Zbtlink ZBT-WG1602 is a Wi-Fi router intendent to use with WWAN
(UMTS/LTE/3G/4G) modems. The router board offsers a couple of miniPCIe
slots with USB and SIM only and another one pure miniPCIe slot as well
as five Gigabit Ethernet ports (4xLAN + WAN).
Specification:
* SoC: MT7621A
* RAM: 256/512 MiB
* Flash: 16/32 MiB (SPI NOR)
* external watchdog (looks like Torexsemi XC6131B)
* Eth: 10/100/1000 Mbps Ethernet x5 ports (4xLAN + WAN)
* WLAN 2GHz: MT7603EN (.11n, MIMO 2x2)
* WLAN 5GHz: MT7612EN (.11ac, MIMO 2x2)
* WLAN Ants: detachable x2, shared by 2GHz & 5GHz radios
* miniPCIe: 2x slots with USB&SIM + 1x slot with regular PCIe bus
* WWAN Ants: detachable x4
* External storage: microSD (SDXC) slot
* USB: 2.0 Type-A port
* LED: 11 (5 per Eth phy, 3 SoC controlled, 2 WLAN 2/5 controlled, 1
power indicator)
* Button: 1 (reset)
* UART: console (115200 baud)
* Power: DC jack (12 V / 2.5 A)
Additional HW information:
* SoC USB port #1 is shared by internal miniPCIe slot and external
Type-A USB port, USB D+/D- lines are toggled between ports using a
GPIO controlled DPDT switch.
* Power of the USB enabled miniPCIe slots can be individually controlled
using dedicated GPIO lines.
* Vendor firmware feeds the external watchdog with 1s pulses. GPIO
watchdog driver is able to either generate a 1us pulses or toggle the
output line. 1us is not enough for the external watchod timer, so
the line toggling driver mode is utilized.
Installation:
Vendor's firmware is OpenWrt (LEDE) based, so the sysupgrade image can
be directly used to install OpenWrt. Firmware must be upgraded using the
'force' and 'do not save configuration' command line options (or
correspondig web interface checkboxes) since the vendor firmware is from
the pre-DSA era.
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Revert the SDC "CLK_SET_RATE_GATE" changes to the SDC clock regulator
structures.
See https://elinux.org/images/b/b8/Elc2013_Clement.pdf
> if ((clk->flags & CLK_SET_RATE_GATE) && clk->prepare_count) {
>
> For this particular clock, setting its rate is possible only if the
> clock is ungated (not yet prepared)
This fixes the MMC failing to initialize on newer ZyXEL NBG6817
hardware revisions with Kingston MMC. Older revisions should
hopefully be unaffected.
Check MMC hardware details with:
cd /sys/block/mmcblk0/device/ && \
tail -v cid date name manfid fwrev hwrev oemid rev
Known problematic MMC names (broken before this commit):
* M62704 (dated 12/2018) via myself
* M62704 (dated 11/2018) via Drake Stefani
Known unaffected MMC names (already working without this commit):
* S10004 (dated 12/2015) via slh
Without enabling dynamic debugging, this error manifests in the kernel
hardware serial console as the following:
[ 2.746605] mmc0: error -110 whilst initialising MMC card
[…trimmed other messages…]
[ 2.877832] Waiting for root device /dev/mmcblk0p5...
Enabling Linux dynamic kernel debugging provides additional messages.
For guidance, see the Linux kernel documentation:
https://www.kernel.org/doc/html/latest/admin-guide/dynamic-debug-howto.html
First, enable dynamic debugging in OpenWRT's configuration:
1. Run "make menuconfig"
2. Select "Global build settings --->"
3. Select "Kernel build options --->"
4. Enable "Compile the kernel with dynamic printk" via spacebar
5. Save and exit (arrow key to "Exit" until prompted to save, save)
Alternatively, set "CONFIG_KERNEL_DYNAMIC_DEBUG=y" in your .config.
Then, turn on dynamic debugging at boot:
Modify bootargs in
target/linux/ipq806x/files/arch/arm/boot/dts/qcom-ipq8065-nbg6817.dts
to add…
bootargs = "[…existing bootargs…] dyndbg=\"file drivers/mmc/* +p\" dynamic_debug.verbose=1 loglevel=8";
For example:
chosen {
- bootargs = "rootfstype=squashfs,ext4 rootwait noinitrd fstools_ignore_partname=1";
+ bootargs = "rootfstype=squashfs,ext4 rootwait noinitrd fstools_ignore_partname=1 dyndbg=\"file drivers/mmc/* +p\" dynamic_debug.verbose=1 loglevel=8";
append-rootblock = "root=/dev/mmcblk0p";
Then, compile and flash the resulting build. If you are testing
before this commit on newer MMC hardware, be prepared to recover!
NOTE: If you have hardware serial console access, you don't need to
use TFTP recovery to change the active boot partition.
Reboot to working alternative partition via serial console:
1. Connect to hardware serial console
* See https://openwrt.org/toh/zyxel/nbg6817#serial
2. Interrupt boot at "Hit any key to stop autoboot:"
3. Run "ATSE NBG6817"
4. Copy the result (e.g. "001976FE4B04")
* Changes with **every boot** - can't reuse this
5. On your local system, run
"./zyxel-uboot-password-tool.sh <copied value here>"
* Example: "./zyxel-uboot-password-tool.sh 001976FE4B04"
6. Run the command provided by the password tool
* Example: "ATEN 1,910F129B"
* Changes with **every boot** - can't reuse this
7. Run "ATGU"
* You now have full u-boot shell until next boot - unlocking is
not remembered
8. Run either "run boot_mmc" (for booting partition set "FF") or
"run boot_mmc_1" (for booting partition set "01")
* These commands are not affected by dual-boot partition flags
NOTE: This will NOT set the dual-boot partition flag. You'll need to
fix that manually. The "nbg6817-dualboot" script may help:
https://github.com/pkgadd/nbg6817/blob/master/nbg6817-dualboot
zyxel-uboot-password-tool.sh - sourced from
commit 459c8c9ef8:
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ a ))
printf "ATEN 1,%X\n" $p
Kernel serial console log BEFORE commit with dynamic debug enabled:
[…trimmed…]
[ 3.171343] mmci-pl18x 12400000.sdcc: designer ID = 0x51
[ 3.171397] mmci-pl18x 12400000.sdcc: revision = 0x0
[ 3.175811] mmci-pl18x 12400000.sdcc: clocking block at 96000000 Hz
[ 3.181134] mmci-pl18x 12400000.sdcc: No vqmmc regulator found
[ 3.186788] mmci-pl18x 12400000.sdcc: mmc0: PL180 manf 51 rev0 at 0x12400000 irq 41,0 (pio)
[ 3.192902] mmci-pl18x 12400000.sdcc: DMA channels RX dma1chan1, TX dma1chan2
[ 3.215609] mmc0: clock 0Hz busmode 2 powermode 1 cs 0 Vdd 21 width 1 timing 0
[ 3.227532] mmci-pl18x 12400000.sdcc: Initial signal voltage of 3.3v
[ 3.247518] mmc0: clock 52000000Hz busmode 2 powermode 2 cs 0 Vdd 21 width 1 timing 0
[…trimmed…]
[ 3.997725] mmc0: req done (CMD2): -110: 00000000 00000000 00000000 00000000
[ 4.003631] mmci-pl18x 12400000.sdcc: irq0 (data+cmd) 00000000
[ 4.003659] mmc0: error -110 whilst initialising MMC card
[ 4.016481] mmc0: clock 0Hz busmode 2 powermode 0 cs 0 Vdd 0 width 1 timing 0
Notice how the initial clock is 52 MHz, which is incorrect - MMC
requires negotiation to enable higher speeds.
Kernel serial console log AFTER commit with dynamic debug enabled:
[…trimmed…]
[ 3.168996] mmci-pl18x 12400000.sdcc: designer ID = 0x51
[ 3.169051] mmci-pl18x 12400000.sdcc: revision = 0x0
[ 3.173492] mmci-pl18x 12400000.sdcc: clocking block at 96000000 Hz
[ 3.178808] mmci-pl18x 12400000.sdcc: No vqmmc regulator found
[ 3.184702] mmci-pl18x 12400000.sdcc: mmc0: PL180 manf 51 rev0 at 0x12400000 irq 41,0 (pio)
[ 3.190573] mmci-pl18x 12400000.sdcc: DMA channels RX dma1chan1, TX dma1chan2
[ 3.217873] mmc0: clock 0Hz busmode 2 powermode 1 cs 0 Vdd 21 width 1 timing 0
[ 3.229250] mmci-pl18x 12400000.sdcc: Initial signal voltage of 3.3v
[ 3.249111] mmc0: clock 400000Hz busmode 2 powermode 2 cs 0 Vdd 21 width 1 timing 0
[…trimmed…]
[ 4.392652] mmci-pl18x 12400000.sdcc: irq0 (data+cmd) 00000000
[ 4.392785] mmc0: clock 52000000Hz busmode 2 powermode 2 cs 0 Vdd 21 width 1 timing 1
[ 4.406554] mmc0: starting CMD6 arg 03b70201 flags 0000049d
[…trimmed…]
Now, the MMC properly initializes and later switches to high speed.
Thanks to:
* Ansuel for maintaining/help with the IPQ806x platform, kernel code
* slh for additional debugging and suggestions
* dwfreed for confirming newer MMC details, clock frequency
* robimarko for device driver debug printing help, clock debugging
* Drake for testing and confirmation with their own newer NBG6817
...and anyone else I missed!
Signed-off-by: Shane Synan <digitalcircuit36939@gmail.com>
Tested-by: Shane Synan <digitalcircuit36939@gmail.com>
BMT replaces nand-specific ops for erasing and writing, but the
mtk-snand driver only implements generic mtd api.
Replace erase, block_isbad, block_markbad in mtd_info for generic mtd
drivers.
Fixes: b600aee3ed ("mediatek: attach bmt to the new snand driver")
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
ipTIME A3004NS-dual is a 2.4/5GHz band router, based on Mediatek MT7621.
Specifications:
- SoC: MT7621 (880MHz)
- RAM: DDR3 256M
- Flash: SPI NOR 16MB
- WiFi:
- 2.4GHz: MT7602E
- 5GHz : MT7612E
- Ethernet:
- 4x LAN
- 1x WAN
- USB: 1 * USB3.0 port
- UART:
- 3.3V, TX, RX, GND / 57600 8N1
Installation via web interface:
- 1. Flash Initramfs image using OEM Firmware's web GUI
- 2. Boot into OpenWrt and perform Sysupgrade with sysupgrade image.
Revert to stock firmware:
- 1. Boot into OpenWrt and perform Sysupgrade with OEM Stock Firmware image.
Signed-off-by: Yuchan Seo <hexagonwin@disroot.org>
Reviewed-by: Sungbo Eo <mans0n@gorani.run>
Currently it is not possible to configure VLANs via LUCI on
tplink tl-mr3020-v3. This patch fixes switch topology for the
LUCI interface.
Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
[copied commit message from github PR]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
In 20b09a2125 Lava LR-25G001 router have problem with two inactive
ethernet ports. JBOOT bootloader didn't configure ethernet devices by default.
The same situation was there. It is required to enable all phy ports.
This is fragment of stock bootlog:
switch reg write_athr offset=90, value=2b0
switch reg write_athr offset=8c, value=2b0
switch reg write_athr offset=88, value=2b0
switch reg write_athr offset=84, value=2b0
switch reg write_athr offset=80, value=2b0
This patch adds proper registers configuration ar8337 initvals.
0x2b0 value causes force flow control configuration, 0x1200 was used
instead (flow control config auto-neg with phy). [1]
When switch is now ok, let's fix port numeration too.
Fixes: 20b09a2125 ("ramips: add support for Lava LR-25G001")
[1] https://github.com/openwrt/openwrt/pull/4806#issuecomment-982019858
Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
Update wifi firmware used for nanopi neo air, with
cypress-firmware-43430-sdio there is no wifi detected, as
brcmfmac-firmware-43430a0-sdio allow to acces to wifi.
Signed-off-by: Michel Promonet <michel.promonet@free.fr>
The xway_legacy subtarget only supports 5 devices. Most compiled
switch drivers are unused by any of these devices. The same drivers
are compiled into the xway subtarget. They were probably copied
from there when creating this subtarget.
Switches used by devices:
Arcadyan ARV4518PWR01 Realtek RTL8306SD
Arcadyan ARV4518PWR01A Realtek RTL8306SD
Arcadyan ARV4520PW Infineon ADM6996I
Arcadyan ARV4525PW only PHY(IC+ IP101A)
Arcadyan ARV452CQW Realtek RTL8306
The CONFIG_ETHERNET_PACKET_MANGLE symbol has also been disabled,
as it is only needed by the driver for AR8216.
Reduces kernel size by 19.9 kB.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
We actually need to enclose the whole section of partitions in a
`partitions { ... }` to assign it a `compatible = "fixed-partitions";
otherwise the partition referred to by `hwinfo` won't be registered
when bringing up MTD partitions, for example as per:
- <https://forum.openwrt.org/t/tp-link-c2600-missing-default-mac-mtd-partition-in-snapshot/103945/6>
- commit e2b03c16eb ("ipq806x: add missing enclosing partitions block for TP-Link C2600")'
Fixes: 8ec21d6bb2 ("mpc85xx: convert mtd-mac-address to nvmem implementation")
Signed-off-by: Martin Kennedy <hurricos@gmail.com>
[minor beautification]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This target does not activate CONFIG_PCI kernel configuration option, do
not activate the PCI feature. This will deactivate some PCI drivers
which are not building without PCI support in the kernel.
If PCI_SUPPORT or PCIE_SUPPORT are activated in the kernel configuration
the feature flag will be automatically set by the build system again.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Deactivate all the symbols of the B53 DSA driver in the generic kernel
configuration. Multiple targets are now using this drivers and they
only need some of the options.
This fixes the bcm4908 build which didn't deactivate all of the options.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Follow up to commit 565b62cca2. Managed to
hit the very same issue again while playing with the NOR SPL builds.
Signed-off-by: Mathias Kresin <dev@kresin.me>
The board has a fixed size kernel partition but do not limit the kernel
size during image building.
Disable image building for both boards as well, since the kernel of the
last release as well as master are to big to fit into the 2 MByte kernel
partition.
Signed-off-by: Mathias Kresin <dev@kresin.me>
With Kernel 5.10 the ar7 FRITZ!Box are not booting the initramfs nor the
sysupgrade image any more. Presumably due to the grown kernel.
Use the okli preloader to workaround the bootloader issue. No solution
so far for the initramfs.
Signed-off-by: Mathias Kresin <dev@kresin.me>
Removed due to being unused with 1f7a03a706, but now required for the
ar7 FRITZ!Box.
Could be used for the ARV7519RW22 as well, for which the image
generation was disabled due to a stock u-boot issue with kernel bigger
than 2 MByte.
The code is combination of the ath79 and ramips okli loader.
Signed-off-by: Mathias Kresin <dev@kresin.me>
The devicetree property mac-address is expected to be set by the
bootloader and has priority over the nvmem supplied one.
Drop the mac-address address property from the dtsi files, to let the
mac address from nvmem-cells get used.
Signed-off-by: Mathias Kresin <dev@kresin.me>
On lantiq a lot of stuff expects to be loaded to and executed at
0x80002000, including our own second stage bootloader.
For all build u-boots, the initial stack pointer is at 0x80008000. After
loading data to 0x80002000, every further stack operation corrupts the
loaded code.
Set the initial stack pointer to 0x80002000, to not overwrite code
loaded in memory. A stack of 0x2000 bytes has been proven as enough in
all done tests.
Signed-off-by: Mathias Kresin <dev@kresin.me>
On danube we only have 0x6800 bytes of usable SRAM. Everything behind
can't be written to and a SPL u-boot locks up during boot.
Since it's a hard to debug issue and took me more than two years to fix
it, I consider it worth to include fix albeit SPL u-boots are not build
in OpenWrt.
I faced the issue while trying to shrink the u-boot to 64K since some
boards only have an u-boot partition of that size from the days
ifx-uboot was used.
Signed-off-by: Mathias Kresin <dev@kresin.me>
Reviewed-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
With gcc10 the variables are placed more tightly to each other, which
uncovers a long existing bug in the lantiq DMA code. It can be observed
when using tftpboot with the filename parameter, which gets reset during
the tftpboot execution.
NetRxPackets[] points to cache line size aligned addresses. In
ltq_eth_rx_packet_align() the address NetRxPackets[] points to is
increased by LTQ_ETH_IP_ALIGN and the resulting not cache aligned
address is used further on. While doing so, the length/size is never
updated.
The "not cache aligned address" + len/size for a cache aligned address
is passed to invalidate_dcache_range(). Hence, invalidate_dcache_range()
invalidates the next 32 bit as well, which flashes the BootFile variable
as well.
variable BootFile is at address: 0x83ffe12c
NetRxPackets[] points to 0x83ffdb20 (len is 0x600)
data points to: 0x83ffdb22 (len is 0x600)
ltq_dma_dcache_inv: 0x83ffdb22 (for len 0x600)
invalidate_dcache_range: 0x83ffdb20 to 0x83ffe120 (size: 32)
invalidate_dcache_range: 0x83ffdb20 to 0x83ffdb40 (Bootfile: a.bin)
...
invalidate_dcache_range: 0x83ffe100 to 0x83ffe120 (Bootfile: a.bin)
invalidate_dcache_range: 0x83ffe120 to 0x83ffe140 (Bootfile: )
In ltq_dma_tx_map() and ltq_dma_rx_map() the start address passed to
ltq_dma_dcache_wb_inv() is incorrect. By considering the offset, the
start address passed to flush_dcache_range() is always aligned to 32, 64
or 128 bytes dependent on configured DMA burst size.
Fixes: FS#4113
Signed-off-by: Mathias Kresin <dev@kresin.me>
At least since gcc 7.3.0 (OpenWrt 18.06) lwr/lwl are used in the
assembly of LzmaProps_Decode. While the decission made by the compiler
looks perfect fine, it triggers some obscure hang on lantiq danube-s
v1.5 with MX29LV640EB NOR flash chips.
Only if the offset 1 is used, the hang can be observed. Using any other
offset works fine:
lwl s0,0(a1) - s0 == 0x6d000080
lwl s0,1(a1) - hangs
lwl s0,2(a1) - s0 == 0x0080xxxx
lwl s0,3(a1) - s0 == 0x80xxxxxx
It isn't clear whether it is a limitation of the flash chip, the EBU or
something else.
Force 8bit reads to prevent gcc optimizing the read with lwr/lwl
instructions.
Signed-off-by: Mathias Kresin <dev@kresin.me>
The configs/omap3_overo_defconfig file was removed from upstream U-Boot
in commit ed3294d6d1f9 ("arm: Remove overo board"). Remove it in OpenWrt
too. If someone needs this please add it also to upstream U-Boot.
This fixes the compile of the omap target.
Fixes: ffb807ec90 ("omap: update u-boot to 2021.07")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
p2p_add_device() may remove the oldest entry if there is no room in the
peer table for a new peer. This would result in any pointer to that
removed entry becoming stale. A corner case with an invalid PD Request
frame could result in such a case ending up using (read+write) freed
memory. This could only by triggered when the peer table has reached its
maximum size and the PD Request frame is received from the P2P Device
Address of the oldest remaining entry and the frame has incorrect P2P
Device Address in the payload.
Fix this by fetching the dev pointer again after having called
p2p_add_device() so that the stale pointer cannot be used.
This fixes the following security vulnerabilities/bugs:
- CVE-2021-27803 - A vulnerability was discovered in how p2p/p2p_pd.c
in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision
discovery requests. It could result in denial of service or other
impact (potentially execution of arbitrary code), for an attacker
within radio range.
Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
(cherry picked from commit 1ca5de13a1)
This is a backport of the upstream commit 58bbbb598144 ("nl80211: Ignore
4addr mode enabling error if it was already enabled").
nl80211_set_4addr_mode() could fail when trying to enable 4addr mode on
an interface that is in a bridge and has 4addr mode already enabled.
This operation would not have been necessary in the first place and this
failure results in disconnecting, e.g., when roaming from one backhaul
BSS to another BSS with Multi AP.
Avoid this issue by ignoring the nl80211 command failure in the case
where 4addr mode is being enabled while it has already been enabled.
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
[bump PKG_RELEASE, more verbose commit description]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit fb860b4e41)
A vulnerability was discovered in how wpa_supplicant processing P2P
(Wi-Fi Direct) group information from active group owners.
This issue was discovered by fuzz testing of wpa_supplicant by Google's
OSS-Fuzz.
https://w1.fi/security/2020-2/wpa_supplicant-p2p-group-info-processing-vulnerability.txt
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
[added the missing patch]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry-picked from commit 7c8c4f1be6)
Without this change, wpa-cli features depend on which wpad build variant was
used to build the wpa-cli package
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Tested-by: Jérôme Benoit <jerome.benoit@piment-noir.org> [WRT1900AC v1]
[added missing package version bump]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 03e9e4ba9e)
This patch incorrectly puts vcc-rtl8153-regulator at the forefront,
causing probe timeout all the time. This commit backport the upstream
commit https://github.com/torvalds/linux/commit/d49f120 ("arm64: dts:
rockchip: Enable USB3 Ethernet on rk3328 NanoPi R2S") to ensure that
this regulator can be normally supplied.
Before:
reg-fixed-voltage vcc-rtl8153-regulator: deferred probe timeout,
ignoring dependency.
After:
vdd_5v_lan: supplied by vdd_5v
Fixes: d53ae8c ("rockchip: add Kernel 5.10 support")
Signed-off-by: AmadeusGhost <amadeus@immortalwrt.org>
