TP-Link Archer C59v2 is a dual-band AC1350 router based on
Qualcomm/Atheros QCA9561+QCA9886 chips.
Specification:
- 775/650/258 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 2T2R 5 GHz
- 5x 10/100 Mbps Ethernet
- USB 2.0 port
- UART header on PCB
Flash instruction:
- via web UI:
1. Download openwrt-ar71xx-generic-archer-c59-v2-squashfs-factory.bin
2. Login to router and open the Advanced tab
3. Navigate to System Tools -> Firmware Upgrade
4. Upload firmware using the Manual Upgrade form
- via TFTP:
1. Set PC to fixed ip address 192.168.0.66
2. Download openwrt-ar71xx-generic-archer-c59-v2-squashfs-factory.bin
and rename it to tp_recovery.bin
3. Start a tftp server with the file tp_recovery.bin in its root directory
4. Turn off the router
5. Press and hold Reset button
6. Turn on router with the reset button pressed and wait ~15 seconds
7. Release the reset button and after a short time
the firmware should be transferred from the tftp server
8. Wait ~30 second to complete recovery.
Signed-off-by: Keith Maika <keithm@aoeex.com>
Qxwlan E750G v8 is based on Qualcomm QCA9344.
Specification:
- 560/450/225 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 2T2R 2.4G GHz (AR9344)
- 2x 10/100 Mbps Ethernet (PoE support)
- 2x 10/100/1000 Mbps Ethernet
- 7x LED (6 driven by GPIO)
- 1x button (reset)
- 1x DC jack for main power input (9-48 V)
- UART (J23) and LEDs (J2) headers on PCB
Flash instruction (using U-Boot CLI and tftp server):
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "sysupgrade" filename to "firmware.bin" and place it in tftp
server directory.
- Connect PC with one of RJ45 ports, power up the board and press
"enter" key to access U-Boot CLI.
- Use the following command to update the device to OpenWrt: "run lfw".
Flash instruction (using U-Boot web-based recovery):
- Configure PC with static IP 192.168.1.xxx(2-254)/24.
- Connect PC with one of RJ45 ports, press the reset button, power up
the board and keep button pressed for around 6-7 seconds, until LEDs
start flashing.
- Open your browser and enter 192.168.1.1, select "sysupgrade" image
and click the upgrade button.
Signed-off-by: 张鹏 <sd20@qxwlan.com>
Qxwlan E750A v4 is based on Qualcomm QCA9344.
Specification:
- 560/450/225 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 2T2R 5G GHz (AR9344)
- 2x 10/100 Mbps Ethernet (one port with PoE support)
- 1x miniPCIe slot (USB 2.0 bus only)
- 7x LED (6 driven by GPIO)
- 1x button (reset)
- 1x DC jack for main power input (9-48 V)
- UART (J23) and LEDs (J2) headers on PCB
Flash instruction (using U-Boot CLI and tftp server):
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "sysupgrade" filename to "firmware.bin" and place it in tftp
server directory.
- Connect PC with one of RJ45 ports, power up the board and press
"enter" key to access U-Boot CLI.
- Use the following command to update the device to OpenWrt: "run lfw".
Flash instruction (using U-Boot web-based recovery):
- Configure PC with static IP 192.168.1.xxx(2-254)/24.
- Connect PC with one of RJ45 ports, press the reset button, power up
the board and keep button pressed for around 6-7 seconds, until LEDs
start flashing.
- Open your browser and enter 192.168.1.1, select "sysupgrade" image
and click the upgrade button.
Signed-off-by: 张鹏 <sd20@qxwlan.com>
Qxwlan E558 v2 is based on Qualcomm QCA9558 + AR8327.
Specification:
- 720/600/200 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 2T2R 2.4 GHz (QCA9558)
- 3x 10/100/1000 Mbps Ethernet (one port with PoE support)
- 4x miniPCIe slot (USB 2.0 bus only)
- 1x microSIM slot
- 5x LED (4 driven by GPIO)
- 1x button (reset)
- 1x 3-pos switch
- 1x DC jack for main power input (9-48 V)
- UART (JP5) and LEDs (J8) headers on PCB
Flash instruction (using U-Boot CLI and tftp server):
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "sysupgrade" filename to "firmware.bin" and place it in tftp
server directory.
- Connect PC with one of RJ45 ports, power up the board and press
"enter" key to access U-Boot CLI.
- Use the following command to update the device to OpenWrt: "run lfw".
Flash instruction (using U-Boot web-based recovery):
- Configure PC with static IP 192.168.1.xxx(2-254)/24.
- Connect PC with one of RJ45 ports, press the reset button, power up
the board and keep button pressed for around 6-7 seconds, until LEDs
start flashing.
- Open your browser and enter 192.168.1.1, select "sysupgrade" image
and click the upgrade button.
Signed-off-by: 张鹏 <sd20@qxwlan.com>
Only build images for straight OpenWrt (using all flash; wipes out
partitions that contain information only important for accessing a
now defunct cloud service with the stock firmware) since the stock
firmware is now irrelevant.
Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>
The Skydog cloud service no longer exists hence supporting going back
to stock firmware with cloud support is no longer applicable.
Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>
F9K1115v2 has a kernel partition size of 1408 kB.
Since kernel 4.9.x+ the kernel image for this device compiled had exceeded
the kernel partition size limit and thus failing size check.
The kernel image generated for this device
under ar71xx tiny target is 1329.67 kB < 1408 kB.
Signed-off-by: Kin Chan <kcchan1@outlook.com>
This patch adds support for the MikroTik RB931-2nD (hAP mini):
https://mikrotik.com/product/RB931-2nD
Specifications:
* SoC: Qualcomm QCA9533 (650MHz)
* RAM: 32MiB
* Storage: 16MiB SPI NOR flash
* Ethernet: 3x100M
* Wireless: QCA9533 built-in, dual-chain 802.11b/g/n
Installation:
1. Setup a DHCP/BOOTP Server with the following parameters:
* DHCP-Option 66 (TFTP server name): pointing to a local TFTP
server within the same subnet of the DHCP range
* DHCP-Option 67 (Bootfile-Name): matching the initramfs filename
of the to be booted image. The usable intramfs files are:
- openwrt-ar71xx-mikrotik-vmlinux-initramfs.elf
- openwrt-ar71xx-mikrotik-vmlinux-initramfs-lzma.elf
- openwrt-ar71xx-mikrotik-rb-nor-flash-16M-initramfs-kernel.bin
2. Press the reset button on the board and keep that pressed.
3. Connect the board to your local network via its Internet port.
4. Release the button after the LEDs on the board are turned off.
Now the board should load and start the initramfs image from
the TFTP server.
5. Now connect the board via either of its LAN ports (2 or 3).
6. Upload the sysupgrade image to the board with scp:
$ scp openwrt-ar71xx-mikrotik-rb-nor-flash-16M-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/fw.bin
7. Log in to the running system listening on 192.168.1.1 via ssh
as root (without password):
$ ssh root@192.168.1.1
8. Flash the uploaded firmware file from the ssh session via the
sysupgrade command:
root@OpenWrt:~# sysupgrade /tmp/fw.bin
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
Move boards to the tiny subtarget which break the build if the kernel is
set to "Optimize for performance".
Signed-off-by: Mathias Kresin <dev@kresin.me>
Add a template for safeloader images and include it instead of
overwriting variables defined in the common tp-link build commands.
Split the existing tp-link templates to proper implement the safeloader
template.
Signed-off-by: Mathias Kresin <dev@kresin.me>
Drop the LOADER_TYPE variables in case no loader is used at all or move
the variable to devices which are using a loader.
Signed-off-by: Mathias Kresin <dev@kresin.me>
Use the provided image build variables to point the kernel-bin build
command to the kernel we are interested in.
Signed-off-by: Mathias Kresin <dev@kresin.me>
Use the LOADER_TYPE variable to specify that we need the elf preloader
and append the loader via the corresponding build recipe. It allows to
enable initramfs images again for mikrotik NAND images, which caused a
build error before.
Add the minor header only to the kernel of the sysupgrade images, as it
is only required for the bootloader to find the kernel on flash.
Signed-off-by: Mathias Kresin <dev@kresin.me>
Use the new dynamic partition split in tplink-safeloader so we no longer
have to worry about kernel size increases.
Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>
This PR adds support for a popular low-cost 2.4GHz N based AP
Specifications:
- SoC: Qualcomm Atheros QCA9533 (650MHz)
- RAM: 64MB
- Storage: 8 MB SPI NOR
- Wireless: 2.4GHz N based built into SoC 2x2
- Ethernet: 1x 100/10 Mbps, integrated into SoC, 24V POE IN
Installation:
Flash factory image through stock firmware WEB UI
or through TFTP
To get to TFTP recovery just hold reset button while powering on for
around 4-5 seconds and release.
Rename factory image to recovery.bin
Stock TFTP server IP:192.168.0.100
Stock device TFTP adress:192.168.0.254
Notes:
TP-Link does not use bootstrap registers so without this patch reference
clock detects as 40MHz while it is actually 25MHz.
This is due to messed up bootstrap resistor configuration on the PCB.
Provided GPL code just forces 25MHz reference clock.
That causes booting with completely wrong clocks, for example, CPU tries
to boot at 1040MHz while the stock is 650MHz.
So this PR depends on PR #672 to remove 40MHz reference clock.
Thanks to Sven Eckelmann <sven@narfation.org> for properly patching that.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
TP-Link Archer C7 v5 is a dual-band AC1750 router, based on Qualcomm/Atheros
QCA9563+QCA9880.
Specification:
- 750/400/250 MHz (CPU/DDR/AHB
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 3T3R 5 GHz
- 5x 10/100/1000 Mbps Ethernet
- 10x LED, 2x button
- UART header on PCB
Flash instruction:
1. Upload lede-ar71xx-generic-archer-c7-v5-squashfs-factory.bin via Web interface
Flash instruction using TFTP recovery:
1. Set PC to fixed ip address 192.168.0.66
2. Download lede-ar71xx-generic-archer-c7-v5-squashfs-factory.bin
and rename it to ArcherC7v5_tp_recovery.bin
3. Start a tftp server with the file tp_recovery.bin in its root directory
4. Turn off the router
5. Press and hold Reset button
6. Turn on router with the reset button pressed and wait ~15 seconds
7. Release the reset button and after a short time
the firmware should be transferred from the tftp server
8. Wait ~30 second to complete recovery.
Signed-off-by: Arvid E. Picciani <aep@exys.org>
This commit adds support for the Mikrotik wAP R (RBwAPR-2nD). The change
is based on 3b15eb0 which added support for the wAP 2nD. This change lacks
LED support.
Specifications:
- SoC: Qualcomm QCA9531 (650 MHz)
- RAM: 64 MB
- Storage: 16 MB NOR SPI flash
- Wireless: built-in QCA9531, 802.11b/g/n 2x2:2
- Ethernet: 1x100Mbps
- Power: 9-30V Passive PoE, 9-30V DC jack, 9-30V automotive jack
- SIM card slot
- Mini-PCIe slot
Installation:
1. Login to the Mikrotik WebUI to backup your licence key
2. Change the following settings in System->Routerboard->Settings:
- Boot device: try ethernet once then NAND
- Boot protocol: DHCP
- Force Backup Booter: checked
3. Setup a DHCP/BOOTP server with:
- DHCP-Option 66 (TFTP server name) pointing to a local TFTP
server within the same subnet of the DHCP range
- DHCP-Option 67 (Bootfile-Name) matching the initramfs filename
of the to be booted image, e.g.
openwrt-ar71xx-mikrotik-vmlinux-initramfs.elf
4. Power off the device
5. If this is the second attempt to boot OpenWRT or the boot device isn't
"try ethernet once then NAND," press and hold the reset button while
powered off. If this is the first attempt, this step isn't necessary.
6. Power on the device, holding the reset button for 15-20s if already
pressed from the previous step.
The board should load and start the initramfs image from the TFTP
server. Login as root/without password to the started OpenWRT via SSH
listing on IPv4 address 192.168.1.1. Use sysupgrade to install OpenWRT.
Revert to RouterOS
Use the "rbcfg" package on in OpenWRT:
- rbcfg set boot_protocol bootp
- rbcfg set boot_device ethnand
- rbcfg apply
Open Netinstall and reboot routerboard. Now Netinstall sees RouterBOARD
and you can install RouterOS. If NetInstall gets stuck on Sending offer
just wait for it to timeout and then close and open Netinstall again.
Click on install again.
In order for RouterOS to function properly, you need to restore license
for the device. You can do that by including license in NetInstall.
Signed-off-by: David Ehrmann <ehrmann@gmail.com>
This commit adds support for the AVM Fritz!WLAN Repeater 450E
SOC: Qualcomm QCA9556 (Scorpion) 560MHz MIPS74Kc
RAM: 64MB Zentel A3R12E40CBF DDR2
FLASH: 16MiB Winbond W25Q128 SPI NOR
WLAN1: QCA9556 2.4 GHz 802.11b/g/n 3x3
INPUT: WPS button
LED: Power, WiFi, LAN, RSSI indicator
Serial: Header Next to Black metal shield
Pinout is 3.3V - RX - TX - GND (Square Pad is 3.3V)
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet
- 2.4GHz WiFi (correct MAC)
- Installation via EVA bootloader
- OpenWRT sysupgrade
- Buttons
- Most LEDs
Not working:
- 2 RSSI LEDs
AVM used for RSSI{0,1} two of the Ethernet PHYs LEDs which they
control over MDIO. Our driver doesn't expose these LEDs as GPIOs.
While it is possible to implement this feature, it would require an
additional kernel patch for a minor functionality.
Installation via EVA:
In the first seconds after Power is connected, the bootloader will
listen for FTP connections on 192.168.178.1. Firmware can be uploaded
like following:
ftp> quote USER adam2
ftp> quote PASS adam2
ftp> binary
ftp> debug
ftp> passive
ftp> quote MEDIA FLSH
ftp> put openwrt-sysupgrade.bin mtd1
Note that this procedure might take up to two minutes.
You need to powercycle the Device afterwards to boot OpenWRT.
Signed-off-by: David Bauer <mail@david-bauer.net>
The AVM package selection partially broke with the addition of the
FRITZ!Box 4020. This commit restores the intended behavior.
Signed-off-by: David Bauer <mail@david-bauer.net>
This commit adds support for the OCEDO Koala
SOC: Qualcomm QCA9558 (Scorpion)
RAM: 128MB
FLASH: 16MiB
WLAN1: QCA9558 2.4 GHz 802.11bgn 3x3
WLAN2: QCA9880 5 GHz 802.11nac 3x3
INPUT: RESET button
LED: Power, LAN, WiFi 2.4, WiFi 5, SYS
Serial: Header Next to Black metal shield
Pinout is 3.3V - GND - TX - RX (Arrow Pad is 3.3V)
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet
- 2.4 GHz WiFi
- 5 GHz WiFi
- TFTP boot from ramdisk image
- Installation via ramdisk image
- OpenWRT sysupgrade
- Buttons
- LEDs
Installation seems to be possible only through booting an OpenWRT
ramdisk image.
Hold down the reset button while powering on the device. It will load a
ramdisk image named 'koala-uImage-initramfs-lzma.bin' from 192.168.100.8.
Note: depending on the present software, the device might also try to
pull a file called 'koala-uimage-factory'. Only the name differs, it
is still used as a ramdisk image.
Wait for the ramdisk image to boot. OpenWRT can be written to the flash
via sysupgrade or mtd.
Due to the flip-flop bootloader which we not (yet) support, you need to
set the partition the bootloader is selecting. It is possible from the
initramfs image with
> fw_setenv bootcmd run bootcmd_1
Afterwards you can reboot the device.
Signed-off-by: David Bauer <mail@david-bauer.net>
We recently increased the kernel partition size of the CPE/WBS 210/510.
This works fine for new installations of the factory image, but on
sysupgrades, the partition table read by the bootloader is not adjusted.
This limits the maximum size of the kernel loaded by the bootloader to the
old partition size.
While adjusting the partition table would be a cleanest solution, such a
migration would have to happen before an upgrade to a new version with a
newer kernel. This is error-prone and would require a two-step upgrade, as
we mark the partition table partition read-only.
Instead, switch from the lzma-loader with embedded kernel to the
okli-loader, so only the tiny lzma-loader is loaded by the bootloader as
"kernel", and the lzma-loader will then load the rest of the kernel by
itself.
Fixes: e39847ea2f ("ar71xx: increase kernel partition size for CPE/WBS 210/510")
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
By making the kernel argv array const, the .data section can always be
omitted from the laoder binary.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
The text section in the ELF loader is aligned to the maximum page size,
which defaults to 64KB. Reduce it to the actual page size to avoid wasting
flash space for this alignment.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Some devices (TP-Link TL-WR1043ND v1) don't boot reliably when the
uncompressed loader is too small. This was workarounded in the loader by
adding 512KB of padding to the .data section of the loader binary.
This approach had two issues:
- The padding was only working when .data was non-empty (otherwise the
section would become NOBITS, omitting it in the binary). .data was only
empty when no CMDLINE was set, leading to further workarounds like
fe594bf90d ("ath79: fix loader-okli, lzma-loader"), and this
workaround was only effective because a missing "const" led to the kernel
argv being stored in .data instead of .rodata
- The padding was not only added to the compressed .gz loader, but also
uncompressed .bin and .elf loaders. The prevented embedding the kernel
cmdline in the loader for non-gz loader types.
To fix both issues, move the creation of the padding from the linker script
to the gzip step.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
PISEN TS-D084 is an wireless router with a battery and integrated power supply based on Atheros AR9331.
Specification:
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH (SPI NOR)
- 1x 10/100 Mbps Ethernet
- 1T1R 2.4 GHz (AR9331)
- 1x USB 2.0
Flash instruction:
The manufacturer are using exactly the same firmware header as TP-LINK TL-WR703N (including device ID!). Simply upload the factory firmware into WebUI and flashing is done.
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
Using a version number of 16 character causes a buffer overflow in the
version number overwriting the first bit of the signature in the
mkdapimg2 tool.
I am not sure if the version number should be null terminated or not.
This patch reduces the size of the version number by removing the number
of private commits from it.
This was the original version number which caused problems:
OpenWrt-r6727+10
Now it uses this version number:
OpenWrt-r6727
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for the AVM Fritz!Box 4020 WiFi-router.
SoC: Qualcomm Atheros QCA9561 (Dragonfly) 750MHz
RAM: Winbond W971GG6KB-25
FLASH: Macronix MX25L12835F
WiFi: QCA9561 b/g/n 3x3 450Mbit/s
USB: 1x USB 2.0
IN: WPS button, WiFi button
OUT: Power LED green, Internet LED green, WLAN LED green,
LAN LED green, INFO LED green, INFO LED red
UART: Header Next to Black metal shield
Pinout is 3.3V - RX - TX - GND (Square Pad is 3.3V)
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet (LAN + WAN)
- WiFi (correct MAC)
- Installation via EVA bootloader
- OpenWRT sysupgrade
- Buttons
- LEDs
Not working:
- USB port
Installation via EVA:
In the first seconds after Power is connected, the bootloader will
listen for FTP connections on 169.254.157.1 (Might also be 192.168.178.1). Firmware can be uploaded
like following:
ftp> quote USER adam2
ftp> quote PASS adam2
ftp> binary
ftp> debug
ftp> passive
ftp> quote MEDIA FLSH
ftp> put openwrt-sysupgrade.bin mtd1
Note that this procedure might take up to two minutes. After transfer is
complete you need to powercycle the device to boot OpenWRT.
Signed-off-by: David Bauer <mail@david-bauer.net>
Some Ubiquiti U-boot versions, in particular the "U-Boot 1.1.4.2-s956
(Jun 10 2015 - 10:54:50)" found with AirOS 5.6, do not correctly flush the
caches for the whole kernel address range after decompressing the kernel
image, leading to hard to debug boot failures, depending on kernel version
and configuration.
As a workaround, prepend the relocate-kernels loader, which will invalidate
the caches after moving the kernel to the correct load address.
Reported-by: Andreas Ziegler <dev@andreas-ziegler.de>
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
TP-Link Archer C60 v2 is a dual-band AC1350 router, based on
Qualcomm/Atheros QCA9561 + QCA9886.
Specification:
- 775/650/258 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 2T2R 5 GHz
- 5x 10/100 Mbps Ethernet
- 7x LED, 2x button
- UART header on PCB
Flash instruction (web):
Download lede-ar71xx-generic-archer-c60-v2-squashfs-factory.bin and use
OEM System Tools - Firmware Upgrade site.
Flash instruction (recovery):
1. Set PC to fixed IP address 192.168.0.66
2. Download lede-ar71xx-generic-archer-c60-v2-squashfs-factory.bin and
rename it to tp_recovery.bin
3. Start a tftp server with the file tp_recovery.bin in its root
directory
4. Turn off the router
5. Press and hold reset button
6. Turn on router with the reset button pressed and wait ~15 seconds
7. Release the reset button and after a short time the firmware should
be transferred from the tftp server
8. Wait ~30 second to complete recovery
Flash instruction (under U-Boot, using UART):
tftp 0x81000000 lede-ar71xx-...-sysupgrade.bin
erase 0x9f030000 +$filesize
cp.b $fileaddr 0x9f030000 $filesize
reset
Signed-off-by: Henryk Heisig <hyniu@o2.pl>
Add support for TL-WR940N v6 board. It is pretty much the same as v5
except they only left WAN LED and removed other ones.
Installation: flash factory image through WEB UI or use TFTP.
Signed-off-by: Robert Marko <robimarko@gmail.com>
D-Link DAP-1330 rev. A1 is a wall-plug N300 Wi-Fi range extender,
based on Qualcomm/Atheros QCA9533 v2.
Short specification:
- 650/393/216 MHz (CPU/DDR/AHB)
- 1x 10/100 Mbps Ethernet
- 64 MB of RAM (DDR1)
- 8 MB of FLASH
- 2T2R 2.4 GHz
- 2x external antennas
- 6x LED (2 are bi-color), 2x button
- 4 pin on pcb (looking from eth port and from left to right tx,rx,gnd,vcc)
Flash instruction: use "factory" image directly in vendor GUI.
This device has a recovery system that assign the ip addr of env
variable "serverip" via dhcp to a pc, and the "ipaddr" value to itself.
The recovery it's triggered by a not bootable firmware,
or pressing the reset button during the bootloader startup (first 30 seconds).
The recovery uses a http page to restore the firmware, and it's checking
the firmware image header, so use the "factory" image to
restore or the original firmware.
You can access vendor firmware over serial using:
- login: root
- password: linuxrocks
Image was tested only in EU version of the device, but should work
also with the same device version sold in other countries.
Signed-off-by: Nicolò Veronese <nicveronese@gmail.com>
GainStrong Oolite V5.2 is a small (39.5 x 78 mm), dual-band system on
module, based on Qualcomm QCA9531 + QCA9887. All QCA9531 SOC GPIOs are
available on castellated pins.
Specification:
- 650/400/200 MHz (CPU/DDR/AHB)
- 64/128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 5x 10/100 Mbps Ethernet (all ports available on castellated pins)
- 2T2R 2.4 GHz (QCA9531), with ext. PA and LNA
- 1T1R 5 GHz (QCA9887) with ext. FEM (SKY85710-11)
- 3x U.FL
- 1x USB 2.0
The dedicated development board includes 5 FE ports, USB 2.0 port, two
buttons (one directly connected to SOC reset input), header with all
GPIOs and several LEDs.
Flash instruction:
Vendor firmware is based on OpenWrt. LuCI or sysupgrade can be used to
flash OpenWrt firmware.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
- combine support for Oolite/MiniBox V1.0 in single mach-*.c file
- fix model/board names
- include correct/full vendor name
- drop redundant package and factory image
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This adds support for AR9331 based Hak5 penetration testing tools:
- WiFi Pineapple NANO
- LAN Turtle
- Packet Squirrel
WiFi Pineapple NANO specifications:
- SoC: Atheros AR9331 (400 MHz)
- RAM: 64 MB (DDR2)
- FLASH: 16 MB
- WiFi: 1T1R AR9331 (built-in), 1T1R AR9271 (built-in via USB bus)
- Ethernet: 1x FE over USB (ASIX AX88772A)
- Ports: 2x RP-SMA for antennas, 1x USB 2.0 (host), 1x micro SD
- Power: USB 5 V, 1.5 A
- Other: status LED, reset button
LAN Turtle specifications:
- SoC: Atheros AR9331 (400 MHz)
- RAM: 64 MB (DDR2)
- FLASH: 16 MB
- WiFi: none
- Ethernet: 1x FE (AR9331), 1x FE over USB (Realtek RTL8152B)
- Ports: 1x RJ45, version dependent: micro SD or 3G SIM slot
- Power: USB 5 V, 0.5 A
- Other: status LED, reset button (inside, on PCB)
Packet Squirrel specifications:
- SoC: Atheros AR9331 (400 MHz)
- RAM: 64 MB (DDR2)
- FLASH: 16 MB
- WiFi: none
- Ethernet: 2x FE (AR9331)
- Ports: 2x RJ45, 1x USB 2.0
- Power: USB 5 V, 0.12 A
- Other: status LED, reset button, 4-way switch
Flash instructions for all 3 devices:
Original firmware is based on OpenWrt.
Use sysupgrade via SSH to flash.
Signed-off-by: Sebastian Kinne <contact@sebkinne.com>
[squashed commits, combined and reworked mach files, aligned board
naming with general convention, fixed minor issues, tested on real
hardware, reworded commit subject and description]
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Vendor released new model (AP80Q) which is identical from hardware point
of view with already supported AP90Q. Include AP80Q in machine name.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
YunCore T830 is a simple N300 router with 5-port FE switch, detachable
antennas and USB 2.0 port.
Specification:
- 650/597/216 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 5x 10/100 Mbps Ethernet
- 2T2R 2.4 GHz (QCA9531), with ext. PA (SKY65174-21) and LNA
- two external, detachable antennas (RP-SMA)
- 1x USB 2.0
- 8x LED (7 driven by GPIO)
- 1x button (reset)
- DC jack for main power input (12 V)
- UART and JTAG headers on PCB
Flash instruction:
1. First, gain root access to the device, following below steps:
- Login into web gui (default password/IP: admin/192.168.188.253).
- Go to "Advanced" -> "Management" -> "System" and download backup of
configuration (bakfile.bin).
- Open the file as tar.gz archive, edit/update "shadow" file and change
hash of root password to something known.
- Repack the archive, rename it back to "bakfile.bin" and use to
restore configuration of the device.
- After that, device will reboot and can be accessed over SSH.
2. Then, install OpenWrt:
- Login over SSH and issue command:
fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
- Upload "sysupgrade" image and install it (only if previous command
succeeded) with command: "sysupgrade -n -F openwrt-...".
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Samsung WAM250 is a dual-band (selectable, not simultaneous) wireless
hub, dedicated for Samsung Shape Wireless Audio System. The device is
based on Atheros AR9344. FCC ID: A3LWAM250.
Specification:
- 560/450/225 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 2x 10/100 Mbps Ethernet
- 2T2R 2.4/5 GHz (AR9344), with ext. PA (SE2598L, SE5003L) and LNA
- 1x USB 2.0
- 4x LED (all are driven by GPIO)
- 2x button (reset, wps/speaker add)
- DC jack for main power input (14 V)
- UART header on PCB (J4, RX: 3, TX: 5)
Flash instruction:
This device uses dual-image (switched between upgrades) with a common
jffs2 config partition. Fortunately, there is a way to disable this mode
so that more flash space can be used by OpenWrt image.
You can easily access this device over telnet, using root/root
credentials (the same also work for serial console access).
1. Make sure that your device uses second (bootpart=2) image using
command: "fw_printenv bootpart".
2. If your device uses first image (bootpart=1), perform upgrade to the
latest vendor firmware (after the update, device should boot from
second partition) using web gui (default login: admin/1234567890).
3. Rename "sysupgrade" image to "firmware.bin", download it (you can use
wget, tftp or ftpget) to "/tmp" and issue below commands:
mtd_debug erase /dev/mtd3 0 $(wc -c /tmp/firmware.bin | awk -F' ' '{print $1}')
mtd_debug write /dev/mtd3 0 $(wc -c /tmp/firmware.bin)
fw_setenv bootpart
fw_setenv bootcmd "bootm 0x9f070000"
reboot
Revert to vendor firmware instruction:
1. Download vendor firmware to "/tmp" device and issue below commands:
fw_setenv bootpart 1
sysupgrade -n -F SS_BHUB_v2.2.05.bin
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
COMFAST CF-E385AC is an AC2200 ceiling mount AP with PoE support, based
on Qualcomm/Atheros QCA9558 + QCA9984 + QCA8337N.
Specification:
- 720/600/200 MHz (CPU/DDR/AHB)
- 256 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 2x 10/100/1000 Mbps Ethernet, with PoE support
- 3T3R 2.4 GHz (QCA9558), with external LNA and PA (SE2576L)
- 4T4R 5 GHz (QCA9984), with external FEM (SKY85728-11)
- 7x internal antennas
- 1x RGB LED (driven by GPIO)
- 1x button (reset)
- UART, LEDs/GPIO and USB headers on PCB
- external watchdog (Pericon Technology PT7A7514)
Flash instruction:
Original firmware is based on OpenWrt.
Use sysupgrade image directly in vendor GUI.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
There are now supported two versions of the CF-E355AC board which differ
in 802.11ac radio chip. Include version number in board, model, image
filename, etc., also for the v1.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
