The GitHub CI spends 10 to 18 minutes rebuilding all host tools in most
"Check Kernel patches" jobs, although the tools container ships them
prebuilt. Before, the "Build tools" step took about 10 seconds.
The refresh sets all stamps to one time given to touch -t, which has a
resolution of a full second, so the fraction is zero. The CI job runs the
refresh about 0.2 seconds after actions/checkout finished, and git writes
the tools directory last. Its files therefore often get a timestamp in
the same second as the stamps, but after the full second. Since
timestamp.pl compares the fraction of a second, these source files are
newer than the stamps and every tool gets cleaned and built again.
Take the time from a freshly created temporary file and set all stamps
to it with touch -r. They still share one timestamp, but it now includes
the fraction and is always later than the checkout.
Fixes: 3cf47c5c17 ("build: compare timestamps with a fraction of a second")
Assisted-by: Claude:claude-opus-5-5
Link: https://github.com/openwrt/openwrt/pull/25626
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
TP-Link RE700X is a dual-band Wi-Fi 6 (AX3000) range extender based on
Qualcomm IPQ5018 (2.4 GHz) with a QCN6122 (5 GHz) companion radio.
Specifications:
- SoC: Qualcomm IPQ5018 (dual-core ARM Cortex-A53)
- RAM: 256 MiB
- Flash: 128 MiB SPI-NAND (ESMT F50D1G41LB)
- Wi-Fi: IPQ5018 2.4 GHz + QCN6122 5 GHz, both 802.11ax
- Ethernet: 1x Gigabit - IPQ5018 MAC1 (DWMAC) via SGMII/uniphy0 to a
Realtek RTL8211F (MDIO1 addr 6). The SoC internal GE PHY (MAC0/gmac0)
is not wired to any external port and stays disabled.
- LEDs: 5, Buttons: reset + WPS
- Power: 100-240 V AC, 50/60 Hz, 0.4 A (internal PSU, wall-plug)
- UART: 3.3 V serial console, 115200 8N1; on-board 4-pad header,
pinout from top: TX, RX, GND, VCC
MAC addresses (factory_data UBI volume, file default-mac, mounted
read-only in preinit like on the EAP650):
- LAN (label MAC): default-mac
- 2.4 GHz: default-mac + 1
- 5 GHz: default-mac + 2
Calibration data is extracted from the 0:art partition (IPQ5018 at
0x1000, QCN6122 at 0x26800).
Installation:
- From OpenWrt (or after a RAM-boot of the initramfs via U-Boot/TFTP):
sysupgrade.
- From the stock firmware: openwrt-...-squashfs-factory-webflash.bin via
the TP-Link web UI (System -> Firmware Upgrade).
scripts/tplink-re700x-factory.py wraps the rootfs UBI into the stock
"nvrammanager" upload container (the same "tplink2022"/safeloader
family as scripts/tplink-mkimage-2022.py); the stock flasher writes it
into the inactive dual-boot slot. This path has not been tested end to
end (no unit on stock firmware was left), so keep UART at hand for a
first install.
The stock U-Boot passes a slot-correct ubi.mtd= (rootfs / rootfs_1 per the
dual-boot index) but with an unmountable root=mtd:ubi_rootfs. The DTS /chosen
inherits ubi.mtd= and appends root=/dev/ubiblock0_1, so OpenWrt boots from
whichever slot the flasher wrote. Like on the EAP650, sysupgrade installs
into the inactive slot and then points tp_boot_idx at it, keeping the
running slot as a fallback; the U-Boot environment is on 0:appsblenv.
The QCN6122/IPQ5018 board-2.bin (BDF) data is supplied via
ipq-wifi-tplink_re700x (openwrt/firmware_qca-wireless).
Wi-Fi is disabled in the DTS for now: with the default ath11k DP ring
sizes both radios exhaust the 256 MiB of RAM. It will be enabled in a
follow-up together with the ath11k patch that selects smaller rings on
low-memory boards, once that has been accepted upstream.
Signed-off-by: Eduard Hart <eduard.hart@etik.com>
Link: https://github.com/openwrt/openwrt/pull/23982
Signed-off-by: Robert Marko <robimarko@gmail.com>
Based on:
- 218aad6e2f re-emit a provider's depends
- 38824a1351 fold the select condition onto re-emitted deps
- 47d6b05ad3 provides-based dep resolution(%vpackage/@vdeps machinery)
- 1fd50531ca "<" rank comparison on provider selection
The provider-selection rank ('A<B', born in 1fd50531) is RHS-anchored
on the stanza owner. When a consumer +selects a provider of a PROVIDES
target served by >=2 providers, the provider's dependencies are
re-emitted into the consumer's kconfig block under this rank. A bare
@() arch/feature dep folded under it becomes:
depends on !(PACKAGE_librespeed-cli-rust<PACKAGE_librespeed-common)
|| (aarch64||arm||i386||i686||loongarch64||mips||...)
Kconfig treats any occurrence of a symbol in a dependency edge as an
edge, even negated under '!() ||', so PACKAGE_librespeed-common lands
in its own dir_dep: a recursive dependency self-loop.
The self-reference reaches the owner's stanza through any re-emitted
dependency emitted as depends-on: provider '@()' arch gates, plain
deps on a second virtual that '||'-expand, and plain deps on ordinary
packages inheriting the rank-bearing parent. Rank is therefore
generated only for select emission: it is built into a separate
variable and folded into the select gate alone, while re-emission
carries the pre-rank negation instead (!OTHER / !(A||B) over all
leftovers, exactly as before 1fd50531). Within a stanza no depends-on
gate can therefore self-reference, except for self-providing
consumers (provide and depend on the same name), which keep
historical behavior; user conditions, parent conditions and all
select arbitration remain untouched.
Fixes: 1fd50531ca ("metadata: ensure one dependency provider to be y if a package is y")
Signed-off-by: Mario Andrés Pérez <mapb_@outlook.com>
Mercusys devices whose stock web UI expects an fwup container reject the
tplink-image-2022 container: the loader picks its verification algorithm
from the fw-type string at offset 0x14, which that container does not
write.
Build the container the loader accepts, with the fw-type string, the
support list and the MD5 placeholder digest in place.
This is a separate script rather than a flag on tplink-mkimage-2022.py
because only the first 0x14 bytes match, the BE length and the salted MD5
over file[4:]. That script writes 0xff filler up to 0x1014, a table there
(>2I rootfs_size/num_items, then >I32s2I entries), data at a fixed 0x1814
base, the rootfs first and a packed >4B1I2I soft version. The fwup
container has no table: 0x2c records of name[32] + >III base, next_off,
size, each followed by its own data and chained through next_off until 0,
the rootfs appended after the last record, and the soft version as ASCII
soft_ver: in an ordinary record.
Signed-off-by: Johan Alvarado <contact@c127.dev>
Link: https://github.com/openwrt/openwrt/pull/24919
Signed-off-by: Robert Marko <robimarko@gmail.com>
Nothing tests either symbol any more. AUDIO_SUPPORT was also selected by
PCI_SUPPORT and USB_SUPPORT, which stood for "a sound card could be
plugged in here": audio hardware sits behind MMC, SPI, a Bluetooth UART
or an SoC PCM block just as often, so the inference never held. The
display feature was derived from a literal CONFIG_VGA_CONSOLE or CONFIG_FB
in a kernel fragment, which misses every target whose fbdev came from DRM
emulation.
Delete both symbols, the two selects, the feature translations and the
derivation.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Categories other than Base system are emitted in alphabetical order, so
a category describing the hardware a device has would land halfway down
the package menu among unrelated ones. Emit Hardware support first
instead, ahead of Base system, since which device classes an image
supports is the first thing to choose and everything else follows from
it.
print_package_config_category() returns early for a category no package
uses, so this has no effect until such a package exists.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The x86 and armsr targets declare the vdi, vmdk and vhdx features, but
VDI_IMAGES, VMDK_IMAGES and VHDX_IMAGES depend on a hardcoded target
list instead, so the features select nothing and a target opting in has
to edit config/Config-images.in.
Give them USES_VDI, USES_VMDK and USES_VHDX in the same shape as the
other image formats and depend on those. The set of targets offering
each format is unchanged.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
"\s" is not an escape sequence in a Perl double-quoted string, so the
pwm feature emits its select statement without the leading tab that
every other feature gets. Kconfig accepts the unindented line, but the
generated target/Config.in is inconsistent.
Fixes: f6fbc39706 ("build: define PWM_SUPPORT arch feature flag")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The factory images of the Linksys LGS3xxC switches differ between
builds in the Belkin header:
-00000000: 0780 0001 7917 f807 6ab3 0fe3 0058 2000 ....y...j....X .
+00000000: 0780 0001 2a5a 3f79 6ab3 d0c7 0058 2000 ....*Z?yj....X .
belkin-header.py stores time.time() as the image time, which also
changes the header checksum. Use SOURCE_DATE_EPOCH when it is set, like
linksys-image.sh does for the tarball inside.
Link: https://github.com/openwrt/openwrt/pull/25355
Signed-off-by: Paul Spooren <mail@aparcar.org>
Both SBOM generators produce a different file on every run, so the
published .bom.cdx.json of an image and of a package feed never match a
rebuild.
dump_cyclonedxsbom_json() in scripts/package-metadata.pl has three
causes. It draws the serial number from rand(), it takes the timestamp
from the wall clock, and encode_json() follows the Perl hash order, which
changes with the hash seed of each run. The last one alone reorders every
key in the file.
scripts/make-sbom.py has the first two causes, through uuid.uuid4() and
datetime.utcnow().
Take the timestamp from SOURCE_DATE_EPOCH, which the build exports. Derive
the serial number from the timestamp and the component list, so it stays a
valid RFC 4122 identifier and still changes when the content changes. Sort
the keys of the Perl output.
Tested with the package index and the image manifest of an ipq40xx build.
Two runs with the same SOURCE_DATE_EPOCH are now identical, two runs with
different values differ, and the scripts exit with an error when the value
is not a number. Both files differ between two runs without the change.
Signed-off-by: John Crispin <john@phrozen.org>
Several image recipes call tar without the options that pin the member
order, the owner, the mode and the modification time. The archive then
holds the build time, the umask of the build user and the readdir order of
the build directory, so two builds of the same source produce different
images.
Pass the same options that Image/mkfs/targz and sysupgrade-tar.sh already
use. The recipes define no member order, so sorting the members takes
nothing away. The diffoscope of the published WAX610 archive shows the
order differing between the build machines, which is what a readdir order
produces.
--mode=go-w clears the write bit of the group and of the others. tar keeps
the mode of the file on disk, which follows the umask of the build user,
so without it the archive differs between a host with umask 022 and one
with umask 002.
Covers the Netgear factory archives of ipq40xx, ipq60xx and ipq807x, the
Creality factory archive of mt76x8, the D-Link DWL8610AP archive of
bcm53xx, the Freecom archive of ixp4xx and the Linksys switch archive of
realtek.
Signed-off-by: John Crispin <john@phrozen.org>
On a rebuild, the initrd and the initramfs kernel image usually have
the same content as before, but xz and lzma compress them again on
every build. For the OpenWrt One this takes about 6 s of the build.
Add scripts/cache-run.sh. It runs a command that creates one file from
another, and stores the output together with a hash of the input, the
command line and the tool. If they are the same in the next run, it
copies the stored output instead. The commands are deterministic, so
the result is identical.
On a hit the script compares the stored output with the file that is
already there and copies only when the two differ. The output then keeps
its timestamp, so a later step that compares timestamps does not treat it
as new work.
Use it for the initrd compression and for Build/lzma. bzip2 and lzop
stay as they are: bzip2 writes to stdout, and lzop stores the mtime of
its input. xz and gzip now keep the cpio, as the other tools do, so a
cache hit leaves the same files behind as a normal run.
The slot name follows the path of the output below $(KDIR), because two
targets in different directories can share a basename. cache-run.sh holds
a lock over the slot and swaps the stored output in with a rename, so two
image recipes on one slot never read a half written pair.
Signed-off-by: John Crispin <john@phrozen.org>
The -n caller of timestamp.pl only needs to know whether the stamp is the
newest file. The script reads the timestamp of every file to answer that,
which costs 0.09 s for the build directory of U-Boot with its 44000 files.
The rebuild check runs the script twice per package and per build.
Collect the paths first, and for -n ask find for the first file that is
newer than the stamp. find stops at that file, so the walk ends early when
there is work to do. The other modes keep the old code, and so does -n with
-follow, because find and the script treat a symbolic link to a file
differently there.
The check over the U-Boot build directory now takes 0.02 s. The result is
the same for all 44 build directories of the OpenWrt One. The time of a full
no-op build does not change on a machine with 24 cores, where the package
step waits for the dependency chain rather than for the checks.
Signed-off-by: John Crispin <john@phrozen.org>
timestamp.pl decides whether a subdir has work to do. It scans the stamp
file and the source directories, keeps the newest, and reports that the
work is done when the newest one is the stamp. The scan reads the mtime
through the core stat of perl, which truncates it to whole seconds, and
the comparison is strict with the stamp scanned first. Two files that
share a second therefore count as a tie, and a tie says that the work is
done.
include/subdir.mk touches tmp/.build at the start of a build and the
stamp of a subdir at the end, so the two land in the same second once a
build takes less than a second between them. The target install stamp is
the last one of a build, roughly 0.4 s before the build ends, so it is
the one that ties first: the next build then skips target/install and
ships the images of the previous build. Around one build in five was
affected once the build became fast enough.
Read the mtime through Time::HiRes, which reports the fraction as well.
Two touches around a fork no longer share a timestamp. Keep the core
stat where the module is missing, which restores the old behaviour
rather than failing.
Signed-off-by: John Crispin <john@phrozen.org>
Set BUILD_TIME_LOG=<file> to record a begin and an end event for every
prepare, configure, compile and install stage of every tool, toolchain
component, kernel and package. scripts/build-time-report.pl turns the log
into a report.
The report divides each second of the build between the stages that run
in it, so the numbers show which stages hold up the wall clock rather
than which ones burn the most CPU. Nothing is recorded and no extra
process runs when BUILD_TIME_LOG is unset.
Signed-off-by: John Crispin <john@phrozen.org>
The variants of a package are built one after the other in one recipe.
For packages with many variants, such as the boot loaders, this makes
the variants the longest chain of the package build, also if nothing
has to be done.
Add PKG_PARALLEL_VARIANTS. If a package sets it, every variant gets its
own make target with the dependencies of the package, and the package
target depends on these targets. A package must only set it if its
variants share no files outside of their build directories.
Signed-off-by: John Crispin <john@phrozen.org>
If several packages of a source use the same build variant, the
variant is added to the list of variants once for each selected
package, and the variant is built as often, one after the other. With
all packages selected, hostapd builds 4 variants twice, and f2fs-tools
its 2 variants four times each.
Add each variant once, with the condition of all packages that use it.
Signed-off-by: John Crispin <john@phrozen.org>
gen_package_auxiliary drops the condition of a dependency such as
+BUILD_NLS:libintl-full, so the ABI version check of a package also
counts packages that it does not depend on in this configuration.
With all packages selected and BUILD_NLS not set, libelf depends on
libintl-full. gettext-full is built after elfutils, and its new
libintl-full.version causes elfutils, and binutils, gdb, strace,
iproute2 and others through it, to be built again on the next make
call.
Write the condition as a make expression with get_conditional_dep, as
gen_package_mk does.
Signed-off-by: John Crispin <john@phrozen.org>
pkgaux writes Package/<name>/depends for every name that a package
provides. If a package provides the name of another real package, it
overwrites the dependencies of that package: dnsmasq-full provides
dnsmasq, so dnsmasq gets the dependencies of dnsmasq-full, among them
nftables-json and libnftnl.
These lists are used for the library dependencies of the prepare
stamp. dnsmasq thus depends on libnftnl without being ordered after it,
and is built again in the build that follows a clean build.
Skip provided names that belong to another real package.
Signed-off-by: John Crispin <john@phrozen.org>
The unlink of a local file with a hash mismatch comes after the die,
so it never runs. The message says that the file is deleted, but it
stays, and every following build fails in the same way.
Delete the file before the die, so that the next run downloads it
again.
Fixes: 4e19cbc553 ("download: handle possibly invalid local tarballs")
Signed-off-by: John Crispin <john@phrozen.org>
The multi-word zstd option '-I zstd -T0 --ultra -20' was appended as a
single argv element. subprocess passes each list element as one argv
entry, so tar received the whole string as one argument and failed to
recognize it. Split into separate '-I' and 'zstd -T0 --ultra -20'
elements so tar correctly interprets the compressor command.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24375
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Feeds update does not make updated packages available to compile; they must be installed.
Despite this, update refreshes the .config, deleting selections in the .config which have not been
installed yet. The deleted selections are not restored with `./scripts/feeds install` nor with
`make defconfig` because these steps cannot conjure up already deleted selections.
Change update to not modify the .config and leave it to `./scripts/feeds install -d <y|m|n>` or
`make defconfig` or other *config options.
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23241
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This is a dual-radio 802.11a/b/g/n/ac access point with
dual Gigabit Ethernet.
There are two closely related models: The AP-324, which has external
antenna connectors, and the AP-325, which has internal antennas.
The board appears to be identical, and the same image works on both.
Additionally, the Siemens Scalance W1750D is an OEM variant using
the same board, so the image also works on that.
Unfortunately the factory APBoot bootloader enforces cryptographic
signatures on the firmware before booting, so a modified version
must be flashed via the serial port. See [^1] for details.
Specifications
==============
* Device: Aruba AP-325 / AP-324
* SoC: Qualcomm IPQ8068 2x1.4GHz ARMv7-A
* RAM: 512MiB (2x Winbond W632GU6MB-12)
* SPI flash: 4MiB Macronix MX25U3235F
* NAND flash: 128MiB Winbond W29N01HZBINF
* WiFi: 2x Qualcomm QCA9990 (one 2.4G, one 5G)
* Ethernet: 2x 1000BASE-T (Marvell 88E1514 PHY), both PoE-capable
* Power: PoE 802.3at or 12V DC jack
* LEDs: Red/Amber/Green status LED, Amber/Green WiFi LED
* Buttons: 1x, behind hole next to DC jack
* Console: RJ45 connector, Cisco pinout
* USB: 1x USB 2.0 Type A, 1x internal to BLE, SoC has USB 3.0
host but board is only wired for 2.0
* BLE: TI CC2540 SoC, connected to USB and UART, unpopulated
debug header on PCB
* TPM: Atmel AT97SC3205T
How to install
==============
The stock bootloader APBoot appears to be vendor fork of U-Boot, which
disables much of the usual functionality and comes with its own booting
and firmware upgrade logic.
Unfortunately, this logic enforces RSA signatures on images,
even for the default boot from NAND.
Therefore, a patched bootloader is needed, which is built as a package.
In addition to the signature check removal, this also changes
the serial baudrate to 115200.
Luckily, the stock firmware does not disable the `sf` command
(it just hides it until you run `diag`), so the patched bootloader
can be fetched via TFTP and then flashed via console.
Flashing patched APBoot
-----------------------
* Build OpenWrt, or download `openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn`
* Connect serial cable and wired ethernet
* Access stock APBoot console at Baud 9600
* Flash patched bootloader:
```
setenv serverip <your TFTP server IP>
setenv autostart n
netget 44000000 openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn
sf probe 0
sf erase 220000 100000
sf write 44000000 220000 100000
reset
```
Booting OpenWrt
---------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Run `setenv serverip <your TFTP server IP>`
* Run `tftpboot openwrt-ipq806x-generic-aruba_ap-32x-initramfs.ari`
Installing OpenWrt
------------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Consider backing up stock firmware(s) (UBI volumes `aos0` and/or `aos1`)
by booting into OpenWrt via initramfs (see above) and dumping them
* Wipe and repartition NAND flash (see below for explanation):
```
nand device 0
nand erase.chip
reset
ubi part ubifs
ubi remove ubifs
ubi create ubifs 1
ubi create rootfs_data
```
* Follow steps above to boot OpenWrt via initramfs
* From OpenWrt, persist installation via sysupgrade
Reverting to stock FW
---------------------
The patched bootloader remains compatible with the original firmware,
so you can just wipe the NAND, let APBoot recreate the partitions,
and flash back the `aos0`/`aos1` backup from above.
Current status
==============
Tested and working
------------------
* Console
* Wired GbE (both ports)
* WiFi (both 2.4G and 5G)
* LEDs
* Restart Button
* USB port
* External watchdog
* TPM
* BLE SoC
Future work
-----------
* GPIOs for:
* power source (8 indicates DC jack, 59 indicates 802.3at)
* reset source (64 for warm reset, 65 for watchdog)
* USB overcurrent (63)
* BLE SoC reflashing
* CC2540 comes with Aruba-specific FW out of the box
* Debug header is exposed on PCB (pinout GND-VCC-Clock-Data-Reset),
but that requires disassembly
* Stock BLE FW appears to support reflashing via UART, but protocol
would need to be reverse-engineered
* ramoops/pstore
* It appears that APBoot clears the RAM on boot, might be something
we can patch out as well
* Porting a modern U-Boot
Flash layout
============
SPI flash
---------
```
0x000000-0x020000 sbl1
0x020000-0x040000 mibib
0x040000-0x080000 sbl2
0x080000-0x100000 sbl3
0x100000-0x110000 ddrconfig
0x110000-0x120000 ssd
0x120000-0x1a0000 tz
0x1a0000-0x220000 rpm
0x220000-0x320000 appsbl
0x320000-0x330000 appsblenv
0x330000-0x370000 art
0x370000-0x380000 panicdump
0x380000-0x390000 certificate
0x390000-0x3a0000 mfginfo
0x3a0000-0x3b0000 flashcache
0x3b0000-0x400000 aosspare
```
Factory NAND flash
------------------
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains kernel+initrd of the primary firmware,
initrd contains the entire root FS
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains kernel+initrd of the secondary firmware,
initrd contains the entire root FS
* 64MiB MTD partition `ubifs`, formatted as UBI
* 64MiB UBI volume `ubifs`
* Contains UBIFS, overlay-mounted on top of the initrd,
shared between firmware slots
APBoot understands UBI, and will read the kernel from the
`aos0` or `aos1` volume (depending on `os_partition`)
with fallback to the other one in case a check fails.
Kernels are expected to have a vendor-specific header, the included
script will add that header with the correct checksum but no signature.
OpenWrt NAND flash
------------------
OpenWrt assumes separate UBI volumes for kernel and rootfs,
as well as a volume that must be named `rootfs_data` for the UBIFS.
Unfortunately, APBoot actively checks the UBI volumes at boot, and will
repartition if it doesn't find the volumes that it expects (listed above).
Luckily, it doesn't check their size, only their existence. Therefore,
we can use the following layout:
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains OpenWrt kernel+initrd
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains OpenWrt root squashfs
* 64MiB MTD partition `ubifs`, formatted as UBI
* small (single-LEB) UBI volume `ubifs`
* Dummy volume, only there to satisfy APBoot
* almost 64MiB UBI volume `rootfs_data`
* contains UBIFS, overlay-mounted on top of the rootfs
[^1]: https://github.com/lukasstockner/ap325-apboot-openwrt
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Paul Spooren <mail@aparcar.org>
This is a dual-radio 802.11a/b/g/n/ac access point with
dual Gigabit Ethernet.
There are two closely related models: The AP-324, which has external
antenna connectors, and the AP-325, which has internal antennas.
The board appears to be identical, and the same image works on both.
Additionally, the Siemens Scalance W1750D is an OEM variant using
the same board, so the image also works on that.
Unfortunately the factory APBoot bootloader enforces cryptographic
signatures on the firmware before booting, so a modified version
must be flashed via the serial port. See [^1] for details.
Specifications
==============
* Device: Aruba AP-325 / AP-324
* SoC: Qualcomm IPQ8068 2x1.4GHz ARMv7-A
* RAM: 512MiB (2x Winbond W632GU6MB-12)
* SPI flash: 4MiB Macronix MX25U3235F
* NAND flash: 128MiB Winbond W29N01HZBINF
* WiFi: 2x Qualcomm QCA9990 (one 2.4G, one 5G)
* Ethernet: 2x 1000BASE-T (Marvell 88E1514 PHY), both PoE-capable
* Power: PoE 802.3at or 12V DC jack
* LEDs: Red/Amber/Green status LED, Amber/Green WiFi LED
* Buttons: 1x, behind hole next to DC jack
* Console: RJ45 connector, Cisco pinout
* USB: 1x USB 2.0 Type A, 1x internal to BLE, SoC has USB 3.0
host but board is only wired for 2.0
* BLE: TI CC2540 SoC, connected to USB and UART, unpopulated
debug header on PCB
* TPM: Atmel AT97SC3205T
How to install
==============
The stock bootloader APBoot appears to be vendor fork of U-Boot, which
disables much of the usual functionality and comes with its own booting
and firmware upgrade logic.
Unfortunately, this logic enforces RSA signatures on images,
even for the default boot from NAND.
Therefore, a patched bootloader is needed, which is built as a package.
In addition to the signature check removal, this also changes
the serial baudrate to 115200.
Luckily, the stock firmware does not disable the `sf` command
(it just hides it until you run `diag`), so the patched bootloader
can be fetched via TFTP and then flashed via console.
Flashing patched APBoot
-----------------------
* Build OpenWrt, or download `openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn`
* Connect serial cable and wired ethernet
* Access stock APBoot console at Baud 9600
* Flash patched bootloader:
```
setenv serverip <your TFTP server IP>
setenv autostart n
netget 44000000 openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn
sf probe 0
sf erase 220000 100000
sf write 44000000 220000 100000
reset
```
Booting OpenWrt
---------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Run `setenv serverip <your TFTP server IP>`
* Run `tftpboot openwrt-ipq806x-generic-aruba_ap-32x-initramfs.ari`
Installing OpenWrt
------------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Consider backing up stock firmware(s) (UBI volumes `aos0` and/or `aos1`)
by booting into OpenWrt via initramfs (see above) and dumping them
* Wipe and repartition NAND flash (see below for explanation):
```
nand device 0
nand erase.chip
reset
ubi part ubifs
ubi remove ubifs
ubi create ubifs 1
ubi create rootfs_data
```
* Follow steps above to boot OpenWrt via initramfs
* From OpenWrt, persist installation via sysupgrade
Reverting to stock FW
---------------------
The patched bootloader remains compatible with the original firmware,
so you can just wipe the NAND, let APBoot recreate the partitions,
and flash back the `aos0`/`aos1` backup from above.
Current status
==============
Tested and working
------------------
* Console
* Wired GbE (both ports)
* WiFi (both 2.4G and 5G)
* LEDs
* Restart Button
* USB port
* External watchdog
* TPM
* BLE SoC
Future work
-----------
* GPIOs for:
* power source (8 indicates DC jack, 59 indicates 802.3at)
* reset source (64 for warm reset, 65 for watchdog)
* USB overcurrent (63)
* BLE SoC reflashing
* CC2540 comes with Aruba-specific FW out of the box
* Debug header is exposed on PCB (pinout GND-VCC-Clock-Data-Reset),
but that requires disassembly
* Stock BLE FW appears to support reflashing via UART, but protocol
would need to be reverse-engineered
* ramoops/pstore
* It appears that APBoot clears the RAM on boot, might be something
we can patch out as well
* Porting a modern U-Boot
Flash layout
============
SPI flash
---------
```
0x000000-0x020000 sbl1
0x020000-0x040000 mibib
0x040000-0x080000 sbl2
0x080000-0x100000 sbl3
0x100000-0x110000 ddrconfig
0x110000-0x120000 ssd
0x120000-0x1a0000 tz
0x1a0000-0x220000 rpm
0x220000-0x320000 appsbl
0x320000-0x330000 appsblenv
0x330000-0x370000 art
0x370000-0x380000 panicdump
0x380000-0x390000 certificate
0x390000-0x3a0000 mfginfo
0x3a0000-0x3b0000 flashcache
0x3b0000-0x400000 aosspare
```
Factory NAND flash
------------------
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains kernel+initrd of the primary firmware,
initrd contains the entire root FS
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains kernel+initrd of the secondary firmware,
initrd contains the entire root FS
* 64MiB MTD partition `ubifs`, formatted as UBI
* 64MiB UBI volume `ubifs`
* Contains UBIFS, overlay-mounted on top of the initrd,
shared between firmware slots
APBoot understands UBI, and will read the kernel from the
`aos0` or `aos1` volume (depending on `os_partition`)
with fallback to the other one in case a check fails.
Kernels are expected to have a vendor-specific header, the included
script will add that header with the correct checksum but no signature.
OpenWrt NAND flash
------------------
OpenWrt assumes separate UBI volumes for kernel and rootfs,
as well as a volume that must be named `rootfs_data` for the UBIFS.
Unfortunately, APBoot actively checks the UBI volumes at boot, and will
repartition if it doesn't find the volumes that it expects (listed above).
Luckily, it doesn't check their size, only their existence. Therefore,
we can use the following layout:
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains OpenWrt kernel+initrd
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains OpenWrt root squashfs
* 64MiB MTD partition `ubifs`, formatted as UBI
* small (single-LEB) UBI volume `ubifs`
* Dummy volume, only there to satisfy APBoot
* almost 64MiB UBI volume `rootfs_data`
* contains UBIFS, overlay-mounted on top of the rootfs
[^1]: https://github.com/lukasstockner/ap325-apboot-openwrt
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Test Dev <dev@example.org>
Previously PKG_SOURCE_DATE_EPOCH came from a git log on the OpenWrt
package directory. That fails in shallow feed clones and in the SDK
(no .git), collapsing to the script's mtime and breaking .apk
reproducibility across SDK rebuilds and between buildbot and SDK.
With this comment, PKG_UNPACK generates a version.date file, later used to
determine a reproducible SOURCE_DATE_EPOCH. Since unpack happens after
download, the evaluation of SOURCE_DATE_EPOCH is now lazy, invoking the
`get_source_date_epoch.sh` script on every use.
While at it, drop export of PKG_SOURCE_DATE_EPOCH and clean it from the
ipkg-build script.
Link: https://github.com/openwrt/openwrt/issues/21579
Link: https://github.com/openwrt/openwrt/pull/21587
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23576
Signed-off-by: Paul Spooren <mail@aparcar.org>
qemustart is a handy script to quickly test OpenWrt firmware using
qemu. Bringing up networking currently requires a bridge-helper
setup with privileged IP and bridge assignment. To simplify
testing scenarios like the package manager, which need both shell
access and outbound internet, add a user-mode networking option
backed by SLIRP that requires no privileges.
To stay backward compatible, the defaults don't change. The new
flag --user-network attaches two NICs (LAN + WAN) and forwards
three host ports to the guest LAN interface (192.168.1.1):
2222 -> 22 (ssh), 8080 -> 80 (http) and 8443 -> 443 (https). The
host-side ports can be overridden with --ssh-port, --http-port
and --https-port.
Link: https://github.com/openwrt/openwrt/pull/23424
Signed-off-by: Paul Spooren <mail@aparcar.org>
OpenWrt's 99-default_network assigns eth0 to lan and eth1 to wan
when no target-specific 02_network is present, which is the case
for malta. The qemustart bridge block however placed the wan
-device before the lan -device, so the guest's eth0 (lan) ended
up attached to $BR_WAN and eth1 (wan) to $BR_LAN.
Swap the order to match the guest's actual role assignment.
Link: https://github.com/openwrt/openwrt/pull/23424
Signed-off-by: Paul Spooren <mail@aparcar.org>
Currently, there is no SBOM generation in imagebuilder when the package
system 'apk' is used. This commit adds this feature back. This already
worked for the package system 'opkg'.
Furthermore, generating the SBOM using perl is not reproducible if the
input data has not changed. A different file is always generated. This is
not the case with Python. For this reason, Python is now used to generate
the SBOM for the imagebuilder.
The script has already been prepared so that it can also process the opkg
package system for generating the SBOM.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Right now we only have the special getver.sh output (i.e. r32802-f505120278)
instead of the actual, full git hash. Offer the full hash for downstream
tooling, specifically the KernelCI.
Signed-off-by: Paul Spooren <mail@aparcar.org>
The GitHub CI was sometimes still building some tools again even when
the same version was already pre-built. This change fixes the problem
and should improve the speed of the GitHub CI actions. The duration of
the "Build tools" step will be reduced from 5 to 20 minutes down to
10 to 15 seconds.
make also checks that dependencies are not more recent than the target
it wants to build. Previously find returned files in an arbitrary order
and touch set the current timestamp. Since touch is called per file the
timestamps differ in fractional seconds, so not all files got the same
time. make detected a more recent dependency and started to rebuild.
Now all files are set to the same timestamp and make will assume
everything is up to date.
It is sufficient to only touch the stamp files to prevent rebuilding.
Link: https://github.com/openwrt/openwrt/pull/22888
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Not all targets need regulator support, so they dont enable it as its
disabled in the generic config by default.
So, in order to allow kernel modules to depend on regulator support lets
add a new feature flag "regulator" and set it automatically if target
kernel config enables CONFIG_REGULATOR.
Link: https://github.com/openwrt/openwrt/pull/22172
Signed-off-by: Robert Marko <robimarko@gmail.com>
Update the default kernel path in start_qemu_malta() to match the new
image naming scheme after the malta target was converted to the Device
macro system with device name 'generic'.
Signed-off-by: Paul Spooren <mail@aparcar.org>
The pattern '*-*cc-*' incorrectly matches these tools because their names
contain 'cc-'. This causes them to receive compiler CFLAGS, breaking
builds with 'ar: two different operation options specified'.
Signed-off-by: Gustavo Henrique Nihei <gustavo.nihei@espressif.com>
Link: https://github.com/openwrt/openwrt/pull/21757
Signed-off-by: Robert Marko <robimarko@gmail.com>
Packages using PROVIDES to declare virtual package alternatives (like
tc-tiny, tc-bpf, tc-full all providing 'tc') could be simultaneously
selected as =y, causing installation conflicts. The PROVIDES mechanism
only handles dependency resolution, not mutual exclusion.
Add add_implicit_provides_conflicts() to automatically generate CONFLICTS
from default variants to non-default variants sharing the same PROVIDES.
This ensures only one variant can be built-in (=y) at a time.
Skip generating implicit conflicts when the non-default already has
explicit CONFLICTS with the default, to avoid Kconfig dependency cycles
with the select-based dependency resolution.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit drop ftp.nara.wide.ad.jp and
www.ring.gr.jp from projectsmirrors.
These mirrors only supports plain HTTP.
Drop mirrors that does no meet modern
security standards.
Signed-off-by: Yanase Yuki <dev@zpc.st>
Link: https://github.com/openwrt/openwrt/pull/21268
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Allow defining virtual provides using the PROVIDES field by prefixing
them with @, e.g.:
PROVIDES:=@ca-certs
Virtual provides don't own the provided name and multiple packages with
the same virtual provides can be installed side-by-side. Packages must
still take care not to override each other's files.
Add an implicit self-provide to packages. apk can't handle self
provides, be it versioned or virtual, so opt for a suffix instead. This
allows several variants to provide the same virtual package without
adding extra provides to the default one, e.g. wget implicitly provides
wget-any and is marked as default, so wget-ssl can explicitly provide
@wget-any as well.
Filter out virtual provides when generating metadata.
Filter out virtual provides prefix and self provide where appropriate.
Signed-off-by: George Sapkin <george@sapk.in>
Link: https://github.com/openwrt/openwrt/pull/21288
Signed-off-by: Robert Marko <robimarko@gmail.com>
Due to the recent changes with the formality checks kernel_bump commit
messages no-longer pass them.
Adjust these messages to follow the updated checks:
- start the first word after prefix with lower-case
- reduce the overall subject length by removing the redundant 'kernel'
Signed-off-by: George Sapkin <george@sapk.in>
Link: https://github.com/openwrt/openwrt/pull/21012
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware
--------
SOC: MediaTek MT7981
RAM: 512MB DDR4
FLASH: 128MB SPI-NAND
WIFI: Mediatek MT7915 (integrated) 2x2 802.11ax 2.4 / 5 GHz
ETH: Mediatek MT7981 internal 1 GbE PHY
UART: 3V3 115200 8N1 (Pinout silkscreened / Do not connect VCC)
Installation
------------
1. Download the OpenWrt initramfs image. Copy the image to a TFTP server
2. Connect the TFTP server to the EAX17. Conect to the serial console,
interrupt the autoboot process by pressing '0' when prompted.
3. Download & Boot the OpenWrt initramfs image.
$ tftpboot openwrt.bin
$ bootm
4. Wait for OpenWrt to boot. Transfer the sysupgrade image to the device
using scp and install using sysupgrade.
$ sysupgrade -n <path-to-sysupgrade.bin>
Signed-off-by: Jascha Sundaresan <flizarthanon@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20354
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
When building in environments that set IS_TTY, the feeds script does not
honor it and passes a hardcoded value to scan.mk, causing unwanted
control characters to appear in stdout.
This commit addresses the issue by checking IS_TTY and MAKE_TERMOUT
variables and uses their values if defined.
Closes#8039
Signed-off-by: Ernestas Kulik <ernestas.k@iconn-networks.com>
Link: https://github.com/openwrt/openwrt/pull/20743
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Certain existing tooling, such as 'package-metadata.pl', are written
to accept the output of 'opkg list' with package manifest delimited
by '-'. The 'make-index-json.py --manifest' output was emulating
the 'apk list --manifest' format without the delimiting dash,
thus breaking these legacy tools.
We fix this by adding the dash to the manifest output, which allows
all existing tooling to process the output irrespective of whether
the build system uses opkg or apk.
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20094
Signed-off-by: Robert Marko <robimarko@gmail.com>
Hauke Mehrtens
Eduard Hart
Mario Andrés Pérez
Johan Alvarado
Daniel Golle
Paul Spooren
John Crispin
Cui Shuang
Zhi You
Rosen Penev
Ryan Leung
Lukas Stockner
Florian Eckert
Eric Fahlgren
Robert Marko
Gustavo Henrique Nihei
Felix Fietkau
Yanase Yuki
George Sapkin
Karsten Sperling
Linus Walleij
Jascha Sundaresan
Andy Chiang
Ernestas Kulik