An AQR113C can report its copper link over MDIO before it writes the
new rate into the USXGMII code word, which carries 10G while the copper
link is down. phylink reads the speed only when the link comes up, so
the MAC stays at 10G. On an RT-AX89X with a 1G partner on the AQR113C
port this happened in 3 of 20 link-ups, and the port passed no traffic.
Report a rate change in the code word as a link drop, so that phylink
resolves the link again at the new rate. With this change all 20
link-ups ended at 1G; 9 came up at 10G first and were re-resolved
within a second.
Fixes: 05c180511d ("qualcommax: add UNIPHY PCS driver")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25829
Signed-off-by: Robert Marko <robimarko@gmail.com>
The NBG7815 cools itself with a GPIO driven fan on TLMM 21. A second
tmp103 sits on the second I2C bus (BLSP QUP4), which the stock firmware
reads as the board temperature, and the stock firmware keeps GPIO 22
high to enable the second fan.
The switching points come from the stock firmware, which controls the
fan from a shell daemon /usr/sbin/fanctld, configured in
/etc/config/fanctld:
config fanctld config
option Enabled '1'
option Delay '20'
option Hits '3'
option TempTrig '108'
option TempClr '85'
fanctld polls every 20 s and starts the fan once any of thermal_zone0
(nss-top), wifi0 or wifi1 has been at or above TempTrig for three
consecutive polls. It stops the fan again only after all three have been
at or below TempClr for three polls:
if [ $temp1 -ge $temp_trig -o $temp2 -ge $temp_trig -o $temp3 -ge $temp_trig ]; then
echo 2
elif [ $temp1 -le $temp_clr -a $temp2 -le $temp_clr -a $temp3 -le $temp_clr ]; then
echo 1
The trip is placed at 85 degC with 5 degC hysteresis, so the fan runs
from 85 degC and stops again at 80 degC, rather than at the stock 108/85:
the SoC hardly reaches 108, so the case gets uncomfortably hot under load
before the fan would ever start, as reported for this device in
https://github.com/openwrt/openwrt/pull/14210
It sits on the CPU cluster rather than on the sensors the stock daemon
polls: the wifi sensors are only reachable through the vendor thermaltool
there, and one zone is enough to drive the fan.
Add the gpio-fan as a cooling device with that trip, enable the second
I2C bus with its tmp103, add the gpio-hog for the second fan enable and
describe the USB VBUS switch on GPIO 32 as a regulator rather than
hogging it.
That regulator carries enable-active-high. For regulator-fixed, gpiolib
ignores the flag in the GPIO specifier and takes the line as active low
without that property, so the regulator would drive GPIO 32 low at probe
- logged as "enforce active low on GPIO handle" - while the stock
firmware holds the line high.
The AQR PHY is deliberately left out of the cooling maps: its driver
rejects the low trip the thermal core installs by default, so a thermal
zone bound to it fails to set its trips.
Co-developed-by: Semih Baskan <strst.gs@gmail.com>
Signed-off-by: Semih Baskan <strst.gs@gmail.com>
Signed-off-by: André Valentin <avalentin@marcant.net>
The front panel of the NBG7815 carries nine RGB LEDs, driven by three TI
LP5569 controllers on the first I2C bus. The stock firmware keeps GPIO 60
high to enable the LED board.
The third controller sits at 0x40, where the stock firmware pokes two
registers directly instead of binding a driver, and the board schematics
call it an LP5009. It answers to the lp5569 register layout though: a
write to the pwm registers at 0x16 lights the LEDs, while the lp50xx
driver only ever got -EIO. Verified on the device by reading back the
registers and by the LEDs actually turning on.
Placement and colours were measured with a camera pointed at the front bar,
one frame per lit LED against a dark frame. LED1 to LED6 walk through the bar
monotonically, so the two controllers form one continuous chain: 0x32
ascending, 0x35 descending, which is also the channel order the stock
zled_ctrl script uses. Red, green and blue each come out as the dominant
channel on all three controllers.
The three groups of the controller at 0x40 light the same spot near the
middle of the bar instead, each with about twice the output of a bar segment,
so they feed one brighter element together rather than three segments of
their own.
Channel numbers are per controller. Getting that wrong is quiet but
destructive: lp55xx_multicolor_brightness() adds the number to the pwm
register base without checking it against the channel count, so the
writes land in the current registers of other channels instead.
Add the controller nodes with the channel mapping and the LED currents
of the stock firmware, the gpio-hog for the LED board enable, and set
LED7 to white through board.d. That is the brighter element in the middle
rather than one end of the bar, and it is the one the stock firmware keeps
driving in every state through its two register writes to 0x40.
The same LED is wired to the led-running and led-upgrade aliases, so
diag.sh turns it on once the system is up and blinks it while a sysupgrade
runs. Measured with a camera at 30 fps: 36 cycles of 200 ms on and 200 ms
off for the duration of the flash.
led-boot and led-failsafe are deliberately absent. Both states are set
from preinit, before the i2c driver for the controller is loaded, so the
LED does not exist yet and led_set_attr() silently skips it - confirmed by
recording a boot, where the LED stays dark and then comes on in one step.
The aliases need a "label" on the multi-led node: get_dt_led() looks for
label, then chan-name, and otherwise composes a name from color and
function, which would be "rgb:" here. The lp55xx driver only reads "label"
from the controller node, so it does not affect the class device name.
Signed-off-by: André Valentin <avalentin@marcant.net>
The QCA8337 is behind PPE port 1, so with the plain QCA tag the EDMA
cannot offload the checksum or TSO of frames for lan3-lan8. Select the
qca-etype tag on its CPU port.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25754
Signed-off-by: Robert Marko <robimarko@gmail.com>
The QCA8K header sits in place of the ethertype, so the IPQ807x EDMA,
which finds the IP header by parsing past the Ethernet header and VLAN
tags, cannot offload the TX checksum or TSO of a frame for a QCA8337
behind a PPE port, and TCP and UDP leave those ports with bad
checksums. Add a "qca-etype" tagger that puts the header behind the
802.1ad ethertype, which the EDMA parses as a VLAN tag, and let qca8k
select it and program HEADER_CTRL to match.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25754
Signed-off-by: Robert Marko <robimarko@gmail.com>
phylink sets the PHY EEE advertisement from lpi_capabilities and does not
check lpi_interfaces, so the PHY of a USXGMII or 10GBASE-R port
advertises EEE although the MAC never enables LPI there. The XPCS behind
those modes reports no EEE ability (SR_XS_PCS_EEE_ABL reads 0 on IPQ8074),
and qca-ssdk does not enable MAC EEE on them for that reason. Offer EEE
only on a port whose phy-mode has MAC LPI, and add 2500BASE-X at
2.5 Gbit/s on ports 5 and 6, which qca-ssdk treats as EEE capable.
Fixes: dd052b4594 ("qualcommax: qca_ppe: add EEE support")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25754
Signed-off-by: Robert Marko <robimarko@gmail.com>
The ports list only full duplex in their MAC capabilities, so the PHY
advertises no half-duplex mode. A link partner with autonegotiation off
is found by parallel detection, which resolves to half duplex, and the
port does not link.
Add MAC_10HD and MAC_100HD to ports 1-6. The GMAC programs half duplex;
USXGMII runs on the XGMAC, which has no duplex setting, so
mac_get_caps() removes both modes for that interface.
On a Xiaomi AX3600 (QCA8075) with the partner forced to 10 or 100 Mbps,
the port stays down before the change and links at half duplex after
it, 3/3 runs each.
Closes: https://github.com/openwrt/openwrt/issues/25657
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25750
Signed-off-by: Robert Marko <robimarko@gmail.com>
On the PSGMII instance (UNIPHY0 on IPQ8074 and IPQ6018), SGMII and
1000BASE-X run with every mode select bit of UNIPHY_MODE_CTRL clear, as
qca-ssdk's __adpt_hppe_uniphy_sgmii_mode_set() programs it. The driver
sets UNIPHY_SGMII_MODE there instead, and the Zyxel NWA110AX, whose
AR8033 sits on UNIPHY0 channel 0, transmits nothing.
Leave the mode select clear on the instance with a clock pair per
channel, and report 125 MHz for that setting in the clock recalc.
Writing 0x20 or 0x21 to the register on the NWA110AX restores TX.
Closes: https://github.com/openwrt/openwrt/issues/25657
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25750
Signed-off-by: Robert Marko <robimarko@gmail.com>
Align continuation lines to the open parenthesis, align the register
defines in qca_edma.h with tabs as qca_ppe.h does, and fix the
operator spacing, blank lines and block comments that checkpatch
reports. No functional change.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25665
Signed-off-by: Robert Marko <robimarko@gmail.com>
Remove code that has no effect on kernel 6.18:
- qca_edma: get_drvinfo, which returns what the ethtool core fills in
from the parent device; NETIF_F_GRO and watchdog_timeo, which the core
sets itself or never reads without ndo_tx_timeout; the tailroom check
on a conduit whose needed_tailroom is always 0; the tx_min_size guard
around skb_put_padto(), which does nothing for a size of 0.
- qca_ppe: port range checks on ports DSA has already validated, NULL
checks before clk_set_rate(), the never-read ds->priv, the repeated
"ports" node check in the IPQ6018 mux setup and stores that are always
overwritten before they are read.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25665
Signed-off-by: Robert Marko <robimarko@gmail.com>
EEE is disabled on every PPE port because the MAC side of LPI was never
programmed. The GMAC has an LPI enable per port, a wake and idle timer
per port and a microsecond prescaler at PPE offset 0x400, as the HPPE
code in qca-ssdk has it. Program them from mac_enable_tx_lpi, offer LPI
at 100 and 1000 Mbit/s on the QSGMII, PSGMII and SGMII ports, enable
EEE by default and add support_eee.
On IPQ8074 EEE negotiates on links whose partner offers it, a 10 minute
soak with bursty traffic loses 0 of 2939 pings, throughput is unchanged
(302 Mbit/s both ways, n=3) and idle ping latency rises from 0.16 to
0.22 ms (n=3). qca-ssdk uses the same LPI registers on IPQ60xx; no
IPQ60xx board was available to run it.
Fixes: a3a6679538 ("qualcommax: qca_ppe: disable EEE to prevent idle-port egress wedge")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25665
Signed-off-by: Robert Marko <robimarko@gmail.com>
Now that we expose the UBI volumes in DTS anyway and have NVMEM support
for ath11k, load the caldata directly via NVMEM.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Currently, AX89X MAC is read for the ethaddr U-Boot env variable, but this
variable is only set if user interrupted boot and ran saveenv before.
So, instead of relying on U-Boot, lets read the MAC from the same place as
U-Boot, from the Factory UBI volume.
There is also a Factory2 UBI volume, but MAC-s in both must be indentical
as Factory2 is only used during upgrade to store the new versions.
Factory UBI volume has 2 MAC-s, one at 0x100e and one at 0x1014.
U-Boot uses the one at 0x100e and increments it by one, so we do the same.
Fixes: f50435627d ("qualcommax: ipq60xx/ipq807x: convert to PPE networking stack")
Link: #24604
Signed-off-by: Robert Marko <robimarko@gmail.com>
Use the new ucidef_set_led_brightness function for the ST LED1202 status
LEDs now that it supports configurable brightness. Blue is enabled at
brightness 51 with red and green off, matching the OEM default colour
scheme and intensity.
Signed-off-by: Manuel Fombuena <fombuena@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23457
Signed-off-by: Robert Marko <robimarko@gmail.com>
Register the three status LEDs of the ST LED1202 controller in the board
default configuration so they are exposed to userspace via UCI and LuCI,
allowing users to customise LED behaviour without manual sysfs interaction.
Blue is enabled by default; red and green are off.
Signed-off-by: Manuel Fombuena <fombuena@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23456
Signed-off-by: Robert Marko <robimarko@gmail.com>
The NXP PCA9633 LED controller was defined in the shared ipq8174-mx4x00.dtsi,
but the MX4200v2 uses a different controller — the ST LED1202 (I2C address
0x58) — instead of the PCA9633 (0x62) used by MX4200v1, MX4300, and HomeWRK.
Move the LED controller node out of the shared DTSI into each device's own
DTS file.
Fix kmod-leds-pca963x being pulled in for all linksys_mx devices by assigning
LED driver packages explicitly per device: kmod-leds-pca963x for MX4200v1,
MX4300, MX5300, and MX8500; kmod-leds-st1202 for MX4200v2.
Signed-off-by: Manuel Fombuena <fombuena@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23456
Signed-off-by: Robert Marko <robimarko@gmail.com>
TP-Link RE700X is a dual-band Wi-Fi 6 (AX3000) range extender based on
Qualcomm IPQ5018 (2.4 GHz) with a QCN6122 (5 GHz) companion radio.
Specifications:
- SoC: Qualcomm IPQ5018 (dual-core ARM Cortex-A53)
- RAM: 256 MiB
- Flash: 128 MiB SPI-NAND (ESMT F50D1G41LB)
- Wi-Fi: IPQ5018 2.4 GHz + QCN6122 5 GHz, both 802.11ax
- Ethernet: 1x Gigabit - IPQ5018 MAC1 (DWMAC) via SGMII/uniphy0 to a
Realtek RTL8211F (MDIO1 addr 6). The SoC internal GE PHY (MAC0/gmac0)
is not wired to any external port and stays disabled.
- LEDs: 5, Buttons: reset + WPS
- Power: 100-240 V AC, 50/60 Hz, 0.4 A (internal PSU, wall-plug)
- UART: 3.3 V serial console, 115200 8N1; on-board 4-pad header,
pinout from top: TX, RX, GND, VCC
MAC addresses (factory_data UBI volume, file default-mac, mounted
read-only in preinit like on the EAP650):
- LAN (label MAC): default-mac
- 2.4 GHz: default-mac + 1
- 5 GHz: default-mac + 2
Calibration data is extracted from the 0:art partition (IPQ5018 at
0x1000, QCN6122 at 0x26800).
Installation:
- From OpenWrt (or after a RAM-boot of the initramfs via U-Boot/TFTP):
sysupgrade.
- From the stock firmware: openwrt-...-squashfs-factory-webflash.bin via
the TP-Link web UI (System -> Firmware Upgrade).
scripts/tplink-re700x-factory.py wraps the rootfs UBI into the stock
"nvrammanager" upload container (the same "tplink2022"/safeloader
family as scripts/tplink-mkimage-2022.py); the stock flasher writes it
into the inactive dual-boot slot. This path has not been tested end to
end (no unit on stock firmware was left), so keep UART at hand for a
first install.
The stock U-Boot passes a slot-correct ubi.mtd= (rootfs / rootfs_1 per the
dual-boot index) but with an unmountable root=mtd:ubi_rootfs. The DTS /chosen
inherits ubi.mtd= and appends root=/dev/ubiblock0_1, so OpenWrt boots from
whichever slot the flasher wrote. Like on the EAP650, sysupgrade installs
into the inactive slot and then points tp_boot_idx at it, keeping the
running slot as a fallback; the U-Boot environment is on 0:appsblenv.
The QCN6122/IPQ5018 board-2.bin (BDF) data is supplied via
ipq-wifi-tplink_re700x (openwrt/firmware_qca-wireless).
Wi-Fi is disabled in the DTS for now: with the default ath11k DP ring
sizes both radios exhaust the 256 MiB of RAM. It will be enabled in a
follow-up together with the ath11k patch that selects smaller rings on
low-memory boards, once that has been accepted upstream.
Signed-off-by: Eduard Hart <eduard.hart@etik.com>
Link: https://github.com/openwrt/openwrt/pull/23982
Signed-off-by: Robert Marko <robimarko@gmail.com>
Hardware:
SoC: Qualcomm IPQ5018 (2x Cortex-A53)
RAM: 256 MiB DDR3
Flash: 128 MiB SPI-NAND (ESMT)
Switch: Realtek RTL8367S, 4x GbE (3x LAN + 1x WAN), SGMII CPU port
WiFi: IPQ5018 2.4 GHz, QCN6122 5 GHz, both 802.11ax
LEDs: system (green/amber), WAN, LAN1-3
Button: reset
UART: 115200 8N1, 3.3V, on-board header
Wi-Fi is left disabled: 256 MiB is too few for ath11k, same as on the
ELECOM WRC-X3000GS2.
Notes:
- The label reads "Ver 2.20", but the vendor firmware only ever calls the
board V2: the GPL tree is GPL_MR80Xv2, PRODUCT_NAME is MR80Xv2, the
running system reports "MR80X V2" and the fwup support list carries
product_ver 2.0.0. The trailing digits are a production sub-revision,
so the port is named v2.
- MAC1 runs sgmii through the UNIPHY PCS to RTL8367S port 6. The link is
wired for HSGMII and 2500base-x does come up, but only when gmac1 and
the CPU port carry the same phy-mode: the UNIPHY PCS belongs to the
conduit (pcs-handle = <&uniphy0> in ipq5018-ess.dtsi), so setting the
CPU port alone leaves the switch running HSGMII into a SerDes still
clocked for SGMII.
With both ends at 2500base-x the trunk still dies on some boots: over
12 reboots, 2 came up with the CPU port passing no traffic at all -
eth0 transmitting while s00_p06_ifInOctets stayed at 0, no FCS errors,
the link reporting 2.5 Gbps. That matches the bring-up ordering race
described in openwrt/openwrt#25153, where the switch end of the trunk
is configured before the IPQ5018 UNIPHY resets and recalibrates its
PLL. sgmii has not reproduced it, so the port ships at sgmii until
that fix lands.
- MAC addresses come from default-mac in the vendor tp_data UBI volume,
6 raw bytes at offset 0, mounted read-only during preinit:
label default-mac
LAN default-mac
WAN default-mac + 1
2.4 GHz default-mac - 1
5 GHz default-mac - 2
- Sysupgrade A/B ping-pongs rootfs/rootfs_1 via tp_boot_idx, switched
only after the new slot is fully written. primaryboot stays 0, the
stock loader and the button recovery rely on it.
- factory.bin is wrapped in the Mercusys fwup container the stock web UI
accepts (scripts/mercusys-fwup.py). The generic tplink-image-2022
container is rejected: the loader picks its verification algorithm from
the fw-type string, which that container does not write.
- The board needs the backported spi-qpic-snand ECC context fix,
otherwise about half of the boots end in "Waiting for root device
/dev/ubiblock0_1".
Installation:
In the stock web UI go to Advanced -> System -> Firmware Update ->
Local Update, browse for
openwrt-qualcommax-ipq50xx-mercusys_mr80x-v2-squashfs-factory.bin
and press UPDATE.
Tested on stock firmware MR80X(EU)_V2.20_1.1.7 Build 20250415
(Multi-language).
The U-Boot web recovery does not accept this image: it verifies an
RSA1024 signature and has no keyless path. Use the stock web UI.
Signed-off-by: Johan Alvarado <contact@c127.dev>
Link: https://github.com/openwrt/openwrt/pull/24919
Signed-off-by: Robert Marko <robimarko@gmail.com>
GL.iNet GL-X2000 (Spitz Plus) is a dual-SIM 4G LTE Wi-Fi 6 router.
Specifications:
SoC: Qualcomm IPQ5018, dual-core Cortex-A53 @ 1.0 GHz
RAM: 512 MiB DDR3
Flash: 128 MiB SPI NAND (Winbond W25N01GWZEIG)
WLAN: IPQ5018 2x2 2.4 GHz, QCN6122 2x2 5 GHz (802.11ax)
Ethernet: 1x GbE WAN (IPQ5018 internal GE PHY)
1x GbE LAN (Atheros AR8031, SGMII)
WWAN: Quectel EG120K-EA, LTE Cat.12, USB 3.0 SuperSpeed
USB: 1x USB 2.0 host behind an internal hub
Buttons: reset
LEDs: power, internet, 2.4G, 5G, 4x signal strength
Serial: 3v3 TTL, 115200 8N1; 4-pin header labelled GND/RX/TX/3V3 on
the mainboard, under the Quectel module in the top right
corner. The case opens after pulling the four rubber feet
Power: DC 9-35 V, shipped with a 12 V 2.5 A supply
Misc: PWM fan, dual SIM slots (muxed inside the modem)
The base MAC address is stored at offset 0x6 of the 0:art partition; the
first six bytes are erased, which is why U-Boot reports the ART address as
invalid. WAN uses the base address (this is the one on the label), LAN
base+1, the 2.4 GHz radio base+2 and the 5 GHz radio base+3. The ethernet
addresses come from nvmem cells. The board deliberately has no ethernetN
aliases: GL.iNet's U-Boot uses them to write its own mac-address
properties into both GMAC nodes (a placeholder for WAN, the base address
for LAN), which of_get_mac_address() would prefer over the nvmem cells.
The modem enumerates at SuperSpeed and therefore requires the IPQ5018 USB3
UNIPHY, so both usbphy0 and usbphy1 are enabled. uqmi cannot communicate
with this modem, so modemmanager has to be installed separately to use it.
The QCN6122 is wired to the second radio instance, so wifi@b00b040 with
userpd3 is enabled rather than wifi@b00a040: the stock device tree enables
wifi2@/userpd3 and leaves wifi1@/userpd2 disabled. That instance places
its BDF and M3 dump above the default q6 region, so the reserved region
is grown accordingly.
Board data for the two radios is submitted separately to
firmware_qca-wireless. It is taken from the stock firmware's wifi_fw
partition, which is a squashfs image: bdwlan.b24 for the IPQ5018 2.4 GHz
radio and qcn6122/bdwlan.b60 for the QCN6122 5 GHz radio, matching the
qcom,board_id values of 0x24 and 0x60 that the stock device tree assigns
to the respective radios. The two radios require distinct board data;
sharing a single BDF leaves the front-end misconfigured and the affected
radio unable to transmit or receive at usable power.
The device tree started from the initial port by Hostle, was largely
rewritten by georgem83 and further reworked by Andreas Boeckler, published
in the OpenWrt forum thread linked below. It is carried here with fixes for
the WLAN board data, the QCN6122 radio instance, the U-Boot environment
partition and the fan cooling map.
Link: https://forum.openwrt.org/t/plain-openwrt-on-gl-x2000/231554
Installation:
Interrupt the bootloader over serial (115200 8N1) by typing "gl", then
TFTP the initramfs image and boot it:
tftpboot 0x44000000 openwrt-qualcommax-ipq50xx-glinet_gl-x2000-initramfs-uImage.itb
bootm 0x44000000
Then flash the factory image with sysupgrade.
Signed-off-by: Gilberto Conde <gilbertorconde@gmail.com>
The U-Boot script embedded in the GL.iNet QSDK factory image hardcodes
the GL-B3000 flash layout. Replace the UBI offset and size with
placeholders filled in by the gl-qsdk-factory recipe, so other GL.iNet
boards with a different layout can use the same script.
The script is copied under a per-device name, which keeps the FIT
description unchanged and avoids devices overwriting each other's
substituted copy in KDIR_TMP.
Signed-off-by: Gilberto Conde <gilbertorconde@gmail.com>
The pinctrl driver leaves GPIO13's fourth function slot empty, so PWM3
cannot be routed there. The GL.iNet GL-X2000 drives its fan from PWM3 on
GPIO13, and the stock firmware muxes the pin with select value 4:
gpio13 : out low func4 8mA no pull
pin 13 (GPIO_13): 1941010.pwm function pwm3 group gpio13
Select value 4 corresponds to the empty slot, so add pwm3 there and list
gpio13 in pwm3_groups.
Accepted upstream via pinctrl-qcom/for-current, so this can be dropped
once the kernel is bumped to 7.3 or later. The backport carries the
upstream diff unchanged; 0305, which adds gpio30 to pwm3_groups
downstream, is refreshed to apply on top of it.
Link: https://patch.msgid.link/20260921093419.2870168-1-gilbertorconde@gmail.com
Signed-off-by: Gilberto Conde <gilbertorconde@gmail.com>
Add support for the CMCC RAX3000Q/QY platform based on Qualcomm IPQ5000.
Both hardware variants are identical and share the same device tree.
Hardware Specifications:
- SoC: Qualcomm IPQ5000
- RAM: 256 MiB, integrated in SoC
- Flash: GigaDevice GD5F1GQ5REYIG (Dosilicon variant is not supported)
- 2.4 GHz Wi-Fi: SoC integrated, with 2 FEMs
- 5 GHz Wi-Fi: QCN6102, with 2 FEMs
- Switch: QCA8337, 1 WAN + 3 LAN
- LEDs: 3 RGB LEDs
- Keys: reset and mesh pairing
- UART: 3-pin, 115200n8
The vendor flash layout is documented and the ART partition contains
calibration data, which must be preserved carefully.
Due to the limited 256 MiB RAM, ath11k is disabled in the DTS to avoid
OOM issues on this device.
The MAC address location in flash could not be identified reliably.
As a temporary workaround, the MAC addresses (WAN LAN 2.4G 5G WiFi) are derived from the ART
partition start, with vendor/default values being invalid and falling
back to random generation if left unchanged (FF).
Flash Guide
Requirements
- UART access (3-pin, 115200n8)
- Ethernet cable
- TFTP server running on your computer
- OpenWrt `.ubi` firmware image
Step 0: Backup all partitions (strongly recommended)
Step 1: Connect UART and interrupt U-Boot
Step 2: Configure PC network
Step 3: Start TFTP server
Step 4: Load firmware via U-Boot
tftpboot 192.168.10.19:<your_firmware>.ubi
Step 5: Flash firmware
flash rootfs
Step 6: Reboot device
reset
Signed-off-by: Mark Jia <mark304188@hotmail.com>
TP-Link EAP650-Outdoor is a 802.11ax AP claiming AX3000 support. It is
wall or pole mountable, and rated for outdoor use. It can only be
powered via PoE.
Specifications:
---------------
* CPU: Qualcomm IPQ5018 Dual core Cortex-A53
* RAM: 512 MB
* Storage: 128MB NAND GigaDevice F50D1G41LB-83YIG2M
* Ethernet: 1x Gigabit RJ45 port with PoE input
* 2.4GHz: IPQ5018 802.11b/g/n/ax (2x 4dBi)
* 5GHz: QCN6024 802.11n/ac/ax (2x 5dBi)
* LEDs: 1x Status LED (Green/Yellow)
* Buttons: 1x Reset
* UART: 4-pin unpopulated header
TX RX GND VCC - JP2 (3.3V, 115200/8)
MAC addresses:
LAN : B0:19:21:xx:xx:02
2.4GHz : B0:19:21:xx:xx:02
5GHz : B0:19:21:xx:xx:03
The procedures to 'backup your stock firmware' and 'stock firmware recovery'
described in the commit "qualcommax: ipq50xx: Add support for Yuncore AX850"
are equivalent for this device.
https://git.openwrt.org/openwrt/openwrt/commit/?id=5d2994a73e20ba840d3096e1ad52add6937fe86d
Installation:
=============
TFTP method
-----------
To flash via tftp, first place the initramfs image on the TFTP server.
setenv serverip <ip of tftp server>
setenv ipaddr <ip in same subnet as tftp server>
tftpboot tplink_eap650-outdoor-v1-initramfs-uImage.itb
bootm
This should boot OpenWRT. Once booted, flash the sysupgrade.bin image
using either luci or the commandline.
Signed-off-by: Samuele Longhi <agave@dracaena.it>
Link: https://github.com/openwrt/openwrt/pull/23056
Signed-off-by: Robert Marko <robimarko@gmail.com>
Create a shared dtsi for ELECOM WRC-X3000GS2 and WRC-X3000GST2.
They have the almost identical hardware, except for memory (256M vs.
512M).
Additionally, disable "q6_region" in reserved-memory of WRC-X3000GS2.
This was disabled before, but accidentally activated by 1f879b8839
("qualcommax: ipq50xx: split firmware variants and refactor QCN6122
support").
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24937
Signed-off-by: Robert Marko <robimarko@gmail.com>
Some Xiaomi AX6000 (RA72) units use SPI-NAND with page size 2048 and
OOB size 128, requiring ECC strength 8 with step size 512 (matching
stock firmware). Without explicit ECC settings, the kernel defaults
to strength 4, causing UBI ECC errors and a boot loop after
sysupgrade to squashfs on affected units.
Signed-off-by: Sergey Dubow <killerpelmeney@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24959
Signed-off-by: Robert Marko <robimarko@gmail.com>
Change the Realtek switch MDIO node unit address and reg property from
decimal (29) to hexadecimal (0x1d) to comply with standard Device Tree
coding conventions. This is a cosmetic fix and does not change the actual
hardware address.
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/25382
Signed-off-by: Robert Marko <robimarko@gmail.com>
Add upstream patch marking the 'gpll0_main' clock as critical on
IPQ5018 (gcc-ipq5018 driver), backported from upstream commit
33f9cb56cc28 ("clk: qcom: gcc-ipq5018: mark 'gpll0_main' clock as
critical").
During boot the APCS core clock feeding the CPUs can use GPLL0 as
its parent. On some boards (e.g. TP-Link Archer AX55 v1 using the
in-tree DTS since v6.18), the ipq-cmn-pll driver's pm_runtime_put()
call in its probe function asynchronously disables
'gcc_cmn_blk_ahb_clk', which in turn disables 'gpll0_main' as well,
hanging the system until the hardware watchdog restarts the board.
Marking gpll0_main as CLK_IS_CRITICAL fixes the underlying issue
directly in the GCC driver, making the previous workaround in
0191-clk-qcom-ipq-cmn-pll-keep-the-CMN-block-bus-clocks-enabled.patch
unnecessary. Drop that patch, as it addressed the same symptom by
keeping the CMN PLL block's bus clocks permanently enabled via a
devres-managed runtime PM reference instead of fixing the actual
critical clock.
Refresh the context in
0721-clk-gcc-ipq5018-remove-the-unsupported-clk-combinati.patch and
0723-clk-qcom-gcc-ipq5018-fix-uniphy-soft-reset-issue.patch, whose
hunks shifted by 9 lines due to the newly inserted patch.
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/25386
Signed-off-by: Robert Marko <robimarko@gmail.com>
Several image recipes call tar without the options that pin the member
order, the owner, the mode and the modification time. The archive then
holds the build time, the umask of the build user and the readdir order of
the build directory, so two builds of the same source produce different
images.
Pass the same options that Image/mkfs/targz and sysupgrade-tar.sh already
use. The recipes define no member order, so sorting the members takes
nothing away. The diffoscope of the published WAX610 archive shows the
order differing between the build machines, which is what a readdir order
produces.
--mode=go-w clears the write bit of the group and of the others. tar keeps
the mode of the file on disk, which follows the umask of the build user,
so without it the archive differs between a host with umask 022 and one
with umask 002.
Covers the Netgear factory archives of ipq40xx, ipq60xx and ipq807x, the
Creality factory archive of mt76x8, the D-Link DWL8610AP archive of
bcm53xx, the Freecom archive of ixp4xx and the Linksys switch archive of
realtek.
Signed-off-by: John Crispin <john@phrozen.org>
Updates the MR7500 DTS to correctly map the partition containing the WAN
PHY firmware.
Also fixes inverted PHY reset polarity.
Signed-off-by: Ross Barnes-Brown <true.robot.ross@gmail.com>
Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
Co-authored-by: Paweł Owoc <frut3k7@gmail.com>
The default failsafe script just takes the first interface from the UCI LAN
inteface list, so its currently using the SFP interface in failsafe.
Since this is not convenient at all, change the order so that lan1 will now
be used for failsafe instead.
Fixes: #23633
Signed-off-by: Robert Marko <robimarko@gmail.com>
Rename the switch, port and PHY nodes to match the upstream device
tree binding names for the qca8k driver. The switch PHYs already live
on the external MDIO bus, so no functional change.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25188
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
Partially revert commit e8c74e8f1e.
Assigning LAN MAC addresses incremented by one causes a conflict
with the addresses for the 2.4G wireless interface.
Additionally, invalid wireless network interface assignments are revoked.
Retain the change setting label-mac-device to &swport5 WAN port
Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25239
Signed-off-by: Robert Marko <robimarko@gmail.com>
Move the switch node from the shared dtsi to the dts.
Remove duplicate swport definitions for GL-AXT1800.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
After switching to kernel 6.18, a pinctrl conflict occurred for
the sd_card: pin GPIO_62 already requested by 7804000.mmc
ipq6018-pinctrl 1000000.pinctrl: error -EINVAL: pin-62
Switch the function of the CD pin to "gpio" to fix this.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
In GL.iNet's latest official firmware, factory.bin cannot be used for
upgrades. It is still possible to upgrade to OpenWrt via U-Boot.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Resets in the remoteproc node are now NOP, so no point in keeping them.
Allows dropping the WCSSAON patches.
Signed-off-by: Robert Marko <robimarko@gmail.com>
During the WCSS secure conversion, loading of M3 FW was forgotten.
Unlike on IPQ807x, it does not lead to a FW crash but we should still load
it.
Fixes: d7502b4694 ("qualcommax: ipq807x/ipq60xx: use secure WCSS driver")
Signed-off-by: Robert Marko <robimarko@gmail.com>
During the WCSS secure conversion, loading of M3 FW was forgotten.
This will lead to a remoteproc crash, so make sure to load the M3 FW.
Fixes: d7502b4694 ("qualcommax: ipq807x/ipq60xx: use secure WCSS driver")
Signed-off-by: Robert Marko <robimarko@gmail.com>
Currently, getting the required UNIPHY derived clocks requires a global
clock lookup by name, so follow IPQ6018 and pass them directly via DT
reference to GCC.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Passing UNIPHY clocks as DT references directly to GCC allows us to drop
the old global name hack we needed for SSDK.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Both AQR113C PHYs can return invalid MDIO data immediately after reset
is deasserted. Firmware detection then skips the NVMEM image and PHY
attachment times out.
Add a 100 ms reset assertion delay and wait 250 ms after deassertion
before probing each PHY. Cold-boot testing confirms both 10G ports
attach without the generic firmware-ID workaround.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Julius Bairaktaris
André Valentin
Robert Marko
Ross Barnes-Brown
Manuel Fombuena
John Audia
Eduard Hart
Johan Alvarado
Edoardo Pinci
Gilberto Conde
Mark Jia
Samuele Longhi
INAGAKI Hiroshi
Sergey Dubow
Mieczyslaw Nalewaj
John Crispin
Rosen Penev
Chukun Pan