staging/svanheule/scripts, branch main

ipq806x: add support for Aruba AP-32x

2026-06-16T14:08:08Z

This is a dual-radio 802.11a/b/g/n/ac access point with dual Gigabit Ethernet. There are two closely related models: The AP-324, which has external antenna connectors, and the AP-325, which has internal antennas. The board appears to be identical, and the same image works on both. Additionally, the Siemens Scalance W1750D is an OEM variant using the same board, so the image also works on that. Unfortunately the factory APBoot bootloader enforces cryptographic signatures on the firmware before booting, so a modified version must be flashed via the serial port. See [^1] for details. Specifications ============== * Device: Aruba AP-325 / AP-324 * SoC: Qualcomm IPQ8068 2x1.4GHz ARMv7-A * RAM: 512MiB (2x Winbond W632GU6MB-12) * SPI flash: 4MiB Macronix MX25U3235F * NAND flash: 128MiB Winbond W29N01HZBINF * WiFi: 2x Qualcomm QCA9990 (one 2.4G, one 5G) * Ethernet: 2x 1000BASE-T (Marvell 88E1514 PHY), both PoE-capable * Power: PoE 802.3at or 12V DC jack * LEDs: Red/Amber/Green status LED, Amber/Green WiFi LED * Buttons: 1x, behind hole next to DC jack * Console: RJ45 connector, Cisco pinout * USB: 1x USB 2.0 Type A, 1x internal to BLE, SoC has USB 3.0 host but board is only wired for 2.0 * BLE: TI CC2540 SoC, connected to USB and UART, unpopulated debug header on PCB * TPM: Atmel AT97SC3205T How to install ============== The stock bootloader APBoot appears to be vendor fork of U-Boot, which disables much of the usual functionality and comes with its own booting and firmware upgrade logic. Unfortunately, this logic enforces RSA signatures on images, even for the default boot from NAND. Therefore, a patched bootloader is needed, which is built as a package. In addition to the signature check removal, this also changes the serial baudrate to 115200. Luckily, the stock firmware does not disable the `sf` command (it just hides it until you run `diag`), so the patched bootloader can be fetched via TFTP and then flashed via console. Flashing patched APBoot ----------------------- * Build OpenWrt, or download `openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn` * Connect serial cable and wired ethernet * Access stock APBoot console at Baud 9600 * Flash patched bootloader: ``` setenv serverip setenv autostart n netget 44000000 openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn sf probe 0 sf erase 220000 100000 sf write 44000000 220000 100000 reset ``` Booting OpenWrt --------------- * Connect serial cable and wired ethernet * Access patched APBoot console at Baud 115200 * Run `setenv serverip ` * Run `tftpboot openwrt-ipq806x-generic-aruba_ap-32x-initramfs.ari` Installing OpenWrt ------------------ * Connect serial cable and wired ethernet * Access patched APBoot console at Baud 115200 * Consider backing up stock firmware(s) (UBI volumes `aos0` and/or `aos1`) by booting into OpenWrt via initramfs (see above) and dumping them * Wipe and repartition NAND flash (see below for explanation): ``` nand device 0 nand erase.chip reset ubi part ubifs ubi remove ubifs ubi create ubifs 1 ubi create rootfs_data ``` * Follow steps above to boot OpenWrt via initramfs * From OpenWrt, persist installation via sysupgrade Reverting to stock FW --------------------- The patched bootloader remains compatible with the original firmware, so you can just wipe the NAND, let APBoot recreate the partitions, and flash back the `aos0`/`aos1` backup from above. Current status ============== Tested and working ------------------ * Console * Wired GbE (both ports) * WiFi (both 2.4G and 5G) * LEDs * Restart Button * USB port * External watchdog * TPM * BLE SoC Future work ----------- * GPIOs for: * power source (8 indicates DC jack, 59 indicates 802.3at) * reset source (64 for warm reset, 65 for watchdog) * USB overcurrent (63) * BLE SoC reflashing * CC2540 comes with Aruba-specific FW out of the box * Debug header is exposed on PCB (pinout GND-VCC-Clock-Data-Reset), but that requires disassembly * Stock BLE FW appears to support reflashing via UART, but protocol would need to be reverse-engineered * ramoops/pstore * It appears that APBoot clears the RAM on boot, might be something we can patch out as well * Porting a modern U-Boot Flash layout ============ SPI flash --------- ``` 0x000000-0x020000 sbl1 0x020000-0x040000 mibib 0x040000-0x080000 sbl2 0x080000-0x100000 sbl3 0x100000-0x110000 ddrconfig 0x110000-0x120000 ssd 0x120000-0x1a0000 tz 0x1a0000-0x220000 rpm 0x220000-0x320000 appsbl 0x320000-0x330000 appsblenv 0x330000-0x370000 art 0x370000-0x380000 panicdump 0x380000-0x390000 certificate 0x390000-0x3a0000 mfginfo 0x3a0000-0x3b0000 flashcache 0x3b0000-0x400000 aosspare ``` Factory NAND flash ------------------ * 32MiB MTD partition `aos0`, formatted as UBI * 32MiB UBI volume `aos0` * contains kernel+initrd of the primary firmware, initrd contains the entire root FS * 32MiB MTD partition `aos1`, formatted as UBI * 32MiB UBI volume `aos1` * contains kernel+initrd of the secondary firmware, initrd contains the entire root FS * 64MiB MTD partition `ubifs`, formatted as UBI * 64MiB UBI volume `ubifs` * Contains UBIFS, overlay-mounted on top of the initrd, shared between firmware slots APBoot understands UBI, and will read the kernel from the `aos0` or `aos1` volume (depending on `os_partition`) with fallback to the other one in case a check fails. Kernels are expected to have a vendor-specific header, the included script will add that header with the correct checksum but no signature. OpenWrt NAND flash ------------------ OpenWrt assumes separate UBI volumes for kernel and rootfs, as well as a volume that must be named `rootfs_data` for the UBIFS. Unfortunately, APBoot actively checks the UBI volumes at boot, and will repartition if it doesn't find the volumes that it expects (listed above). Luckily, it doesn't check their size, only their existence. Therefore, we can use the following layout: * 32MiB MTD partition `aos0`, formatted as UBI * 32MiB UBI volume `aos0` * contains OpenWrt kernel+initrd * 32MiB MTD partition `aos1`, formatted as UBI * 32MiB UBI volume `aos1` * contains OpenWrt root squashfs * 64MiB MTD partition `ubifs`, formatted as UBI * small (single-LEB) UBI volume `ubifs` * Dummy volume, only there to satisfy APBoot * almost 64MiB UBI volume `rootfs_data` * contains UBIFS, overlay-mounted on top of the rootfs [^1]: https://github.com/lukasstockner/ap325-apboot-openwrt Signed-off-by: Lukas Stockner Link: https://github.com/openwrt/openwrt/pull/20738 Signed-off-by: Paul Spooren

Revert "ipq806x: add support for Aruba AP-32x"

2026-06-16T14:05:13Z

This reverts commit e912d6aeb4c017a30b86acd3a8cf4ec4b53b87a8. Wrong Signed-off-by line was used, reverting and re-applying. Signed-off-by: Paul Spooren

ipq806x: add support for Aruba AP-32x

2026-06-16T11:45:44Z

build: derive PKG_SOURCE_DATE_EPOCH from the unpacked source tree

2026-06-02T09:51:00Z

Previously PKG_SOURCE_DATE_EPOCH came from a git log on the OpenWrt package directory. That fails in shallow feed clones and in the SDK (no .git), collapsing to the script's mtime and breaking .apk reproducibility across SDK rebuilds and between buildbot and SDK. With this comment, PKG_UNPACK generates a version.date file, later used to determine a reproducible SOURCE_DATE_EPOCH. Since unpack happens after download, the evaluation of SOURCE_DATE_EPOCH is now lazy, invoking the `get_source_date_epoch.sh` script on every use. While at it, drop export of PKG_SOURCE_DATE_EPOCH and clean it from the ipkg-build script. Link: https://github.com/openwrt/openwrt/issues/21579 Link: https://github.com/openwrt/openwrt/pull/21587 Co-Authored-By: Claude Opus 4.7 (1M context) Link: https://github.com/openwrt/openwrt/pull/23576 Signed-off-by: Paul Spooren

scripts: add --user-network to qemustart

2026-05-21T14:06:25Z

qemustart is a handy script to quickly test OpenWrt firmware using qemu. Bringing up networking currently requires a bridge-helper setup with privileged IP and bridge assignment. To simplify testing scenarios like the package manager, which need both shell access and outbound internet, add a user-mode networking option backed by SLIRP that requires no privileges. To stay backward compatible, the defaults don't change. The new flag --user-network attaches two NICs (LAN + WAN) and forwards three host ports to the guest LAN interface (192.168.1.1): 2222 -> 22 (ssh), 8080 -> 80 (http) and 8443 -> 443 (https). The host-side ports can be overridden with --ssh-port, --http-port and --https-port. Link: https://github.com/openwrt/openwrt/pull/23424 Signed-off-by: Paul Spooren

scripts: fix lan/wan order of malta in qemustart

2026-05-21T14:06:25Z

OpenWrt's 99-default_network assigns eth0 to lan and eth1 to wan when no target-specific 02_network is present, which is the case for malta. The qemustart bridge block however placed the wan -device before the lan -device, so the guest's eth0 (lan) ended up attached to $BR_WAN and eth1 (wan) to $BR_LAN. Swap the order to match the guest's actual role assignment. Link: https://github.com/openwrt/openwrt/pull/23424 Signed-off-by: Paul Spooren

build: add CycloneDX SBOM processing to apk

2026-05-17T10:21:09Z

Currently, there is no SBOM generation in imagebuilder when the package system 'apk' is used. This commit adds this feature back. This already worked for the package system 'opkg'. Furthermore, generating the SBOM using perl is not reproducible if the input data has not changed. A different file is always generated. This is not the case with Python. For this reason, Python is now used to generate the SBOM for the imagebuilder. The script has already been prepared so that it can also process the opkg package system for generating the SBOM. Signed-off-by: Florian Eckert

scripts: add git_commit to profiles.json

2026-04-21T11:47:58Z

Right now we only have the special getver.sh output (i.e. r32802-f505120278) instead of the actual, full git hash. Offer the full hash for downstream tooling, specifically the KernelCI. Signed-off-by: Paul Spooren

scripts/ext-tools.sh: set all prebuilt tool files to same timestamp

2026-04-12T14:55:37Z

The GitHub CI was sometimes still building some tools again even when the same version was already pre-built. This change fixes the problem and should improve the speed of the GitHub CI actions. The duration of the "Build tools" step will be reduced from 5 to 20 minutes down to 10 to 15 seconds. make also checks that dependencies are not more recent than the target it wants to build. Previously find returned files in an arbitrary order and touch set the current timestamp. Since touch is called per file the timestamps differ in fractional seconds, so not all files got the same time. make detected a more recent dependency and started to rebuild. Now all files are set to the same timestamp and make will assume everything is up to date. It is sufficient to only touch the stamp files to prevent rebuilding. Link: https://github.com/openwrt/openwrt/pull/22888 Signed-off-by: Hauke Mehrtens

build: reject non-matching artifacts

2026-03-12T08:31:25Z

Check for malformed artifact names before dereferencing them. Fixes: https://github.com/openwrt/openwrt/commit/5816d883ff3884ae96c3293b316f6d56c099eee0 Signed-off-by: Eric Fahlgren Link: https://github.com/openwrt/openwrt/pull/22385 Signed-off-by: Robert Marko