Josef Schlehofer [Tue, 26 Jul 2022 12:31:26 +0000 (14:31 +0200)]
mvebu: backport DTS changes for Turris Omnia from mvebu/dt
My commit backported patches from the following links:
- https://lore.kernel.org/linux-arm-kernel/20220704113622.18887-1-kabel@kernel.org/
- https://lore.kernel.org/linux-arm-kernel/20220704113622.18887-2-kabel@kernel.org/
According to the links, they are applied in repository mvebu in branch dt,
so it should be included in upcoming Linux version soon.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Lech Perczak [Tue, 9 Aug 2022 23:10:57 +0000 (01:10 +0200)]
ath25: fix initramfs image generation
Commit 21f460a5dbef ("ath25: fix duplicate LZMA compression") changed
the way kernel images are generated, affecting initramfs images instead.
Initramfs images were previously ELF images, and by mistake this change
caused the raw kernel image to be used as a source. This caused them to
be non-loadable by bootloaders.
Restore the previous KERNEL_INITRAMFS recipe and adjust
KERNEL_INITRAMFS_NAME to point at the correct source artifact.
While at that, adjust KERNEL_INITRAMFS_SUFFIX to -kernel.elf,
so it matches the suffix of non-initramfs kernel artifact.
Lech Perczak [Tue, 9 Aug 2022 23:06:24 +0000 (01:06 +0200)]
ath25: fix ELF image generation
Commit 21f460a5dbef ("ath25: fix duplicate LZMA compression"), when
attempting to restore ELF artifact generation, copiedover the raw
kernel image twice. Because of that, the .elf artifact was actually a
duplicate of raw image.
Fix that by copying over .elf suffixed kernel image instead.
Installation
-----------------
1. Login to the router web interface (admin:admin)
2. Navigate to Settings -> WAN -> Add static IP interface (e.g.
10.0.0.1/255.255.255.0)
3. Navigate to Settings -> Remote cotrol -> Add SSH, port 22,
10.0.0.0/255.255.255.0 and interface created before
4. Change IP of your client to 10.0.0.2/255.255.255.0 and connect the
ethernet cable to the WAN port of the router
5. Connect to the router using SSH shell (SuperUser:SNxxxxxxxxxx, where
SNxxxxxxxxxx is the serial number from the backplate label)
6. Run in SSH shell:
sh
7. Make a mtd backup (optional, see related section)
8. Change bootflag to Sercomm1 and reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
reboot
9. Login to the router web interface (admin:admin)
10. Remove dots from the OpenWrt factory image filename
11. Update firmware via web using OpenWrt factory image
Revert to stock
---------------
1. Change bootflag to Sercomm1 in OpenWrt CLI and then reboot:
printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
2. Optional: Update with any stock (Beeline) firmware if you want to
overwrite OpenWrt in Slot 0 completely.
mtd backup
----------
1. Set up a tftp server (e.g. tftpd64 for windows)
2. Connect to a router using SSH shell and run the following commands:
cd /tmp
for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \
tftp -l mtd$i -p 10.0.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done
tftp -l mtd.md5 -p 10.0.0.2
MAC Addresses
-------------
+-----+-----------+---------+
| use | address | example |
+-----+-----------+---------+
| LAN | label | *:54 |
| WAN | label + 1 | *:55 |
| 2g | label + 4 | *:58 |
| 5g | label + 5 | *:59 |
+-----+-----------+---------+
The label MAC address was found in Factory 0x21000
Co-developed-by: Maximilian Weinmann <x1@disroot.org> Signed-off-by: Maximilian Weinmann <x1@disroot.org> Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Add support for the TP-Link SG2008P switch. This is an RTL8380 based
switch with 802.3af one the first four ports.
Specifications:
---------------
* SoC: Realtek RTL8380M
* Flash: 32 MiB SPI flash (Vendor varies)
* RAM: 256 MiB (Vendor varies)
* Ethernet: 8x 10/100/1000 Mbps with PoE on 4 ports
* Buttons: 1x "Reset" button on front panel
* Power: 53.5V DC barrel jack
* UART: 1x serial header, unpopulated
* PoE: 1x TI TPS23861 I2C PoE controller
Works:
------
- (8) RJ-45 ethernet ports
- Switch functions
- System LED
Not yet enabled:
----------------
- Power-over-Ethernet (driver works, but doesn't enable "auto" mode)
- PoE, Link/Act, PoE max and System LEDs
Install via web interface:
-------------------------
Not supported at this time.
Install via serial console/tftp:
--------------------------------
The footprints R27 (0201) and R28 (0402) are not populated. To enable
serial console, 50 ohm resistors should be soldered -- any value from
0 ohm to 50 ohm will work. R27 can be replaced by a solder bridge.
The u-boot firmware drops to a TP-Link specific "BOOTUTIL" shell at
38400 baud. There is no known way to exit out of this shell, and no
way to do anything useful.
Ideally, one would trick the bootloader into flashing the sysupgrade
image first. However, if the image exceeds 6MiB in size, it will not
work. The sysupgrade image can also be flashed. To install OpenWRT:
Prepare a tftp server with:
1. server address: 192.168.0.146
2. the image as: "uImage.img"
Power on device, and stop boot by pressing any key.
Once the shell is active:
1. Ground out the CLK (pin 16) of the ROM (U7)
2. Select option "3. Start"
3. Bootloader notes that "The kernel has been damaged!"
4. Release CLK as sson as bootloader thinks image is corrupted.
5. Bootloader enters automatic recovery -- details printed on console
6. Watch as the bootloader flashes and boots OpenWRT.
Blind install via tftp:
-----------------------
This method works when it's not feasible to install a serial header.
Prepare a tftp server with:
1. server address: 192.168.0.146
2. the image as: "uImage.img"
3. Watch network traffic (tcpdump or wireshark works)
4. Power on the device.
5. Wait 1-2 seconds then ground out the CLK (pin 16) of the ROM (U7)
6. When 192.168.0.30 makes tftp requests, release pin 16
7. Wait 2-3 minutes for device to auto-flash and boot OpenWRT
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
kernel: add upstream patches for tps23861 PoE controller
These patches support the tps23861 PoE controller found on a number of
managed switches. The TPS23861 is an I2C-based quad IEEE 802.3at (PoE+)
Power-over-Ethernet PSE controller. It's also found on some Realtek
based switches, where we expect the bulk of the users to reside.
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
[Disable driver in generic/config-5.10] Signed-off-by: Sander Vanheule <sander@svanheule.net>
realtek: EnGenius EWS2910P: use the mtd3 partition for root overlay
The root overlay is mounted on the "rootfs_data" partition. This comes
at the end of the firmware image, courtesy of mtdsplit. There is very
little space left (About 1MB), which can fill up rapidly.
The "firmware" and "firmware2" partitions are part of the bootloader
dual firmware logic. They should contain independent, valid uImages.
This leaves "jffs2-cfg" (mtd3) and "jffs2-log" (mtd4) as candidates.
mtd3 is about 13.7 MB and is used by the vendor firmware to store
configuration settings. It is only erased by vendor firmware during a
factory reset. By naming this partition "rootfs_data", it becomes the
root overlay, providing significantly more room. Even with mtdsplit
wanting to create a "rootfs_data" on the firmware partition, mtd3 is
used as the overlay.
Rename "jffs2-cfg" to "rootfs_data", and profit from the extra space.
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Sander Vanheule [Sat, 13 Aug 2022 16:49:47 +0000 (18:49 +0200)]
realtek: Netgear GS110TPP v1: add lan9 and lan10
The original commit for the GS110TP was missing ports 9 and 10. These
are provided by an external RTL8214C phy, for which no support was
available at the time. Now that this phy is supported, add the missing
entries to enable all device ports.
Paul Spooren [Sat, 30 Jul 2022 18:25:32 +0000 (20:25 +0200)]
realtek: skip SFP ports in PoE setup
The function `ucidef_set_poe` receives a list of ports to add to the PoE array.
Since switches have many ports the varibale `lan_list` is passed instead of
writing every single lan port. However, this list includes partly SFP ports
which are unrelated to PoE.
This commits adds the option to add a third parameter to manually exclide
interfaces, usually the last two.
Signed-off-by: Paul Spooren <mail@aparcar.org>
[Replace glob by regex to be more specific about matching characters] Signed-off-by: Sander Vanheule <sander@svanheule.net>
Daniel Golle [Fri, 12 Aug 2022 20:16:00 +0000 (22:16 +0200)]
arm-trusted-firmware-mediatek: skip bad blocks on SPI-NAND (SNFI)
Add patch to skip bad blocks when reading from SPI-NAND. This is needed
in case erase block(s) early in the flash inside the FIP area are bad
and hence need to be skipped in order to be able to boot on such damaged
chips.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Florian Eckert [Wed, 3 Aug 2022 07:54:06 +0000 (09:54 +0200)]
fstools: add uci fstab section to conffiles for package block-mount
The command 'opkg search /etc/config/fstab' does not return a package
name for this config file. In order to know to which package this config
file belongs to, a 'conffiles' entry was made for this file to package
'block-mount'.
Daniel Golle [Fri, 12 Aug 2022 10:02:04 +0000 (12:02 +0200)]
mkimage: fix validation of legacy images with custom magic
All images generated by mkimage are now always validated.
This change broke our downstream support for setting a custom value for
IH_MAGIC (mkimage -M ...). Make sure also plain legacy kernel images
with custom value set for IH_MAGIC validate correctly.
Fixes: fa9895ee5b ("tools: mkimage: update to U-Boot release 2022.07") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Daniel Golle [Fri, 12 Aug 2022 09:02:44 +0000 (11:02 +0200)]
kernel: kmod-input-gpio-keys-polled depends on kmod-input-core
While kmod-input-core was previously indirectly selected by
kmod-input-polldev, this is now only the case on Linux 5.10.
Select kmod-input-core as dependency independently of the kernel
version to fix build error:
Package kmod-input-gpio-keys-polled is missing dependencies for the following libraries:
input-core.ko
Fixes: 54878fbbdd ("kernel: kmod-input-polldev: Depend on kernel 5.10") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Hauke Mehrtens [Sat, 5 Mar 2022 18:08:27 +0000 (19:08 +0100)]
kernel: Backport upstream flowtable patches from 5.15
This backports some patches from kernel 5.15 to fix issues with
flowtable offloading in kernel 5.10. OpenWrt backports most of the
patches related to flowtable offloading from kernel 5.15 already, but we
are missing some of the extra fixes.
This fixes some connection tracking problems when a flow gets removed
from the offload and added to the normal SW path again.
The patch 614-v5.18-netfilter-flowtable-fix-TCP-flow-teardown.patch was
extended manually with the nf_conntrack_tcp_established() function.
Manas Sambhus [Tue, 9 Aug 2022 07:44:40 +0000 (13:14 +0530)]
base-files: wifi: add random MAC support for wifi-iface
Add support for randomly generating a MAC address for a wifi-iface
instance by setting `macaddr` to `random`
When set to `random`, a new locally administered unicast MAC address
is generated and assigned to the iface everytime it is (re-)configured
Hauke Mehrtens [Sun, 7 Aug 2022 13:22:42 +0000 (15:22 +0200)]
kernel: kmod-iio-sps30: Add I2C driver
The sps30.ko driver was split into a main sps30.ko driver and a
sps30_i2c.ko driver for the I2C interface with kernel 5.14. Add the
sps30_i2c.ko module to the package too.
Hauke Mehrtens [Sun, 7 Aug 2022 12:35:03 +0000 (14:35 +0200)]
kernel: kmod-wwan: Add package
This adds the kmod-wwan package. This provides the generic wwan driver
core which is needed for some existing packages.
Currently the drivers/net/wwan/wwan.ko driver is compiled into the
kernel when one of the wwan module is activated, better build it as a
kernel module.
Hauke Mehrtens [Sun, 7 Aug 2022 12:06:14 +0000 (14:06 +0200)]
kernel: kmod-nft-nat6: Remove package
The nft NAT packages for IPv4 and IPv6 were merged into the common
packages with kernel 5.1. The kmod-nft-nat6 package was empty in our
build, remove it.
Multiple kernel configuration options were also removed, remove them
from our generic kernel configuration too.
Hauke Mehrtens [Sun, 7 Aug 2022 11:32:31 +0000 (13:32 +0200)]
kernel: kmod-w1-slave-ds2760: Remove package
The w1_ds2760.ko driver was merged into the ds2760_battery.ko driver.
The driver was removed and this package was never build any more.
This happened with kernel 4.19.
Hauke Mehrtens [Sun, 7 Aug 2022 11:24:59 +0000 (13:24 +0200)]
kernel: kmod-net-rtl8192su: Remove package
The R8712U driver depends on cfg80211. cfg80211 is provided by mac80211
backports, we can not build any in kernel drivers which depend on
cfg80211 which is an out of tree module in OpenWrt.
The cfg80211 dependency was added with kernel 5.9.
We could add rtl8192su to backports and build it from there.
Hauke Mehrtens [Sun, 7 Aug 2022 11:51:02 +0000 (13:51 +0200)]
kernel: Activate CONFIG_GPIOLIB in generic configuration
All targets expect the malta target already activate the CONFIG_GPIOLIB
option. Move it to generic kernel configuration and also activate it for
malta.
Hauke Mehrtens [Fri, 5 Aug 2022 22:52:50 +0000 (00:52 +0200)]
kernel: kmod-fs-fscache: Add cachefiles.ko
The CONFIG_CACHEFILES configuration option makes the kernel build
cachefiles.ko, also package it. Build CONFIG_CACHEFILES as module and do
not try to build it into the kernel. This did not work because it
depended on CONFIG_FSCACHE which was already build as module.
Hauke Mehrtens [Fri, 5 Aug 2022 22:13:54 +0000 (00:13 +0200)]
kernel: kmod-usb-dwc2-pci: Add new package
Add dwc2_pci kernel module into own kernel package.
The dwc2_pci.ko kernel module was always build when kmod-usb-dwc2
was selected, but it was not packaged.
Add the missing kmod-usb-phy-nop dependency to the kmod-usb-dwc2-pci
package too. The CONFIG_USB_DWC2_PLATFORM option is already gone for
some time.
Hauke Mehrtens [Mon, 8 Aug 2022 18:26:18 +0000 (20:26 +0200)]
CI: kernel: Checkout feeds from github
Instead of cloning the feeds from the default location at
git.openwrt.org use the github action to clone them directly from
github. We saw some error messages when cloning from git.openwrt.org,
probably related to some rate limiting applied. Cloning from github
within a github action should work more stable.
The "./scripts/feeds update -a" script will use the already checked out
feed repositories and not clone them again from git.openwrt.org, but it
will also not change the branch name.
Petr Štetiar [Tue, 9 Aug 2022 05:50:19 +0000 (07:50 +0200)]
zlib: backport null dereference fix
The curl developers found test case that crashed in their testing when
using zlib patched against CVE-2022-37434, same patch we've backported
in commit 7df6795d4c25 ("zlib: backport fix for heap-based buffer
over-read (CVE-2022-37434)"). So we need to backport following patch in
order to fix issue introduced in that previous CVE-2022-37434 fix.
References: https://github.com/curl/curl/issues/9271 Fixes: 7df6795d4c25 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)") Signed-off-by: Petr Štetiar <ynezz@true.cz>
Jo-Philipp Wich [Mon, 8 Aug 2022 22:08:13 +0000 (00:08 +0200)]
jansson: revert ABI version bump
The soversion of the shipped libjansson.so library didn't change, so the
ABI version change is unwarranted and leads to opkg file clashes.
Also stop shipping an unversioned library symlink while we're at it as
it only needed at compile/link time and leading to file level clashes
between packages on future ABI bumps.
Koen Vandeputte [Mon, 1 Aug 2022 13:07:44 +0000 (15:07 +0200)]
mac80211: backport upstream fix for unitialized lock usage
Backports upstream fix from 5.19
lockdep complains use of uninitialized spinlock at ieee80211_do_stop() [1],
for commit f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif
that is being stopped") guards clear_bit() using fq.lock even before
fq_init() from ieee80211_txq_setup_flows() initializes this spinlock.
According to discussion [2], Toke was not happy with expanding usage of
fq.lock. Since __ieee80211_wake_txqs() is called under RCU read lock, we
can instead use synchronize_rcu() for flushing ieee80211_wake_txqs().
Thomas Langer [Fri, 29 Jul 2022 16:36:00 +0000 (18:36 +0200)]
kernel: netsupport: Extract sched-prio and sched-red
Extract the kmod-sched-prio and kmod-sched-red kernel modules from the
big kmod-sched package. This allows adding the two kernel modules to
OpenWrt without adding the kmod-sched and all its depdnecy.
Signed-off-by: Thomas Langer <tlanger@maxlinear.com> Signed-off-by: Hauke Mehrtens <hmehrtens@maxlinear.com>
This puts the kmod-sched packages into an alphabetical order.
I kept the kmod-sched-core at the top as this is the main package.
No changes other than reordering were done.
Thomas Langer [Fri, 29 Jul 2022 16:35:57 +0000 (18:35 +0200)]
kernel: netsupport: kmod-sched: explicitly define included modules
Change SCHED_MODULES_EXTRA to an explicit list of modules
instead of taking everything that is not filtered out.
This removes the need of updating the filter each time an extra
sch_*, act_* or similar is added with an own kmod definition.
Signed-off-by: Thomas Langer <tlanger@maxlinear.com> Signed-off-by: Hauke Mehrtens <hmehrtens@maxlinear.com>
kernel: netsupport: kmod-sched: Remove sch_fq_codel and sch_fifo
The sch_fq_codel.ko and the sch_fifo.ko are always compiled into the
kernel, they are activated in the generic kernel configuration. There is
no need to activate the build of these kernel modules in the kmod-sched*
packages.
MAC assignment:
lan: 98:0d:67:ee:85:54 (base, on the device back)
wlan: 98:0d:67:ee:85:55
Installation from web GUI:
- Log in as "admin" on http://192.168.1.1/
- Upload OpenWrt initramfs-recovery.bin image on the
Maintenance -> Firmware page
- Wait for OpenWrt to boot and ssh to root@192.168.1.1
- format ubi device: ubiformat /dev/mtd6
- attach ubi device: ubiattach -m6
- create rootfs volume: ubimkvol /dev/ubi0 -n0 -N rootfs -s 1MiB
- rootfs_data volume: ubimkvol /dev/ubi0 -n1 -N rootfs_data -s 1MiB
- run sysupgrade with sysupgrade image
For more details about flashing see
commit 2449a632084b ("ramips: mt7621: Add support for ZyXEL NR7101").
Please note that this commit is needed:
firmware-utils: add marcant changes for ZyXEL NBG6716 and LTE3301-PLUS
Signed-off-by: André Valentin <avalentin@marcant.net>
Manuel Niekamp [Wed, 22 Jun 2022 20:56:29 +0000 (22:56 +0200)]
ath79: add support for Sophos AP15
The Sophos AP15 seems to be very close to Sophos AP55/AP100.
Based on:
commit 6f1efb289837 ("ath79: add support for Sophos AP100/AP55 family")
author Andrew Powers-Holmes <andrew@omnom.net>
Fri, 3 Sep 2021 15:53:57 +0200 (23:53 +1000)
committer Hauke Mehrtens <hauke@hauke-m.de>
Sat, 16 Apr 2022 16:59:29 +0200 (16:59 +0200)
Unique to AP15:
- Green and yellow LED
- 2T2R 2.4GHz 802.11b/g/n via SoC WMAC
- No buttons
- No piezo beeper
- No 5.8GHz
Flashing instructions:
- Derived from UART method described in referenced commit, methods
described there should work too.
- Set up a TFTP server; IP address has to be 192.168.99.8/24
- Copy the firmware (initramfs-kernel) to your TFTP server directory
renaming it to e.g. boot.bin
- Open AP's enclosure and locate UART header (there is a video online)
- Terminal connection parameters are 115200 8/N/1
- Connect TFTP server and AP via ethernet
- Power up AP and cancel autoboot when prompted
- Prompt shows 'ath> '
- Commands used to boot:
ath> tftpboot 0x81000000 boot.bin
ath> bootm 0x81000000
- Device should boot OpenWRT
- IP address after boot is 192.168.1.1/24
- Connect to device via browser
- Permanently flash using the web ui (flashing sysupgrade image)
- (BTW: the AP55 images seem to work too, only LEDs are not working)
Testing done:
- To be honest: Currently not so much testing done.
- Flashed onto two devices
- Devices are booting
- MAC addresses are correct
- LEDs are working
- Scanning for WLANs is working
Big thanks to all the people working on this great project!
(Sorry about my english, it is not my native language)
Signed-off-by: Manuel Niekamp <m.niekamp@richter-leiterplatten.de>
Reto Schneider [Fri, 11 Jun 2021 09:19:51 +0000 (11:19 +0200)]
ramips: mt7628: fix memory controller reset bit
According to MediaTek MT7688 Datasheet v1.4, as well as the MT7628
counterpart, the memory controller reset bit (MC_RST) is 10, not 20.
Reset bit 20 is used for for UART 2 (UART2_RST).
Please note: Due to the lack of hardware, I was not able to test this
change.
The router comes with OpenWrt 14.07 built with MTK SDK. However, as the
modem is provided by carriers, so the web interface is highly minimized and
only contains a static page with no interaction options.
There are two possible ways to gain the access.
1) Open the shell and use a UART2USB convert to gain TTY access. Please
notice you have to remove resistance R54 at the back of the board
otherwise you won't be able to input anything.
2) Use built-in backdoor. Access http://192.168.1.1/cgi-bin/_/testxst to
start dropbear service at port 9122. Be warned the software is super
old and only diffie-hellman-group1-sha1, diffie-hellman-group14-sha1,
kexguess2@matt.ucc.asn.au is support, you may not be able to connect it
with an up-to-date ssh client.
After you can control the device, flash the firmware as usual. Here are
some hints for that.
Option 1 (via original firmware):
1) Setup HTTP server on your computer, for example:
python3 -m http.server
2) Connect to the route and flash:
cd /tmp
wget http://<your-computer-host>/<your-firmware-name>
mtd -r write <your-firmware-name> firmware
Option 2 (replacing u-boot via breed):
1) Download breed-mt7620-reset13.bin from https://breed.hackpascal.net/
2) Setup HTTP server on your computer, for example:
python3 -m http.server
You can skip this step if your breed is already accessible from HTTP,
since the original wget does not support HTTPS.
3) Connect to the route and flash breed:
cd /tmp
wget http://<your-computer-host>/breed-mt7620-reset13.bin
mtd write breed-mt7620-reset13.bin Bootloader
4) Reboot. Hold reset key or press any key in TTY to enter breed.
5) Access breed web interface (http://192.168.1.1/). Choose the flash
layout to be 0x50000 and flash new firmware.
MAC addresses:
-------------
There are three MACs stored in factory, as in MT7620A reference design:
source address usage
0x4 label WLAN
0x28 label MAC 1
0x2e label + 1 MAC 2
However, the OEM firmware only uses one single MAC (label) for all
interfaces, probably a misconfiguration.
Problem: WiFi is super weak, but SSID beacons seems to be right.
Solve: Change 36h in factory partition (namely 0xf60036) to be 0x0.
Explain: Clearly Netgear have different ideas on how EEPROM is used. Bit 2
of 36h indicates the presence of External LNA for 11g (2.4 GHz) band,
which seems to be incorrectly set by Netgear (originally 0x04). Lifting it
solves the problem of weak RX signal.
Installation:
------------
There are two possible ways to install the firmware. Flashing via web
interface of original firmware is not tested due to a broken firmware.
1) Open the shell and use a UART2USB convert to gain TTY access (TP7: RXD,
TP9: TXD, TP10: GND). Please notice you have to remove resistance R54
next to TP7 otherwise you won't be able to input anything.
2) Use well-known Netgear debug switch. Access
http://192.168.168.1/setup.cgi?todo=debug to start telnet service
(username: root, password: <none>).
Please back up firmware if you want to go back to the original.
After you can control the device, flash the firmware as usual. Here are
some hints for that.
Option 1 (via nmrpflash):
1) Download nmrpflash from https://github.com/jclehner/nmrpflash
2) Use *-factory.img and flash:
nmrpflash -L
nmrpflash -i net* -f <your-firmware-name>
3) Turn off then turn on the device, wait it finishing flash.
Option 2 (replacing u-boot via breed):
1) Download breed-mt7620-reset1.bin from https://breed.hackpascal.net/
2) Setup HTTP server on your computer, for example:
python3 -m http.server
You can skip this step if your breed is already accessible from HTTP,
since the original wget does not support HTTPS.
3) Connect to the route and flash breed:
cd /tmp
wget http://<your-computer-host>/breed-mt7620-reset1.bin
dd if=breed-mt7620-reset1.bin of=/dev/mtdblock0 bs=64k
4) Reboot. Hold reset key or press any key in TTY to enter breed.
5) Access breed web interface (http://192.168.1.1/). Choose memory layout
to be 0x40000 and flash new firmware.
Remark:
------
As a "Range Extender", it has a switch to switch between Wired mode (GPIO
21 low) and Wireless mode (GPIO 20 low), which is not implemented in this
patch. However, the router will be turned off when it switches to the
middle, which makes this switch much less useful.
MAC addresses:
-------------
The OEM firmware uses one single MAC for all interfaces, located at
0xf700b0.
Specifications:
CPU: MT7621A dual-core 880MHz
RAM: 64MB DDR2
FLASH: 16MB MX25L12805D NOR SPI
WIFI: 2.4GHz 2x2 MT7603 b/g/n PCI
WIFI: 5GHz 2x2 MT7662 a/b/ac PCI
ETH: 1xLAN 1000base-T integrated
SWITCH: MT7530 Port 0: LAN, Port 6: CPU
LED: Power, 2.4GHz WiFi, 5GHz WiFi
BTN: WPS, Reset
UART: Near ETH port, from ETH: 3V3-TxD-GND-RxD 57600 8n1
MISC: Audio support
Installation:
1. Update using recovery mode
- while holdig "reset" button, power on the device
- keep holding "reset" until power led is flashing yellow
- set own IP to 192.168.1.75, subnet mask: 255.255.255.0
- push firmware image (can be factory.bin or sysupgrade.bin)
using tftp client in binary mode to 192.168.1.1
Notes:
This board has only two MAC addresses programmed in the "factory" partition:
- MAC for wlan0 (2.4GHz) at offset 0x0004
- MAC for wlan1 (5GHz) at offset 0x8004
- stock firmware re-uses wlan0 MAC for ethernet
- no valid addresses found in 0x28, 0x2e, 0xe000 and 0xe006
Nick Hainke [Wed, 3 Aug 2022 05:13:08 +0000 (07:13 +0200)]
elfutils: update to 0.187
Changes:
debuginfod: Support -C option for connection thread pooling.
debuginfod-client: Negative cache file are now zero sized instead of
no-permission files.
addr2line: The -A, --absolute option, which shows file names including
the full compilation directory is now the default. To get the
old behavior use the new option --relative.
libdw, debuginfo-client: Load libcurl lazily only when files need to
be fetched remotely. libcurl is now never
loaded when DEBUGINFOD_URLS is unset. And when
DEBUGINFOD_URLS is set, libcurl is only loaded
when the debuginfod_begin function is called.
Petr Štetiar [Sat, 6 Aug 2022 12:55:07 +0000 (14:55 +0200)]
zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow
in inflate in inflate.c via a large gzip header extra field. NOTE: only
applications that call inflateGetHeader are affected. Some common
applications bundle the affected zlib source code but may be unable to
call inflateGetHeader.
Fixes: CVE-2022-37434
References: https://github.com/ivd38/zlib_overflow Signed-off-by: Petr Štetiar <ynezz@true.cz>
realtek: add support for Panasonic Switch-M48eG PN28480K
Panasonic Switch-M48eG PN28480K is a 48 + 4 port gigabit switch, based on
RTL8393M.
Specification:
- SoC : Realtek RTL8393M
- RAM : DDR3 128 MiB (Winbond W631GG8KB-15)
- Flash : SPI-NOR 32 MiB (Macronix MX25L25635FMI-10G)
- Ethernet : 10/100/1000 Mbps x48 + 2
- port 1-40 : TP, RTL8218B x5
- port 41-48 : RTL8218FB
- port 41-44: TP
- port 45-48: TP/SFP (Combo)
- LEDs/Keys : 7x / 1x
- UART : RS-232 port on the front panel (connector: RJ-45)
- 3:TX, 4:GND, 5:GND, 6:RX (pin number: RJ-45)
- 9600n8
- Power : 100-240 VAC, 50/60 Hz, 0.5 A
- Plug : IEC 60320-C13
- Stock OS : VxWorks based
Flash instruction using initramfs image:
1. Prepare the TFTP server with the IP address 192.168.1.111
2. Rename the OpenWrt initramfs image to "0101A8C0.img" and place it to
the TFTP directory
3. Download the official upgrading firmware (ex: pn28480k_v30000.rom)
and place it to the TFTP directory
4. Boot M48eG and interrupt the U-Boot with Ctrl + C keys
5. Execute the following commands and boot with the OpenWrt initramfs
image
rtk network on
tftpboot 0x81000000
bootm
6. Backup mtdblock files to the computer by scp or anything and reboot
7. Interrupt the U-Boot and execute the following commands to re-create
filesystem in the flash
ffsmount c:/
ffsfmt c:/
this step takes a long time, about ~ 4 mins
8. Execute the following commands to put the official images to the
filesystem
updatert <official image>
example:
updatert pn28480k_v30000.rom
this step takes about ~ 40 secs
9. Set the environment variables of the U-Boot by the following commands
11: On the initramfs image, download the sysupgrade image and perform
sysupgrade with it
sysupgrade <imagename>
12: Wait ~ 120 seconds to complete flashing
Known Issues:
- 4x SFP ports are provided as combo ports by the RTL8218FB chip, but the
phy driver has no support for it. Currently, only TP ports work by the
RTL8218B support.
Note:
- "Switch-M48eG" is a model name, and "PN28480K" is a model number.
Switch-M48eG has an another (old) model number ("PN28480"), it's not a
Realtek based hardware.
- Switch-M48eG has a "POWER" LED (Green), but it's not connected to any
GPIO pin.
- U-Boot checks the runtime images in the flash when booting and fails
to execute "bootcmd" variable if the images are not existing.
- A filesystem is formed in the flash (0x100000-0x1DFFFFF) on the stock
firmware and it includes the stock images, configuration files and
checksum files. It's unknown format, can't be managed on the OpenWrt.
To get the enough space for OpenWrt, move the filesystem to the head
of "fs_reserved" partition by execution of "ffsfmt" and "updatert".
- A GPIO pin on PCA9539 is used for resetting external RTL8218B phys and
RTL8218FB phy.
This should be specified as "reset-gpios" property in MDIO node, but
the current configuration of RTL8218B phy in the driver seems to be
incomplete and RTL8218FB won't be configured on RTL8218D support.
So, ethernet ports on these phys will be broken after hard-resetting.
At the moment, configure this pin as gpio-hog to avoid breaking by
resetting.
- This model has 2x Microchip TCN75A thermal sensors. Linux Kernel
supports TCN75 chip on lm75 driver, but no support for TCN75'A'
variant.
At the moment, use TCN75 support for the chips instead.
Back to the stock firmware:
1. Delete "loadaddr" variable and set "bootcmd" to the original value
realtek: enable pca953x GPIO driver for rtl839x subtarget
The system status LED on Panasonic Switch-M48eG PN28480K is connected to
a PCA9539PW. To use the LED as a status LED of OpenWrt while booting,
enable the pca953x driver and built-in to the kernel.
Also enable CONFIG_GPIO_PCA953X_IRQ to use interrupt via RTL83xx GPIO.
realtek: add support for Panasonic Switch-M24eG PN28240K
Panasonic Switch-M24eG PN28240K is a 24 + 2 port gigabit switch, based on
RTL8382M.
Specification:
- SoC : Realtek RTL8382M
- RAM : DDR3 128 MiB (Winbond W631GG8KB-15)
- Flash : SPI-NOR 32 MiB (Macronix MX25L25635FMI-10G)
- Ethernet : 10/100/1000 Mbps x24 + 2
- port 1-8 : TP, RTL8218B
- port 9-16 : TP, RTL8218B (SoC)
- port 17-24 : RTL8218FB
- port 17-22: TP
- port 23-24: TP/SFP (Combo)
- LEDs/Keys : 7x / 1x
- UART : RS-232 port on the front panel (connector: RJ-45)
- 3:TX, 4:GND, 5:GND, 6:RX (pin number: RJ-45)
- 9600n8
- Power : 100-240 VAC, 50/60 Hz, 0.5 A
- Plug : IEC 60320-C13
- Stock OS : VxWorks based
Flash instruction using initramfs image:
1. Prepare the TFTP server with the IP address 192.168.1.111
2. Rename the OpenWrt initramfs image to "0101A8C0.img" and place it to
the TFTP directory
3. Download the official upgrading firmware (ex: pn28240k_v30000.rom)
and place it to the TFTP directory
4. Boot M24eG and interrupt the U-Boot with Ctrl + C keys
5. Execute the following commands and boot with the OpenWrt initramfs
image
rtk network on
tftpboot 0x81000000
bootm
6. Backup mtdblock files to the computer by scp or anything and reboot
7. Interrupt the U-Boot and execute the following commands to re-create
filesystem in the flash
ffsmount c:/
ffsfmt c:/
this step takes a long time, about ~ 4 mins
8. Execute the following commands to put the official images to the
filesystem
updatert <official image>
example:
updatert pn28240k_v30000.rom
this step takes about ~ 40 secs
9. Set the environment variables of the U-Boot by the following commands
11: On the initramfs image, download the sysupgrade image and perform
sysupgrade with it
sysupgrade <imagename>
12: Wait ~ 120 seconds to complete flashing
Known Issues:
- 2x SFP ports are provided as combo ports by the RTL8218FB chip, but the
phy driver has no support for it. Currently, only TP ports work by the
RTL8218D support.
Note:
- "Switch-M24eG" is a model name, and "PN28240K" is a model number.
Switch-M24eG has an another (old) model number ("PN28240"), it's not a
Realtek based hardware.
- Switch-M24eG has a "POWER" LED (Green), but it's not connected to any
GPIO pin.
- U-Boot checks the runtime images in the flash when booting and fails
to execute "bootcmd" variable if the images are not existing.
- A filesystem is formed in the flash (0x100000-0x1DFFFFF) on the stock
firmware and it includes the stock images, configuration files and
checksum files. It's unknown format, can't be managed on the OpenWrt.
To get the enough space for OpenWrt, move the filesystem to the head
of "fs_reserved" partition by execution of "ffsfmt" and "updatert".
- A GPIO pin on PCA9539 is used for resetting external RTL8218B phy and
RTL8218FB phy.
This should be specified as "reset-gpios" property in MDIO node, but
the current configuration of RTL8218B phy in the phy driver seems to
be incomplete and RTL8218FB won't be configured on RTL8218D support.
So, ethernet ports on these phys will be broken after hard-resetting.
At the moment, configure this pin as gpio-hog to avoid breaking by
resetting.
Back to the stock firmware:
1. Delete "loadaddr" variable and set "bootcmd" to the original value
realtek: add support for Panasonic Switch-M16eG PN28160K
Panasonic Switch-M16eG PN28160K is a 16 + 2 port gigabit switch, based on
RTL8382M.
Specification:
- SoC : Realtek RTL8382M
- RAM : DDR3 128 MiB (Winbond W631GG8KB-15)
- Flash : SPI-NOR 32 MiB (Macronix MX25L25635FMI-10G)
- Ethernet : 10/100/1000 Mbps x16 + 2
- port 1-8 : TP, RTL8218B (SoC)
- port 9-16 : RTL8218FB
- port 9-14: TP
- port 15-16: TP/SFP (Combo)
- LEDs/Keys : 7x / 1x
- UART : RS-232 port on the front panel (connector: RJ-45)
- 3:TX, 4:GND, 5:GND, 6:RX (pin number: RJ-45)
- 9600n8
- Power : 100-240 VAC, 50/60 Hz, 0.5 A
- Plug : IEC 60320-C13
- Stock OS : VxWorks based
Flash instruction using initramfs image:
1. Prepare the TFTP server with the IP address 192.168.1.111
2. Rename the OpenWrt initramfs image to "0101A8C0.img" and place it to
the TFTP directory
3. Download the official upgrading firmware (ex: pn28160k_v30003.rom)
and place it to the TFTP directory
4. Boot M16eG and interrupt the U-Boot with Ctrl + C keys
5. Execute the following commands and boot with the OpenWrt initramfs
image
rtk network on
tftpboot 0x81000000
bootm
6. Backup mtdblock files to the computer by scp or anything and reboot
7. Interrupt the U-Boot and execute the following commands to re-create
filesystem in the flash
ffsmount c:/
ffsfmt c:/
this step takes a long time, about ~ 4 mins
8. Execute the following commands to put the official images to the
filesystem
updatert <official image>
example:
updatert pn28160k_v30003.rom
this step takes about ~ 40 secs
9. Set the environment variables of the U-Boot by the following commands
11: On the initramfs image, download the sysupgrade image and perform
sysupgrade with it
sysupgrade <imagename>
12: Wait ~ 120 seconds to complete flashing
Known Issues:
- 2x SFP ports are provided as combo ports by the RTL8218FB chip, but the
phy driver has no support for it. Currently, only TP ports work by the
RTL8218D support.
Note:
- "Switch-M16eG" is a model name, and "PN28160K" is a model number.
Switch-M16eG has an another (old) model number ("PN28160"), it's not a
Realtek based hardware.
- Switch-M16eG has a "POWER" LED (Green), but it's not connected to any
GPIO pin.
- U-Boot checks the runtime images in the flash when booting and fails
to execute "bootcmd" variable if the images are not existing.
- A filesystem is formed in the flash (0x100000-0x1DFFFFF) on the stock
firmware and it includes the stock images, configuration files and
checksum files. It's unknown format, can't be managed on the OpenWrt.
To get the enough space for OpenWrt, move the filesystem to the head
of "fs_reserved" partition by execution of "ffsfmt" and "updatert".
- A GPIO pin on PCA9539 is used for resetting external RTL8218FB phy.
This should be specified as "reset-gpios" property in MDIO node, but
RTL8218FB won't be configured on RTL8218D support in the phy driver.
So, ethernet ports on the phy will be broken after hard-resetting.
At the moment, configure this pin as gpio-hog to avoid breaking by
resetting.
Back to the stock firmware:
1. Delete "loadaddr" variable and set "bootcmd" to the original value
Wenli Looi [Mon, 1 Aug 2022 03:22:32 +0000 (03:22 +0000)]
ramips: support fw_printenv for Netgear WAX202
Config partition contains uboot env for the first 0x20000 bytes.
The rest of the partition contains other data including the device MAC
address and the password printed on the label.
projects / thirdparty / openwrt.git / log
