mux-mmio.ko depends on regmap-mmio.ko at runtime, but the kmod package
was missing the dependency, causing build failures when the module is
included.
Fixes: ac39016898 ("kernel: modules: package MMIO mux driver")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24028
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Indicate that there are some changes. This should make sure that the
package gets updated.
Fixes: 257aee0cc0 ("scripts: dhcpv6: don't report custom ip6class if default")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Indicate that there are some changes. This should make sure that the
package gets updated.
Fixes: 63c0767f3d ("ead: fix integer underflow in handle_send_a()")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
maintainer: Felix Fietkau <nbd@nbd.name>
The metric field is not used when wireGuard routes are created.
See: https://github.com/openwrt/openwrt/issues/23199
This patch is aimed at adding the metric field in the config to the created routes for WireGuard if
the metric field is not empty and not 0
Compile tested: X86, Openwrt-main
Run tested: X86
Please have a look and consider implementing
Signed-off-by: Erik Conijn <egc112@msn.com>
Link: https://github.com/openwrt/openwrt/pull/23280
Signed-off-by: Robert Marko <robimarko@gmail.com>
add ra/dhcpv4/dhcpv6
dhcpv6 service provided by dnsmasq without odhcpd
Signed-off-by: Andy Chiang <AndyChiang_git@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23445
Signed-off-by: Robert Marko <robimarko@gmail.com>
Create a package for ov5645 kernel module, required to support camera on
PICO-PI-IMX7D board.
Currently limit the visibility to imx_cortexa7 subtarget, but this can
be enabled on other platforms if needed.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17606
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Package the video-mux module, required by PICO-PI-IMX7D board, to
support included OV5645 camera.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17606
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Create a package for MMIO-based multiplexer driver, used as a backend by
video-mux on i.MX7 SoCs.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17606
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Create a package for i.MX7 CSI driver module, together with it's common
code for i.MX family.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17606
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Some EHT options like beamformer/beamformee
are disabled by default in hostapd.conf
Read the EHT Phy Cap structure and enable/disable
switches within the hostapd.conf for capable hardware.
Without this EHT SU beamformer/beamformee and MU
beamformer capabilities are omitted from AP beacons,
even if the driver reports the hardware as capable.
Signed-off-by: Richard Huynh <voxlympha@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22956
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
The MikroTik RB5009UPr+S+IN is a multigig router based on the Marvell
Armada 7040 SoC, sharing the same hardware base as the RB5009UG+S+IN
with added PoE-out support on all ethernet ports.
Specification:
- SoC : Marvell Armada 7040 (88F7040), 4x Cortex-A72
- CPU frequency : 350-1400 MHz
- RAM : 1 GB
- Flash : 16 MB SPI NOR + 1 GB NAND
- Switch : Marvell MV88E6393X
- Ethernet : 1x 2.5G (p1, QCA8081), 7x 1G (p2-p8), 1x SFP+ 10G
- PoE-in : 802.3af/at on p1, 24-57V
- PoE-out : 802.3af/at on p1-p8, 130 W total
- Power : DC jack / 2-pin terminal / PoE-in, 24-57V
- USB : 1x USB 3.0 type A, max 1.5 A
- LEDs/Keys (GPIO): 4x/1x
- UART : MikroTik SPI/UART combo header (10-pin, 2.0mm pitch)
- assignment : GND Vcc Rx ? GND / CLK DO /CS Tx DI (top view)
- settings : 115200n8
Flash instruction using initramfs image:
RouterBOOT cannot boot the OpenWrt kernel directly. A U-Boot loader
(u-boot.elf) is installed as an intermediary: RouterBOOT loads
u-boot.elf, which then loads the OpenWrt initramfs image.
1. Rename the downloaded initramfs image, removing the version number,
to: openwrt-mvebu-cortexa72-mikrotik_rb5009-initramfs-uImage.itb
2. Set up a BOOTP/TFTP server serving u-boot.elf, with the renamed
initramfs image in the same directory
3. Power off the router, hold the reset button (front panel), power on
and keep holding until the initramfs image has been served, then
release
4. The router boots the initramfs image, reachable at 192.168.1.1
5. Log in via SSH, install U-Boot, wipe NAND and flash OpenWrt:
. /lib/functions.sh
yafut -d /dev/mtd$(find_mtd_index "YAFFS") -w -i /tmp/u-boot.elf -o kernel -T
ubiformat /dev/mtd$(find_mtd_index "ubi") -y
sysupgrade /tmp/openwrt-mvebu-cortexa72-mikrotik_rb5009upr-squashfs-sysupgrade.bin
Recovery:
Hold the reset button while U-Boot is booting to load the initramfs
image again. To return to RouterOS, use MikroTik Netinstall.
MAC Addresses:
MAC addresses are read from the RouterBOOT hard_config in NOR via the
macaddr_hard nvmem cell:
offset +0 p1 (2.5G, label-mac-device)
offset +1 p2
offset +2 p3
offset +3 p4
offset +4 p5
offset +5 p6
offset +6 p7
offset +7 p8
offset +8 sfp
Tested-by: Sm00shed <sm00shed@posteo.de> (RB5009UPr+S+IN, OpenWrt v25.12.4,
kernel 6.12.87, mtpoe fw 65.21)
Signed-off-by: Przemek Rudy <prudy@protonmail.com>
[carlo@common-net.org: refactor RB5009UPr+S+IN support and fix sysupgrade path]
Signed-off-by: Carlo Filippi <carlo@common-net.org>
[sm00shed@posteo.de: fix compatible indentation, remove mikrotik,rb5009, expand commit message]
Signed-off-by: Sm00shed <sm00shed@posteo.de>
Link: https://github.com/openwrt/openwrt/pull/23698
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Specialize RB5009UG model from generic RB5009.
Signed-off-by: Przemek Rudy <prudy@protonmail.com>
[carlo@common-net.org: fixed model name and backward compatibility ]
Signed-off-by: Carlo Filippi <carlo@common-net.org>
Signed-off-by: Sm00shed <sm00shed@posteo.de>
Link: https://github.com/openwrt/openwrt/pull/23698
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
RAM: ESMT M15T2G16128A-DEB DDR3 1866 MT/s
This allows us to use the full size of nand,
which extends ubi size from 64Mb to 122.25Mb.
1. Log in to the device and backup all the partitions,
especially unique "Factory" and "bdinfo" partitions
from System -> Backup / Flash Firmware -> Save mtdblock contents.
2. Install kmod-mtd-rw to unlock mtd partitions for writing
apk update && apk add kmod-mtd-rw && insmod mtd-rw i_want_a_brick=1
3. Write new OpenWrt (U-Boot Layout) "BL2" and "FIP":
mtd -e BL2 write openwrt-mediatek-filogic-cudy_m3000-v2-yt8821-ubootmod-preloader.bin BL2
mtd -e FIP write openwrt-mediatek-filogic-cudy_m3000-v2-yt8821-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC: "192.168.1.254", gateway "192.168.1.1"
5. Serve openwrt-mediatek-filogic-cudy_m3000-v2-yt8821-ubootmod-initramfs-recovery.itb
using TFTP server.
6. Connect Router LAN with PC LAN.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt initramfs recovery has booted,
clean "/dev/mtd5" ubi partition to utilize maximum of free space:
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Perform sysupgrade.
Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23274
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
RAM: ESMT M15T2G16128A-DEB DDR3 1866 MT/s
This allows us to use the full size of nand,
which extends ubi size from 64Mb to 122.25Mb.
1. Log in to the device and backup all the partitions,
especially unique "Factory" and "bdinfo" partitions
from System -> Backup / Flash Firmware -> Save mtdblock contents.
2. Install kmod-mtd-rw to unlock mtd partitions for writing
apk update && apk add kmod-mtd-rw && insmod mtd-rw i_want_a_brick=1
3. Write new OpenWrt (U-Boot Layout) "BL2" and "FIP":
mtd -e BL2 write openwrt-mediatek-filogic-cudy_m3000-v1-ubootmod-preloader.bin BL2
mtd -e FIP write openwrt-mediatek-filogic-cudy_m3000-v1-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC: "192.168.1.254", gateway "192.168.1.1"
5. Serve openwrt-mediatek-filogic-cudy_m3000-v1-ubootmod-initramfs-recovery.itb
using TFTP server.
6. Connect Router LAN with PC LAN.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt initramfs recovery has booted,
clean "/dev/mtd5" ubi partition to utilize maximum of free space:
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Perform sysupgrade.
Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23274
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add DDR3_FREQ_1866 for DDR3 Cudy devices
to reduce RAM speed to 1866 MT/s
All known Cudy devices with DDR3 256/512 MB RAM use
ESMT M15T2G16128A-DEB DDR3 1866 MT/s or
ESMT M15T2G16256A-DEB DDR3 1866 MT/s
Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23274
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The firmware loading does not depend (solely) on the PHY id. The driver
needs to read out the vendor version id of the PHY before it can decide
which firmware file needs to be loaded.
A split in an RTL8261N and an RTL8264B firmware package is therefore
misleading. And it could even be that a product ships an RTL8264B but
switches the revision of the chip in the middle of its product lifetime. In
this case, the first identification based on the chip ID or the actual chip
ID for the OpenWrt porter might fail for another user with a later/earlier
produced device.
Shipping both files in the same package avoids this problem. Only the "low
power" firmware package is slightly misleading because there is only a
RTL8261N firmware binary for low power but no corresponding RTL8264B
version. It will ship simply the non-low power version for RTL8264B.
Suggested-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Link: https://github.com/openwrt/openwrt/pull/23947
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add a new sta_set_airtime_weight driver op so drivers can program the
airtime fairness weight into hardware.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
odhcp6c returns delegated prefixes with a "class=<IAID>" tag if a custom
IAID was specified in the -P argument. This tag must then be used for any
prefix filter ("network.<interface>.ip6class") instead of the uplink i/f
name.
OpenWrt by default uses the first eight digits of the uplink i/f name's MD5
hash as IAID. Don't report a custom "class" tag for this default IAID.
Fixes: f08cd5ce5d
Signed-off-by: Shine <4c.fce2@proton.me>
Tested-by: Goetz Goerisch <ggoerisch@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23989
Signed-off-by: Robert Marko <robimarko@gmail.com>
The mesh capability check unconditionally ran wpa_supplicant -vmesh to
detect driver support. On devices where wpa_supplicant is not installed,
this produces a "/bin/sh: wpa_supplicant: not found" error in the logs
on every wifi reconfiguration even when no mesh interface is configured.
Guard the invocation with fs.access() so the binary is only executed
when it is actually present, and use its absolute path to avoid relying
on $PATH.
Signed-off-by: Florian Maurer <fmaurer@disroot.org>
Link: https://github.com/openwrt/openwrt/pull/23607
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
mac80211's ieee80211_set_antenna() rejects calls with -EOPNOTSUPP once
the radio is started (local->started == true). The spurious failure
triggers a wpa_supplicant invocation in the error path, producing both
a "command failed: Not supported (-122)" message and (where wpa_supplicant
is not installed) a "/bin/sh: wpa_supplicant: not found" message in the
log on every wifi reconfiguration.
In this code path, reset_config() tears down all interfaces before the
antenna is touched, so local->started is false exactly when the antenna
config has changed. Skip the iw phy set antenna call otherwise, matching
the behaviour of mainline OpenWrt's bash mac80211.sh. The trade-off is
that we no longer re-assert the antenna mask on warm reconf if it was
cleared out-of-band (e.g. by a driver reload); in practice drivers do
not clear it mid-life.
Also split the antenna details out of the generic "Configuring '${phy}'
distance: ..." log line so it isn't claimed when the call was skipped.
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Florian Maurer <fmaurer@disroot.org>
Link: https://github.com/openwrt/openwrt/pull/23607
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The NanoPi R2S Plus is a NanoPi R2S with on-board eMMC added. The device
tree (rk3328-nanopi-r2s-plus.dts) is already present in kernel 6.12, and
U-Boot support has been present since v2025.01, so neither a kernel DTS
backport nor a U-Boot patch is required.
Hardware
--------
Rockchip RK3328 (4x Cortex-A53, up to 1.4 GHz)
1GB DDR4 RAM
32GB eMMC 5.1
microSD slot (up to 128GB)
1x 1000 Base-T (native, RTL8211F via GMAC) - WAN
1x 1000 Base-T (USB 3.0, RTL8153B) - LAN
Optional M.2 SDIO Wi-Fi
2x USB 2.0 Type-A host
1x USB-C (5V power input, USB device for Maskrom update)
1x USB-C (onboard USB-to-UART debug console, 1500000 bps)
1x serial debug header / UART0 (3.3V TTL, 3-pin 2.54mm)
2 Buttons (GPIO key, Maskrom)
3 LEDs (SYS red, WAN green, LAN green)
DC 5V/2A power
Operating temperature 0 to 70 C
The MAC addresses are derived from the eMMC CID, so they are stable
regardless of whether the device boots from microSD or eMMC.
Installation
------------
On RK3328 the BootROM boots the eMMC before the microSD slot, so the
Maskrom button must be held to boot from microSD while stock firmware is
still on the eMMC.
How to boot from eMMC:
1. Write the uncompressed sysupgrade image to sdcard
2. Hold the "Mask" button while powering on the device
3. Wait until OpenWrt is fully booted
4. Copy the compressed .gz sysupgrade image to the machine's /tmp folder using scp
5. Run: gunzip -c /tmp/openwrt-...-friendlyarm_nanopi-r2s-plus-squashfs-sysupgrade.img.gz | dd of=/dev/mmcblk1 bs=4M conv=fsync
6. Power the device off, remove the sdcard and power it back on
Tested:
- microSD boot (via Maskrom button) and native eMMC boot
- Both Ethernet ports (RTL8211F WAN, RTL8153B LAN)
- eMMC-derived MAC addresses
Signed-off-by: Grische <github@grische.xyz>
Assisted-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23854
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This commit adds support for Nokia XG-040G-MD XG-PON ONU.
Specification
-------------
- SoC : Airoha AN7581DT Quad-core ARM Cortex-A53 1.2 GHz
- RAM : 512 MiB DDR4 (ESMT M16U4G16256A-QLB)
- Flash : SPI-NAND 256 MiB (SkyHigh ML02G300WHI00)
- WLAN : -
- Ethernet : 1x 2500 Mbps (LAN1, Airoha EN8811HN)
3x 10/100/1000 Mbps (LAN2-LAN4, Airoha AN7581 SoC switch)
- XG-PON : ECONET EN7572AN, SLIC: MaxLinear PEF32001VSV12
- USB : 1x USB 3.0 (with power control via gpio)
1x USB 2.0 (with power control via gpio)
- Buttons : Reset
- LEDs : 1x Power (green, gpio-controlled)
1x WAN (green, gpio-controlled)
1x WAN (red, gpio-controlled)
4x LAN (green, gpio-controlled)
2x USB (green)
- Power : 12 VDC, 1 A
Unsupported functions and limitations
-------------------------------------
1. XG-PON won't be available after installing OpenWrt.
Installation (stock layout, UART)
---------------------------------
1. Attach UART and run picocom:
picocom -b 115200 --send-cmd "sb -vv" /dev/ttyUSB0
2. Interrupt boot process by pressing Enter key to enter u-boot
Username: telecomadmin
Password: nE7jA%5m
3. Start download firmware via ymodem protocol (via UART):
loady 0x85000000
4. Press Ctrl + A then Ctrl + S in the picocom terminal (if you are using
a different terminal, please refer to the documentation) to start
upload OpenWrt initramfs image using ymodem protocol. Enter local path
to the OpenWrt initramfs image and press Enter.
5. Load OpenWrt initramfs image from the memory:
bootm 0x85000000
5. Sysupgrade with OpenWrt sysupgrade image
Alternative for the p.3-4. Load and boot OpenWrt initramfs from tftp IP
192.168.1.254:
tftpboot 0x85000000 192.168.1.254:openwrt-initramfs-uImage.itb
bootm 0x85000000
I was unable to download the file without errors, the bootloader network
driver is very unstable. Perhaps you will be more fortunate.
Backup and installation (stock layout, without UART)
----------------------------------------------------
1. Unplug Fiber
2. Make ONU Reset
3. Navigate: http://192.168.1.1
Username: CMCCAdmin
Password: aDm8H%MdA
4. Go to Apps -> Home Storage -> FTP and check Enable FTP
5. Go to Apps -> Home Storage -> SAMBA Sharing and check Enable Samba
6. Visit the following URL to open Telnet:
http://192.168.1.1/system.cgi?telnet
7. Telnet account login:
Username: user
Password: <see ONU label>
8. Get root privileges:
su user_ftp
Password: <see ONU label>
9. Copy 'squashfs-factory-kernel.bin', 'squashfs-factory-rootfs.bin' and
'OpenWrt.mtd2.u-boot-env.bin' (backup of 'u-boot-env' partition from
the another Nokia XG-040G-MD with OpenWrt installed)
9. Attach USB flash drive and check the new dir in /mnt:
ls /mnt
10. Change current dir to the flash drive (change D to your flash drive
label):
cd /mnt/D
11. Make backup:
for i in 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16; \
do cat /dev/mtd$i | gzip -9 > mtd$i.bin.gz; done
12. Check image sizes:
ls -l | awk '{if(NR>1) {$5=sprintf("0x%x", $5); print}}'
13. Write images:
mtd_debug erase /dev/mtd0 0x60000 0x20000
mtd_debug write /dev/mtd0 0x60000 0x20000 OpenWrt.mtd2.u-boot-env.bin
mtd_debug erase /dev/mtd14 0x0 0x2880000
mtd_debug write /dev/mtd14 0x0 0x3e6cfc squashfs-factory-kernel.bin
mtd_debug erase /dev/mtd11 0x0 0x80e0000
mtd_debug write /dev/mtd11 0x0 0x440000 squashfs-factory-rootfs.bin
0x3e6cfc - size of your 'squashfs-factory-kernel.bin'
0x440000 - size of your 'squashfs-factory-rootfs.bin'
14. Reboot:
reboot
Recovery (stock layout)
-----------------------
The same as described in Installation (UART).
Return to stock (stock layout)
------------------------------
1. Follow the steps 1-5 of the Installation (UART)
2. Once in OpenWrt upload you backup to the /tmp dir of the router:
scp -O mtd16.bin.gz root@192.168.1.1:/tmp
5. Connect to the router using ssh and install kmod-mtd-rw:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
6. Unlock bootloader:
mtd unlock bootloader
7. Restore stock:
zcat /tmp/mtd16.bin.gz | mtd write - all_flash
8. Reboot:
reboot
Notes (OpenWrt U-Boot layout)
-----------------------------
1. Only devices with SkyHigh ML02G300WHI00 spi-nand are supported. Driver
for FudanMicro FM25G02B is absent in current U-Boot.
2. A simple installation without serial console is also possible using a
fork of @dangowrt's UBI Installer
Link: https://github.com/dangowrt/owrt-ubi-installer
Installation / recovery (OpenWrt U-Boot layout)
-----------------------------------------------
1. Make sure that you have 'bosa' and 'ri' partitions mtd backups before
you start
2. Place OpenWrt images on the tftp server (IP: 192.168.1.254):
openwrt-airoha-an7581-nokia_xg-040g-md-ubi-bl31-uboot.fip
openwrt-airoha-an7581-nokia_xg-040g-md-ubi-initramfs-recovery.itb
openwrt-airoha-an7581-nokia_xg-040g-md-ubi-preloader.bin
3. Attach serial console and start terminal with XMODEM support:
picocom -b 115200 --send-cmd "sx -vvX" /dev/ttyUSB0
4. Push reset button and power on the router
5. Press 'x', then 'Ctrl + A' and 'Ctrl + S'
6. Paste full path to the bl2 image:
'openwrt-airoha-an7581-nokia_xg-040g-md-ubi-preloader.bin'
7. Wait until the file is downloaded and the following prompt appears:
Press x to load BL31 + U-Boot FIP
8. Press 'x', then 'Ctrl + A' and 'Ctrl + S'
9. Paste full path to the fip image:
'openwrt-airoha-an7581-nokia_xg-040g-md-ubi-bl31-uboot.fip'
10. Wait until the file is downloaded, u-boot will prepare ubi partition
automatically
11. Wait for U-Boot menu
12. Run 'Load BL31+U-Boot FIP via TFTP then write to NAND'
13. Run 'Load BL2 preloader via TFTP then write to NAND'
14. Run 'Boot system via TFTP'
15. Once in OpenWrt perform standard sysupgrade
16. Once in OpenWrt upload 'bosa' and 'ri' partitions mtd backups to the
/tmp dir using scp protocol
17. Check ID of the UBI volumes:
ubinfo -d 0 -N bosa | grep "Volume ID"
ubinfo -d 0 -N ri | grep "Volume ID"
18. Write backups according to the volume ID:
ubiupdatevol /dev/ubi0_2 /tmp/bosa.bin
ubiupdatevol /dev/ubi0_3 /tmp/ri.bin
19. Reboot:
reboot
Stock layout
------------
+-------+------------+---------+---------+
| mtd | label | start | size |
+-------+------------+---------+---------+
| mtd0 | bootloader | 0 | 80000 |
| mtd1 | romfile | 80000 | 40000 |
| mtd14 | nsb_master | c0000 | 2880000 |
| mtd15 | nsb_slave | 2940000 | 2880000 |
| mtd6 | bosa | 51c0000 | 40000 |
| mtd7 | ri | 5200000 | 40000 |
| mtd8 | flag | 5240000 | 40000 |
| mtd9 | flagback | 5280000 | 40000 |
| mtd10 | config | 52c0000 | a00000 |
| mtd11 | data | 5cc0000 | 80e0000 |
| mtd12 | oopsfs | dda0000 | 400000 |
| mtd13 | log | e1a0000 | a00000 |
+-------+------------+---------+---------+
USB power control
-----------------
Disable (both ports):
echo disabled > /sys/devices/platform/usb-power/state
Enable (both ports):
echo enabled > /sys/devices/platform/usb-power/state
UART
----
A view from the back side of the PCB:
------------------------
| GND RX TX
| X X X
Connection parameters:
115200, 8N1, 3.3V
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 04:xx:xx:xx:xx:0d | label |
| WAN | 04:xx:xx:xx:xx:0e | label + 1 |
+---------+-------------------+-----------+
The LAN MAC (hex) was found in 'ri', 0x3e
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23569
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add support for Nokia XG-040G-MD.
Known issues
------------
1. Reset button is currently doesn't work and cannot be used to start
tftp recovery:
Button 'reset' not found (err=-19)
LED 'green:power' not found (err=-19)
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23569
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This command is required to read and set device MAC address. The patch
was copied from mediatek target.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23569
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Use = {} to get rid of the memset so that init is just
pci_register_driver with extra prints.
Assisted-by: Opencode:Big-Pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23976
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Upstream selects these for CRYPTO_KRB5.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23794
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
GCC 15 defaults to C23, where an empty parameter list "()" means
"(void)" instead of an unspecified argument list. This broke two spots
in the bundled tinysrp sources:
- The interrupt() signal handler in t_truerand.c was declared with
"()", so its type became "void (*)(void)" and no longer matched the
"void (*)(int)" expected by signal():
t_truerand.c💯32: error: passing argument 2 of 'signal' from
incompatible pointer type [-Wincompatible-pointer-types]
Give it the proper signal handler signature instead.
- The pre-ANSI fallback in t_defines.h declared strchr(), strrchr()
and strtok() with "()". ead.c is compiled without -DHAVE_CONFIG_H,
so STDC_HEADERS is undefined and that legacy branch is taken, where
the zero-argument prototypes now conflict with the declarations in
the standard headers:
tinysrp/t_defines.h:90:30: error: conflicting types for 'strtok';
have 'char *(void)'
Drop the dead K&R branch and include <stdlib.h> and <string.h>
unconditionally; the library's own objects already take this path
via config.h.
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/23955
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
GCC 15 defaults to C23, where an empty parameter list "()" means
"(void)" instead of an unspecified argument list. This broke thc-ipv6 in
two ways:
- thc-ipv6.h declared thc_open_ipv6() with an empty argument list, so
its prototype became "int(void)" and conflicted with the actual
definition "int thc_open_ipv6(char *interface)" and all of its
callers:
thc-ipv6-lib.c:127:36: error: too many arguments to function
'thc_open_ipv6'; expected 0, have 1
thc-ipv6-lib.c:2555:5: error: conflicting types for 'thc_open_ipv6';
have 'int(char *)'
- The alarming() SIGALRM handlers in detect_sniffer6.c and thcping6.c
were declared with "()", so their type became "void (*)(void)" and no
longer matched the "void (*)(int)" expected by signal():
detect_sniffer6.c:140:19: error: passing argument 2 of 'signal'
from incompatible pointer type [-Wincompatible-pointer-types]
Add patches giving the prototype and the signal handlers their proper
signatures.
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/23956
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
GCC 15 enables -Wheader-guard and the kernel module build treats
warnings as errors, so the mismatched include guards in three driver
headers break the build:
include/rtl8812a_sreset.h:20: error: header guard
'_RTL88812A_SRESET_H_' followed by '#define' of a different macro
[-Werror=header-guard]
Add a patch making each '#ifndef' match its '#define'. rtl8192e_sreset.h
was a copy/paste of the rtl8812a guard, so it gets its own
'_RTL8192E_SRESET_H_' name instead of duplicating '_RTL8812A_SRESET_H_'.
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/23957
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
wdev_update_disabled_vifs() indexed the disabled_vifs map with the wdev
object instead of the vif name. The map is read back via
disabled_vifs[vif.name], so disabled vifs were never matched, and
coercing the wdev object into a string key triggered an infinite
escaping loop in ucv_to_string_json_encoded() during state output,
causing OOM on reboot.
Suggested-by: Shayne Chen (陳軒丞) <Shayne.Chen@mediatek.com>
Reported-by: Michael-cy Lee (李峻宇) <Michael-cy.Lee@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit bumps restool layerscape package to lf-6.18.2-1.0.0 version.
Patch to disable manpage build was dropped and replaced with MANPAGE=""
in MAKE_FLAGS.
Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23290
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
For DHCPv6 address requests (IA_NA), odhcp6c currently uses the first eight
digits of the i/f name's MD5 hash as IAID.
In case of DHCPv6-PD, however, odhcp6c expects the IAID to be specified
explicitly for the IA_PD(s) requested, otherwise it will start counting the
IAID from "1" up for each "-P" argument.
As OpenWrt only requests a single IA_PD per interface, make sure to pass
the identical IAID for IA_PD as is used for IA_NA, unless a custom IAID
was explicitly specified in the i/f configuration.
This prevents regressions with ISPs that expect an IA_PD request to come
from the same IAID+DUID combination as the IA_NA request.
In addition, add some validation of the "reqprefix" value, in order to
catch most cases that would otherwise result in netifd or odhcp6c
malfunction.
Signed-off-by: Shine <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23758
Signed-off-by: Robert Marko <robimarko@gmail.com>
-----
Hardware:
CPU: ARMADA 380 1x1332Mhz
RAM: 512MB DDR3
FLASH: 256MB MX30LF2G18AC
2x SATA III
2x USB3.0
1x USB2.0
i2c to control various states.
RTC with battery
1Gbit LAN (WoL capable)
9x LED
RESET button at back
Power button at front (gpio-poweroff)
Copy button at front
-----
Doesn't work
FAN control
buzzer
-----
UART connections
Connect UART to port J3 115200
+----+----+----+----+----+
|3.3V| TX | RX | | GND|
+----+----+----+ +----+
Depend of UART adapter board can fail to boot when adapter is attached. (all leds are dimmed) .
In that case disconnect UART for an < second and after that all leds should be white.
Stop u-boot by ctrl-c within 3s window. (bootdelay 7s or more helps)
setenv bootdelay 7
saveenv
-----
Instalation via UART
Boot initramfs-kernel.bin
setenv ethact egiga0
setenv serverip 192.168.1.11
setenv ipaddr 192.168.1.12
tftpboot 0x02000000 *initramfs-kernel.bin
bootm 0x02000000 -
Device is DHCP client by default ( as the other supported NAS)
do backup into safe space
/dev/mtd3 Kernel-1
/dev/mtd4 RootFS-1
use sysupgrade in console or via luci
-----
MAC addresses
mac stored in u-boot-env ethaddr
label mac = eth0 mac = 5c:6a:80:xx:xx:xx
-----
Setting up u-boot dual boot
u-boot contain two banks contain two OEM copies
To boot OpenWrt from bank1
setenv next_bootfrom 1
saveenv
To boot OEM from bank2
setenv next_bootfrom 2
saveenv
-----
Configuration via i2c
install i2c-tools
Enable WoL
i2cset -y 0x0 0xa 0xa 0x0006 w
Disable WoL
i2cset -y 0x0 0xa 0xa 0x0306 w
Enable auto power on
i2cset -y 0x0 0x0a 0x0a 0x0107 w
Disable auto power on
i2cset -y 0x0 0x0a 0x0a 0x0007 w
Signed-off-by: Robert Senderek <robert.senderek@10g.pl>
Link: https://github.com/openwrt/openwrt/pull/23228
Signed-off-by: Robert Marko <robimarko@gmail.com>
Split kmod-nf-nathelper-extra into separate helper packages
and keep the original package as a compatibility meta-package.
This allows selecting only the required protocol helpers
instead of installing all helper modules and dependencies.
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/23690
Signed-off-by: Robert Marko <robimarko@gmail.com>
The DUID-UUID was generated from a random UUID, which is regenerated on
every fresh flash and therefore does not survive reconfiguration events
such as reflashing without keeping the configuration. RFC8415/RFC6355
prefer a DUID that remains stable across such events.
Add a ucode helper that picks the first LAN port (falling back to WAN)
from /etc/board.json, resolves its MAC address and derives a stable UUID
from it, falling back to a random UUID only when that fails.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
proto/dhcp.sh hardcoded `-t 0` (infinite retries) with no way
for UCI / operator to tune per-retry interval (udhcpc -T),
retry count (udhcpc -t) or failure retry-loop wait (udhcpc -A).
Add three new proto config ints (timeout, retry, tryagain)
and thread them into the udhcpc command line. Unset options
preserve existing behaviour: retry defaults to 0, timeout and
tryagain are omitted so udhcpc uses its own RFC defaults.
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
When bridge VLAN filtering is active, network_get_physdev resolves
UCI interface names to the VLAN sub-interface (e.g. br-lanv0) rather
than the bridge master. LLDP frames use reserved multicast
(01:80:c2:00:00:0e) which bridges trap to member ports, so lldpd
must listen on the physical ports to receive them.
Detect when the resolved device is a sub-interface of a bridge and
expand it to the list of bridge member ports instead.
Signed-off-by: John Crispin <john@phrozen.org>
9ff6e43bb75f service: notify instance exit details via ubus
4f42296dc4f0 jail: mount rootfs overlay with userxattr in user namespace
60fdbf00e924 jail: chown rootfs overlay dir to mapped root in user namespace
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Only print VHT/HE/EHT center frequency and channel width fields
when they are actually populated. This avoids displaying undefined
values for non-6GHz HE results where channel info is derived from
VHT/HT Operation IEs. Also fix center_chan_2 format specifier from
%s to %d.
Signed-off-by: John Crispin <john@phrozen.org>
Add a proto_dhcp_restart() handler that re-acquires the DHCP lease via a
single ubus call, releasing the previous lease and triggering a fresh
DHCPDISCOVER without bouncing the interface.
The re-acquire is implemented by sending SIGHUP to udhcpc, which releases
the current lease (if any) and immediately transitions the state machine
to INIT_SELECTING so the next main-loop iteration sends a fresh
DHCPDISCOVER. A single signal thus expresses 'release this lease and get
a new one' without exiting the client, so upstream watchdogs (e.g. a
DNS-health monitor) can request a clean re-lease without tearing down the
interface.
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The supplicant config generator read eap_type and auth from UCI for
internal logic but never wrote the corresponding eap= and phase2=
directives to the wpa_supplicant config.
Fix by:
- Generating eap= and phase2= from eap_type/auth for PEAP/TTLS/FAST/TLS
- Adding eap and phase2 to the network_append_vars output list
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
cell.he was only populated when the 6 GHz Operation Information
sub-element was parsed, making HE invisible to scan results on
2.4/5 GHz bands. Fix this by setting cell.he unconditionally when
HE Operation IE (Extension Element 36) is seen.
Gate 6 GHz channel width parsing on cell.band rather than the HE
Operation Parameters bit field, which proved unreliable on MediaTek
firmware. Fix flag byte offsets in the 6 GHz path: VHT Oper Info
Present (BIT 14) and Co-Hosted BSS (BIT 15) are in byte 1 of
he_oper_params which maps to ext[2], not ext[1].
For non-6GHz bands, derive channel width from the already-parsed
VHT/HT Operation IEs instead of leaving cell.he empty.
Signed-off-by: John Crispin <john@phrozen.org>
abfaaac65929 netifd: fix const-discard warnings in attr/devtype parsing
52c7db3a2beb bridge: remove kernel member on teardown regardless of device claim state
741fd3c162df bridge: attempt delbr unconditionally on bridge destroy
2909720f8cf1 system-linux: detach device from stale bridge before adding it
67f06ef1600a interface: detach hotplug members on reassignment
bb7f0a456dce interface-ip: skip offlink handling on point-to-point links
c1f9d4df847a system-linux: guard PSE port priority for older kernel headers
b087b0773366 build: prefer libnl-tiny and fix LIBNL detection on reconfigure
b0063715d7ea device: add broadcast_flood bridge port setting
973354a1a6f0 interface: add carrier_loss_delay option
d155e4cefbd9 interface: add restart support
Signed-off-by: Felix Fietkau <nbd@nbd.name>
A patch was added without proper header.
Add a header that explains what the patch does and its prerequisites.
Fixes: e42e9c8133
Signed-off-by: Shine <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23917
Signed-off-by: Robert Marko <robimarko@gmail.com>
A patch was added without proper header and not obvious that it's a
backport. Replace that patch with a backport of the upstream commit.
Patch 001-build-simplify-the-instantiation-of-nftversion-h.patch
rebased, all others refreshed.
Fixes: 255f4c8e60 ("packages: nftables: fix build on host with busybox ash")
Link: https://github.com/openwrt/openwrt/pull/23910
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Bump the PKG_RELEASE as it was missed when adding a patch.
Fixes: 255f4c8e60 ("packages: nftables: fix build on host with busybox ash")
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Numeric for loops are a bashism and won't work in BusyBox' ash. Replace
with a portable equivalent.
Backport of a post-1.1.6 nftables fix.
Signed-off-by: Shine <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/21957
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Due to POSIX style ioctl() declaration in MUSL, arm-trusted-firmware-tools
fails to build on MUSL based hosts with -Werror and -pedantic GCC switches
enabled. Alpine Linux, for example, fixes this with an unconditional cast
to "int". This commit tries to apply this cast only for MUSL based build
hosts, while keeping the type as-is where the cast isn't needed. Maybe
overkill, but cleaner than an unconditional cast.
Fixes: #13339
Signed-off-by: Shine <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/21957
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This commit introduces OpenWrt U-Boot all-in-ubi layout support
for the CreatLentem CLT-R30B1, enabling:
- Fully-featured U-Boot
- Effective recovery mechanisms
- Prolonged device lifetime by allocating most of the flash
to UBI (which takes care of wear-leveling)
- Maximum available storage space for OpenWrt
- Unified firmware across different device variants
OpenWrt U-Boot UBI flash instructions
-------------------------------------
Using the installer image
-------------------------
To simplify the installation process, this method uses a fork
of Daniel Golle's (@dangowrt) UBI Installer
https://github.com/dangowrt/owrt-ubi-installer
1. Ensure your router is running the latest generic OpenWrt firmware.
Upgrade it if necessary.
2. Obtain the installer image:
Build the installer from source
https://github.com/andros-ua/owrt-ubi-installer/tree/clt-r30b1
or download a prebuilt image from the
https://github.com/andros-ua/owrt-ubi-installer/releases
3. Flash the openwrt*creatlentem_clt-r30b1-ubi-initramfs-recovery-installer.itb
image using sysupgrade.
4. Wait for installation: the green status LED will blink rapidly,
indicating that the all-in-UBI installer is running.
5. Once the installation finishes,
the status LED will turn solid white (lime) for 5 seconds.
6. After the device reboots, perform a final sysupgrade using the
openwrt*creatlentem_clt-r30b1-ubi-squashfs-sysupgrade.itb image.
Return to stock layout
----------------------
1. Flash openwrt*creatlentem_clt-r30b1(-112m)-initramfs-kernel.bin
via sysupgrade
2. Copy files to /tmp on the device via SCP:
BL2.bin
u-boot-env.bin
Factory.bin
FIP.bin
openwrt*creatlentem_clt-r30b1(-112m)-squashfs-sysupgrade.bin
3. Restore stock MTD partitions:
apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd write /tmp/BL2.bin BL2
mtd write /tmp/u-boot-env.bin u-boot-env
mtd write /tmp/Factory.bin Factory
mtd write /tmp/FIP.bin FIP
4. Install the system:
sysupgrade /tmp/*sysupgrade.bin
Recovery
--------
Use mtk_uartboot to recover corrupted BL2 or FIP via UART:
https://github.com/981213/mtk_uartboot
Stock layout
----------------------------------------
| dev: size erasesize name |
| mtd0: 00100000 00020000 "BL2" |
| mtd1: 00080000 00020000 "u-boot-env" |
| mtd2: 00200000 00020000 "Factory" |
| mtd3: 00200000 00020000 "FIP" |
| mtd4: 07000000 00020000 "ubi" |
----------------------------------------
OpenWrt U-Boot UBI layout
----------------------------------
| dev: size erasesize name |
| mtd0: 00100000 00020000 "BL2" |
| mtd1: 07f00000 00020000 "ubi" |
----------------------------------
Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20666
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This board is the control board for the Antminer S9 miners.
SoC: Xilinx XC7Z010 - dual-core Cortex-A9 with FPGA stack
Memory: 512Mb DDR3
NIC: 1Gbit ethernet (BCM B50612E PHY)
Flash: 256Mb NAND (Micron MT29F2G08ABAEAWP)
Storage: SD-card slot
Other: control pins available via FPGA stack
Admittedly, there is a limited number of use cases available
for these boards outside of the miners and the lack of FPGA
tooling in OpenWrt. However, for one, they are easily and cheaply
available, for two, the reason for adding this is to provide an
easy addition to the boardfarm for continuous testing of this target.
Notes: For u-boot, an additional patch is required to support
booting from SD-cards. This is because EXTRA_ENV_SETTINGS is
already defined in the board's u-boot config, which is the same
place where the zynq-common.dtsi defines the required envvars.
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
This is unfortunately needed to disable the signature verification
in the stock bootloader.
Co-authored-by: Paul Spooren <mail@aparcar.org>
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Paul Spooren <mail@aparcar.org>
This is a dual-radio 802.11a/b/g/n/ac access point with
dual Gigabit Ethernet.
There are two closely related models: The AP-324, which has external
antenna connectors, and the AP-325, which has internal antennas.
The board appears to be identical, and the same image works on both.
Additionally, the Siemens Scalance W1750D is an OEM variant using
the same board, so the image also works on that.
Unfortunately the factory APBoot bootloader enforces cryptographic
signatures on the firmware before booting, so a modified version
must be flashed via the serial port. See [^1] for details.
Specifications
==============
* Device: Aruba AP-325 / AP-324
* SoC: Qualcomm IPQ8068 2x1.4GHz ARMv7-A
* RAM: 512MiB (2x Winbond W632GU6MB-12)
* SPI flash: 4MiB Macronix MX25U3235F
* NAND flash: 128MiB Winbond W29N01HZBINF
* WiFi: 2x Qualcomm QCA9990 (one 2.4G, one 5G)
* Ethernet: 2x 1000BASE-T (Marvell 88E1514 PHY), both PoE-capable
* Power: PoE 802.3at or 12V DC jack
* LEDs: Red/Amber/Green status LED, Amber/Green WiFi LED
* Buttons: 1x, behind hole next to DC jack
* Console: RJ45 connector, Cisco pinout
* USB: 1x USB 2.0 Type A, 1x internal to BLE, SoC has USB 3.0
host but board is only wired for 2.0
* BLE: TI CC2540 SoC, connected to USB and UART, unpopulated
debug header on PCB
* TPM: Atmel AT97SC3205T
How to install
==============
The stock bootloader APBoot appears to be vendor fork of U-Boot, which
disables much of the usual functionality and comes with its own booting
and firmware upgrade logic.
Unfortunately, this logic enforces RSA signatures on images,
even for the default boot from NAND.
Therefore, a patched bootloader is needed, which is built as a package.
In addition to the signature check removal, this also changes
the serial baudrate to 115200.
Luckily, the stock firmware does not disable the `sf` command
(it just hides it until you run `diag`), so the patched bootloader
can be fetched via TFTP and then flashed via console.
Flashing patched APBoot
-----------------------
* Build OpenWrt, or download `openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn`
* Connect serial cable and wired ethernet
* Access stock APBoot console at Baud 9600
* Flash patched bootloader:
```
setenv serverip <your TFTP server IP>
setenv autostart n
netget 44000000 openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn
sf probe 0
sf erase 220000 100000
sf write 44000000 220000 100000
reset
```
Booting OpenWrt
---------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Run `setenv serverip <your TFTP server IP>`
* Run `tftpboot openwrt-ipq806x-generic-aruba_ap-32x-initramfs.ari`
Installing OpenWrt
------------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Consider backing up stock firmware(s) (UBI volumes `aos0` and/or `aos1`)
by booting into OpenWrt via initramfs (see above) and dumping them
* Wipe and repartition NAND flash (see below for explanation):
```
nand device 0
nand erase.chip
reset
ubi part ubifs
ubi remove ubifs
ubi create ubifs 1
ubi create rootfs_data
```
* Follow steps above to boot OpenWrt via initramfs
* From OpenWrt, persist installation via sysupgrade
Reverting to stock FW
---------------------
The patched bootloader remains compatible with the original firmware,
so you can just wipe the NAND, let APBoot recreate the partitions,
and flash back the `aos0`/`aos1` backup from above.
Current status
==============
Tested and working
------------------
* Console
* Wired GbE (both ports)
* WiFi (both 2.4G and 5G)
* LEDs
* Restart Button
* USB port
* External watchdog
* TPM
* BLE SoC
Future work
-----------
* GPIOs for:
* power source (8 indicates DC jack, 59 indicates 802.3at)
* reset source (64 for warm reset, 65 for watchdog)
* USB overcurrent (63)
* BLE SoC reflashing
* CC2540 comes with Aruba-specific FW out of the box
* Debug header is exposed on PCB (pinout GND-VCC-Clock-Data-Reset),
but that requires disassembly
* Stock BLE FW appears to support reflashing via UART, but protocol
would need to be reverse-engineered
* ramoops/pstore
* It appears that APBoot clears the RAM on boot, might be something
we can patch out as well
* Porting a modern U-Boot
Flash layout
============
SPI flash
---------
```
0x000000-0x020000 sbl1
0x020000-0x040000 mibib
0x040000-0x080000 sbl2
0x080000-0x100000 sbl3
0x100000-0x110000 ddrconfig
0x110000-0x120000 ssd
0x120000-0x1a0000 tz
0x1a0000-0x220000 rpm
0x220000-0x320000 appsbl
0x320000-0x330000 appsblenv
0x330000-0x370000 art
0x370000-0x380000 panicdump
0x380000-0x390000 certificate
0x390000-0x3a0000 mfginfo
0x3a0000-0x3b0000 flashcache
0x3b0000-0x400000 aosspare
```
Factory NAND flash
------------------
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains kernel+initrd of the primary firmware,
initrd contains the entire root FS
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains kernel+initrd of the secondary firmware,
initrd contains the entire root FS
* 64MiB MTD partition `ubifs`, formatted as UBI
* 64MiB UBI volume `ubifs`
* Contains UBIFS, overlay-mounted on top of the initrd,
shared between firmware slots
APBoot understands UBI, and will read the kernel from the
`aos0` or `aos1` volume (depending on `os_partition`)
with fallback to the other one in case a check fails.
Kernels are expected to have a vendor-specific header, the included
script will add that header with the correct checksum but no signature.
OpenWrt NAND flash
------------------
OpenWrt assumes separate UBI volumes for kernel and rootfs,
as well as a volume that must be named `rootfs_data` for the UBIFS.
Unfortunately, APBoot actively checks the UBI volumes at boot, and will
repartition if it doesn't find the volumes that it expects (listed above).
Luckily, it doesn't check their size, only their existence. Therefore,
we can use the following layout:
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains OpenWrt kernel+initrd
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains OpenWrt root squashfs
* 64MiB MTD partition `ubifs`, formatted as UBI
* small (single-LEB) UBI volume `ubifs`
* Dummy volume, only there to satisfy APBoot
* almost 64MiB UBI volume `rootfs_data`
* contains UBIFS, overlay-mounted on top of the rootfs
[^1]: https://github.com/lukasstockner/ap325-apboot-openwrt
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Paul Spooren <mail@aparcar.org>
On the AP-325 (and variants), the bootloader enforces a particular UBI volume
layout and naming, so unfortunately the kernel's UBI volume and MTD partition
end up with the name, which confuses the current logic.
Therefore, add an option to ignore the MTD partition.
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Paul Spooren <mail@aparcar.org>
The current code assumes that the rootfs_data UBI volume is on the same MTD
partition as the rootfs.
Unfortunately, this does not work on the Aruba AP-325 (and variants), since
the bootloader enforces a particular UBI volume layout.
Therefore, this adds a separate variable to set the rootfs_data partition,
and updates all existing devices with a non-default rootfs partition to also
specify the new variable.
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Paul Spooren <mail@aparcar.org>
This is unfortunately needed to disable the signature verification
in the stock bootloader.
Co-authored-by: Paul Spooren <mail@aparcar.org>
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Test Dev <dev@example.org>
This is a dual-radio 802.11a/b/g/n/ac access point with
dual Gigabit Ethernet.
There are two closely related models: The AP-324, which has external
antenna connectors, and the AP-325, which has internal antennas.
The board appears to be identical, and the same image works on both.
Additionally, the Siemens Scalance W1750D is an OEM variant using
the same board, so the image also works on that.
Unfortunately the factory APBoot bootloader enforces cryptographic
signatures on the firmware before booting, so a modified version
must be flashed via the serial port. See [^1] for details.
Specifications
==============
* Device: Aruba AP-325 / AP-324
* SoC: Qualcomm IPQ8068 2x1.4GHz ARMv7-A
* RAM: 512MiB (2x Winbond W632GU6MB-12)
* SPI flash: 4MiB Macronix MX25U3235F
* NAND flash: 128MiB Winbond W29N01HZBINF
* WiFi: 2x Qualcomm QCA9990 (one 2.4G, one 5G)
* Ethernet: 2x 1000BASE-T (Marvell 88E1514 PHY), both PoE-capable
* Power: PoE 802.3at or 12V DC jack
* LEDs: Red/Amber/Green status LED, Amber/Green WiFi LED
* Buttons: 1x, behind hole next to DC jack
* Console: RJ45 connector, Cisco pinout
* USB: 1x USB 2.0 Type A, 1x internal to BLE, SoC has USB 3.0
host but board is only wired for 2.0
* BLE: TI CC2540 SoC, connected to USB and UART, unpopulated
debug header on PCB
* TPM: Atmel AT97SC3205T
How to install
==============
The stock bootloader APBoot appears to be vendor fork of U-Boot, which
disables much of the usual functionality and comes with its own booting
and firmware upgrade logic.
Unfortunately, this logic enforces RSA signatures on images,
even for the default boot from NAND.
Therefore, a patched bootloader is needed, which is built as a package.
In addition to the signature check removal, this also changes
the serial baudrate to 115200.
Luckily, the stock firmware does not disable the `sf` command
(it just hides it until you run `diag`), so the patched bootloader
can be fetched via TFTP and then flashed via console.
Flashing patched APBoot
-----------------------
* Build OpenWrt, or download `openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn`
* Connect serial cable and wired ethernet
* Access stock APBoot console at Baud 9600
* Flash patched bootloader:
```
setenv serverip <your TFTP server IP>
setenv autostart n
netget 44000000 openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn
sf probe 0
sf erase 220000 100000
sf write 44000000 220000 100000
reset
```
Booting OpenWrt
---------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Run `setenv serverip <your TFTP server IP>`
* Run `tftpboot openwrt-ipq806x-generic-aruba_ap-32x-initramfs.ari`
Installing OpenWrt
------------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Consider backing up stock firmware(s) (UBI volumes `aos0` and/or `aos1`)
by booting into OpenWrt via initramfs (see above) and dumping them
* Wipe and repartition NAND flash (see below for explanation):
```
nand device 0
nand erase.chip
reset
ubi part ubifs
ubi remove ubifs
ubi create ubifs 1
ubi create rootfs_data
```
* Follow steps above to boot OpenWrt via initramfs
* From OpenWrt, persist installation via sysupgrade
Reverting to stock FW
---------------------
The patched bootloader remains compatible with the original firmware,
so you can just wipe the NAND, let APBoot recreate the partitions,
and flash back the `aos0`/`aos1` backup from above.
Current status
==============
Tested and working
------------------
* Console
* Wired GbE (both ports)
* WiFi (both 2.4G and 5G)
* LEDs
* Restart Button
* USB port
* External watchdog
* TPM
* BLE SoC
Future work
-----------
* GPIOs for:
* power source (8 indicates DC jack, 59 indicates 802.3at)
* reset source (64 for warm reset, 65 for watchdog)
* USB overcurrent (63)
* BLE SoC reflashing
* CC2540 comes with Aruba-specific FW out of the box
* Debug header is exposed on PCB (pinout GND-VCC-Clock-Data-Reset),
but that requires disassembly
* Stock BLE FW appears to support reflashing via UART, but protocol
would need to be reverse-engineered
* ramoops/pstore
* It appears that APBoot clears the RAM on boot, might be something
we can patch out as well
* Porting a modern U-Boot
Flash layout
============
SPI flash
---------
```
0x000000-0x020000 sbl1
0x020000-0x040000 mibib
0x040000-0x080000 sbl2
0x080000-0x100000 sbl3
0x100000-0x110000 ddrconfig
0x110000-0x120000 ssd
0x120000-0x1a0000 tz
0x1a0000-0x220000 rpm
0x220000-0x320000 appsbl
0x320000-0x330000 appsblenv
0x330000-0x370000 art
0x370000-0x380000 panicdump
0x380000-0x390000 certificate
0x390000-0x3a0000 mfginfo
0x3a0000-0x3b0000 flashcache
0x3b0000-0x400000 aosspare
```
Factory NAND flash
------------------
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains kernel+initrd of the primary firmware,
initrd contains the entire root FS
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains kernel+initrd of the secondary firmware,
initrd contains the entire root FS
* 64MiB MTD partition `ubifs`, formatted as UBI
* 64MiB UBI volume `ubifs`
* Contains UBIFS, overlay-mounted on top of the initrd,
shared between firmware slots
APBoot understands UBI, and will read the kernel from the
`aos0` or `aos1` volume (depending on `os_partition`)
with fallback to the other one in case a check fails.
Kernels are expected to have a vendor-specific header, the included
script will add that header with the correct checksum but no signature.
OpenWrt NAND flash
------------------
OpenWrt assumes separate UBI volumes for kernel and rootfs,
as well as a volume that must be named `rootfs_data` for the UBIFS.
Unfortunately, APBoot actively checks the UBI volumes at boot, and will
repartition if it doesn't find the volumes that it expects (listed above).
Luckily, it doesn't check their size, only their existence. Therefore,
we can use the following layout:
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains OpenWrt kernel+initrd
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains OpenWrt root squashfs
* 64MiB MTD partition `ubifs`, formatted as UBI
* small (single-LEB) UBI volume `ubifs`
* Dummy volume, only there to satisfy APBoot
* almost 64MiB UBI volume `rootfs_data`
* contains UBIFS, overlay-mounted on top of the rootfs
[^1]: https://github.com/lukasstockner/ap325-apboot-openwrt
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Test Dev <dev@example.org>
On the AP-325 (and variants), the bootloader enforces a particular UBI volume
layout and naming, so unfortunately the kernel's UBI volume and MTD partition
end up with the name, which confuses the current logic.
Therefore, add an option to ignore the MTD partition.
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Test Dev <dev@example.org>
The current code assumes that the rootfs_data UBI volume is on the same MTD
partition as the rootfs.
Unfortunately, this does not work on the Aruba AP-325 (and variants), since
the bootloader enforces a particular UBI volume layout.
Therefore, this adds a separate variable to set the rootfs_data partition,
and updates all existing devices with a non-default rootfs partition to also
specify the new variable.
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Test Dev <dev@example.org>
This commit fixes "286f377389a button-hotplug: add KEY_SETUP and KEY_VENDOR
handling" which changed the code without bumping the PKG_RELEASE, resulting in
different binaries under the same version.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Link: https://github.com/openwrt/openwrt/pull/23826
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
This commit fixes "a5107ad58c6 mtd: fix buffer leak and fd leak in mtd_dump()"
which changed the code but did not increase the release. This causes two
packages with the same version to have different content and thereby hashes.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Link: https://github.com/openwrt/openwrt/pull/23827
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Add basic support for the TP-Link SG2008P V3 variant. The switch appears
to be identical to the V1 variant, except that it uses the MP3924
instead of the TPS23861 PoE chip.
Specifications:
---------------
* SoC: Realtek RTL8380M
* Flash: 32 MiB SPI flash (Vendor varies)
* RAM: 256 MiB (Vendor varies)
* Ethernet: 8x 10/100/1000 Mbps with PoE on 4 ports
* Buttons: 1x "Reset" button on front panel
* Power: 53.5V DC barrel jack
* UART: 1x serial header, unpopulated
* PoE: 1x MPS MP3924 I2C PoE controller
Works:
------
- (8) RJ-45 ethernet ports
- Switch functions
- System LED
- Basic PoE support (no driver, but a startup script puts the chip
into AUTO mode)
Not yet enabled:
----------------
- PoE, Link/Act, PoE max and System LEDs
Install via web interface:
-------------------------
Not supported at this time.
Install via serial console/tftp:
--------------------------------
The footprints R27 (0201) and R28 (0402) are not populated. To enable
serial console, 50 ohm resistors should be soldered -- any value from
0 ohm to 50 ohm will work. R27 can be replaced by a solder bridge.
The u-boot firmware drops to a TP-Link specific "BOOTUTIL" shell at
38400 baud. There is no known way to exit out of this shell, and no
way to do anything useful.
Ideally, one would trick the bootloader into flashing the sysupgrade
image first. However, if the image exceeds 6MiB in size, it will not
work. The sysupgrade image can also be flashed. To install OpenWRT:
Prepare a tftp server with:
1. server address: 192.168.0.146
2. the image as: "uImage.img"
Power on device, and stop boot by pressing any key.
Once the shell is active:
1. Ground out the CLK (pin 16) of the ROM (U7)
2. Select option "3. Start"
3. Bootloader notes that "The kernel has been damaged!"
4. Release CLK as sson as bootloader thinks image is corrupted.
5. Bootloader enters automatic recovery -- details printed on console
6. Watch as the bootloader flashes and boots OpenWRT.
Blind install via tftp:
-----------------------
This method works when it's not feasible to install a serial header.
Prepare a tftp server with:
1. server address: 192.168.0.146
2. the image as: "uImage.img"
3. Watch network traffic (tcpdump or wireshark works)
4. Power on the device.
5. Wait 1-2 seconds then ground out the CLK (pin 16) of the ROM (U7)
6. When 192.168.0.30 makes tftp requests, release pin 16
7. Wait 2-3 minutes for device to auto-flash and boot OpenWRT
Signed-off-by: Daniel Tang <tangrs@google.com>
Link: https://github.com/openwrt/openwrt/pull/20616
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
handle_send_a() computed the SRP "A" parameter length as
len = ntohl(msg->len) - sizeof(struct ead_msg_number);
sizeof(struct ead_msg_number) is 1, and the subtraction is evaluated in
unsigned arithmetic. A packet with msg->len == 0 therefore wraps the
result to a huge value which, assigned to the signed int len, becomes -1.
The following bounds check is signed:
if (len > MAXPARAMLEN + 1)
return false;
so -1 passes, and memcpy(A.data, number->data, len) runs with len cast to
size_t (~SIZE_MAX) against the 257-byte abuf, crashing the daemon.
Neither parse_message() nor handle_packet() validate msg->len (only the
captured packet length), so an unauthenticated attacker on the local
segment can reach this path and crash ead with a single crafted packet.
Validate the claimed length in unsigned arithmetic before the subtraction
and bound it on both sides. Doing the upper-bound check unsigned as well
also closes a 32-bit-only variant where sizeof(ead_packet) + msg->len
overflows in handle_packet(), letting a large msg->len reach the same
negative-len path.
Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw
Reported-by: @Vasco0x4
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
