TP-Link Archer C7 v4 is a dual-band AC1750 router, based on Qualcomm/Atheros
QCA9561+QCA9888.
Specification:
- 775/650/258 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 3T3R 5 GHz
- 5x 10/100/1000 Mbps Ethernet
- 7x LED, 2x button
- UART header on PCB
Flash instruction:
1. Upload lede-ar71xx-generic-archer-c7-v4-squashfs-factory.bin via Web interface
Flash instruction using TFTP recovery:
1. Set PC to fixed ip address 192.168.0.66
2. Download lede-ar71xx-generic-archer-c7-v4-squashfs-factory.bin
and rename it to ArcherC7v4_tp_recovery.bin
3. Start a tftp server with the file tp_recovery.bin in its root directory
4. Turn off the router
5. Press and hold Reset button
6. Turn on router with the reset button pressed and wait ~15 seconds
7. Release the reset button and after a short time
the firmware should be transferred from the tftp server
8. Wait ~30 second to complete recovery.
Flash instruction under U-Boot, using UART:
1. tftp 0x81000000 lede-ar71xx-...-sysupgrade.bin
2. erase 0x9f040000 +$filesize
3. cp.b $fileaddr 0x9f040000 $filesize
4. reset
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Specifications:
- SoC: Qualcomm QCA9558 (720 MHz)
- RAM: 256MB
- Storage: 1MB NOR, 128 MB NAND flash
- Ethernet: 1x1000M
Installation:
1. Connect to serial console on the board
2. Boot initramfs image over u-boot
3. Copy image to the device and run sysupgrade
Installation without serial console is not supported at this time
Signed-off-by: Felix Fietkau <nbd@nbd.name>
This reverts commit 13e5e47369.
This commit causes a severe regression in LAN->WAN routing performance
for several devices. This appears to be caused by the extra requirement
to validate the SKB checksum early in the rx path, which the ethernet
hardware does not do
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Specifications:
- SoC: Qualcomm QCA9531 (650MHz)
- RAM: 64MB
- Storage: 16MB NOR SPI flash
- Ethernet: 5x100M (1 PoE in, 4 PoE out)
- Outdoor use ready
This ethernet router is based on the same platform as the hEX PoE lite.
Installation
1. login to the Mikrotik WebUI to backup your licence keys
2. setup a DHCP/BOOTP Server with:
* DHCP-Option 66 (TFTP server name) pointing to a local TFTP
Server within the same subnet of the DHCP range
* DHCP-Option 67 (Bootfile-Name) matching the initramfs filename
of the to be booted image
3. connect the port labled internet to your local network
4. keep the reset button pushed down and power on the board
The board should load and start the initramfs image from the TFTP
Server. Login as root/without password to the started LEDE via ssh
listing on IPv4 address 192.168.1.1. Use sysupgrade to install LEDE.
Revert to RouterOS
Use the "rbcfg" package on in LEDE:
* rbcfg set boot_protocol bootp
* rbcfg set boot_device ethnand
* rbcfg apply
Open Netinstall and reboot routerboard. Now netinstall sees routerboard
and you can install RouterOS. If NetInstall gets stuck on Sending offer
just wait for it to timeout and then close and open Netinstall again.
Click on install again.
In order for RouterOS to function properly, you need to restore license
for the device. You can do that by including license in NetInstall
Signed-off-by: Robert Marko <robimarko@gmail.com>
This add support for kernel 4.9 to the ar71xx target.
It was compile tested with the generic, NAND and mikrotik subtarget.
Multiple members of the community tested it on their boards and did not
report any major problem so far.
Especially the NAND part received some changes to adapt to the new
kernel APIs. The serial driver hack used for the Arduino Yun was not
ported because the kernel changed there a lot.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
A default rssileds config exists for the TP-Link WA850RE v1 but the
rssiled package is not included by default.
The compressed 17.01.3 image size increases by 3302 bytes which should
be tolerable even for a 4MB flash board.
Fixes: FS#1043
Signed-off-by: Mathias Kresin <dev@kresin.me>
Evaluation board 2.2 uses a different status LED pin
The other removed LEDs were never present
Signed-off-by: Catrinel Catrinescu <cc@80211.de>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Handle AR9344 as well. Disable the EHCI platform device when device mode
is active, to avoid resource conflicts.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
Booting from jffs2 directly is no longer supported, use
rootfstype=squashfs consistently for all subtargets
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The addresses were read from the 'config' partition, which would not always
contain the addresses at the same offsets, depending on the stock firmware
version used before flashing LEDE. Change this to get the addresses from
the 'product-info' partition, which is read-only.
Reported-and-tested-by: Andreas Ziegler <ml@andreas-ziegler.de>
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
On a TL-WN710N, this patch increases iperf performance from ~92.5 to ~93.5 mbps. Keep in mind the WN710N is a 100mbps device. I expect greater numbers from gigabit devices.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
This adds metadata to wpj344 and wpj558 images to prevent loading
firmware of wpj344 into wpj558 and vice versa. This until now was
possible and break the units and had to be recovered from the uboot.
Signed-off-by: Enrique Giraldo <enrique.giraldo@galgus.net>
COMFAST CF-E355AC is a ceiling mount AP with PoE support, based on
Qualcomm/Atheros QCA9531 + QCA9882.
Short specification:
- 2x 10/100 Mbps Ethernet, with PoE support
- 64MB of RAM (DDR2)
- 16 MB of FLASH
- 2T2R 2.4 GHz, 802.11b/g/n
- 2T2R 5 GHz, 802.11ac/n/a
- built-in 4x 3 dBi antennas
- output power (max): 500 mW (27 dBm)
- 1x RGB LED, 1x button
- built-in watchdog chipset
Flash instruction:
Original firmware is based on OpenWrt.
Use sysupgrade image directly in vendor GUI.
Signed-off-by: Enrique Giraldo <enrique.giraldo@galgus.net>
[whitespace fixes, ac radio caldata offset fix]
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
GL.iNet GL-USB150 is an USB dongle WiFi router, based on Atheros AR9331.
Specification:
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- Realtek RTL8152B USB to Ethernet bridge (connected with AR9331 PHY4)
- 1T1R 2.4 GHz
- 2x LED, 1x button
- UART header on PCB
Flash instruction:
Vendor firmware is based on OpenWrt CC. GUI or sysupgrade can be used
to flash LEDE firmware.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
The WAN port on the Netgear WNDR4300 router has two LEDs,
amber and green. Use the switch LED trigger to behave as the
rest of the LAN HW controlled LEDs
- Green: 1 Gbps
- Amber: 100/10 Mbps
Signed-off-by: Daniel Gonzalez Cabanelas <dgcbueu@gmail.com>
1. Add support to LAN/WAN LEDs attached to ar8327.
2. Fix the problem that LAN/WAN LEDs does not blink in hardware (auto)
mode when connected to 10M/100M ethernet.
Signed-off-by: Kuang Rufan <master@a1983.com.cn>
This patch fixes the switch port numbering on Mikrotik RB750r2 (hEX lite) and RB750UPr2 (hEX PoE lite).
Tested on a RB750UPr2. Maybe this patch is applicable to other devices (e.g. RB951Ui-2nD, RB952Ui-5ac2nD) but I have no way to test them.
Signed-off-by: João Chaínho <joaochainho@gmail.com>
We will need "mktplinkfw-combined" command also in the "ramips" target
for new MediaTek based TP-Link devices, with "safeloader" image type.
Also, rename the command to "tplink-v1-header", use "VERSION_DIST"
variable instead of "OpenWrt" and allow passing additional parameters.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
We use combined option in "mktplinkfw" tool for generating initramfs
kernel images and header for kernel inside "safeloader" image type (in
fact, only for TL-WR1043ND v4 at this moment).
There is also "mktplinkfw-kernel" tool, a stripped-down version, used
only for generating "simple" header, for safeloader image types.
This changes how "mktplinkfw" handles combined images (which then will
allow us to drop the stripped-down version of the tool):
- drop "ignore size" command line option (it was used only for combined
images anyway)
- don't require "flash layout id" for combined images (we don't need and
shouldn't limit size of the initramfs kernel and for kernels inside
safeloader images, the "tplink-safeloader" tool does the size check)
- require kernel address and entry point in command line parameters for
combined images (consequence of previous point)
- don't include md5 sum and firmware length values in header (they are
needed only for update from vendor GUI and are ingored in case of
initramfs and "tplink-safeloader" images)
- drop "fake" flash layout for TL-WR1043ND v4 as it's no longer needed
Also, adjust "mktplinkfw-combined" command in ar71xx/image/tp-link.mk to
match introduced changes in "mktplinkfw" tool.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
ALFA Network AP121F is a pocket-size router dedicated for VPN/TOR users.
Device is based on Atheros AR9331 WiSoC and is running a custom version
(updated from OpenWrt CC to LEDE 17.01 release) of NetAidKit firmware.
Specification:
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR1)
- 16 MB of FLASH (SPI NOR)
- 1x 10/100 Mbps Ethernet
- 1T1R 2.4 GHz
- 1x microSD (optional, on separate PCB)
- 3x LED, 1x button, 1x switch
- UART header on PCB
Flash instruction (under U-Boot web recovery mode):
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with RJ45 port, press the reset button, power up device,
wait for first blink of all LEDs (indicates network setup), then keep
button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
The Power LED of RB912UAG-{2,5}HPnD boards can be controlled by sofware,
so use it for diag purposes and make the User LED free for other tasks.
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
It is quite unexpected behaviour when the Power LED switches off as soon
as the kernel starts booting. So set the default state to 'Keep' for
the Power LEDs of all RouterBOARDs (e.g. RB91x, SXT Lite series, etc.).
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
[switch the default state to keep instead of on]
Signed-off-by: Mathias Kresin <dev@kresin.me>
Do not parse /tmp/sysinfo/board_name, /proc/cpuinfo or the device tree
compatible string directly. Always use the board_name function to get
the board name.
The admswconfig package still reads /proc/cpuinfo directly. The code
looks somehow broken and the whole adm5120 which uses this package
looks unmaintained. Leave it as it is for now.
Signed-off-by: Mathias Kresin <dev@kresin.me>
For targets using the generic board detection and board specific
settings in diag.sh, the board name is still unset at the time the
set_state() provided by diag.sh is called by 10_indicate_preinit.
Change the execution order to ensure the boardname is populated before
required the first time. Do the target specific board detection as
early as possible, directly followed by the generic one to allow a
seamless switch to the generic function for populating /tmp/sysinfo/.
Signed-off-by: Mathias Kresin <dev@kresin.me>
Non-US versions of the TP-Link TL-WR710N v1 don't have a region code so
far, so we can just set US unconditionally.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Depending on busybox applet selection, paths of basic utiilties may differ,
and may not work as symlinks to busybox. Simply using whatever binary is
found in PATH and detecting symlinks automatically is more robust and
easier to maintain.
The list of binaries is also slightly cleaned up and duplicates are
removed.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
TP-Link TL-WR902AC has another one, tiny LED inside RJ45 socket which is
attached to GPIO15. Add support for it, use it as a "lan" LED and rename
old one to "internet". Also, fix uci option name for "lan" LED in system
configuration ("wan" -> "lan").
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Until we enable requirement for metadata in sysupgrade images under
ar71xx target, this prevents users from using wrong image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This commit adds metadata to TP-Link sysupgrade images
created by tplink-safeloader with uImage kernel header.
Signed-off-by: Henryk Heisig <hyniu@o2.pl>
Rename TPLINK_BOARD_NAME to TPLINK_BOARD_ID for two ommited devices.
Fixes: 7d6c63d ("build: rename TPLINK_BOARD_NAME to TPLINK_BOARD_ID")
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
TP-Link TL-WR902AC v1 is a pocket-size, dual-band (AC750), successor of
TL-MR3020 (both devices use very similar enclosure, in same size). New
device is based on Qualcomm QCA9531 v2 + QCA9887. FCC ID: TE7WR902AC.
Specification:
- 650/391/216 MHz (CPU/DDR/AHB)
- 1x 10/100 Mbps Ethernet
- 1x USB 2.0 (GPIO-controlled power)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH
- 2T2R 2.4 GHz (QCA9531)
- 1T1R 5 GHz (QCA9887)
- 5x LED (GPIO-controlled), 2x button, 1x 3-pos switch
- UART pads on PCB (TP1 -> TX, TP2 -> RX, TP3 -> GND, TP4 -> 3V3, jumper
resitors are missing on TX/RX lines)
- 1x micro USB (for power only)
Flash instructions:
Use "factory" image under vendor GUI.
Recovery instructions:
This device contains tftp recovery mode inside U-Boot. You can use it to
flash LEDE (use "factory" image) or vendor firmware.
1. Configure PC with static IP 192.168.0.66/24 and tftp server.
2. Rename "lede-ar71xx-generic-tl-wr902ac-v1-squashfs-factory.bin"
to "wr902acv1_un_tp_recovery.bin" and place it in tftp server dir.
3. Connect PC with LAN port, press the reset button, power up the router
and keep button pressed until WPS LED lights up.
4. Router will download file from server, write it to flash and reboot.
Root access over serial line in vendor firmware: root/sohoadmin.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
We can use "tplink-fw" mtd splitter for TP-Link devices which use kernel
with TP-Link header embedded inside "safeloader" image type and thus get
rid of statically defined "kernel" and "rootfs" partitions in cmdline.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Refresh mikrotik subtarget kernel config and enable kernel support for
boards which belong to this subtarget only.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Refresh nand subtarget kernel config and enable kernel support for
boards which belong to this subtarget only.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Refresh target kernel config and disable kernel support for all boards
which belong to nand and mikrotik subtargets only.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Commit 9fec39a (ar71xx: add support for TP-Link TL-WA855RE v1) introduced a
typo in 02_network, fix it by removing the stray paren.
Reported-by: Henryk Heisig <hyniu@o2.pl>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
TPLINK_HWID hasn't been specified for TP-Link RE450 since the begin.
As we don't want to break sysupgrade (all existing LEDE release images
for this board have TPLINK_HWID set to 0x0), set it explicitly to 0x0.
Fixes FS#852
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
TP-Link Archer C58 v1 is a dual-band AC1350 router, based on Qualcomm
QCA9561 + QCA9886. It looks like Archer C59 v1 without USB port.
Specification:
- 775/650/258 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 2T2R 5 GHz
- 5x 10/100 Mbps Ethernet
- 6x LED, 3x button
- UART header on PCB, RX, TX at TP4+5 (backside)
QCA9886 wlan needs pre_cal_data file and enable ieee80211 phy hotplug to
patch macaddress.
Flash instruction:
Use "factory" image directly in vendor GUI.
Recovery method:
1. Set PC to fixed ip address 192.168.0.66/24.
2. Download "lede-ar71xx-generic-archer-c58-v1-squashfs-factory.bin" and
rename it to "tp_recovery.bin".
3. Start a tftp server with the file "tp_recovery.bin" in its root
directory.
4. Turn off the router.
5. Press and hold Reset button.
6. Turn on router with the reset button pressed and wait ~15 seconds.
7. Release the reset button and after a short time the firmware should
be transferred from the tftp server.
8. Wait ~30 second to complete recovery.
Flash instruction under U-Boot, using UART:
tftp 0x81000000 lede-ar71xx-...-sysupgrade.bin
erase 0x9f020000 +$filesize
cp.b $fileaddr 0x9f020000 $filesize
reset
This commit is based on GitHub PR#1112
Signed-off-by: Henryk Heisig <hyniu@o2.pl>
TP-Link TL-WA855RE v1 is a wall-plug N300 Wi-Fi range extender,
based on Qualcomm/Atheros QCA9533 v2.
Short specification:
- 550/397/198 MHz (CPU/DDR/AHB)
- 1x 10/100 Mbps Ethernet
- 32 MB of RAM (DDR1)
- 4 MB of FLASH
- 2T2R 2.4 GHz
- 2x external antennas
- 2x LED (green and orange in the same package), 2x button
- UART: TP5(TX) and TP4(RX) test points on PCB
Flash instruction: use "factory" image directly in vendor GUI.
Warning: this device does not include any kind of recovery mechanism
in the bootloader and disassembling process is not trivial.
You can access vendor firmware over serial line using:
- login: root
- password: sohoadmin
Image was tested only in EU version of the device, but should work
also with the same device version sold in other countries.
Signed-off-by: Federico Cappon <dududede371@gmail.com>
Use statically defined sizes for kernel and rootfs mtd partitions.
Vendor upgrade script writes both firmware parts independently which
ends up in a gap between kernel and rootfs images. This results in
incorrectly calculated rootfs_data start offset.
Also, fix IMAGE_SIZE, DEVICE_PACKAGES and drop redundant KERNEL
definition.
Fixes FS#835
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Migrate Arduino Yun from legacy to generic building code.
Note: the mtd partitioning is changed to adopt the LEDE default
partitioning. It allows to have a kernel bigger than 1280k. It is
necessary as kernel > 4.4 with default LEDE configuration grows
bigger.
To use the new partitioning, you need to update your U-Boot env in
advance:
setenv mtdparts "spi0.0:256k(u-boot)ro,64k(u-boot-env),15936k(firmware),64k(nvram),64k(art)ro"
setenv bootcmd "run addboard; run addtty; run addparts; run addrootfs; bootm 0x9f050000 || bootm 0x9fea0000"
saveenv
Signed-off-by: Camille Bilodeau <camille.bilodeau@protonmail.com>
This way, the assigned addresses match those on the barcode labels.
Otherwise, the addresses appear to vary on boot.
Signed-off-by: Leon M. George <leon@georgemail.eu>
Use --mtime when SOURCE_DATE_EPOCH is set.
Use gzip -n9z instead of tar z to remove
timestamp in gzip header.
Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
Specifications:
* SoC: AR7242 (Virian 400MHz)
* RAM: 64 MB DDR (W9751G6JB-25)
* Flash: 16MB SPI flash (S25FL129PIF)
* WiFi: AR9382 (2.4/5GHz) + 2x SE2595L
* LAN: 1x1000M (PEF7071V)
To install LEDE via EVA bootloader, a FTP connection need to be
established to 192.168.178.1 within the first seconds after power on:
ftp> quote USER adam2
ftp> quote PASS adam2
ftp> binary
ftp> debug
ftp> passive
ftp> quote MEDIA FLSH
ftp> put lede-ar71xx-generic-fritz300e-squashfs-sysupgrade.bin mtd1
Signed-off-by: Mathias Kresin <dev@kresin.me>
Add upstream send AR724x PCIe patches to get the PCIe controller out of
reset during driver init.
The AVM Fritz 300E bootloader doesn't take care of releasing the
different PCIe controller related resets which causes an endless hang
as soon as either the PCIE Reset register (0x180f0018) or the PCI
Application Control register (0x180f0000) is read from.
Signed-off-by: Mathias Kresin <dev@kresin.me>
All TP-Link TL-WR710N versions share the same machine code.
This has been working since the beginning as we don't use double-quotes
to protect spaces inside command line values. Thus, kernel interprets
'board=TL-WR710N v2' as 'board=TL-WR710N' and separate parameter 'v2'.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Keep TP-Link devices definitions in alphabetical order whenever it's
possible. Also group together similar devices or devices from the same
series.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
TP-Link TL-WR942N v1 is a 2.4 GHz single-band N450 router, based on
Qualcomm/Atheros QCA9561.
Specification:
- 775/650/258 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x USB 2.0
- 11x LED (most are controlled by 74HC595)
- 2x button
- UART header on PCB*
* Serial console is disabled in OEM non-beta firmwares and corresponding
GPIO pins 14 and 15 are assigned to control USB1 and USB2 LEDs by
production (non-beta) U-Boot and firmware.
Currently not working:
1. USB1 and USB2 LEDs if UART RX and TX pins are assigned to their GPIOs
by some U-Boot versions.
Flash instruction under vendor GUI:
1. Download "lede-ar71xx-generic-tl-wr942n-v1-squashfs-factory.bin".
2. Go to WEB interface and perform usual firmware upgrade.
FLash instruction under U-Boot recovery mode (doesn't work in beta
firmware):
1. Setup PC with static IP "192.168.0.66/24" and tftp server.
2. Change "*-factory" image filename to "WR942v1_recovery.bin" and make
it available to download from your tftp server.
3. Press "reset" button and power up the router, wait till "WPS" LED
turns on.
Flash instruction under U-Boot, using UART (can be done only with
preinstalled UART-enabled U-Boot version!):
1. Use "tpl" to stop autobooting and obtain U-Boot CLI access.
2. Setup ip addresses for U-Boot and your tftp server.
3. Issue below commands:
tftp 0x81000000 lede-ar71xx-generic-tl-wr942n-v1-sysupgrade.bin
erase 0x9f020000 +$filesize
cp.b 0x81000000 0x9f020000 $filesize
reset
Signed-off-by: Serg Studzinskii <serguzhg@gmail.com>
[minor code style fixes, extended commit message]
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Use "GL.iNet" as vendor name (based on information from the vendor, this
is registered name of the company) and align model names with official
website.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Most of the custom Build/* functions in ar71xx target are rarely used by
image building code for devices from more than one subtarget. As they
don't need to be always included, move them to corresponding *.mk files.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
ag71xx_ethtool_set_ringparam() will return an uninitialized value on
success.
Found-by: Coverity Scan #1330877
Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
Fixes the following security vulnerabilities:
CVE-2017-8890
The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the
Linux kernel through 4.10.15 allows attackers to cause a denial of service
(double free) or possibly have unspecified other impact by leveraging use
of the accept system call.
CVE-2017-9074
The IPv6 fragmentation implementation in the Linux kernel through 4.11.1
does not consider that the nexthdr field may be associated with an invalid
option, which allows local users to cause a denial of service (out-of-bounds
read and BUG) or possibly have unspecified other impact via crafted socket
and send system calls.
CVE-2017-9075
The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel
through 4.11.1 mishandles inheritance, which allows local users to cause a
denial of service or possibly have unspecified other impact via crafted
system calls, a related issue to CVE-2017-8890.
CVE-2017-9076
The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux
kernel through 4.11.1 mishandles inheritance, which allows local users to
cause a denial of service or possibly have unspecified other impact via
crafted system calls, a related issue to CVE-2017-8890.
CVE-2017-9077
The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel
through 4.11.1 mishandles inheritance, which allows local users to cause a
denial of service or possibly have unspecified other impact via crafted
system calls, a related issue to CVE-2017-8890.
CVE-2017-9242
The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel
through 4.11.3 is too late in checking whether an overwrite of an skb data
structure may occur, which allows local users to cause a denial of service
(system crash) via crafted system calls.
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8890
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9074
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9075
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9076
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9077
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9242
Ref: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.71
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
If nand chip has no NAND_NO_SUBPAGE_WRITE flag on its options
ubifs can't use it mtd devices and the kernel crashes with error:
__nand_correct_data: uncorrectable ECC error
Signed-off-by: Sergey Sergeev <adron@yapic.net>
This fixes wrong GPIO numbers for LEDs and button in Wallys DR344 board
and sets color of all LEDs to green as the mass production boards have
only green one.
Actually, DR344 has 6 GPIO-connected LEDs and one button:
- GPIO11: status
- GPIO12: sig1
- GPIO13: sig2
- GPIO14: sig3
- GPIO15: sig4
- GPIO16: reset button
- GPIO17: lan
WAN LED is connected directly with AR8035 PHY.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This aligns default network interfaces configuration with vendor
firmware: GE (eth0) -> wan, FE (eth1) -> lan.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
GMAC0 interface of AR9344 SOC in Wallys DR344 board is connected with
AR8035, not with AR8327. Without this fix, GE interface doesn't work at
all or shows high packet loss ratio.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
EnGenius ENS202EXT is an outdoor wireless access point with
2-port 10/100 switch, detachable antennas and proprietery PoE.
The device is based on Qualcomm/Atheros AR9341 v1.
Specifications:
- 535/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM
- 16 MB of FLASH
- UART (J1) header on PCB (unpopulated)
- 2x 10/100 Mbps Ethernet
- 2.4 GHz, up to 26dBm
- 2x external, detachable antennas
- 7x LED, 1x button
Flash instructions:
You have three options:
- Use the vendor firmware upgrade page on the web interface and give
it the factory.img. This is the easiest way to go about it.
- If you have serial access during u-boot, interrupt the normal boot
(any key before timeout) and run 'run failsafe_boot'; this will bring
you to a minimal openwrt luci image on ip 192.168.1.1 useful if you've
bricked the normal firmware.
- Use the vendor's management cli, which can be accessed via telnet
with the same credentials as the web login (default admin:admin), then
issue the following commands:
*** Hi admin, welcome to use cli(V-1.6.7) ***
---========= Commands Help =========---
stat -- Status
sys -- System
wless2 -- 2.4G-Wireless
mgmt -- Management
tree -- Tree
help -- Help
reboot -- Reboot
ens202ext>mgmt
Management
---========= Commands Help =========---
admin -- Administration
mvlan -- Management VLAN settings
snmp -- SNMP settings
backup -- Backup/Restore settings
autorb -- Auto reboot settings
fwgrade -- Firmware upgrade
time -- Time settings
wifisch -- Wifi schedule
log -- Log
diag -- Diagnostics
disc -- Device Discovery
logout -- Logout
help -- Help
exit -- Exit
ens202ext/mgmt>fwgrade
Management --> Firmware upgrade
---========= Commands Help =========---
fwup -- Firmware upgrade
help -- Help
exit -- Exit
ens202ext/mgmt/fwgrade>fwup http://web.server/lede-ar71xx-generic-ens202ext-squashfs-factory.bin
Signed-off-by: Marty Plummer <ntzrmtthihu777@gmail.com>
You can flash via tftp recovery (serve factory image as /mr6400_tp_recovery.bin
on 192.168.0.66/24, connect to any ethernet port and power on device while
holding the reset button). Flashing via OEM web interface does not work.
Hardware Specification (v1.0 EU):
- SoC: QCA9531
- Flash: Winbond W25Q64FV (8MiB)
- RAM: EtronTech EM6AB160TSE-5G (64MiB)
- Wireless: SoC platform only (2.4GHz b/g/n, 2x internal antenna)
- Ethernet: 2NIC (3x100M + 1x100M)
- WWAN: TP-LINK LTE MODULE (2x external detachable antenna)
- Power: DC 12V 1A
Signed-off-by: Filip Moc <lede@moc6.cz>
This change is required to make the GBit switch work on my Mikrotik Routerboard RB2011UiAS-RM, and I assume that the other RB2011 variants are exactly the same in terms of the switch. I have tested the board without and with the patch and confirm that the GBit ports are not supported at all (i.e. no communication works) with the current version in trunk and that everything works with the patch applied. The test box has been running for a few days with the patch applied, and does not show any performance problems in a test setting. I have not used it with LEDE in production so far, but with a previous turnk version of OpenWRT for many years - with the same patch applied. I therefore have good indication that it is stable.
For the record, the switch chip on my test box is identified as
switch0: Atheros AR8327 rev. 4 switch registered on ag71xx-mdio.0
The value 0x6f000000 has been taken from the table at https://wiki.openwrt.org/toh/mikrotik/rb2011uias with the previous discussion thread still online at https://lists.openwrt.org/pipermail/openwrt-devel/2014-December/029949.html.
One definite improvement from the older OpenWRT trunk version I have been running in production and current LEDE trunk is that the SFP interface can be kept in the default configuration without excessive kernel messages about it constantly going up and down. I have not yet tested an actual SFP module, though.
Performance seems to be reasonable. Routing between two GBit ports on that switch separated by different VLANs with the default firewall ruleset (and one additional rule two allow traffic between the VLANs), but without NAT, iperf3 results are:
[ ID] Interval Transfer Bandwidth Retr
[ 4] 0.00-10.00 sec 508 MBytes 426 Mbits/sec 102 sender
[ 4] 0.00-10.00 sec 506 MBytes 425 Mbits/sec receiver
With a connection going through NAT (also 2 ports on the same GBit switch, same ruleset, but NAT active), routing performance drops to around 250 MBit/s.
(Note that RouterOS achieves beyond 900 MBit/s on the same hardware with the default rule set and the FastTrack rule active even for NAT, see https://wiki.mikrotik.com/index.php?title=Manual:IP/Fasttrack and http://www.mikrotik.com/download/share/FastTrack.pdf).
Summarizing, I strongly recommend to apply this patch in trunk, so that the GBit switch chip rev. 4 can be supported upstream in the next LEDE release (hopefully soon).
Signed-off-by: René Mayrhofer <rene@mayrhofer.eu.org>
changes the image version from hardcoded OpenWrt to
$VERSION_DIST. AirOS shows a notification with the image version
during a firmware upgrade.
fixes#582
Signed-off-by: Matthias Fritzsche <txt.file@txtfile.eu>
Refresh patches. A number of patches have landed upstream & hence are no
longer required locally:
062-[1-6]-MIPS-* series
042-0004-mtd-bcm47xxpart-fix-parsing-first-block
Reintroduced lantiq/patches-4.4/0050-MIPS-Lantiq-Fix-cascaded-IRQ-setup
as it was incorrectly included upstream thus dropped from LEDE.
As it has now been reverted upstream it needs to be included again for
LEDE.
Run tested ar71xx Archer C7 v2 and lantiq.
Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
[update from 4.4.68 to 4.4.69]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Teltonika RUT900 is a Router with LTE dual SIM, WiFi, 4x Ethernet
ports, I/O, RS232, RS485, GPS.
The device ist based on a Atheros AR9344 rev 3,
Specifications:
- 560/450/225 MHz (CPU/DDR/AHB)
- 128 MB of RAM
- 16 MB of FLASH
- Serial Console header on a Card Board edge connector
- 4x 10/100 Mbps Ethernet (3x LAN, 1x WAN)
- 2.4 GHz Wifi
- 2x external, detachable Wifi antennas
- LTE Modem Huawei ME909u-521 (Also other Modem seen)
- 2x LTE antennas
- 1x GPS antenna
- 7x LED, 1x button
- 1x USB Connector
- 1x Serial RS232
- 1x Serial RS485
- 1x MicroSD Card
The GPL sources of the device are available at www.teltonika.lt/gpl/
and are based on OpenWRT Barrier Breaker (14.07)
Running from tftp:
The Router starts into the uboot Webupdater if the Button ist pressed
more than 3 seconds, if no Network cable is attached it starts the
uboot serial console, from there the router loads the firmware image
via tftpboot from 192.168.1.2:firmware.bin (the router has the
192.168.1.1). With bootm the loaded image will be booted.
Signed-off-by: Steffen Weinreich <steve@weinreich.org>
This adds support for Aerohive AP-121 access point.
Specification:
- SoC: Atheros AR9344-BC2A at 560MHz
- WiFi 1: 2.4GHz Atheros AR9340? - SoC
- WiFi 2: 5.0GHz Atheros AR9382-AL1A
- Memory: 128MB from 2x Nanya NT5TU32M16DG-AC
- SPI: 1MB Macronix MX25L8006E
- NAND: 128MB Hynix H27U1G8F2BTR-BC
- Ethernet: Atheros AR8035-A
- USB: 1x 2.0
- TPM: Atmel SC3204
Flashing:
1. Hook into UART (9600 baud) and enter U-Boot. You may need to enter
a password of administrator or AhNf?d@ta06 if prompted.
2. Once in U-Boot, download and flash LEDE factory image over tftp:
dhcp;
setenv serverip tftp-server-ip;
tftpboot 0x81000000 lede-ar71xx-nand-hiveap-121-squashfs-factory.bin;
nand erase 0x800000 0x800000;
nand write 0x81000000 0x800000 0x800000;
reset;
Signed-off-by: Chris Blake <chrisrblake93@gmail.com>
[minor text changes in commit subject and description, fixed
alphabetical order in etc/diag.sh, use only model name in lib/ar71xx.sh,
fixed code style issues in mach-hiveap-121.c, ubinized factory image]
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Rambutan is a Wifi module based on QCA9550/9557
http://www.8devices.com/products/rambutan
This commit adds basic support for Rambutan development kit
Specification:
- 720/600/200 MHz (CPU/DDR/AHB)
- 128 MB of DDR2 RAM
- 128 MB of NAND Flash
- 1x 100Mbps Ethernet
- 1x 1000Mbps Ethernet (PHY on dev-kit)
- 1x Wifi radio 2x2 MIMO, dualband 2.4 and 5 GHz
- 2x U.FL connectors on module, chip antennas on dev-kit
- 1x miniPCIe slot
- 1x USB2.0 host socket + 1x USB2.0 pins on 2.54mm header
Flash instructions:
Stock firmware is OpenWrt, so use:
sysupgrade -n /tmp/lede-ar71xx-nand-rambutan-squashfs-sysupgrade.tar
or upgarde from GUI (don't save config)
Use factory image to flash from U-Boot:
tftpboot 80060000 lede-ar71xx-nand-rambutan-squashfs-factory.ubi
nand erase.part ubi
nand write 80060000 ubi ${filesize}
Signed-off-by: Mantas Pucka <mantas@8devices.com>
[split support in uboot-envtools package into a separate commit,
fixed alphabetical order in lib/preinit/05_set_iface_mac_ar71xx]
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This adds the build option for the new UniFi AC Mesh.
It is a direct hardware copy from the AC Lite.
- SoC: QCA9563-AL3A (775Mhz)
- RAM: 128MiB
- Flash: 16MiB - dual firmware partitions!
- LAN: 1 1000M - POE
- Wireless:
2.4G: QCA9563
5G: UniFi Chip, QCA988X compatible
Thanks to Frank Dietz for testing.
Signed-off-by: Ludwig Thomeczek <ledesrc@wxorx.net>
[wrapped too long lines in mach-ubnt-unifiac.c]
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This fixes switch port mapping for: TL-WR841N/ND v8, TL-MR3420 v2 and
TL-WR941N/ND v5. All of them share the same Atheros ap123 reference
design.
The order of switch ports (shown in "swconfig dev eth1 show") is CPU,
LAN 4, LAN 1, LAN 2, LAN 3.
Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>
[included 2 more devices]
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
The patch 523-MIPS-ath79-OTP-support only supports the OTP offsets for
AR933x chips, which has changed on newer platforms such as the AR934x.
The follwoing change is to add support for reading the OTP on the
AR934x. Tested on an Aerohive AP-121.
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: Chris Blake <chrisrblake93@gmail.com>
Fix a '==' that should be a '=' in a test condition. Busybox fortunately
doesn't care.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Since 192f0a3db8 ("ath9k: unset the default LED pin if used by
platform leds") the default ath9k wireless LED is not set as soon as
any pin of the ath ath9k gpio controller is used.
All touched boards have leds defined which are using the gpio pins
exposed by the ath9k driver but rely on a default set wireless led
trigger.
Add the wireless leds were missing and setup the wireless phy trigger
in userspace.
Signed-off-by: Russell Senior <russell@personaltelco.net>
Signed-off-by: Mathias Kresin <dev@kresin.me>
Instead of renaming the default wireless led attached to the wireless
chip, add a new led using the platform leds with the phy0tpt trigger
set in userspace.
When switching ar71xx to device tree, the same can be done by using the
build in GPIO controller and without adding new bindings.
Drop the now unused platform code.
Signed-off-by: Mathias Kresin <dev@kresin.me>
There are currently several supported TP-Link devices without specified
version number in image name and/or DEVICE_TITLE (e.g. WBS210, WBS510,
TL-WR810N, TL-WA7510N, TL-WPA8630), but vendor website shows that there
are already more than one version of them on the market.
For devices like Archer C5, which second version is based on a total
different platform, missing version number in DEVICE_TITLE (used in
menuconfig) might be misleading for users.
To make it less confusing for users and easier to maintain in future,
include version number in image name and DEVICE_TITLE for all TP-Link
devices, even if there is only one version of device at the moment.
Also, keep DEVICE_TITLE in same format for all TP-Link devices.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Acked-by: John Crispin <john@phrozen.org>
Kernel/hardware support for this board has been implemented since
Chaos Calmer. This set of patches is to get the board identified in
userland. This will allow support for things like sysupgrade,
configuring initial LED state, configuring initial switch state, etc.
Signed-off-by: Ron Angeles <ronangeles@gmail.com>
This router has the same hardware as TP-LINK TL-WR841N/ND v11 (same FCC
ID, same TFTP image name...).
If the stock firmware web interface doesn't accept LEDE factory image,
it can be flashed via the U-Boot TFTP recovery mode, by long-pressing
the reset button after power on.
The TFTP image name is wr841nv11_tp_recovery.bin (yes, v11, not v12).
Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>
Specification:
- SoC: Qualcomm Atheros QCA9563 (775 MHz, MIPS 74Kc)
- RAM: 128 MiB
- Storage: 16MB NOR flash
- Wireless: Built into QCA9563 (Dragonfly), PHY modes b/g/n, 3x3 MIMO
- Ethernet: 2x1G
Tested and working:
- ethernet / switch / lan / wan
- 2.4GHz SoC wifi
- PCIe
- leds
- buzzer
Ramload:
- tftpboot 0x84000000 lede-ar71xx-generic-wpj563-16M-initramfs-uImage.bin
- bootm 0x84000000
Install:
- tftpboot 0x80500000 lede-ar71xx-generic-wpj563-16M-squashfs-sysupgrade.bin
- erase 0x9f030000 +$filesize
- erase 0x9f680000 +1
- cp.b $fileaddr 0x9f030000 $filesize
Erasing 0x9f680000 is required because uboot defines
"bootcmd=bootm 0x9f680000 || bootm 0x9f030000", so it first tries to boot
the higher address. I think the 16 mb flash are intended to be used as
8+8mb for a fallback image. In my hardware only the lower address has a
bootable image. But to make sure future hardware will boot lede too, I
erase one block, so uboot will skip this address.
Signed-off-by: Christian Mehlis <christian@m3hlis.de>
P&W (full name: Shenzhen Progress&Win Technologies) R602N (could be also
labeled as R602F, R602, etc.) is a simple N300 router with 5-port
10/100 Mbps switch, non-detachable antennas and USB.
CPE505 is an outdoor CPE with PoE support and detachable antennas.
Both devices are based on Qualcomm/Atheros QCA9531 v2.
Common specification:
- 650/597/216 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of FLASH
- UART (J2) header on PCB
R602N specification:
- 5x 10/100 Mbps Ethernet
- 1x USB 2.0
- 2T2R 2.4 GHz with external LNA and PA (SE2576L), up to 28 dBm
- 2x external, non-detachable antennas
- 7x LED, 1x button
CPE505N specification:
- 2x 10/100 Mbps Ethernet (both ports support passive PoE 12-24 V)
- 2T2R 2.4 GHz with external LNA and PA (SKY65174-21), up to 30 dBm
- 2x external, detachable antennas (RP-SMA connectors)
- 1x RGB LED, 2x LEDs (in RJ45 sockets), 1x button
Flash instructions:
It seems that there are many different versions of the firmware which
these devices are shipped with. The generic/standard one is based on
some modified OpenWrt and LEDE firmware can be flashed directly from
vendor's webgui or with sysupgrade (root password is "admin123").
Before flashing, make sure (use "fw_printenv") that the kernel load
address in your device is set to "0x9f050000" (bootcmd variable is
"bootm 0x9f050000"). If your device uses different load address, you
should first change it, under vendor's firmware, with command:
fw_setenv bootcmd "bootm 0x9f050000 || bootm OLD_ADDRESS"
Where OLD_ADDRESS is previous kernel load address (in CPE505 version
I got access to, it was "0x9fe80000"). This will allow you to use
both the vendor's and LEDE firmware.
If version of your device contains empty U-Boot environment (you will
get information about this after issuing "fw_printenv"), you should
use U-Boot, serial line access and TFTP to perform firmware upgrade:
1. tftp 0x80060000 lede-ar71xx-generic-...-squashfs-sysupgrade.bin
2. erase 0x9f050000 +$filesize
3. cp.b $fileaddr 0x9f050000 $filesize
4. setenv bootcmd "bootm 0x9f050000 || bootm OLD_ADDRESS"
5. saveenv && reset
These devices contain also web recovery mode inside U-Boot. It can be
started with pressing the reset button for around 3 seconds just after
the device powerup. Web recovery panel is available on "192.168.10.9"
and to be able to use it, IP on your PC must be set to "192.168.10.10".
Make sure to change kernel load address before using recovery mode or
the U-Boot will not be able to load LEDE firmware.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This patch adds initial support for the MikroTik RouterBOARD hAP ac
(RB962UiGS-5HacT2HnT).
All functions are supported except:
-SFP cage (eth1) is not working
-WLAN LEDs are not working
Signed-off-by: Ryan Mounce <ryan@mounce.com.au>
This patch adds support for the MikroTik RouterBOARD hAP ac lite
(RB952Ui-5ac2nD).
The hAP ac lite is nearly identical to the hAP, with an added QCA9887
5GHz radio. The 2.4GHz radio ID is also changed in the hAP ac lite.
Signed-off-by: Ryan Mounce <ryan@mounce.com.au>
When the device name doesn't already contain "RouterBOARD", this patch adds
this string to the machine name.
Most NOR devices already have "RouterBOARD" in their hardware-stored device name,
but not all of them.
This patch also makes the code more robust against buffer overflows.
Signed-off-by: Thibaut VARENE <hacks@slashdirt.org>
The Netgear WNDR4300, equipped with an Atheros AR8327 Gigabit Switch,
has two LEDs on each port for monitoring LAN activity, but it currently
only uses one. Fix the configuration to use both.
The patch provides this new configuration:
- green LED: 1 Gbps link, 4Hz blink frequency
- amber LED: 10/100 Mbps link. 4Hz for 100Mbps, 2Hz for 10Mbps
Signed-off-by: Daniel Gonzalez Cabanelas <dgcbueu@gmail.com>
At now there is no general rule about what part of (or whole) machine
name string should be used for board name assignment/detection and every
target handles this in a different way.
For most of the boards in ar71xx we already use only part of the string,
generally without the vendor name.
This shortens wildcards patterns in case statement for board name
assignment, wherever possible (e.g. where it won't be misleading).
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Be consistent and always use double quotes for case statement patterns,
as in other targets. With this approach it should be less confusing for
users adding support for new devices.
Also, be consistent with MikroTik boards wildcard pattern.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
