Add support for Xiaomi AX5400 (RA74).
Specifications:
* SoC: Qualcomm IPQ5018 (64-bit dual-core ARM Cortex-A53 @ 1.0Ghz)
* Memory: Etrontech EM6HE16EWAKG 512 MiB DDR3L-933
* Serial Port: 1v8 TTL 115200n8
* Wi-Fi: IPQ5018 (2x2 2.4 Ghz 802.11b/g/n/ax - up to 574 Mbps)
QCN9024 (4x4 5 Ghz 802.11an/ac/ax - up to 4804 Mbps)
* Ethernet: IPQ5018 integrated virtual switch connected to an
external QCA8337 switch (3 LAN Ports 10/100/1000)
* Flash: Gigadevice GD5F1GQ5REYIG (128 MiB)
* LEDs: 1x System Blue (GPIO 24 Active High)
1x System Yellow (GPIO 25 Active High)
1x WAN Link Blue (GPIO 26 Active High)
1x WAN Link Yellow (GPIO 27 Active High)
* Buttons: 1x Reset (GPIO 38 Active Low)
1x WPS (GPIO 28 Active Low)
* MAC address layout: LAN (eth1): 0:art @ offset 0x0
WAN (eth0): 0:art @ offset 0x6
Flash instructions: (use redmi-ax5400 image for the Redmi AX5400)
Download XMIR Patcher: https://github.com/openwrt-xiaomi/xmir-patcher
First flash a ubinized OpenWrt initramfs that will serve as the intermediate step, since
OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for
packages, through either of the below two methods:
Installation via XMIR Patcher:
1. Load the initramfs image: openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi
Installation via ubiformat method, through SSH:
1. If needed, enable SSH using XMIR Patcher.
2. Copy the file openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi to the /tmp directory
3. Open an SSH shell to the router
4. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1):
nvram get flag_boot_rootfs
5. Find the rootfs and rootfs_1 mtd indexes respectively:
cat /proc/mtd
Please confirm if mtd18 and mtd19 are the correct indexes from above!
6. Use the command ubiformat to flash the opposite mtd with UBI image:
If nvram get flag_boot_rootfs returned 0:
ubiformat /dev/mtd19 -y -f /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit
otherwise:
ubiformat /dev/mtd18 -y -f /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit
7. Reboot the device by:
reboot
Continue in order to pernamently flash OpenWrt:
1. Upload the sysupgrade image to /tmp/ using SCP:
scp -O <path to image> root@192.168.1.1:/tmp/
2. Open an SSH shell to 192.168.1.1 from a PC within the same subnet
3. Use sysupgrade to flash the sysupgrade image:
sysupgrade -n -v /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-squashfs-sysupgrade.bin
Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired.
Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23374
Signed-off-by: Robert Marko <robimarko@gmail.com>
rebuilding x86 did fail in an existing build directory
mkdir fails if the folder exists already
Signed-off-by: Sander Schutten <schutten@hotmail.com>
Signed-off-by: Florian Maurer <fmaurer@disroot.org>
Changes:
update regulatory database based on preceding
Update regulatory rules for India (IN) on 6GHz
Replace M2Crypto with cryptography package
Fix regulatory.bin signing with new
Signed-off-by: xiao bo <peterwillcn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23101
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The basic AN7581 NPU FW also supports WiFi offload for MT7992 WiFi chip.
Add this information in the package description to clarify this.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Switch http:// (and redundant ftp://) PKG_SOURCE_URL entries to https://
across tools/ and package/. PKG_HASH alone does not protect against an
attacker tampering with insecure downloads when a maintainer regenerates
the hash via `make ... FIXUP=1`: HTTPS authenticates the upstream so the
captured hash reflects real upstream content.
In-place http -> https (HTTPS reachability verified per host):
- tools/elftosb, tools/lzop, tools/liblzo, tools/mpfr, tools/dosfstools,
tools/libressl, tools/xz
- package/libs/mpfr, package/libs/libmnl, package/libs/libnfnetlink
Replaced with @OPENWRT (HTTPS-only mirror) where the upstream HTTPS host
is dead or has a broken certificate:
- package/libs/popt (ftp.rpm.org cert mismatch)
- package/firmware/ixp4xx-microcode (was http://downloads.openwrt.org)
- package/boot/imx-bootlets (trabant.uid0.hu cert mismatch)
- package/boot/kobs-ng (freescale.com URL is dead, redirects to nxp.com root)
Dropped redundant ftp://ftp.denx.de fallback (https://ftp.denx.de is
already listed):
- package/boot/uboot-tools, tools/mkimage
Signed-off-by: Paul Spooren <mail@aparcar.org>
The by-now-upstream driver for the built-in 2.5GE PHY of the MediaTek
MT7988 and MT7987 SoC loads firmware at probe time.
Build the driver as a module in order to make sure the driver only
attempts to load the firmware by the time the rootfs with the firmware
file has become available.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
NN6000v1 Specifications:
SoC: Qualcomm IPQ6000 1.2GHz
RAM: K4B4G1646E-BCMA 512MiB x2 = 1 GiB
Flash: FORESEE 256GB eMMC
ETH: QCA8075 (2x LAN, 1x WAN)
WLAN1: QCN5022 2.4GHz AX 2x2
WLAN2: QCN5052 5GHz AX 2x2
Power: DC 12V
Button: Reset, Wps
USB: 1x 3.0
NN6000v2 Specifications:
SoC: Qualcomm IPQ6000 1.2GHz
RAM: MT41K512M16VRN-107 IT:P 1GiB x2 = 2 GiB
Flash: FORESEE 256GB eMMC
ETH: QCA8075 (4x LAN, 1x WAN)
WLAN1: QCN5022 2.4GHz AX 2x2
WLAN2: QCN5052 5GHz AX 2x2
Power: DC 12V
Button: Reset, Wps
USB: 1x 3.0
Install via UART:
1. Download the initramfs image, rename it to
initramfs.itb, host it with the tftp server.
2. Interrupt U-Boot and run these commands:
tftpboot initramfs.itb
bootm
3. After openwrt boots up, use scp or luci web
to upload sysupgrade.bin to upgrade.
Install via Uboot WebUI:
- Only work when you flash a custom uboot with webui
- Push the reset button for 5 seconds, then use broswer to
access http://192.168.1.1/, then upload factory.bin.
Signed-off-by: Fire Chen <firedevel@icloud.com>
Link: https://github.com/openwrt/openwrt/pull/21787
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Hardware
========
SoC: Qualcomm IPQ4018
ETH: Qualcomm QCA8075 (2 x RJ-45)
WDG: OnSemi SCT706
RAM: Micron MT41K128M16JT-125 (256MB)
NOR: Infineon S25FL512S (64MB)
Installation
============
1. Create a ramboot-able image with the command
{ dd if=/dev/zero bs=32 count=1 2>/dev/null; \
cat openwrt-ipq40xx-generic-huawei_ap4050dn-initramfs-uImage.itb; \
} > ramboot.bin`
2. Start a TFTP server in the folder with the ramboot.bin.
3. Plug in a USB-RJ45 serial adapter to the CONSOLE port of the device
and start a serial console session with
9600 baud, no parity, 1 stop bit.
4. Plug in either 12V power or PoE to the device.
5. On the prompt `Press f or F to stop Auto-Boot in 3 seconds`,
press `f` to enter the Huawei U-Boot command line
6. Enter a new password for the u-boot command line
7. In the command line, run these commands to ramboot OpenWrt:
setenv serverip <IPv4 address of TFTP server>
setenv ipaddr <IPv4 address for this AP>
setenv rambootfile ramboot.bin
run ramboot
8. In OpenWrt, set up the network and then `scp` the files
`u-boot-huawei_ap4050dn/uImage` and
`openwrt-ipq40xx-generic-huawei_ap4050dn-squashfs-sysupgrade.bin`
into `/tmp/`
9. To backup the original firmware, run the following:
cat /dev/mtd12 /dev/mtd13 > huawei_ap4050dn_fw_backup.bin.bin
10. Run the following commands to flash u-boot and OpenWrt to the device:
mtd erase uboot
mtd write /tmp/uImage uboot
sysupgrade -n /tmp/openwrt-ipq40xx-generic-huawei_ap4050dn-squashfs-sysupgrade.bin
11. The device should now boot OpenWrt! (sometimes the boot process takes a bit
longer due to the watchdog resetting the device before the watchdog driver runs)
Signed-off-by: Marco von Rosenberg <marcovr@selfnet.de>
Add support for Airoha EN7581/AN7583 NPU variant firmware present in
linux-firmware. The Airoha EN7581 NPU variant is to support devices
equipped with the MT7996 WiFi chip.
While at it also add an extra new line to follow pattern of double new line to
separate each firmware package.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
75bedc5 wireless-regdb: Update regulatory info for Australia (AU) for 2025
a6e5195 wireless-regdb: Update broken link in regulatory.bin(5) manpage
9e8c67f wireless-regdb: Update regulatory info for Malaysia (MY) for 2024
61a4637 wireless-regdb: Update regulatory info for Malaysia (MY) for 2025
5cefe55 wireless-regdb: Update regulatory info for Tunisia (TN) on 6GHz for 2025
1a729ae wireless-regdb: Update regulatory info for Canada (CA) for 2025
ea20dfa wireless-regdb: update regulatory database based on preceding changes
Link: https://github.com/openwrt/openwrt/pull/22150
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
CMCC MR3000D-CI is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on
IPQ5000.
Device specification
--------------------
- SoC : Qualcomm IPQ5018
- RAM : 512 MiB DDR3L
- Flash : 128 MiB SPI-NAND (GigaDevice GD5F1GQ5REYIG)
- WLAN : 2.4/5 GHz 2T2R
- 2.4 GHz : Qualcomm IPQ5018 (SoC)
- 5 GHz : Qualcomm Atheros QCN6102
- Ethernet : 4x 10/100/1000 Mbps
- Switch : Qualcomm Atheros QCA8337
- LEDs/Keys (GPIO) : 2x LEDs, 2x Buttons
- UART : Through-hole on PCB
- Voltage : 3.3 V
- Assignment : Silkscreened on PCB
- Settings : 115200n8
- Power : 12 VDC, 1.5 A
Installation
-----------------
1. Telnet method
a. Enable telnet
Log in to http://192.168.10.1/ with the password on the sticker
Modify URL according to example (keep your unique hash after ";stok=")
and press Enter:
http://192.168.10.1/cgi-bin/luci/;stok=78becad1b1490e45be2776025cde2b7d/api/NPCnetwork/ping?url=$(telnetd)
You should get the following in the browser:
{"link":0}
b. Run tftp server on IP 192.168.10.254 and put factory image
'openwrt-qualcommax-ipq50xx-cmcc_mr3000d-ci-squashfs-factory.ubi'
in the tftp root dir.
c. Login to 192.168.10.1 with telnet (user: root, pass: from the
sticker).
d. Download factory image from the tftp:
tftp -l factory.ubi -r openwrt-qualcommax-ipq50xx-cmcc_mr3000d-ci-squashfs-factory.ubi -g 192.168.10.254
e. Flash factory image:
export rootfs=$(cat /proc/mtd | grep rootfs | grep -v _ | cut -d: -f1)
ubidetach -f -p /dev/${rootfs}
ubiformat /dev/${rootfs} -y -f /tmp/factory.ubi
f. Reboot:
reboot
2. U-Boot Method using UBI Image (using UART)
a. Place the factory.ubi file on your TFTP server, enter U-Boot CLI
and exec these commands:
tftpboot <your_tftp_server_ip>:factory.ubi
flash rootfs
reset
3. U-Boot Method using initramfs Image (using UART)
a. Place the openwrt-*-initramfs-fit-uImage.itb file on your TFTP
server and rename it to initramfs.bin
b. Enable serial console, enter to U-Boot CLI and exec these commands:
tftpboot <your_tftp_server_ip>:initramfs.bin
bootm
c. Once boot completed, upload the sysupgrade.bin file to router's
/tmp directory (using scp or wget) and execute the following command
in openwrt shell:
sysupgrade -n /tmp/sysupgrade.bin
MAC Addresses
-------------
+--------------+-------------------+-------------+
| Interface | MAC example | Location |
+--------------+-------------------+-------------+
| LAN | 84:7a:xx:xx:xx:dd | 0:ART, 0x6 |
| WAN (label) | 84:7a:xx:xx:xx:dc | 0:ART, 0x0 |
| WLAN 2.4 GHz | 84:7a:xx:xx:xx:de | 0:ART, 0xc |
| WLAN 5 | 84:7a:xx:xx:xx:df | 0:ART, 0x12 |
+--------------+-------------------+-------------+
Notes
-----
1. U-Boot is protected by a password (pass: netpower).
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21952
Signed-off-by: Robert Marko <robimarko@gmail.com>
I botched the rebase of ipq-wifi, so fix it.
Fixes: 67e6baf05e ("qualcommax: ipq60xx: add Netgear RBx350 support")
Signed-off-by: Robert Marko <robimarko@gmail.com>
The Zyxel NWA110AX is a dual band 2x2:2 802.11ax wireless access point
with PoE.
The device is very similar to the NWA210AX except for being 2x2 instead
of 4x4 in the 5GHz band and not having the 2.5GbE ethernet port. This
commit factors out a common DTS and device definition and reuses it for
both devices.
Hardware:
* SoC: Qualcomm IPQ8070A
* RAM: 1GiB 1x Samsung K4A8G165WC-BCTD
* Flash: 8MiB Winbond W25Q64DW SPI-NOR, 256MiB Winbond W29N02GZ SPI-NAND
* WLAN 2.4GHz: QCN5024 2x2:2 802.11b/g/n/ax
* WLAN 5GHz: QCN5054 2x2:2 802.11n/ac/ax
* Ethernet: 1x 1GbE with AR8033 PHY
* Serial Config: 3.3V TTL 115200-8-N-1, externally accessible
* Serial Layout: GND TX RX 3.3V (don't connect, marked with triangle)
* LEDs: 1x red, 1x green, 1x blue, 1x white
* Buttons: 1x reset
MAC addresses:
* Uplink: base address on label
* 2.4GHz WLAN: base + 1
* 5GHZ WLAN: base + 2
Flashing Notes:
The device uses a dual-image setup and OpenWrt can only be installed as
image 0. When the currently running stock firmware is image 0, OpenWrt
will be installed as image 1, fail to boot and the device returns to stock
firmware. If this happens, install any version of stock firmware so that
it runs as image 1, before installing OpenWrt. Alternatively, if there
already is a valid stock firmware in image 1, the "debug dual-image show"
and "debug dual-image set boot-image image1" commands can be used in the
stock CLI via serial/SSH/telnet to switch to image 1.
Flashing with Stock Web Interface:
* Get the OpenWrt factory image and rename it to a shorter name, for
example "openwrt.bin" (the stock firmware has a character limit)
* In the web interface, go to "Maintenance" -> "File Manager" ->
"Firmware Package" (or click the link next to "Firmware Version" under
"Device Information" on the dashboard)
* Under "Upload File" browse to the renamed OpenWrt factory image and
click on "Upload"
Switch Boot Image:
* OpenWrt to stock: "zyxel-bootconfig-ipq807x set image1"
* Stock to OpenWrt: "debug dual-image set boot-image image0"
Unbrick / Revert to Stock with the Boot Module:
* Disconnect the device from power
* Configure your machine to 192.168.1.103/24 and start a TFTP server
* Put the stock firmware image into the TFTP server root and rename it to
"ZLD-current"
* Establish a serial connection to the device through the console port
* Connect the device to power
* When prompted, press a key to abort automatic boot and enter debug mode
* Use the "atnz" command to flash the firmware image
* Use the "atgo" command to boot from the newly flashed image
Signed-off-by: Michael Lotz <mmlr@mlotz.ch>
Link: https://github.com/openwrt/openwrt/pull/21849
Signed-off-by: Robert Marko <robimarko@gmail.com>
Netgear RBx350 are dual band 4 stream 802.11ax mesh devices from the Orbi
series. The RBR350 is a router with a WAN and 3 LAN ports. The RBS350 is a
satellite without WAN port, only 2 LAN ports and half the flash. The
hardware is otherwise identical. They were sold in kits as RBK352, RBK353,
RBK354 or RBK355, with one router and 1-4 satellites.
Hardware:
* SoC: Qualcomm IPQ6018
* RAM: 512MiB 1x Nanya NT5CC256M16ER-EK
* Flash: 512MiB Winbond W29N04GZ or 256MiB Winbond W29N02GZ
* WLAN 2.4GHz: QCN5022 2x2:2 b/g/n/ax
* WLAN 5GHz: QCN5052 2x2:2 a/n/ac/ax
* Ethernet: QCA8075 switch with 1 WAN and 3 LAN ports or 2 LAN ports
* Serial Config: 3.3V TTL 115200-8-N-1, internal populated header
* Serial Layout: 3.3V (don't connect, marked with dot) RX TX GND
* LEDs: green/red power, white/red/green/blue status
* Buttons: 1x Reset, 1x WPS
MAC addresses:
* LAN1: base address on label, stored in boarddata partition at 0x8
* LAN2: base + 1
* LAN3: base + 2
* WAN: base + 3
* 2.4GHz WLAN: base + 1
* 5GHz WLAN: base + 2
Flashing Notes:
The stock firmware images are signed. Both the bootloader and the stock
web interface check the signature and will fail to boot/flash.
The bootloader automatically does NMRP when a gigabit LAN connection is
present. The stock and factory images contain a U-Boot script that is
executed when flashing using NMRP. This is used to alter and persist the
U-Boot env with a boot command that works with unsigned firmware.
Install OpenWrt:
* Get the nmrpflash utility [0] and OpenWrt factory image
* Find network interface to use: nmrpflash -L
* Start nmrpflash: nmrpflash -i interface -f openwrt-...-factory.img
* Connect the device LAN port closest to the power jack to the same
network using gigabit
* Plug the device in and wait for the bootloader to flash
* Unplug and replug the device once the power LED blinks amber
Revert to Stock:
The boot command needs to be reverted before flashing the stock firmware,
otherwise it will fail to boot and get stuck in recovery mode (red power
LED flashing).
* Run: fw_setenv bootcmd bootipq
* Restart the device
* Flash the stock firmware RBx350-Va.b.c.d.img using nmrpflash
[0]: https://github.com/jclehner/nmrpflash
Signed-off-by: Michael Lotz <mmlr@mlotz.ch>
Link: https://github.com/openwrt/openwrt/pull/21656
Signed-off-by: Robert Marko <robimarko@gmail.com>
Netgear RBx750 are tri band, 2.4GHz and 2x 5GHz, 8 stream 802.11ax mesh
devices from the Orbi series. The RBR750 is a router with a WAN and 3 LAN
ports. The RBS750 is a satellite without WAN port, only 2 LAN ports and
half the flash. The hardware is otherwise identical. They were sold in
kits as RBK752-RBK757, with one router and 1-6 satellites.
Hardware:
* SoC: Qualcomm IPQ8074
* RAM: 1GiB 1x Samsung
* Flash: 512MiB Winbond W29N04GZ or 256MiB Winbond W29N02GZ
* WLAN 2.4GHz: QCN5024 2x2:2 b/g/n/ax
* WLAN 5GHz Low Band: QCN5054 2x2:2 a/n/ac/ax 5180-5320MHz
* WLAN 5GHz High Band: QCN5054 4x4:4 a/n/ac/ax 5500-5700MHz
* Ethernet: QCA8075 switch with 1 WAN and 3 LAN ports or 2 LAN ports
* Serial Config: 3.3V TTL 115200-8-N-1, internal populated header
* Serial Layout: Bottom <- RX, TX, GND, 3.3V (don't connect) -> Top
* LEDs: green/red power, white/red/green/blue status
* Buttons: 1x Reset, 1x WPS
MAC addresses:
LAN1: base address on label
LAN2: base + 1
LAN3: base + 2
WAN: base + 1
2.4GHz: base + 2
5GHz-Low: base + 3
5GHz-High: base + 4
Flashing Notes:
The stock firmware images are signed. Both the bootloader and the stock
web interface check the signature and will fail to boot/flash.
The bootloader automatically does NMRP when a gigabit LAN connection is
present. The stock and factory images contain a U-Boot script that is
executed when flashing using NMRP. This is used to alter and persist the
U-Boot env with a boot command that works with unsigned firmware.
Install OpenWrt:
* Get the nmrpflash utility [0] and OpenWrt factory image
* Find network interface to use: nmrpflash -L
* Start nmrpflash: nmrpflash -i interface -f openwrt-...-factory.img
* Connect the device LAN port closest to the power jack to the same
network using gigabit
* Plug the device in and wait for the bootloader to flash
* Unplug and replug the device once the power LED blinks amber
Revert to Stock:
The boot command needs to be reverted before flashing the stock firmware,
otherwise it will fail to boot and get stuck in recovery mode (red power
LED flashing).
* Run: fw_setenv bootcmd bootipq
* Restart the device
* Flash the stock firmware RBx750-Va.b.c.d.img using nmrpflash
[0]: https://github.com/jclehner/nmrpflash
Signed-off-by: Michael Lotz <mmlr@mlotz.ch>
Link: https://github.com/openwrt/openwrt/pull/21938
Signed-off-by: Robert Marko <robimarko@gmail.com>
TCL LINKHUB HH500V also known as Vodafone Gigacube B157 is a dual band
802.11ax 5G NR CPE with an FXS port.
Specifications:
* SoC: Qualcomm IPQ8072A
* RAM: 1024 MB
* NAND flash: 256MB NAND (MT29F2G08ABBGAH4)
* NOR flash: 64MB NOR (MX25U25635F) - only in some variants
* WiFi 5G: Qualcomm QCN5054
* WiFi 2.4G: Qualcomm QCN5024
* Ethernet 2.5G: Qualcomm QCA8081
* Ethernet 1G: Qualcomm QCA8075
* Modem: GosunCn GM800 (Qualcomm Snapdragon X55)
* SIM: 1 nano-SIM card slot
* Buttons: Power, Reset, WPS
* LEDs: Power (B/R), WiFi (B), 4G (B/Y/R), 5G (B/Y/R)
* VoIP: 1 FXS RJ11 port (not supported in OpenWrt)
* Power: 12V, 3A
UART serial console:
* 115200,8N1,1.8V
* Three unmarked test points next to QJ2012A:
+---------+
| QJ2012A |
+---------+
o TX
o GND
o RX
o
o
o
Installation via OEM firmware:
* Use the following process to obtain root ssh access
https://forum.openwrt.org/t/150371/24
* Connect using root with no password on port 42000
* Optionally for serial bootloader access run :
fw_setenv bootdelay=3
* SCP factory.bin to /tmp
* Run:
sysupgrade -n /tmp/factory.bin
Installation via serial console and OEM firmware::
* Use console to access OEM firmware shell
* Proceed with SCP & sysupgrade as described above
Other notes:
* This device uses active partition rotation
* Some versions (TCL branded?) have a NOR chip in addition to NAND
* The above is supported by u-boot patching DT partitions
* DT patching does NOT occur on tftpboot/bootm
* Modem is detected as foxconn-sdx55 by kernel (same VID/PID)
* This works OK-ish and should be improved if we can get OEM modem details
Signed-off-by: Milan Krstic <milan.krstic@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19182
Signed-off-by: Robert Marko <robimarko@gmail.com>
Specifications:
* SoC: Qualcomm IPQ6018/AP-CP03-C1 (64-bit Quad-core Arm Cortex-A53 @ 1.2 GHz)
* RAM: 2x Zentel A3T4GF40BBF-HP (1 GiB DDR3-1866 (13-13-13))
* Serial Port: 1v8 TTL 115200n8
* Wi-Fi: Qualcomm QCN5022 (802.11ax/b/g/n)
* Wi-Fi: Qualcomm QCN5052 (802.11ac/ax/n)
* Ethernet: RTL8211FS (10/100/1000BASE-T)
* Flash: GigaDevice PSR1GA30DT (128 MiB)
* LEDs: 1x Blue Status (GPIO 35 Active High)
* Buttons: 1x Reset (GPIO 9 Active Low)
* FCCID: 2AXJ4EAP620HDV3
* UART: 4-pin unpopulated header by the J1 footprint
Installation Instructions (Serial+TFTP):
1. Locate the J1 footprint which contains 4 unpopulated pins
where starting from the arrow, the pins are TX, RX, VCC and GND
respectively.
2. Connect a 1v8 TTL port to the 4 pins. Ensure RX and TX are crossed
over.
3. Copy openwrt-qualcommax-ipq60xx-tplink_eap620-hd-v3-initramfs-uImage.itb
to your TFTP server.
4. Power up the AP and hold Ctrl+B in the serial console (115200n8) until autoboot is halted.
5. Run the following commands in the U-boot prompt:
IPQ6018# setenv serverip <TFTP server addr>
IPQ6018# setenv ipaddr <addr of the AP>
IPQ6018# tftpboot 0x44000000 openwrt-qualcommax-ipq60xx-tplink_eap620-hd-v3-initramfs-uImage.itb
IPQ6018# bootm 0x44000000
You may need to type Ctrl+C and Enter before running these commands
to clear invisible characters from the buffer.
6. Run the following command in a terminal to copy the sysupgrade image
to be installed (check IP address):
$ scp -O openwrt-qualcommax-ipq60xx-tplink_eap620-hd-v3-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
7. Activate the OpenWrt serial console and run the following commands:
# cd /tmp
# sysupgrade -n openwrt-qualcommax-ipq60xx-tplink_eap620-hd-v3-squashfs-sysupgrade.bin
8. The AP will reboot and OpenWrt will be successfully installed.
Installation Instructions (Web UI method):
1. Set up the device using the vendor's web UI. Navigate to
Management->SSH and enable the "SSH Login" checkbox. Select "Save".
2. Connect to the machine via SSH:
$ ssh -o hostkeyalgorithms=ssh-rsa <ip_of_device>
3. Disable signature verification:
$ cliclientd stopcs
4. Rename the "-web-ui-factory" image to something less than 63
characters, maintaining the ".bin" suffix.
5. Go to System -> Firmware Update.
Under "New Firmware File", click "Browse" and select the image.
Select "Update" and confirm by clicking "OK".
6. If the update fails, the web UI should show an error message.
Otherwise, the device should reboot into OpenWrt.
Device support followed from EAP620HD v2 and eap6xx-outdoor for DTS.
Links: openwrt/openwrt#18227
Signed-off-by: John Christoforidis <github@yanny.dev>
Link: https://github.com/openwrt/openwrt/pull/21467
Signed-off-by: Robert Marko <robimarko@gmail.com>
Specifications:
SoC: Qualcomm IPQ6010 1.8GHz
RAM: K4A4G165WF-BCTD x2 1GiB
Flash: FORESEE 128GB/256GB eMMC
ETH: 4x 1Gbps + 1x 2.5Gbps
WLAN1: QCN5022 2.4GHz AX 2x2
WLAN2: QCN5052 5.8GHz AX 2x2
WLAN2: QCN9024 5.2GHz AX 4x4
Button: Reset, Screen, Wps
Power: DC 12V 3A
USB: 1x 3.0
Flash instructions:
1. Download the initramfs image, rename it to
initramfs.itb, host it with the tftp server.
2. If the stock firmware version is 4.3.0.r4211
or higher, enter "jdmt018R" to interrupt
U-Boot when the following statement appears:
"disabled console and autoboot in 2 seconds"
3. Run these commands in U-Boot console:
tftpboot initramfs.itb
bootm
4. After openwrt boots up, use scp or luci web
to upload sysupgrade.bin to upgrade.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/19840
Signed-off-by: Robert Marko <robimarko@gmail.com>
Specifications:
SoC: Qualcomm IPQ6000 1.2GHz
RAM: NT52CB256MB16DP 512MiB
Flash: FORESEE 64GB/128GB eMMC
ETH: QCA8075 (3x LAN, 1x WAN)
WLAN1: QCN5022 2.4GHz AX 2x2
WLAN2: QCN5052 5GHz AX 2x2
Power: DC 12V 2A
Button: Reset, Wps
USB: 1x 3.0
Flash instructions:
1. Download the initramfs image, rename it to
initramfs.itb, host it with the tftp server.
2. If the stock firmware version is 4.3.0.r4211
or higher, enter "jdmt018R" to interrupt
U-Boot when the following statement appears:
"disabled console and autoboot in 2 seconds"
3. Run these commands in U-Boot console:
tftpboot initramfs.itb
bootm
4. After openwrt boots up, use scp or luci web
to upload sysupgrade.bin to upgrade.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/19780
Signed-off-by: Robert Marko <robimarko@gmail.com>
BDF for EAP623-Outdoor HD v1 was renamed in the repo, but ipq-wifi
was not updated to reflect that, so do it now to fix broken wifi.
Fixes: #21432
Signed-off-by: Robert Marko <robimarko@gmail.com>
This is tri-band WiFi6E capable router. Also Zyxel Nebula managed so no real local GUI. To open device 4 screws must be located uder the label.
Four latches are on front and two on each side. Better start from ethernet port side where 3 small latches are easy to handle.
FCC shows It's identical to WSQ65 sold as Zyxel Multy M6E but that's nowhare to be found yet. WSQ65 is not covered by this PR
Speficiations:
* SoC: Qualcomm IPQ5018
* RAM: 1GB DDR3
* Flash: Winbond W25N02KWZEIR 256MB
* UART: PCB "J3" is located left from front LED strip
(VCC/TX/RX/ /GND) 3.3V 115200n8
* Wi-Fi1: IPQ5018 (2x2 2.4 Ghz 802.11b/g/n/ax)
* Wi-Fi2: QCN6102 (2x2:2 5 Ghz 802.11an/ac/ax)
* Wi-Fi3: QCN6122 (2x2:2 6 Ghz 802.11an/ac/ax)
* Ethernet: QCA8337 4xLAN 1Gbit / 1xWAN 1Gbit
* Buttons: WPS , Reset
* LEDs: 13 in total
RGB power, RGB wan, RGB status (cloud), RGB wifi, Green wps
* FCCID: I8803891
*Flash Instructions starts with getting root:
connect uart to J3 connector next to the front LEDs
go to failsafe when this shows up in log:
"Press the [f] key and hit [enter] to enter failsafe mode"
execute:
mount_root
passwd -d root
reboot
logon as root:
look for 'Please press Enter to activate this console.'
login is root password is empty
execute:
fw_setenv DebugFlag=0x1
fw_setenv bootdelay=0x2
passwd -d root
backup ubi partition "rootfs" into safe space
reboot
*OpenWrt installation
stop uboot and execute:
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.10
tftpboot *-factory.ubi
flash rootfs
reset
or:
tftpboot *-initramfs-uImage.itb
bootm
use sysupgrade as usual
*restore OEM from backup
stop uboot and execute:
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.10
tftpboot *-initramfs-uImage.itb
bootm
transfer rootfs.bin backup and execute:
ubiformat /dev/mtd16 -y -f /tmp/rootfs.bin
Signed-off-by: Robert Senderek <robert.senderek@10g.pl>
Link: https://github.com/openwrt/openwrt/pull/21042
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit adds support for the Cisco Meraki MR20/Go GR10.
The Meraki MR20 is a Cisco 802.11ac/WiFi 5 AP with 1 Ethernet port.
It can be powered by a 12V DC barrel jack (5.5x2.5mm, center positive)
or via 802.3af POE.
The Meraki Go GR10 (codename: Maggot) is identical to the MR20
(codename: Grub), so this document will refer to both devices as the MR20.
MR20 hardware info:
* CPU: Qualcomm IPQ4029
* RAM: 256MB DDR3
* Storage: 128 MB (MX30LF1G18AC)
* Networking: 1 Gigabit Ethernet
* WiFi: QCA4019 802.11b/g/n/ac
* Serial: Internal header (J10, 2.54mm, unpopulated)
This device ships with secure boot, and cannot be flashed without
external programmers (TSOP48 NAND and I2C EEEPROM)!
Disassembly:
Remove the four rubber feet on the rear of the AP and the four
Torx T8 screws under the feet.
Using a guitar pick or similar plastic tool, insert it on the side
along the seam around the edge. Push in gently while gently lifting
the front of the housing to release the plastic retention clips.
There are 15 clips in total.
Once you have removed the plastic front (shown above already removed
so you know where the clips are), remove the 4 Philips screws holding
down the two metal WiFi antennas.
Lift the PCB gently while pushing the Ethernet port into the housing
to release it. The PCB should come free from the metal heat spreader.
The TSOP48 NAND flash (U9, Macronix/MXIC MX30LF1G18AC) is located on
the opposite side of the PCB.
To flash, you need to desolder the TSOP48 or use a 360 clip.
You also need to reprogram the I2C EEPROM (U20, Atmel 24c64).
Installation:
The dumps to flash can be found in this repository:
https://github.com/halmartin/meraki-openwrt-docs/tree/main/mr20_gr10
The device has the following flash layout (offsets with OOB data):
```
0x000000000000-0x000000100000 : "sbl1"
0x000000100000-0x000000200000 : "mibib"
0x000000200000-0x000000300000 : "bootconfig"
0x000000300000-0x000000400000 : "qsee"
0x000000400000-0x000000500000 : "qsee_alt"
0x000000500000-0x000000580000 : "cdt"
0x000000580000-0x000000600000 : "cdt_alt"
0x000000600000-0x000000680000 : "ddrparams"
0x000000700000-0x000000900000 : "u-boot"
0x000000900000-0x000000b00000 : "u-boot-backup"
0x000000b00000-0x000000b80000 : "ART"
0x000000c00000-0x000007c00000 : "ubi"
```
* Dump your original NAND (if using nanddump, include OOB data).
* Decompress `u-boot.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `u-boot` portion of NAND from
`0x738000`-`0x948000` (length `0x210000`). Offsets here include OOB data.
* Decompress `ubi.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `ubi` portion of NAND from
`0xc60000`-`0x8400000` (length `0x77a0000`). Offsets here include OOB data.
* Dump your original EEPROM. Change the byte at offset `0x49` to `0x1e`
(originally `0x2c` or `0x25`). Remember to re-write the EEPROM with the
modified data.
* This can be done on Linux via the following command:
`printf "\x1e" | dd of=/tmp/eeprom.bin bs=1 seek=$((0x49)) conv=notrunc`
**Note**: the device will not boot if you modify the board major number and
have not yet overwritten the `ubi` and `u-boot` regions of NAND.
* Resolder the NAND after overwriting the `u-boot` and `ubi` regions.
OpenWrt Installation:
* After flashing NAND and EEPROM with external programmers. Plug in an
Ethernet cable and power up the device.
* The new U-Boot build uses the space character `" "` (without quotes) to
interrupt boot.
* Interrupt U-Boot and `tftpboot` the OpenWrt initramfs image from your
tftp server
```
dhcp
setenv serverip <your_tftp>
tftpboot openwrt-ipq40xx-generic-meraki_mr20-initramfs-uImage.itb
```
* Once booted into the OpenWrt initramfs, created the `ART` ubivol with
the WiFi radio calibration from the mtd partition:
```
cat /dev/mtd10 > /tmp/ART.bin
ubiupdatevol /dev/ubi0_1 /tmp/ART.bin
```
* `scp` the `sysupgrade` image to
the device and run the normal `sysupgrade` procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_mr20-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_mr20-squashfs-sysupgrade.bin"
```
* OpenWrt should now be installed on the device.
Signed-off-by: Hal Martin <hal.martin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20646
Signed-off-by: Robert Marko <robimarko@gmail.com>
Linksys MX6200 is a triband Wi-Fi 6E wireless router.
Speficiations:
* SoC: Qualcomm IPQ5018 (64-bit dual-core ARM Cortex-A53 @ 1.0Ghz)
* Memory: Nanya NT5CC256M16ER-EK (512 MiB DDR3-933)
* Serial Port: 3v3 TTL 115200n8
* Wi-Fi: IPQ5018 (2x2 2.4 Ghz 802.11b/g/n/ax)
QCN6102 (2x2:2 5 Ghz 802.11an/ac/ax)
QCN6122 (2x2:2 6 Ghz 802.11an/ac/ax)
* Ethernet: IPQ5018 integrated virtual switch connected to:
- LAN Port: Internal IPQ5018 GE PHY
- WAN Port: Maxlinear Ethernet GPY115C PHY
* Flash: Macronix MX35UF2GE4AD (256 MiB)
* LEDs: 1x multi-color PWM LED
* Buttons: 1x WPS (GPIO 27 Active Low)
1x Reset (GPIO 28 Acive Low)
* FCC ID: 2AYRA-08436
Flash instructions:
************************************************************************
NOTE: serial access is required! Although the web UI allows you to
install the Openwrt image, secure boot is enabled which will prevent
booting an unsigned image. The boot sequence must be adjusted in U-boot
to allow booting unsigned images.
************************************************************************
1. On OEM firmware, login to the web UI (typically @ http://192.168.1.1)
and click 'CA' in the bottom right corner.
Then click -> Connectivity -> Manual Upgrade.
Alternatively, browse to
http://<router IP>/fwupdate.html.
Upload openwrt-qualcommax-ipq50xx-linksys_mx6200-squashfs-factory.ubi.
Continue with step 5.
2. Installation on alternate partition using serial connection from OEM
firmware (default login: root, password: admin):
flash_erase /dev/mtd19 0 0
nandwrite -p /dev/mtd19 openwrt-qualcommax-ipq50xx-linksys_mx6200-squashfs-factory.ubi
reboot
Continue with step 5.
3. Installation using serial connection from initramfs
setup tftp server listening on IP in 192.168.1.0/24 (other than the
router IP 192.168.1.1). In U-boot, load the initramfs image to memory:
tftp $loadaddr <your IP>:openwrt-qualcommax-ipq50xx-linksys_mx6200-initramfs-uImage.itb
boot the image using command:
bootm $loadaddr
when fully booted, scp the sysupgrade image to your router IP (default:
192.168.1.1):
scp -O <path>/openwrt-qualcommax-ipq50xx-linksys_mx6200-squashfs-sysypgrade.bin root@192.168.1.1:/tmp/
use sysupgrade to flash the image to nand:
sysupgrade -n -v /tmp/openwrt-qualcommax-ipq50xx-linksys_mx6200-squashfs-sysupgrade.bin
Continue with step 5.
4. Optionally install on alternate partition. From Openwrt:
mtd -r -e rootfs_1 -n write openwrt-qualcommax-ipq50xx-linksys_mx6200-squashfs-factory.ubi rootfs_1
Continue with step 5.
5. Setup U-boot for ability to dual boot signed (stock) and non-signed
(Openwrt) images with auto-detection.
From U-boot, run (be aware: copy line by line):
setenv setnandbootargs 'setenv bootargs init=/sbin/init ubi.mtd=rootfs rootfstype=squashfs rootwait'
setenv nandinitcmd 'setenv mtdids nand0=nand0; run setrootfscmd; ubi part rootfs 2048'
setenv setrootfscmd 'if test $boot_part = 1; then setenv mtdparts mtdparts=nand0:0x${imgsize}@0x${prikern}(rootfs); else setenv mtdparts mtdparts=nand0:0x${imgsize}@0x${altkern}(rootfs); fi'
setenv readhdr1cmd 'ubi read $loadaddr kernel 0x40; setexpr IMGOFF $loadaddr + 0x10; setexpr CODEOFF $loadaddr + 0x14; setexpr SIGOFF $loadaddr + 0x1c; setexpr CERTOFF $loadaddr + 0x24'
setenv readhdr2cmd 'setexpr.l HDR *$loadaddr; setexpr.l IMGSZ *$IMGOFF; setexpr.l CODESZ *$CODEOFF; setexpr.l SIGSZ *$SIGOFF; setexpr.l CERTSZ *$CERTOFF; setexpr TSIZE $CODESZ + $SIGSZ; setexpr TSIZE $TSIZE + $CERTSZ'
setenv testmbncmd 'if test $HDR -ne edfe0dd0 -a $IMGSZ -eq $TSIZE; then bootipq; else ubi read $loadaddr kernel $kernsize; run setnandbootargs; bootm $loadaddr; fi'
setenv bootcmd2 'if test $auto_recovery = no; then bootipq; else run nandinitcmd; run readhdr1cmd; run readhdr2cmd; run testmbncmd; fi'
setenv bootcmd 'run bootcmd2'
saveenv
6. Back to the OEM firmware.
Download firmware from OEM website:
MX6200: https://support.linksys.com/kb/article/408-en/
From serial/SSH, in Openwrt, flash OEM firmware to alternate partition:
mtd -r -e rootfs_1 -n write FW_MX6200_1.0.11.216041_prod.signed.img rootfs_1
Switching active partition:
1. From U-boot, executive the following to switch to partition 1:
setenv boot_part 1
for partition 2:
setenv boot_part 2
2. From Openwrt:
fw_printenv boot_part
In case it's 1:
fw_setenv boot_part 2
. /lib/upgrade/platform.sh
linksys_bootconfig_set_primaryboot "0:bootconfig" 1
linksys_bootconfig_set_primaryboot "0:bootconfig1" 1
In case it's 2:
fw_setenv boot_part 1
. /lib/upgrade/platform.sh
linksys_bootconfig_set_primaryboot "0:bootconfig" 0
linksys_bootconfig_set_primaryboot "0:bootconfig1" 0
and
reboot
Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/21038
Signed-off-by: Robert Marko <robimarko@gmail.com>
c6202981872e ipq5018: use correct board for GL-iNet B3000 IPQ5018 radio
ec72376cadf1 qca4019: Add Meraki Underdog
059b7114c77b ipq6018: add tp-link eap620hd v2
Signed-off-by: Robert Marko <robimarko@gmail.com>
George Moussalem
Robert Marko
Sander Schutten
Christoph Krapp
xiao bo
Christian Marangi
Paul Spooren
Daniel Golle
John Audia
Fire Chen
Paweł Owoc
Marco von Rosenberg
David Bauer
Hauke Mehrtens
Mikhail Zhilkin
Michael Lotz
Milan Krstic
John Christoforidis
Chukun Pan
Pawel Dembicki
Robert Senderek
Yanase Yuki
Hal Martin
Janusz Dziedzic