mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-22 06:45:03 +04:00
Wojciech Zwolinski
bf5c535c42
Add support for the ZTE T5400, based on the Qualcomm IPQ5018.
Specifications:
- Qualcomm IPQ5018 SoC, 2x ARM Cortex-A53
- 512 MiB RAM
- 256 MiB SPI-NAND (Winbond W25N02JWZEIF)
- integrated IPQ5018 2.4 GHz 802.11ax radio, 2x2
- Qualcomm QCN9024 5 GHz 802.11ax radio, 4x4, PCIe Gen2 x2,
exposed to ath11k under the QCN9074 hw1.0 profile
- QCA8337 switch providing 3x LAN ports, with an SGMII uplink via
GMAC1/UNIPHY0 and CPU port 6
- IPQ5018 internal GEPHY providing the fourth RJ45 Ethernet port,
configured as WAN, via GMAC0
- reset and WPS buttons
- red and white status LEDs
- USB2 + USB3 Type-C port (not enabled)
- 12 V / 2.0 A (24 W) DC power input
UART:
The UART pads are on the component side near the SoC/RAM shield.
With the Ethernet ports at the bottom and antenna connectors on the
left, the pads are at the upper-right edge of the shield area. They
are not labelled on the PCB. Access requires removing the shield
cover.
With the board oriented as above:
upper signal pad: router TX
lower signal pad: router RX
The UART uses 1.8 V logic, 115200 8N1, without flow control.
router TX -> adapter RXD
router RX <- adapter TXD
No dedicated UART ground pad was identified next to the TX/RX pads.
The shield is connected to ground and can be used for adapter GND.
Other board points can be verified as ground by checking continuity
against the shield.
Ethernet and MAC addresses:
Stock firmware derives interface addresses from a single factory base
MAC stored in the "mac" NAND partition by adjusting only the fourth
octet (mac[3]) by a per-interface constant.
This is intentionally not reproduced bit-for-bit. The port uses the
generic "mac-base" nvmem layout already used by other devices in-tree,
which matches stock except when an offset causes the fourth octet to
cross a boundary.
- label / br-lan (LAN): factory MAC, unmodified
- eth0 / GMAC0 (WAN): factory MAC, mac[3] - 2
- eth1 / GMAC1 (LAN conduit): factory MAC, mac[3] - 1
- integrated 2.4 GHz radio: factory MAC, unmodified
- external 5 GHz radio: factory MAC, mac[3] + 10
The generic mac-base layout performs normal 48-bit arithmetic on the
whole address, while stock firmware wraps the fourth octet
independently. The results can therefore differ when the affected
octet crosses a 0x00 or 0xff boundary.
Replicating the stock fourth-octet-only arithmetic exactly would
require device-specific handling for this edge case.
The tested unit does not hit the edge case, so all derived addresses
match stock and remain unique. It is not known from a single unit how
often such a boundary case occurs across production T5400 devices.
Flash layout:
On the tested unit, OpenWrt is installed entirely in the existing
60 MiB "rootfs" partition, exposed as mtd17. The second stock
slot, "rootfs_1", is exposed as mtd18 and remains untouched.
The stock U-Boot boot chain is left unmodified. Its bootcmd=bootipq
boots the OpenWrt UBI from mtd17 using FIT config@mp03.1. No
persistent U-Boot environment, MIBIB or BOOTCONFIG changes are
required.
Flashing instructions:
Connect a TFTP host to physical RJ45 port 4 (GMAC0/eth0).
For the procedure below, configure the router as 192.168.0.1 and
the TFTP host as 192.168.0.22.
The stock U-Boot autoboot delay is one second. Interrupt autoboot over
UART to reach the IPQ5018# prompt.
Use the following transient network settings:
setenv serverip 192.168.0.22
setenv ipaddr 192.168.0.1
Stock backup:
Before the first persistent write, both stock rootfs slots can be
exported directly from stock U-Boot:
nand read 0x44000000 0x00a60000 0x03c00000
tftpput 0x44000000 0x03c00000 192.168.0.22:zte-t5400-mtd17-rootfs.bin
nand read 0x44000000 0x04660000 0x03c00000
tftpput 0x44000000 0x03c00000 192.168.0.22:zte-t5400-mtd18-rootfs_1.bin
The saved mtd17 image provides the tested stock recovery path.
Boot the OpenWrt initramfs image over TFTP:
tftpboot 0x44000000 openwrt-qualcommax-ipq50xx-zte_t5400-initramfs-uImage.itb
bootm 0x44000000
The initramfs runs entirely from RAM and does not modify NAND by
itself.
Transfer the following factory image to /tmp on the running
OpenWrt initramfs system:
openwrt-qualcommax-ipq50xx-zte_t5400-squashfs-factory.ubi
Verify that /dev/mtd17 is the "rootfs" partition before writing
the image.
Then write mtd17:
ubiformat /dev/mtd17 -y \
-f /tmp/openwrt-qualcommax-ipq50xx-zte_t5400-squashfs-factory.ubi
Power-cycle the router after the write completes. The unchanged stock
bootipq path then boots OpenWrt from mtd17.
Subsequent upgrades use the normal OpenWrt NAND sysupgrade path with:
openwrt-qualcommax-ipq50xx-zte_t5400-squashfs-sysupgrade.bin
Normal installation and upgrade leave mtd18, ART, the MAC partition,
MIBIB, BOOTCONFIG and bootloader partitions unchanged.
Testing:
Tested on real hardware:
- initramfs boot over UART/TFTP
- factory installation and persistent cold boot
- clean and configuration-preserving sysupgrade
- all four Ethernet ports with routed iperf3 traffic
- both Wi-Fi radios in AP mode and with routed iperf3 traffic
- LEDs and reset/WPS buttons
- restoration of the saved stock mtd17 image and vendor-kernel boot,
followed by a clean OpenWrt reinstall
Signed-off-by: Wojciech Zwolinski <wojciech.zwolinski0@gmail.com>