ELECOM WRC-X3000GST2 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router based on
IPQ5018. The only hardware difference from the WRC-X3000GS2 is the RAM
capacity; all other peripherals are identical. This port therefore
reuses the GS2 board-2.bin (ipq-wifi-elecom_wrc-x3000gs2) and ath11k
calibration variant.
Specification:
- SoC : Qualcomm IPQ5018
- RAM : DDR3 512 MiB (Kingston Technology D2516ECMDXGJD)
- Flash : SPI-NAND 128 MiB (Macronix MX35UF1G24AD-Z4I)
- WLAN : 2.4/5 GHz 2T2R
- 2.4 GHz : Qualcomm IPQ5018 (SoC)
- 5 GHz : Qualcomm QCN6122
- Ethernet : 5x 10/100/1000 Mbps
- wan (phy) : Qualcomm IPQ5018 (SoC)
- lan (switch) : Qualcomm Atheros QCA8337
- LEDs/Keys (GPIO): 8x / 3x (reset, WPS, router/AP slide switch)
- UART : through-hole on PCB, 4pins near the barcode
- assignment : 3.3V, TX, RX, NC, GND from the barcode side
- settings : 115200n8
- Power : 12 VDC, 1 A (Max. 11.5W)
Flash instruction using factory.bin image:
1. Boot WRC-X3000GST2 normally in router mode
2. Access the WebUI ("http://192.168.2.1/") and open the firmware
update page ("ファームウェア更新")
3. Select the OpenWrt factory.bin image and click apply ("適用")
4. After the device reboots automatically, wait until the green power LED
stops blinking and stays solid
5. When the green power LED is solid, hold the reset button until the red
LED starts blinking to clear remaining stock firmware settings
Switching to the stock firmware:
1. Load the elecom.sh script
. /lib/upgrade/elecom.sh
2. Check the current index of rootfs
bootconfig_rw_index 0:bootconfig rootfs
3. Set the index to inverted value
bootconfig_rw_index 0:bootconfig rootfs <value>
bootconfig_rw_index 0:bootconfig1 rootfs <value>
example:
- step2 returned "0":
bootconfig_rw_index 0:bootconfig rootfs 1
bootconfig_rw_index 0:bootconfig1 rootfs 1
- step2 returned "1":
bootconfig_rw_index 0:bootconfig rootfs 0
bootconfig_rw_index 0:bootconfig1 rootfs 0
4. Reboot
Partition Layout (Stock FW):
0x000000000000-0x000000080000 : "0:SBL1"
0x000000080000-0x000000100000 : "0:MIBIB"
0x000000100000-0x000000140000 : "0:BOOTCONFIG"
0x000000140000-0x000000180000 : "0:BOOTCONFIG1"
0x000000180000-0x000000280000 : "0:QSEE"
0x000000280000-0x000000380000 : "0:QSEE_1"
0x000000380000-0x0000003c0000 : "0:DEVCFG"
0x0000003c0000-0x000000400000 : "0:DEVCFG_1"
0x000000400000-0x000000440000 : "0:CDT"
0x000000440000-0x000000480000 : "0:CDT_1"
0x000000480000-0x000000500000 : "0:APPSBLENV"
0x000000500000-0x000000640000 : "0:APPSBL"
0x000000640000-0x000000780000 : "0:APPSBL_1"
0x000000780000-0x000000880000 : "0:ART"
0x000000880000-0x000000900000 : "0:TRAINING"
0x000000900000-0x000003c40000 : "rootfs"
0x000003c40000-0x000003fc0000 : "Config"
0x000003fc0000-0x000007300000 : "rootfs_1"
0x000007300000-0x000007680000 : "Config_2"
0x000007680000-0x000007b80000 : "Reserved"
0x000007b80000-0x000007c00000 : "FWHEADER"
0x000007c00000-0x000007c80000 : "Factory"
Notes:
- This device has dual-boot feature and it's managed by the index in the
0:bootconfig and 0:bootconfig1 partitions.
- Wi-Fi BDF is shared with WRC-X3000GS2 (ipq-wifi-elecom_wrc-x3000gs2)
as the hardware (SoC, QCN6122, antennas) is identical between the two
models.
- GST2 stock firmware keeps its configuration even when sysupgrade is
called with -n. When installing from the OEM WebUI, those stock
settings can be restored into OpenWrt overlay, so settings must be
initialized after the first OpenWrt boot.
MAC Addresses:
LAN : 38:97:A4:xx:xx:40 (0:APPSBLENV, "eth1addr"/"ethaddr" (text))
WAN : 38:97:A4:xx:xx:43 (0:APPSBLENV, "eth0addr" (text))
2.4 GHz: 38:97:A4:xx:xx:41 (0:APPSBLENV, "wifi0" (text))
5 GHz : 38:97:A4:xx:xx:42 (0:APPSBLENV, "wifi1" (text))
Signed-off-by: Taiga Ogawa <zectaiga@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23471
Signed-off-by: Robert Marko <robimarko@gmail.com>
Add support for Xiaomi AX5400 (RA74).
Specifications:
* SoC: Qualcomm IPQ5018 (64-bit dual-core ARM Cortex-A53 @ 1.0Ghz)
* Memory: Etrontech EM6HE16EWAKG 512 MiB DDR3L-933
* Serial Port: 1v8 TTL 115200n8
* Wi-Fi: IPQ5018 (2x2 2.4 Ghz 802.11b/g/n/ax - up to 574 Mbps)
QCN9024 (4x4 5 Ghz 802.11an/ac/ax - up to 4804 Mbps)
* Ethernet: IPQ5018 integrated virtual switch connected to an
external QCA8337 switch (3 LAN Ports 10/100/1000)
* Flash: Gigadevice GD5F1GQ5REYIG (128 MiB)
* LEDs: 1x System Blue (GPIO 24 Active High)
1x System Yellow (GPIO 25 Active High)
1x WAN Link Blue (GPIO 26 Active High)
1x WAN Link Yellow (GPIO 27 Active High)
* Buttons: 1x Reset (GPIO 38 Active Low)
1x WPS (GPIO 28 Active Low)
* MAC address layout: LAN (eth1): 0:art @ offset 0x0
WAN (eth0): 0:art @ offset 0x6
Flash instructions: (use redmi-ax5400 image for the Redmi AX5400)
Download XMIR Patcher: https://github.com/openwrt-xiaomi/xmir-patcher
First flash a ubinized OpenWrt initramfs that will serve as the intermediate step, since
OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for
packages, through either of the below two methods:
Installation via XMIR Patcher:
1. Load the initramfs image: openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi
Installation via ubiformat method, through SSH:
1. If needed, enable SSH using XMIR Patcher.
2. Copy the file openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi to the /tmp directory
3. Open an SSH shell to the router
4. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1):
nvram get flag_boot_rootfs
5. Find the rootfs and rootfs_1 mtd indexes respectively:
cat /proc/mtd
Please confirm if mtd18 and mtd19 are the correct indexes from above!
6. Use the command ubiformat to flash the opposite mtd with UBI image:
If nvram get flag_boot_rootfs returned 0:
ubiformat /dev/mtd19 -y -f /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit
otherwise:
ubiformat /dev/mtd18 -y -f /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit
7. Reboot the device by:
reboot
Continue in order to pernamently flash OpenWrt:
1. Upload the sysupgrade image to /tmp/ using SCP:
scp -O <path to image> root@192.168.1.1:/tmp/
2. Open an SSH shell to 192.168.1.1 from a PC within the same subnet
3. Use sysupgrade to flash the sysupgrade image:
sysupgrade -n -v /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-squashfs-sysupgrade.bin
Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired.
Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23374
Signed-off-by: Robert Marko <robimarko@gmail.com>
The Xiaomi AX6000 has three radios:
- IPQ5018 integrated 2.4 GHz (ath11k AHB, wifi0)
- QCN9024 on PCIe0 (ath11k PCI, QCA8074-class 5 GHz)
- QCA9887 on PCIe1 (ath10k, 5 GHz)
The DTS previously kept pcie1 disabled because the controller
could not bring the link up. The real cause was the PERST GPIO
polarity: the stock device-tree uses GPIO_ACTIVE_HIGH on GPIO18
for the QCA9887 card, while OpenWrt had GPIO_ACTIVE_LOW, leaving
the card held in reset.
With the correct polarity the PCIe1 link trains and the QCA9887
enumerates at 01:00.0. ath10k loads firmware-2.bin, registers
phy0 with mac80211, and provides a functional 5 GHz AP.
Tested on a reworked Xiaomi AX6000 with QCA9887 soldered in.
All three radios enumerate, load firmware and beacon
successfully; scan, association and data traffic confirmed on
each radio.
Signed-off-by: chinawrj <chinawrj@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23047
Signed-off-by: Robert Marko <robimarko@gmail.com>
CPR driver was converted to use of_device_get_match_data and it locally
constified the CPR match data structures but they are also stored per
regulator in their struct, these were not constified and would cause a
compile time error.
So, constify those as well.
Fixes: c1fa85f659 ("treewide: use of_device_get_match_data")
Signed-off-by: Robert Marko <robimarko@gmail.com>
No need to add another aliases node just for the label-mac-device,
luckily DTC was smart enough to combine them together in the final DTB.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Add IPQ8074 support to the upstream CMN PLL driver. The CMN PLL block
is identical to IPQ6018 with the same output clocks (bias_pll_cc_clk
at 300 MHz and bias_pll_nss_noc_clk at 416.5 MHz).
Signed-off-by: John Crispin <john@phrozen.org>
Add IPQ6018 support to the upstream CMN PLL driver. The CMN PLL at
0x9b000 generates the 12 GHz base clock feeding the networking
subsystem. Its output clocks (bias_pll_cc_clk at 300 MHz and
bias_pll_nss_noc_clk at 416.5 MHz) replace the previous fixed-clock
stubs and are found by GCC via global clock name lookup.
Signed-off-by: John Crispin <john@phrozen.org>
The XO clock source is always-on in hardware and cannot be gated.
Without CLK_IS_CRITICAL, the CMN PLL runtime PM suspend cascades a
disable up to gcc_xo_clk_src, causing a branch status timeout warning.
The IPQ8074 GCC driver already marks this clock as critical.
Signed-off-by: John Crispin <john@phrozen.org>
NN6000v1 Specifications:
SoC: Qualcomm IPQ6000 1.2GHz
RAM: K4B4G1646E-BCMA 512MiB x2 = 1 GiB
Flash: FORESEE 256GB eMMC
ETH: QCA8075 (2x LAN, 1x WAN)
WLAN1: QCN5022 2.4GHz AX 2x2
WLAN2: QCN5052 5GHz AX 2x2
Power: DC 12V
Button: Reset, Wps
USB: 1x 3.0
NN6000v2 Specifications:
SoC: Qualcomm IPQ6000 1.2GHz
RAM: MT41K512M16VRN-107 IT:P 1GiB x2 = 2 GiB
Flash: FORESEE 256GB eMMC
ETH: QCA8075 (4x LAN, 1x WAN)
WLAN1: QCN5022 2.4GHz AX 2x2
WLAN2: QCN5052 5GHz AX 2x2
Power: DC 12V
Button: Reset, Wps
USB: 1x 3.0
Install via UART:
1. Download the initramfs image, rename it to
initramfs.itb, host it with the tftp server.
2. Interrupt U-Boot and run these commands:
tftpboot initramfs.itb
bootm
3. After openwrt boots up, use scp or luci web
to upload sysupgrade.bin to upgrade.
Install via Uboot WebUI:
- Only work when you flash a custom uboot with webui
- Push the reset button for 5 seconds, then use broswer to
access http://192.168.1.1/, then upload factory.bin.
Signed-off-by: Fire Chen <firedevel@icloud.com>
Link: https://github.com/openwrt/openwrt/pull/21787
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
The main difference between EAP610, 623, and 625 is the device name,
support string, and the BDF package. Move the others to a common
Device/tplink_eap6xx-common in order to highlight the common aspects.
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18804
Signed-off-by: Robert Marko <robimarko@gmail.com>
The EAP625 and EAP623 are extremely similar. The only difference in
the vendor's device tree is that EAP625 also enables USB and UART2.
Use the eap6xx dtsi instead of writing out a full devicetree.
The EAP623 uses the same RTL8211F as the 625 and 610. Since this is
a gigabit PHY, it is okay to change the ess mac mode from SGMII_PLUS
to SGMII. This is now consistent across all three devices.
Move the 'realtek,clkout-disable' and 'realtek,aldps-enable' PHY
properties to the common dtsi, as they work well on all three devices.
Reflect the remaining differences in the eap625 dts.
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18804
Signed-off-by: Robert Marko <robimarko@gmail.com>
As I was looking at the differences between EAP610, 623, and 625
Outdoor, I realized that the quick-start guide of all of the devices
mentions a yellow and green LED. Thus rename the "amber" led to
"yellow", and adjust its color ID accordingly.
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18804
Signed-off-by: Robert Marko <robimarko@gmail.com>
Originally, the .compatible string for EAP623-Outdoor HD tried to
shorten the "-outdoor" to "od". However, this naming was inconsistent
with the existing "eap610-outdoor". As "od" is not a common shorthand,
spell out the complete word: "eap623-outdoor-hd-v1".
Fixes: 5dbf93c8c5 ("ipq60xx: add support for TP-Link EAP623-Outdoor HD v1")
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18804
Signed-off-by: Robert Marko <robimarko@gmail.com>
CONFIG_REGULATOR_QCOM_LABIBB is being disabled by targets manually, so
instead lets disable it in generic config.
Signed-off-by: Robert Marko <robimarko@gmail.com>
CONFIG_REGULATOR_QCOM_USB_VBUS showed up on Layerscape recently, and it
looks like multiple targets disable it manually, so simply disable it in
generic configuration instead.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Follow the recent change where all DTS files were moved to a dedicated dir.
Fixes: 3a39f682df ("qualcommax: ipq50xx: add support for CMCC MR3000D-CI")
Signed-off-by: Robert Marko <robimarko@gmail.com>
CMCC MR3000D-CI is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on
IPQ5000.
Device specification
--------------------
- SoC : Qualcomm IPQ5018
- RAM : 512 MiB DDR3L
- Flash : 128 MiB SPI-NAND (GigaDevice GD5F1GQ5REYIG)
- WLAN : 2.4/5 GHz 2T2R
- 2.4 GHz : Qualcomm IPQ5018 (SoC)
- 5 GHz : Qualcomm Atheros QCN6102
- Ethernet : 4x 10/100/1000 Mbps
- Switch : Qualcomm Atheros QCA8337
- LEDs/Keys (GPIO) : 2x LEDs, 2x Buttons
- UART : Through-hole on PCB
- Voltage : 3.3 V
- Assignment : Silkscreened on PCB
- Settings : 115200n8
- Power : 12 VDC, 1.5 A
Installation
-----------------
1. Telnet method
a. Enable telnet
Log in to http://192.168.10.1/ with the password on the sticker
Modify URL according to example (keep your unique hash after ";stok=")
and press Enter:
http://192.168.10.1/cgi-bin/luci/;stok=78becad1b1490e45be2776025cde2b7d/api/NPCnetwork/ping?url=$(telnetd)
You should get the following in the browser:
{"link":0}
b. Run tftp server on IP 192.168.10.254 and put factory image
'openwrt-qualcommax-ipq50xx-cmcc_mr3000d-ci-squashfs-factory.ubi'
in the tftp root dir.
c. Login to 192.168.10.1 with telnet (user: root, pass: from the
sticker).
d. Download factory image from the tftp:
tftp -l factory.ubi -r openwrt-qualcommax-ipq50xx-cmcc_mr3000d-ci-squashfs-factory.ubi -g 192.168.10.254
e. Flash factory image:
export rootfs=$(cat /proc/mtd | grep rootfs | grep -v _ | cut -d: -f1)
ubidetach -f -p /dev/${rootfs}
ubiformat /dev/${rootfs} -y -f /tmp/factory.ubi
f. Reboot:
reboot
2. U-Boot Method using UBI Image (using UART)
a. Place the factory.ubi file on your TFTP server, enter U-Boot CLI
and exec these commands:
tftpboot <your_tftp_server_ip>:factory.ubi
flash rootfs
reset
3. U-Boot Method using initramfs Image (using UART)
a. Place the openwrt-*-initramfs-fit-uImage.itb file on your TFTP
server and rename it to initramfs.bin
b. Enable serial console, enter to U-Boot CLI and exec these commands:
tftpboot <your_tftp_server_ip>:initramfs.bin
bootm
c. Once boot completed, upload the sysupgrade.bin file to router's
/tmp directory (using scp or wget) and execute the following command
in openwrt shell:
sysupgrade -n /tmp/sysupgrade.bin
MAC Addresses
-------------
+--------------+-------------------+-------------+
| Interface | MAC example | Location |
+--------------+-------------------+-------------+
| LAN | 84:7a:xx:xx:xx:dd | 0:ART, 0x6 |
| WAN (label) | 84:7a:xx:xx:xx:dc | 0:ART, 0x0 |
| WLAN 2.4 GHz | 84:7a:xx:xx:xx:de | 0:ART, 0xc |
| WLAN 5 | 84:7a:xx:xx:xx:df | 0:ART, 0x12 |
+--------------+-------------------+-------------+
Notes
-----
1. U-Boot is protected by a password (pass: netpower).
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21952
Signed-off-by: Robert Marko <robimarko@gmail.com>
Align the qualcommax target to the pattern already used on other devices where
the device DTS are placed in a dedicated directory separate from the files
directory.
This, while trying to enforce a common pattern for every target, also permits to
do modification to device DTS without having to trigger a recompilation of the
entire kernel (as the files directory is not touched)
Link: https://github.com/openwrt/openwrt/pull/22037
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
The Zyxel NWA110AX is a dual band 2x2:2 802.11ax wireless access point
with PoE.
The device is very similar to the NWA210AX except for being 2x2 instead
of 4x4 in the 5GHz band and not having the 2.5GbE ethernet port. This
commit factors out a common DTS and device definition and reuses it for
both devices.
Hardware:
* SoC: Qualcomm IPQ8070A
* RAM: 1GiB 1x Samsung K4A8G165WC-BCTD
* Flash: 8MiB Winbond W25Q64DW SPI-NOR, 256MiB Winbond W29N02GZ SPI-NAND
* WLAN 2.4GHz: QCN5024 2x2:2 802.11b/g/n/ax
* WLAN 5GHz: QCN5054 2x2:2 802.11n/ac/ax
* Ethernet: 1x 1GbE with AR8033 PHY
* Serial Config: 3.3V TTL 115200-8-N-1, externally accessible
* Serial Layout: GND TX RX 3.3V (don't connect, marked with triangle)
* LEDs: 1x red, 1x green, 1x blue, 1x white
* Buttons: 1x reset
MAC addresses:
* Uplink: base address on label
* 2.4GHz WLAN: base + 1
* 5GHZ WLAN: base + 2
Flashing Notes:
The device uses a dual-image setup and OpenWrt can only be installed as
image 0. When the currently running stock firmware is image 0, OpenWrt
will be installed as image 1, fail to boot and the device returns to stock
firmware. If this happens, install any version of stock firmware so that
it runs as image 1, before installing OpenWrt. Alternatively, if there
already is a valid stock firmware in image 1, the "debug dual-image show"
and "debug dual-image set boot-image image1" commands can be used in the
stock CLI via serial/SSH/telnet to switch to image 1.
Flashing with Stock Web Interface:
* Get the OpenWrt factory image and rename it to a shorter name, for
example "openwrt.bin" (the stock firmware has a character limit)
* In the web interface, go to "Maintenance" -> "File Manager" ->
"Firmware Package" (or click the link next to "Firmware Version" under
"Device Information" on the dashboard)
* Under "Upload File" browse to the renamed OpenWrt factory image and
click on "Upload"
Switch Boot Image:
* OpenWrt to stock: "zyxel-bootconfig-ipq807x set image1"
* Stock to OpenWrt: "debug dual-image set boot-image image0"
Unbrick / Revert to Stock with the Boot Module:
* Disconnect the device from power
* Configure your machine to 192.168.1.103/24 and start a TFTP server
* Put the stock firmware image into the TFTP server root and rename it to
"ZLD-current"
* Establish a serial connection to the device through the console port
* Connect the device to power
* When prompted, press a key to abort automatic boot and enter debug mode
* Use the "atnz" command to flash the firmware image
* Use the "atgo" command to boot from the newly flashed image
Signed-off-by: Michael Lotz <mmlr@mlotz.ch>
Link: https://github.com/openwrt/openwrt/pull/21849
Signed-off-by: Robert Marko <robimarko@gmail.com>
Netgear RBx350 are dual band 4 stream 802.11ax mesh devices from the Orbi
series. The RBR350 is a router with a WAN and 3 LAN ports. The RBS350 is a
satellite without WAN port, only 2 LAN ports and half the flash. The
hardware is otherwise identical. They were sold in kits as RBK352, RBK353,
RBK354 or RBK355, with one router and 1-4 satellites.
Hardware:
* SoC: Qualcomm IPQ6018
* RAM: 512MiB 1x Nanya NT5CC256M16ER-EK
* Flash: 512MiB Winbond W29N04GZ or 256MiB Winbond W29N02GZ
* WLAN 2.4GHz: QCN5022 2x2:2 b/g/n/ax
* WLAN 5GHz: QCN5052 2x2:2 a/n/ac/ax
* Ethernet: QCA8075 switch with 1 WAN and 3 LAN ports or 2 LAN ports
* Serial Config: 3.3V TTL 115200-8-N-1, internal populated header
* Serial Layout: 3.3V (don't connect, marked with dot) RX TX GND
* LEDs: green/red power, white/red/green/blue status
* Buttons: 1x Reset, 1x WPS
MAC addresses:
* LAN1: base address on label, stored in boarddata partition at 0x8
* LAN2: base + 1
* LAN3: base + 2
* WAN: base + 3
* 2.4GHz WLAN: base + 1
* 5GHz WLAN: base + 2
Flashing Notes:
The stock firmware images are signed. Both the bootloader and the stock
web interface check the signature and will fail to boot/flash.
The bootloader automatically does NMRP when a gigabit LAN connection is
present. The stock and factory images contain a U-Boot script that is
executed when flashing using NMRP. This is used to alter and persist the
U-Boot env with a boot command that works with unsigned firmware.
Install OpenWrt:
* Get the nmrpflash utility [0] and OpenWrt factory image
* Find network interface to use: nmrpflash -L
* Start nmrpflash: nmrpflash -i interface -f openwrt-...-factory.img
* Connect the device LAN port closest to the power jack to the same
network using gigabit
* Plug the device in and wait for the bootloader to flash
* Unplug and replug the device once the power LED blinks amber
Revert to Stock:
The boot command needs to be reverted before flashing the stock firmware,
otherwise it will fail to boot and get stuck in recovery mode (red power
LED flashing).
* Run: fw_setenv bootcmd bootipq
* Restart the device
* Flash the stock firmware RBx350-Va.b.c.d.img using nmrpflash
[0]: https://github.com/jclehner/nmrpflash
Signed-off-by: Michael Lotz <mmlr@mlotz.ch>
Link: https://github.com/openwrt/openwrt/pull/21656
Signed-off-by: Robert Marko <robimarko@gmail.com>
Netgear RBx750 are tri band, 2.4GHz and 2x 5GHz, 8 stream 802.11ax mesh
devices from the Orbi series. The RBR750 is a router with a WAN and 3 LAN
ports. The RBS750 is a satellite without WAN port, only 2 LAN ports and
half the flash. The hardware is otherwise identical. They were sold in
kits as RBK752-RBK757, with one router and 1-6 satellites.
Hardware:
* SoC: Qualcomm IPQ8074
* RAM: 1GiB 1x Samsung
* Flash: 512MiB Winbond W29N04GZ or 256MiB Winbond W29N02GZ
* WLAN 2.4GHz: QCN5024 2x2:2 b/g/n/ax
* WLAN 5GHz Low Band: QCN5054 2x2:2 a/n/ac/ax 5180-5320MHz
* WLAN 5GHz High Band: QCN5054 4x4:4 a/n/ac/ax 5500-5700MHz
* Ethernet: QCA8075 switch with 1 WAN and 3 LAN ports or 2 LAN ports
* Serial Config: 3.3V TTL 115200-8-N-1, internal populated header
* Serial Layout: Bottom <- RX, TX, GND, 3.3V (don't connect) -> Top
* LEDs: green/red power, white/red/green/blue status
* Buttons: 1x Reset, 1x WPS
MAC addresses:
LAN1: base address on label
LAN2: base + 1
LAN3: base + 2
WAN: base + 1
2.4GHz: base + 2
5GHz-Low: base + 3
5GHz-High: base + 4
Flashing Notes:
The stock firmware images are signed. Both the bootloader and the stock
web interface check the signature and will fail to boot/flash.
The bootloader automatically does NMRP when a gigabit LAN connection is
present. The stock and factory images contain a U-Boot script that is
executed when flashing using NMRP. This is used to alter and persist the
U-Boot env with a boot command that works with unsigned firmware.
Install OpenWrt:
* Get the nmrpflash utility [0] and OpenWrt factory image
* Find network interface to use: nmrpflash -L
* Start nmrpflash: nmrpflash -i interface -f openwrt-...-factory.img
* Connect the device LAN port closest to the power jack to the same
network using gigabit
* Plug the device in and wait for the bootloader to flash
* Unplug and replug the device once the power LED blinks amber
Revert to Stock:
The boot command needs to be reverted before flashing the stock firmware,
otherwise it will fail to boot and get stuck in recovery mode (red power
LED flashing).
* Run: fw_setenv bootcmd bootipq
* Restart the device
* Flash the stock firmware RBx750-Va.b.c.d.img using nmrpflash
[0]: https://github.com/jclehner/nmrpflash
Signed-off-by: Michael Lotz <mmlr@mlotz.ch>
Link: https://github.com/openwrt/openwrt/pull/21938
Signed-off-by: Robert Marko <robimarko@gmail.com>
Replace the following pending patches which have now been merged in
kernel v6.20:
- arm64: dts: qcom: ipq5018: Remove tsens v1 fallback compatible
- clk: qcom: gcc-ipq5018: flag sleep clock as critical
- arm64: dts: qcom: ipq5018: Correct USB DWC3 wrapper interrupts
Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/21883
Signed-off-by: Robert Marko <robimarko@gmail.com>
TCL LINKHUB HH500V also known as Vodafone Gigacube B157 is a dual band
802.11ax 5G NR CPE with an FXS port.
Specifications:
* SoC: Qualcomm IPQ8072A
* RAM: 1024 MB
* NAND flash: 256MB NAND (MT29F2G08ABBGAH4)
* NOR flash: 64MB NOR (MX25U25635F) - only in some variants
* WiFi 5G: Qualcomm QCN5054
* WiFi 2.4G: Qualcomm QCN5024
* Ethernet 2.5G: Qualcomm QCA8081
* Ethernet 1G: Qualcomm QCA8075
* Modem: GosunCn GM800 (Qualcomm Snapdragon X55)
* SIM: 1 nano-SIM card slot
* Buttons: Power, Reset, WPS
* LEDs: Power (B/R), WiFi (B), 4G (B/Y/R), 5G (B/Y/R)
* VoIP: 1 FXS RJ11 port (not supported in OpenWrt)
* Power: 12V, 3A
UART serial console:
* 115200,8N1,1.8V
* Three unmarked test points next to QJ2012A:
+---------+
| QJ2012A |
+---------+
o TX
o GND
o RX
o
o
o
Installation via OEM firmware:
* Use the following process to obtain root ssh access
https://forum.openwrt.org/t/150371/24
* Connect using root with no password on port 42000
* Optionally for serial bootloader access run :
fw_setenv bootdelay=3
* SCP factory.bin to /tmp
* Run:
sysupgrade -n /tmp/factory.bin
Installation via serial console and OEM firmware::
* Use console to access OEM firmware shell
* Proceed with SCP & sysupgrade as described above
Other notes:
* This device uses active partition rotation
* Some versions (TCL branded?) have a NOR chip in addition to NAND
* The above is supported by u-boot patching DT partitions
* DT patching does NOT occur on tftpboot/bootm
* Modem is detected as foxconn-sdx55 by kernel (same VID/PID)
* This works OK-ish and should be improved if we can get OEM modem details
Signed-off-by: Milan Krstic <milan.krstic@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19182
Signed-off-by: Robert Marko <robimarko@gmail.com>
The BOOTCONFIG partition is used by Qualcomm's boot chain to store
metadata about the device's startup configuration. It contains info such
as versioning, configuration flags, primary boot partition, and more.
Newer devices with dual boot partitions not only store the active boot
partition in a U-boot variable but also in partition info in the
BOOTCONFIG partition. As such, add library functions to set and toggle
the active boot partition.
Signed-off-by: Milan Krstic <milan.krstic@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19182
Signed-off-by: Robert Marko <robimarko@gmail.com>
Taiga Ogawa
Shiji Yang
George Moussalem
Rosen Penev
Christoph Krapp
chinawrj
Robert Marko
Ziyang Huang
Mieczyslaw Nalewaj
Steffen Förster
Paweł Owoc
John Crispin
John Audia
Fire Chen
Alexandru Gagniuc
Mikhail Zhilkin
Christian Marangi
Michael Lotz
Milan Krstic