On the bottom sticker it's branded as ZTE ZXECS EBG3130 device, but in factory
OpenWrt image it's referenced as BDCOM WAP2100-SK device.
Specifications:
- SoC: MediaTek MT7620A
- RAM: 128 MB
- Flash: 16 MB
- Ethernet: 5 FE ports
- Wireless radio: 2T2R 2.4 GHz and 1T1R 5 GHz (MT7610EN, unsupported)
- UART: 1 x UART on PCB marked as J2 (R=RX, T=TX, G=GND) with 115200 8N1 config
- LEDs: Power, FE ports 1-5, WPS, USB, RF 2.4G, RF 5G
- Other: USB port, SD card slot and 2x external antennas (non-detachable)
Flashing instructions:
A) The U-Boot has HTTP based firmware upgrade
A1) Flashing notes
We've identified so far two different batches of units, unfortunately
each batch has different U-Boot bootloader flashed with different
default environment variables, thus each batch has different IP address
for accessing web based firmware updater.
* First batch has web based bootloader IP address 1.1.1.1
* Second batch has web based bootloader IP address 192.168.1.250
In case you can't connect to either of those IPs, you can try to get
the default IP address via two methods:
A1.1) Serial console, then the IP address is visible during the boot
...
HTTP server is starting at IP: 1.1.1.1
raspi_read: from:40004 len:6
HTTP server is ready!
...
A1.2) Over telnet/SSH using this command:
root@bdcom:/# grep ipaddr= /dev/mtd0
ipaddr=1.1.1.1
A2) Flashing with browser
* Change IP address of PC to 1.1.1.2 with 255.255.255.0 netmask
* Reboot the device and try to reach web based bootloader in the
browser with the following URL http://1.1.1.1
* Quickly select the firmware sysupgrade file and click on the
`Update firmware` button, this all has to be done within 10 seconds,
bootloader doesn't wait any longer
If done correctly, the web page should show UPDATE IN PROGRESS page
with progress indicator. Once the flashing completes (it takes roughly
around 1 minute), the device will reboot to the OpenWrt firmware
A3) Flashing with curl
sudo ip addr add 1.1.1.2/24 dev eth0
curl \
--verbose \
--retry 3 \
--retry-delay 1 \
--retry-max-time 30 \
--connect-timeout 30 \
--form "firmware=@openwrt-ramips-mt7620-BDCOM-WAP2100-SK-squashfs-sysupgrade.bin" \
http://1.1.1.1
Now power on the router.
B) The U-boot is based on Ralink SDK so we can flash the firmware using UART.
1. Configure PC with a static IP address and setup an TFTP server.
2. Put the firmware into the tftp directory.
3. Connect the UART line as described on the PCB (G=GND, R=RX, T=TX)
4. Power up the device and press 2, follow the instruction to set device and
tftp server IP address and input the firmware file name. U-boot will then load
the firmware and write it into the flash.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Create initrd enries for x86 images, that'll load intel microcode as
early as possible. To achieve that the test module for grub is enabled
which provides shell-like conditionals. Also restrict the late load of
microcode to AMD processors.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
Add files to bootfs image from selected as built-in packages, which want
to install files to targets boot file system.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
Mount boot file system with rw option to allow installation of packages
which install files to /boot directory.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
Ubiquity allows flashing of unsigned factory images via TFTP recovery
method[1]. They claim in airOS v6.0.7 release changelog[2] following:
All future airOS versions will be signed in this way and not allow
unsigned firmware to be loaded except via TFTP.
U-boot bootloader on M-XW devices expects factory image revision
version in specific format. On airOS v6.1.7 with `U-Boot 1.1.4-s1039
(May 24 2017 - 15:58:18)` bootloader checks if the revision major(?)
number is actually a number, but in currently generated images there's
OpenWrt text and so the check fails:
Hit any key to stop autoboot: 0
Setting default IP 192.168.1.20
Starting TFTP server...
Receiving file from 192.168.1.25:38438
Received 4981148 bytes
Firmware check failed! (1)
By placing arbitrary correct number first in major version, we make the
bootloader happy and we can flash factory images over TFTP again:
Received 3735964 bytes
Firmware Version: XW.ar934x.v6.0.4-42.r8474-56aa1ac-OpenWrt
Setting U-Boot environment variables
Un-Protected 1 sectors
Erasing Flash.... done
Patch provided by AREDN[3] project, tested on Bullet M2 XW (ynezz) and
Nanostation M5 XW (ae6xe).
1. https://help.ubnt.com/hc/en-us/articles/204910124-UniFi-TFTP-Recovery-for-Bricked-Access-Points
2. https://dl.ubnt.com/firmwares/XW-fw/v6.0.7/changelog.txt
3. https://github.com/aredn
Signed-off-by: Petr Štetiar <ynezz@true.cz>
CPU: AR9342 SoC
RAM: 64 MB DDR2
Flash: 8 MB NOR SPI
Ports: 100 MBit (24V PoE in)
WLAN: 2.4/5 GHz
UART: 1 UART on PCB marked as J1 with 115200 8N1 config
LEDs: Power, Ethernet, 4x RSSI LEDs (orange, red, 2x green)
Buttons: Reset
UART connection details
.---------------------------------.
| |
[ETH] J1 [ANT]
| o VCC o RX o TX o GND |
`---------------------------------'
Flashing instructions
A) Serial console, U-Boot and TFTP
1. Connect to serial header J1 on the PCB
2. Power on device and enter U-Boot console
3. Set up TFTP server serving an OpenWrt initramfs build
4. Load initramfs build using the command tftpboot in the U-Boot cli
5. Boot the loaded image using the command bootm
6. Copy squashfs OpenWrt sysupgrade build to the booted device
7. Use mtd to write sysupgrade to partition "firmware"
8. Reboot and enjoy
B) Experimental factory image flashing over SSH from airOS v6.1.7
1. You need to flash your UBNT M2HP with airOS v6.1.7 firmware
no other airOS version is currently supported
2. git clone https://github.com/true-systems/ubnt-bullet-m2hp-openwrt-flashing
3. cd ubnt-bullet-m2hp-openwrt-flashing
4. make flash-factory FW_OWRT=/path/to/your/openwrt-ath79-generic-ubnt_bullet-m-xw-squashfs-factory.bin
Tested only on Bullet M2HP.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Belkin F5D8235 v2 has two ethernet switches on board.
One internal rt3052 and rtl8366rb on rgmii interface.
Looks like internal switch settings were lost in
translation to device tree infrastructure.
Signed-off-by: Roman Yeryomin <roman@advem.lv>
Specifically, SKW92A_E16, described here:
http://www.skylabmodule.com/wp-content/uploads/SkyLab_SKW92A_V1.04_datasheet.pdf
Specification:
- MediaTek MT7628N/N (580 Mhz)
- 64 MB of RAM
- 16 MB of FLASH
- 2T2R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x u.FL
- Power by micro-USB connector at USB1 on EVB
- UART via micro-USB connector at USB3 on EVB (57600 8n1)
- 5x Ethernet LEDs
- 1x WLAN LEDs
- 1x WPS LED connected by jumper wire from I2S_CK on J20 to WPS_LED pin hole next
to daughter board on EVB
- WPS/Reset button (S2 on EVB)
- RESET button (S1 on EVB) is *not* connected to RST hole next to daughter board
Flash instruction:
>From Skylab firmware:
1. Associate with SKYLAP_AP
2. In a browser, load: http://10.10.10.254/
3. Username/password: admin/admin
4. In web admin interface: Administration / Upload Firmware, browse to
sysupgrade image, apply, flash will fail with a message:
Not a valid firmware. *** Warning: "/var/tmpFW" has corrupted data!
5. Telnet to 10.10.10.254, drops you into a root shell with no credentials
6. # cd /var
7. # mtd_write -r write tmpFW mtd4
Unlocking mtd4 ...
Writing from tmpFW to mtd4 ... [e]
8. When flash has completed, you will have booted into your firmware.
>From U-boot via TFTP and initramfs:
1. Place openwrt-ramips-mt76x8-skw92a-initramfs-kernel.bin on a TFTP server
2. Connect to serial console at USB3 on EVB
3. Connect ethernet between port 1 (not WAN) and your TFTP server (e.g.
192.168.11.20)
4. Start terminal software (e.g. screen /dev/ttyUSB0 57600) on PC
5. Apply power to EVB
6. Interrupt u-boot with keypress of "1"
7. At u-boot prompts:
Input device IP (10.10.10.123) ==:192.168.11.21
Input server IP (10.10.10.3) ==:192.168.11.20
Input Linux Kernel filename (root_uImage) ==:openwrt-ramips-mt76x8-skw92a-initramfs-kernel.bin
8. Move ethernet to port 0 (WAN) on EVB
9. At new OpenWrt console shell, fetch squashfs-sysupgrade image and flash
with sysupgrade.
>From U-boot via TFTP direct flash:
1. Place openwrt-ramips-mt76x8-skw92a-squashfs-sysupgrade.bin on a TFTP server
2. Connect to serial console at USB3 on EVB (57600 8N1)
3. Connect ethernet between port 1 (not WAN) an your TFTP server (e.g.
192.168.11.20)
4. Start terminal software (e.g. screen /dev/ttyUSB0 57600) on PC
5. Apply power to EVB
6. Interrupt u-boot with keypress of "2"
7. At u-boot prompts:
Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N) Y
Input device IP (10.10.10.123) ==:192.168.11.21
Input server IP (10.10.10.3) ==:192.168.11.20
Input Linux Kernel filename (root_uImage) ==:openwrt-ramips-mt76x8-skw92a-squashfs-sysupgrade.bin
8. When transfer is complete or as OpenWrt begins booting, move ethernet to
port 0 (WAN).
Signed-off-by: Russell Senior <russell@personaltelco.net>
This is probably theoretical problem as the Ventana is defined first in
the image Makefile, but once the position of the definition would change
in the future (alphabetical sorting?) it would get bootscript from the
previous board which would have BOOT_SCRIPT set.
Cc: Tim Harvey <tharvey@gateworks.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Both devices come with a MediaTek MT7610E 5GHz 802.11ac 1T1R radio
which wasn't supported at the time the devices were added to OpenWrt.
Now that we got it, include kmod-mt76x0e in images for those devices.
Reported-by: Arian Sanusi <openwrt@semioptimal.net>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This allows us to use the bridge as a managed switch and gracefully
handle mixed tagged and untagged frames. Prior to this, the only
alternative was creating one bridge per vlan which quickly becomes a
nightmare and still won't let you mix both tagged and untagged frames on
the physical port without some complex ebtables magic.
This is in line with the notion that OpenWRT is the network go-to swiss
army knife when you need a nice set-and-forget, low maintenance box to
handle a specific task.
Current builds of the ip-bridge package already fully support this
feature so the only requirement is enabling the kernel config.
This is disabled by default so existing bridge configurations will not
be affected. This patch only gives the ability to turn it on with an
'ip link' command. If there is interest, I could look into making the
feature accessible via uci configuration.
It causes about 3.1% hit on raw bridging speed, which is relatively
trivial considering that I had to use 300 byte packets to strain the CPU
enough to notice a slowdown at all. The ER8 would chug along at wire
speed otherwise, and that's using only one core. Since the typical
bridge use case on OpenWRT is wireless, I doubt it would be noticeable
at all.
With BRIDGE_VLAN_FILTERING
iperf -u -c 192.168.1.105 -b 1G -l 300
------------------------------------------------------------
Client connecting to 192.168.1.105, UDP port 5001
Sending 300 byte datagrams, IPG target: 2.24 us (kalman adjust)
UDP buffer size: 208 KByte (default)
------------------------------------------------------------
[ 3] local 192.168.1.12 port 58045 connected with 192.168.1.105 port 5001
[ ID] Interval Transfer Bandwidth
[ 3] 0.0-10.0 sec 977 MBytes 820 Mbits/sec
[ 3] Sent 3414986 datagrams
[ 3] Server Report:
[ 3] 0.0-10.0 sec 811 MBytes 680 Mbits/sec 0.000 ms
581210/3414986 (0%)
Without BRIDGE_VLAN_FILTERING
iperf -u -c 192.168.1.105 -b 1G -l 300
------------------------------------------------------------
Client connecting to 192.168.1.105, UDP port 5001
Sending 300 byte datagrams, IPG target: 2.24 us (kalman adjust)
UDP buffer size: 208 KByte (default)
------------------------------------------------------------
[ 3] local 192.168.1.12 port 36645 connected with 192.168.1.105 port 5001
[ ID] Interval Transfer Bandwidth
[ 3] 0.0-10.0 sec 977 MBytes 820 Mbits/sec
[ 3] Sent 3414990 datagrams
[ 3] Server Report:
[ 3] 0.0-10.0 sec 836 MBytes 701 Mbits/sec 0.000 ms
493950/3414990 (0%)
In terms of kernel size, it uses 16KB (6753K vs 6737K on ER8) so a
0.002% hit. The exact 16KB is probably just due to how the kernel is
compressed.
Suggested-by: Jonathan Thibault <jonathan@navigue.com>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Specify the new "firmware" partition format for Netgear WNDR3700
and WNDR3700v2 similarly as ffd082aa did for WNDR3800, the third
device in the family.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
No single target/arch uses it and most likely there is no need to make
such a potential code target/arch specific.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
If "compatible" is being used that should trigger a proper parser
directly. It's more reliable thanks to not trying parsers one by one. In
such case partition shouldn't be split automatically to avoid parsing it
twice.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Currently, the b53 MDIO switch driver registers the switch on
config-init and not on device probe. Because of this, the switch
gets added every time the associated interface comes up.
This commit fixes this behavior by registering the switch on device
probe.
Compile- and run-tested on OCEDO Koala.
Signed-off-by: David Bauer <mail@david-bauer.net>
It's more reliable as mtd subsystem doesn't have to blindly try that
parser. It allows disabling MTD_SPLIT_FIRMWARE completely (TRX is
handled in a similar way).
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
It makes more sense to add run_parsers_by_type() in a patch that
introduces parser types. That makes the other one just add a code using
it.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
There was a bug in ubifs related to the O_TMPFILE. When reapplying
changes after power cut data could be lost. This problem was exposed by
overlayfs and the upstream commit 3a1e819b4e80 ("ovl: store file handle
of lower inode on copy up").
This fixes a regression introduced when switching from 4.9 to 4.14.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
It has been rejected upstream and instead a nice/more generic solution
has been implemented. It's possible now to describe partitions format
using "compatible" DT string.
No OpenWrt target uses "linux,part-probe" anymore, leave it only in case
some forks need it. It will be dropped with support for new kernels.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
as indicated in commit c5bf408ed6 "(ramips: fix image generation for mt76x8")
more rework was needed to fix the other issues.
Building on another machine, but using the same arch, showed
the application failing again for different reasons.
Fix this by completely rewriting the application, fixing following found issues:
- buffer overflows, resulting in stack corruption
- flaws in memory requirement calculations (too small, too large)
- memory leaks
- missing bounds checking on string handling
- non-reproducable images, by using unitilized memory in checksum calculation
- missing error handling, resulting in succes on specific image errors
- endianness errors when building on BE machines
- various minor build warnings
- documentation did not match the code actions (header item locations)
- allowing input to be decimal, hex or octal now
Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
Following errors were seen in the past on imx6 when using serial:
[ 22.617622] imx-uart 2020000.serial: DMA transaction error.
[ 22.623228] imx-uart 2020000.serial: DMA transaction error.
[ 22.628826] imx-uart 2020000.serial: DMA transaction error.
[ 22.648951] imx-uart 2020000.serial: DMA transaction error.
[ 22.654558] imx-uart 2020000.serial: DMA transaction error.
[ 22.660156] imx-uart 2020000.serial: DMA transaction error.
Which is the reason why DMA for the serial ports
got disabled in commits:
efb362cd93 ("imx6: disable dma on uart")
3b4241071d ("imx6: disable UART dma")
As indicated on mailinglist discussion, the cause seems to be
the usage of very old SDMA firmware which is present in the soc:
[ 0.624302] imx-sdma 20ec000.sdma: Direct firmware load for imx/sdma/sdma-imx6q.bin failed with error -2
[ 0.624318] imx-sdma 20ec000.sdma: Falling back to user helper
[ 64.531607] imx-sdma 20ec000.sdma: external firmware not found, using ROM firmware
This patch adds the new firmware binary. (2196 bytes)
It is required to embed the binary into the kernel image, as it
gets loaded very early in the boot process where the rootfs is not
available yet:
[ 0.622966] imx-sdma 20ec000.sdma: loaded firmware 3.3
Extended testing shows that the DMA errors are not seen anymore
when using this newer firmware version.
Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
The bump to kernel 4.14 caused a massive increase in kernel size.
For most targets, switching them to dynamic partitioning allowed
to cope with this.
On some targets, the kernel partition is located behind the rootfs,
which disallows switching to dynamic partitioning as the boot location
would be altered, requiring a u-boot change.
Also within the tiny section, which disables kernel symbols etc
to decrease the image size, the partition size is still too small.
Disable these targets for now, fixing image generation:
- Buffalo BHR-4GRV2
- Zbtlink ZBT-WE1526
Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
