The device is cloud-managed, but there is a hidden local firmware upgrade
page in the OEM web interface. The device has to be registered in the
cloud in order to be able to access this page.
The system has a dual firmware design, there is no way to tell which
firmware is currently booted. Therefore, an -initramfs version is flashed
first.
1. Log into the OEM web GUI
2. Access the hidden upgrade page by navigating to
https://192.168.212.1/gui/#/main/debug/firmwareupgrade
3. Upload the -initramfs-kernel.bin file and flash it
4. Wait for OpenWrt to boot and log in via SSH
5. Transfer the sysupgrade file via SCP
6. Run sysupgrade to install the image
7. Reboot and enjoy
NB: If the initramfs version was installed in RAS2, the sysupgrade script
sets the boot number to the first partition. A backup has to be performed
manually in case the OEM firwmare should be kept.
The UART method is more difficult, as the boot loader does not have a
timeout set. A semi-working stock firmware is required to configure it:
1. Attach UART
2. Boot the stock firmware until the message about failsafe mode appears
3. Enter failsafe mode by pressing "f" and "Enter"
4. Type "mount_root"
5. Run "fw_setenv bootmenu_delay 3"
6. Reboot, U-Boot now presents a menu
7. The -initramfs-kernel.bin image can be flashed using the menu
8. Run the regular sysupgrade for a permanent installation
Changing the partition to boot is a bit cumbersome in U-Boot, as there is
no menu to select it. It can only be checked using mstc_bootnum. To change
it, issue the following commands in U-Boot:
This selects FW1. Replace "mw.b 1800004 1 1" by "mw.b 1800004 2 1" to
change to the second slot.
Back to stock
=============
It is possible to flash back to stock, but a OEM firmware upgrade is
required. ZyXEL does not provide the link on its website, but the link
can be acquired from the OEM web GUI by analyzing the transferred JSON
objects.
It is then a matter of writing the firmware to Kernel2 and setting the
boot partition to FW2:
Lech Perczak [Sat, 6 Nov 2021 16:56:03 +0000 (17:56 +0100)]
umbim: include MBIM-provided DNS servers also with DHCP mode
In MBIM interfaces, DNS servers may be provided out-of-band regardless
whether DHCP is used for configuration, or not. Move the DNS
configuration outside "if" blocks to support that.
Lech Perczak [Sat, 6 Nov 2021 15:01:02 +0000 (16:01 +0100)]
umbim: handle MTU configuration
Allow setting interface MTU through UCI. If this is not set,
use MBIM-provided MTU, if provided through control channel.
If separate MTUs are provided for IPv4 and IPv6, apply larger of them.
This is very unlikely and possible only for IPv4v6 dual-stack configuration.
Lech Perczak [Sat, 6 Nov 2021 12:35:15 +0000 (13:35 +0100)]
umbim: support multiple-valued configuration fields
MBIM supports multiple values for IP address and DNS server, and such
configuration is available through output of MBIM. Use new helper
method to support adding multiple addresses and DNS servers to static
interfaces for both IPv4 and IPv6.
Lech Perczak [Sat, 6 Nov 2021 12:21:32 +0000 (13:21 +0100)]
umbim: add "_proto_mbim_get_field" helper
Add a new helper to extract IP configuration from umbim output. This is
required to extract fields which can possibly have multiple values,
namely IP addresses and DNS servers, and get rid of primitive parser
using 'eval' builtin without support for this.
Lech Perczak [Sat, 6 Nov 2021 02:02:08 +0000 (03:02 +0100)]
umbim: log output of 'config' step
Display full configuration obtained using MBIM control channel in the
log, from umbim output verbatim, for easier troubleshooting, and in
preparation for parser refactoring.
Lech Perczak [Fri, 6 Aug 2021 20:29:57 +0000 (22:29 +0200)]
umbim: pass ipXtable to child interfaces
Inspired by commti e51aa699f7ca, allow setting specific routing tables
via ip4table and ip6table options, by passing them on child interfaces
created by MBIM protocol handler.
umbim: use static config by default, fallback to DHCP
Finally, inspired by ModemManager's logic, make static configuration
obtained through MBIM control channel, preferred.
If IP configuration is not available this way, fallback to DHCP(v6) if
enabled, else do not create a sub-interface for unavailable IP type.
Lech Perczak [Mon, 9 Jan 2023 21:54:07 +0000 (22:54 +0100)]
umbim: separate DHCPv6 configuration from DHCP(v4)
Now, that sub-interface setup is split by IP type, and separate checks
are performed for DHCP selection, it is possible to control DHCP on v4
an v6 sub-interfaces instantly. Add "dhcpv6" variable, akin to QMI
option, to control behaviour of DHCPv6 separately from IPv4 option,
which is required for some mobile operators.
Check whether interface is configured per IP type, not per DHCP. This is
preparation to allow fallback to DHCP if static IP configuration is not
available, which is the default option for MBIM modems
umbim: inherit "peerdns" option from parent interface
MBIM protocol handler should intherit "peerdns" options from parent
interface on sub-interfaces, otherwise upstream DNS servers are applied
regardless of configuration.
umbim: use IP configuration provided by MBIM by default
Previously, DHCP was used. According to MBIM Specification v1.0 errata 1 [1],
section 10.5.20, MBIM_CID_IP_CONFIGURATION,
if MBIM information element containing IP configuration is available,
host shall use it, and fall back to in-band mechanisms to acquire it therwise -
therefore make static configuration the default.
Lech Perczak [Mon, 21 Feb 2022 21:48:10 +0000 (22:48 +0100)]
umbim: detect actual connection IP type
Current implementation needlessly creates both IPv4 and IPv6
sub-interfaces for single-stack IP types. Limit this only to selected IP
type. While at that, ensure that IP type is also passed to umbim during
"connect" phase. In addition, detect the actual established connection
type returned by umbim and set up subinterfaces according to that,
not to requested configuration. While at that, allow empty IP type explicitly,
interpreted as "any" according to MBIM specification.
Lech Perczak [Mon, 9 Jan 2023 21:08:07 +0000 (22:08 +0100)]
umbim: fail connect step immediately
Subsequent calls to 'umbim connect' do not have any effect if a failure
occured, and in such case an infinite loop without timeout is created,
leading to possibility of interface stuck at connecting forever.
Drop this loop, and issue MBIM disconnect properly, so netifd can
restart from scratch.
This issue can be observed with Sierra EM7455 at changing APN, which
causes network re-registration by default, and a MBIM transaction
timeout, which is resolved on next interface bringup by netifd.
Lech Perczak [Tue, 15 Feb 2022 00:44:32 +0000 (01:44 +0100)]
umbim: connect session for only the selected PDP type
Previous implementation automatically set up connections for both IPv4
and IPv6, even if one of them isn't supported. Respect the "pdptype"
option in the same way, as it is done for QMI or NCM, and only start the
respective PDN sessions, if set.
1. The mtk_bmt driver recursively calls its scan_bmt() helper function
during device initialization, while looking for a valid block
mapping table (BMT).
- increased the size of some stack-allocated structures (like
struct mtd_oob_ops, used in bbt_nand_read(), which is indirectly
called from scan_bmt()),
- increased the stack size for some functions (for example,
spinand_mtd_read(), which is indirectly called from scan_bmt(),
now uses an extra stack-allocated struct mtd_ecc_stats).
3. OpenWrt currently compiles the kernel with the
-fno-optimize-sibling-calls flag, which prevents tail-call
optimization.
Collectively, all of these factors caused stack usage in the mtk_bmt
driver to grow excessively large, triggering stack overflows.
Recursion is not really necessary in scan_bmt() as it simply iterates
over flash memory blocks in reverse order, looking for a valid BMT.
Refactor the logic contained in the scan_bmt() and read_bmt() functions
in target/linux/generic/files/drivers/mtd/nand/mtk_bmt_v2.c so that deep
recursion is prevented (and therefore also any potential stack overflows
it may cause).
This activates some extra checks in SLAB or SLUB to make it harder to
execute kernel heap exploits. This adds a minor performance
degradation which I haven't measured-.
Many mainstream Linux distributions also activate this option.
kernel: Initialize RNG using CPU RNG and bootloader
This activates the following kernel options by default:
* CONFIG_RANDOM_TRUST_CPU
* CONFIG_RANDOM_TRUST_BOOTLOADER
With these option Linux will also use data from the CPU RNG e.g. RDRAND
and the bootloader to initialize the Linux RNG if such sources are
available.
These random bits are used in addition to the other sources, no other
sources are getting deactivated. I read that the Chacha mixer isn't
vulnerable to injected entropy, so this should not be a problem even if
these sources might inject bad random data.
The Linux kernel suggests to activate both options, Debian also
activates them. This does not increase kernel code size.
This applies commit 02ac9c94 to fix this OpenSSL Security Advisory
issued on 20th April 2023[1]:
Input buffer over-read in AES-XTS implementation on 64 bit ARM
(CVE-2023-1255)
==============================================================
Severity: Low
Issue summary: The AES-XTS cipher decryption implementation for 64 bit
ARM platform contains a bug that could cause it to read past the input
buffer, leading to a crash.
Impact summary: Applications that use the AES-XTS algorithm on the 64
bit ARM platform can crash in rare circumstances. The AES-XTS algorithm
is usually used for disk encryption.
The AES-XTS cipher decryption implementation for 64 bit ARM platform
will read past the end of the ciphertext buffer if the ciphertext size
is 4 mod 5 in 16 byte blocks, e.g. 144 bytes or 1024 bytes. If the
memory after the ciphertext buffer is unmapped, this will trigger a
crash which results in a denial of service.
If an attacker can control the size and location of the ciphertext
buffer being decrypted by an application using AES-XTS on 64 bit ARM,
the application is affected. This is fairly unlikely making this issue a
Low severity one.
- irq_domain_add_simple() can't be used on bmips since interrupts aren't
hardcoded with specific offsets for internal and external as opposed to
bcm63xx. This is needed to avoid collisions with other interrupts.
- remove unused bcm63xx-specific code.
Petr Štetiar [Mon, 30 Jan 2023 07:33:16 +0000 (08:33 +0100)]
ci: add Coverity Scan scheduled workflow
Coverity Scan is a static code analysis service focused on open source
software quality and security, so lets scan various OpenWrt components
every Friday for the start.
The resize tool will resize the prompt to match the current terminal
size. This is helpful when connecting to the system using UART to make
the vi or top output match the current terminal size.
This increases the busybox binary size by 136 bytes and the ipkg size by
335 bytes on aarch64.
kernel: bcma: fallback-sprom: align extraction with upstream
The current bcma SPROM extraction from upstream only supports SPROMs with
revisions from 8 to 11.
Let's align the downstream fallback driver with upstream.
Martin Kennedy [Thu, 20 Apr 2023 21:58:21 +0000 (17:58 -0400)]
ath79: create APBoot-compatible image for Aruba AP-175
As was done in commit e11d00d44c66 ("ath79: create Aruba AP-105 APBoot
compatible image"), alter the Aruba AP-175 image generation process so
OpenWrt can be loaded with the vendor Aruba APBoot. Since the
remainder of the explanation and installation process is identical,
continuing the quote from that commit:
This works by prepending the OpenWrt LZMA loader to the uImage and
jumping directly to the loader. Aruba does not offer bootm on these
boards.
This approach keeps compatibility to devices which had their U-Boot
replaced. Both bootloaders can boot the same image.
With this patch, new installations do not require replacing the
bootloader and can be performed from the serial console without
opening the case.
Installation
------------
1. Attach to the serial console of the AP-175.
Interrupt autoboot and change the U-Boot env.
2. Load the OpenWrt initramfs image on the device using TFTP.
Place the initramfs image as "ap175.bin" in the TFTP server
root directory, connect it to the AP and make the server reachable
at 192.168.1.66/24.
$ run apb_rb_openwrt
3. Once OpenWrt booted, transfer the sysupgrade image to the device
using scp and use sysupgrade to install the firmware.
Signed-off-by: Martin Kennedy <hurricos@gmail.com>
The previous attempt to replace an open coded paged read in the RealTek
Ethernet PHY driver was too naive and resulted in breaking the r8169
PCIe Ethernet driver which also makes use of the RealTek Ethernet PHY
driver.
Fix this by instead of using the (not yet populated) paged operations
rather use rtl821x_write_page and protect the whole paged read operation
using the MDIO bus mutex.
It was found this device uses a single tri-color power/status LED
rather than individual red/orange LEDs, which also supports green.
Add GPIO for green color and use with `boot` and `running` aliases.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net> Reviewed-by: Philip Prindeville <philipp@redfish-solutions.com> Signed-off-by: David Bauer <mail@david-bauer.net>
Felix Baumann [Fri, 21 Apr 2023 01:07:58 +0000 (03:07 +0200)]
ramips: Cudy X6 fixes / improvements
- Correct WiFi MACs, they didn't match oem firmware
- Move nvmem-cells to bdinfo partition and remove &bdinfo reference
- Add OEM device model name R13 to SUPPORTED_DEVICES
This allows sysupgrading from Cudy's OpenWrt fork without force
- Label red_led and use it during failsafe mode and upgrades
MAC addresses as verified by OEM firmware:
use address source
LAN b4:4b:d6:2d:c8:4a label
WAN b4:4b:d6:2d:c8:4b label + 1
2g b4:4b:d6:2d:c8:4a label
5g b6:4b:d6:3d:c8:4a label + LA-Bit set + 4th oktet increased
The label MAC address is found in bdinfo 0xde00.
Signed-off-by: Felix Baumann <felix.bau@gmx.de>
[read wifi mac from flash offset] Signed-off-by: David Bauer <mail@david-bauer.net>
There are three MAC addresses stored in the flash ROM, the assignment
follows stock. The MAC on the label is the WiFi MAC address.
Installation (TFTP)
===================
1. Connect serial console
2. Configure static IP to 192.168.1.112
3. Put OpenWrt factory.bin file as firmware-system.bin
4. Press Power + WPS and plug in power
5. Keep buttons pressed until TFTP requests are visible
6. Wait for the system to finish flashing and wait for reboot
7. Bootup will fail as the kernel offset is wrong
8. Run "setenv bootcmd bootm 0x9f150000"
9. Reset board and enjoy OpenWrt
Tony Ambardar [Mon, 16 Jan 2023 11:18:00 +0000 (03:18 -0800)]
ath79: use gpios for switch management in WZR-HP-G300NH variants
The RTL8366S/RB switch node in DTS defines "mii-bus = <&mdio0>" to permit
management via SMI but this has likely never worked, instead falling back
to using GPIOs in the past:
rtl8366s switch: cannot find mdio bus from bus handle (yet)
rtl8366s switch: using GPIO pins 19 (SDA) and 20 (SCK)
rtl8366s switch: RTL8366 ver. 1 chip found
Recently, the rtl8366s and rtl8366_smi drivers were changed from built-in
to loadable modules. This affected driver probing order and caused switch
initialization (and network access) to fail:
rtl8366s switch: using MDIO bus 'ag71xx_mdio'
rtl8366s switch: unknown chip id (ffff)
rtl8366s switch: chip detection failed, err=-19
Force using GPIOs to manage the switch by dropping the "mii-bus" DTS
definition, which works for both built-in and loadable switch drivers.
Fixes: 6e0f0eae5b ("ath79: use rtl8366s and rtl8366_smi as a module") Fixes: 575ec7a4b1 ("ath79: use rtl8366rb as a module") Tested-by: Tony Ambardar <itugrok@yahoo.com> # WZR-HP-G300NH (RTL8366S) Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
Tony Ambardar [Fri, 13 Jan 2023 11:17:54 +0000 (03:17 -0800)]
ath79: fix switch support for WZR-HP-G300NH devices
Switch drivers for RTL8366S/RB were packaged as modules but not properly
added to device definitions for WZR-HP-G300NH router variants, breaking
network access to both after installation or upgrade.
Assign the correct switch driver package for each router.
Fixes: 6e0f0eae5b ("ath79: use rtl8366s and rtl8366_smi as a module") Fixes: 575ec7a4b1 ("ath79: use rtl8366rb as a module") Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
Apart from the embedded BCM63268 wireless, this device has an external BCM4360
connected by PCIe which needs a fallback SPROM.
b43 isn't enabled for this device because BCM4360 isn't supported (AC PHY).
Apart from the embedded BCM6362 wireless, Netgear DGND3700v2 has external
BCM43228 wireless connected by PCIe.
Fallback SPROM isn't needed for this one because it has a physical SPROM.
By default both kmod-bcma and kmod-ssb are selected by kmod-b43.
However, only one of both modules is needed for bmips subtargets:
- bcma: bcm6318, bcm6328, bcm6362, bcm63268
- ssb: bcm6358, bcm6368
Stop using bmips b43-sprom fixups and switch to generic bcma/ssb fallback
SPROMs. This way we don't need to include the b43-sprom fixups on devices
without Broadcom wireless.
Daniel Kestrel [Fri, 17 Mar 2023 07:22:06 +0000 (08:22 +0100)]
generic: 5.15: replace ramips AR8033 fiber patch with 5.18 patches
A patch was added in kernel 5.4 to support the fiber operation of
AR8033 with ramips devices. In kernel 5.18 similar enhancements
were added to the kernel. Those patches are required for other
fiber based devices but when added, build fails for ramips targets.
This commit removes the ramips patch and adds the kernel 5.18 ones.
Signed-off-by: Daniel Kestrel <kestrel1974@t-online.de>
[ split commit,refresh patch and improve commit message ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Daniel Kestrel [Fri, 17 Mar 2023 07:22:06 +0000 (08:22 +0100)]
generic: 5.10: replace ramips AR8033 fiber patch with 5.18 patches
A patch was added in kernel 5.4 to support the fiber operation of
AR8033 with ramips devices. In kernel 5.18 similar enhancements
were added to the kernel. Those patches are required for other
fiber based devices but when added, build fails for ramips targets.
This commit removes the ramips patch and adds the kernel 5.18 ones.
Signed-off-by: Daniel Kestrel <kestrel1974@t-online.de>
[ split commit, refresh patch and improve commit title ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Flash instructions:
1. Execute the following operation to open nc shell:
https://openwrt.org/inbox/toh/tp-link/xdr-6086#rooting
2. Replace the stock bootloader to OpenWrt's:
dd bs=131072 conv=sync of=/dev/mtdblock9 if=/tmp/xxx-preloader.bin
dd bs=131072 conv=sync of=/dev/mtdblock9 seek=28 if=/tmp/xxx-bl31-uboot.fip
3. Connect to your PC via the Gigabit port of the router,
set a static ip on the ethernet interface of your PC.
(ip 192.168.1.254, gateway 192.168.1.1)
4. Download the initramfs image, and restart the router,
waiting for tftp recovery to complete.
5. After openwrt boots up, perform sysupgrade.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
[Add uboot build, fit and sysupgrade support, fix RealTek PHYs] Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Daniel Golle [Fri, 2 Dec 2022 04:29:58 +0000 (04:29 +0000)]
uboot-mediatek: add TP-Link TL-XDR4288 and TL-XDR608x
TP-Link TL-XDR608x comes with locked vendor loader. Add U-Boot build
for replacement loader for both TL-XDR6086 and TL-XDR6088. The only
difference at U-Boot level is the different filename requested via
TFTP, matching the corresponding OpenWrt build artifacts for each
device.
The TP-Link TL-XDR4288 has the same hardware as the TP-Link TL-XDR6088
except for the wireless part. Also create a uboot for the TP-Link
TL-XDR4288.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
[rebase to uboot 23.04, correct led and button] Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
* use interface mode switching only when operating in C45 mode
Linux prevents switching the interface mode when using C22 MDIO,
hence use rate-adapter mode in case the PHY controlled via C22.
* use phy_read_paged where appropriate
* use existing generic inline functions to handle 10GbE advertisements
instead of redundantly defining register macros in realtek.c which
are not actually vendor-specific.
* make sure 10GbE advertisement is valid, preventing false-positive
warning "Downshift occurred from negotiated speed 2.5Gbps to actual
speed 1Gbps, check cabling!" with some link-partners using 1G mode.
* Support Link Down Power Saving Mode (ALDPS)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Chukun Pan [Wed, 19 Oct 2022 15:16:30 +0000 (23:16 +0800)]
ramips: MSG1500 X.00: switch to mac-address-ascii dts
The Config partition of some machines is special, and the openwrt script
cannot read the protest_lan_mac correctly. This problem can be solved by
reading the mac address (ascii) in dts.
Due to us keeping a patch around for years and never proposing it to
squashfs4 repository, we resulted in having the same squashfs4 version
but with different supported options. (openwrt patched -- upstream)
To workaround this problem, a non-standard option was required.
To not have surprise on tool bump, backport the patch and add the new
config option required to enable these extended non-standard options.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Daniel Golle [Thu, 20 Apr 2023 10:31:49 +0000 (11:31 +0100)]
uboot-mediatek: fix factory/reset button
U-Boot commit ea6fdc13595 ("dm: button: add support for linux_code in
button-gpio.c driver") makes it mandatory to specify linux,code for all
buttons. As that broke handling of the reset button in U-Boot with the
update to U-Boot 2023.04, add linux,code for all butons.
Reported-by: @DragonBluep Fixes: 50f7c5af4a ("uboot-mediatek: update to v2023.04") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Daniel Golle [Tue, 18 Apr 2023 18:09:01 +0000 (19:09 +0100)]
mediatek: bpi-r3: allow up to 3W per SFP module
According to SinoVoip up to 3A @ 3.3V are available for both
SFP modules together. Raise energy limit from 1W (default) to 3W,
however, be aware that using modules consuming more than 1W will
require active cooling!
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
upstream PR 408 improvements:
-Fix AMSDU packets unused
-Removed the ASMDU packets queue
-Add more info in the iw tool
-fix is_hw_crypto_enabled
-Optimization AMPDU_TX_OPERATIONAL (avoid a spinlock)
Tony Butler [Wed, 30 Nov 2022 14:19:37 +0000 (06:19 -0800)]
tools/bzip2: add `bzip2` binaries
`bzip2` is the standard executable for bzip2 compression
this includes development includes and both static and shared libs
(libbz2) which can be used by other packages
the initramfs generator offers the BZIP2 option but there was no
executable to support it, and worked only via side effect of having a
system-installed version of bzip2, which could be less predictable
Signed-off-by: Tony Butler <spudz76@gmail.com>
[ remove unintended change ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Robert Marko [Tue, 18 Apr 2023 08:35:47 +0000 (10:35 +0200)]
mac80211: ath11k: replace 160MHz fix with upstream pending one
QCA has finally sent a proper fixup for the 160MHz regression upstream,
so lets use the pending fix which also properly sets center frequency 2
in case 80+80 MHz is used.
projects / thirdparty / openwrt.git / log
