave | 2940000 | 2880000 |
| mtd6 | bosa | 51c0000 | 40000 |
| mtd7 | ri | 5200000 | 40000 |
| mtd8 | flag | 5240000 | 40000 |
| mtd9 | flagback | 5280000 | 40000 |
| mtd10 | config | 52c0000 | a00000 |
| mtd11 | data | 5cc0000 | 80e0000 |
| mtd12 | oopsfs | dda0000 | 400000 |
| mtd13 | log | e1a0000 | a00000 |
+-------+------------+---------+---------+
UART
----
A view from the back side of the PCB:
------------------------
| GND RX TX
| X X X
Connection parameters:
115200, 8N1, 3.3V
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | e0:xx:xx:xx:xx:a0 | label |
| WAN | e0:xx:xx:xx:xx:a1 | label + 1 |
+---------+-------------------+-----------+
The LAN MAC (hex) was found in 'ri', 0x3e
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23809
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Use the compatible expected by the AN7583 pinctrl driver so the pinctrl and integrated GPIO driver can bind.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Changes:
* removed upstreamed patches,
* refresh patches,
* add en7523/an7581/an7583 pinctrl support
* add basic PCS support for an7583
* add an7583 specific mdio bus support
Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
Link: https://github.com/openwrt/openwrt/pull/24165
Signed-off-by: Robert Marko <robimarko@gmail.com>
Update to the latest stable version. Also remove obsolete symbol
PKG_CONFIG_SYSROOT_DIR[1].
[1] 8ef8dee4f3
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/24123
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
It seems that GCC 14.4 will generate larger binary compared to the
GCC 14.3 on ARM32 platforms. We have to increase the maximum allowed
SPL size to fix build errors.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/24058
Signed-off-by: Robert Marko <robimarko@gmail.com>
The MikroTik RB5009UPr+S+IN is a multigig router based on the Marvell
Armada 7040 SoC, sharing the same hardware base as the RB5009UG+S+IN
with added PoE-out support on all ethernet ports.
Specification:
- SoC : Marvell Armada 7040 (88F7040), 4x Cortex-A72
- CPU frequency : 350-1400 MHz
- RAM : 1 GB
- Flash : 16 MB SPI NOR + 1 GB NAND
- Switch : Marvell MV88E6393X
- Ethernet : 1x 2.5G (p1, QCA8081), 7x 1G (p2-p8), 1x SFP+ 10G
- PoE-in : 802.3af/at on p1, 24-57V
- PoE-out : 802.3af/at on p1-p8, 130 W total
- Power : DC jack / 2-pin terminal / PoE-in, 24-57V
- USB : 1x USB 3.0 type A, max 1.5 A
- LEDs/Keys (GPIO): 4x/1x
- UART : MikroTik SPI/UART combo header (10-pin, 2.0mm pitch)
- assignment : GND Vcc Rx ? GND / CLK DO /CS Tx DI (top view)
- settings : 115200n8
Flash instruction using initramfs image:
RouterBOOT cannot boot the OpenWrt kernel directly. A U-Boot loader
(u-boot.elf) is installed as an intermediary: RouterBOOT loads
u-boot.elf, which then loads the OpenWrt initramfs image.
1. Rename the downloaded initramfs image, removing the version number,
to: openwrt-mvebu-cortexa72-mikrotik_rb5009-initramfs-uImage.itb
2. Set up a BOOTP/TFTP server serving u-boot.elf, with the renamed
initramfs image in the same directory
3. Power off the router, hold the reset button (front panel), power on
and keep holding until the initramfs image has been served, then
release
4. The router boots the initramfs image, reachable at 192.168.1.1
5. Log in via SSH, install U-Boot, wipe NAND and flash OpenWrt:
. /lib/functions.sh
yafut -d /dev/mtd$(find_mtd_index "YAFFS") -w -i /tmp/u-boot.elf -o kernel -T
ubiformat /dev/mtd$(find_mtd_index "ubi") -y
sysupgrade /tmp/openwrt-mvebu-cortexa72-mikrotik_rb5009upr-squashfs-sysupgrade.bin
Recovery:
Hold the reset button while U-Boot is booting to load the initramfs
image again. To return to RouterOS, use MikroTik Netinstall.
MAC Addresses:
MAC addresses are read from the RouterBOOT hard_config in NOR via the
macaddr_hard nvmem cell:
offset +0 p1 (2.5G, label-mac-device)
offset +1 p2
offset +2 p3
offset +3 p4
offset +4 p5
offset +5 p6
offset +6 p7
offset +7 p8
offset +8 sfp
Tested-by: Sm00shed <sm00shed@posteo.de> (RB5009UPr+S+IN, OpenWrt v25.12.4,
kernel 6.12.87, mtpoe fw 65.21)
Signed-off-by: Przemek Rudy <prudy@protonmail.com>
[carlo@common-net.org: refactor RB5009UPr+S+IN support and fix sysupgrade path]
Signed-off-by: Carlo Filippi <carlo@common-net.org>
[sm00shed@posteo.de: fix compatible indentation, remove mikrotik,rb5009, expand commit message]
Signed-off-by: Sm00shed <sm00shed@posteo.de>
Link: https://github.com/openwrt/openwrt/pull/23698
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Specialize RB5009UG model from generic RB5009.
Signed-off-by: Przemek Rudy <prudy@protonmail.com>
[carlo@common-net.org: fixed model name and backward compatibility ]
Signed-off-by: Carlo Filippi <carlo@common-net.org>
Signed-off-by: Sm00shed <sm00shed@posteo.de>
Link: https://github.com/openwrt/openwrt/pull/23698
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
RAM: ESMT M15T2G16128A-DEB DDR3 1866 MT/s
This allows us to use the full size of nand,
which extends ubi size from 64Mb to 122.25Mb.
1. Log in to the device and backup all the partitions,
especially unique "Factory" and "bdinfo" partitions
from System -> Backup / Flash Firmware -> Save mtdblock contents.
2. Install kmod-mtd-rw to unlock mtd partitions for writing
apk update && apk add kmod-mtd-rw && insmod mtd-rw i_want_a_brick=1
3. Write new OpenWrt (U-Boot Layout) "BL2" and "FIP":
mtd -e BL2 write openwrt-mediatek-filogic-cudy_m3000-v2-yt8821-ubootmod-preloader.bin BL2
mtd -e FIP write openwrt-mediatek-filogic-cudy_m3000-v2-yt8821-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC: "192.168.1.254", gateway "192.168.1.1"
5. Serve openwrt-mediatek-filogic-cudy_m3000-v2-yt8821-ubootmod-initramfs-recovery.itb
using TFTP server.
6. Connect Router LAN with PC LAN.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt initramfs recovery has booted,
clean "/dev/mtd5" ubi partition to utilize maximum of free space:
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Perform sysupgrade.
Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23274
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
RAM: ESMT M15T2G16128A-DEB DDR3 1866 MT/s
This allows us to use the full size of nand,
which extends ubi size from 64Mb to 122.25Mb.
1. Log in to the device and backup all the partitions,
especially unique "Factory" and "bdinfo" partitions
from System -> Backup / Flash Firmware -> Save mtdblock contents.
2. Install kmod-mtd-rw to unlock mtd partitions for writing
apk update && apk add kmod-mtd-rw && insmod mtd-rw i_want_a_brick=1
3. Write new OpenWrt (U-Boot Layout) "BL2" and "FIP":
mtd -e BL2 write openwrt-mediatek-filogic-cudy_m3000-v1-ubootmod-preloader.bin BL2
mtd -e FIP write openwrt-mediatek-filogic-cudy_m3000-v1-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC: "192.168.1.254", gateway "192.168.1.1"
5. Serve openwrt-mediatek-filogic-cudy_m3000-v1-ubootmod-initramfs-recovery.itb
using TFTP server.
6. Connect Router LAN with PC LAN.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt initramfs recovery has booted,
clean "/dev/mtd5" ubi partition to utilize maximum of free space:
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Perform sysupgrade.
Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23274
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add DDR3_FREQ_1866 for DDR3 Cudy devices
to reduce RAM speed to 1866 MT/s
All known Cudy devices with DDR3 256/512 MB RAM use
ESMT M15T2G16128A-DEB DDR3 1866 MT/s or
ESMT M15T2G16256A-DEB DDR3 1866 MT/s
Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23274
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The NanoPi R2S Plus is a NanoPi R2S with on-board eMMC added. The device
tree (rk3328-nanopi-r2s-plus.dts) is already present in kernel 6.12, and
U-Boot support has been present since v2025.01, so neither a kernel DTS
backport nor a U-Boot patch is required.
Hardware
--------
Rockchip RK3328 (4x Cortex-A53, up to 1.4 GHz)
1GB DDR4 RAM
32GB eMMC 5.1
microSD slot (up to 128GB)
1x 1000 Base-T (native, RTL8211F via GMAC) - WAN
1x 1000 Base-T (USB 3.0, RTL8153B) - LAN
Optional M.2 SDIO Wi-Fi
2x USB 2.0 Type-A host
1x USB-C (5V power input, USB device for Maskrom update)
1x USB-C (onboard USB-to-UART debug console, 1500000 bps)
1x serial debug header / UART0 (3.3V TTL, 3-pin 2.54mm)
2 Buttons (GPIO key, Maskrom)
3 LEDs (SYS red, WAN green, LAN green)
DC 5V/2A power
Operating temperature 0 to 70 C
The MAC addresses are derived from the eMMC CID, so they are stable
regardless of whether the device boots from microSD or eMMC.
Installation
------------
On RK3328 the BootROM boots the eMMC before the microSD slot, so the
Maskrom button must be held to boot from microSD while stock firmware is
still on the eMMC.
How to boot from eMMC:
1. Write the uncompressed sysupgrade image to sdcard
2. Hold the "Mask" button while powering on the device
3. Wait until OpenWrt is fully booted
4. Copy the compressed .gz sysupgrade image to the machine's /tmp folder using scp
5. Run: gunzip -c /tmp/openwrt-...-friendlyarm_nanopi-r2s-plus-squashfs-sysupgrade.img.gz | dd of=/dev/mmcblk1 bs=4M conv=fsync
6. Power the device off, remove the sdcard and power it back on
Tested:
- microSD boot (via Maskrom button) and native eMMC boot
- Both Ethernet ports (RTL8211F WAN, RTL8153B LAN)
- eMMC-derived MAC addresses
Signed-off-by: Grische <github@grische.xyz>
Assisted-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23854
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This commit adds support for Nokia XG-040G-MD XG-PON ONU.
Specification
-------------
- SoC : Airoha AN7581DT Quad-core ARM Cortex-A53 1.2 GHz
- RAM : 512 MiB DDR4 (ESMT M16U4G16256A-QLB)
- Flash : SPI-NAND 256 MiB (SkyHigh ML02G300WHI00)
- WLAN : -
- Ethernet : 1x 2500 Mbps (LAN1, Airoha EN8811HN)
3x 10/100/1000 Mbps (LAN2-LAN4, Airoha AN7581 SoC switch)
- XG-PON : ECONET EN7572AN, SLIC: MaxLinear PEF32001VSV12
- USB : 1x USB 3.0 (with power control via gpio)
1x USB 2.0 (with power control via gpio)
- Buttons : Reset
- LEDs : 1x Power (green, gpio-controlled)
1x WAN (green, gpio-controlled)
1x WAN (red, gpio-controlled)
4x LAN (green, gpio-controlled)
2x USB (green)
- Power : 12 VDC, 1 A
Unsupported functions and limitations
-------------------------------------
1. XG-PON won't be available after installing OpenWrt.
Installation (stock layout, UART)
---------------------------------
1. Attach UART and run picocom:
picocom -b 115200 --send-cmd "sb -vv" /dev/ttyUSB0
2. Interrupt boot process by pressing Enter key to enter u-boot
Username: telecomadmin
Password: nE7jA%5m
3. Start download firmware via ymodem protocol (via UART):
loady 0x85000000
4. Press Ctrl + A then Ctrl + S in the picocom terminal (if you are using
a different terminal, please refer to the documentation) to start
upload OpenWrt initramfs image using ymodem protocol. Enter local path
to the OpenWrt initramfs image and press Enter.
5. Load OpenWrt initramfs image from the memory:
bootm 0x85000000
5. Sysupgrade with OpenWrt sysupgrade image
Alternative for the p.3-4. Load and boot OpenWrt initramfs from tftp IP
192.168.1.254:
tftpboot 0x85000000 192.168.1.254:openwrt-initramfs-uImage.itb
bootm 0x85000000
I was unable to download the file without errors, the bootloader network
driver is very unstable. Perhaps you will be more fortunate.
Backup and installation (stock layout, without UART)
----------------------------------------------------
1. Unplug Fiber
2. Make ONU Reset
3. Navigate: http://192.168.1.1
Username: CMCCAdmin
Password: aDm8H%MdA
4. Go to Apps -> Home Storage -> FTP and check Enable FTP
5. Go to Apps -> Home Storage -> SAMBA Sharing and check Enable Samba
6. Visit the following URL to open Telnet:
http://192.168.1.1/system.cgi?telnet
7. Telnet account login:
Username: user
Password: <see ONU label>
8. Get root privileges:
su user_ftp
Password: <see ONU label>
9. Copy 'squashfs-factory-kernel.bin', 'squashfs-factory-rootfs.bin' and
'OpenWrt.mtd2.u-boot-env.bin' (backup of 'u-boot-env' partition from
the another Nokia XG-040G-MD with OpenWrt installed)
9. Attach USB flash drive and check the new dir in /mnt:
ls /mnt
10. Change current dir to the flash drive (change D to your flash drive
label):
cd /mnt/D
11. Make backup:
for i in 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16; \
do cat /dev/mtd$i | gzip -9 > mtd$i.bin.gz; done
12. Check image sizes:
ls -l | awk '{if(NR>1) {$5=sprintf("0x%x", $5); print}}'
13. Write images:
mtd_debug erase /dev/mtd0 0x60000 0x20000
mtd_debug write /dev/mtd0 0x60000 0x20000 OpenWrt.mtd2.u-boot-env.bin
mtd_debug erase /dev/mtd14 0x0 0x2880000
mtd_debug write /dev/mtd14 0x0 0x3e6cfc squashfs-factory-kernel.bin
mtd_debug erase /dev/mtd11 0x0 0x80e0000
mtd_debug write /dev/mtd11 0x0 0x440000 squashfs-factory-rootfs.bin
0x3e6cfc - size of your 'squashfs-factory-kernel.bin'
0x440000 - size of your 'squashfs-factory-rootfs.bin'
14. Reboot:
reboot
Recovery (stock layout)
-----------------------
The same as described in Installation (UART).
Return to stock (stock layout)
------------------------------
1. Follow the steps 1-5 of the Installation (UART)
2. Once in OpenWrt upload you backup to the /tmp dir of the router:
scp -O mtd16.bin.gz root@192.168.1.1:/tmp
5. Connect to the router using ssh and install kmod-mtd-rw:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
6. Unlock bootloader:
mtd unlock bootloader
7. Restore stock:
zcat /tmp/mtd16.bin.gz | mtd write - all_flash
8. Reboot:
reboot
Notes (OpenWrt U-Boot layout)
-----------------------------
1. Only devices with SkyHigh ML02G300WHI00 spi-nand are supported. Driver
for FudanMicro FM25G02B is absent in current U-Boot.
2. A simple installation without serial console is also possible using a
fork of @dangowrt's UBI Installer
Link: https://github.com/dangowrt/owrt-ubi-installer
Installation / recovery (OpenWrt U-Boot layout)
-----------------------------------------------
1. Make sure that you have 'bosa' and 'ri' partitions mtd backups before
you start
2. Place OpenWrt images on the tftp server (IP: 192.168.1.254):
openwrt-airoha-an7581-nokia_xg-040g-md-ubi-bl31-uboot.fip
openwrt-airoha-an7581-nokia_xg-040g-md-ubi-initramfs-recovery.itb
openwrt-airoha-an7581-nokia_xg-040g-md-ubi-preloader.bin
3. Attach serial console and start terminal with XMODEM support:
picocom -b 115200 --send-cmd "sx -vvX" /dev/ttyUSB0
4. Push reset button and power on the router
5. Press 'x', then 'Ctrl + A' and 'Ctrl + S'
6. Paste full path to the bl2 image:
'openwrt-airoha-an7581-nokia_xg-040g-md-ubi-preloader.bin'
7. Wait until the file is downloaded and the following prompt appears:
Press x to load BL31 + U-Boot FIP
8. Press 'x', then 'Ctrl + A' and 'Ctrl + S'
9. Paste full path to the fip image:
'openwrt-airoha-an7581-nokia_xg-040g-md-ubi-bl31-uboot.fip'
10. Wait until the file is downloaded, u-boot will prepare ubi partition
automatically
11. Wait for U-Boot menu
12. Run 'Load BL31+U-Boot FIP via TFTP then write to NAND'
13. Run 'Load BL2 preloader via TFTP then write to NAND'
14. Run 'Boot system via TFTP'
15. Once in OpenWrt perform standard sysupgrade
16. Once in OpenWrt upload 'bosa' and 'ri' partitions mtd backups to the
/tmp dir using scp protocol
17. Check ID of the UBI volumes:
ubinfo -d 0 -N bosa | grep "Volume ID"
ubinfo -d 0 -N ri | grep "Volume ID"
18. Write backups according to the volume ID:
ubiupdatevol /dev/ubi0_2 /tmp/bosa.bin
ubiupdatevol /dev/ubi0_3 /tmp/ri.bin
19. Reboot:
reboot
Stock layout
------------
+-------+------------+---------+---------+
| mtd | label | start | size |
+-------+------------+---------+---------+
| mtd0 | bootloader | 0 | 80000 |
| mtd1 | romfile | 80000 | 40000 |
| mtd14 | nsb_master | c0000 | 2880000 |
| mtd15 | nsb_slave | 2940000 | 2880000 |
| mtd6 | bosa | 51c0000 | 40000 |
| mtd7 | ri | 5200000 | 40000 |
| mtd8 | flag | 5240000 | 40000 |
| mtd9 | flagback | 5280000 | 40000 |
| mtd10 | config | 52c0000 | a00000 |
| mtd11 | data | 5cc0000 | 80e0000 |
| mtd12 | oopsfs | dda0000 | 400000 |
| mtd13 | log | e1a0000 | a00000 |
+-------+------------+---------+---------+
USB power control
-----------------
Disable (both ports):
echo disabled > /sys/devices/platform/usb-power/state
Enable (both ports):
echo enabled > /sys/devices/platform/usb-power/state
UART
----
A view from the back side of the PCB:
------------------------
| GND RX TX
| X X X
Connection parameters:
115200, 8N1, 3.3V
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 04:xx:xx:xx:xx:0d | label |
| WAN | 04:xx:xx:xx:xx:0e | label + 1 |
+---------+-------------------+-----------+
The LAN MAC (hex) was found in 'ri', 0x3e
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23569
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add support for Nokia XG-040G-MD.
Known issues
------------
1. Reset button is currently doesn't work and cannot be used to start
tftp recovery:
Button 'reset' not found (err=-19)
LED 'green:power' not found (err=-19)
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23569
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This command is required to read and set device MAC address. The patch
was copied from mediatek target.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23569
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
-----
Hardware:
CPU: ARMADA 380 1x1332Mhz
RAM: 512MB DDR3
FLASH: 256MB MX30LF2G18AC
2x SATA III
2x USB3.0
1x USB2.0
i2c to control various states.
RTC with battery
1Gbit LAN (WoL capable)
9x LED
RESET button at back
Power button at front (gpio-poweroff)
Copy button at front
-----
Doesn't work
FAN control
buzzer
-----
UART connections
Connect UART to port J3 115200
+----+----+----+----+----+
|3.3V| TX | RX | | GND|
+----+----+----+ +----+
Depend of UART adapter board can fail to boot when adapter is attached. (all leds are dimmed) .
In that case disconnect UART for an < second and after that all leds should be white.
Stop u-boot by ctrl-c within 3s window. (bootdelay 7s or more helps)
setenv bootdelay 7
saveenv
-----
Instalation via UART
Boot initramfs-kernel.bin
setenv ethact egiga0
setenv serverip 192.168.1.11
setenv ipaddr 192.168.1.12
tftpboot 0x02000000 *initramfs-kernel.bin
bootm 0x02000000 -
Device is DHCP client by default ( as the other supported NAS)
do backup into safe space
/dev/mtd3 Kernel-1
/dev/mtd4 RootFS-1
use sysupgrade in console or via luci
-----
MAC addresses
mac stored in u-boot-env ethaddr
label mac = eth0 mac = 5c:6a:80:xx:xx:xx
-----
Setting up u-boot dual boot
u-boot contain two banks contain two OEM copies
To boot OpenWrt from bank1
setenv next_bootfrom 1
saveenv
To boot OEM from bank2
setenv next_bootfrom 2
saveenv
-----
Configuration via i2c
install i2c-tools
Enable WoL
i2cset -y 0x0 0xa 0xa 0x0006 w
Disable WoL
i2cset -y 0x0 0xa 0xa 0x0306 w
Enable auto power on
i2cset -y 0x0 0x0a 0x0a 0x0107 w
Disable auto power on
i2cset -y 0x0 0x0a 0x0a 0x0007 w
Signed-off-by: Robert Senderek <robert.senderek@10g.pl>
Link: https://github.com/openwrt/openwrt/pull/23228
Signed-off-by: Robert Marko <robimarko@gmail.com>
A patch was added without proper header.
Add a header that explains what the patch does and its prerequisites.
Fixes: e42e9c8133
Signed-off-by: Shine <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23917
Signed-off-by: Robert Marko <robimarko@gmail.com>
Due to POSIX style ioctl() declaration in MUSL, arm-trusted-firmware-tools
fails to build on MUSL based hosts with -Werror and -pedantic GCC switches
enabled. Alpine Linux, for example, fixes this with an unconditional cast
to "int". This commit tries to apply this cast only for MUSL based build
hosts, while keeping the type as-is where the cast isn't needed. Maybe
overkill, but cleaner than an unconditional cast.
Fixes: #13339
Signed-off-by: Shine <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/21957
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This commit introduces OpenWrt U-Boot all-in-ubi layout support
for the CreatLentem CLT-R30B1, enabling:
- Fully-featured U-Boot
- Effective recovery mechanisms
- Prolonged device lifetime by allocating most of the flash
to UBI (which takes care of wear-leveling)
- Maximum available storage space for OpenWrt
- Unified firmware across different device variants
OpenWrt U-Boot UBI flash instructions
-------------------------------------
Using the installer image
-------------------------
To simplify the installation process, this method uses a fork
of Daniel Golle's (@dangowrt) UBI Installer
https://github.com/dangowrt/owrt-ubi-installer
1. Ensure your router is running the latest generic OpenWrt firmware.
Upgrade it if necessary.
2. Obtain the installer image:
Build the installer from source
https://github.com/andros-ua/owrt-ubi-installer/tree/clt-r30b1
or download a prebuilt image from the
https://github.com/andros-ua/owrt-ubi-installer/releases
3. Flash the openwrt*creatlentem_clt-r30b1-ubi-initramfs-recovery-installer.itb
image using sysupgrade.
4. Wait for installation: the green status LED will blink rapidly,
indicating that the all-in-UBI installer is running.
5. Once the installation finishes,
the status LED will turn solid white (lime) for 5 seconds.
6. After the device reboots, perform a final sysupgrade using the
openwrt*creatlentem_clt-r30b1-ubi-squashfs-sysupgrade.itb image.
Return to stock layout
----------------------
1. Flash openwrt*creatlentem_clt-r30b1(-112m)-initramfs-kernel.bin
via sysupgrade
2. Copy files to /tmp on the device via SCP:
BL2.bin
u-boot-env.bin
Factory.bin
FIP.bin
openwrt*creatlentem_clt-r30b1(-112m)-squashfs-sysupgrade.bin
3. Restore stock MTD partitions:
apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd write /tmp/BL2.bin BL2
mtd write /tmp/u-boot-env.bin u-boot-env
mtd write /tmp/Factory.bin Factory
mtd write /tmp/FIP.bin FIP
4. Install the system:
sysupgrade /tmp/*sysupgrade.bin
Recovery
--------
Use mtk_uartboot to recover corrupted BL2 or FIP via UART:
https://github.com/981213/mtk_uartboot
Stock layout
----------------------------------------
| dev: size erasesize name |
| mtd0: 00100000 00020000 "BL2" |
| mtd1: 00080000 00020000 "u-boot-env" |
| mtd2: 00200000 00020000 "Factory" |
| mtd3: 00200000 00020000 "FIP" |
| mtd4: 07000000 00020000 "ubi" |
----------------------------------------
OpenWrt U-Boot UBI layout
----------------------------------
| dev: size erasesize name |
| mtd0: 00100000 00020000 "BL2" |
| mtd1: 07f00000 00020000 "ubi" |
----------------------------------
Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20666
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This board is the control board for the Antminer S9 miners.
SoC: Xilinx XC7Z010 - dual-core Cortex-A9 with FPGA stack
Memory: 512Mb DDR3
NIC: 1Gbit ethernet (BCM B50612E PHY)
Flash: 256Mb NAND (Micron MT29F2G08ABAEAWP)
Storage: SD-card slot
Other: control pins available via FPGA stack
Admittedly, there is a limited number of use cases available
for these boards outside of the miners and the lack of FPGA
tooling in OpenWrt. However, for one, they are easily and cheaply
available, for two, the reason for adding this is to provide an
easy addition to the boardfarm for continuous testing of this target.
Notes: For u-boot, an additional patch is required to support
booting from SD-cards. This is because EXTRA_ENV_SETTINGS is
already defined in the board's u-boot config, which is the same
place where the zynq-common.dtsi defines the required envvars.
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
This is unfortunately needed to disable the signature verification
in the stock bootloader.
Co-authored-by: Paul Spooren <mail@aparcar.org>
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Paul Spooren <mail@aparcar.org>
This is a dual-radio 802.11a/b/g/n/ac access point with
dual Gigabit Ethernet.
There are two closely related models: The AP-324, which has external
antenna connectors, and the AP-325, which has internal antennas.
The board appears to be identical, and the same image works on both.
Additionally, the Siemens Scalance W1750D is an OEM variant using
the same board, so the image also works on that.
Unfortunately the factory APBoot bootloader enforces cryptographic
signatures on the firmware before booting, so a modified version
must be flashed via the serial port. See [^1] for details.
Specifications
==============
* Device: Aruba AP-325 / AP-324
* SoC: Qualcomm IPQ8068 2x1.4GHz ARMv7-A
* RAM: 512MiB (2x Winbond W632GU6MB-12)
* SPI flash: 4MiB Macronix MX25U3235F
* NAND flash: 128MiB Winbond W29N01HZBINF
* WiFi: 2x Qualcomm QCA9990 (one 2.4G, one 5G)
* Ethernet: 2x 1000BASE-T (Marvell 88E1514 PHY), both PoE-capable
* Power: PoE 802.3at or 12V DC jack
* LEDs: Red/Amber/Green status LED, Amber/Green WiFi LED
* Buttons: 1x, behind hole next to DC jack
* Console: RJ45 connector, Cisco pinout
* USB: 1x USB 2.0 Type A, 1x internal to BLE, SoC has USB 3.0
host but board is only wired for 2.0
* BLE: TI CC2540 SoC, connected to USB and UART, unpopulated
debug header on PCB
* TPM: Atmel AT97SC3205T
How to install
==============
The stock bootloader APBoot appears to be vendor fork of U-Boot, which
disables much of the usual functionality and comes with its own booting
and firmware upgrade logic.
Unfortunately, this logic enforces RSA signatures on images,
even for the default boot from NAND.
Therefore, a patched bootloader is needed, which is built as a package.
In addition to the signature check removal, this also changes
the serial baudrate to 115200.
Luckily, the stock firmware does not disable the `sf` command
(it just hides it until you run `diag`), so the patched bootloader
can be fetched via TFTP and then flashed via console.
Flashing patched APBoot
-----------------------
* Build OpenWrt, or download `openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn`
* Connect serial cable and wired ethernet
* Access stock APBoot console at Baud 9600
* Flash patched bootloader:
```
setenv serverip <your TFTP server IP>
setenv autostart n
netget 44000000 openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn
sf probe 0
sf erase 220000 100000
sf write 44000000 220000 100000
reset
```
Booting OpenWrt
---------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Run `setenv serverip <your TFTP server IP>`
* Run `tftpboot openwrt-ipq806x-generic-aruba_ap-32x-initramfs.ari`
Installing OpenWrt
------------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Consider backing up stock firmware(s) (UBI volumes `aos0` and/or `aos1`)
by booting into OpenWrt via initramfs (see above) and dumping them
* Wipe and repartition NAND flash (see below for explanation):
```
nand device 0
nand erase.chip
reset
ubi part ubifs
ubi remove ubifs
ubi create ubifs 1
ubi create rootfs_data
```
* Follow steps above to boot OpenWrt via initramfs
* From OpenWrt, persist installation via sysupgrade
Reverting to stock FW
---------------------
The patched bootloader remains compatible with the original firmware,
so you can just wipe the NAND, let APBoot recreate the partitions,
and flash back the `aos0`/`aos1` backup from above.
Current status
==============
Tested and working
------------------
* Console
* Wired GbE (both ports)
* WiFi (both 2.4G and 5G)
* LEDs
* Restart Button
* USB port
* External watchdog
* TPM
* BLE SoC
Future work
-----------
* GPIOs for:
* power source (8 indicates DC jack, 59 indicates 802.3at)
* reset source (64 for warm reset, 65 for watchdog)
* USB overcurrent (63)
* BLE SoC reflashing
* CC2540 comes with Aruba-specific FW out of the box
* Debug header is exposed on PCB (pinout GND-VCC-Clock-Data-Reset),
but that requires disassembly
* Stock BLE FW appears to support reflashing via UART, but protocol
would need to be reverse-engineered
* ramoops/pstore
* It appears that APBoot clears the RAM on boot, might be something
we can patch out as well
* Porting a modern U-Boot
Flash layout
============
SPI flash
---------
```
0x000000-0x020000 sbl1
0x020000-0x040000 mibib
0x040000-0x080000 sbl2
0x080000-0x100000 sbl3
0x100000-0x110000 ddrconfig
0x110000-0x120000 ssd
0x120000-0x1a0000 tz
0x1a0000-0x220000 rpm
0x220000-0x320000 appsbl
0x320000-0x330000 appsblenv
0x330000-0x370000 art
0x370000-0x380000 panicdump
0x380000-0x390000 certificate
0x390000-0x3a0000 mfginfo
0x3a0000-0x3b0000 flashcache
0x3b0000-0x400000 aosspare
```
Factory NAND flash
------------------
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains kernel+initrd of the primary firmware,
initrd contains the entire root FS
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains kernel+initrd of the secondary firmware,
initrd contains the entire root FS
* 64MiB MTD partition `ubifs`, formatted as UBI
* 64MiB UBI volume `ubifs`
* Contains UBIFS, overlay-mounted on top of the initrd,
shared between firmware slots
APBoot understands UBI, and will read the kernel from the
`aos0` or `aos1` volume (depending on `os_partition`)
with fallback to the other one in case a check fails.
Kernels are expected to have a vendor-specific header, the included
script will add that header with the correct checksum but no signature.
OpenWrt NAND flash
------------------
OpenWrt assumes separate UBI volumes for kernel and rootfs,
as well as a volume that must be named `rootfs_data` for the UBIFS.
Unfortunately, APBoot actively checks the UBI volumes at boot, and will
repartition if it doesn't find the volumes that it expects (listed above).
Luckily, it doesn't check their size, only their existence. Therefore,
we can use the following layout:
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains OpenWrt kernel+initrd
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains OpenWrt root squashfs
* 64MiB MTD partition `ubifs`, formatted as UBI
* small (single-LEB) UBI volume `ubifs`
* Dummy volume, only there to satisfy APBoot
* almost 64MiB UBI volume `rootfs_data`
* contains UBIFS, overlay-mounted on top of the rootfs
[^1]: https://github.com/lukasstockner/ap325-apboot-openwrt
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Paul Spooren <mail@aparcar.org>
This is unfortunately needed to disable the signature verification
in the stock bootloader.
Co-authored-by: Paul Spooren <mail@aparcar.org>
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Test Dev <dev@example.org>
This is a dual-radio 802.11a/b/g/n/ac access point with
dual Gigabit Ethernet.
There are two closely related models: The AP-324, which has external
antenna connectors, and the AP-325, which has internal antennas.
The board appears to be identical, and the same image works on both.
Additionally, the Siemens Scalance W1750D is an OEM variant using
the same board, so the image also works on that.
Unfortunately the factory APBoot bootloader enforces cryptographic
signatures on the firmware before booting, so a modified version
must be flashed via the serial port. See [^1] for details.
Specifications
==============
* Device: Aruba AP-325 / AP-324
* SoC: Qualcomm IPQ8068 2x1.4GHz ARMv7-A
* RAM: 512MiB (2x Winbond W632GU6MB-12)
* SPI flash: 4MiB Macronix MX25U3235F
* NAND flash: 128MiB Winbond W29N01HZBINF
* WiFi: 2x Qualcomm QCA9990 (one 2.4G, one 5G)
* Ethernet: 2x 1000BASE-T (Marvell 88E1514 PHY), both PoE-capable
* Power: PoE 802.3at or 12V DC jack
* LEDs: Red/Amber/Green status LED, Amber/Green WiFi LED
* Buttons: 1x, behind hole next to DC jack
* Console: RJ45 connector, Cisco pinout
* USB: 1x USB 2.0 Type A, 1x internal to BLE, SoC has USB 3.0
host but board is only wired for 2.0
* BLE: TI CC2540 SoC, connected to USB and UART, unpopulated
debug header on PCB
* TPM: Atmel AT97SC3205T
How to install
==============
The stock bootloader APBoot appears to be vendor fork of U-Boot, which
disables much of the usual functionality and comes with its own booting
and firmware upgrade logic.
Unfortunately, this logic enforces RSA signatures on images,
even for the default boot from NAND.
Therefore, a patched bootloader is needed, which is built as a package.
In addition to the signature check removal, this also changes
the serial baudrate to 115200.
Luckily, the stock firmware does not disable the `sf` command
(it just hides it until you run `diag`), so the patched bootloader
can be fetched via TFTP and then flashed via console.
Flashing patched APBoot
-----------------------
* Build OpenWrt, or download `openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn`
* Connect serial cable and wired ethernet
* Access stock APBoot console at Baud 9600
* Flash patched bootloader:
```
setenv serverip <your TFTP server IP>
setenv autostart n
netget 44000000 openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn
sf probe 0
sf erase 220000 100000
sf write 44000000 220000 100000
reset
```
Booting OpenWrt
---------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Run `setenv serverip <your TFTP server IP>`
* Run `tftpboot openwrt-ipq806x-generic-aruba_ap-32x-initramfs.ari`
Installing OpenWrt
------------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Consider backing up stock firmware(s) (UBI volumes `aos0` and/or `aos1`)
by booting into OpenWrt via initramfs (see above) and dumping them
* Wipe and repartition NAND flash (see below for explanation):
```
nand device 0
nand erase.chip
reset
ubi part ubifs
ubi remove ubifs
ubi create ubifs 1
ubi create rootfs_data
```
* Follow steps above to boot OpenWrt via initramfs
* From OpenWrt, persist installation via sysupgrade
Reverting to stock FW
---------------------
The patched bootloader remains compatible with the original firmware,
so you can just wipe the NAND, let APBoot recreate the partitions,
and flash back the `aos0`/`aos1` backup from above.
Current status
==============
Tested and working
------------------
* Console
* Wired GbE (both ports)
* WiFi (both 2.4G and 5G)
* LEDs
* Restart Button
* USB port
* External watchdog
* TPM
* BLE SoC
Future work
-----------
* GPIOs for:
* power source (8 indicates DC jack, 59 indicates 802.3at)
* reset source (64 for warm reset, 65 for watchdog)
* USB overcurrent (63)
* BLE SoC reflashing
* CC2540 comes with Aruba-specific FW out of the box
* Debug header is exposed on PCB (pinout GND-VCC-Clock-Data-Reset),
but that requires disassembly
* Stock BLE FW appears to support reflashing via UART, but protocol
would need to be reverse-engineered
* ramoops/pstore
* It appears that APBoot clears the RAM on boot, might be something
we can patch out as well
* Porting a modern U-Boot
Flash layout
============
SPI flash
---------
```
0x000000-0x020000 sbl1
0x020000-0x040000 mibib
0x040000-0x080000 sbl2
0x080000-0x100000 sbl3
0x100000-0x110000 ddrconfig
0x110000-0x120000 ssd
0x120000-0x1a0000 tz
0x1a0000-0x220000 rpm
0x220000-0x320000 appsbl
0x320000-0x330000 appsblenv
0x330000-0x370000 art
0x370000-0x380000 panicdump
0x380000-0x390000 certificate
0x390000-0x3a0000 mfginfo
0x3a0000-0x3b0000 flashcache
0x3b0000-0x400000 aosspare
```
Factory NAND flash
------------------
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains kernel+initrd of the primary firmware,
initrd contains the entire root FS
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains kernel+initrd of the secondary firmware,
initrd contains the entire root FS
* 64MiB MTD partition `ubifs`, formatted as UBI
* 64MiB UBI volume `ubifs`
* Contains UBIFS, overlay-mounted on top of the initrd,
shared between firmware slots
APBoot understands UBI, and will read the kernel from the
`aos0` or `aos1` volume (depending on `os_partition`)
with fallback to the other one in case a check fails.
Kernels are expected to have a vendor-specific header, the included
script will add that header with the correct checksum but no signature.
OpenWrt NAND flash
------------------
OpenWrt assumes separate UBI volumes for kernel and rootfs,
as well as a volume that must be named `rootfs_data` for the UBIFS.
Unfortunately, APBoot actively checks the UBI volumes at boot, and will
repartition if it doesn't find the volumes that it expects (listed above).
Luckily, it doesn't check their size, only their existence. Therefore,
we can use the following layout:
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains OpenWrt kernel+initrd
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains OpenWrt root squashfs
* 64MiB MTD partition `ubifs`, formatted as UBI
* small (single-LEB) UBI volume `ubifs`
* Dummy volume, only there to satisfy APBoot
* almost 64MiB UBI volume `rootfs_data`
* contains UBIFS, overlay-mounted on top of the rootfs
[^1]: https://github.com/lukasstockner/ap325-apboot-openwrt
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Test Dev <dev@example.org>
