RepoMirrors/openwrt
1
0
Fork 0
mirror of git://git.openwrt.org/openwrt/openwrt.git synced 2025-03-11 08:02:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
6e555ac3ad
openwrt/target/linux/ipq807x/image/generic.mk
INAGAKI Hiroshi f490295bf2
ipq807x: add support for Buffalo WXR-5950AX12 
Buffalo WXR-5950AX12 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on
IPQ8074A.

Specification:

- SoC         : Qualcomm IPQ8074A
- RAM         : DDR3 1024 MiB (2x Nanya NT5CC256M16ER-EK)
- Flash       : RAW NAND 256 MiB (Winbond W29N02GZBIBA)
- WLAN        : 2.4/5 GHz (IPQ8074A)
- Ethernet    : 5 ports
  - WAN       : 100/1000/2500/10000 Mbps x1 (AQR113C)
  - LAN       : 100/1000/2500/10000 Mbps x1 (AQR113C),
                10/100/1000 Mbps x3 (QCA8075)
- LED/Keys    : 8x/5x
- UART        : pin header on PCB (J7)
  - assignment: 3.3V, GND, TX, RX from disc marking
  - settings  : 115200n8
- Power       : 12 VDC, 4 A

Flash instruction using initramfs image:

1. Prepare TFTP server with IP address 192.168.11.10
2. Rename OpenWrt initramfs image to "WXR-5950AX12-initramfs.uImage and
   place it to TFTP directory
3. Hold AOSS (WPS) button and power on WXR-5950AX12
4. WXR-5950AX12 downloads initramfs image from TFTP server and boots
   with it automatically
5. Upload sysupgrade image to WXR-5950AX12 and perform sysupgrade
6. Wait ~120 seconds to complete flashing

Partition layout:

0x000000000000-0x000000100000 : "0:sbl1"
0x000000100000-0x000000200000 : "0:mibib"
0x000000200000-0x000000280000 : "0:bootconfig"
0x000000280000-0x000000300000 : "0:bootconfig1"
0x000000300000-0x000000600000 : "0:qsee"
0x000000600000-0x000000900000 : "0:qsee_1"
0x000000900000-0x000000980000 : "0:devcfg"
0x000000980000-0x000000a00000 : "0:devcfg_1"
0x000000a00000-0x000000a80000 : "0:apdp"
0x000000a80000-0x000000b00000 : "0:apdp_1"
0x000000b00000-0x000000b80000 : "0:rpm"
0x000000b80000-0x000000c00000 : "0:rpm_1"
0x000000c00000-0x000000c80000 : "0:cdt"
0x000000c80000-0x000000d00000 : "0:cdt_1"
0x000000d00000-0x000000d80000 : "0:appsblenv"
0x000000d80000-0x000000e80000 : "0:appsbl"
0x000000e80000-0x000000f80000 : "0:appsbl_1"
0x000000f80000-0x000001000000 : "0:art"
0x000001000000-0x000001080000 : "0:art_1"
0x000001080000-0x000001100000 : "0:orgdata"
0x000001100000-0x000001180000 : "0:orgdata_1"
0x000001180000-0x000005180000 : "rootfs"
0x000005180000-0x000009180000 : "rootfs_recover"
0x000009180000-0x000010000000 : "user_property"

Notes:

- WXR-5950AX12 has 2x OS images on NAND flash. The 1st image is for
  normal operation and the 2nd one is for recoverying or firmware
  upgrading on stock.

- Stock U-Boot checks MD5 hashes in "fw_hash" volume in each "root*"
  partition when booting. This is just a comparation of hash strings.

  Behaviors:

  - both "fw_hash" volumes exist, hashes are rootfs == rootfs_recover
    ---> boot from rootfs

  - both "fw_hash" volumes exist, hashes are rootfs != rootfs_recover
    ---> boot from rootfs_recover

    Note: this behavior is used for firmware upgrading on stock

  - "fw_hash" volume in rootfs is missing
    ---> boot from rootfs_recover

  - "fw_hash" volume in rootfs_recover is missing
    ---> boot from rootfs

  - "fw_hash" volumes in both root* partition are missing
    ---> boot from rootfs_recover

Reverting to stock firmware:

1. Decrypt official image by buffalo-enc and remove header

   example of decryption:

   $ buffalo-enc -i wxr_5950ax12_jp_305 -o wxr_5950ax12_jp_305.dec \
                 -d -k olaffuB -O 0xc8

   example of removing header (v3.05):

   - before

   $ hexdump -n 64 -v -C wxr_5950ax12_jp_305.dec
   00000000  57 58 52 2d 35 39 35 30  41 58 31 32 5f 33 2e 30  |WXR-5950AX12_3.0|
   00000010  35 5f 31 2e 30 31 5f 4a  50 5f 6a 70 5f 71 63 61  |5_1.01_JP_jp_qca|
   00000020  0a 66 69 6c 65 6c 65 6e  3d 34 35 33 35 30 39 31  |.filelen=4535091|
   00000030  32 0a 55 42 49 23 01 00  00 00 00 00 00 00 00 00  |2.UBI#..........|
   00000040

   - after

   $ hexdump -n 64 -v -C wxr_5950ax12_jp_305.ubi
   00000000  55 42 49 23 01 00 00 00  00 00 00 00 00 00 00 00  |UBI#............|
   00000010  00 00 08 00 00 00 10 00  78 cf c4 91 00 00 00 00  |........x.......|
   00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
   00000030  00 00 00 00 00 00 00 00  00 00 00 00 3d 2a 64 fd  |............=*d.|
   00000040

2. Boot WXR-5950AX12 with OpenWrt initramfs image

3. Upload modified stock image to WXR-5950AX12

4. Find partitions "rootfs" and "rootfs_recover"

   example:

   root@OpenWrt:/# cat /proc/mtd
   dev:    size   erasesize  name
   ...
   mtd22: 04000000 00020000 "rootfs"
   mtd23: 04000000 00020000 "rootfs_recover"
   ...

   in this case, "rootfs" is mtd22 and "rootfs_recover" is mtd23

5. Format "rootfs"/"rootfs_recover" partition with the uploaded image

   example:

   ubiformat /dev/mtd22 -f /tmp/wxr_5950ax12_jp_305.ubi
   ubiformat /dev/mtd23 -f /tmp/wxr_5950ax12_jp_305.ubi

6. Remove "rootfs"/"rootfs_data" volume from user_property partition

   example:

   . /lib/upgrade/nand.sh
   UBI=$(nand_attach_ubi user_property)
   ubirmvol /dev/$UBI -N rootfs
   ubirmvol /dev/$UBI -N rootfs_data

7. Reboot

MAC addresses:

LAN    : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text))
WAN    : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text))
2.4 GHz: 50:C4:DD:xx:xx:30 (0:APPSBLENV, wlan0addr (text))
5 GHz  : 50:C4:DD:xx:xx:38 (0:APPSBLENV, wlan1addr (text))

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2023-02-12 01:18:39 +01:00

147 lines
4.1 KiB
Makefile
Raw Blame History

define Device/FitImage
KERNEL_SUFFIX := -uImage.itb
KERNEL = kernel-bin | libdeflate-gzip | fit gzip $$(KDIR)/image-$$(DEVICE_DTS).dtb
KERNEL_NAME := Image
endef
define Device/FitImageLzma
KERNEL_SUFFIX := -uImage.itb
KERNEL = kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(DEVICE_DTS).dtb
KERNEL_NAME := Image
endef
define Device/UbiFit
KERNEL_IN_UBI := 1
IMAGES := factory.ubi sysupgrade.bin
IMAGE/factory.ubi := append-ubi
IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
endef
define Device/buffalo_wxr-5950ax12
$(call Device/FitImage)
$(call Device/UbiFit)
DEVICE_VENDOR := Buffalo
DEVICE_MODEL := WXR-5950AX12
BLOCKSIZE := 128k
PAGESIZE := 2048
DEVICE_DTS_CONFIG := config@hk01
SOC := ipq8074
DEVICE_PACKAGES := ipq-wifi-buffalo_wxr-5950ax12
endef
TARGET_DEVICES += buffalo_wxr-5950ax12
define Device/dynalink_dl-wrx36
$(call Device/FitImage)
$(call Device/UbiFit)
DEVICE_VENDOR := Dynalink
DEVICE_MODEL := DL-WRX36
BLOCKSIZE := 128k
PAGESIZE := 2048
DEVICE_DTS_CONFIG := config@rt5010w-d350-rev0
SOC := ipq8072
DEVICE_PACKAGES := ipq-wifi-dynalink_dl-wrx36
endef
TARGET_DEVICES += dynalink_dl-wrx36
define Device/edgecore_eap102
$(call Device/FitImage)
$(call Device/UbiFit)
DEVICE_VENDOR := Edgecore
DEVICE_MODEL := EAP102
BLOCKSIZE := 128k
PAGESIZE := 2048
DEVICE_DTS_CONFIG := config@ac02
SOC := ipq8071
DEVICE_PACKAGES := ipq-wifi-edgecore_eap102
IMAGE/factory.ubi := append-ubi | qsdk-ipq-factory-nand
endef
TARGET_DEVICES += edgecore_eap102
define Device/edimax_cax1800
$(call Device/FitImage)
$(call Device/UbiFit)
DEVICE_VENDOR := Edimax
DEVICE_MODEL := CAX1800
BLOCKSIZE := 128k
PAGESIZE := 2048
DEVICE_DTS_CONFIG := config@ac03
SOC := ipq8070
DEVICE_PACKAGES := ipq-wifi-edimax_cax1800
endef
TARGET_DEVICES += edimax_cax1800
define Device/qnap_301w
$(call Device/FitImage)
DEVICE_VENDOR := QNAP
DEVICE_MODEL := 301w
DEVICE_DTS_CONFIG := config@hk01
KERNEL_SIZE := 16384k
BLOCKSIZE := 512k
SOC := ipq8072
IMAGES += factory.bin sysupgrade.bin
IMAGE/factory.bin := append-rootfs | pad-rootfs | pad-to 64k
IMAGE/sysupgrade.bin/squashfs := append-rootfs | pad-to 64k | sysupgrade-tar rootfs=$$$$@ | append-metadata
DEVICE_PACKAGES := ipq-wifi-qnap_301w e2fsprogs kmod-fs-ext4 losetup
endef
TARGET_DEVICES += qnap_301w
define Device/redmi_ax6
$(call Device/xiaomi_ax3600)
DEVICE_VENDOR := Redmi
DEVICE_MODEL := AX6
DEVICE_PACKAGES := ipq-wifi-redmi_ax6
endef
TARGET_DEVICES += redmi_ax6
define Device/xiaomi_ax3600
$(call Device/FitImage)
$(call Device/UbiFit)
DEVICE_VENDOR := Xiaomi
DEVICE_MODEL := AX3600
BLOCKSIZE := 128k
PAGESIZE := 2048
DEVICE_DTS_CONFIG := config@ac04
SOC := ipq8071
KERNEL_SIZE := 36608k
DEVICE_PACKAGES := ipq-wifi-xiaomi_ax3600 kmod-ath10k-ct-smallbuffers ath10k-firmware-qca9887-ct
ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
ARTIFACTS := initramfs-factory.ubi
ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-uImage.itb | ubinize-kernel
endif
endef
TARGET_DEVICES += xiaomi_ax3600
define Device/xiaomi_ax9000
$(call Device/FitImage)
$(call Device/UbiFit)
DEVICE_VENDOR := Xiaomi
DEVICE_MODEL := AX9000
BLOCKSIZE := 128k
PAGESIZE := 2048
DEVICE_DTS_CONFIG := config@hk14
SOC := ipq8072
KERNEL_SIZE := 57344k
DEVICE_PACKAGES := ipq-wifi-xiaomi_ax9000 kmod-ath11k-pci ath11k-firmware-qcn9074 \
kmod-ath10k-ct ath10k-firmware-qca9887-ct
ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
ARTIFACTS := initramfs-factory.ubi
ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-uImage.itb | ubinize-kernel
endif
endef
TARGET_DEVICES += xiaomi_ax9000
define Device/zyxel_nbg7815
$(call Device/FitImage)
DEVICE_VENDOR := ZYXEL
DEVICE_MODEL := NBG7815
DEVICE_DTS_CONFIG := config@nbg7815
BLOCKSIZE := 128k
PAGESIZE := 2048
SOC := ipq8074
IMAGES += factory.bin sysupgrade.bin
IMAGE/factory.bin := append-rootfs | pad-rootfs | pad-to 64k
IMAGE/sysupgrade.bin/squashfs := append-rootfs | pad-to 64k | sysupgrade-tar rootfs=$$$$@ | append-metadata
DEVICE_PACKAGES := ipq-wifi-zyxel_nbg7815 kmod-ath11k-pci e2fsprogs kmod-fs-ext4 losetup kmod-hwmon-tmp103
endef
TARGET_DEVICES += zyxel_nbg7815
Reference in New Issue View Git Blame Copy Permalink