2018-02-21 19:40:50 +00:00
|
|
|
#!/bin/sh
|
|
|
|
|
|
2018-03-10 09:59:18 +00:00
|
|
|
# xor multiple hex values of the same length
|
|
|
|
|
xor() {
|
|
|
|
|
local val
|
|
|
|
|
local ret="0x$1"
|
|
|
|
|
local retlen=${#1}
|
|
|
|
|
|
|
|
|
|
shift
|
|
|
|
|
while [ -n "$1" ]; do
|
|
|
|
|
val="0x$1"
|
|
|
|
|
ret=$((ret ^ val))
|
|
|
|
|
shift
|
|
|
|
|
done
|
|
|
|
|
|
|
|
|
|
printf "%0${retlen}x" "$ret"
|
|
|
|
|
}
|
|
|
|
|
|
2018-02-21 19:40:50 +00:00
|
|
|
ath10kcal_die() {
|
|
|
|
|
echo "ath10cal: " "$*"
|
|
|
|
|
exit 1
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
ath10kcal_extract() {
|
|
|
|
|
local part=$1
|
|
|
|
|
local offset=$2
|
|
|
|
|
local count=$3
|
|
|
|
|
local mtd
|
|
|
|
|
|
|
|
|
|
mtd=$(find_mtd_chardev $part)
|
|
|
|
|
[ -n "$mtd" ] || \
|
|
|
|
|
ath10kcal_die "no mtd device found for partition $part"
|
|
|
|
|
|
|
|
|
|
dd if=$mtd of=/lib/firmware/$FIRMWARE bs=1 skip=$offset count=$count 2>/dev/null || \
|
|
|
|
|
ath10kcal_die "failed to extract calibration data from $mtd"
|
|
|
|
|
}
|
|
|
|
|
|
ipq40xx: add support for ASUS RT-AC58U/RT-ACRH13
This patch adds support for ASUS RT-AC58U/RT-ACRH13.
hardware highlights:
SOC: IPQ4018 / QCA Dakota
CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7
DRAM: 128 MiB DDR3L-1066 @ 537 MHz (1074?) NT5CC64M16GP-DI
NOR: 2 MiB Macronix MX25L1606E (for boot, QSEE)
NAND: 128 MiB Winbond W25NO1GVZE1G (cal + kernel + root, UBI)
ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN)
USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC)
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
INPUT: one Reset and one WPS button
LEDS: Status, WAN, WIFI1/2, USB and LAN (one blue LED for each)
Serial:
WARNING: The serial port needs a TTL/RS-232 3V3 level converter!
The Serial setting is 115200-8-N-1. The board has an unpopulated
1x4 0.1" header. The pinout (VDD, RX, GND, TX) is printed on the
PCB right next to the connector.
U-Boot Note: The ethernet driver isn't always reliable and can sometime
time out... Don't worry, just retry.
Access via the serial console is required. As well as a working
TFTP-server setup and the initramfs image. (If not provided, it
has to be built from the OpenWrt source. Make sure to enable
LZMA as the compression for the INITRAMFS!)
To install the image permanently, you have to do the following
steps in the listed order.
1. Open up the router.
There are four phillips screws hiding behind the four plastic
feets on the underside.
2. Connect the serial cable (See notes above)
3. Connect your router via one of the four LAN-ports (yellow)
to a PC which can set the IP-Address and ssh and scp from.
If possible set your PC's IPv4 Address to 192.168.1.70
(As this is the IP-Address the Router's bootloader expects
for the tftp server)
4. power up the router and enter the u-boot
choose option 1 to upload the initramfs image. And follow
through the ipv4 setup.
Wait for your router's status LED to stop blinking rapidly and
glow just blue. (The LAN LED should also be glowing blue).
3. Connect to the OpenWrt running in RAM
The default IPv4-Address of your router will be 192.168.1.1.
1. Copy over the openwrt-sysupgrade.bin image to your router's
temporary directory
# scp openwrt-sysupgrade.bin root@192.168.1.1:/tmp
2. ssh from your PC into your router as root.
# ssh root@192.168.1.1
The default OpenWrt-Image won't ask for a password. Simply hit the Enter-Key.
Once connected...: run the following commands on your temporary installation
3. delete the "jffs2" ubi partition to make room for your new root partition
# ubirmvol /dev/ubi0 --name=jffs2
4. install OpenWrt on the NAND Flash.
# sysupgrade -v /tmp/openwrt-sysupgrade.bin
- This will will automatically reboot the router -
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2018-03-07 08:13:10 +00:00
|
|
|
ath10kcal_ubi_extract() {
|
|
|
|
|
local part=$1
|
|
|
|
|
local offset=$2
|
|
|
|
|
local count=$3
|
|
|
|
|
local ubidev
|
|
|
|
|
local ubi
|
|
|
|
|
|
|
|
|
|
. /lib/upgrade/nand.sh
|
|
|
|
|
|
|
|
|
|
ubidev=$(nand_find_ubi $CI_UBIPART)
|
|
|
|
|
ubi=$(nand_find_volume $ubidev $part)
|
|
|
|
|
[ -n "$ubi" ] || \
|
|
|
|
|
ath10kcal_die "no UBI volume found for $part"
|
|
|
|
|
|
|
|
|
|
dd if=/dev/$ubi of=/lib/firmware/$FIRMWARE bs=1 skip=$offset count=$count 2>/dev/null || \
|
|
|
|
|
ath10kcal_die "failed to extract from $ubi"
|
|
|
|
|
}
|
|
|
|
|
|
2018-03-10 09:59:18 +00:00
|
|
|
ath10kcal_patch_mac() {
|
|
|
|
|
local mac=$1
|
|
|
|
|
|
|
|
|
|
[ -z "$mac" ] && return
|
|
|
|
|
|
|
|
|
|
macaddr_2bin $mac | dd of=/lib/firmware/$FIRMWARE conv=notrunc bs=1 seek=6 count=6
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
ath10kcal_patch_mac_crc() {
|
|
|
|
|
local mac=$1
|
|
|
|
|
local mac_offset=6
|
|
|
|
|
local chksum_offset=2
|
|
|
|
|
local xor_mac
|
|
|
|
|
local xor_fw_mac
|
|
|
|
|
local xor_fw_chksum
|
|
|
|
|
|
|
|
|
|
xor_fw_mac=$(hexdump -v -n 6 -s $mac_offset -e '/1 "%02x"' /lib/firmware/$FIRMWARE)
|
|
|
|
|
xor_fw_mac="${xor_fw_mac:0:4} ${xor_fw_mac:4:4} ${xor_fw_mac:8:4}"
|
|
|
|
|
|
|
|
|
|
ath10kcal_patch_mac "$mac" && {
|
|
|
|
|
xor_mac=${mac//:/}
|
|
|
|
|
xor_mac="${xor_mac:0:4} ${xor_mac:4:4} ${xor_mac:8:4}"
|
|
|
|
|
|
|
|
|
|
xor_fw_chksum=$(hexdump -v -n 2 -s $chksum_offset -e '/1 "%02x"' /lib/firmware/$FIRMWARE)
|
|
|
|
|
xor_fw_chksum=$(xor $xor_fw_chksum $xor_fw_mac $xor_mac)
|
|
|
|
|
|
|
|
|
|
printf "%b" "\x${xor_fw_chksum:0:2}\x${xor_fw_chksum:2:2}" | \
|
|
|
|
|
dd of=/lib/firmware/$FIRMWARE conv=notrunc bs=1 seek=$chksum_offset count=2
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
ath10kcal_is_caldata_valid() {
|
|
|
|
|
local expected="$1"
|
|
|
|
|
|
|
|
|
|
magic=$(hexdump -v -n 2 -e '1/1 "%02x"' /lib/firmware/$FIRMWARE)
|
|
|
|
|
[[ "$magic" == "$expected" ]]
|
|
|
|
|
return $?
|
|
|
|
|
}
|
|
|
|
|
|
2018-02-21 19:40:50 +00:00
|
|
|
[ -e /lib/firmware/$FIRMWARE ] && exit 0
|
|
|
|
|
|
|
|
|
|
. /lib/functions.sh
|
|
|
|
|
. /lib/functions/system.sh
|
|
|
|
|
|
|
|
|
|
board=$(board_name)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
case "$FIRMWARE" in
|
2018-03-10 09:59:18 +00:00
|
|
|
"ath10k/cal-pci-0000:01:00.0.bin")
|
|
|
|
|
case "$board" in
|
|
|
|
|
meraki,mr33)
|
|
|
|
|
ath10kcal_ubi_extract "ART" 36864 2116
|
|
|
|
|
ath10kcal_is_caldata_valid "4408" || ath10kcal_extract "ART" 36864 2116
|
|
|
|
|
ath10kcal_patch_mac $(macaddr_add $(get_mac_binary "/sys/bus/i2c/devices/0-0050/eeprom" 102) +1)
|
|
|
|
|
;;
|
|
|
|
|
esac
|
|
|
|
|
;;
|
ipq40xx: add support for OpenMesh A62
* QCA IPQ4019
* 256 MB of RAM
* 32 MB of SPI NOR flash (s25fl256s1)
- 2x 15 MB available; but one of the 15 MB regions is the recovery image
* 2T2R 2.4 GHz
- QCA4019 hw1.0 (SoC)
- requires special BDF in QCA4019/hw1.0/board-2.bin with
bus=ahb,bmi-chip-id=0,bmi-board-id=20,variant=OM-A62
* 2T2R 5 GHz (channel 36-64)
- QCA9888 hw2.0 (PCI)
- requires special BDF in QCA9888/hw2.0/board-2.bin
bus=pci,bmi-chip-id=0,bmi-board-id=16,variant=OM-A62
* 2T2R 5 GHz (channel 100-165)
- QCA4019 hw1.0 (SoC)
- requires special BDF in QCA4019/hw1.0/board-2.bin with
bus=ahb,bmi-chip-id=0,bmi-board-id=21,variant=OM-A62
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x button (reset; kmod-input-gpio-keys compatible)
* external watchdog
- triggered GPIO
* 1x USB (xHCI)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x gigabit ethernet
- phy@mdio3:
+ Label: Ethernet 1
+ gmac0 (ethaddr) in original firmware
+ 802.3at POE+
- phy@mdio4:
+ Label: Ethernet 2
+ gmac1 (eth1addr) in original firmware
+ 18-24V passive POE (mode B)
* powered only via POE
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the factory image to the u-boot when the device boots up.
The initramfs image can be started using
setenv bootargs 'loglevel=8 earlycon=msm_serial_dm,0x78af000 console=ttyMSM0,115200 mtdparts=spi0.0:256k(0:SBL1),128k(0:MIBIB),384k(0:QSEE),64k(0:CDT),64k(0:DDRPARAMS),64k(0:APPSBLENV),512k(0:APPSBL),64k(0:ART),64k(0:custom),64k(0:KEYS),15552k(inactive),15552k(inactive2)'
tftpboot 0x84000000 openwrt-ipq40xx-openmesh_a62-initramfs-fit-uImage.itb
set fdt_high 0x85000000
bootm 0x84000000
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
2017-08-09 11:52:07 +00:00
|
|
|
"ath10k/pre-cal-pci-0000:01:00.0.bin")
|
|
|
|
|
case "$board" in
|
|
|
|
|
openmesh,a62)
|
|
|
|
|
ath10kcal_extract "0:ART" 36864 12064
|
|
|
|
|
;;
|
|
|
|
|
esac
|
|
|
|
|
;;
|
2018-02-21 19:40:50 +00:00
|
|
|
"ath10k/pre-cal-ahb-a000000.wifi.bin")
|
|
|
|
|
case "$board" in
|
2018-04-11 09:14:36 +00:00
|
|
|
8dev,jalapeno |\
|
|
|
|
|
glinet,gl-b1300 |\
|
|
|
|
|
qcom,ap-dk01.1-c1)
|
|
|
|
|
ath10kcal_extract "ART" 4096 12064
|
|
|
|
|
;;
|
ipq40xx: add support for ASUS RT-AC58U/RT-ACRH13
This patch adds support for ASUS RT-AC58U/RT-ACRH13.
hardware highlights:
SOC: IPQ4018 / QCA Dakota
CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7
DRAM: 128 MiB DDR3L-1066 @ 537 MHz (1074?) NT5CC64M16GP-DI
NOR: 2 MiB Macronix MX25L1606E (for boot, QSEE)
NAND: 128 MiB Winbond W25NO1GVZE1G (cal + kernel + root, UBI)
ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN)
USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC)
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
INPUT: one Reset and one WPS button
LEDS: Status, WAN, WIFI1/2, USB and LAN (one blue LED for each)
Serial:
WARNING: The serial port needs a TTL/RS-232 3V3 level converter!
The Serial setting is 115200-8-N-1. The board has an unpopulated
1x4 0.1" header. The pinout (VDD, RX, GND, TX) is printed on the
PCB right next to the connector.
U-Boot Note: The ethernet driver isn't always reliable and can sometime
time out... Don't worry, just retry.
Access via the serial console is required. As well as a working
TFTP-server setup and the initramfs image. (If not provided, it
has to be built from the OpenWrt source. Make sure to enable
LZMA as the compression for the INITRAMFS!)
To install the image permanently, you have to do the following
steps in the listed order.
1. Open up the router.
There are four phillips screws hiding behind the four plastic
feets on the underside.
2. Connect the serial cable (See notes above)
3. Connect your router via one of the four LAN-ports (yellow)
to a PC which can set the IP-Address and ssh and scp from.
If possible set your PC's IPv4 Address to 192.168.1.70
(As this is the IP-Address the Router's bootloader expects
for the tftp server)
4. power up the router and enter the u-boot
choose option 1 to upload the initramfs image. And follow
through the ipv4 setup.
Wait for your router's status LED to stop blinking rapidly and
glow just blue. (The LAN LED should also be glowing blue).
3. Connect to the OpenWrt running in RAM
The default IPv4-Address of your router will be 192.168.1.1.
1. Copy over the openwrt-sysupgrade.bin image to your router's
temporary directory
# scp openwrt-sysupgrade.bin root@192.168.1.1:/tmp
2. ssh from your PC into your router as root.
# ssh root@192.168.1.1
The default OpenWrt-Image won't ask for a password. Simply hit the Enter-Key.
Once connected...: run the following commands on your temporary installation
3. delete the "jffs2" ubi partition to make room for your new root partition
# ubirmvol /dev/ubi0 --name=jffs2
4. install OpenWrt on the NAND Flash.
# sysupgrade -v /tmp/openwrt-sysupgrade.bin
- This will will automatically reboot the router -
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2018-03-07 08:13:10 +00:00
|
|
|
asus,rt-ac58u)
|
|
|
|
|
CI_UBIPART=UBI_DEV
|
|
|
|
|
ath10kcal_ubi_extract "Factory" 4096 12064
|
|
|
|
|
;;
|
2018-02-21 19:40:50 +00:00
|
|
|
avm,fritzbox-4040)
|
|
|
|
|
/usr/bin/fritz_cal_extract -i 1 -s 0x400 -e 0x207 -l 12064 -o /lib/firmware/$FIRMWARE $(find_mtd_chardev "urlader_config")
|
|
|
|
|
;;
|
2018-03-10 09:59:18 +00:00
|
|
|
meraki,mr33)
|
|
|
|
|
ath10kcal_ubi_extract "ART" 4096 12064
|
|
|
|
|
ath10kcal_is_caldata_valid "202f" || ath10kcal_extract "ART" 4096 12064
|
|
|
|
|
ath10kcal_patch_mac_crc $(macaddr_add $(get_mac_binary "/sys/bus/i2c/devices/0-0050/eeprom" 102) +2)
|
|
|
|
|
;;
|
ipq40xx: add support for Netgear EX6100v2/EX6150v2
Specifications:
SOC: Qualcomm IPQ4018 (DAKOTA) ARM Quad-Core
RAM: 256 MB Winbond W632GU6KB12J
FLASH: 16 MiB Macronix MX25L12805D
ETH: Qualcomm QCA8072
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11b/g/n/ac 2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11n/ac
1x1 (EX6100)
2x2 (EX6150)
INPUT: Power, WPS, reset button
AP / Range-extender toggle
LED: Power, Router, Extender (dual), WPS, Left-/Right-arrow
SERIAL: Header next to QCA8072 chip.
VCC, TX, RX, GND (Square hole is VCC)
WARNING: The serial port needs a TTL/RS-232 v3.3 level converter!
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet
- 2.4 GHz WiFi (Correct MAC-address)
- 5 GHz WiFi (Correct MAC-address)
- Factory installation from WebIF
- Factory installation from tftp
- OpenWRT sysupgrade (Preserving and non-preserving)
- LEDs
- Buttons
Not Working:
- AP/Extender toggle-switch
Untested:
- Support on EX6100v2. They share the same GPL-Code and vendor-images.
The 6100v2 seems to lack one 5GHz stream and differs in the 5GHz
board-blob. I only own a EX6150v2, therefore i am only able to verify
functionality on this device.
Install via Web-Interface:
Upload the factory image to the device to the Netgear Web-Interface.
The device might asks you to confirm the update a second time due to
detecting the OpenWRT firmware as older. The device will automatically
reboot after the image is written to flash.
Install via TFTP:
Connect to the devices serial. Hit Enter-Key in bootloader to stop
autobooting. Command "fw_recovery" will start a tftp server, waiting for
a DNI image to be pushed.
Assign your computer the IP-address 192.168.1.10/24. Push image with
tftp -4 -v -m binary 192.168.1.1 -c put <OPENWRT_FACTORY>
Device will erase factory-partition first, then writes the pushed image
to flash and reboots.
Parts of this commit are based on Thomas Hebb's work on the
openwrt-devel mailinglist.
See https://lists.openwrt.org/pipermail/openwrt-devel/2018-January/043418.html
Signed-off-by: David Bauer <mail@david-bauer.net>
2018-03-28 22:32:38 +00:00
|
|
|
netgear,ex6100v2 |\
|
|
|
|
|
netgear,ex6150v2)
|
|
|
|
|
ath10kcal_extract "ART" 4096 12064
|
|
|
|
|
ath10kcal_patch_mac_crc $(mtd_get_mac_binary dnidata 0)
|
|
|
|
|
;;
|
2018-03-02 10:56:53 +00:00
|
|
|
compex,wpj428 |\
|
ipq40xx: add support for OpenMesh A62
* QCA IPQ4019
* 256 MB of RAM
* 32 MB of SPI NOR flash (s25fl256s1)
- 2x 15 MB available; but one of the 15 MB regions is the recovery image
* 2T2R 2.4 GHz
- QCA4019 hw1.0 (SoC)
- requires special BDF in QCA4019/hw1.0/board-2.bin with
bus=ahb,bmi-chip-id=0,bmi-board-id=20,variant=OM-A62
* 2T2R 5 GHz (channel 36-64)
- QCA9888 hw2.0 (PCI)
- requires special BDF in QCA9888/hw2.0/board-2.bin
bus=pci,bmi-chip-id=0,bmi-board-id=16,variant=OM-A62
* 2T2R 5 GHz (channel 100-165)
- QCA4019 hw1.0 (SoC)
- requires special BDF in QCA4019/hw1.0/board-2.bin with
bus=ahb,bmi-chip-id=0,bmi-board-id=21,variant=OM-A62
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x button (reset; kmod-input-gpio-keys compatible)
* external watchdog
- triggered GPIO
* 1x USB (xHCI)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x gigabit ethernet
- phy@mdio3:
+ Label: Ethernet 1
+ gmac0 (ethaddr) in original firmware
+ 802.3at POE+
- phy@mdio4:
+ Label: Ethernet 2
+ gmac1 (eth1addr) in original firmware
+ 18-24V passive POE (mode B)
* powered only via POE
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the factory image to the u-boot when the device boots up.
The initramfs image can be started using
setenv bootargs 'loglevel=8 earlycon=msm_serial_dm,0x78af000 console=ttyMSM0,115200 mtdparts=spi0.0:256k(0:SBL1),128k(0:MIBIB),384k(0:QSEE),64k(0:CDT),64k(0:DDRPARAMS),64k(0:APPSBLENV),512k(0:APPSBL),64k(0:ART),64k(0:custom),64k(0:KEYS),15552k(inactive),15552k(inactive2)'
tftpboot 0x84000000 openwrt-ipq40xx-openmesh_a62-initramfs-fit-uImage.itb
set fdt_high 0x85000000
bootm 0x84000000
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
2017-08-09 11:52:07 +00:00
|
|
|
openmesh,a42 |\
|
|
|
|
|
openmesh,a62)
|
2018-02-21 19:40:50 +00:00
|
|
|
ath10kcal_extract "0:ART" 4096 12064
|
|
|
|
|
;;
|
ipq40xx: add support for the ZyXEL NBG6617
This patch adds support for ZyXEL NBG6617
Hardware highlights:
SOC: IPQ4018 / QCA Dakota
CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7
DRAM: 256 MiB DDR3L-1600/1866 Nanya NT5CC128M16IP-DI @ 537 MHz
NOR: 32 MiB Macronix MX25L25635F
ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN)
USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC)
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
INPUT: RESET Button, WIFI/Rfkill Togglebutton, WPS Button
LEDS: Power, WAN, LAN 1-4, WLAN 2.4GHz, WLAN 5GHz, USB, WPS
Serial:
WARNING: The serial port needs a TTL/RS-232 3.3v level converter!
The Serial setting is 115200-8-N-1. The 1x4 .1" header comes
pre-soldered. Pinout:
1. 3v3 (Label printed on the PCB), 2. RX, 3. GND, 4. TX
first install / debricking / restore stock:
0. Have a PC running a tftp-server @ 192.168.1.99/24
1. connect the PC to any LAN-Ports
2. put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file
into the tftp-server root directory and rename it to just "ras.bin".
3. power-cycle the router and hold down the the WPS button (for 30sek)
4. Wait (for a long time - the serial console provides some progress
reports. The u-boot says it best: "Please be patient".
5. Once the power LED starts to flashes slowly and the USB + WPS LEDs
flashes fast at the same time. You have to reboot the device and
it should then come right up.
Installation via Web-UI:
0. Connect a PC to the powered-on router. It will assign your PC a
IP-address via DHCP
1. Access the Web-UI at 192.168.1.1 (Default Passwort: 1234)
2. Go to the "Expert Mode"
3. Under "Maintenance", select "Firmware-Upgrade"
4. Upload the OpenWRT factory image
5. Wait for the Device to finish.
It will reboot into OpenWRT without any additional actions needed.
To open the ZyXEL NBG6617:
0. remove the four rubber feet glued on the backside
1. remove the four philips screws and pry open the top cover
(by applying force between the plastic top housing from the
backside/lan-port side)
Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
|NBG6617> HELP
|ATEN x[,y] set BootExtension Debug Flag (y=password)
|ATSE x show the seed of password generator
|ATSH dump manufacturer related data in ROM
|ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO boot up whole system
|ATUR x upgrade RAS image (filename)
|NBG6617>
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
|NBG6617> ATSE NBG6617
|012345678901
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711
copy and paste the result into the shell to unlock zloader.
|NBG6617> ATEN 1,0046B0017430
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
|NBG6617> ATGU
|NBG6617#
Co-authored-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: David Bauer <mail@david-bauer.net>
2018-06-21 12:24:59 +00:00
|
|
|
zyxel,nbg6617 |\
|
ipq40xx: add support for ZyXEL WRE6606
Specifications:
SOC: Qualcomm IPQ4018 (DAKOTA) ARM Quad-Core
RAM: 128 MB Nanya NT5CC64M16GP-DI
FLASH: 16 MiB Macronix MX25L12845EMI-12G
ETH: Qualcomm QCA8072
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11b/g/n 2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11n/ac W2 2x2
INPUT: WPS, Mode-toggle-switch
LED: Power, WLAN 2.4GHz, WLAN 5GHz, LAN, WPS
(LAN not controllable by software)
(WLAN each green / red)
SERIAL: Header next to eth-phy.
VCC, TX, GND, RX (Square hole is VCC)
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet (Correct MAC-address)
- 2.4 GHz WiFi (Correct MAC-address)
- 5 GHz WiFi (Correct MAC-address)
- Factory installation from tftp
- OpenWRT sysupgrade
- LEDs
- WPS Button
Not Working:
- Mode-toggle-switch
Install via TFTP:
Connect to the devices serial. Hit Enter-Key in bootloader to stop
autobooting. Command `tftpboot` will pull an initramfs image named
`C0A86302.img` from a tftp server at `192.168.99.08/24`.
After successfull transfer, boot the image with `bootm`.
To persistently write the firmware, flash an openwrt sysupgrade image
from inside the initramfs, for example transfer
via `scp <sysupgrade> root@192.168.1.1:/tmp` and flash on the device
with `sysupgrade -n /tmp/<sysupgrade>`.
append-cmdline patch taken from chunkeeys work on the NBG6617.
Signed-off-by: Magnus Frühling <skorpy@frankfurt.ccc.de>
Co-authored-by: David Bauer <mail@david-bauer.net>
Co-authored-by: Christian Lamparter <chunkeey@googlemail.com>
2018-06-11 21:10:43 +00:00
|
|
|
zyxel,wre6606)
|
|
|
|
|
ath10kcal_extract "ART" 4096 12064
|
|
|
|
|
ath10kcal_patch_mac_crc $(macaddr_add $(cat /sys/class/net/eth0/address) -2)
|
|
|
|
|
;;
|
2018-02-21 19:40:50 +00:00
|
|
|
esac
|
|
|
|
|
;;
|
|
|
|
|
"ath10k/pre-cal-ahb-a800000.wifi.bin")
|
|
|
|
|
case "$board" in
|
2018-04-11 09:14:36 +00:00
|
|
|
8dev,jalapeno |\
|
|
|
|
|
glinet,gl-b1300 |\
|
|
|
|
|
qcom,ap-dk01.1-c1)
|
|
|
|
|
ath10kcal_extract "ART" 20480 12064
|
|
|
|
|
;;
|
ipq40xx: add support for ASUS RT-AC58U/RT-ACRH13
This patch adds support for ASUS RT-AC58U/RT-ACRH13.
hardware highlights:
SOC: IPQ4018 / QCA Dakota
CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7
DRAM: 128 MiB DDR3L-1066 @ 537 MHz (1074?) NT5CC64M16GP-DI
NOR: 2 MiB Macronix MX25L1606E (for boot, QSEE)
NAND: 128 MiB Winbond W25NO1GVZE1G (cal + kernel + root, UBI)
ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN)
USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC)
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
INPUT: one Reset and one WPS button
LEDS: Status, WAN, WIFI1/2, USB and LAN (one blue LED for each)
Serial:
WARNING: The serial port needs a TTL/RS-232 3V3 level converter!
The Serial setting is 115200-8-N-1. The board has an unpopulated
1x4 0.1" header. The pinout (VDD, RX, GND, TX) is printed on the
PCB right next to the connector.
U-Boot Note: The ethernet driver isn't always reliable and can sometime
time out... Don't worry, just retry.
Access via the serial console is required. As well as a working
TFTP-server setup and the initramfs image. (If not provided, it
has to be built from the OpenWrt source. Make sure to enable
LZMA as the compression for the INITRAMFS!)
To install the image permanently, you have to do the following
steps in the listed order.
1. Open up the router.
There are four phillips screws hiding behind the four plastic
feets on the underside.
2. Connect the serial cable (See notes above)
3. Connect your router via one of the four LAN-ports (yellow)
to a PC which can set the IP-Address and ssh and scp from.
If possible set your PC's IPv4 Address to 192.168.1.70
(As this is the IP-Address the Router's bootloader expects
for the tftp server)
4. power up the router and enter the u-boot
choose option 1 to upload the initramfs image. And follow
through the ipv4 setup.
Wait for your router's status LED to stop blinking rapidly and
glow just blue. (The LAN LED should also be glowing blue).
3. Connect to the OpenWrt running in RAM
The default IPv4-Address of your router will be 192.168.1.1.
1. Copy over the openwrt-sysupgrade.bin image to your router's
temporary directory
# scp openwrt-sysupgrade.bin root@192.168.1.1:/tmp
2. ssh from your PC into your router as root.
# ssh root@192.168.1.1
The default OpenWrt-Image won't ask for a password. Simply hit the Enter-Key.
Once connected...: run the following commands on your temporary installation
3. delete the "jffs2" ubi partition to make room for your new root partition
# ubirmvol /dev/ubi0 --name=jffs2
4. install OpenWrt on the NAND Flash.
# sysupgrade -v /tmp/openwrt-sysupgrade.bin
- This will will automatically reboot the router -
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2018-03-07 08:13:10 +00:00
|
|
|
asus,rt-ac58u)
|
|
|
|
|
CI_UBIPART=UBI_DEV
|
|
|
|
|
ath10kcal_ubi_extract "Factory" 20480 12064
|
|
|
|
|
;;
|
2018-02-21 19:40:50 +00:00
|
|
|
avm,fritzbox-4040)
|
|
|
|
|
/usr/bin/fritz_cal_extract -i 1 -s 0x400 -e 0x208 -l 12064 -o /lib/firmware/$FIRMWARE $(find_mtd_chardev "urlader_config")
|
|
|
|
|
;;
|
2018-03-10 09:59:18 +00:00
|
|
|
meraki,mr33)
|
|
|
|
|
ath10kcal_ubi_extract "ART" 20480 12064
|
|
|
|
|
ath10kcal_is_caldata_valid "202f" || ath10kcal_extract "ART" 20480 12064
|
|
|
|
|
ath10kcal_patch_mac_crc $(macaddr_add $(get_mac_binary "/sys/bus/i2c/devices/0-0050/eeprom" 102) +3)
|
|
|
|
|
;;
|
ipq40xx: add support for Netgear EX6100v2/EX6150v2
Specifications:
SOC: Qualcomm IPQ4018 (DAKOTA) ARM Quad-Core
RAM: 256 MB Winbond W632GU6KB12J
FLASH: 16 MiB Macronix MX25L12805D
ETH: Qualcomm QCA8072
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11b/g/n/ac 2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11n/ac
1x1 (EX6100)
2x2 (EX6150)
INPUT: Power, WPS, reset button
AP / Range-extender toggle
LED: Power, Router, Extender (dual), WPS, Left-/Right-arrow
SERIAL: Header next to QCA8072 chip.
VCC, TX, RX, GND (Square hole is VCC)
WARNING: The serial port needs a TTL/RS-232 v3.3 level converter!
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet
- 2.4 GHz WiFi (Correct MAC-address)
- 5 GHz WiFi (Correct MAC-address)
- Factory installation from WebIF
- Factory installation from tftp
- OpenWRT sysupgrade (Preserving and non-preserving)
- LEDs
- Buttons
Not Working:
- AP/Extender toggle-switch
Untested:
- Support on EX6100v2. They share the same GPL-Code and vendor-images.
The 6100v2 seems to lack one 5GHz stream and differs in the 5GHz
board-blob. I only own a EX6150v2, therefore i am only able to verify
functionality on this device.
Install via Web-Interface:
Upload the factory image to the device to the Netgear Web-Interface.
The device might asks you to confirm the update a second time due to
detecting the OpenWRT firmware as older. The device will automatically
reboot after the image is written to flash.
Install via TFTP:
Connect to the devices serial. Hit Enter-Key in bootloader to stop
autobooting. Command "fw_recovery" will start a tftp server, waiting for
a DNI image to be pushed.
Assign your computer the IP-address 192.168.1.10/24. Push image with
tftp -4 -v -m binary 192.168.1.1 -c put <OPENWRT_FACTORY>
Device will erase factory-partition first, then writes the pushed image
to flash and reboots.
Parts of this commit are based on Thomas Hebb's work on the
openwrt-devel mailinglist.
See https://lists.openwrt.org/pipermail/openwrt-devel/2018-January/043418.html
Signed-off-by: David Bauer <mail@david-bauer.net>
2018-03-28 22:32:38 +00:00
|
|
|
netgear,ex6100v2 |\
|
|
|
|
|
netgear,ex6150v2)
|
|
|
|
|
ath10kcal_extract "ART" 20480 12064
|
|
|
|
|
ath10kcal_patch_mac_crc $(mtd_get_mac_binary dnidata 12)
|
|
|
|
|
;;
|
2018-03-02 10:56:53 +00:00
|
|
|
compex,wpj428 |\
|
ipq40xx: add support for OpenMesh A62
* QCA IPQ4019
* 256 MB of RAM
* 32 MB of SPI NOR flash (s25fl256s1)
- 2x 15 MB available; but one of the 15 MB regions is the recovery image
* 2T2R 2.4 GHz
- QCA4019 hw1.0 (SoC)
- requires special BDF in QCA4019/hw1.0/board-2.bin with
bus=ahb,bmi-chip-id=0,bmi-board-id=20,variant=OM-A62
* 2T2R 5 GHz (channel 36-64)
- QCA9888 hw2.0 (PCI)
- requires special BDF in QCA9888/hw2.0/board-2.bin
bus=pci,bmi-chip-id=0,bmi-board-id=16,variant=OM-A62
* 2T2R 5 GHz (channel 100-165)
- QCA4019 hw1.0 (SoC)
- requires special BDF in QCA4019/hw1.0/board-2.bin with
bus=ahb,bmi-chip-id=0,bmi-board-id=21,variant=OM-A62
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x button (reset; kmod-input-gpio-keys compatible)
* external watchdog
- triggered GPIO
* 1x USB (xHCI)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x gigabit ethernet
- phy@mdio3:
+ Label: Ethernet 1
+ gmac0 (ethaddr) in original firmware
+ 802.3at POE+
- phy@mdio4:
+ Label: Ethernet 2
+ gmac1 (eth1addr) in original firmware
+ 18-24V passive POE (mode B)
* powered only via POE
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the factory image to the u-boot when the device boots up.
The initramfs image can be started using
setenv bootargs 'loglevel=8 earlycon=msm_serial_dm,0x78af000 console=ttyMSM0,115200 mtdparts=spi0.0:256k(0:SBL1),128k(0:MIBIB),384k(0:QSEE),64k(0:CDT),64k(0:DDRPARAMS),64k(0:APPSBLENV),512k(0:APPSBL),64k(0:ART),64k(0:custom),64k(0:KEYS),15552k(inactive),15552k(inactive2)'
tftpboot 0x84000000 openwrt-ipq40xx-openmesh_a62-initramfs-fit-uImage.itb
set fdt_high 0x85000000
bootm 0x84000000
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
2017-08-09 11:52:07 +00:00
|
|
|
openmesh,a42 |\
|
|
|
|
|
openmesh,a62)
|
2018-02-21 19:40:50 +00:00
|
|
|
ath10kcal_extract "0:ART" 20480 12064
|
|
|
|
|
;;
|
ipq40xx: add support for the ZyXEL NBG6617
This patch adds support for ZyXEL NBG6617
Hardware highlights:
SOC: IPQ4018 / QCA Dakota
CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7
DRAM: 256 MiB DDR3L-1600/1866 Nanya NT5CC128M16IP-DI @ 537 MHz
NOR: 32 MiB Macronix MX25L25635F
ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN)
USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC)
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
INPUT: RESET Button, WIFI/Rfkill Togglebutton, WPS Button
LEDS: Power, WAN, LAN 1-4, WLAN 2.4GHz, WLAN 5GHz, USB, WPS
Serial:
WARNING: The serial port needs a TTL/RS-232 3.3v level converter!
The Serial setting is 115200-8-N-1. The 1x4 .1" header comes
pre-soldered. Pinout:
1. 3v3 (Label printed on the PCB), 2. RX, 3. GND, 4. TX
first install / debricking / restore stock:
0. Have a PC running a tftp-server @ 192.168.1.99/24
1. connect the PC to any LAN-Ports
2. put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file
into the tftp-server root directory and rename it to just "ras.bin".
3. power-cycle the router and hold down the the WPS button (for 30sek)
4. Wait (for a long time - the serial console provides some progress
reports. The u-boot says it best: "Please be patient".
5. Once the power LED starts to flashes slowly and the USB + WPS LEDs
flashes fast at the same time. You have to reboot the device and
it should then come right up.
Installation via Web-UI:
0. Connect a PC to the powered-on router. It will assign your PC a
IP-address via DHCP
1. Access the Web-UI at 192.168.1.1 (Default Passwort: 1234)
2. Go to the "Expert Mode"
3. Under "Maintenance", select "Firmware-Upgrade"
4. Upload the OpenWRT factory image
5. Wait for the Device to finish.
It will reboot into OpenWRT without any additional actions needed.
To open the ZyXEL NBG6617:
0. remove the four rubber feet glued on the backside
1. remove the four philips screws and pry open the top cover
(by applying force between the plastic top housing from the
backside/lan-port side)
Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
|NBG6617> HELP
|ATEN x[,y] set BootExtension Debug Flag (y=password)
|ATSE x show the seed of password generator
|ATSH dump manufacturer related data in ROM
|ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO boot up whole system
|ATUR x upgrade RAS image (filename)
|NBG6617>
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
|NBG6617> ATSE NBG6617
|012345678901
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711
copy and paste the result into the shell to unlock zloader.
|NBG6617> ATEN 1,0046B0017430
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
|NBG6617> ATGU
|NBG6617#
Co-authored-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: David Bauer <mail@david-bauer.net>
2018-06-21 12:24:59 +00:00
|
|
|
zyxel,nbg6617 |\
|
ipq40xx: add support for ZyXEL WRE6606
Specifications:
SOC: Qualcomm IPQ4018 (DAKOTA) ARM Quad-Core
RAM: 128 MB Nanya NT5CC64M16GP-DI
FLASH: 16 MiB Macronix MX25L12845EMI-12G
ETH: Qualcomm QCA8072
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11b/g/n 2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11n/ac W2 2x2
INPUT: WPS, Mode-toggle-switch
LED: Power, WLAN 2.4GHz, WLAN 5GHz, LAN, WPS
(LAN not controllable by software)
(WLAN each green / red)
SERIAL: Header next to eth-phy.
VCC, TX, GND, RX (Square hole is VCC)
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet (Correct MAC-address)
- 2.4 GHz WiFi (Correct MAC-address)
- 5 GHz WiFi (Correct MAC-address)
- Factory installation from tftp
- OpenWRT sysupgrade
- LEDs
- WPS Button
Not Working:
- Mode-toggle-switch
Install via TFTP:
Connect to the devices serial. Hit Enter-Key in bootloader to stop
autobooting. Command `tftpboot` will pull an initramfs image named
`C0A86302.img` from a tftp server at `192.168.99.08/24`.
After successfull transfer, boot the image with `bootm`.
To persistently write the firmware, flash an openwrt sysupgrade image
from inside the initramfs, for example transfer
via `scp <sysupgrade> root@192.168.1.1:/tmp` and flash on the device
with `sysupgrade -n /tmp/<sysupgrade>`.
append-cmdline patch taken from chunkeeys work on the NBG6617.
Signed-off-by: Magnus Frühling <skorpy@frankfurt.ccc.de>
Co-authored-by: David Bauer <mail@david-bauer.net>
Co-authored-by: Christian Lamparter <chunkeey@googlemail.com>
2018-06-11 21:10:43 +00:00
|
|
|
zyxel,wre6606)
|
|
|
|
|
ath10kcal_extract "ART" 20480 12064
|
|
|
|
|
ath10kcal_patch_mac_crc $(macaddr_add $(cat /sys/class/net/eth0/address) -1)
|
|
|
|
|
;;
|
2018-02-21 19:40:50 +00:00
|
|
|
esac
|
|
|
|
|
;;
|
|
|
|
|
*)
|
|
|
|
|
exit 1
|
|
|
|
|
;;
|
|
|
|
|
esac
|