Ubiquity allows flashing of unsigned factory images via TFTP recovery
method[1]. They claim in airOS v6.0.7 release changelog[2] following:
All future airOS versions will be signed in this way and not allow
unsigned firmware to be loaded except via TFTP.
U-boot bootloader on M-XW devices expects factory image revision
version in specific format. On airOS v6.1.7 with `U-Boot 1.1.4-s1039
(May 24 2017 - 15:58:18)` bootloader checks if the revision major(?)
number is actually a number, but in currently generated images there's
OpenWrt text and so the check fails:
Hit any key to stop autoboot: 0
Setting default IP 192.168.1.20
Starting TFTP server...
Receiving file from 192.168.1.25:38438
Received 4981148 bytes
Firmware check failed! (1)
By placing arbitrary correct number first in major version, we make the
bootloader happy and we can flash factory images over TFTP again:
Received 3735964 bytes
Firmware Version: XW.ar934x.v6.0.4-42.r8474-56aa1ac-OpenWrt
Setting U-Boot environment variables
Un-Protected 1 sectors
Erasing Flash.... done
Patch provided by AREDN[3] project, tested on Bullet M2 XW (ynezz) and
Nanostation M5 XW (ae6xe).
1. https://help.ubnt.com/hc/en-us/articles/204910124-UniFi-TFTP-Recovery-for-Bricked-Access-Points
2. https://dl.ubnt.com/firmwares/XW-fw/v6.0.7/changelog.txt
3. https://github.com/aredn
Signed-off-by: Petr Štetiar <ynezz@true.cz>
CPU: AR9342 SoC
RAM: 64 MB DDR2
Flash: 8 MB NOR SPI
Ports: 100 MBit (24V PoE in)
WLAN: 2.4/5 GHz
UART: 1 UART on PCB marked as J1 with 115200 8N1 config
LEDs: Power, Ethernet, 4x RSSI LEDs (orange, red, 2x green)
Buttons: Reset
UART connection details
.---------------------------------.
| |
[ETH] J1 [ANT]
| o VCC o RX o TX o GND |
`---------------------------------'
Flashing instructions
A) Serial console, U-Boot and TFTP
1. Connect to serial header J1 on the PCB
2. Power on device and enter U-Boot console
3. Set up TFTP server serving an OpenWrt initramfs build
4. Load initramfs build using the command tftpboot in the U-Boot cli
5. Boot the loaded image using the command bootm
6. Copy squashfs OpenWrt sysupgrade build to the booted device
7. Use mtd to write sysupgrade to partition "firmware"
8. Reboot and enjoy
B) Experimental factory image flashing over SSH from airOS v6.1.7
1. You need to flash your UBNT M2HP with airOS v6.1.7 firmware
no other airOS version is currently supported
2. git clone https://github.com/true-systems/ubnt-bullet-m2hp-openwrt-flashing
3. cd ubnt-bullet-m2hp-openwrt-flashing
4. make flash-factory FW_OWRT=/path/to/your/openwrt-ath79-generic-ubnt_bullet-m-xw-squashfs-factory.bin
Tested only on Bullet M2HP.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Belkin F5D8235 v2 has two ethernet switches on board.
One internal rt3052 and rtl8366rb on rgmii interface.
Looks like internal switch settings were lost in
translation to device tree infrastructure.
Signed-off-by: Roman Yeryomin <roman@advem.lv>
Specifically, SKW92A_E16, described here:
http://www.skylabmodule.com/wp-content/uploads/SkyLab_SKW92A_V1.04_datasheet.pdf
Specification:
- MediaTek MT7628N/N (580 Mhz)
- 64 MB of RAM
- 16 MB of FLASH
- 2T2R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x u.FL
- Power by micro-USB connector at USB1 on EVB
- UART via micro-USB connector at USB3 on EVB (57600 8n1)
- 5x Ethernet LEDs
- 1x WLAN LEDs
- 1x WPS LED connected by jumper wire from I2S_CK on J20 to WPS_LED pin hole next
to daughter board on EVB
- WPS/Reset button (S2 on EVB)
- RESET button (S1 on EVB) is *not* connected to RST hole next to daughter board
Flash instruction:
>From Skylab firmware:
1. Associate with SKYLAP_AP
2. In a browser, load: http://10.10.10.254/
3. Username/password: admin/admin
4. In web admin interface: Administration / Upload Firmware, browse to
sysupgrade image, apply, flash will fail with a message:
Not a valid firmware. *** Warning: "/var/tmpFW" has corrupted data!
5. Telnet to 10.10.10.254, drops you into a root shell with no credentials
6. # cd /var
7. # mtd_write -r write tmpFW mtd4
Unlocking mtd4 ...
Writing from tmpFW to mtd4 ... [e]
8. When flash has completed, you will have booted into your firmware.
>From U-boot via TFTP and initramfs:
1. Place openwrt-ramips-mt76x8-skw92a-initramfs-kernel.bin on a TFTP server
2. Connect to serial console at USB3 on EVB
3. Connect ethernet between port 1 (not WAN) and your TFTP server (e.g.
192.168.11.20)
4. Start terminal software (e.g. screen /dev/ttyUSB0 57600) on PC
5. Apply power to EVB
6. Interrupt u-boot with keypress of "1"
7. At u-boot prompts:
Input device IP (10.10.10.123) ==:192.168.11.21
Input server IP (10.10.10.3) ==:192.168.11.20
Input Linux Kernel filename (root_uImage) ==:openwrt-ramips-mt76x8-skw92a-initramfs-kernel.bin
8. Move ethernet to port 0 (WAN) on EVB
9. At new OpenWrt console shell, fetch squashfs-sysupgrade image and flash
with sysupgrade.
>From U-boot via TFTP direct flash:
1. Place openwrt-ramips-mt76x8-skw92a-squashfs-sysupgrade.bin on a TFTP server
2. Connect to serial console at USB3 on EVB (57600 8N1)
3. Connect ethernet between port 1 (not WAN) an your TFTP server (e.g.
192.168.11.20)
4. Start terminal software (e.g. screen /dev/ttyUSB0 57600) on PC
5. Apply power to EVB
6. Interrupt u-boot with keypress of "2"
7. At u-boot prompts:
Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N) Y
Input device IP (10.10.10.123) ==:192.168.11.21
Input server IP (10.10.10.3) ==:192.168.11.20
Input Linux Kernel filename (root_uImage) ==:openwrt-ramips-mt76x8-skw92a-squashfs-sysupgrade.bin
8. When transfer is complete or as OpenWrt begins booting, move ethernet to
port 0 (WAN).
Signed-off-by: Russell Senior <russell@personaltelco.net>
We currently could (ab)use IMAGES for this task, but the downside is,
that the filenames has filesystem tied to the filename, which might be
confusing as the artifact itself don't has to be used with that specific
filesystem. Another downside is, that the artifacts built with IMAGES
target are build for every FILESYSTEMS filesystem.
Consider following use case:
define Device/apalis
...
FILESYSTEMS := ext4 squashfs
IMAGES := spl-uboot.bin recovery.scr
IMAGE/spl-uboot.bin := append-uboot-spl | pad-to 68k | append-uboot
IMAGE/recovery.scr := recovery-scr
endef
Where we would get target binaries with following filenames:
openwrt-imx6-apalis-squashfs.recovery.scr
openwrt-imx6-apalis-squashfs.spl-uboot.bin
openwrt-imx6-apalis-ext4.recovery.scr
openwrt-imx6-apalis-ext4.spl-uboot.bin
With proposed patch, we could now just do:
define Device/apalis
...
ARTIFACTS := spl-uboot.bin recovery.scr
ARTIFACT/spl-uboot.bin := append-uboot-spl | pad-to 68k | append-uboot
ARTIFACT/recovery.scr := recovery-scr
endef
Which would produce target binaries with following filenames:
openwrt-imx6-apalis-recovery.scr
openwrt-imx6-apalis-spl-uboot.bin
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
e520469b Update manual pages
54067256 Bump up version number to 1.35.0
c4d2eeee Update AUTHORS
f51e696e asio: Add stop() to listen_and_serve doc
a433b132 Merge pull request #1260 from nghttp2/h2load-non-final-response
cf48a56d Merge pull request #1238 from jktjkt/cmake-fix-libevent-detection
6cad1b24 nghttpx: Write mruby send_info early
3c393dca nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend
17292445 h2load: Handle HTTP/1 non-final response
f6644a92 make clang-format
48998f72 Merge pull request #1222 from donny-dont/fix/declspec
15ff52f9 Update README
6c03bb14 Upgrade travis toolchain
524b4392 Fix travis build failure
859bf2bc Update manual pages
b5619fb1 h2load: Clarify that time for connect includes TLS handshake
dcbe0c69 nghttpx: Simplify move ctor and operator
2996c284 nghttpx: Cleanup
42e8ceb6 nghttpx: Convert API status code to enum class
1daf9ce8 nghttpx: Convert WorkerEventType to enum class
d68edf56 nghttpx: Convert MemcachedStatusCode to enum class
0c4e9fef nghttpx: Convert memcached op to enum class
571404c6 nghttpx: Convert MemcachedParseState to enum class
4d562b77 nghttpx: Convert LogFragmentType to enum class
e6225871 nghttpx: Convert connection check status to enum class
4bd075de nghttpx: Convert Http2Session state to enum class
b46a3249 nghttpx: Convert FreelistZone to enum class
4bd44b9c nghttpx: Convert dispatch state to enum class
1b42110d nghttpx: Make Downstream state enum class
0735ec55 nghttpx: Convert shrpx_connect_proto to enum class
00554779 nghttpx: Convert DNSResolverStatus to enum class
0963f389 nghttpx: Convert SerialEventType to enum class
1abfa3ca nghttpx: Make TLS handshake state enum class
f2159bc2 nghttpx: Convert UpstreamAltMode to enum class
b0eb68ee nghttpx: Convert shrpx_forwarded_node_type to enum class
e7b7b037 nghttpx: Convert shrpx_cookie_secure to enum class
5e4f434f nghttpx: Convert shrpx_session_affinity to enum class
20ea964f nghttpx: Convert shrpx_proto to enum class
d105619b src: Remove extra braces if possible
ec5729b1 Use std::make_unique
6c919695 Use C++14
46576178 Don't send Transfer-Encoding to pre-HTTP/1.1 clients
5e925f87 Update doc
153531d4 nghttpx: Use the same type as standard stream operator<<
f7287df0 Bump up version number to 1.35.0-DEV
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
Some packages like libpfring assume the presense of lex, which on some
other systems is a symlink to flex but not all. Symlink flex to fix
compilation.
Arch Linux and Fedora do this as far as I know.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
This is probably theoretical problem as the Ventana is defined first in
the image Makefile, but once the position of the definition would change
in the future (alphabetical sorting?) it would get bootscript from the
previous board which would have BOOT_SCRIPT set.
Cc: Tim Harvey <tharvey@gateworks.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Both devices come with a MediaTek MT7610E 5GHz 802.11ac 1T1R radio
which wasn't supported at the time the devices were added to OpenWrt.
Now that we got it, include kmod-mt76x0e in images for those devices.
Reported-by: Arian Sanusi <openwrt@semioptimal.net>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This allows us to use the bridge as a managed switch and gracefully
handle mixed tagged and untagged frames. Prior to this, the only
alternative was creating one bridge per vlan which quickly becomes a
nightmare and still won't let you mix both tagged and untagged frames on
the physical port without some complex ebtables magic.
This is in line with the notion that OpenWRT is the network go-to swiss
army knife when you need a nice set-and-forget, low maintenance box to
handle a specific task.
Current builds of the ip-bridge package already fully support this
feature so the only requirement is enabling the kernel config.
This is disabled by default so existing bridge configurations will not
be affected. This patch only gives the ability to turn it on with an
'ip link' command. If there is interest, I could look into making the
feature accessible via uci configuration.
It causes about 3.1% hit on raw bridging speed, which is relatively
trivial considering that I had to use 300 byte packets to strain the CPU
enough to notice a slowdown at all. The ER8 would chug along at wire
speed otherwise, and that's using only one core. Since the typical
bridge use case on OpenWRT is wireless, I doubt it would be noticeable
at all.
With BRIDGE_VLAN_FILTERING
iperf -u -c 192.168.1.105 -b 1G -l 300
------------------------------------------------------------
Client connecting to 192.168.1.105, UDP port 5001
Sending 300 byte datagrams, IPG target: 2.24 us (kalman adjust)
UDP buffer size: 208 KByte (default)
------------------------------------------------------------
[ 3] local 192.168.1.12 port 58045 connected with 192.168.1.105 port 5001
[ ID] Interval Transfer Bandwidth
[ 3] 0.0-10.0 sec 977 MBytes 820 Mbits/sec
[ 3] Sent 3414986 datagrams
[ 3] Server Report:
[ 3] 0.0-10.0 sec 811 MBytes 680 Mbits/sec 0.000 ms
581210/3414986 (0%)
Without BRIDGE_VLAN_FILTERING
iperf -u -c 192.168.1.105 -b 1G -l 300
------------------------------------------------------------
Client connecting to 192.168.1.105, UDP port 5001
Sending 300 byte datagrams, IPG target: 2.24 us (kalman adjust)
UDP buffer size: 208 KByte (default)
------------------------------------------------------------
[ 3] local 192.168.1.12 port 36645 connected with 192.168.1.105 port 5001
[ ID] Interval Transfer Bandwidth
[ 3] 0.0-10.0 sec 977 MBytes 820 Mbits/sec
[ 3] Sent 3414990 datagrams
[ 3] Server Report:
[ 3] 0.0-10.0 sec 836 MBytes 701 Mbits/sec 0.000 ms
493950/3414990 (0%)
In terms of kernel size, it uses 16KB (6753K vs 6737K on ER8) so a
0.002% hit. The exact 16KB is probably just due to how the kernel is
compressed.
Suggested-by: Jonathan Thibault <jonathan@navigue.com>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Specify the new "firmware" partition format for Netgear WNDR3700
and WNDR3700v2 similarly as ffd082aa did for WNDR3800, the third
device in the family.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
No single target/arch uses it and most likely there is no need to make
such a potential code target/arch specific.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
If "compatible" is being used that should trigger a proper parser
directly. It's more reliable thanks to not trying parsers one by one. In
such case partition shouldn't be split automatically to avoid parsing it
twice.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Currently, the b53 MDIO switch driver registers the switch on
config-init and not on device probe. Because of this, the switch
gets added every time the associated interface comes up.
This commit fixes this behavior by registering the switch on device
probe.
Compile- and run-tested on OCEDO Koala.
Signed-off-by: David Bauer <mail@david-bauer.net>
Currently flash from WebIF is broken for Archer C7 v5 EU models as their
SupportList entries are missing.
The added entries originate from TP-Links latest Archer C7 v5 EU
firmware.
Signed-off-by: David Bauer <mail@david-bauer.net>
2cc4b99 file: use global exec timeout instead of own hardcoded limit
ecd1660 exec: increase maximum execution time to 120s
Also expose the socket and timeout options in /etc/config/rpcd for
easier use.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
When restart is run on an init script, the script traps SIGTERM. This is
done as a workaround for scripts named the same name as the program they
start. In that case, the init script process will have the same name as
the program process, and so when the init script runs killall, it will
kill itself. So SIGTERM is trapped to make the init script unkillable.
However, the trap is retained when the init script runs start, and thus
processes started by restart will not respond to SIGTERM, and will thus
be unkillable unless you use SIGKILL. This fixes that by removing the
trap before running start.
Signed-off-by: Linus Kardell <linus@telliq.com>
It's more reliable as mtd subsystem doesn't have to blindly try that
parser. It allows disabling MTD_SPLIT_FIRMWARE completely (TRX is
handled in a similar way).
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
1517dfb8aa Add an additional test to resolv/tst-resolv-network.c
1050634904 libanl: properly cleanup if first helper thread creation failed (bug 22927)
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
4734108 mt7603: use mt7603_wtbl_clear on station removal
9428e34 mt7603: fix watchdog reset sequence
b3f82a3 mt7603: report PSE reset failures via debugfs
a301dec mt7603: add back PSE client reset code
94cebfc mt7603: fix handling lost interrupt events during watchdog reset
b38fe7d mt7603: only issue PSE reset on PSE stuck
da666a7 mt7603: issue PSE reset if firmware debug register indicates stuck queues
Signed-off-by: Felix Fietkau <nbd@nbd.name>
It makes more sense to add run_parsers_by_type() in a patch that
introduces parser types. That makes the other one just add a code using
it.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* chacha20,poly1305: fix up for win64
* poly1305: only export neon symbols when in use
* poly1305: cleanup leftover debugging changes
* crypto: resolve target prefix on buggy kernels
* chacha20,poly1305: don't do compiler testing in generator and remove xor helper
* crypto: better path resolution and more specific generated .S
* poly1305: make frame pointers for auxiliary calls
* chacha20,poly1305: do not use xlate
This should fix up the various build errors, warnings, and insertion errors
introduced by the previous snapshot, where we added some significant
refactoring. In short, we're trying to port to using Andy Polyakov's original
perlasm files, and this means quite a lot of work to re-do that had stableized
in our old .S.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
4b83102 treewide: switch to C-code style comments
70506bf treewide: make some functions static
d9872db interface: fix removal of dynamic interfaces
2f7ef7d interface: rework code to get rid of interface_set_dynamic
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
