The ZyXEL NR7101 prepend an additional header to U-Boot images. This
header use the TRX magic 0x30524448 (HDR0), but is incompatible with
TRX images.
This code is reverse-engineered based on matching 32 bit numbers
found in the header with lengths and different checksum
calculations of the vendor images found on the device. The result
was matched against the validation output produced by the
bootloader to name the associated header fields.
Example bootloader validation output:
Zyxel TRX Image 1 --> Found! Header Checksum OK
============ZyXEL header information==================
chipId : MT7621A
boardId : NR7101
modelId : 07 01 00 01
kernel_len : (14177560)
kernelChksum : (0x8DD31F69)
swVersionInt : 1.00(ABUV.0)D1
swVersionExt : 1.00(ABUV.0)D1
Zyxel TRX Image 2 --> Found! Header Checksum OK
============ZyXEL header information==================
chipId : MT7621A
boardId : NR7101
modelId : 07 01 00 01
kernel_len : (14176660)
kernelChksum : (0x951A7637)
swVersionInt : 1.00(ABUV.0)D0
swVersionExt : 1.00(ABUV.0)D0
=================================================
Check image validation:
Image1 Header Magic Number --> OK
Image2 Header Magic Number --> OK
Image1 Header Checksum --> OK
Image2 Header Checksum --> OK
Image1 Data Checksum --> OK
Image2 Data Checksum --> OK
Image1 Stable Flag --> Stable
Image1 Try Counter --> 0
Image1: OK
Image2: OK
The coverage and algorithm for the kernelChksum field is unknown.
This field is not validated by the bootloader or the OEM firmware
upgrade tool. It is therefore set to a static value for now.
The swVersion fields contain free form string values. The OEM firmware
use ZyXEL structured version numbers as shown above. The strings are
not interpreted or validated on boot, so they can be repurposed for
anything we want the bootloader to display to the user. But the OEM
web GUI fails to flash images with freeform strings.
The purpose of the other strings in the header is not known. The
values appear to be static. We assume they are fixed for now, until
we have other examples. One of these strings is the platform name,
which is taken as an input parameter for support other members of
the device family.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
ath79, lantiq, ipq40xx, ramips all use the OpenWrt-specific gpio-export
functionality. Consolidate the patch that adds it under hack-5.10 since
this logic is obviously not target-specific. For those who want to
disable it, unsetting CONFIG_GPIO_SYSFS symbol will disable this code.
Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Reserve 64KiB of memory for crashlogs and enable PSTORE feature in
kernel config for MT7622.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Add support for pstore/ramoops now that DRAM content is preserved
over reboot on MT7622. On each boot, check pstore and boot to recovery
image in case there are records stored in it.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Most notably this enabled use of pstore/ramoops on MT7622 as DRAM
content is now preserved over reboot.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
The previous commit increased the U-Boot environment size of the
UniFi 6 LR to 0x4000. Also change it uboot-envtools accordingly.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
mtd erase needs to be aligned with erase blocks. Use padded image size
for erasing the production volume.
As the environment grew above the current size of 0x1000 bytes by
introducing the new padding function, increase the env size to 0x4000.
While at it, clean up reset button function to work to more reliable on
that board.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Adds support for Layer 2 multicast by implementing the DSA port_mdb_*
callbacks. The Kernel bridge listens to IGMP/MLD messages trapped to
the CPU-port, and calls the Multicast Forwarding Database updates.
The updates manage the L2 forwarding entries and the multicast
port-maps.
Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
This sets up all VLANs with a default configuration on reset:
- forward based on VLAN-ID and not the FID/MSTI
- forward based on the inner VLAN-ID (not outer)
Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
This adds SoC specific VLAN configuration routines, which
alsoe sets up the portmask table entries that are referred to
in the vlan profiles registers for unknown multicast flooding.
Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
This adds support for the MMD access registers the RTL-SoCs use to access clause 45
PHYs via mdio.
This new interface is used to add EEE-support for the RTL8226
Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
Adds a hash-bucket size attribute for the different SoCs, in order to
accomodate the buckets with 8 entries of the L2-forwarding tables
on RTL93XX in contrast to only 4 on RTL83XX.
Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
This adds snooping support for IGMP and MLD on RTL8380/90/9300
by trapping IGMP and MLD packets to the CPU.
Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
Enables CRC calculation offloading on RTL8380/8390/9300.
Tested on Zyxel XGS1210-10 (RTL9302)/GS1900-48 (RTL8390)/GS1900-10HP (RTL8382)
On the Zyxel GS1900-10HP, an increase of 5% in iperf3 send throughput
and 11% in receive throughput is seen.
Signed-off-by: Birger Koblitz <git@birger-koblitz.de>
INABA Abaniact AML2-17GP is a 17 port gigabit switch, based on RTL8382.
Specification:
- SoC : Realtek RTL8382
- RAM : DDR3 128 MiB (SK hynix H5TQ1G63EFR)
- Flash : SPI-NOR 32 MiB (Macronix MX25L25635FZ2I-10G)
- Ethernet : 10/100/1000 Mbps x17
- port 1-8 : RTL8218B (SoC)
- port 8-16 : RTL8218D
- port wan : RTL8214FC
- LEDs/Keys : 1x, 1x
- UART : pin header on PCB (Molex 530470410 compatible)
- J14: 3.3V, GND, RX, TX from rear side
- 115200n8
- Power : 100-240 VAC, 50/60 Hz, 0.21 A
- Plug : IEC 60320-C13
Flash instruction using initramfs image:
1. Boot AML2-17GP normally
2. Set the IP address of computer to the range of 192.168.1.0/24, other
than 192.168.1.248 and connect computer to "WAN/CONSOLE" port of
AML2-17GP
3. Access to "http://192.168.1.248" and open firmware setting page
-- UI Language: 日本語 --
"メンテナンス" -> "デュアルイメージ"
-- UI Language: ENGLISH --
"Maintenance" -> "Dual Image"
4. Check "イメージ情報 (en: "Images Information")" and set the first
image to active by choosing "アクティブイメージ" (en: "Active
Image") in the partition "0"
5. open firmware upgrade page
-- UI Language: 日本語 --
"メンテナンス" -> "アップグレードマネージャー"
-- UI Language: ENGLISH --
"Maintenance" -> "Upgrade Manager"
6. Set the properties as follows
-- UI Language: 日本語 --
"アップグレード方式" : "HTTP"
"アップグレードタイプ" : "イメージ"
"イメージ" : "アクティブ"
"ブラウズファイル" : (select the OpenWrt initramfs image)
-- UI Language: ENGLISH --
"Upgrade Method" : "HTTP"
"Upgrade Type" : "Image"
"Image" : "(Active)"
"Browse file" : (select the OpenWrt initramfs image)
7. Press "アップグレード" (en: "Upgrade") button and perform upgrade
8. Wait ~150 seconds to complete flashing
9. After the flashing, the following message is showed and press "OK"
button to reboot
-- UI Language: 日本語 --
"成功!! 今すぐリブートしますか?"
-- UI Language: ENGLISH --
"Success!! Do you want to reboot now?"
10. After the rebooting, reconnect the cable to other port (1-16) and
open the SSH connection, download the sysupgrade image to the device
and perform sysupgrade with it
11. Wait ~120 seconds to complete sysupgrade
Note:
- The uploaded image via WebUI will only be written with the length
embedded in the uImage header. If the sysupgrade image is specified,
only the kernel is flashed and lacks the rootfs, this causes a kernel
panic while booting and bootloops.
To avoid this issue, initramfs image is required for flashing on WebUI
of stock firmware.
- This device has 1x LED named as "POWER", but it's not connected to the
GPIO of SoC and cannot be controlled.
- port 17 is named as "WAN/CONSOLE". This port is for the upstream
connection and console access (telnet/WebUI) on stock firmware.
Back to stock firmware:
1. Set "bootpartition" variable in u-boot-env2 partition to "1" by
fw_setsys
fw_setsys bootpartition 1
2. Reboot AML2-17GP
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
The Netgear GS308T v1 is an 8 port gigabit switch. The GS310TP v1 is an 8
port POE+ gigabit switch with 2 SFP Ports (currently untested).
The GS308T v1 and GS310TP v1 are quite similar to the Netgear GS1xx
devices already supported. Theses two devices use the same Netgear
firmware and are very similar to there corresponding GS1xx devices. For
this reason they share a large portion of the device tree with the GS108T
and GS110TP with exception of the uimage magic and model and compatible
values.
All of the above feature a dual firmware layout, referred to as Image0
and Image1 in the Netgear firmware.
In order to manipulate the PoE+ on the GS310TP v1 , one needs the
rtl83xx-poe package
Specifications (GS308T)
----------------------
* RTL8380M SoC, 1 MIPS 4KEc core @ 500MHz
* 128MB DDR3-1600 DRAM (Winbond W631GG8MB-12)
* 32MB 3v NOR SPI Flash (Winbond W25Q256JVFQ)
* RTL8231 GPIO extender to control the LEDs and the reset button
* 8 x 10/100/1000BASE-T ports, internal PHY (RTL8218B)
* UART (115200 8N1) via unpopulated standard 0.1" pin header marked J1
* Power is supplied via a 12V 1A barrel connector
Specifications (GS310TP)
----------------------
* RTL8380M SoC, 1 MIPS 4KEc core @ 500MHz
* Nuvoton M0516LDN for controlling PoE
* 128MB DDR3-1600 DRAM (Winbond W631GG8MB-12)
* 32MB 3v NOR SPI Flash (Winbond W25Q256JVFQ)
* RTL8231 GPIO extender to control the LEDs and the reset button
* 8 x 10/100/1000BASE-T PoE+ ports, 2 x Gigabit SFP ports,
internal PHY (RTL8218B)
* UART (115200 8N1) via unpopulated standard 0.1" pin header marked J1
* Power is supplied via a 54V 1.25A barrel connector
Both devices have UART pinout
-----------
J1 | [o]ooo
^ ||`------ GND
| |`------- RX [TX out of the serial adapter]
| `-------- TX [RX into the serial adapter]
`---------- Vcc (3V3) [the square pin]
The through holes are filled with PB-free solder which melts at 375C.
They can also be drilled using a 0.9mm bit.
Installation
------------
Instructions are identical to those for the similar Negear devices
and apply both to the GS308T v1 and GS310TP v1 as well.
-------------------
Boot initramfs image from U-Boot
--------------------------------
1. Press the Escape key at the `Hit Esc key to stop autoboot` prompt
2. Init network with `rtk network on` command
3. Load image with `tftpboot 0x8f000000
openwrt-realtek-generic-netgear_gs308t-v1-initramfs-kernel.bin` command
4. Boot the image with `bootm` command
The switch defaults to IP 192.168.1.1 and tries to fetch the image via
TFTP from 192.168.1.111.
Updating the installed firmware
-------------------------------
The OpenWRT ramdisk image can be flashed directly from the Netgear UI.
The Image0 slot should be used in order to enable sysupgrade.
As with similar switches, changing the active boot partition can be
accomplished in U-Boot as follows:
1. Press the Escape key at the `Hit Esc key to stop autoboot` prompt
2. Run `setsys bootpartition {0|1}` to select the boot partition
3. Run `savesys` followed by `boota` to proceed with the boot process
Signed-off-by: Raylynn Knight <rayknight@me.com>
Fixes issue with merged DNS requests in 2.83/2.84 not being
retried on the firsts failed request causing lookup failures.
Also fixes the following security problem in dnsmasq:
* CVE-2021-3448:
If specifiying the source address or interface to be used
when contacting upstream name servers such as:
server=8.8.8.8@1.2.3.4, server=8.8.8.8@1.2.3.4#66 and
server=8.8.8.8@eth0 then all would use the same socket
bound to the explicitly configured port. Now only
server=8.8.8.8@1.2.3.4#66 will use the explicitly
configured port and the others random source ports.
Remove upstreamed patches and update remaining patch.
Signed-off-by: Alan Swanson <reiver@improbability.net>
[refreshed old runtime support patch]
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
This package depends on the lantiq target and is only build for that
target. A normal package would be build by the SDK builder probably
under a different target and then this package will not be selected.
Mark it as nonshared to build it when the lantiq target gets build.
Fixes: FS#3773, FS#3774
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
This package depends on the lantiq target and is only build for that
target. A normal package would be build by the SDK builder probably
under a different target and then this package will not be selected.
Mark it as nonshared to build it when the lantiq target gets build.
Fixes: FS#3773, FS#3774
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This backports a fix for the low priority CVE-2021-28831:
decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit
on the huft_build result pointer, with a resultant invalid free or
segmentation fault, via malformed gzip data.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is needed to add support for CM4 and RPI 400.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Commit 718e97c5c843 ("ramips: mt7530 swconfig: fix race condition in
register access") backports a fix which depends on unlocked MMD
accessors, however these were not yet included in Kernel 4.14 and they
were not backported yet.
Fixes commit 718e97c5c843 ("ramips: mt7530 swconfig: fix race condition in register access")
Signed-off-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
[ Upstream commit f99c9cd9c4 ]
The mt7530_{r,w}32 operation over MDIO uses 3 mdiobus operations and
does not hold a lock, which causes a race condition when multiple
threads try to access a register, they may get unexpected results.
To avoid this, handle the MDIO lock manually, and use the unlocked
__mdiobus_{read,write} in the critical section.
This fixes the "Ghost VLAN" artifact[1] in MT7530/7621 when the VLAN
operation and the swconfig LED link status poll race between each other.
[1] https://forum.openwrt.org/t/mysterious-vlan-ids-on-mt7621-device/64495
Signed-off-by: DENG Qingfang <dqfext@gmail.com>
(cherry picked from commit f99c9cd9c4)
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
