Airoha reported some additional bug and fixes were pushed for the ethernet
driver. Backport the additional patch merged upstream and refresh all
affected patch.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
The NOR Flash mtd erase block size is 4 KB on ath79 tiny sub-target.
Squashfs-split driver always check and create the jffs2 rootfs_data
partition on the first free block. However, sysupgrade script append
the config backup to the end of the sysupgrade image. If we pad the
image to the 64 KB boundary, the kernel will be unable to find a
valid jffs2 partition and then recreate the rootfs_data partition.
Users may lose their config during upgrades. Fix this issue by setting
BLOCKSIZE to 4 KB so that the sysupgrade image can be aligned to the
4 KB boundary.
Fixes: https://github.com/openwrt/openwrt/issues/20495
Fixes: 05d35403b2 ("ath79-tiny: enable 4k sectors")
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/22497
Signed-off-by: Robert Marko <robimarko@gmail.com>
The current code permits support of the standalone PCS feature only for
in-tree kernel module but doesn't correctly support PCS from external
kernel module.
This is caused by the fact that the FWNODE_PCS config flag is internally
selected by any PCS driver and can't be selected directly. This is
problematic for any external kernel module that wants to use the standalone
PCS feature and needs the OPs provided by the generic PCS code.
Moreover compiling the standalone PCS code as a module is problematic and
would cause link error caused by the late PCS code that introduce a
notifier where phylink code depends on.
To address both problem, permit to select the FWNODE_PCS and change it to a
simple bool preventing it to compile as a module.
Link: https://github.com/openwrt/openwrt/pull/23349
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
After the standalone Airoha PCS driver and pcs-handle binding, wan (gdm2)
and lan2 (gdm4) netdevs probe but do not pass traffic.
Similar to the Aeonsemi PHY it seems also the RTL PHY needs in-band to the
PCS for USXGMII to work correctly. This still needs to be better
investigated but in the meantime lets apply this workaround to restore
traffic.
Signed-off-by: Daniel Pawlik <pawlik.dan@gmail.com>
[ improve commit description ]
Link: https://github.com/openwrt/openwrt/pull/23383
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
This commit adds support for the netis MEX605, which is a variant based on the netis NX30 V2.
1. Update brand naming from Netis to netis to follow the official branding.
2. Rename NX30V2 to NX30 V2 to correctly reflect it as the second version of the NX30.
3. Update variant notation for consistency.
cherry picked from commit c982357
1. Add 'model' to the DTS for netis NX30 V2 and define WiFi LED.
4. Fix typo.
Signed-off-by: Zhiwei Cao <bfdeh@126.com>
Signed-off-by: David Han <h96643864@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22726
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This was needed before the env-size binding was available to restrict it
to a specific size. No longer a need for this.
This should be no-op since status = "disabled";
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22367
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
It was discovered that the internal PHY interrupt are not always connected
and PHY link up/down is not correctly detected.
This is the case of the Nokia Valyrian board that suffer from this problem.
To handle this, drop the internal PHY interrupt property from DTSI and add
it only to the Gemtek W1700K DTS where it was reported to work correctly.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
The EN751627 EcoNet subtarget consists of the EN7516 DSL SoC and the
(rare) EN7527 xPON SoC.
We currently support pci / wifi, usb and flash, but the EN751221 eth
driver is not portable to this family right now.
Zyxel EX3301-T0 is a wifi router based on the EN7516, it is a DSL SoC
but lacks the DSL port.
Installation instructions:
1. Serial access is required, stop the Zyxel bootloader.
2. Use ATENv3 https://github.com/cjdelisle/ATENv3 to unlock bootloader
3. "ATLD x" on the prompt to start a TFTP server
4. Connect ethernet cable from any lan (yellow) port on modem to a
device.
5. On your device, configure network to 192.168.1.2/30
6. On your device, send TRX file to 192.168.1.1 with name x, i.e.
tftp -p -l ./econet/tclinux -r x 192.168.1.1
7. On modem, you should see a line like this:
"Total 8022324 (0x7A6934) bytes received" note the hex value
8. "ATGU" to enter econet bootloader
9. "flash 80000 80020000 <the hex number without 0x>"
For example: flash 80000 80020000 7A6934
10. "reboot 1" -- start the system
If it boots back into the factory OS, you need to switch OS, from the
ZHAL prompt:
1. "ATCB" -- load data from flash
2. "ATCF 0" -- switch to OS 0
3. "ATBT 1" -- enable flash write
4. "ATSB" -- save data
5. "ATSR 1" -- reboot system
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/22945
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This improves on openwrt/openwrt@aeb9028aab by adding support for
other Dell EMC Edge620/640/680 devices and mapping
the interfaces to match the markings on the device.
This modifies the netdevices.mk file to set the boot flag for
ixgbe driver to load it in early stage of the boot process to
allow for proper mapping of the network interface PCI paths
inside the 02_network script. This will also allow other devices
using the ixgbe driver to do proper mapping in 02_network script.
The 02_network script is then modified to support all
dell-emc-620/640/680 devices. It now maps the network
interfaces via PCI paths to match the markings on the device.
The interface marked GE6 is still used for WAN with
interfaces GE1-GE5 used for LAN.
The SFP1 and SFP2 interfaces are left to be assigned by
the user.
Signed-off-by: Raylynn Knight <rayknight@me.com>
Link: https://github.com/openwrt/openwrt/pull/23110
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This patch adds support for Huawei HG2821T-U, EPON ONU and home router,
often comes with ISP service.
Specifications
==============
* SoC: Econet EN7526GT
* RAM: 512MiB DDR3L (MT41K256M16TW-107)
* Flash: 256MiB SPI NAND (TC58CVG1S3HRAIG)
* WiFi 2.4GHz: MT7592N
* WiFi 5GHz: MT7612EN
* Ethernet: builtin switch
* LED: Power, Internet, WiFi, USB
* Buttons: Reset
* UART: Serial console (115200 8n1)
* USB: 1 x USB2
* Other: Phone jack, XPON fiber port
!!! BACKUP YOUR ROM !!!
=======================
Please always have your FULL flash image backup before flashing
anything. The vendor firmware varies a lot depending on your ISP and
location. You will have a hard time finding the right regional firmware
if you don't have a backup.
Notes
=====
* Due to the target `econet` being incomplete, WiFi, DSA switch, and
many other features are not supported yet. Do not flash the image unless
you know the consquences or `econet` is declared stable.
* This device, and apparently many other devices of this platform, use
a dual-image layout. OpenWRT (with `econet` target) only uses slot A.
Slot B is not used by OpenWRT, and is applicable for dual-booting to
vendor firmware.
* If you do not use vendor firmware anymore, you can erase and reuse
anything after `configuration_b`, which gives you ~110 MiB free space.
Again, backup your flash first.
Installation
============
Within shell
------------
Note that acquiring the shell access to the vendor firmware can be a bit
tricky depending on the firmware variation. If you can't play with the
vendor firmware, boot to OpenWrt using debricking method below.
0. (Optional) Back up your flash, and / or move the vendor firmware to
slot B
1. Build and then locate the `kernel.bin` and `rootfs.bin` image files
2. Upload `kernel.bin` and `rootfs.bin` to the device (via HTTP or USB
stick), then type:
```
mtd write -f -e KernelA kernel.bin KernelA
mtd erase RootfsA
mtd write -f -r -e AppA rootfs.bin AppA
```
From bootloader
---------------
1. Build and then locate the `kernel.bin` and `rootfs.bin` image files
2. Switch device on and press a key within 3 seconds
3. Upload `kernel.bin` via TFTP as described below
4. Once the transfer has completed successfully, bootloader will give
you the file length in "Total %d (0x%X) bytes received", then type
`flash 200000 80020000 <file length hex>`
5. Upload `rootfs.bin` then flash with
`flash 600000 80020000 <file length hex>`
6. Restart the device to boot into OpenWRT
> [!IMPORTANT]
> Do not try `httpd` in the bootloader. It writes to the wrong address
and will corrupt the flash.
Debricking
==========
1. Build and then locate the `initramfs-kernel.bin` image files
2. Switch device on and press a key within 3 seconds
3. Connect to device via ethernet, set the IP address to `192.168.1.X`,
then upload the image via TFTP
`tftp 192.168.1.1 -m binary -v -c put initramfs-kernel.bin`
The file name can be anything except `tcboot.bin` or `tclinux.bin`,
they will corrupt the flash.
4. Type `jump 80020000` to boot the kernel from memory
Dual boot
=========
Use `en75_chboot` tool to switch between vendor firmware and OpenWrt. If
you are soft-locked, you can also switch the flag in the bootloader:
1. Switch device on and press a key within 3 seconds
2. Select the kernel that you wish to use:
- `memwl 80020000 30ffffff` for `KernelA` (OpenWrt)
- `memwl 80020000 31ffffff` for `KernelB` (Factory)
3. Select the rootfs, which should be the same as the kernel:
- `memwl 80020004 30ffffff` for `RootfsA` (OpenWrt)
- `memwl 80020004 31ffffff` for `RootfsB` (Factory)
3. Commit the data to flash: `flash 1e0000 80020000 8`
4. Restart the device to boot into the selected OS
MAC addresses
=============
`//configuration_a/factory.conf` contains MAC addresses, along with
other pre-configured settings. OpenWrt uses `brmac`, `internetmac`,
`APMAC`, and `APMAC_5G`, while `tr069mac`, `voipmac`, `priprotocolmac`,
and `PONMac` are not used for now.
Signed-off-by: David Yang <mmyangfl@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23131
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Extend the EN7528 PCIe driver to EN751221 with a specific PHY
tuning ritual. Also enable wifi drivers on SmartFiber XP8421-B,
TpLink Archer VR1200V v2 and Zyxel PMG5617GA.
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/22208
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The AN7531N SoC has currently problems communicating using `phy_mmd_...`
when irqbalance is active. But when there is a communication error in the
interrupt handler, the interrupt will be disabled. This can usually be seen
in the logs as:
irq 53: nobody cared (try booting with the "irqpoll" option)
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.12.77 #0
Tainted: [O]=OOT_MODULE
Hardware name: Gemtek W1700K (OpenWrt U-Boot layout) (DT)
Call trace:
dump_backtrace.part.0+0xbc/0xcc
show_stack+0x14/0x20
dump_stack_lvl+0x58/0x74
dump_stack+0x14/0x1c
__report_bad_irq+0x48/0xf8
note_interrupt+0x2f4/0x340
handle_irq_event+0xac/0xe0
handle_simple_irq+0xa8/0xfc
handle_irq_desc+0x30/0x54
generic_handle_irq+0x1c/0x24
airoha_irq_handler+0x90/0xe0
__handle_irq_event_percpu+0x44/0x11c
handle_irq_event+0x40/0xe0
handle_fasteoi_irq+0xb4/0x240
handle_irq_desc+0x30/0x54
generic_handle_domain_irq+0x18/0x20
gic_handle_irq+0x60/0xec
do_interrupt_handler+0x4c/0x84
el1_interrupt+0x30/0x4c
el1h_64_irq_handler+0x14/0x1c
el1h_64_irq+0x68/0x6c
handle_softirqs+0x98/0x210
__do_softirq+0x10/0x18
____do_softirq+0xc/0x20
call_on_irq_stack+0x30/0x50
do_softirq_own_stack+0x18/0x20
irq_exit_rcu+0x80/0xb8
el1_interrupt+0x34/0x4c
el1h_64_irq_handler+0x14/0x1c
el1h_64_irq+0x68/0x6c
default_idle_call+0x24/0x34
do_idle+0x98/0xf0
cpu_startup_entry+0x30/0x38
kernel_init+0x0/0x130
console_on_rootfs+0x0/0x64
__primary_switched+0x80/0x88
handlers:
[<000000002b75be58>] irq_default_primary_handler threaded
[<000000006d87ada6>] phy_interrupt
Disabling IRQ #53
This is not a problem with the rtl8261n driver because it is not
registering an interrupt handler. But with the kernel realtek PHY driver, a
interrupt handler is registered which can trigger this problem on bootup.
To avoid is, disable the interrupt and use the PHY polling mode also wit
the upcoming realtek PHY driver support for RTL8261.
Co-authored-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Co-authored-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Daniel Pawlik <pawlik.dan@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23078
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Some W1700K and XR1701G boards with Realtek RTL8261N/RTL8261BE 10G PHYs
fail to bring up the USXGMII link on cold boot. The PHY enters a bad
state during initialization and the link stays down permanently until
power cycle.
Root cause: the GPIO reset assert/deassert timing (40ms/150ms) is too
short for the RTL8261N to complete its internal firmware load. The OEM
firmware uses 200ms/200ms.
Increase both PHY reset timings to 200ms/200ms to match OEM values.
Confirmed to fix intermittent boot failures on both W1700K (Gemtek)
and XR1701G boards.
Signed-off-by: Ryan Chen <rchen14b@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22564
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The RTL8365MB_DIGITAL_INTERFACE_SELECT_MODE_MASK macro was shifting
the 4-bit mask (0xF) by only (_extint % 2) bits instead of
(_extint % 2) * 4. This caused the mask to overlap with the adjacent
nibble when configuring odd-numbered external interfaces, selecting
the wrong bits entirely.
Align the shift calculation with the existing ...MODE_OFFSET macro.
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/23285
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Ethernet LAN port is set to `eth1` (silkscreen "ETH2" and case label "2") next to the 2x USB Type-A
ports and WAN is set to `eth0` (silkscreen "ETH1" and case label "1") next to the USB Type-C port.
The USER ("reset") button serves as the reset button. A short press will reboot and a long press
will reset to factory settings (deleting all data) if using squashfs image.
MASK ("maskrom") and RCRY ("recovery") buttons are enabled but are not set to any specific function
Pressing the POWER button will `poweroff` the device and it will stay off until a power cycle.
Hardware
---------------
* SoC: RockChip RK3576 64-bit ARMv8-A 8 cores big.LITTLE (4x A72 and 4x A53)
* RAM: 3/4GB LPDDR4X or 8/16GB LPDDR5
* Ethernet: 2x GbE (SoC RGMII MAC, RTL8211F PHY)
* 3x LEDs (SYS - red / 1 (WAN) - green / 2 (LAN) - green)
* 4x Buttons (MASK ("maskrom"), RCRY ("recovery"), USER ("reset" - OpenWrt reset), POWER)
* 1x 16MiB SPI NOR on board
* 1x UFS slot for optional UFS 2.0 module (currently not supported)
* 1x microSD card slot (UHS-I)
* 1x HDMI OUT
* 1x Headphone OUT 3.5mm
* 1x M.2 M-key 2280 PCIe slot (PCIe 2.1 x1 supports NVMe SSD)
* 1x M.2 E-key *SDIO* slot for optional RTL8822CS Wi-Fi 5
* the case has integrated antennae as well as 2x knockouts
* the device tree is missing the nodes relevant to Wi-Fi operations so it's not supported for now.
* 2x USB 3.2 Gen 1 Type-A Ports
* Power: 1x USB Type-C 6V-20V with both DC and USB PD supported
* Serial: 1500000 8N1 3.3V - 2.54mm 3-pin header next to HDMI
MAC addresses
---------------
WAN (`eth0` case label "1"): generated from /sys/.../mmcblk0/cid (CID of SD card)
LAN (`eth1` case label "2"): WAN + 1
Installation
---------------
Decompress the archive of the OpenWrt sysupgrade image and write it to a microSD card using `dd`
or use Balena Etcher (no need to decompress).
Boot
---------------
Insert microSD card, set boot switch to "UFS/SD" and then supply power.
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23008
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Apply pending U-Boot patches so that Rockchip RK3576 devices can boot from SD card. The problem:
"The BootROM on RK3576 has an issue loading boot images from an SD-card. This issue can be worked
around by injecting an initial boot image before TPL…and return to BootROM to load next image, TPL"
Compilation of the initial boot image has been added to the U-Boot build recipe.
Tested on FriendlyELEC NanoPi M5
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23008
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Select `CONFIG_ROCKCHIP_SARADC=y` to enable Rockchip SAR ADC
Add ADC Ladder Buttons driver as a kernel module as well as `kmod-button-hotplug` to the list of
default packages for Rockchip targets that have buttons connected to ADC, not including some
devices (e.g. NanoPi R76S) that have ADC buttons which are not in the device tree.
This is needed to use buttons on Rockchip devices that are connected to ADC and not GPIO
Tested on FriendlyELEC NanoPi M5
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23008
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add chip info entry for the Realtek RTL8367SB switch. This device has
chip ID 0x6367 and version 0x0010. It exposes two external interfaces:
port 6 supports MII, TMII, RMII, RGMII, SGMII and HSGMII, while port 7
supports MII, TMII, RMII and RGMII. Use the existing 8365MB-VC jam table
for initialization.
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/23345
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The RG-EW1300G is a router with 1 x WAN and 3 x LAN gigabit ports.
The router runs on Ruijie OS by default.
- Specifications:
* SoC: MT7621A
* RAM: 128MB DDR3
* Flash: 16MB SPI NOR flash (GD25Q128C)
* WiFi0: Mediatek MT7615 2.4GHz 802.11b/g/n
* WiFi1: Mediatek MT7615 5GHz 802.11ac
* Ethernet: MT7530, 4x 1000Base-T.
* UART: Serial console - As marked on PCB, baudrate is 57600. DO NOT CONNECT 3.3V.
* Buttons: Reset, WPS.
* LED: Programmable LEDs via GPIO working for Red+Green status, and Mesh/WPS at the rear of the chassis.
- Default Flash:
```
GD25Q128C(c8 40180000) (16384 Kbytes)
mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
6 cmdlinepart partitions found on MTD device raspi
Creating 6 MTD partitions on "raspi":
0x000000000000-0x000000050000 : "u-boot"
0x000000050000-0x000000060000 : "u-boot-env"
0x000000060000-0x000000070000 : "Factory"
0x000000070000-0x000000080000 : "product_info"
0x000000080000-0x000000090000 : "kdump"
0x000000090000-0x000001000000 : "firmware"
0x00000031a847-0x000001000000 : "rootfs"
mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
mtd: partition "rootfs_data" created automatically, ofs=0xae0000, len=0x520000
0x000000ae0000-0x000001000000 : "rootfs_data"
register mt_drv
```
```
cat /proc/mtd
dev: size erasesize name
mtd0: 00050000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "factory"
mtd3: 00010000 00010000 "product_info"
mtd4: 00010000 00010000 "kdump"
mtd5: 00f70000 00010000 "firmware"
mtd6: 0028a847 00010000 "kernel"
mtd7: 00ce57b9 00010000 "rootfs"
mtd8: 00520000 00010000 "rootfs_data"
```
- Installation:
1. Open the case, solder to the marked 4 pin header
2. Connect it to a USB-UART TTL (do not connect to 3.3v)
3. Open a terminal with baud 57600.
4. Power on device, and repeatedly press "2" key to catch bootloader option
5. Set IP, TFTP server IP, and image file to load (eg, openwrt-ramips-mt7621-ruijie_rg-ew1300g-v1-squashfs-sysupgrade.bin)
6. System will reboot into OpenWRT.
Signed-off-by: Matt Brent <git@mattzfiber.co.za>
Link: https://github.com/openwrt/openwrt/pull/21864
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
With new PCS implementation, the pcs property needs to be updated to the
new name of 'pcs-handle' to correctly work with PCS fwnode
consumer/provider.
Fixes: 4d5f579a81 ("airoha: update PCS node in DTSI for new PCS implementation")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
The nRESET pins of the RTL8224 PHYs on the PSX8/PSX10 are wired to GPIO6
(lan1-4) + GPIO10 (lan5-8) of the SoC, but this was never described in the
devicetree.
GPIO 6 is the global reset shared by (logical) PHYs 0-3 on MDIO bus0. GPIO
10 is the global reset shared by (logical) PHYs 8-11 on mdio bus0. It is
intentionally not declared as reset-gpios on any bus: the MDIO driver /
phylink only support a single reset GPIO per bus, not two (or more). And a
GPIO can only be used as reset-gpio on a single PHY. Attaching it to a
single PHY would still reset the other PHYs on the same chip as a side
effect, leaving their software state out of sync with the hardware and
likely breaking them.
Signed-off-by: Sven Eckelmann <se@simonwunderlich.de>
Link: https://github.com/openwrt/openwrt/pull/23297
Signed-off-by: Robert Marko <robimarko@gmail.com>
The nRESET pins of the RTL8224 PHYs on the PSX28/ESX28 are wired to GPIO29
of the SoC, but this was never described in the devicetree.
GPIO 29 is the global reset shared by all PHYs across all MDIO busses. It
is intentionally not declared as reset-gpios on any bus: the MDIO driver /
phylink only support a reset GPIO per bus, not on the parent controller.
Attaching it to a single bus would still reset the PHYs on the other busses
as a side effect, leaving their software state out of sync with the
hardware and likely breaking them.
Signed-off-by: Sven Eckelmann <se@simonwunderlich.de>
Link: https://github.com/openwrt/openwrt/pull/23297
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit adds support for the Meraki Z3C "Teleworker" device with
802.11ac, LTE Cat 3 modem, and an integrated 5 port Gigabit switch.
Port 5 has POE output (802.3af). The WAN port is used for tftp booting
in U-Boot.
This device ships with secure boot, and cannot be flashed without an
external programmer.
|||
|--|--|
|Model|Z3C|
|CPU|Qualcomm Atheros IPQ4029|
|Flash MB|128 NAND|
|RAM MB|512|
|WLAN Hardware|Qualcomm Atheros IPQ4029|
|WLAN 2.4GHz|b/g/n 2x2|
|WLAN 5.0GHz|a/n/ac 2x2|
|WWAN|LTE Cat 3|
|Ethernet 1Gbit ports|5|
The LAN/WiFi MAC addresses are sourced from an internal I2C EEPROM.
Z3C-HW-NA (NA: North America) supports LTE bands: 2,4,5,13,17
Z3C-HW-WW (WW: World-wide) supports LTE bands: 1,3,7,8,20
Disassembly:
Remove the four T8 screws on the bottom of the device under the rubber feet.
Using a guitar pick or similar plastic tool, insert it on the side between
the bottom case and the side, pry up gently. The plastic bottom has 18 latches
around the perimeter (but none on the rear by the Ethernet ports).
Remember to remove the SIM tray!
Gently remove the metal RF shield on the bottom of the PCB.
The TSOP48 NAND flash (U30, Spansion S34ML01G200TFV00) is located on the bottom
side of the PCB (facing you as you remove the bottom plastic). To flash, you
will need to desolder the TSOP48. Attempts to flash in-circuit using a 360 clip
were unsuccessful.
The SOIC8 I2C EEPROM (U32, Atmel 24C64) is located on the bottom side of the PCB
under a metal RF shield. It can be flashed in circuit using a chip clip. You may
have to bend the RF shield up to fit the chip clip.
The UART header is on the top (opposite) side of the PCB. You do not need to
remove any more screws to remove the PCB. The PCB has some thermal interface
material for heat dissipation and will be slightly difficult to remove the
first time. Gently pry up on the green PCB from one of the front corners until
the thermal pads break contact with the top case. You can then lift out the
entire PCB, including the attached LTE/WiFi antennas.
Installation:
The dumps to flash can be found in this repository:
https://github.com/halmartin/meraki-openwrt-docs/tree/main/z3c
The device has the following flash layout (offsets with OOB data):
```
0x000000000000-0x000000100000 : "sbl1"
0x000000100000-0x000000200000 : "mibib"
0x000000200000-0x000000300000 : "bootconfig"
0x000000300000-0x000000400000 : "qsee"
0x000000400000-0x000000500000 : "qsee_alt"
0x000000500000-0x000000580000 : "cdt"
0x000000580000-0x000000600000 : "cdt_alt"
0x000000600000-0x000000680000 : "ddrparams"
0x000000700000-0x000000900000 : "u-boot"
0x000000900000-0x000000b00000 : "u-boot-backup"
0x000000b00000-0x000000b80000 : "ART"
0x000000c00000-0x000007c00000 : "ubi"
```
* Dump your original NAND (if using nanddump, include OOB data).
* Decompress `u-boot.bin.gz` dump (contains OOB data) and overwrite the
`u-boot` portion of NAND from `0x738000-0x948000` (length `0x210000`).
* Decompress `ubi.bin.gz` dump (contains OOB data) and overwrite the `ubi`
portion of NAND from `0xc60000-0x8400000` (length `0x77a0000`).
* Dump your original EEPROM. Change the byte at offset `0x49` to `0x1e`
(originally `0x2a`). Remember to re-write the EEPROM with the
modified data.
* This can be done on Linux via the following command:
`printf "\x1e" | dd of=/tmp/eeprom.bin bs=1 seek=$((0x49)) conv=notrunc`
**Note**: the device will not boot if you modify the board major number and
have not yet overwritten the `ubi` and `u-boot` regions of NAND.
* Resolder the NAND after overwriting the `u-boot` and `ubi` regions.
OpenWrt Installation:
* After flashing NAND and EEPROM with external programmers. Plug in an
Ethernet cable and power up the device.
* The new U-Boot build uses the space character `" "` (without quotes) to
interrupt boot.
* Interrupt U-Boot and `tftpboot` the OpenWrt initramfs image from your
tftp server
```
dhcp
setenv serverip <your_tftp>
tftpboot openwrt-ipq40xx-generic-meraki_z3c-initramfs-uImage.itb
```
* Once booted into the OpenWrt initramfs, created the `ART` ubivol with
the WiFi radio calibration from the mtd partition:
```
cat /dev/mtd10 > /tmp/ART.bin
ubiupdatevol /dev/ubi0_1 /tmp/ART.bin
```
* `scp` the `sysupgrade` image to
the device and run the normal `sysupgrade` procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_z3c-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_z3c-squashfs-sysupgrade.bin"
```
* OpenWrt should now be installed on the device.
* Note: To use the LTE modem as a WWAN, you must install `modemmanager`
(you probably also want `luci-proto-modemmanager`) and then configure
the modem for your provider.
Due to OpenWrt policies these packages are not included in the
initramfs/sysupgrade image.
Signed-off-by: Hal Martin <hal.martin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23307
Signed-off-by: Robert Marko <robimarko@gmail.com>
Remove target/linux/ipq40xx/dts/qcom-ipq4029-wired-qca-common.dtsi
This file is no longer used after the ipq40xx Meraki device tree
refactoring that occurred last year when adding support for the MR30H.
Signed-off-by: Hal Martin <hal.martin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23307
Signed-off-by: Robert Marko <robimarko@gmail.com>
This fixes:
* CVE-2026-6042: Algorithmic Complexity DoS in musl libc iconv
* CVE-2026-40200: musl libc: stack corruption in qsort with sufficiently large inputs
Link: https://github.com/openwrt/openwrt/pull/23329
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Update the PCS node in AN7581/AN7583 .dtsi for new PCS implementation.
The #pcs-cell is now needed for the produced/consumer implementation.
Also add entry for USB and PCIe PCS for AN7581 but keep them disabled
by default. USB and PCIe PCS for AN7583 node will be added later once PHY
code will stabilize.
Link: https://github.com/openwrt/openwrt/pull/23271
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Migrate Airoha PCS/Ethernet pending patch to PCS standalone implementation.
This new implementation drop the hack of reading and accessing the dev from
a different device and drop the legacy pcs_create/drop implementation in
favor of fwnode one with a provider/consumer approach.
This is also to sync with the proposed series posted upstream for revision.
The new PCS patch for AN7581 implement full support for USB and PCIe PCS.
Link: https://github.com/openwrt/openwrt/pull/23271
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Backport phylink_replay_link() API patch from upstream kernel. This is
mostly needed for force_major_config bool in phylink struct needed for new
standalone PCS series.
While at it also rename the current 703 patch to 703-01 as it's part of the
same series merged upstream.
All patch automatically refreshed.
Link: https://github.com/openwrt/openwrt/pull/23271
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
With Kernel 6.18 the kernel size exceeds 4MB. Without additional changes
to the partition layout or kernel size reduction, the image will not be
usable. Disable this sub-target until necessary changes or a decision
regarding its removal have been made.
Signed-off-by: Stefan Kalscheuer <stefan@stklcode.de>
Link: https://github.com/openwrt/openwrt/pull/22761
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Without explicit dependency between these two packages compilation
against Kernel 6.18 fails with the following error:
Package kmod-leds-turris-omnia is missing dependencies for the
following libraries: turris-omnia-mcu.ko
Make the dependency explicit to resolve this issue.
Signed-off-by: Stefan Kalscheuer <stefan@stklcode.de>
Link: https://github.com/openwrt/openwrt/pull/22761
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
John Audia
Christian Marangi
Shiji Yang
Hauke Mehrtens
Stefan Kalscheuer
Daniel Pawlik
David Han
Rosen Penev
Andy Chiang
Caleb James DeLisle
Raylynn Knight
David Yang
Ryan Chen
Qingfang Deng
Mieczyslaw Nalewaj
Ryan Leung
librarat876
Matt Brent
Mikhail Zhilkin
Sven Eckelmann
Hal Martin
Hannu Nyman