Hardware
--------
CPU: Qualcomm IPQ4018
RAM: 256M
FLASH: 32M SPI NOR W25Q256
ETH: QCA8075
WiFi2: IPQ4018 2T2R 2SS b/g/n
WiFi5: IPQ4018 2T2R 2SS n/ac
LED: - Power amber
- LAN1(PoE) green
- LAN2 green
- Wi-Fi 2.4GHz green
- Wi-Fi 5GHz green
BTN: - WPS
UART: 115200n8 3.3V J1
VCC(1) - GND(2) - TX(3) - RX(4)
Added basic support to get the device up and running for a sysupgrade
image only.
There is currently no way back to factory firmware, so this is a one-way
street to OpenWRT.
Install from factory condition is convoluted, and may brick your device:
1) Enable SSH and disable the CLI on the factory device from the web user
interface (Management->Advanced)
2) Reboot the device
3) Override the default, limited SSH shell:
a) Get into the ssh shell:
ssh admin@192.168.1.1 /bin/sh --login
b) Change the dropbear script to disable the limited shell. At the
empty command prompt type:
sed -i '/login_ssh/s/^/#/g’ dropbear
/etc/init.d/dropbear restart
exit
4) ssh in to a (now-) normal OpenWRT SSH session
5) Flash your built image
a) scp openwrt-ipq40xx-engenius_ens620ext-squashfs-sysupgrade.bin
admin@192.168.1.1:/tmp/
b) ssh admin@192.168.1.1
c) sysupgrade -n
/tmp/openwrt-ipq40xx-engenius_ens620ext-squashfs-sysupgrade.bin
6) After flash completes (it may say "Upgrade failed" followed by
"Upgrade completed") and device reboots, log in to newly flashed
system. Note you will now need to ssh as root rather than admin.
Signed-off-by: Steve Glennon <s.glennon@cablelabs.com>
[whitespace fixes, reordered partitions, removed rng node from 4.14,
fixed 901-arm-boot-add-dts-files.patch]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Hardware
--------
CPU: Qualcomm IPQ4019
RAM: 256M (NANYA NT5CC128M16JR-EK)
FLASH: 128M NAND (Macronix MX30LF1G18AC-XKI)
ETH: Qualcomm QCA8072
WiFi2: IPQ4019 2T2R 2SS b/g/n
WiFi5: IPQ4019 2T2R 2SS n/ac
WiFi5: QCA9984 4T4R 4SS n/ac
LED: - Connect green/blue/red
- Power green
BTN: WPS/Connect
UART: 115200n8 3.3V
VCC - RX - TX - GND (Square is VCC)
Installation
------------
1. Grab the uboot for the Device from the 'u-boot-fritz3000'
subdirectory. Place it in the same directory as the 'eva_ramboot.py'
script. It is located in the 'scripts/flashing' subdirectory of the
OpenWRT tree.
2. Assign yourself the IP address 192.168.178.10/24. Connect your
Computer to one of the boxes LAN ports.
3. Connect Power to the Box. As soon as the LAN port of your computer
shows link, load the U-Boot to the box using following command.
> ./eva_ramboot.py --offset 0x85000000 192.168.178.1 uboot-fritz3000.bin
4. The U-Boot will now start. Now assign yourself the IP address
192.168.1.70/24. Copy the OpenWRT initramfs (!) image to a TFTP
server root directory and rename it to 'FRITZ3000.bin'.
5. The Box will now boot OpenWRT from RAM. This can take up to two
minutes.
6. Copy the U-Boot and the OpenWRT sysupgrade (!) image to the Box using
scp. SSH into the Box and first write the Bootloader to both previous
kernel partitions.
> mtd write /path/to/uboot-fritz3000.bin uboot0
> mtd write /path/to/uboot-fritz3000.bin uboot1
7. Remove the AVM filesystem partitions to make room for our kernel +
rootfs + overlayfs.
> ubirmvol /dev/ubi0 --name=avm_filesys_0
> ubirmvol /dev/ubi0 --name=avm_filesys_1
8. Flash OpenWRT peristently using sysupgrade.
> sysupgrade -n /path/to/openwrt-sysupgrade.bin
Signed-off-by: David Bauer <mail@david-bauer.net>
This patch fixes a problem that was discovered during DSA
development. On the MR33, the link change events from the
external AR8035-PHY would never make it to the qca8k driver.
The issue turned out to be a misplaced memcpy that was copying
over the zero-initialized irq table, when it should have been
set to PHY_POLL. Hence this patch moves the memcpy after the
array has been initialized.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Backport below changes for I2C QUP driver from v4.17:
0668bc44a426 i2c: qup: fix copyrights and update to SPDX identifier
7239872fb340 i2c: qup: fixed releasing dma without flush operation completion
eb422b539c1f i2c: qup: minor code reorganization for use_dma
6d5f37f166bb i2c: qup: remove redundant variables for BAM SG count
c5adc0fa63a9 i2c: qup: schedule EOT and FLUSH tags at the end of transfer
7e6c35fe602d i2c: qup: fix the transfer length for BAM RX EOT FLUSH tags
3f450d3eea14 i2c: qup: proper error handling for i2c error in BAM mode
08f15963bc75 i2c: qup: use the complete transfer length to choose DMA mode
ecb6e1e5f435 i2c: qup: change completion timeout according to transfer length
6f2f0f6465ac i2c: qup: fix buffer overflow for multiple msg of maximum xfer len
f7714b4e451b i2c: qup: send NACK for last read sub transfers
fbfab1ab0658 i2c: qup: reorganization of driver code to remove polling for qup v1
7545c7dba169 i2c: qup: reorganization of driver code to remove polling for qup v2
This fixes various I2C issues observed on AP120C-AC board equipped with
Atmel/Microchip AT97SC3205T TPM module.
Tested-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Hardware
--------
CPU: Qualcomm IPQ4019
RAM: 256M
FLASH: 128M NAND
ETH: QCA8075
VDSL: Intel/Lantiq VRX518 PCIe attached
currently not supported
DECT: Dialog SC14448
currently not supported
WiFi2: IPQ4019 2T2R 2SS b/g/n
WiFi5: IPQ4019 2T2R 2SS n/ac
LED: - Power/DSL green
- WLAN green
- FON/DECT green
- Connect/WPS green
- Info green
- Info red
BTN: - WLAN
- FON
- WPS/Connect
UART: 115200n8 3.3V (located under the Dialog chip)
VCC - RX - TX - GND (Square is VCC)
Installation
------------
1. Grab the uboot for the Device from the 'u-boot-fritz7530'
subdirectory. Place it in the same directory as the 'eva_ramboot.py'
script. It is located in the 'scripts/flashing' subdirectory of the
OpenWRT tree.
2. Assign yourself the IP address 192.168.178.10/24. Connect your
Computer to one of the boxes LAN ports.
3. Connect Power to the Box. As soon as the LAN port of your computer
shows link, load the U-Boot to the box using following command.
> ./eva_ramboot.py --offset 0x85000000 192.168.178.1 uboot-fritz7530.bin
4. The U-Boot will now start. Now assign yourself the IP address
192.168.1.70/24. Copy the OpenWRT initramfs (!) image to a TFTP
server root directory and rename it to 'FRITZ7530.bin'.
5. The Box will now boot OpenWRT from RAM. This can take up to two
minutes.
6. Copy the U-Boot and the OpenWRT sysupgrade (!) image to the Box using
scp. SSH into the Box and first write the Bootloader to both previous
kernel partitions.
> mtd write /path/to/uboot-fritz7530.bin uboot0
> mtd write /path/to/uboot-fritz7530.bin uboot1
7. Remove the AVM filesystem partitions to make room for our kernel +
rootfs + overlayfs.
> ubirmvol /dev/ubi0 --name=avm_filesys_0
> ubirmvol /dev/ubi0 --name=avm_filesys_1
8. Flash OpenWRT peristently using sysupgrade.
> sysupgrade -n /path/to/openwrt-sysupgrade.bin
Signed-off-by: David Bauer <mail@david-bauer.net>
[removed pcie-dts range node, refreshed on top of AP120-AC/E2600AC]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
From: Niklas Cassel <niklas.cassel@linaro.org>
|The databook clearly states that the MSI IRQ (msi_ctrl_int) is a level
|triggered interrupt.
|
|The msi_ctrl_int will be high for as long as any MSI status bit is set,
|thus the IRQ type should be set to IRQ_TYPE_LEVEL_HIGH, causing the
|IRQ handler to keep getting called, as long as any MSI status bit is set.
|[...]
|Not having the correct IRQ type defined will cause us to lose interrupts,
|which in turn causes timeouts in the PCIe endpoint drivers.
|
|Signed-off-by: Niklas Cassel <niklas.cassel@linaro.org>
|Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
David Bauer reported that the VDSL modem (attached via PCIe)
on his AVM Fritz!Box 7530 was complaining about not having
enough space in the BAR. A closer inspection of the old
qcom-ipq40xx.dtsi pulled from the GL-iNet repository listed:
| qcom,pcie@80000 {
| compatible = "qcom,msm_pcie";
| reg = <0x80000 0x2000>,
| <0x99000 0x800>,
| <0x40000000 0xf1d>,
| <0x40000f20 0xa8>,
| <0x40100000 0x1000>,
| <0x40200000 0x100000>,
| <0x40300000 0xd00000>;
| reg-names = "parf", "phy", "dm_core", "elbi",
| "conf", "io", "bars";
Matching the reg-names with the listed reg leads to
<0xd00000> as the size for the "bars".
BugLink: https://www.mail-archive.com/openwrt-devel@lists.openwrt.org/msg45212.html
Reported-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Qxwlan E2600AC C1 based on IPQ4019
Specifications:
SOC: Qualcomm IPQ4019
DRAM: 256 MiB
FLASH: 32 MiB Winbond W25Q256
ETH: Qualcomm QCA8075
WLAN: 5G + 5G/2.4G
* 2T2R 2.4/5 GHz
- QCA4019 hw1.0 (SoC)
* 2T2R 5 GHz
- QCA4019 hw1.0 (SoC)
INPUT: Reset buutton
LED: 1x Power ,6 driven by gpio
SERIAL: UART (J5)
UUSB: USB3.0
POWER: 1x DC jack for main power input (9-24 V)
SLOT: Pcie (J25), sim card (J11), SD card (J51)
Flash instruction (using U-Boot CLI and tftp server):
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "sysupgrade" filename to "firmware.bin" and place it in tftp
server directory.
- Connect PC with one of RJ45 ports, power up the board and press
"enter" key to access U-Boot CLI.
- Use the following command to update the device to OpenWrt: "run lfw".
Flash instruction (using U-Boot web-based recovery):
- Configure PC with static IP 192.168.1.xxx(2-254)/24.
- Connect PC with one of RJ45 ports, press the reset button, power up
the board and keep button pressed for around 6-7 seconds, until LEDs
start flashing.
- Open your browser and enter 192.168.1.1, select "sysupgrade" image
and click the upgrade button.
Qxwlan E2600AC C2 based on IPQ4019
Specifications:
SOC: Qualcomm IPQ4019
DRAM: 256 MiB
NOR: 16 MiB Winbond W25Q128
NAND: 128MiB Micron MT29F1G08ABAEAWP
ETH: Qualcomm QCA8075
WLAN: 5G + 5G/2.4G
* 2T2R 2.4/5 GHz
- QCA4019 hw1.0 (SoC)
* 2T2R 5 GHz
- QCA4019 hw1.0 (SoC)
INPUT: Reset buutton
LED: 1x Power, 6 driven by gpio
SERIAL: UART (J5)
USB: USB3.0
POWER: 1x DC jack for main power input (9-24 V)
SLOT: Pcie (J25), sim card (J11), SD card (J51)
Flash instruction (using U-Boot CLI and tftp server):
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "ubi" filename to "ubi-firmware.bin" and place it in tftp
server directory.
- Connect PC with one of RJ45 ports, power up the board and press
"enter" key to access U-Boot CLI.
- Use the following command to update the device to OpenWrt: "run lfw".
Flash instruction (using U-Boot web-based recovery):
- Configure PC with static IP 192.168.1.xxx(2-254)/24.
- Connect PC with one of RJ45 ports, press the reset button, power up
the board and keep button pressed for around 6-7 seconds, until LEDs
start flashing.
- Open your browser and enter 192.168.1.1, select "ubi" image
and click the upgrade button.
Signed-off-by: 张鹏 <sd20@qxwlan.com>
[ added rng node. whitespace fixes, ported 02_network,
ipq-wifi Makefile, misc dts fixes, trivial message changes ]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
ALFA Network AP120C-AC is a dual-band ceiling AP, based on Qualcomm
IPQ4018 + QCA8075 platform.
Specification:
- Qualcomm IPQ4018 (717 MHz)
- 256 MB of RAM (DDR3)
- 16 MB (SPI NOR) + 128 MB (SPI NAND) of flash
- 2x Gbps Ethernet, with 802.3af PoE support in one port
- 2T2R 2.4/5 GHz (IPQ4018), with ext. FEMs (QFE1952, QFE1922)
- 3x U.FL connectors
- 1x 1.8 dBi (Bluetooth) and 2x 3/5 dBi dual-band (Wi-Fi) antennas
- Atmel/Microchip AT97SC3205T TPM module (I2C bus)
- TI CC2540 Bluetooth LE module (USB 2.0 bus)
- 4x LED (all driven by GPIO)
- 1x button (reset)
- 1x USB 2.0 (optional, not installed in indoor version)
- DC jack for main power input (12 V)
- UART header available on PCB (2.0 mm pitch)
Flash instruction:
1. This board uses dual-image feature (128 MB NAND is divided into two
64 MB partitions: 'rootfs1' and 'rootfs2').
2. Before update, make sure your device is running firmware no older
than v1.1 (previous versions have incompatible U-Boot).
3. Use 'factory' image in vendor GUI or for sysupgrade tool, without
preserving settings.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Without a proper SPI NAND support (SPI NAND framework is available in
kernel >= 4.19) the only way to make such flash working is to include
it in raw/parallel NAND subsystem support and combine with mt29f staging
driver. Obviously, this approach isn't going to be accepted by upstream
(similar support for Winbond W25N01GV was rejected).
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
SoC: Qualcomm IPQ4019 (Dakota) 717 MHz, 4 cores
RAM: 256 MiB (Nanya NT5CC128M16IP-DI)
FLASH: 128 MiB (Macronix NAND)
WiFi0: Qualcomm IPQ4019 b/g/n 2x2
WiFi1: Qualcomm IPQ4019 a/n/ac 2x2
WiFi2: Qualcomm Atheros QCA9886 a/n/ac
BT: Atheros AR3012
IN: WPS Button, Reset Button
OUT: RGB-LED via TI LP5523 9-channel Controller
UART: Front of Device - 115200 N-8
Pinout 3.3v - RX - TX - GND (Square is VCC)
Installation:
1. Transfer OpenWRT-initramfs image to the device via SSH to /tmp.
Login credentials are identical to the Web UI.
2. Login to the device via SSH.
3. Flash the initramfs image using
> mtd-write -d linux -i openwrt-image-file
4. Power-cycle the device and wait for OpenWRT to boot.
5. From there flash the OpenWRT-sysupgrade image.
Ethernet-Ports: Although labeled identically, the port next to
the power socket is the LAN port and the other one is WAN. This
is the same behavior as in the stock firmware.
Signed-off-by: Marius Genheimer <mail@f0wl.cc>
[Dropped setup_mac 02_network in favour of 05_set_iface_mac_ipq40xx.sh,
reorderd 02_network entries, added board.bin WA for the QCA9886 from ath79,
minor dts touchup, added rng to 4.19 dts]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Specifications:
SOC: Qualcomm IPQ4018
RAM: 256 MiB Samsung K4B2G1646F-BYK0
FLASH1: MX25L1605D 2 MB
FLASH2: Winbond W25N01GV 128Mb
ETH: Qualcomm QCA8075
WLAN0: Qualcomm Atheros QCA4018 2.4GHz 802.11b/g/n 2x2
WLAN1: Qualcomm Atheros QCA4018 5GHz 802.11n/ac W2 2x2
INPUT: WPS, Reset
LED: Status - Green
SERIAL: Header at J19, Beneath DC Power Jack
1-VCC ; 2-TX ; 3-RX; 4-GND;
Serial 115200-8-N-1.
Tested and working:
- USB (requires extra packages)
- LAN Ethernet (Correct MAC-address)
- WAN Ethernet (Correct MAC-address)
- 2.4 GHz WiFi (Correct MAC-address)
- 5 GHz WiFi (Correct MAC-address)
- Factory installation from Web UI
- OpenWRT sysupgrade
- LED
- Reset Button
Need Testing:
- WPS button
Install via Web UI:
- Attach to a LAN port on the router.
- Connect to the Linksys Smart WiFi Page (default 192.168.1.1) and login
- Select the connectivity tab on the left
- In the manual update box on the right
- Select browse, and browse to
openwrt-ipq40xx-linksys_ea6350v3-squashfs-factory.bin
- Click update.
- Read and accept the warning
- The router LED will start blinking. When the router LED goes solid, you
can now navigate to 192.168.1.1 to your new OpenWrt installation.
Sysupgrade:
- Flash the sysupgrade image as usual. Please: try to do a reset everytime
you can (doing it with LuCI is easy and can be done in the same step).
Recovery (Automatic):
- If the device fails to boot after install or upgrade, whilst the unit is
turned on:
1 - Wait 15 seconds
2 - Switch Off and Wait 10 seconds
3 - Switch on
4 - Repeat steps 1 to 3, 3 times then go to 5.
5 - U-boot will have now erased the failed update and switched back to the
last working firmware - you should be able to access your router on
LAN.
Recovery (Manual):
- The steps for manual recovery are the same as the generic u-boot tftp
client method.
Back To Stock:
- Use the generic recovery using the tftp client method to flash the
"civic.img". Also you can strip-and-pad the original image and use
the generic "mtd" method by flashing over the "kernel" partition.
* Just be careful to flash in the partition that the device is currently
booted.
Signed-off-by: Ryan Pannell <ryan@osukl.com>
Signed-off-by: Oever González <notengobattery@gmail.com>
[minor edits, removed second compatible of nand, added dtb entry to 4.19]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This patch fixes a kernel warning that got triggered by 4.19
because of a bad/missing interrupt level definition in the DTS.
| WARNING: CPU: 2 PID: 1996 at drivers/irqchip/irq-gic.c:1016
| CPU: 2 PID: 1996 Comm: kmodloader Not tainted 4.19.9 #0
| Hardware name: Generic DT based system
| [<c0317884>] (warn_slowpath_null) from [<c04f9cd0>]
| [<c04f9cd0>] (gic_irq_domain_translate) from [<c035af30>]
| [<c035af30>] (irq_create_fwspec_mapping) from [<c035b1e0>]
| [<c035b1e0>] (irq_create_of_mapping) from [<c0614eec>]
| [<c0614eec>] (of_irq_get) from [<c0614f3c>]
| [<c0614f3c>] (of_irq_to_resource) from [<c0614ff0>]
| [<c0614ff0>] (of_irq_to_resource_table) from [<c0610e08>]
| [<c0610e08>] (of_device_alloc) from [<c0610ea0>]
| [<c0610ea0>] (of_platform_device_create_pdata)
| [<c061120c>] (of_platform_bus_create)
| [<c06113c4>] (of_platform_populate)
| [<bf4c06b4>] (dwc3_qcom_probe [dwc3_qcom])
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
- replace licence texts with SPDX-License-Identifier where
applicable.
- make node-names more generic to fit with Device-Tree Release v0.2
Section 2.2.2 Generic Names Recommendation.
- utilize wifi0/1, blsp1_uart1 labels
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
SOC: IPQ4018 / QCA Dakota
CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7
DRAM: 256 MiB
NOR: 32 MiB
ETH: Qualcomm Atheros QCA8072
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
INPUT: RESET Button
LEDS: Power, LAN, MESH, WLAN 2.4GHz, WLAN 5GHz
1. Load Ramdisk via U-Boot
To set up the flash memory environment, do the following:
a. As a preliminary step, ensure that the board console port is connected to the PC using these RS232 parameters:
* 115200bps
* 8N1
b. Confirm that the PC is connected to the board using one of the Ethernet ports. Set a static ip 192.168.99.8 for Ethernet that connects to board. The PC must have a TFTP server launched and listening on the interface to which the board is connected. At this stage power up the board and, after a few seconds, press 4 and then any key during the countdown.
U-BOOT> set serverip 192.168.99.8 && set ipaddr 192.168.99.9 && tftpboot 0x84000000 openwrt.itb && bootm
2. Load image via GUI
a. Upgrade EAP1300 to FW v3.5.3.2
In the GUI, System Manager > Firmware > Firmware Upgrade, to do upgrade.
b. Transfer to OpenWrt from EnGenius.
In Firmware Upgrade page, to upgrade yours openwrt-ipq40xx-engenius_eap1300-squashfs-sysupgrade.bin.
3. Revert to EnGenius EAP1300
To flash openwrt-ipq40xx-engenius_eap1300-squashfs-factory.bin by using sysupgrade command and "DO NOT" keep configuration.
$ sysupgrade –n openwrt-ipq40xx-engenius_eap1300-squashfs-factory.bin
Signed-off-by: Steven Lin <steven.lin@senao.com>
This patch replaces the custom autoload quirk of the
RT-AC58U with a bootargs-append overwrite.
The vendor's u-boot doesn't leave the bootargs / cmdline alone,
so the it can't be overwritten in any other way right now...
And of course, this will be a lot of fun to deal with once
the device switches to the new spi-nand subsystem.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
The following patches were integrated upstream:
* target/linux/ipq40xx/patches-4.14/050-0006-mtd-nand-qcom-Add-a-NULL-check-for-devm_kasprintf.patch
* target/linux/mediatek/patches-4.14/0177-phy-phy-mtk-tphy-use-auto-instead-of-force-to-bypass.patch
This fixes tries to work around the following security problems:
* CVE-2018-3620 L1 Terminal Fault OS, SMM related aspects
* CVE-2018-3646 L1 Terminal Fault Virtualization related aspects
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This patch adds support for ZyXEL NBG6617
Hardware highlights:
SOC: IPQ4018 / QCA Dakota
CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7
DRAM: 256 MiB DDR3L-1600/1866 Nanya NT5CC128M16IP-DI @ 537 MHz
NOR: 32 MiB Macronix MX25L25635F
ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN)
USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC)
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
INPUT: RESET Button, WIFI/Rfkill Togglebutton, WPS Button
LEDS: Power, WAN, LAN 1-4, WLAN 2.4GHz, WLAN 5GHz, USB, WPS
Serial:
WARNING: The serial port needs a TTL/RS-232 3.3v level converter!
The Serial setting is 115200-8-N-1. The 1x4 .1" header comes
pre-soldered. Pinout:
1. 3v3 (Label printed on the PCB), 2. RX, 3. GND, 4. TX
first install / debricking / restore stock:
0. Have a PC running a tftp-server @ 192.168.1.99/24
1. connect the PC to any LAN-Ports
2. put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file
into the tftp-server root directory and rename it to just "ras.bin".
3. power-cycle the router and hold down the the WPS button (for 30sek)
4. Wait (for a long time - the serial console provides some progress
reports. The u-boot says it best: "Please be patient".
5. Once the power LED starts to flashes slowly and the USB + WPS LEDs
flashes fast at the same time. You have to reboot the device and
it should then come right up.
Installation via Web-UI:
0. Connect a PC to the powered-on router. It will assign your PC a
IP-address via DHCP
1. Access the Web-UI at 192.168.1.1 (Default Passwort: 1234)
2. Go to the "Expert Mode"
3. Under "Maintenance", select "Firmware-Upgrade"
4. Upload the OpenWRT factory image
5. Wait for the Device to finish.
It will reboot into OpenWRT without any additional actions needed.
To open the ZyXEL NBG6617:
0. remove the four rubber feet glued on the backside
1. remove the four philips screws and pry open the top cover
(by applying force between the plastic top housing from the
backside/lan-port side)
Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
|NBG6617> HELP
|ATEN x[,y] set BootExtension Debug Flag (y=password)
|ATSE x show the seed of password generator
|ATSH dump manufacturer related data in ROM
|ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO boot up whole system
|ATUR x upgrade RAS image (filename)
|NBG6617>
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
|NBG6617> ATSE NBG6617
|012345678901
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711
copy and paste the result into the shell to unlock zloader.
|NBG6617> ATEN 1,0046B0017430
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
|NBG6617> ATGU
|NBG6617#
Co-authored-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: David Bauer <mail@david-bauer.net>
The sender domain has a DMARC Reject/Quarantine policy which disallows
sending mailing list messages using the original "From" header.
To mitigate this problem, the original message has been wrapped
automatically by the mailing list software.
Refresh patches.
Remove patch that can be reverse applied:
mvebu/patches-4.14/530-ATA-ahci_mvebu-enable-stop_engine-override.patch
mvebu/patches-4.14/531-ATA-ahci_mvebu-pmp-stop-errata-226.patch
Update patch that no longer applied:
ipq806x/patches-4.14/0035-clk-mux-Split-out-register-accessors-for-reuse.patch
Compiled-tested-for: lantiq, ramips
Run-tested-on: lantiq BT hh5a, ramips MIR3g
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Tested-by: Michael Yartys <michael.yartys@protonmail.com>
Tested-by: Rosen Penev <rosenp@gmail.com>
Specifications:
SOC: Qualcomm IPQ4018 (DAKOTA) ARM Quad-Core
RAM: 128 MB Nanya NT5CC64M16GP-DI
FLASH: 16 MiB Macronix MX25L12845EMI-12G
ETH: Qualcomm QCA8072
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11b/g/n 2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11n/ac W2 2x2
INPUT: WPS, Mode-toggle-switch
LED: Power, WLAN 2.4GHz, WLAN 5GHz, LAN, WPS
(LAN not controllable by software)
(WLAN each green / red)
SERIAL: Header next to eth-phy.
VCC, TX, GND, RX (Square hole is VCC)
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet (Correct MAC-address)
- 2.4 GHz WiFi (Correct MAC-address)
- 5 GHz WiFi (Correct MAC-address)
- Factory installation from tftp
- OpenWRT sysupgrade
- LEDs
- WPS Button
Not Working:
- Mode-toggle-switch
Install via TFTP:
Connect to the devices serial. Hit Enter-Key in bootloader to stop
autobooting. Command `tftpboot` will pull an initramfs image named
`C0A86302.img` from a tftp server at `192.168.99.08/24`.
After successfull transfer, boot the image with `bootm`.
To persistently write the firmware, flash an openwrt sysupgrade image
from inside the initramfs, for example transfer
via `scp <sysupgrade> root@192.168.1.1:/tmp` and flash on the device
with `sysupgrade -n /tmp/<sysupgrade>`.
append-cmdline patch taken from chunkeeys work on the NBG6617.
Signed-off-by: Magnus Frühling <skorpy@frankfurt.ccc.de>
Co-authored-by: David Bauer <mail@david-bauer.net>
Co-authored-by: Christian Lamparter <chunkeey@googlemail.com>
This fixup ip align in essedma driver rx path
see cat /proc/cpu/alignment
which reports alignment-fixups without this fix.
Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
* QCA IPQ4019
* 256 MB of RAM
* 32 MB of SPI NOR flash (s25fl256s1)
- 2x 15 MB available; but one of the 15 MB regions is the recovery image
* 2T2R 2.4 GHz
- QCA4019 hw1.0 (SoC)
- requires special BDF in QCA4019/hw1.0/board-2.bin with
bus=ahb,bmi-chip-id=0,bmi-board-id=20,variant=OM-A62
* 2T2R 5 GHz (channel 36-64)
- QCA9888 hw2.0 (PCI)
- requires special BDF in QCA9888/hw2.0/board-2.bin
bus=pci,bmi-chip-id=0,bmi-board-id=16,variant=OM-A62
* 2T2R 5 GHz (channel 100-165)
- QCA4019 hw1.0 (SoC)
- requires special BDF in QCA4019/hw1.0/board-2.bin with
bus=ahb,bmi-chip-id=0,bmi-board-id=21,variant=OM-A62
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x button (reset; kmod-input-gpio-keys compatible)
* external watchdog
- triggered GPIO
* 1x USB (xHCI)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x gigabit ethernet
- phy@mdio3:
+ Label: Ethernet 1
+ gmac0 (ethaddr) in original firmware
+ 802.3at POE+
- phy@mdio4:
+ Label: Ethernet 2
+ gmac1 (eth1addr) in original firmware
+ 18-24V passive POE (mode B)
* powered only via POE
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the factory image to the u-boot when the device boots up.
The initramfs image can be started using
setenv bootargs 'loglevel=8 earlycon=msm_serial_dm,0x78af000 console=ttyMSM0,115200 mtdparts=spi0.0:256k(0:SBL1),128k(0:MIBIB),384k(0:QSEE),64k(0:CDT),64k(0:DDRPARAMS),64k(0:APPSBLENV),512k(0:APPSBL),64k(0:ART),64k(0:custom),64k(0:KEYS),15552k(inactive),15552k(inactive2)'
tftpboot 0x84000000 openwrt-ipq40xx-openmesh_a62-initramfs-fit-uImage.itb
set fdt_high 0x85000000
bootm 0x84000000
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
The pinctrl initialization fails with the MSM pinctrl code and gpio-hogs
because either the gpio ranges are not yet initialized (missing gpio-range
in DT) or that the msm driver unconditionally tries to re-initializes the
ranges (gpio-range in DT).
To allow gpio-hogs and similar early-boot gpio code, the gpio-ranges must
be in the device tree and the pinctrl-msm code must check whether the range
was already initialized by the DT.
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
[drop changes to unrelated dtsi files, refresh patches]
Signed-off-by: Mathias Kresin <dev@kresin.me>
The tz and smem reserved-memory information handled in the upstream Linux
sources by the SoC specific dtsi and not by the the boards dts. Using the
same approach in OpenWrt avoids unneccessary duplication.
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
The reserved-memory regions are mostly undocumented by QCA and are named
very unspecific in the QSDK device trees. It was tried to clean them up by
commit 71ed9f10a3 ("ipq40xx: Use detailed reserved memory for A42") and
similar changes.
The features which require these regions were mostly unknown but
Senthilkumar N L <snlakshm@qti.qualcomm.com> and Sricharan Ramabadhran
<srichara@qti.qualcomm.com> provided some more insight in some of them:
* crash dump feature
- a couple of regions used when 'qca,scm_restart_reason' dt node has the
value 'dload_status' not set to 1
+ apps_bl <0x87000000 0x400000>
+ sbl <0x87400000 0x100000>
+ cnss_debug <0x87400000 0x100000>
+ cpu_context_dump <0x87b00000 0x080000>
- required driver not available in Linux
- safe to remove
* QSEE app execution
- region tz_apps <0x87b80000 0x280000>
- required driver not available in Linux
- safe to remove
* communication with TZ/QSEE
- region smem <0x87b80000 0x280000>
- driver changes not yet upstreamed
- must not be removed because any access can crash kernel/program
* trustzone (QSEE) private memory
- region tz <0x87e80000 0x180000>
- must not be removed because any access can crash kernel/program
Removing the unnecessary regions saves some kilobyte of reserved-memory and
cleans up the device tree:
* 2560 KiB
- 8devices Jalapeno
- AVM FRITZ!Box 4040
- Compex WPJ428
- Meraki MR33 Access Point
- OpenMesh A42
* 14336 KiB
- GL.iNet GL-B1300
- Qualcomm Technologies, Inc. IPQ40xx/AP-DK01.1-C1
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Specifications:
SOC: Qualcomm IPQ4018 (DAKOTA) ARM Quad-Core
RAM: 256 MB Winbond W632GU6KB12J
FLASH: 16 MiB Macronix MX25L12805D
ETH: Qualcomm QCA8072
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11b/g/n/ac 2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11n/ac
1x1 (EX6100)
2x2 (EX6150)
INPUT: Power, WPS, reset button
AP / Range-extender toggle
LED: Power, Router, Extender (dual), WPS, Left-/Right-arrow
SERIAL: Header next to QCA8072 chip.
VCC, TX, RX, GND (Square hole is VCC)
WARNING: The serial port needs a TTL/RS-232 v3.3 level converter!
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet
- 2.4 GHz WiFi (Correct MAC-address)
- 5 GHz WiFi (Correct MAC-address)
- Factory installation from WebIF
- Factory installation from tftp
- OpenWRT sysupgrade (Preserving and non-preserving)
- LEDs
- Buttons
Not Working:
- AP/Extender toggle-switch
Untested:
- Support on EX6100v2. They share the same GPL-Code and vendor-images.
The 6100v2 seems to lack one 5GHz stream and differs in the 5GHz
board-blob. I only own a EX6150v2, therefore i am only able to verify
functionality on this device.
Install via Web-Interface:
Upload the factory image to the device to the Netgear Web-Interface.
The device might asks you to confirm the update a second time due to
detecting the OpenWRT firmware as older. The device will automatically
reboot after the image is written to flash.
Install via TFTP:
Connect to the devices serial. Hit Enter-Key in bootloader to stop
autobooting. Command "fw_recovery" will start a tftp server, waiting for
a DNI image to be pushed.
Assign your computer the IP-address 192.168.1.10/24. Push image with
tftp -4 -v -m binary 192.168.1.1 -c put <OPENWRT_FACTORY>
Device will erase factory-partition first, then writes the pushed image
to flash and reboots.
Parts of this commit are based on Thomas Hebb's work on the
openwrt-devel mailinglist.
See https://lists.openwrt.org/pipermail/openwrt-devel/2018-January/043418.html
Signed-off-by: David Bauer <mail@david-bauer.net>
This patch adds support for 8devices Jalapeno.
Specification:
QCA IPQ4018, Quad core ARM v7 Cortex A7 717MHz
256 MB of DDR3 RAM
8 MB of SPI NOR flash
128 MB of Winbond SPI NAND flash
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
requires special BDF in QCA4019/hw1.0/board-2.bin with:
bus=ahb,bmi-chip-id=0,bmi-board-id=16,variant=8devices-Jalapeno
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
requires special BDF in QCA4019/hw1.0/board-2.bin with:
bus=ahb,bmi-chip-id=0,bmi-board-id=17,variant=8devices-Jalapeno
ETH: Qualcomm Atheros QCA8072 Gigabit Switch (1 x LAN, 1 x WAN)
phy@mdio3:
Label: eth0
gmac0
phy@mdio4:
Label: eth1
gmac1
Installation instructions:
Since boards ship with old version of LEDE installation is simple.
Just use sysupgrade -n -F sysupgrade.bin
Syuspgrade needs to be forced since OpenWRT uses DT detection in recent
releases.
If you get error that FIT configuration is not found during boot it is
due to older U-boot used on your board.
That is because 8devices used custom FIT configuration partition name
as they internally had v1 and v2 boards.
Only v2 boards are sold so now they are shipping boards with never
U-boot using generic config@1 FIT partition name.
Also for old uboot it is possible to force loading config@1 by changing
uboot environment:
setenv boot5 'bootm 0x84000000#config@1’
saveenv
Signed-off-by: Robert Marko <robimarko@gmail.com>
Right patch version this time, sorry!
* Patch 180-usb-xhci-add-support-for-performing-fake-doorbell.patch had to be adjusted slightly because of upstream adapted code.
* Refreshed patches.
Compile-tested: ramips/mt7621, x86/64
Run-tested: ramips/mt7621, x86/64
Signed-off-by: Stijn Segers <foss@volatilesystems.org>
Tested-by: Rosen Penev <rosenp@gmail.com>
The AVM Fritz!Box 4040 uses an IPQ4018 as SoC and not an IPQ4019. The DTS
must be adjusted to reflect this.
Signed-off-by: Sven Eckelmann <sven@narfation.org>
* QCA IPQ4028
* 256 MB of RAM
* 32 MB of SPI NOR flash (mx25l25635e)
* 128 MB of SPI NAND flash (gd5f1gq4ucy1g)
* 2T2R 2.4 GHz
- QCA4019 hw1.0 (SoC)
- uses AP-DK03 BDF from QCA4019/hw1.0/board-2.bin
* 2T2R 5 GHz
- QCA4019 hw1.0 (SoC)
- uses AP-DK03 BDF from QCA4019/hw1.0/board-2.bin
* 2 fully software controllable GPIO-LEDs
* 2 additional GPIO-LEDs which also affect the SIM card detection
* 1x button (reset)
* 1x GPIO buzzer
* 1x USB (xHCI)
* 1x NGFF (USB-only with Dual-SIM support, untested)
* TTL pins are on board (R124 is next to GND, then follows: RX, TX, VCC)
* 2x gigabit ethernet
- phy@mdio4:
+ Manual: Ethernet port 0
+ gmac0 (ethaddr) in original firmware
+ 802.3af POE (HV version)
+ 24v passive POE (LV version)
- phy@mdio3:
+ Manual: Ethernet port 1
+ gmac1 (eth1addr) in original firmware
* DC Jack connector
+ 24-56V (HV version)
+ 12-24V (LV version)
The SPI NAND flash isn't supported at the moment.
The bootloader has to be updated before OpenWrt is installed to fix a
reboot problem. The nor-ipq40xx-single.img from
https://downloads.compex.com.sg/?dir=uploads/QSDK/QCA-Reference/WPJ428/b170123-IPQ40xx-Reference-Firmware
has to be downloaded and the transfered in u-boot via TFTP
set ipaddr 192.168.1.11
set serverip 192.168.1.10
ping ${serverip}
tftpboot 0x84000000 nor-ipq40xx-single.img
imgaddr=0x84000000 && source $imgaddr:script
The sysupgrade image can be installed directly on flash using u-boot:
sf probe
tftpboot 0x84000000 openwrt-ipq40xx-compex_wpj428-squashfs-sysupgrade.bin
sf erase 0x00180000 +$filesize
sf write 0x84000000 0x00180000 $filesize
bootipq
The initramfs image can be started using
tftpboot 0x82000000 openwrt-ipq40xx-compex_wpj428-initramfs-fit-uImage.itb
set fdt_high 0x83000000
bootm 0x82000000
The used SIM card slot can be changed using
# slot 1 (also enables orange LED)
echo 1 > /sys/class/gpio/gpio3/value
# slot 2
echo 0 > /sys/class/gpio/gpio3/value
It can be checked whether a SIM card is inserted in the current slot and
the red LED is subsequently on via:
echo 2 > /sys/class/gpio/export
cat /sys/class/gpio/gpio2/value
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Steve Glennon
David Bauer
Christian Lamparter
Piotr Dymacz
Koen Vandeputte
张鹏
Marius Genheimer
Oever González
Steven Lin
Hauke Mehrtens
Stijn Tintel
Mantas Pucka
John Crispin
Christian Lamparter
Kevin Darbyshire-Bryant
Magnus Frühling
Chen Minqiang
Roman Yeryomin
Sven Eckelmann
Robert Marko
Stijn Segers
Sven Eckelmann