-----
Hardware:
CPU: ARMADA 380 1x1332Mhz
RAM: 512MB DDR3
FLASH: 256MB MX30LF2G18AC
2x SATA III
2x USB3.0
1x USB2.0
i2c to control various states.
RTC with battery
1Gbit LAN (WoL capable)
9x LED
RESET button at back
Power button at front (gpio-poweroff)
Copy button at front
-----
Doesn't work
FAN control
buzzer
-----
UART connections
Connect UART to port J3 115200
+----+----+----+----+----+
|3.3V| TX | RX | | GND|
+----+----+----+ +----+
Depend of UART adapter board can fail to boot when adapter is attached. (all leds are dimmed) .
In that case disconnect UART for an < second and after that all leds should be white.
Stop u-boot by ctrl-c within 3s window. (bootdelay 7s or more helps)
setenv bootdelay 7
saveenv
-----
Instalation via UART
Boot initramfs-kernel.bin
setenv ethact egiga0
setenv serverip 192.168.1.11
setenv ipaddr 192.168.1.12
tftpboot 0x02000000 *initramfs-kernel.bin
bootm 0x02000000 -
Device is DHCP client by default ( as the other supported NAS)
do backup into safe space
/dev/mtd3 Kernel-1
/dev/mtd4 RootFS-1
use sysupgrade in console or via luci
-----
MAC addresses
mac stored in u-boot-env ethaddr
label mac = eth0 mac = 5c:6a:80:xx:xx:xx
-----
Setting up u-boot dual boot
u-boot contain two banks contain two OEM copies
To boot OpenWrt from bank1
setenv next_bootfrom 1
saveenv
To boot OEM from bank2
setenv next_bootfrom 2
saveenv
-----
Configuration via i2c
install i2c-tools
Enable WoL
i2cset -y 0x0 0xa 0xa 0x0006 w
Disable WoL
i2cset -y 0x0 0xa 0xa 0x0306 w
Enable auto power on
i2cset -y 0x0 0x0a 0x0a 0x0107 w
Disable auto power on
i2cset -y 0x0 0x0a 0x0a 0x0007 w
Signed-off-by: Robert Senderek <robert.senderek@10g.pl>
Link: https://github.com/openwrt/openwrt/pull/23228
Signed-off-by: Robert Marko <robimarko@gmail.com>
A patch was added without proper header.
Add a header that explains what the patch does and its prerequisites.
Fixes: e42e9c8133
Signed-off-by: Shine <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23917
Signed-off-by: Robert Marko <robimarko@gmail.com>
Due to POSIX style ioctl() declaration in MUSL, arm-trusted-firmware-tools
fails to build on MUSL based hosts with -Werror and -pedantic GCC switches
enabled. Alpine Linux, for example, fixes this with an unconditional cast
to "int". This commit tries to apply this cast only for MUSL based build
hosts, while keeping the type as-is where the cast isn't needed. Maybe
overkill, but cleaner than an unconditional cast.
Fixes: #13339
Signed-off-by: Shine <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/21957
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This commit introduces OpenWrt U-Boot all-in-ubi layout support
for the CreatLentem CLT-R30B1, enabling:
- Fully-featured U-Boot
- Effective recovery mechanisms
- Prolonged device lifetime by allocating most of the flash
to UBI (which takes care of wear-leveling)
- Maximum available storage space for OpenWrt
- Unified firmware across different device variants
OpenWrt U-Boot UBI flash instructions
-------------------------------------
Using the installer image
-------------------------
To simplify the installation process, this method uses a fork
of Daniel Golle's (@dangowrt) UBI Installer
https://github.com/dangowrt/owrt-ubi-installer
1. Ensure your router is running the latest generic OpenWrt firmware.
Upgrade it if necessary.
2. Obtain the installer image:
Build the installer from source
https://github.com/andros-ua/owrt-ubi-installer/tree/clt-r30b1
or download a prebuilt image from the
https://github.com/andros-ua/owrt-ubi-installer/releases
3. Flash the openwrt*creatlentem_clt-r30b1-ubi-initramfs-recovery-installer.itb
image using sysupgrade.
4. Wait for installation: the green status LED will blink rapidly,
indicating that the all-in-UBI installer is running.
5. Once the installation finishes,
the status LED will turn solid white (lime) for 5 seconds.
6. After the device reboots, perform a final sysupgrade using the
openwrt*creatlentem_clt-r30b1-ubi-squashfs-sysupgrade.itb image.
Return to stock layout
----------------------
1. Flash openwrt*creatlentem_clt-r30b1(-112m)-initramfs-kernel.bin
via sysupgrade
2. Copy files to /tmp on the device via SCP:
BL2.bin
u-boot-env.bin
Factory.bin
FIP.bin
openwrt*creatlentem_clt-r30b1(-112m)-squashfs-sysupgrade.bin
3. Restore stock MTD partitions:
apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd write /tmp/BL2.bin BL2
mtd write /tmp/u-boot-env.bin u-boot-env
mtd write /tmp/Factory.bin Factory
mtd write /tmp/FIP.bin FIP
4. Install the system:
sysupgrade /tmp/*sysupgrade.bin
Recovery
--------
Use mtk_uartboot to recover corrupted BL2 or FIP via UART:
https://github.com/981213/mtk_uartboot
Stock layout
----------------------------------------
| dev: size erasesize name |
| mtd0: 00100000 00020000 "BL2" |
| mtd1: 00080000 00020000 "u-boot-env" |
| mtd2: 00200000 00020000 "Factory" |
| mtd3: 00200000 00020000 "FIP" |
| mtd4: 07000000 00020000 "ubi" |
----------------------------------------
OpenWrt U-Boot UBI layout
----------------------------------
| dev: size erasesize name |
| mtd0: 00100000 00020000 "BL2" |
| mtd1: 07f00000 00020000 "ubi" |
----------------------------------
Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20666
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This board is the control board for the Antminer S9 miners.
SoC: Xilinx XC7Z010 - dual-core Cortex-A9 with FPGA stack
Memory: 512Mb DDR3
NIC: 1Gbit ethernet (BCM B50612E PHY)
Flash: 256Mb NAND (Micron MT29F2G08ABAEAWP)
Storage: SD-card slot
Other: control pins available via FPGA stack
Admittedly, there is a limited number of use cases available
for these boards outside of the miners and the lack of FPGA
tooling in OpenWrt. However, for one, they are easily and cheaply
available, for two, the reason for adding this is to provide an
easy addition to the boardfarm for continuous testing of this target.
Notes: For u-boot, an additional patch is required to support
booting from SD-cards. This is because EXTRA_ENV_SETTINGS is
already defined in the board's u-boot config, which is the same
place where the zynq-common.dtsi defines the required envvars.
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
This is unfortunately needed to disable the signature verification
in the stock bootloader.
Co-authored-by: Paul Spooren <mail@aparcar.org>
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Paul Spooren <mail@aparcar.org>
This is a dual-radio 802.11a/b/g/n/ac access point with
dual Gigabit Ethernet.
There are two closely related models: The AP-324, which has external
antenna connectors, and the AP-325, which has internal antennas.
The board appears to be identical, and the same image works on both.
Additionally, the Siemens Scalance W1750D is an OEM variant using
the same board, so the image also works on that.
Unfortunately the factory APBoot bootloader enforces cryptographic
signatures on the firmware before booting, so a modified version
must be flashed via the serial port. See [^1] for details.
Specifications
==============
* Device: Aruba AP-325 / AP-324
* SoC: Qualcomm IPQ8068 2x1.4GHz ARMv7-A
* RAM: 512MiB (2x Winbond W632GU6MB-12)
* SPI flash: 4MiB Macronix MX25U3235F
* NAND flash: 128MiB Winbond W29N01HZBINF
* WiFi: 2x Qualcomm QCA9990 (one 2.4G, one 5G)
* Ethernet: 2x 1000BASE-T (Marvell 88E1514 PHY), both PoE-capable
* Power: PoE 802.3at or 12V DC jack
* LEDs: Red/Amber/Green status LED, Amber/Green WiFi LED
* Buttons: 1x, behind hole next to DC jack
* Console: RJ45 connector, Cisco pinout
* USB: 1x USB 2.0 Type A, 1x internal to BLE, SoC has USB 3.0
host but board is only wired for 2.0
* BLE: TI CC2540 SoC, connected to USB and UART, unpopulated
debug header on PCB
* TPM: Atmel AT97SC3205T
How to install
==============
The stock bootloader APBoot appears to be vendor fork of U-Boot, which
disables much of the usual functionality and comes with its own booting
and firmware upgrade logic.
Unfortunately, this logic enforces RSA signatures on images,
even for the default boot from NAND.
Therefore, a patched bootloader is needed, which is built as a package.
In addition to the signature check removal, this also changes
the serial baudrate to 115200.
Luckily, the stock firmware does not disable the `sf` command
(it just hides it until you run `diag`), so the patched bootloader
can be fetched via TFTP and then flashed via console.
Flashing patched APBoot
-----------------------
* Build OpenWrt, or download `openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn`
* Connect serial cable and wired ethernet
* Access stock APBoot console at Baud 9600
* Flash patched bootloader:
```
setenv serverip <your TFTP server IP>
setenv autostart n
netget 44000000 openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn
sf probe 0
sf erase 220000 100000
sf write 44000000 220000 100000
reset
```
Booting OpenWrt
---------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Run `setenv serverip <your TFTP server IP>`
* Run `tftpboot openwrt-ipq806x-generic-aruba_ap-32x-initramfs.ari`
Installing OpenWrt
------------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Consider backing up stock firmware(s) (UBI volumes `aos0` and/or `aos1`)
by booting into OpenWrt via initramfs (see above) and dumping them
* Wipe and repartition NAND flash (see below for explanation):
```
nand device 0
nand erase.chip
reset
ubi part ubifs
ubi remove ubifs
ubi create ubifs 1
ubi create rootfs_data
```
* Follow steps above to boot OpenWrt via initramfs
* From OpenWrt, persist installation via sysupgrade
Reverting to stock FW
---------------------
The patched bootloader remains compatible with the original firmware,
so you can just wipe the NAND, let APBoot recreate the partitions,
and flash back the `aos0`/`aos1` backup from above.
Current status
==============
Tested and working
------------------
* Console
* Wired GbE (both ports)
* WiFi (both 2.4G and 5G)
* LEDs
* Restart Button
* USB port
* External watchdog
* TPM
* BLE SoC
Future work
-----------
* GPIOs for:
* power source (8 indicates DC jack, 59 indicates 802.3at)
* reset source (64 for warm reset, 65 for watchdog)
* USB overcurrent (63)
* BLE SoC reflashing
* CC2540 comes with Aruba-specific FW out of the box
* Debug header is exposed on PCB (pinout GND-VCC-Clock-Data-Reset),
but that requires disassembly
* Stock BLE FW appears to support reflashing via UART, but protocol
would need to be reverse-engineered
* ramoops/pstore
* It appears that APBoot clears the RAM on boot, might be something
we can patch out as well
* Porting a modern U-Boot
Flash layout
============
SPI flash
---------
```
0x000000-0x020000 sbl1
0x020000-0x040000 mibib
0x040000-0x080000 sbl2
0x080000-0x100000 sbl3
0x100000-0x110000 ddrconfig
0x110000-0x120000 ssd
0x120000-0x1a0000 tz
0x1a0000-0x220000 rpm
0x220000-0x320000 appsbl
0x320000-0x330000 appsblenv
0x330000-0x370000 art
0x370000-0x380000 panicdump
0x380000-0x390000 certificate
0x390000-0x3a0000 mfginfo
0x3a0000-0x3b0000 flashcache
0x3b0000-0x400000 aosspare
```
Factory NAND flash
------------------
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains kernel+initrd of the primary firmware,
initrd contains the entire root FS
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains kernel+initrd of the secondary firmware,
initrd contains the entire root FS
* 64MiB MTD partition `ubifs`, formatted as UBI
* 64MiB UBI volume `ubifs`
* Contains UBIFS, overlay-mounted on top of the initrd,
shared between firmware slots
APBoot understands UBI, and will read the kernel from the
`aos0` or `aos1` volume (depending on `os_partition`)
with fallback to the other one in case a check fails.
Kernels are expected to have a vendor-specific header, the included
script will add that header with the correct checksum but no signature.
OpenWrt NAND flash
------------------
OpenWrt assumes separate UBI volumes for kernel and rootfs,
as well as a volume that must be named `rootfs_data` for the UBIFS.
Unfortunately, APBoot actively checks the UBI volumes at boot, and will
repartition if it doesn't find the volumes that it expects (listed above).
Luckily, it doesn't check their size, only their existence. Therefore,
we can use the following layout:
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains OpenWrt kernel+initrd
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains OpenWrt root squashfs
* 64MiB MTD partition `ubifs`, formatted as UBI
* small (single-LEB) UBI volume `ubifs`
* Dummy volume, only there to satisfy APBoot
* almost 64MiB UBI volume `rootfs_data`
* contains UBIFS, overlay-mounted on top of the rootfs
[^1]: https://github.com/lukasstockner/ap325-apboot-openwrt
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Paul Spooren <mail@aparcar.org>
This is unfortunately needed to disable the signature verification
in the stock bootloader.
Co-authored-by: Paul Spooren <mail@aparcar.org>
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Test Dev <dev@example.org>
This is a dual-radio 802.11a/b/g/n/ac access point with
dual Gigabit Ethernet.
There are two closely related models: The AP-324, which has external
antenna connectors, and the AP-325, which has internal antennas.
The board appears to be identical, and the same image works on both.
Additionally, the Siemens Scalance W1750D is an OEM variant using
the same board, so the image also works on that.
Unfortunately the factory APBoot bootloader enforces cryptographic
signatures on the firmware before booting, so a modified version
must be flashed via the serial port. See [^1] for details.
Specifications
==============
* Device: Aruba AP-325 / AP-324
* SoC: Qualcomm IPQ8068 2x1.4GHz ARMv7-A
* RAM: 512MiB (2x Winbond W632GU6MB-12)
* SPI flash: 4MiB Macronix MX25U3235F
* NAND flash: 128MiB Winbond W29N01HZBINF
* WiFi: 2x Qualcomm QCA9990 (one 2.4G, one 5G)
* Ethernet: 2x 1000BASE-T (Marvell 88E1514 PHY), both PoE-capable
* Power: PoE 802.3at or 12V DC jack
* LEDs: Red/Amber/Green status LED, Amber/Green WiFi LED
* Buttons: 1x, behind hole next to DC jack
* Console: RJ45 connector, Cisco pinout
* USB: 1x USB 2.0 Type A, 1x internal to BLE, SoC has USB 3.0
host but board is only wired for 2.0
* BLE: TI CC2540 SoC, connected to USB and UART, unpopulated
debug header on PCB
* TPM: Atmel AT97SC3205T
How to install
==============
The stock bootloader APBoot appears to be vendor fork of U-Boot, which
disables much of the usual functionality and comes with its own booting
and firmware upgrade logic.
Unfortunately, this logic enforces RSA signatures on images,
even for the default boot from NAND.
Therefore, a patched bootloader is needed, which is built as a package.
In addition to the signature check removal, this also changes
the serial baudrate to 115200.
Luckily, the stock firmware does not disable the `sf` command
(it just hides it until you run `diag`), so the patched bootloader
can be fetched via TFTP and then flashed via console.
Flashing patched APBoot
-----------------------
* Build OpenWrt, or download `openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn`
* Connect serial cable and wired ethernet
* Access stock APBoot console at Baud 9600
* Flash patched bootloader:
```
setenv serverip <your TFTP server IP>
setenv autostart n
netget 44000000 openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn
sf probe 0
sf erase 220000 100000
sf write 44000000 220000 100000
reset
```
Booting OpenWrt
---------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Run `setenv serverip <your TFTP server IP>`
* Run `tftpboot openwrt-ipq806x-generic-aruba_ap-32x-initramfs.ari`
Installing OpenWrt
------------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Consider backing up stock firmware(s) (UBI volumes `aos0` and/or `aos1`)
by booting into OpenWrt via initramfs (see above) and dumping them
* Wipe and repartition NAND flash (see below for explanation):
```
nand device 0
nand erase.chip
reset
ubi part ubifs
ubi remove ubifs
ubi create ubifs 1
ubi create rootfs_data
```
* Follow steps above to boot OpenWrt via initramfs
* From OpenWrt, persist installation via sysupgrade
Reverting to stock FW
---------------------
The patched bootloader remains compatible with the original firmware,
so you can just wipe the NAND, let APBoot recreate the partitions,
and flash back the `aos0`/`aos1` backup from above.
Current status
==============
Tested and working
------------------
* Console
* Wired GbE (both ports)
* WiFi (both 2.4G and 5G)
* LEDs
* Restart Button
* USB port
* External watchdog
* TPM
* BLE SoC
Future work
-----------
* GPIOs for:
* power source (8 indicates DC jack, 59 indicates 802.3at)
* reset source (64 for warm reset, 65 for watchdog)
* USB overcurrent (63)
* BLE SoC reflashing
* CC2540 comes with Aruba-specific FW out of the box
* Debug header is exposed on PCB (pinout GND-VCC-Clock-Data-Reset),
but that requires disassembly
* Stock BLE FW appears to support reflashing via UART, but protocol
would need to be reverse-engineered
* ramoops/pstore
* It appears that APBoot clears the RAM on boot, might be something
we can patch out as well
* Porting a modern U-Boot
Flash layout
============
SPI flash
---------
```
0x000000-0x020000 sbl1
0x020000-0x040000 mibib
0x040000-0x080000 sbl2
0x080000-0x100000 sbl3
0x100000-0x110000 ddrconfig
0x110000-0x120000 ssd
0x120000-0x1a0000 tz
0x1a0000-0x220000 rpm
0x220000-0x320000 appsbl
0x320000-0x330000 appsblenv
0x330000-0x370000 art
0x370000-0x380000 panicdump
0x380000-0x390000 certificate
0x390000-0x3a0000 mfginfo
0x3a0000-0x3b0000 flashcache
0x3b0000-0x400000 aosspare
```
Factory NAND flash
------------------
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains kernel+initrd of the primary firmware,
initrd contains the entire root FS
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains kernel+initrd of the secondary firmware,
initrd contains the entire root FS
* 64MiB MTD partition `ubifs`, formatted as UBI
* 64MiB UBI volume `ubifs`
* Contains UBIFS, overlay-mounted on top of the initrd,
shared between firmware slots
APBoot understands UBI, and will read the kernel from the
`aos0` or `aos1` volume (depending on `os_partition`)
with fallback to the other one in case a check fails.
Kernels are expected to have a vendor-specific header, the included
script will add that header with the correct checksum but no signature.
OpenWrt NAND flash
------------------
OpenWrt assumes separate UBI volumes for kernel and rootfs,
as well as a volume that must be named `rootfs_data` for the UBIFS.
Unfortunately, APBoot actively checks the UBI volumes at boot, and will
repartition if it doesn't find the volumes that it expects (listed above).
Luckily, it doesn't check their size, only their existence. Therefore,
we can use the following layout:
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains OpenWrt kernel+initrd
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains OpenWrt root squashfs
* 64MiB MTD partition `ubifs`, formatted as UBI
* small (single-LEB) UBI volume `ubifs`
* Dummy volume, only there to satisfy APBoot
* almost 64MiB UBI volume `rootfs_data`
* contains UBIFS, overlay-mounted on top of the rootfs
[^1]: https://github.com/lukasstockner/ap325-apboot-openwrt
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Test Dev <dev@example.org>
Add basic support for the TP-Link SG2008P V3 variant. The switch appears
to be identical to the V1 variant, except that it uses the MP3924
instead of the TPS23861 PoE chip.
Specifications:
---------------
* SoC: Realtek RTL8380M
* Flash: 32 MiB SPI flash (Vendor varies)
* RAM: 256 MiB (Vendor varies)
* Ethernet: 8x 10/100/1000 Mbps with PoE on 4 ports
* Buttons: 1x "Reset" button on front panel
* Power: 53.5V DC barrel jack
* UART: 1x serial header, unpopulated
* PoE: 1x MPS MP3924 I2C PoE controller
Works:
------
- (8) RJ-45 ethernet ports
- Switch functions
- System LED
- Basic PoE support (no driver, but a startup script puts the chip
into AUTO mode)
Not yet enabled:
----------------
- PoE, Link/Act, PoE max and System LEDs
Install via web interface:
-------------------------
Not supported at this time.
Install via serial console/tftp:
--------------------------------
The footprints R27 (0201) and R28 (0402) are not populated. To enable
serial console, 50 ohm resistors should be soldered -- any value from
0 ohm to 50 ohm will work. R27 can be replaced by a solder bridge.
The u-boot firmware drops to a TP-Link specific "BOOTUTIL" shell at
38400 baud. There is no known way to exit out of this shell, and no
way to do anything useful.
Ideally, one would trick the bootloader into flashing the sysupgrade
image first. However, if the image exceeds 6MiB in size, it will not
work. The sysupgrade image can also be flashed. To install OpenWRT:
Prepare a tftp server with:
1. server address: 192.168.0.146
2. the image as: "uImage.img"
Power on device, and stop boot by pressing any key.
Once the shell is active:
1. Ground out the CLK (pin 16) of the ROM (U7)
2. Select option "3. Start"
3. Bootloader notes that "The kernel has been damaged!"
4. Release CLK as sson as bootloader thinks image is corrupted.
5. Bootloader enters automatic recovery -- details printed on console
6. Watch as the bootloader flashes and boots OpenWRT.
Blind install via tftp:
-----------------------
This method works when it's not feasible to install a serial header.
Prepare a tftp server with:
1. server address: 192.168.0.146
2. the image as: "uImage.img"
3. Watch network traffic (tcpdump or wireshark works)
4. Power on the device.
5. Wait 1-2 seconds then ground out the CLK (pin 16) of the ROM (U7)
6. When 192.168.0.30 makes tftp requests, release pin 16
7. Wait 2-3 minutes for device to auto-flash and boot OpenWRT
Signed-off-by: Daniel Tang <tangrs@google.com>
Link: https://github.com/openwrt/openwrt/pull/20616
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add config for WAVLINK WL-WN536AX6 Rev a to be able to read and write U-Boot environment variables.
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23682
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The u-boot build for mediatek ARM SoCs doesn't require pylibfdt. We
can use pre-build kernel DTC to save some build time.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Remove upstreamed patches:
001-pinctrl-mediatek-MT7981-fix-GPIO9-register-map.patch [1]
010-clk-mediatek-mt7622-fix-infracfg-and-pericfg-clock-o.patch [2]
We also need to backport two new patches from v2026.07-rc2 to address
the yaml build error[3] and MT7621 boot issue[4].
[1] a1d1fc8d8c
[2] 52d84fccfd
[3] 8ef8dee4f3
[4] de79075f0f
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Patch 280 was already included in u-boot v2022.07.
Link: 5f2d5915f8
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Suggested-by: Daniel Golle <daniel@makrotopia.org>
This is the last version supporting the boards omap3_beagle and omap4_panda.
Because we use a boot script we need to enable CONFIG_LEGACY_IMAGE_FORMAT.
Signed-off-by: Andre Heider <a.heider@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22728
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Vendor U-Boot stores its environment at offset 0x2000 inside the
"config" partition (size 0x4000). The offset is not erase-block
aligned, so the fw_env tool's alignment check rejects the natural
secsize=0x20000. Declaring secsize=0x2000 passes the check, lets
fw_printenv read the real env (factory_mac, hw_version,
bundle_number, ...), and causes fw_setenv to fail cleanly on erase
rather than corrupting anything (the kernel rejects sub-erase-block
MEMERASE).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Florian Maurer <fmaurer@disroot.org>
Link: https://github.com/openwrt/openwrt/pull/23192
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This pull request is based on
- the discussions in https://forum.openwrt.org/t/support-for-the-linksys-mr9000
Device Specs:
- Router is similar to EA8300 but with 512MB RAM and changed GPIOs
- IPQ4019
- Quad Core CPU
- 512 MB RAM
- 256 MB FLASH
- 4 LAN ports, 1 WAN port
- 1x2.4GHz (802.11n) and 2x5GHz (802.11c) wifi
- 3 LEDs (Red, blue, green) which are routed to one indicator at the top of the case
- 2 buttons (Reset, WPS)
Disassembling the device:
- There are 4 T10 screws at the bottom of the device which must be removed
- All 4 screws are located under the rubber feet
Serial interface:
- The serial interface is already populated on the device with a 5-pin header
- Pinout from front to back: 1:GND, 2: unknown, 3: RX, 4: TX, 5: VCC
- Settings: 115200, 8N1
MAC address layout:
- Same as on MR8300
- MAC address is stored in the "devinfo" partition (entry "hw_mac_addr")
- The MAC address on the label is identical with the one in the devinfo partition
- The MAC address on the label is the WAN MAC address
- LAN MAC address is the one from the label + 1
- Wifi (2.4GHz) MAC is the one from the label + 2
- Wifi (1st 5GHz) MAC is the one from the label + 3
- Wifi (2nd 5GHz) MAC is the one from the label + 4
Migrating to OpenWrt requires multiple steps:
- Load and boot the initramfs image
- Adapt U-Boot settings to support bigger kernels
- Flash the sysupgrade image
Load and boot initramfs:
- Connect serial interface
- Set up a TFTP server on IP 192.168.1.254
- Copy openwrt-ipq40xx-generic-linksys_mr9000-initramfs-zImage.itb to TFTP server
- Rename file to C0A80101.img
- Boot up the device and stop in U-Boot
- Run the following U-Boot commands after a link has been established:
tftp
bootm
- Initramfs image is started now.
Adapt U-Boot settings to support bigger kernels:
- Run "fw_printenv" in the initramfs image after booting
- There should be an entry kernsize=300000 which indicates the maximum size for the kernel is 3MB
- Execute "fw_setenv kernsize 500000" to increase the max kernel size to 5MB
- Check that the change are applied with "fw_printenv"
Flash the sysupgrade image:
- Default sysupgrade routine either with a initramfs image containing LuCI or via command line.
Revert back to OEM firmware:
- Flash the OEM firmware via sysupgrade
- Forced update is required
Signed-off-by: Karsten Rehn <rekados@posteo.de>
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22744
Signed-off-by: Robert Marko <robimarko@gmail.com>
This tool requires gnutls. In fact, we do not have to build it.
Fix build error:
tools/mkeficapsule.c:20:10: fatal error: gnutls/gnutls.h: No such file or directory
20 | #include <gnutls/gnutls.h>
| ^~~~~~~~~~~~~~~~~
Fixes: 158651a6d7 ("uboot-imx: bump to 2026.04 release")
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23635
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Build ATF images for i.MX8MP. Tested on Kontron OSM-S/BL i.MX8MP.
The default IMX_BOOT_UART_BASE for imx8mp platforms is 0x30890000, which
would be UART2. The Kontron board however uses UART3 as serial debug
console. As a result, after loading BL31 the system hangs.
Setting IMX_BOOT_UART_BASE=auto will fix it.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
This version supports boards with 1.5GB or 3GB of RAM.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/23360
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
ELECOM WRC-X3000GST2 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router based on
IPQ5018. The only hardware difference from the WRC-X3000GS2 is the RAM
capacity; all other peripherals are identical. This port therefore
reuses the GS2 board-2.bin (ipq-wifi-elecom_wrc-x3000gs2) and ath11k
calibration variant.
Specification:
- SoC : Qualcomm IPQ5018
- RAM : DDR3 512 MiB (Kingston Technology D2516ECMDXGJD)
- Flash : SPI-NAND 128 MiB (Macronix MX35UF1G24AD-Z4I)
- WLAN : 2.4/5 GHz 2T2R
- 2.4 GHz : Qualcomm IPQ5018 (SoC)
- 5 GHz : Qualcomm QCN6122
- Ethernet : 5x 10/100/1000 Mbps
- wan (phy) : Qualcomm IPQ5018 (SoC)
- lan (switch) : Qualcomm Atheros QCA8337
- LEDs/Keys (GPIO): 8x / 3x (reset, WPS, router/AP slide switch)
- UART : through-hole on PCB, 4pins near the barcode
- assignment : 3.3V, TX, RX, NC, GND from the barcode side
- settings : 115200n8
- Power : 12 VDC, 1 A (Max. 11.5W)
Flash instruction using factory.bin image:
1. Boot WRC-X3000GST2 normally in router mode
2. Access the WebUI ("http://192.168.2.1/") and open the firmware
update page ("ファームウェア更新")
3. Select the OpenWrt factory.bin image and click apply ("適用")
4. After the device reboots automatically, wait until the green power LED
stops blinking and stays solid
5. When the green power LED is solid, hold the reset button until the red
LED starts blinking to clear remaining stock firmware settings
Switching to the stock firmware:
1. Load the elecom.sh script
. /lib/upgrade/elecom.sh
2. Check the current index of rootfs
bootconfig_rw_index 0:bootconfig rootfs
3. Set the index to inverted value
bootconfig_rw_index 0:bootconfig rootfs <value>
bootconfig_rw_index 0:bootconfig1 rootfs <value>
example:
- step2 returned "0":
bootconfig_rw_index 0:bootconfig rootfs 1
bootconfig_rw_index 0:bootconfig1 rootfs 1
- step2 returned "1":
bootconfig_rw_index 0:bootconfig rootfs 0
bootconfig_rw_index 0:bootconfig1 rootfs 0
4. Reboot
Partition Layout (Stock FW):
0x000000000000-0x000000080000 : "0:SBL1"
0x000000080000-0x000000100000 : "0:MIBIB"
0x000000100000-0x000000140000 : "0:BOOTCONFIG"
0x000000140000-0x000000180000 : "0:BOOTCONFIG1"
0x000000180000-0x000000280000 : "0:QSEE"
0x000000280000-0x000000380000 : "0:QSEE_1"
0x000000380000-0x0000003c0000 : "0:DEVCFG"
0x0000003c0000-0x000000400000 : "0:DEVCFG_1"
0x000000400000-0x000000440000 : "0:CDT"
0x000000440000-0x000000480000 : "0:CDT_1"
0x000000480000-0x000000500000 : "0:APPSBLENV"
0x000000500000-0x000000640000 : "0:APPSBL"
0x000000640000-0x000000780000 : "0:APPSBL_1"
0x000000780000-0x000000880000 : "0:ART"
0x000000880000-0x000000900000 : "0:TRAINING"
0x000000900000-0x000003c40000 : "rootfs"
0x000003c40000-0x000003fc0000 : "Config"
0x000003fc0000-0x000007300000 : "rootfs_1"
0x000007300000-0x000007680000 : "Config_2"
0x000007680000-0x000007b80000 : "Reserved"
0x000007b80000-0x000007c00000 : "FWHEADER"
0x000007c00000-0x000007c80000 : "Factory"
Notes:
- This device has dual-boot feature and it's managed by the index in the
0:bootconfig and 0:bootconfig1 partitions.
- Wi-Fi BDF is shared with WRC-X3000GS2 (ipq-wifi-elecom_wrc-x3000gs2)
as the hardware (SoC, QCN6122, antennas) is identical between the two
models.
- GST2 stock firmware keeps its configuration even when sysupgrade is
called with -n. When installing from the OEM WebUI, those stock
settings can be restored into OpenWrt overlay, so settings must be
initialized after the first OpenWrt boot.
MAC Addresses:
LAN : 38:97:A4:xx:xx:40 (0:APPSBLENV, "eth1addr"/"ethaddr" (text))
WAN : 38:97:A4:xx:xx:43 (0:APPSBLENV, "eth0addr" (text))
2.4 GHz: 38:97:A4:xx:xx:41 (0:APPSBLENV, "wifi0" (text))
5 GHz : 38:97:A4:xx:xx:42 (0:APPSBLENV, "wifi1" (text))
Signed-off-by: Taiga Ogawa <zectaiga@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23471
Signed-off-by: Robert Marko <robimarko@gmail.com>
Turris Mox stores the U-Boot environment in SPI NOR flash. Add the
fw_env.config entry pointing to MTD partition 2 at offset 0x0 with
64 KiB env size and sector size, so userspace tools fw_printenv and
fw_setenv work correctly on this board.
Signed-off-by: Štěpán Dalecký <daleckystepan@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23421
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for netis EAP930 V1 ceiling access point.
Specification
-------------
- SoC : MediaTek MT7981BA dual-core ARM Cortex-A53 1.3 GHz
- RAM : 256 MiB DDR3 (ESMT M15T2G16128A-EFB)
- Flash : SPI-NAND 128 MiB (ESMT F50L1G41LB-104)
- WLAN : MediaTek MT7976CN dual-band WiFi 6
- 2.4 GHz : b/g/n/ax, MIMO 2x2
- 5 GHz : a/n/ac/ax, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x1 (SoC internal phy)
- USB : No
- Buttons : Reset
- LEDs : 1x Status (red), gpio-controlled
1x Status (blue), gpio-controlled
- Power : 48 VDC (PoE) or 12 VDC, 1.5 A
Installation
------------
1. Connect to the access point using ssh (user: admin, pass: web interface
password)
2. Make mtd backup:
cat /dev/mtd0 | gzip -1 -c > /tmp/mtd0_spi0.0.bin.gz
cat /dev/mtd1 | gzip -1 -c > /tmp/mtd1_BL2.bin.gz
cat /dev/mtd2 | gzip -1 -c > /tmp/mtd2_u-boot-env.bin.gz
cat /dev/mtd3 | gzip -1 -c > /tmp/mtd3_Factory.bin.gz
cat /dev/mtd4 | gzip -1 -c > /tmp/mtd4_FIP.bin.gz
cat /dev/mtd5 | gzip -1 -c > /tmp/mtd5_ubi.bin.gz
3. Download mtd backup from the /tmp dir of the router to your PC using
scp protocol
4. Upload OpenWrt 'bl31-uboot.fip', 'preloader.bin' images to the /tmp
dir of the router using scp protocol
5. Write FIP and BL2 (replace bootloader):
mtd write /tmp/bl31-uboot.fip FIP
mtd write /tmp/preloader.bin spi0.0
6. Place OpenWrt
'openwrt-mediatek-filogic-netis_eap930-v1-initramfs-recovery.itb' image
on the tftp server (IP: 192.168.1.254)
7. Erase 'ubi' partition and reboot the router:
mtd erase ubi
reboot
8. U-Boot automatically boot OpenWrt recovery image from tftp server to
the RAM (1 Gbps link is required)
9. Upload OpenWrt 'sysupgrade.itb' image to the /tmp dir of the router
(IP: 192.168.1.1) using scp protocol
10. Connect to the router using ssh and run:
sysupgrade -n squashfs-sysupgrade.itb
Recovery
--------
1. Place OpenWrt
'openwrt-mediatek-filogic-netis_eap930-v1-initramfs-recovery.itb' image
on the tftp server (IP: 192.168.1.254)
2. Press Reset button and power on the router. After ~10 sec release
the button.
3. Use OpenWrt initramfs system for recovery
Return to stock
---------------
1. Upload stock BL2, FIP, ubi partitions backup archives to the /tmp dir
of the router using scp protocol
2. Connect to the router using ssh and run:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd unlock BL2
mtd unlock FIP
4. Restore backups:
zcat /tmp/mtd1_BL2.bin.gz | mtd write - BL2
zcat /tmp/mtd4_FIP.bin.gz | mtd write - FIP
zcat /tmp/mtd5_ubi.bin.gz | mtd write - ubi
3. Reboot the router:
reboot
UART
----
Connection parameters: 115200, 8N1, 3.3V
UART pins are silkscreened on the PCB.
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 88:xx:xx:88:xx:d3 | label |
| WLAN 2g | 88:xx:xx:18:xx:d4 | |
| WLAN 5g | 88:xx:xx:78:xx:d4 | |
+---------+-------------------+-----------+
The LAN MAC (hex) was found in 'Factory', 0x1fef20
The WLAN 2g/5g MAC prototype (hex) was found in 'Factory', 0x4
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23133
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
U-Boot v2026.01 introduced drivers/mtd/nand/spi/otp.c which adds `spinand_user_otp_size()` and
`spinand_fact_otp_size()`. These functions are called unconditionally from `spinand_init()` in
drivers/mtd/nand/spi/core.c to determine whether to set up OTP methods:
if (spinand_user_otp_size(spinand) || spinand_fact_otp_size(spinand)) {
ret = spinand_set_mtd_otp_ops(spinand); /* drivers/mtd/nand/spi/core.c:2369 */
...
}
Both OTP size functions pass `&spinand->user_otp->layout` or `&spinand->fact_otp->layout` to
`spinand_otp_size()` without first checking whether the pointer is NULL. In the standard probing
path, these pointers are assigned by `spinand_match_and_init()` from the per-chip `spinand_info`
table. `100-21-mtd-spi-nand-add-CASN-page-support.patch` adds CASN detection to `spinand_detect()`
so that when a CASN page is found, `spinand_init_via_casn()` is called instead of
`spinand_id_detect()`. As `spinand_match_and_init()` is only called via `spinand_id_detect()`, it
is never invoked for CASN-probed devices.
As a result, `spinand->user_otp` and `spinand->fact_otp` remain NULL from the zero-initialised DM
priv allocation. Both `spinand_user_otp_size()` and `spinand_fact_otp_size()` spuriously return
non-zero by reading `layout->npages` from a small mapped address computed from their respective
NULL pointer, causing `spinand_init()` to call `spinand_set_mtd_otp_ops()` which reads
`spinand->user_otp->ops` and thereby silently assigns a garbage value to `user_ops` that is then
dereferenced at `if (user_ops->info)`.
int spinand_set_mtd_otp_ops(struct spinand_device *spinand)
{
struct mtd_info *mtd = spinand_to_mtd(spinand);
const struct spinand_fact_otp_ops *fact_ops = spinand->fact_otp->ops;
const struct spinand_user_otp_ops *user_ops = spinand->user_otp->ops;
...
if (user_ops) {
if (user_ops->info) /* drivers/mtd/nand/spi/otp.c:343 */
...
...
}
...
}
On COMFAST CF-WR632AX (MT7981, Winbond W25N01GV) this results in a "Synchronous Abort" during boot.
The crash was confirmed via `addr2line` on the U-Boot ELF:
"Synchronous Abort" handler, esr 0x96000004, far 0xeafffffeeafffffe
elr: 0000000041e2ff44 (drivers/mtd/nand/spi/otp.c:343)
lr : 0000000041e2f2f8 (drivers/mtd/nand/spi/core.c:2369)
The same was observed on Acer Predator Connect W6x (MT7986, Winbond W25N02KV):
"Synchronous Abort" handler, esr 0x96000004, far 0xeafffffeeafffffe
elr: 0000000041e2c868 (drivers/mtd/nand/spi/otp.c:343)
lr : 0000000041e2bc1c (drivers/mtd/nand/spi/core.c:2369)
Fix this by adding NULL guards to both OTP size functions so that they return 0 when the pointer is
NULL. With both functions returning 0, the condition in `spinand_init()` evaluates to false and
`spinand_set_mtd_otp_ops()` is never called, skipping setup of OTP methods entirely for CASN-probed
SPI NAND chips.
This change has no effect on SPI NAND chips that do have OTP data but not CASN. For those chips,
`spinand_match_and_init()` sets `spinand->user_otp` and `spinand->fact_otp` to non-NULL values from
the per-chip table, the NULL guard does not activate, and the existing behaviour is unchanged.
Fixes: https://github.com/openwrt/openwrt/issues/23430
Fixes: b94de14baf ("uboot-mediatek: update to v2026.01")
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23447
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Clean up whitespace and fix LED labels.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/23490
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The BL2 image for mt7987_rfb-emmc should be emmc, not sdmmc.
Fixes: 6d35eda ("uboot-mediatek: add builds for the MediaTek MT7987 reference board")
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/23490
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Update the uboot-ath79 package to v2026.04 release for ath79 devices.
Tested on:
- NEC Aterm WG600HP (AR9344)
- NEC Aterm WG1400HP (QCA9558)
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22901
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The Globitel BT-R320 patch has incorrect line numbers and corrupted
ASCII control characters.
Fixes: a3105d3f95 ("mediatek: filogic: add support for Globitel BT-R320")
Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23526
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add support for the AlwayLink M01K43 5G CPE router.
Hardware specifications:
- SoC: MediaTek MT7981B (Filogic 820), dual-core Cortex-A53
- RAM: 256 MiB DDR3 (0x40000000, size 0x10000000)
- Flash: 128 MiB SPI-NAND (UBI, root) + 4 MiB SPI-NOR (bootloader)
- Ethernet: 4x 1 GbE LAN + 1x 2.5 GbE WAN
(MT7531 DSA switch; WAN via RTL8221B 2.5GbE PHY on MAC1)
- WiFi: MT7981 built-in 2x2 802.11ax (2.4 GHz + 5 GHz)
- USB: 1x xHCI (USB 2.0 only; USB 3.0 PHY pins not routed)
- Modem: M.2 B-Key slot wired for USB (tested: Quectel RM551E-GL,
Quectel RM520N-GL via QMI)
- LEDs: 10x GPIO LEDs (status, WAN, LAN, WiFi 2.4/5, signal bars)
- Buttons: WPS, Reset, RFKill
- Power: 12 V DC barrel jack
- UART: 3.3 V TTL header on PCB, 115200 8N1, no flow control
PCB silkscreen: M01K43 v5.0
Manufacturer: Shenzhen AlwayLink Wireless Technology Co., Ltd.
MAC addresses come from the 'ledeinfo' partition (mtd6) at offset 0x18
(label macaddr_ledeinfo_18); the stored value is the LAN MAC.
interface this port vendor firmware
------------------- ----------- --------------------------
eth0 / LAN bridge base + 0 base + 0
eth1 / WAN base + 1 base + 1
wifi 2.4 GHz band@0 base + 2 base (driver-derived)
wifi 5 GHz band@1 base + 3 base + LAA bit (driver)
The vendor's ethernet scheme (LAN = base, WAN = base + 1) is reproduced
exactly. For WiFi the vendor's proprietary mt_wifi driver ignores the
stored per-radio MAC and derives each BSSID from the base by setting the
locally-administered bit, so the radios are not given clean unicast
offsets. Under mainline mt76 + DSA, reusing the base (LAN) MAC on a radio
collides at L2 with the gmac0 conduit, so this port assigns the 2.4 GHz
and 5 GHz radios base + 2 and base + 3 — unique unicast addresses in the
same OUI block.
Installation
------------
Stock firmware defaults (verified on shipping units):
LAN IP: 192.168.100.1
SSH/web: user 'root', password 'admin'
Serial: 3.3 V TTL UART header on PCB, 115200 8N1, no flow control
Image artifacts produced by this device definition:
openwrt-mediatek-filogic-alwaylink_m01k43-squashfs-factory.bin
openwrt-mediatek-filogic-alwaylink_m01k43-squashfs-sysupgrade.bin
Before flashing, back up the per-unit partitions (cannot be
regenerated):
ssh root@192.168.100.1
dd if=/dev/mtd3 of=/tmp/factory.bin bs=1 count=655360
dd if=/dev/mtd6 of=/tmp/ledeinfo.bin bs=1 count=65536
exit
scp root@192.168.100.1:/tmp/factory.bin .
scp root@192.168.100.1:/tmp/ledeinfo.bin .
Method 1 - From an existing OpenWrt install (sysupgrade):
IMG=openwrt-mediatek-filogic-alwaylink_m01k43-squashfs-sysupgrade.bin
scp "$IMG" root@192.168.1.1:/tmp/sysupgrade.bin
ssh root@192.168.1.1 sysupgrade -n /tmp/sysupgrade.bin
Method 2 - U-Boot serial recovery via TFTP (requires 3.3 V USB-UART
adapter):
1. Attach 3.3 V USB-UART (TX, RX, GND) to the PCB header. Open a
terminal at 115200 8N1, no flow control.
2. Configure a TFTP server on the host PC at IP 192.168.2.88.
Place the factory image in the TFTP root, renamed if desired.
3. Power on the router. The BL2/U-Boot banner prints within ~1
second; press any key during the autoboot countdown to enter
the U-Boot menu.
4. From the menu, select 'Upgrade ubi'. U-Boot's default IP is
192.168.2.1 and it expects the TFTP server at 192.168.2.88.
Provide the factory image filename when prompted.
5. Wait for the write to complete; U-Boot reboots into OpenWrt.
Method 3 - From a NAND programmer (brick-recovery path):
1. Clip onto or desolder the SPI-NAND chip and dump the full
128 MiB with a programmer (e.g. RT809H, CH341A with NAND
adapter). Keep the dump as a recovery image.
2. Using the same programmer, write the factory.bin image to
the UBI region of the NAND. The SPI-NOR (BL2/u-boot-env/
Factory/FIP/woem/ledeinfo/nvram) must NOT be erased - those
partitions are per-unit and live on the separate 4 MiB NOR.
3. Reseat the chip and power on. The bootloader on NOR will
load the new kernel and rootfs from UBI.
Signed-off-by: Richard Jones <richard@netsolution.shop>
Link: https://github.com/openwrt/openwrt/pull/22818
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The chunk length is not correct.
Fixes: d2fabb974c ("mediatek: add support for Wavlink WL-WNT100X3 ubootmod")
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
This allows us to use the full size of nand, which increases ubi size
from 90M to 122.25M.
Flashing instructions:
1. Login into the device and backup all your partitions,
especially `Factory` and 'HW' to be able to come back to stock and use all
Wavlink services.
2. Unlock mtd partitions:
```
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
```
3. Upload new `bl2` and `fip` to the router /tmp and write them:
```
mtd write /tmp/openwrt-mediatek-filogic-wavlink_wl-wnt100x3-ubootmod-preloader.bin bl2
mtd write /tmp/openwrt-mediatek-filogic-wavlink_wl-wnt100x3-ubootmod-bl31-uboot.fip fip
mtd erase ubi
```
4. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
5. Serve OpenWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After OpenWrt initramfs has booted, prepare ubi and envs:
```
ubidetach -p /dev/mtd4 && ubiformat /dev/mtd4 -y && ubiattach -p /dev/mtd4 && ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB && ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
```
8. Perform sysupgrade.
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22753
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
| Component | Details |
|------------------|-------------------------------------------------|
| **SoC** | MediaTek MT7986A (4× ARM Cortex-A53 @ 2.0 GHz) |
| **RAM** | 512 MB |
| **Flash** | 256 MB NAND |
| **Ethernet** | 5× 10/100/1000 Mbps (1 WAN + 4 LAN) |
| **WLAN 2.4 GHz** | MediaTek MT7976GN — 802.11b/g/n/ax, 4×4 MIMO |
| **WLAN 5 GHz** | MediaTek MT7976AN — 802.11n/ac/ax, 4×4 MIMO |
| **LEDs** | 1× RGB LED (GPIO-controlled) |
| **Button** | 1× Reset |
| **USB** | Yes |
**MAC Addresses:**
| Interface | Source |
|------------|-------------------------------------------------|
| WAN/Label | u-boot-env MTD partition, "mac" (text) |
| LAN | WAN + 1 |
| 2.4 GHz | WAN + 2 |
| 5 GHz | WAN + 3 |
---
**1. Prepare TFTP server**
Set a static IP on the ethernet interface of your computer (e.g. default: ip `192.168.1.2`, gateway `192.168.1.1`).
Download the initramfs image and host it with the TFTP server.
**2. Interrupt boot**
Attach UART and power on the router. When the boot menu appears, select **Failsafe Mode**,
then press `Ctrl-C` to interrupt and enter the U-Boot prompt.
**3. Load and run initramfs image**
```sh
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.2
tftpboot 0x46000000 openwrt-mediatek-filogic-jiorouter_ax6000-jidu6101-initramfs-kernel.bin
fdt addr $(fdtcontroladdr)
fdt rm /signature
bootm
```
**4. Flash sysupgrade image**
Place the sysupgrade image in `/tmp`, then run:
```sh
sysupgrade /tmp/openwrt-mediatek-filogic-jiorouter_ax6000-jidu6101-squashfs-sysupgrade.bin
```
Alternatively, use the sysupgrade option in LuCI.
Note:
- The raw MTD u-boot-env partition is only used for MAC address storage, while the active U-Boot environment is stored in the UBI volume.
- These devices ship with secure boot enabled and stock U-Boot only accepts vendor-signed FIT images.
- BL2/FIP cannot be replaced, so the stock signature verification path cannot be disabled directly.
- Setting ipaddr='' forces U-Boot to exit the web failsafe path and continue into autoboot.
- The custom bootcmd loads OpenWrt from the UBI volume and removes the /signature node before bootm, allowing unsigned OpenWrt FIT images to boot.
- Stock U-Boot expects its environment in a UBI volume named u-boot-env, so it is created during initial setup.
Signed-off-by: sh3ikh-faisal <sheikhfaisal713@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22201
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add support for Xiaomi AX5400 (RA74).
Specifications:
* SoC: Qualcomm IPQ5018 (64-bit dual-core ARM Cortex-A53 @ 1.0Ghz)
* Memory: Etrontech EM6HE16EWAKG 512 MiB DDR3L-933
* Serial Port: 1v8 TTL 115200n8
* Wi-Fi: IPQ5018 (2x2 2.4 Ghz 802.11b/g/n/ax - up to 574 Mbps)
QCN9024 (4x4 5 Ghz 802.11an/ac/ax - up to 4804 Mbps)
* Ethernet: IPQ5018 integrated virtual switch connected to an
external QCA8337 switch (3 LAN Ports 10/100/1000)
* Flash: Gigadevice GD5F1GQ5REYIG (128 MiB)
* LEDs: 1x System Blue (GPIO 24 Active High)
1x System Yellow (GPIO 25 Active High)
1x WAN Link Blue (GPIO 26 Active High)
1x WAN Link Yellow (GPIO 27 Active High)
* Buttons: 1x Reset (GPIO 38 Active Low)
1x WPS (GPIO 28 Active Low)
* MAC address layout: LAN (eth1): 0:art @ offset 0x0
WAN (eth0): 0:art @ offset 0x6
Flash instructions: (use redmi-ax5400 image for the Redmi AX5400)
Download XMIR Patcher: https://github.com/openwrt-xiaomi/xmir-patcher
First flash a ubinized OpenWrt initramfs that will serve as the intermediate step, since
OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for
packages, through either of the below two methods:
Installation via XMIR Patcher:
1. Load the initramfs image: openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi
Installation via ubiformat method, through SSH:
1. If needed, enable SSH using XMIR Patcher.
2. Copy the file openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi to the /tmp directory
3. Open an SSH shell to the router
4. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1):
nvram get flag_boot_rootfs
5. Find the rootfs and rootfs_1 mtd indexes respectively:
cat /proc/mtd
Please confirm if mtd18 and mtd19 are the correct indexes from above!
6. Use the command ubiformat to flash the opposite mtd with UBI image:
If nvram get flag_boot_rootfs returned 0:
ubiformat /dev/mtd19 -y -f /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit
otherwise:
ubiformat /dev/mtd18 -y -f /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit
7. Reboot the device by:
reboot
Continue in order to pernamently flash OpenWrt:
1. Upload the sysupgrade image to /tmp/ using SCP:
scp -O <path to image> root@192.168.1.1:/tmp/
2. Open an SSH shell to 192.168.1.1 from a PC within the same subnet
3. Use sysupgrade to flash the sysupgrade image:
sysupgrade -n -v /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-squashfs-sysupgrade.bin
Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired.
Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23374
Signed-off-by: Robert Marko <robimarko@gmail.com>
- Sync shared U-Boot DTS nodes with the main device DTS
- Remove duplicate strings
Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22929
Signed-off-by: Robert Marko <robimarko@gmail.com>
Fix instability by reducing RAM speed to 1866 MT/s
in line with Winbond W634GU6RB-11 specs.
Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22929
Signed-off-by: Robert Marko <robimarko@gmail.com>
Update package to the latest stable version.
Patches unchanged.
Signed-off-by: Stefan Kalscheuer <stefan@stklcode.de>
Link: https://github.com/openwrt/openwrt/pull/23369
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit adds support for the netis MEX605, which is a variant based on the netis NX30 V2.
1. Update brand naming from Netis to netis to follow the official branding.
2. Rename NX30V2 to NX30 V2 to correctly reflect it as the second version of the NX30.
3. Update variant notation for consistency.
cherry picked from commit c982357
1. Add 'model' to the DTS for netis NX30 V2 and define WiFi LED.
4. Fix typo.
Signed-off-by: Zhiwei Cao <bfdeh@126.com>
Signed-off-by: David Han <h96643864@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22726
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Ethernet LAN port is set to `eth1` (silkscreen "ETH2" and case label "2") next to the 2x USB Type-A
ports and WAN is set to `eth0` (silkscreen "ETH1" and case label "1") next to the USB Type-C port.
The USER ("reset") button serves as the reset button. A short press will reboot and a long press
will reset to factory settings (deleting all data) if using squashfs image.
MASK ("maskrom") and RCRY ("recovery") buttons are enabled but are not set to any specific function
Pressing the POWER button will `poweroff` the device and it will stay off until a power cycle.
Hardware
---------------
* SoC: RockChip RK3576 64-bit ARMv8-A 8 cores big.LITTLE (4x A72 and 4x A53)
* RAM: 3/4GB LPDDR4X or 8/16GB LPDDR5
* Ethernet: 2x GbE (SoC RGMII MAC, RTL8211F PHY)
* 3x LEDs (SYS - red / 1 (WAN) - green / 2 (LAN) - green)
* 4x Buttons (MASK ("maskrom"), RCRY ("recovery"), USER ("reset" - OpenWrt reset), POWER)
* 1x 16MiB SPI NOR on board
* 1x UFS slot for optional UFS 2.0 module (currently not supported)
* 1x microSD card slot (UHS-I)
* 1x HDMI OUT
* 1x Headphone OUT 3.5mm
* 1x M.2 M-key 2280 PCIe slot (PCIe 2.1 x1 supports NVMe SSD)
* 1x M.2 E-key *SDIO* slot for optional RTL8822CS Wi-Fi 5
* the case has integrated antennae as well as 2x knockouts
* the device tree is missing the nodes relevant to Wi-Fi operations so it's not supported for now.
* 2x USB 3.2 Gen 1 Type-A Ports
* Power: 1x USB Type-C 6V-20V with both DC and USB PD supported
* Serial: 1500000 8N1 3.3V - 2.54mm 3-pin header next to HDMI
MAC addresses
---------------
WAN (`eth0` case label "1"): generated from /sys/.../mmcblk0/cid (CID of SD card)
LAN (`eth1` case label "2"): WAN + 1
Installation
---------------
Decompress the archive of the OpenWrt sysupgrade image and write it to a microSD card using `dd`
or use Balena Etcher (no need to decompress).
Boot
---------------
Insert microSD card, set boot switch to "UFS/SD" and then supply power.
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23008
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Apply pending U-Boot patches so that Rockchip RK3576 devices can boot from SD card. The problem:
"The BootROM on RK3576 has an issue loading boot images from an SD-card. This issue can be worked
around by injecting an initial boot image before TPL…and return to BootROM to load next image, TPL"
Compilation of the initial boot image has been added to the U-Boot build recipe.
Tested on FriendlyELEC NanoPi M5
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23008
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
