Huawei AP6010DN is a dual-band, dual-radio 802.11a/b/g/n 2x2 MIMO
enterprise access point with one Gigabit Ethernet port and PoE
support.
Hardware highlights:
- CPU: AR9344 SoC at 480MHz
- RAM: 128MB DDR2
- Flash: 32MB SPI-NOR
- Wi-Fi 2.4GHz: AR9344-internal radio
- Wi-Fi 5GHz: AR9580 PCIe WLAN SoC
- Ethernet: 10/100/1000 Mbps Ethernet through Atheros AR8035 PHY
- PoE: yes
- Standalone 12V/2A power input
- Serial console externally available through RJ45 port
- External watchdog: CAT706SVI (1.6s timeout)
Serial console:
9600n8 (9600 baud, no stop bits, no parity, 8 data bits)
MAC addresses:
Each device has 32 consecutive MAC addresses allocated by
the vendor, which don't overlap between devices.
This was confirmed with multiple devices with consecutive
serial numbers.
The MAC address range starts with the address on the label.
To be able to distinguish between the interfaces,
the following MAC address scheme is used:
- eth0 = label MAC
- radio0 (Wi-Fi 2.4GHz) = label MAC + 1
- radio1 (Wi-Fi 5GHz) = label MAC + 2
Installation:
0. Connect some sort of RJ45-to-USB adapter to "Console" port of the AP
1. Power up the AP
2. At prompt "Press f or F to stop Auto-Boot in 3 seconds",
do what they say.
Log in with default admin password "admin@huawei.com".
3. Boot the OpenWrt initramfs from TFTP using the hidden script "run ramboot".
Replace IP address as needed:
> setenv serverip 192.168.1.10
> setenv ipaddr 192.168.1.1
> setenv rambootfile openwrt-ath79-generic-huawei_ap6010dn-initramfs-kernel.bin
> saveenv
> run ramboot
4. Optional but recommended as the factory firmware cannot be downloaded publicly:
Back up contents of "firmware" partition using the web interface or ssh:
$ ssh root@192.168.1.1 cat /dev/mtd11 > huawei_ap6010dn_fw_backup.bin
5. Run sysupgrade using sysupgrade image. OpenWrt
shall boot from flash afterwards.
Return to factory firmware (using firmware upgrade package downloaded from non-public Huawei website):
1. Start a TFTP server in the directory where
the firmware upgrade package is located
2. Boot to u-boot as described above
3. Install firmware upgrade package and format the config partitions:
> update system FatAP6X10XN_SOMEVERSION.bin
> format_fs
Return to factory firmware (from previously created backup):
1. Copy over the firmware partition backup to /tmp,
for example using scp
2. Use sysupgrade with force to restore the backup:
sysupgrade -F huawei_ap6010dn_fw_backup.bin
3. Boot AP to U-Boot as described above
Quirks and known issues:
- The stock firmware has a semi dual boot concept where the primary
kernel uses a squashfs as root partition and the secondary kernel uses
an initramfs. This dual boot concept is circumvented on purpose to gain
more flash space and since the stock firmware's flash layout isn't
compatible with mtdsplit.
- The external watchdog's timeout of 1.6s is very hard to satisfy
during bootup. This is why the GPIO15 pin connected to the watchdog input
is configured directly in the LZMA loader to output the AHB_CLK/2 signal
which keeps the watchdog happy until the wdt-gpio kernel driver takes
over. Because it would also take too long to read the whole kernel image
from flash, the uImage header only includes the loader which then reads
the kernel image from flash after GPIO15 is configured.
Signed-off-by: Marco von Rosenberg <marcovr@selfnet.de>
Link: https://github.com/openwrt/openwrt/pull/15941
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 128 MB SPI-NAND
RAM: 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, Mesh
Power: DC 12V 1A
Gain telnet access:
1. Login into web interface, and download the configuration.
2. Decode and uncompress the configuration:
* Enter fakeroot if you are not login as root.
base64 -d e-xxxxxxxxxxxx-cfg.tar.gz | tar -zx
3. Edit 'etc/passwd', remove root password: 'root::1:0:99999:7:::'.
4. Edit 'etc/rc.local', insert telnetd command before 'exit 0':
( sleep 3s; /usr/sbin/telnetd; ) &
5. Repack the configuration:
tar -zc etc/ | base64 > e-xxxxxxxxxxxx-cfg.tar.gz
6. Upload new configuration via web interface, now you can connect to
ASR3000 via telnet.
Flash instructions:
1. Connect to ASR3000, backup everything, especially 'Factory' part.
2. Write new BL2:
mtd write openwrt-mediatek-filogic-abt_asr3000-preloader.bin BL2
3. Write new FIP:
mtd write openwrt-mediatek-filogic-abt_asr3000-bl31-uboot.fip FIP
4. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
5. Serve OpenWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After OpenWrt has booted, perform sysupgrade.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Link: https://github.com/openwrt/openwrt/pull/15887
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Use export_fitblk_bootdev() in /lib/upgrade/fit.sh instead of now
deprecated fitblk_get_bootdev() function. Include /lib/upgrade/fit.sh
instead of /lib/upgrade/common.sh to allow removing the function there.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
There is no point in hard-coding the UBI volume numbers as we are
dynamically looking up the volume by volume name in all cases by now.
Remove this relict as it causes problems without being useful for
anything.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
1. Rename function _do_env_set() to env_do_env_set().
2. Replace kwbimage hack with UBOOT_CUSTOMIZE_CONFIG:
"--disable TOOLS_KWBIMAGE" and "--disable TOOLS_LIBCRYPTO".
3. Disable CONFIG_CMD_BOOTEFI_BOOTMGR for all supported devices
because the newly added UEFI bootmenu entries doesn't work.
4. Enable CONFIG_VERSION_VARIABLE for the OpenWrt One.
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Co-authored-by: Daniel Golle <daniel@makrotopia.org>
This commit adds support for Asus RT-AX89X BX revision.
WARNING: Only the BX revision boards (So B1, B2 etc) are supported because
AX revision boards use IPQ8074 v1 SoC which is unsupported.
Specifications:
---------------
* CPU: Qualcomm IPQ8074A Quad core Cortex-A53 @ 2.2GHz
* RAM: 1024MB
* Storage: 256MB SLC NAND (Macronix MX30UF2G18AC)
* Ethernet:
* 5x 1G RJ45 ports via QCA8337 switch
* 3x 1G RJ45 ports via internal switch (QCA8075 PHY)
* 1x 10G RJ45 via internal switch (AQR113C PHY)
* 1x 10G SFP+ slot via internal switch
* WLAN:
* 2.4GHz 4x4
* 5GHz 8x8
* 8 external antennas
* USB: 2x USB 3.0 Type-A
* Buttons:
* Power switch
* WPS
* Reset
* Wireless ON/OFF
* LED ON/OFF
LED-s:
* Power
* Wi-Fi
* WAN
* 10G
* SFP+
Power:
* 19.5V via DC jack
Installation instructions:
--------------------------
1. Flash temporary OpenWrt initramfs:
* Flash openwrt-qualcommax-ipq807x-asus_rt-ax89x-initramfs-factory.trx
via the stock firmware.
Administration -> Firmware Upgrade -> Manual Firmware update (Upload)
After flashing the device will reboot with OpenWrt initramfs and it can
be accesed via any of the LAN ports via SSH with the usual OpenWrt
default credentials.
2. Sysupgrade from OpenWrt initramfs:
* Copy openwrt-qualcommax-ipq807x-asus_rt-ax89x-squashfs-sysupgrade.bin to
/tmp/openwrt-qualcommax-ipq807x-asus_rt-ax89x-squashfs-sysupgrade.bin of
the running initramfs image.
* Simply sysupgrade -n /tmp/openwrt-qualcommax-ipq807x-asus_rt-ax89x-squashfs-sysupgrade.bin
After flashing the device will reboot with OpenWrt initramfs and it can
be accesed via any of the LAN ports via SSH with the usual OpenWrt
default credentials.
Link: https://github.com/openwrt/openwrt/pull/15840
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit adds support for TP-LINK RE6000XD.
The device is quite similar to the Mercusys MR90X V1,
except only 3 LAN ports and more LEDs.
So thanks to csharper2005 for doing all the groundwork.
Device specification
--------------------
SoC Type: MediaTek MT7986BLA, Cortex-A53, 64-bit
RAM: MediaTek MT7986BLA (512MB)
Flash: SPI NAND GigaDevice (128 MB)
Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8)
Ethernet: 1x2.5Gbe (LAN3 2.5Gbps), 2xGbE (LAN 1Gbps, LAN1,
LAN2)
WLAN 2g: MediaTek MT7975N, b/g/n/ax, MIMO 4x4
WLAN 5g: MediaTek MT7975P(N), a/n/ac/ax, MIMO 4x4
LEDs: 8 LEDs, 1 status blue, 2x WIFI blue, 2x signal
blue/red, 3 LAN blue gpio-controlled
Button: 2 (Reset, WPS)
USB ports: No
Power: 12 VDC, 2 A
Connector: Barrel
Bootloader: Main U-Boot - U-Boot 2022.01-rc4. Additionally, ubi0
partition contain "seconduboot" (also U-Boot 2022.01-rc4)
Serial console (UART), unpopulated
---------------------
V
+-------+-------+-------+-------+
| +3.3V | GND | TX | RX |
+---+---+-------+-------+-------+
|
+--- Don't connect
Disassemble: rm the 2 screws at the bottom and the one at the backside.
un-clip the case starting at the edge above the LEDs.
Installation (UART)
-------------------
1. Place OpenWrt initramfs image on tftp server with IP 192.168.1.2
2. Attach UART, switch on the router and interrupt the boot process by
pressing 'Ctrl-C'
3. Load and run OpenWrt initramfs image:
tftpboot openwrt-mediatek-filogic-tplink_re6000xd-initramfs-kernel.bin bootm
4. Run 'sysupgrade -n' with the sysupgrade OpenWrt image
Notice: while I was successfull at activating ssh (as described
here:
https://www.lisenet.com/2023/gaining-ssh-access-to-tp-link-re200-wi-fi-range-extender/)
Unfortunately I haven't found the correct root password.
Looks like they are using a static password
(md5crypt, salt + 21 characters) that is not the web
interface admin password.
The TP-LINK RE900XD looks like the very same device,
according to the pictures and the firmware.
But I haven't checked if the OpenWrt firmware works as well
on that device.
The second ubi partition (ubi1) is empty and there is no known
dual-partition mechanism, neither in u-boot nor in the stock firmware.
Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
Re-enable FIT signature verification since we switched to use hyphen
for node name separators in commit 2b133ab19c ("scripts: use sep-char for hash nodes").
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
use u-boot-rockchip.bin to copy SPL/TPL/U-Boot to the image.
since binman was used in mainline u-boot for rockchip, we can use
u-boot-rockchip.bin instead of idbloader.img and u-boot.itb.
Reviewed-by: Tianling Shen <cnsztl@immortalwrt.org>
Signed-off-by: FUKAUMI Naoki <naoki@radxa.com>
Link: https://github.com/openwrt/openwrt/pull/15815
Signed-off-by: Robert Marko <robimarko@gmail.com>
MikroTik RB5009 uses RouterBoot as its bootloader like all MikroTik devices
running RouterOS, meaning that its not FIT compatible and can only boot
ELF images.
Now this is not so much of an issue on ARM or MIPS since kernel supports
appending DTB-s to it (Or we patch the kernel to embed it), but on ARM64
there is intentionally no such support.
RouterBoot will pass a DTB, but its the broken MikroTik one which is a
modified reference DTB and incorrect in more places than its valid so we
cannot use it to boot our kernel.
Thus, the solution is to use an intermediary loader and luckily for us
Armada 7040 is well supported in U-Boot which makes it a great option since
it supports anything that we will ever need to boot.
Upstream U-Boot currently requires the Armada boards to be converted to
OF_UPSTREAM before adding anything new and this requires updating all of
the drivers to accomodate the Linux DTS, while I plan to do this eventually
we will need to keep this board downstream for now.
Most stuff is supported in U-Boot, including networking since the switch
is preconfigured by RouterBoot.
A custom environment is used to try and boot from the following devices:
1. NAND (UBI)
2. USB
3. Networking
If NAND boot fails then U-Boot will attempt to boot OpenWrt initramfs from
USB or via networking.
There is a manual recovery mechanism implemented where if the reset button
is held when U-Boot is booting it will try to boot OpenWrt initramfs from:
1. USB
2. Networking
When U-Boot is in recovery mode it will light all of the LED-s except the
switch ones.
Link: https://github.com/openwrt/openwrt/pull/15765
Signed-off-by: Robert Marko <robimarko@gmail.com>
The TP-Link TL-XTR8488 is silimiar to TL-XDR6088 with following changes:
* 1GB DDR4 RAM
* Addtional MT7915AN for 5.8 GHz wireless
For flash instructions, see the commit for TP-Link TL-XDR6088.
Based on An Yun's work.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Add two patches to fix compile errors being repeatedly seen on OpenWrt CI.
The first is an upstream backport to fix this i386-related error:
x86_64-openwrt-linux-musl-gcc -mcmodel=large -I./purgatory/include
-I./purgatory/arch/x86_64/include -I./util_lib/include -I./include -Iinclude
-I/builder/shared-workdir/build/sdk/staging_dir/toolchain-x86_64_gcc-13.3.0_musl/lib/gcc/x86_64-openwrt-linux-musl/13.3.0/include
-c -MD -o purgatory/arch/i386/entry32-16.o purgatory/arch/i386/entry32-16.S
purgatory/arch/i386/entry32-16.S: Assembler messages:
purgatory/arch/i386/entry32-16.S:23: Error: 64bit mode not supported on `i386'.
The second addresses an error using basename() on musl libc:
kexec/arch/i386/x86-linux-setup.c: In function 'add_edd_entry':
kexec/arch/i386/x86-linux-setup.c:332:20: warning: implicit declaration of function 'basename' [-Wimplicit-function-declaration]
332 | if (sscanf(basename(sysfs_name), "int13_dev%hhx", &devnum) != 1) {
| ^~~~~~~~
kexec/arch/i386/x86-linux-setup.c:332:20: warning: passing argument 1 of 'sscanf' makes pointer from integer without a cast [-Wint-conversion]
332 | if (sscanf(basename(sysfs_name), "int13_dev%hhx", &devnum) != 1) {
| ^~~~~~~~~~~~~~~~~~~~
| |
| int
...
Fixes: #14621
Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
The gpio is actually low active, fix it.
Fixes: 40e7fab9e4 ("mediatek: add Nokia EA0326GMP support")
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Link: https://github.com/openwrt/openwrt/pull/15651
Signed-off-by: Robert Marko <robimarko@gmail.com>
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 128 MB SPI-NAND
RAM: 256MB
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, WPS/Mesh
Power: DC 12V 1A
Gain SSH access:
1. Login into web interface, and download the configuration.
2. Download the configration utilities:
https://firmware.download.immortalwrt.eu.org/cnsztl/mediatek/filogic/openwrt-mediatek-mt7981-nokia-ea0326gmp-config-utils.tar.gz
These binaries are extraced from the factory firmware, which are
dynamically linked with aarch64 musl 1.1.24. To use them, you
must run them under the same runtime environment, otherwise the
binaries will not work properly!
3. Upload the configuration and utilities to a suitable environment.
4. Uncompress the utilities, move them to '/bin' and give them executable permisison:
tar -zxf openwrt-mediatek-mt7981-nokia-ea0326gmp-config-utils.tar.gz
mv mkconfig seama /bin
chmod +x /bin/mkconfig
chmod +x /bin/seama
5. Decrypt and uncompress the configuration:
Enter fakeroot if you are not login as root.
mkconfig -a de-enca -m EA0326GMP_3FE79221BAAA -i EA0326GMP_3FE79221BAAA-xxxxxxxx-backup.tar.gz -o backup.tar.gz
tar -zxf backup.tar.gz
6. Edit 'etc/config/dropbear', set 'enable' to '1'.
7. Edit 'etc/passwd', remove root password: 'root::1:0:99999:7:::'.
8. Repack the configuration:
tar -zcf backup.tar.gz etc/
mkconfig -a enca -m EA0326GMP_3FE79221BAAA -i backup.tar.gz -o EA0326GMP_3FE79221BAAA-xxxxxxxx-backup.tar.gz
9. Upload new configuration via web interface, now you can SSH to EA0326GMP.
A minimum configuration which enabled SSH access is also provided
to simplify the process:
https://firmware.download.immortalwrt.eu.org/cnsztl/mediatek/filogic/openwrt-mediatek-mt7981-nokia-ea0326gmp-enable-ssh.tar.gz
Flash instructions:
1. SSH to EA0326GMP, backup everything, especially 'Factory' part.
2. Write new BL2:
mtd write openwrt-mediatek-filogic-nokia_ea0326gmp-preloader.bin BL2
3. Write new FIP:
mtd write openwrt-mediatek-filogic-nokia_ea0326gmp-bl31-uboot.fip FIP
4. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
5. Serve OpenWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After OpenWrt has booted, perform sysupgrade.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Dont allow x2 read and cache read operations on FM35Q1GA as they seem
to be unstable. Also the Linux drivers does not allow x2 ops.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Import pending patches to set pinconf settings for SPI-NAND pins on
MT7622 identical to what the old proprietary preloader did.
Should further increase the reliability of some SNFI-attached SPI-NAND
flash chips.
Link: https://github.com/mtk-openwrt/arm-trusted-firmware/pull/7
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Update ARM TrustedFirmware-A to the most recent release of
MediaTek downstream patched version released 2024-01-17.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
U-Boot 2024.04 for tegra needs swig installed on the host, this
dependency is only checked if UBOOT_USE_INTREE_DTC is set. add the
missing definition.
Fixes: 6832faf340 ("uboot-tegra: bump version to 2024.04")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Dual-slot NAS based on Marvell Kirkwood.
Specifications:
- Marvell 88F6702 @1GHz
- 256Mb RAM
- 128Mb NAND
- 1x GbE LAN (Marvell 88E1318R)
- 1x USB 2.0
- 2x SATA
- Weltrend WT69P3 ("supervisor" MCU chip)
- Serial on J2 (115200,8n1)
- Newer bootROM so kwboot-ing via serial is possible
Notes:
- The Weltrend MCU is controlled by the package added in utils/dns320l-mcu.
- The original MAC address is stored in the "mini firmware" image's first
17 bytes.
- Compared to the original MTD layout, the uImage+rootfs are now stored in
a common ubi partition.
Installation:
1. Serial console
- Connect your levelshifter to the serial console
on J2 (refer to the wiki page for pinout)
2. Update u-boot
- Download the u-boot.kwb image for the device
- Powercycle the NAS
- Run "kwboot -b u-boot-dns320l/u-boot.kwb /dev/ttyUSB0 -p"
- Connect to the serial console with minicom
- tftp 0x0800000 u-boot-dns320l/u-boot.kwb
(Please note that "PHY reset timed out" seems to be customary
on kirkwood devices, the egiga0 interface works regardless.)
- nand erase 0x0 100000
- nand write 0x0800000 0x0 0x100000
- reset
3. Install OpenWrt
- Boot up the initramfs image
- tftpboot 0x800000 openwrt-kirkwood-generic-dlink_dns320l-initramfs-uImage; bootm 0x800000
- Download the sysupgrade image and perform sysupgrade
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
Reviewed-by: Pawel Dembicki <paweldembicki@gmail.com>
Dell/SonicWall APL26-0AE (marketed as SonicPoint ACe) is a dual band
wireless access point. End of life as of 2022-07-31.
Specification
SoC: QualcommAtheros QCA9550
RAM: 256 MB DDR2
Flash: 32 MB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
5 GHz 3T3R QCA9890 oversized Mini PCIe card
Ethernet: 2x 10/100/1000 Mbps QCA8334
port labeled lan1 is PoE capable (802.3at)
USB: 1x 2.0
LEDs: LEDs: 6x which 5 are GPIO controlled and two of them are dual color
Buttons: 2x GPIO controlled
Serial: RJ-45 port, SonicWall pinout
baud: 115200, parity: none, flow control: none
Before flashing, be sure to have a copy of factory firmware, in case You
wish to revert to original firmware.
All described procedures were done in following environment:
ROM Version: SonicROM (U-Boot) 8.0.0.0-11o
SafeMode Firmware Version: SonicOS 8.0.0.0-14o
Firmware Version: SonicOS 9.0.1.0
In case of other versions, following installation instructions might be
ineffective.
Installation
1. Prepare TFTP server with OpenWrt sysupgrade image and rename that
image to "sp_fw.bin".
2. Connect to one of LAN ports.
3. Connect to serial port.
4. Hold the reset button (small through hole on side of the unit),
power on the device and when prompted to stop autoboot, hit any key.
The held button can now be released.
5. Alter U-Boot environment with following commands:
setenv bootcmd bootm 0x9F110000
saveenv
6. Adjust "ipaddr" (access point, default is 192.168.1.1) and "serverip"
(TFTP server, default is 192.168.1.10) addresses in U-Boot
environment, then run following commands:
tftp 0x80060000 sp_fw.bin
erase 0x9F110000 +0x1EF0000
cp.b 0x80060000 0x9F110000 $filesize
7. After successful flashing, execute:
boot
8. The access point will boot to OpenWrt. Wait few minutes, until the
wrench LED will stop blinking, then it's ready for configuration.
Known issues
Initramfs image can't be bigger than specified kernel size, otherwise
bootloader will throw LZMA decompressing error. Switching to lzma-loader
should workaround that.
This device has Winbond 25Q256FVFG and doesn't have reliable reset, which
causes hang on reboot, thus broken-flash-reset needs to be added. This
property addition causes dispaly of "scary" warning on each boot, take
this warnig into consideration.
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
