The GL-X300B is a industrial 4G LTE router based on the Qualcomm
QCA9531 SoC.
Specifications:
- Qualcomm QCA9531 @ 650 MHz
- 128 MB of RAM
- 16 MB of SPI NOR FLASH
- 2x 10/100 Mbps Ethernet
- 2.4GHz 802.11b/g/n
- 1x USB 2.0 (vbus driven by GPIO)
- 4x LED, driven by GPIO
- 1x button (reset)
- 1x mini pci-e slot (vcc driven by GPIO)
- RS-485 Serial Port (untested)
Flash instructions:
This firmware can be flashed using either sysupgrade from the GL.iNet
firmware or the recovery console as follows:
- Press and hold the reset button
- Connect power to the router, wait five seconds
- Manually configure 192.168.1.2/24 on your computer, connect to
192.168.1.1
- Upload the firmware image using the web interface
RS-485 serial port is untested and may depend on the following commit in
the GL.iNet repo:
202e83a32a
MAC addresses as verified by OEM firmware:
vendor OpenWrt address
WAN eth0 label
LAN eth1 label + 1
2g phy0 label + 2
The label MAC address was found in the art partition at 0x0
Based on vendor commit:
16c5708b20
Signed-off-by: John Marrett <johnf@zioncluster.ca>
In the current state, nvmem cells are only detected on platform device.
To quickly fix the problem, we register the affected problematic driver
with the of_platform but that is more an hack than a real solution.
Backport from net-next the required patch so that nvmem can work also
with non-platform devices and rework our current patch.
Drop the mediatek and dsa workaround and rework the ath10k patches.
Rework every driver that use the of_get_mac_address api.
Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
The LEDs for LAN1 and LAN3 were swapped. Link on port 1 would illuminate
the LED on port 3 and vice versa.
Signed-off-by: David Bauer <mail@david-bauer.net>
Without explicit configuration of these pins the ethernet as well as
status LED of the device do not work correctly.
Signed-off-by: David Bauer <mail@david-bauer.net>
Specifications:
* QCA9531, 16 MiB flash (Winbond W25Q128JVSQ), 128 MiB RAM
* 802.11n 2T2R (external antennas)
* QCA9887, 802.11ac 1T1R (connected with diplexer to one of the antennas)
* 3x 10/100 LAN, 1x 10/100 WAN
* UART header with pinout printed on PCB
Installation:
* The device comes with a bootloader installed only
* The bootloader offers DHCP and is reachable at http://10.123.123.1
* Accept the agreement and flash sysupgrade.bin
* Use Firefox if flashing does not work
TFTP recovery with static IP:
* Rename sysupgrade.bin to jt-or750i_firmware.bin
* Offer it via TFTP server at 192.168.0.66
* Keep the reset button pressed for 4 seconds after connecting power
TFTP recovery with dynamic IP:
* Rename sysupgrade.bin to jt-or750i_firmware.bin
* Offer it via TFTP server with a DHCP server running at the same address
* Keep the reset button pressed for 6 seconds after connecting power
Co-authored-by: Sebastian Schaper <openwrt@sebastianschaper.net>
Signed-off-by: Vincent Wiemann <vincent.wiemann@ironai.com>
A missing quote in target/linux/ath79/patches-5.x/920-mikrotik-rb4xx.patch
produces:
...
scripts/kconfig/conf --syncconfig Kconfig
drivers/mfd/Kconfig:2016:warning: multi-line strings not supported
...
This patch adds missing closing quote, fixing the above warning.
Signed-off-by: Paul Blazejowski <paulb@blazebox.homeip.net>
Define nvmem-cells and convert mtd-mac-address to nvmem implementation.
The conversion is done with an automated script.
Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
Rework patch 681-NET-add-mtd-mac-address-support to implement
only the function to read the mac-address from mtd.
Generalize mtd-mac-address-increment function so it can be applied
to any source of of_get_mac_address.
Rename any mtd-mac-address-increment to mac-address-increment.
Rename any mtd-mac-address-increment-byte to mac-address-increment-byte.
This should make simplify the conversion of target to nvmem implementation.
Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
sysupgrade metadata is not flashed to the device, so check-size
should be called _before_ adding metadata to the image.
While at it, do some obvious wrapping improvements.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Acked-by: Paul Spooren <mail@aparcar.org>
Looks like the symbol was forgotten for 5.4
Fixes: 820e660cd7 ("ath79: add NAND driver for MikroTik RB91xG series")
Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
The MX25L12805D used on all ath79 OCEDO boards supports clock
speeds up to 50 MHz.
Thus, we can increase the maximum SPI frequency the flash chip is
controlled at to 50 MHz, increasing transfer speed.
Signed-off-by: David Bauer <mail@david-bauer.net>
The M25P80 used on the Siemens WS-AP3610 supports clock speeds up to 54
MHz. Thus, we can safely increase the maximum SPI frequency the flash
chip is controlled at to 50 MHz, increasing transfer speed.
Signed-off-by: David Bauer <mail@david-bauer.net>
Device specifications
* SoC: QCA9563 @ 775MHz (MIPS 74Kc)
* RAM: 128MiB DDR2
* Flash: 16MiB SPI-NOR (EN25QH128)
* Wireless 2.4GHz (SoC): b/g/n, 3x3
* Wireless 5Ghz (QCA9988): a/n/ac, 4x4 MU-MIMO
* IoT Wireless 2.4GHz (QCA6006): currently unusable
* Ethernet (AR8327): 3 LAN × 1GbE, 1 WAN × 1GbE
* LEDs: Internet (blue/orange), System (blue/orange)
* Buttons: Reset
* UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1)
* Power: 12VDC, 1,5A
MAC addresses map (like in OEM firmware)
art@0x0 88:C3:97:*:57 wan/label
art@0x1002 88:C3:97:*:2D lan/wlan2g
art@0x5006 88:C3:97:*:2C wlan5g
Obtain SSH Access
1. Download and flash the firmware version 1.3.8 (China).
2. Login to the router web interface and get the value of `stok=` from the
URL
3. Open a new tab and go to the following URL (replace <STOK> with the stok
value gained above; line breaks are only for easier handling, please put
together all four lines into a single URL without any spaces):
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev
?bssid=any&user_id=any&ssid=-h%0Anvram%20set%20ssh_en%3D1%0Anvram%20commit
%0Ased%20-i%20%27s%2Fchannel%3D.%2A%2Fchannel%3D%5C%5C%22debug%5C%5C%22%2F
g%27%20%2Fetc%2Finit.d%2Fdropbear%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A
4. Wait 30-60 seconds (this is the time required to generate keys for the
SSH server on the router).
Create Full Backup
1. Obtain SSH Access.
2. Create backup of all flash (on router):
dd if=/dev/mtd0 of=/tmp/ALL.backup
3. Copy backup to PC (on PC):
scp root@192.168.31.1:/tmp/ALL.backup ./
Tip: backup of the original firmware, taken three times, increases the
chances of recovery :)
Calculate The Password
* Locally using shell (replace "12345/E0QM98765" with your router's serial
number):
On Linux
printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | \
md5sum - | head -c8 && echo
On macOS
printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | \
md5 | head -c8
* Locally using python script (replace "12345/E0QM98765" with your
router's serial number):
wget https://raw.githubusercontent.com/eisaev/ax3600-files/master/scripts/calc_passwd.py
python3.7 -c 'from calc_passwd import calc_passwd; print(calc_passwd("12345/E0QM98765"))'
* Online
https://www.oxygen7.cn/miwifi/
Debricking (lite)
If you have a healthy bootloader, you can use recovery via TFTP using
programs like TinyPXE on Windows or dnsmasq on Linux. To switch the router
to TFTP recovery mode, hold down the reset button, connect the power
supply, and release the button after about 10 seconds. The router must be
connected directly to the PC via the LAN port.
Debricking
You will need a full dump of your flash, a CH341 programmer, and a clip
for in-circuit programming.
Install OpenWRT
1. Obtain SSH Access.
2. Create script (on router):
echo '#!/bin/sh' > /tmp/flash_fw.sh
echo >> /tmp/flash_fw.sh
echo '. /bin/boardupgrade.sh' >> /tmp/flash_fw.sh
echo >> /tmp/flash_fw.sh
echo 'board_prepare_upgrade' >> /tmp/flash_fw.sh
echo 'mtd erase rootfs_data' >> /tmp/flash_fw.sh
echo 'mtd write /tmp/openwrt.bin firmware' >> /tmp/flash_fw.sh
echo 'sleep 3' >> /tmp/flash_fw.sh
echo 'reboot' >> /tmp/flash_fw.sh
echo >> /tmp/flash_fw.sh
chmod +x /tmp/flash_fw.sh
3. Copy `openwrt-ath79-generic-xiaomi_aiot-ac2350-squashfs-sysupgrade.bin`
to the router (on PC):
scp openwrt-ath79-generic-xiaomi_aiot-ac2350-squashfs-sysupgrade.bin \
root@192.168.31.1:/tmp/openwrt.bin
4. Flash OpenWRT (on router):
/bin/ash /tmp/flash_fw.sh &
5. SSH connection will be interrupted - this is normal.
6. Wait for the indicator to turn blue.
Signed-off-by: Evgeniy Isaev <isaev.evgeniy@gmail.com>
[improve commit message formatting slightly]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Specifications:
SOC: Qualcomm Atheros TP9343 (750 MHz)
Flash: 8 Mb (GigaDevice GD25Q64CSIG)
RAM: 64 Mb (Zentel A3R12E40DBF-8E)
Serial: yes, 4-pin header
Wlan: Qualcomm Atheros TP9343, antenna: MIM0 3x3:3 RP-SMA
3 x 2.4GHz power amp module Skyworks (SiGe) SE2576L
Ethernet: Qualcomm Atheros TP9343
Lan speed: 100M ports: 4
Lan speed: 100M ports: 1
Other info: same case, ram and flash that TP-Link TL-WR841HP,
different SOC
https://forum.openwrt.org/t/adding-device-support-tp-link-wr941hp/
Label MAC addresses based on vendor firmware:
LAN *:ee label
WAN *:ef label +1
WLAN *:ee label
The label MAC address found in "config" partition at 0x8
Flash instruction:
Upload the generated factory firmware on web interface.
Signed-off-by: Diogenes Rengo <rengocbx250@gmail.com>
[remove various whitespace issues, squash commits, use short 0x0]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This patch adds support for the Ubiquiti PowerBeam M (XW), e.g. PBE-M5-400,
a 802.11n wireless with a feed+dish form factor. This device was previously
supported by the ar71xx loco-m-xw firmware.
Specifications:
- Atheros AR9342 SoC
- 64 MB RAM
- 8 MB SPI flash
- 1x 10/100 Mbps Ethernet port, 24 Vdc PoE-in
- Power and LAN green LEDs
- 4x RSSI LEDs (red, orange, green, green)
- UART (115200 8N1)
Flashing via stock GUI:
- Downgrade to AirOS v5.5.x (latest available is 5.5.10-u2) first (see
https://openwrt.org/toh/ubiquiti/powerbeam installation instructions)
- Upload the factory image via AirOS web GUI.
Flashing via TFTP:
- Use a pointy tool (e.g., unbent paperclip) to keep the
reset button pressed.
- Power on the device (keep reset button pressed).
- Keep pressing until LEDs flash alternatively LED1+LED3 =>
LED2+LED4 => LED1+LED3, etc.
- Release reset button.
- The device starts a TFTP server at 192.168.1.20.
- Set a static IP on the computer (e.g., 192.168.1.21/24).
- Upload via tftp the factory image:
$ tftp 192.168.1.20
tftp> bin
tftp> trace
tftp> put openwrt-ath79-generic-xxxxx-ubnt_powerbeam-m-xw-squashfs-factory.bin
WARNING: so far, no non-destructive method has been discovered for
opening the enclosure to reach the serial console. Internal photos
are available here: https://fcc.io/SWX-NBM5HP
Signed-off-by: Russell Senior <russell@personaltelco.net>
The ar71xx GPIO driver only uses 0x24 registers, all following GPIO
registers are using to control pinmux functions, which are not handles
by the GPIO driver but the generic Linux pinctrl driver.
For some SoC conflicting address ranges were defined for these (AR7240 &
AR9330).
Resolve these cases and align the address space of the GPIO controller
between all SoCs, as the used address space of the driver is identical
for all these.
Signed-off-by: David Bauer <mail@david-bauer.net>
Analysis done by Denis Kalashnikov:
It seems that some ROS versions on some routerboard models have this bug:
after silence boot (no output to uart, no beeps) beeper clicks when wireless traffic is.
https://forum.mikrotik.com/viewtopic.php?f=3&t=92269https://forum.mikrotik.com/viewtopic.php?t=63399
From these links:
1)
Hello, I have RB951G-2HnD and I noticed strange thing
when I loaded the device with some wireless traffic it
produced strange sound - like hissing, fizzing etc.
2)
Same problem still on 6.33, with silent boot enabled
I hear buzzing noise on wireless load.
3)
The sound is fixed in v5.19, it was a bug that caused beeper to make clicks.
It also got fixed in RouterOS:
* What's new in 5.19 (2012-Jul-16 10:51):
fix ticking sound on RB411UAHL;
* What's new in 6.38.3 (2017-Feb-07 09:52):
rb3011 - fixed noise from buzzer after silent boot;
I've checked with an oscilloscope that:
* When on the ssr beeper pin is 0,
on the beeper itself is 1 (~5V),
and when on the ssr beeper pin is 1,
on the beeper is 0
The beeper doesn't consume power,
so 1 should be a default/idle value for the ssr beeper pin).
* When there is wireless traffic (ping packets)
in the background and the beeper clicks, I see
pulses on the beeper itself,
but no pulses on the ssr beeper pin (Q5 pin of 74hc595).
When I manually toggle the ssr beeper pin I see pulses on both.
So, it is likely that the phantom beeper clicks are caused by the EMI.
Suggested-by: Denis Kalashnikov <denis281089@gmail.com>
Reviewed-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
This commit adds support for the Teltonika RUT230 v1, a Atheros AR9331
based router with a Quectel UC20 UMTS modem.
Hardware
--------
Atheros AR9331
16 MB SPI-NOR XTX XT25F128B
64M DDR2 memory
Atheros AR9331 1T1R 802.11bgn Wireless
Boootloader: pepe2k U-Boot mod
Hardware-Revision
-----------------
There are two board revisions of the RUT230, a v0 and v1.
A HW version is silkscreened on the top of the PCBs front side as well
as shown in the Teltonika UI. However, this looks to be a different
identifier, as the GPl dump shows this silkscreened / UI shown version
are internally treated identically.
Th following mapping has been obtained from the latest GPl dump.
HW Ver 01 - 04 --> v0
HW Ver > 05 --> v1
My board was a HW Ver 09 and is treated as a v1.
Installation
------------
While attaching power, hold down the reset button and release it after
the signal LEDs flashed 3 times.
Attach your Computer with the devices LAN port and assign yourself the
IPv4 address 192.168.1.10/24. Open a web browser, navigate to
192.168.1.1. Upload the OpenWrt factory image.
The device will install OpenWrt and automatically reboots afterwards.
You can use the smae procedure with the stock firmware to return back to
the vendor firmware.
Signed-off-by: David Bauer <mail@david-bauer.net>
The beeper is currently not fully functional and has also
been removed from DTS.
Also remove the dependency for the gpio-beeper module.
Fixes: 695a1cd53c ("ath79: add support for MikroTik RouterBOARD 912UAG-2HPnD")
Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
Without this patch we have to manually bring up the CPU interface in
failsafe mode.
This was backported from kernel 5.12.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Tested-by: Rafał Miłecki <rafal@milecki.pl>
Currently, the option to disable subpage writing is only set
when a HW ECC engine is used.
Some boards lack a HW ECC engine and use software for that.
In this case, this NAND option does not get set when the NAND chip
does not support it, resulting in mounting errors.
Move the setting of this option to a generic init location so it
gets set for all types where required.
While at it, also OR the option instead of just setting it
so we don't overwrite potential flags being set somewhere else.
Before:
[ 1.681273] UBI: auto-attach mtd2
[ 1.684669] ubi0: attaching mtd2
[ 1.688877] ubi0 error: validate_ec_hdr: bad VID header offset 2048, expected 512
[ 1.696469] ubi0 error: validate_ec_hdr: bad EC header
[ 1.701712] Erase counter header dump:
[ 1.705512] magic 0x55424923
[ 1.709322] version 1
[ 1.712330] ec 1
[ 1.715331] vid_hdr_offset 2048
[ 1.718610] data_offset 4096
[ 1.721880] image_seq 1462320675
[ 1.725680] hdr_crc 0x12255a15
After:
1.680917] UBI: auto-attach mtd2
[ 1.684308] ubi0: attaching mtd2
[ 2.954504] random: crng init done
[ 3.142813] ubi0: scanning is finished
[ 3.163455] ubi0: attached mtd2 (name "ubi", size 124 MiB)
[ 3.169069] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 3.176037] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 3.182942] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 3.190013] ubi0: good PEBs: 992, bad PEBs: 0, corrupted PEBs: 0
[ 3.196102] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
[ 3.203434] ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1462320675
[ 3.212700] ubi0: available PEBs: 0, total reserved PEBs: 992, PEBs reserved for bad PEB handling: 20
[ 3.222124] ubi0: background thread "ubi_bgt0d" started, PID 317
[ 3.230246] block ubiblock0_1: created from ubi0:1(rootfs)
[ 3.235819] ubiblock: device ubiblock0_1 (rootfs) set to be root filesystem
[ 3.256830] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
This board has been supported in the ar71xx.
Links:
* https://mikrotik.com/product/RB912UAG-2HPnD
* https://openwrt.org/toh/hwdata/mikrotik/mikrotik_rb912uag-2hpnd
This also supports the 5GHz flavour of the board.
Hardware:
* SoC: Atheros AR9342,
* RAM: DDR 64MB,
* SPI NOR: 64KB,
* NAND: 128MB,
* Ethernet: x1 10/100/1000 port with passive POE in,
* Wi-Fi: 802.11 b/g/n,
* PCIe,
* USB: 2.0 EHCI controller, connected to mPCIe slot and a Type-A
port -- both can be used for LTE modem, but only one can be
used at any time.
* LEDs: 5 general purpose LEDs (led1..led5), power LED, user LED,
Ethernet phy LED,
* Button,
* Beeper.
Not working:
* Button: it shares gpio line 15 with NAND ALE and NAND IO7,
and current drivers doesn't easily support this configuration,
* Beeper: it is connected to bit 5 of a serial shift register
(tested with sysfs led trigger timer). But kmod-gpio-beeper
doesn't work -- we left this as is for now.
Flashing:
* Use the RouterBOARD Reset button to enable TFTP netboot,
boot kernel and initramfs and then perform sysupgrade.
* From ar71xx OpenWrt firmware run:
$ sysupgrade -F /tmp/<sysupgrade.bin>
For more info see: https://openwrt.org/toh/mikrotik/common.
Co-Developed-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
Reviewed-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Signed-off-by: Denis Kalashnikov <denis281089@gmail.com>
Main part is copied from ar71xx original driver rb91x_nand
written by Gabor Juhos <juhosg@openwrt.org>.
What is done:
* Support of kernel 5.4 and 5.10,
* DTS support,
* New gpio API (gpiod_*) support.
Reviewed-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Signed-off-by: Denis Kalashnikov <denis281089@gmail.com>
This is a slighty modified version of ar71xx gpio-latch driver
written by Gabor Juhos <juhosg@openwrt.org>.
Changes:
* DTS support,
* New gpio API (gpiod_*).
Reviewed-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Signed-off-by: Denis Kalashnikov <denis281089@gmail.com>
