For DHCPv6 address requests (IA_NA), odhcp6c currently uses the first eight
digits of the i/f name's MD5 hash as IAID.
In case of DHCPv6-PD, however, odhcp6c expects the IAID to be specified
explicitly for the IA_PD(s) requested, otherwise it will start counting the
IAID from "1" up for each "-P" argument.
As OpenWrt only requests a single IA_PD per interface, make sure to pass
the identical IAID for IA_PD as is used for IA_NA, unless a custom IAID
was explicitly specified in the i/f configuration.
This prevents regressions with ISPs that expect an IA_PD request to come
from the same IAID+DUID combination as the IA_NA request.
In addition, add some validation of the "reqprefix" value, in order to
catch most cases that would otherwise result in netifd or odhcp6c
malfunction.
Signed-off-by: Shine <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23758
Signed-off-by: Robert Marko <robimarko@gmail.com>
-----
Hardware:
CPU: ARMADA 380 1x1332Mhz
RAM: 512MB DDR3
FLASH: 256MB MX30LF2G18AC
2x SATA III
2x USB3.0
1x USB2.0
i2c to control various states.
RTC with battery
1Gbit LAN (WoL capable)
9x LED
RESET button at back
Power button at front (gpio-poweroff)
Copy button at front
-----
Doesn't work
FAN control
buzzer
-----
UART connections
Connect UART to port J3 115200
+----+----+----+----+----+
|3.3V| TX | RX | | GND|
+----+----+----+ +----+
Depend of UART adapter board can fail to boot when adapter is attached. (all leds are dimmed) .
In that case disconnect UART for an < second and after that all leds should be white.
Stop u-boot by ctrl-c within 3s window. (bootdelay 7s or more helps)
setenv bootdelay 7
saveenv
-----
Instalation via UART
Boot initramfs-kernel.bin
setenv ethact egiga0
setenv serverip 192.168.1.11
setenv ipaddr 192.168.1.12
tftpboot 0x02000000 *initramfs-kernel.bin
bootm 0x02000000 -
Device is DHCP client by default ( as the other supported NAS)
do backup into safe space
/dev/mtd3 Kernel-1
/dev/mtd4 RootFS-1
use sysupgrade in console or via luci
-----
MAC addresses
mac stored in u-boot-env ethaddr
label mac = eth0 mac = 5c:6a:80:xx:xx:xx
-----
Setting up u-boot dual boot
u-boot contain two banks contain two OEM copies
To boot OpenWrt from bank1
setenv next_bootfrom 1
saveenv
To boot OEM from bank2
setenv next_bootfrom 2
saveenv
-----
Configuration via i2c
install i2c-tools
Enable WoL
i2cset -y 0x0 0xa 0xa 0x0006 w
Disable WoL
i2cset -y 0x0 0xa 0xa 0x0306 w
Enable auto power on
i2cset -y 0x0 0x0a 0x0a 0x0107 w
Disable auto power on
i2cset -y 0x0 0x0a 0x0a 0x0007 w
Signed-off-by: Robert Senderek <robert.senderek@10g.pl>
Link: https://github.com/openwrt/openwrt/pull/23228
Signed-off-by: Robert Marko <robimarko@gmail.com>
Split kmod-nf-nathelper-extra into separate helper packages
and keep the original package as a compatibility meta-package.
This allows selecting only the required protocol helpers
instead of installing all helper modules and dependencies.
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/23690
Signed-off-by: Robert Marko <robimarko@gmail.com>
The DUID-UUID was generated from a random UUID, which is regenerated on
every fresh flash and therefore does not survive reconfiguration events
such as reflashing without keeping the configuration. RFC8415/RFC6355
prefer a DUID that remains stable across such events.
Add a ucode helper that picks the first LAN port (falling back to WAN)
from /etc/board.json, resolves its MAC address and derives a stable UUID
from it, falling back to a random UUID only when that fails.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
proto/dhcp.sh hardcoded `-t 0` (infinite retries) with no way
for UCI / operator to tune per-retry interval (udhcpc -T),
retry count (udhcpc -t) or failure retry-loop wait (udhcpc -A).
Add three new proto config ints (timeout, retry, tryagain)
and thread them into the udhcpc command line. Unset options
preserve existing behaviour: retry defaults to 0, timeout and
tryagain are omitted so udhcpc uses its own RFC defaults.
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
When bridge VLAN filtering is active, network_get_physdev resolves
UCI interface names to the VLAN sub-interface (e.g. br-lanv0) rather
than the bridge master. LLDP frames use reserved multicast
(01:80:c2:00:00:0e) which bridges trap to member ports, so lldpd
must listen on the physical ports to receive them.
Detect when the resolved device is a sub-interface of a bridge and
expand it to the list of bridge member ports instead.
Signed-off-by: John Crispin <john@phrozen.org>
9ff6e43bb75f service: notify instance exit details via ubus
4f42296dc4f0 jail: mount rootfs overlay with userxattr in user namespace
60fdbf00e924 jail: chown rootfs overlay dir to mapped root in user namespace
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Only print VHT/HE/EHT center frequency and channel width fields
when they are actually populated. This avoids displaying undefined
values for non-6GHz HE results where channel info is derived from
VHT/HT Operation IEs. Also fix center_chan_2 format specifier from
%s to %d.
Signed-off-by: John Crispin <john@phrozen.org>
Add a proto_dhcp_restart() handler that re-acquires the DHCP lease via a
single ubus call, releasing the previous lease and triggering a fresh
DHCPDISCOVER without bouncing the interface.
The re-acquire is implemented by sending SIGHUP to udhcpc, which releases
the current lease (if any) and immediately transitions the state machine
to INIT_SELECTING so the next main-loop iteration sends a fresh
DHCPDISCOVER. A single signal thus expresses 'release this lease and get
a new one' without exiting the client, so upstream watchdogs (e.g. a
DNS-health monitor) can request a clean re-lease without tearing down the
interface.
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The supplicant config generator read eap_type and auth from UCI for
internal logic but never wrote the corresponding eap= and phase2=
directives to the wpa_supplicant config.
Fix by:
- Generating eap= and phase2= from eap_type/auth for PEAP/TTLS/FAST/TLS
- Adding eap and phase2 to the network_append_vars output list
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
cell.he was only populated when the 6 GHz Operation Information
sub-element was parsed, making HE invisible to scan results on
2.4/5 GHz bands. Fix this by setting cell.he unconditionally when
HE Operation IE (Extension Element 36) is seen.
Gate 6 GHz channel width parsing on cell.band rather than the HE
Operation Parameters bit field, which proved unreliable on MediaTek
firmware. Fix flag byte offsets in the 6 GHz path: VHT Oper Info
Present (BIT 14) and Co-Hosted BSS (BIT 15) are in byte 1 of
he_oper_params which maps to ext[2], not ext[1].
For non-6GHz bands, derive channel width from the already-parsed
VHT/HT Operation IEs instead of leaving cell.he empty.
Signed-off-by: John Crispin <john@phrozen.org>
abfaaac65929 netifd: fix const-discard warnings in attr/devtype parsing
52c7db3a2beb bridge: remove kernel member on teardown regardless of device claim state
741fd3c162df bridge: attempt delbr unconditionally on bridge destroy
2909720f8cf1 system-linux: detach device from stale bridge before adding it
67f06ef1600a interface: detach hotplug members on reassignment
bb7f0a456dce interface-ip: skip offlink handling on point-to-point links
c1f9d4df847a system-linux: guard PSE port priority for older kernel headers
b087b0773366 build: prefer libnl-tiny and fix LIBNL detection on reconfigure
b0063715d7ea device: add broadcast_flood bridge port setting
973354a1a6f0 interface: add carrier_loss_delay option
d155e4cefbd9 interface: add restart support
Signed-off-by: Felix Fietkau <nbd@nbd.name>
A patch was added without proper header and not obvious that it's a
backport. Replace that patch with a backport of the upstream commit.
Patch 001-build-simplify-the-instantiation-of-nftversion-h.patch
rebased, all others refreshed.
Fixes: 255f4c8e60 ("packages: nftables: fix build on host with busybox ash")
Link: https://github.com/openwrt/openwrt/pull/23910
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Bump the PKG_RELEASE as it was missed when adding a patch.
Fixes: 255f4c8e60 ("packages: nftables: fix build on host with busybox ash")
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Due to POSIX style ioctl() declaration in MUSL, arm-trusted-firmware-tools
fails to build on MUSL based hosts with -Werror and -pedantic GCC switches
enabled. Alpine Linux, for example, fixes this with an unconditional cast
to "int". This commit tries to apply this cast only for MUSL based build
hosts, while keeping the type as-is where the cast isn't needed. Maybe
overkill, but cleaner than an unconditional cast.
Fixes: #13339
Signed-off-by: Shine <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/21957
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This commit introduces OpenWrt U-Boot all-in-ubi layout support
for the CreatLentem CLT-R30B1, enabling:
- Fully-featured U-Boot
- Effective recovery mechanisms
- Prolonged device lifetime by allocating most of the flash
to UBI (which takes care of wear-leveling)
- Maximum available storage space for OpenWrt
- Unified firmware across different device variants
OpenWrt U-Boot UBI flash instructions
-------------------------------------
Using the installer image
-------------------------
To simplify the installation process, this method uses a fork
of Daniel Golle's (@dangowrt) UBI Installer
https://github.com/dangowrt/owrt-ubi-installer
1. Ensure your router is running the latest generic OpenWrt firmware.
Upgrade it if necessary.
2. Obtain the installer image:
Build the installer from source
https://github.com/andros-ua/owrt-ubi-installer/tree/clt-r30b1
or download a prebuilt image from the
https://github.com/andros-ua/owrt-ubi-installer/releases
3. Flash the openwrt*creatlentem_clt-r30b1-ubi-initramfs-recovery-installer.itb
image using sysupgrade.
4. Wait for installation: the green status LED will blink rapidly,
indicating that the all-in-UBI installer is running.
5. Once the installation finishes,
the status LED will turn solid white (lime) for 5 seconds.
6. After the device reboots, perform a final sysupgrade using the
openwrt*creatlentem_clt-r30b1-ubi-squashfs-sysupgrade.itb image.
Return to stock layout
----------------------
1. Flash openwrt*creatlentem_clt-r30b1(-112m)-initramfs-kernel.bin
via sysupgrade
2. Copy files to /tmp on the device via SCP:
BL2.bin
u-boot-env.bin
Factory.bin
FIP.bin
openwrt*creatlentem_clt-r30b1(-112m)-squashfs-sysupgrade.bin
3. Restore stock MTD partitions:
apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd write /tmp/BL2.bin BL2
mtd write /tmp/u-boot-env.bin u-boot-env
mtd write /tmp/Factory.bin Factory
mtd write /tmp/FIP.bin FIP
4. Install the system:
sysupgrade /tmp/*sysupgrade.bin
Recovery
--------
Use mtk_uartboot to recover corrupted BL2 or FIP via UART:
https://github.com/981213/mtk_uartboot
Stock layout
----------------------------------------
| dev: size erasesize name |
| mtd0: 00100000 00020000 "BL2" |
| mtd1: 00080000 00020000 "u-boot-env" |
| mtd2: 00200000 00020000 "Factory" |
| mtd3: 00200000 00020000 "FIP" |
| mtd4: 07000000 00020000 "ubi" |
----------------------------------------
OpenWrt U-Boot UBI layout
----------------------------------
| dev: size erasesize name |
| mtd0: 00100000 00020000 "BL2" |
| mtd1: 07f00000 00020000 "ubi" |
----------------------------------
Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20666
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This board is the control board for the Antminer S9 miners.
SoC: Xilinx XC7Z010 - dual-core Cortex-A9 with FPGA stack
Memory: 512Mb DDR3
NIC: 1Gbit ethernet (BCM B50612E PHY)
Flash: 256Mb NAND (Micron MT29F2G08ABAEAWP)
Storage: SD-card slot
Other: control pins available via FPGA stack
Admittedly, there is a limited number of use cases available
for these boards outside of the miners and the lack of FPGA
tooling in OpenWrt. However, for one, they are easily and cheaply
available, for two, the reason for adding this is to provide an
easy addition to the boardfarm for continuous testing of this target.
Notes: For u-boot, an additional patch is required to support
booting from SD-cards. This is because EXTRA_ENV_SETTINGS is
already defined in the board's u-boot config, which is the same
place where the zynq-common.dtsi defines the required envvars.
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
This is a dual-radio 802.11a/b/g/n/ac access point with
dual Gigabit Ethernet.
There are two closely related models: The AP-324, which has external
antenna connectors, and the AP-325, which has internal antennas.
The board appears to be identical, and the same image works on both.
Additionally, the Siemens Scalance W1750D is an OEM variant using
the same board, so the image also works on that.
Unfortunately the factory APBoot bootloader enforces cryptographic
signatures on the firmware before booting, so a modified version
must be flashed via the serial port. See [^1] for details.
Specifications
==============
* Device: Aruba AP-325 / AP-324
* SoC: Qualcomm IPQ8068 2x1.4GHz ARMv7-A
* RAM: 512MiB (2x Winbond W632GU6MB-12)
* SPI flash: 4MiB Macronix MX25U3235F
* NAND flash: 128MiB Winbond W29N01HZBINF
* WiFi: 2x Qualcomm QCA9990 (one 2.4G, one 5G)
* Ethernet: 2x 1000BASE-T (Marvell 88E1514 PHY), both PoE-capable
* Power: PoE 802.3at or 12V DC jack
* LEDs: Red/Amber/Green status LED, Amber/Green WiFi LED
* Buttons: 1x, behind hole next to DC jack
* Console: RJ45 connector, Cisco pinout
* USB: 1x USB 2.0 Type A, 1x internal to BLE, SoC has USB 3.0
host but board is only wired for 2.0
* BLE: TI CC2540 SoC, connected to USB and UART, unpopulated
debug header on PCB
* TPM: Atmel AT97SC3205T
How to install
==============
The stock bootloader APBoot appears to be vendor fork of U-Boot, which
disables much of the usual functionality and comes with its own booting
and firmware upgrade logic.
Unfortunately, this logic enforces RSA signatures on images,
even for the default boot from NAND.
Therefore, a patched bootloader is needed, which is built as a package.
In addition to the signature check removal, this also changes
the serial baudrate to 115200.
Luckily, the stock firmware does not disable the `sf` command
(it just hides it until you run `diag`), so the patched bootloader
can be fetched via TFTP and then flashed via console.
Flashing patched APBoot
-----------------------
* Build OpenWrt, or download `openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn`
* Connect serial cable and wired ethernet
* Access stock APBoot console at Baud 9600
* Flash patched bootloader:
```
setenv serverip <your TFTP server IP>
setenv autostart n
netget 44000000 openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn
sf probe 0
sf erase 220000 100000
sf write 44000000 220000 100000
reset
```
Booting OpenWrt
---------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Run `setenv serverip <your TFTP server IP>`
* Run `tftpboot openwrt-ipq806x-generic-aruba_ap-32x-initramfs.ari`
Installing OpenWrt
------------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Consider backing up stock firmware(s) (UBI volumes `aos0` and/or `aos1`)
by booting into OpenWrt via initramfs (see above) and dumping them
* Wipe and repartition NAND flash (see below for explanation):
```
nand device 0
nand erase.chip
reset
ubi part ubifs
ubi remove ubifs
ubi create ubifs 1
ubi create rootfs_data
```
* Follow steps above to boot OpenWrt via initramfs
* From OpenWrt, persist installation via sysupgrade
Reverting to stock FW
---------------------
The patched bootloader remains compatible with the original firmware,
so you can just wipe the NAND, let APBoot recreate the partitions,
and flash back the `aos0`/`aos1` backup from above.
Current status
==============
Tested and working
------------------
* Console
* Wired GbE (both ports)
* WiFi (both 2.4G and 5G)
* LEDs
* Restart Button
* USB port
* External watchdog
* TPM
* BLE SoC
Future work
-----------
* GPIOs for:
* power source (8 indicates DC jack, 59 indicates 802.3at)
* reset source (64 for warm reset, 65 for watchdog)
* USB overcurrent (63)
* BLE SoC reflashing
* CC2540 comes with Aruba-specific FW out of the box
* Debug header is exposed on PCB (pinout GND-VCC-Clock-Data-Reset),
but that requires disassembly
* Stock BLE FW appears to support reflashing via UART, but protocol
would need to be reverse-engineered
* ramoops/pstore
* It appears that APBoot clears the RAM on boot, might be something
we can patch out as well
* Porting a modern U-Boot
Flash layout
============
SPI flash
---------
```
0x000000-0x020000 sbl1
0x020000-0x040000 mibib
0x040000-0x080000 sbl2
0x080000-0x100000 sbl3
0x100000-0x110000 ddrconfig
0x110000-0x120000 ssd
0x120000-0x1a0000 tz
0x1a0000-0x220000 rpm
0x220000-0x320000 appsbl
0x320000-0x330000 appsblenv
0x330000-0x370000 art
0x370000-0x380000 panicdump
0x380000-0x390000 certificate
0x390000-0x3a0000 mfginfo
0x3a0000-0x3b0000 flashcache
0x3b0000-0x400000 aosspare
```
Factory NAND flash
------------------
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains kernel+initrd of the primary firmware,
initrd contains the entire root FS
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains kernel+initrd of the secondary firmware,
initrd contains the entire root FS
* 64MiB MTD partition `ubifs`, formatted as UBI
* 64MiB UBI volume `ubifs`
* Contains UBIFS, overlay-mounted on top of the initrd,
shared between firmware slots
APBoot understands UBI, and will read the kernel from the
`aos0` or `aos1` volume (depending on `os_partition`)
with fallback to the other one in case a check fails.
Kernels are expected to have a vendor-specific header, the included
script will add that header with the correct checksum but no signature.
OpenWrt NAND flash
------------------
OpenWrt assumes separate UBI volumes for kernel and rootfs,
as well as a volume that must be named `rootfs_data` for the UBIFS.
Unfortunately, APBoot actively checks the UBI volumes at boot, and will
repartition if it doesn't find the volumes that it expects (listed above).
Luckily, it doesn't check their size, only their existence. Therefore,
we can use the following layout:
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains OpenWrt kernel+initrd
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains OpenWrt root squashfs
* 64MiB MTD partition `ubifs`, formatted as UBI
* small (single-LEB) UBI volume `ubifs`
* Dummy volume, only there to satisfy APBoot
* almost 64MiB UBI volume `rootfs_data`
* contains UBIFS, overlay-mounted on top of the rootfs
[^1]: https://github.com/lukasstockner/ap325-apboot-openwrt
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Paul Spooren <mail@aparcar.org>
On the AP-325 (and variants), the bootloader enforces a particular UBI volume
layout and naming, so unfortunately the kernel's UBI volume and MTD partition
end up with the name, which confuses the current logic.
Therefore, add an option to ignore the MTD partition.
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Paul Spooren <mail@aparcar.org>
The current code assumes that the rootfs_data UBI volume is on the same MTD
partition as the rootfs.
Unfortunately, this does not work on the Aruba AP-325 (and variants), since
the bootloader enforces a particular UBI volume layout.
Therefore, this adds a separate variable to set the rootfs_data partition,
and updates all existing devices with a non-default rootfs partition to also
specify the new variable.
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Paul Spooren <mail@aparcar.org>
This is a dual-radio 802.11a/b/g/n/ac access point with
dual Gigabit Ethernet.
There are two closely related models: The AP-324, which has external
antenna connectors, and the AP-325, which has internal antennas.
The board appears to be identical, and the same image works on both.
Additionally, the Siemens Scalance W1750D is an OEM variant using
the same board, so the image also works on that.
Unfortunately the factory APBoot bootloader enforces cryptographic
signatures on the firmware before booting, so a modified version
must be flashed via the serial port. See [^1] for details.
Specifications
==============
* Device: Aruba AP-325 / AP-324
* SoC: Qualcomm IPQ8068 2x1.4GHz ARMv7-A
* RAM: 512MiB (2x Winbond W632GU6MB-12)
* SPI flash: 4MiB Macronix MX25U3235F
* NAND flash: 128MiB Winbond W29N01HZBINF
* WiFi: 2x Qualcomm QCA9990 (one 2.4G, one 5G)
* Ethernet: 2x 1000BASE-T (Marvell 88E1514 PHY), both PoE-capable
* Power: PoE 802.3at or 12V DC jack
* LEDs: Red/Amber/Green status LED, Amber/Green WiFi LED
* Buttons: 1x, behind hole next to DC jack
* Console: RJ45 connector, Cisco pinout
* USB: 1x USB 2.0 Type A, 1x internal to BLE, SoC has USB 3.0
host but board is only wired for 2.0
* BLE: TI CC2540 SoC, connected to USB and UART, unpopulated
debug header on PCB
* TPM: Atmel AT97SC3205T
How to install
==============
The stock bootloader APBoot appears to be vendor fork of U-Boot, which
disables much of the usual functionality and comes with its own booting
and firmware upgrade logic.
Unfortunately, this logic enforces RSA signatures on images,
even for the default boot from NAND.
Therefore, a patched bootloader is needed, which is built as a package.
In addition to the signature check removal, this also changes
the serial baudrate to 115200.
Luckily, the stock firmware does not disable the `sf` command
(it just hides it until you run `diag`), so the patched bootloader
can be fetched via TFTP and then flashed via console.
Flashing patched APBoot
-----------------------
* Build OpenWrt, or download `openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn`
* Connect serial cable and wired ethernet
* Access stock APBoot console at Baud 9600
* Flash patched bootloader:
```
setenv serverip <your TFTP server IP>
setenv autostart n
netget 44000000 openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn
sf probe 0
sf erase 220000 100000
sf write 44000000 220000 100000
reset
```
Booting OpenWrt
---------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Run `setenv serverip <your TFTP server IP>`
* Run `tftpboot openwrt-ipq806x-generic-aruba_ap-32x-initramfs.ari`
Installing OpenWrt
------------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Consider backing up stock firmware(s) (UBI volumes `aos0` and/or `aos1`)
by booting into OpenWrt via initramfs (see above) and dumping them
* Wipe and repartition NAND flash (see below for explanation):
```
nand device 0
nand erase.chip
reset
ubi part ubifs
ubi remove ubifs
ubi create ubifs 1
ubi create rootfs_data
```
* Follow steps above to boot OpenWrt via initramfs
* From OpenWrt, persist installation via sysupgrade
Reverting to stock FW
---------------------
The patched bootloader remains compatible with the original firmware,
so you can just wipe the NAND, let APBoot recreate the partitions,
and flash back the `aos0`/`aos1` backup from above.
Current status
==============
Tested and working
------------------
* Console
* Wired GbE (both ports)
* WiFi (both 2.4G and 5G)
* LEDs
* Restart Button
* USB port
* External watchdog
* TPM
* BLE SoC
Future work
-----------
* GPIOs for:
* power source (8 indicates DC jack, 59 indicates 802.3at)
* reset source (64 for warm reset, 65 for watchdog)
* USB overcurrent (63)
* BLE SoC reflashing
* CC2540 comes with Aruba-specific FW out of the box
* Debug header is exposed on PCB (pinout GND-VCC-Clock-Data-Reset),
but that requires disassembly
* Stock BLE FW appears to support reflashing via UART, but protocol
would need to be reverse-engineered
* ramoops/pstore
* It appears that APBoot clears the RAM on boot, might be something
we can patch out as well
* Porting a modern U-Boot
Flash layout
============
SPI flash
---------
```
0x000000-0x020000 sbl1
0x020000-0x040000 mibib
0x040000-0x080000 sbl2
0x080000-0x100000 sbl3
0x100000-0x110000 ddrconfig
0x110000-0x120000 ssd
0x120000-0x1a0000 tz
0x1a0000-0x220000 rpm
0x220000-0x320000 appsbl
0x320000-0x330000 appsblenv
0x330000-0x370000 art
0x370000-0x380000 panicdump
0x380000-0x390000 certificate
0x390000-0x3a0000 mfginfo
0x3a0000-0x3b0000 flashcache
0x3b0000-0x400000 aosspare
```
Factory NAND flash
------------------
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains kernel+initrd of the primary firmware,
initrd contains the entire root FS
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains kernel+initrd of the secondary firmware,
initrd contains the entire root FS
* 64MiB MTD partition `ubifs`, formatted as UBI
* 64MiB UBI volume `ubifs`
* Contains UBIFS, overlay-mounted on top of the initrd,
shared between firmware slots
APBoot understands UBI, and will read the kernel from the
`aos0` or `aos1` volume (depending on `os_partition`)
with fallback to the other one in case a check fails.
Kernels are expected to have a vendor-specific header, the included
script will add that header with the correct checksum but no signature.
OpenWrt NAND flash
------------------
OpenWrt assumes separate UBI volumes for kernel and rootfs,
as well as a volume that must be named `rootfs_data` for the UBIFS.
Unfortunately, APBoot actively checks the UBI volumes at boot, and will
repartition if it doesn't find the volumes that it expects (listed above).
Luckily, it doesn't check their size, only their existence. Therefore,
we can use the following layout:
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains OpenWrt kernel+initrd
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains OpenWrt root squashfs
* 64MiB MTD partition `ubifs`, formatted as UBI
* small (single-LEB) UBI volume `ubifs`
* Dummy volume, only there to satisfy APBoot
* almost 64MiB UBI volume `rootfs_data`
* contains UBIFS, overlay-mounted on top of the rootfs
[^1]: https://github.com/lukasstockner/ap325-apboot-openwrt
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Test Dev <dev@example.org>
On the AP-325 (and variants), the bootloader enforces a particular UBI volume
layout and naming, so unfortunately the kernel's UBI volume and MTD partition
end up with the name, which confuses the current logic.
Therefore, add an option to ignore the MTD partition.
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Test Dev <dev@example.org>
The current code assumes that the rootfs_data UBI volume is on the same MTD
partition as the rootfs.
Unfortunately, this does not work on the Aruba AP-325 (and variants), since
the bootloader enforces a particular UBI volume layout.
Therefore, this adds a separate variable to set the rootfs_data partition,
and updates all existing devices with a non-default rootfs partition to also
specify the new variable.
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Test Dev <dev@example.org>
This commit fixes "286f377389a button-hotplug: add KEY_SETUP and KEY_VENDOR
handling" which changed the code without bumping the PKG_RELEASE, resulting in
different binaries under the same version.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Link: https://github.com/openwrt/openwrt/pull/23826
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
This commit fixes "a5107ad58c6 mtd: fix buffer leak and fd leak in mtd_dump()"
which changed the code but did not increase the release. This causes two
packages with the same version to have different content and thereby hashes.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Link: https://github.com/openwrt/openwrt/pull/23827
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Add basic support for the TP-Link SG2008P V3 variant. The switch appears
to be identical to the V1 variant, except that it uses the MP3924
instead of the TPS23861 PoE chip.
Specifications:
---------------
* SoC: Realtek RTL8380M
* Flash: 32 MiB SPI flash (Vendor varies)
* RAM: 256 MiB (Vendor varies)
* Ethernet: 8x 10/100/1000 Mbps with PoE on 4 ports
* Buttons: 1x "Reset" button on front panel
* Power: 53.5V DC barrel jack
* UART: 1x serial header, unpopulated
* PoE: 1x MPS MP3924 I2C PoE controller
Works:
------
- (8) RJ-45 ethernet ports
- Switch functions
- System LED
- Basic PoE support (no driver, but a startup script puts the chip
into AUTO mode)
Not yet enabled:
----------------
- PoE, Link/Act, PoE max and System LEDs
Install via web interface:
-------------------------
Not supported at this time.
Install via serial console/tftp:
--------------------------------
The footprints R27 (0201) and R28 (0402) are not populated. To enable
serial console, 50 ohm resistors should be soldered -- any value from
0 ohm to 50 ohm will work. R27 can be replaced by a solder bridge.
The u-boot firmware drops to a TP-Link specific "BOOTUTIL" shell at
38400 baud. There is no known way to exit out of this shell, and no
way to do anything useful.
Ideally, one would trick the bootloader into flashing the sysupgrade
image first. However, if the image exceeds 6MiB in size, it will not
work. The sysupgrade image can also be flashed. To install OpenWRT:
Prepare a tftp server with:
1. server address: 192.168.0.146
2. the image as: "uImage.img"
Power on device, and stop boot by pressing any key.
Once the shell is active:
1. Ground out the CLK (pin 16) of the ROM (U7)
2. Select option "3. Start"
3. Bootloader notes that "The kernel has been damaged!"
4. Release CLK as sson as bootloader thinks image is corrupted.
5. Bootloader enters automatic recovery -- details printed on console
6. Watch as the bootloader flashes and boots OpenWRT.
Blind install via tftp:
-----------------------
This method works when it's not feasible to install a serial header.
Prepare a tftp server with:
1. server address: 192.168.0.146
2. the image as: "uImage.img"
3. Watch network traffic (tcpdump or wireshark works)
4. Power on the device.
5. Wait 1-2 seconds then ground out the CLK (pin 16) of the ROM (U7)
6. When 192.168.0.30 makes tftp requests, release pin 16
7. Wait 2-3 minutes for device to auto-flash and boot OpenWRT
Signed-off-by: Daniel Tang <tangrs@google.com>
Link: https://github.com/openwrt/openwrt/pull/20616
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
handle_send_a() computed the SRP "A" parameter length as
len = ntohl(msg->len) - sizeof(struct ead_msg_number);
sizeof(struct ead_msg_number) is 1, and the subtraction is evaluated in
unsigned arithmetic. A packet with msg->len == 0 therefore wraps the
result to a huge value which, assigned to the signed int len, becomes -1.
The following bounds check is signed:
if (len > MAXPARAMLEN + 1)
return false;
so -1 passes, and memcpy(A.data, number->data, len) runs with len cast to
size_t (~SIZE_MAX) against the 257-byte abuf, crashing the daemon.
Neither parse_message() nor handle_packet() validate msg->len (only the
captured packet length), so an unauthenticated attacker on the local
segment can reach this path and crash ead with a single crafted packet.
Validate the claimed length in unsigned arithmetic before the subtraction
and bound it on both sides. Doing the upper-bound check unsigned as well
also closes a 32-bit-only variant where sizeof(ead_packet) + msg->len
overflows in handle_packet(), letting a large msg->len reach the same
negative-len path.
Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw
Reported-by: @Vasco0x4
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
When growing the segment array in find_entry(), the memset() that zeroes
the newly allocated slots computed the destination with redundant sizeof
scaling:
memset(segments + (num_segments * sizeof(struct tffs_entry_segment)), ...)
segments is a typed pointer, so pointer arithmetic already scales by the
element size. Multiplying the offset by sizeof again advances the
destination by num_segments * sizeof^2 bytes, landing far outside the
realloc()'d buffer and zeroing unrelated heap memory whenever a TFFS
entry spans multiple segments that require array expansion.
Drop the redundant multiplication so the memset targets segments[num_segments].
This is a robustness fix for malformed/corrupt TFFS content; the parser
only reads the on-device nand-tffs MTD partition as root, so it is not
considered security relevant.
Reported-by: @Vasco0x4
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/23763
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Backport two upstream commits that replace memset() on coherent DMA
descriptor rings with explicit WRITE_ONCE() status word stores.
On 32-bit PowerPC platforms like apm821xx, coherent DMA memory may be
mapped uncached. The optimized memset() path can use dcbz there, which
triggers alignment warnings and spams the kernel log.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23776
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Shine
Robert Senderek
Mieczyslaw Nalewaj
Felix Fietkau
John Crispin
Thomas Weißschuh
Hauke Mehrtens
Chad Monroe
Jonas Jelonek
Andrii Kuiukoff
Zoltan HERPAI
Lukas Stockner
Paul Spooren
Ryan Leung
Daniel Tang
Rosen Penev