Google WiFi (codename: Gale) is an IPQ4019-based AP, with 2 Ethernet
ports, 2x2 2.4+5GHz WiFi, 512 MB RAM, 4 GB eMMC, and a USB type C port.
In its stock configuration, it runs a Chromium OS-based system, but you
wouldn't know it, since you can only manage it via a "cloud" +
mobile-app system.
The "v2" label is coded into the bootloader, which prefers the
"google,gale-v2" compatible string. I believe "v1" must have been
pre-release hardware.
Note: this is *not* the Google Nest WiFi, released in 2019.
I include "factory.bin" support, where we generate a GPT-based disk
image with 2 partitions -- a kernel partition (using the custom "Chrome
OS kernel" GUID type) and a root filesystem partition. See below for
flashing instructions.
Sysupgrade is supported via recent emmc_do_upgrade() helper.
This is a subtarget because it enables different features
(FEATURES=boot-part rootfs-part) whose configurations don't make sense
in the "generic" target, and because it builds in a few USB drivers,
which are necessary for installation (installation is performed by
booting from USB storage, and so these drivers cannot be built as
modules, since we need to load modules from USB storage).
Flashing instructions
=====================
Documented here:
https://openwrt.org/inbox/toh/google/google_wifi
Note this requires booting from USB storage.
Features
========
I've tested:
* Ethernet, both WAN and LAN ports
* eMMC
* USB-C (hub, power-delivery, peripherals)
* LED0 (R/G/B)
* WiFi (limited testing)
* SPI flash
* Serial console: once in developer mode, console can be accessed via
the USB-C port with SuzyQable, or other similar "Closed Case
Debugging" tools:
https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/master/docs/ccd.md#suzyq-suzyqable
* Sysupgrade
Not tested:
* TPM
Known not working:
* Reboot: this requires some additional TrustZone / SCM
configuration to disable Qualcomm's SDI. I have a proposal upstream,
and based on IRC chats, this might be acceptable with additional DT
logic:
[RFC PATCH] firmware: qcom_scm: disable SDI at boot
https://lore.kernel.org/linux-arm-msm/20200721080054.2803881-1-computersforpeace@gmail.com/
* SMP: enabling secondary CPUs doesn't currently work using the stock
bootloader, as the qcom_scm driver assumes newer features than this
TrustZone firmware has. I posted notes here:
[RFC] qcom_scm: IPQ4019 firmware does not support atomic API?
https://lore.kernel.org/linux-arm-msm/20200913201608.GA3162100@bDebian/
* There's a single external button, and a few useful internal GPIO
switches. I haven't hooked them up.
The first two are fixed with subsequent commits.
Additional notes
================
Much of the DTS is pulled from the Chrome OS kernel 3.18 branch, which
the manufacturer image uses.
Note: the manufacturer bootloader knows how to patch in calibration data
via the wifi{0,1} aliases in the DTB, so while these properties aren't
present in the DTS, they are available at runtime:
# ls -l
/sys/firmware/devicetree/base/soc/wifi@a*/qcom,ath10k-pre-calibration-data
-r--r--r-- 1 root root 12064 Jul 15 19:11 /sys/firmware/devicetree/base/soc/wifi@a000000/qcom,ath10k-pre-calibration-data
-r--r--r-- 1 root root 12064 Jul 15 19:11 /sys/firmware/devicetree/base/soc/wifi@a800000/qcom,ath10k-pre-calibration-data
Ethernet MAC addresses are similarly patched in via the ethernet{0,1} aliases.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
(updated 901 - x1pro moved in the process)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Telco X1 Pro is a Cat12 LTE-A Pro modem router.
Vendor firmware is based on a recent version of OpenWrt.
Flashing is possible via CLI using sysupgrade -F -n
The serial headers allow bootloader and console access
Serial setting: 115200 8N1
Brief Specifications:
IPQ4019 SoC
32MB flash
512MB RAM
4x gigabit LAN
1x gigabit WAN
Dual-band Wave-2 wifi
2x SMA LTE antenna connectors
2x RP-SMA wifi antennas
1x USB 2.0 port
1x Reset button
Serial headers installed
1x Nano SIM tray
1x Quectel EM-12G LTE-A Pro modem
1x M.2 slot attached to USB 3.0
1x internal micro SD card slot
Signed-off-by: Nicholas Smith <nicholas@nbembedded.com>
ZTE MF286D is a LTE router with four gigabit ethernet ports
and integrated QMI mPCIE modem.
Hardware specification:
- CPU: IPQ4019
- RAM: 256MB
- Flash: NAND 128MB + NOR 2MB
- WLAN1: Qualcomm Atheros QCA4019 2.4GHz 802.11bgn 2x2:2
- WLAN2: Qualcomm Atheros QCA4019 5GHz 802.11anac 2x2:2
- LTE: mPCIe cat 12 card (Modem chipset MDM9250)
- LAN: 4 Gigabit Ports
- USB: 1x USB2.0 (regular port). 1x USB3.0 (mpcie - used by the modem)
- Serial console: X8 connector 115200 8n1
Known issues:
- Many LEDs are driven by the modem. Only internal LEDs and wifi LEDs
are driven by cpu.
- Wifi LED is triggered by phy0tpt only
- No VoIP support
- LAN1/WAN port is configured as WAN
- ZTE gives only one MAC per device. Use +1/+2/+3 increment for WAN
and WLAN0/1
Opening the case:
1. Take of battery lid (no battery support for this model, battery cage
is dummy).
2. Unscrew screw placed behind battery lid.
3. Take off back cover. It attached with multiple plastic clamps.
4. Unscrew four more screws hidden behind back case.
5. Remove front panel from blue chassis. There are more plastic
clamps.
6. Unscrew two boards, which secures the PCB in the chassis.
7. Extract board from blue chassis.
Console connection (X8 connector):
1. Parameters: 115200 8N1
2. Pin description: (from closest pin to X8 descriptor to farthest)
- VCC (3.3V)
- TX
- RX
- GND
Install Instructions:
Serial + initramfs:
1. Place OpenWrt initramfs image for the device on a TFTP in
the server's root. This example uses Server IP: 192.168.1.3
2. Connect serial console (115200,8n1) to X8 connector.
3. Connect TFTP server to RJ-45 port.
4. Stop in u-Boot and run u-Boot commands:
setenv serverip 192.168.1.3
setenv ipaddr 192.168.1.72
set fdt_high 0x85000000
tftp openwrt-ipq40xx-generic-zte_mf286d-initramfs-fit-zImage.itb
bootm $loadaddr
5. Please make backup of original partitions, if you think about revert
to stock.
6. Login via ssh or serial and remove stock partitions:
ubiattach -m 9
ubirmvol /dev/ubi0 -N ubi_rootfs
ubirmvol /dev/ubi0 -N ubi_rootfs_data
7. Install image via "sysupgrade -n".
Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
(cosmetic changes to the commit message)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
SOC: IPQ4019
CPU: Quad-core ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
DRAM: 256 MB
NAND: 128 MiB Macronix MX30LF1G18AC
ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4x LAN, 1x WAN)
USB: 1x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC)
WLAN1: Qualcomm Atheros QCA4019 2.4GHz 802.11bgn 2x2:2
WLAN2: Qualcomm Atheros QCA9984 5GHz 802.11nac 4x4:4
INPUT: 1x WPS, 1x Reset
LEDS: Status, WIFI1, WIFI2, WAN (red & blue), 4x LAN
This board is very similar to the RT-ACRH13/RT-AC58U. It must be flashed
with an intermediary initramfs image, the jffs2 ubi volume deleted, and
then finally a sysupgrade with the final image performed.
Signed-off-by: Joshua Roys <roysjosh@gmail.com>
(added ALT0)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This patch adds supports for the GL-B2200 router.
Specifications:
- SOC: Qualcomm IPQ4019 ARM Quad-Core
- RAM: 512 MiB
- Flash: 16 MiB NOR - SPI0
- EMMC: 8GB EMMC
- ETH: Qualcomm QCA8075
- WLAN1: Qualcomm Atheros QCA4019 2.4GHz 802.11b/g/n 2x2
- WLAN2: Qualcomm Atheros QCA4019 5GHz 802.11n/ac W2 2x2
- WLAN3: Qualcomm Atheros QCA9886 5GHz 802.11n/ac W2 2x2
- INPUT: Reset, WPS
- LED: Power, Internet
- UART1: On board pin header near to LED (3.3V, TX, RX, GND), 3.3V without pin - 115200 8N1
- UART2: On board with BLE module
- SPI1: On board socket for Zigbee module
Update firmware instructions:
Please update the firmware via U-Boot web UI (by default at 192.168.1.1, following instructions found at
https://docs.gl-inet.com/en/3/troubleshooting/debrick/).
Normal sysupgrade, either via CLI or LuCI, is not possible from stock firmware.
Please do use the *gl-b2200-squashfs-emmc.img file, gunzipping the produced *gl-b2200-squashfs-emmc.img.gz one first.
What's working:
- WiFi 2G, 5G
- WPA2/WPA3
Not tested:
- Bluetooth LE/Zigbee
Credits goes to the original authors of this patch.
V1->V2:
- updates *arm-boot-add-dts-files.patch correctly (sorry, my mistake)
- add uboot-envtools support
V2->V3:
- Li Zhang updated official patch to fix wrong MAC address on wlan0 (PCI) interface
V3->V4:
- wire up sysupgrade
Signed-off-by: Li Zhang <li.zhang@gl-inet.com>
[fix tab and trailing space, document what's working and what's not]
Signed-off-by: TruongSinh Tran-Nguyen <i@truongsinh.pro>
[rebase on top of master, address remaining comments]
Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com>
[remove redundant check in platform.sh]
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
LHGG-60ad is IPQ4019 + wil6210 based.
Specification:
- Qualcomm IPQ4019 (717 MHz)
- 256 MB of RAM (DDR3L)
- 16 MB (SPI NOR) of flash
- 1x Gbit ethernet, 802.3af/at POE IN connected through AR8035.
- WLAN: wil6210 802.11ad PCI card
- No USB or SD card ports
- UART disabled
- 8x LEDs
Biggest news is the wil6210 PCI card.
Integration for its configuration and detection has already been taken
care of when adding support for TP-Link Talon AD7200.
However, signal quality is much lower than with stock firmware, so
probably additional board-specific data has to be provided to the
driver and is still missing at the moment.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
[Fix Ethernet Interface]
Signed-off-by: Nick Hainke <vincent@systemli.org>
This patch adds support for the Teltonika RUTX10.
This device is an industrial DIN-rail router with 4 ethernet ports,
2.4G/5G dualband WiFi, Bluetooth, a USB 2.0 port and two GPIOs.
The RUTX series devices are very similiar so common parts of the DTS
are kept in a DTSI file. They are based on the QCA AP-DK01.1-C1 dev
board.
See https://teltonika-networks.com/product/rutx10 for more info.
Hardware:
SoC: Qualcomm IPQ4018
RAM: 256MB DDR3
SPI Flash 1: XTX XT25F128B (16MB, NOR)
SPI Flash 2: XTX XT26G02AWS (256MB, NAND)
Ethernet: Built-in IPQ4018 (SoC, QCA8075), 4x 10/100/1000 ports
WiFi 1: Qualcomm QCA4019 IEEE 802.11b/g/n
Wifi 2: Qualcomm QCA4019 IEEE 802.11a/n/ac
USB Hub: Genesys Logic GL852GT
Bluetooth: Qualcomm CSR8510 (A10U)
LED/GPIO controller: STM32F030 with custom firmware
Buttons: Reset button
Leds: Power (green, cannot be controlled)
WiFi 2.4G activity (green)
WiFi 5G activity (green)
MACs Details verified with the stock firmware:
eth0: Partition 0:CONFIG Offset: 0x0
eth1: = eth0 + 1
radio0 (2.4 GHz): = eth0 + 2
radio1 (5.0 GHz): = eth0 + 3
Label MAC address is from eth0.
The LED/GPIO controller needs a separate kernel driver to function.
The driver was extracted from the Teltonika GPL sources and can be
found at following feed: https://github.com/0xFelix/teltonika-rutx-openwrt
USB detection of the bluetooth interface is sometimes a bit flaky. When
not detected power cycle the device. When the bluetooth interface was
detected properly it can be used with bluez / bluetoothctl.
Flash instructions via stock web interface (sysupgrade based):
1. Set PC to fixed ip address 192.168.1.100
2. Push reset button and power on the device
3. Open u-boot HTTP recovery at http://192.168.1.1
4. Upload latest stock firmware and wait until the device is rebooted
5. Open stock web interface at http://192.168.1.1
6. Set some password so the web interface is happy
7. Go to firmware upgrade settings
8. Choose
openwrt-ipq40xx-generic-teltonika_rutx10-squashfs-nand-factory.ubi
9. Set 'Keep settings' to off
10. Click update, when warned that it is not a signed image proceed
Return to stock firmware:
1. Set PC to fixed ip address 192.168.1.100
2. Push reset button and power on the device
3. Open u-boot HTTP recovery at http://192.168.1.1
4. Upload latest stock firmware and wait until the device is rebooted
Note: The DTS expects OpenWrt to be running from the second rootfs
partition. u-boot on these devices hot-patches the DTS so running from the
first rootfs partition should also be possible. If you want to be save follow
the instructions above. u-boot HTTP recovery restores the device so that when
flashing OpenWrt from stock firmware it is flashed to the second rootfs
partition and the DTS matches.
Signed-off-by: Felix Matouschek <felix@matouschek.org>
This adds support for the MikroTik RouterBOARD RBD53iG-5HacD2HnD
(hAP ac³), a indoor dual band, dual-radio 802.11ac
wireless AP with external omnidirectional antennae, USB port, five
10/100/1000 Mbps Ethernet ports and PoE passthrough.
See https://mikrotik.com/product/hap_ac3 for more info.
Specifications:
- SoC: Qualcomm Atheros IPQ4019
- RAM: 256 MB
- Storage: 16 MB NOR + 128 MB NAND
- Wireless:
· Built-in IPQ4019 (SoC) 802.11b/g/n 2x2:2, 3 dBi antennae
· Built-in IPQ4019 (SoC) 802.11a/n/ac 2x2:2, 5.5 dBi antennae
- Ethernet: Built-in IPQ4019 (SoC, QCA8075) , 5x 1000/100/10 port,
passive PoE in, PoE passtrough on port 5
- 1x USB Type A port
Installation:
1. Boot the initramfs image via TFTP
2. Run "cat /proc/mtd" and look for "ubi" partition mtd device number, ex. "mtd1"
3. Use ubiformat to remove MikroTik specific UBI volumes
* Detach the UBI partition by running: "ubidetach -d 0"
* Format the partition by running: "ubiformat /dev/mtdN -y"
Replace mtdN with the correct mtd index from step 2.
3. Flash the sysupgrade image using "sysupgrade -n"
Signed-off-by: Robert Marko <robimarko@gmail.com>
Tested-by: Mark Birss <markbirss@gmail.com>
Tested-by: Michael Büchler <michael.buechler@posteo.net>
Tested-by: Alex Tomkins <tomkins@darkzone.net>
P&W R619AC is a IPQ4019 Dual-Band AC1200 router.
It is made by P&W (p2w-tech.com) known as P&W R619AC
but marketed and sold more popularly as G-DOCK 2.0.
Specification:
* SOC: Qualcomm Atheros IPQ4019 (717 MHz)
* RAM: 512 MiB
* Flash: 16 MiB (NOR) + 128 MiB (NAND)
* Ethernet: 5 x 10/100/1000 (4 x LAN, 1 x WAN)
* Wireless:
- 2.4 GHz b/g/n Qualcomm Atheros IPQ4019
- 5 GHz a/n/ac Qualcomm Atheros IPQ4019
* USB: 1 x USB 3.0
* LED: 4 x LAN, 1 x WAN, 2 x WiFi, 1 x Power (All Blue LED)
* Input: 1 x reset
* 1 x MicroSD card slot
* Serial console: 115200bps, pinheader J2 on PCB
* Power: DC 12V 2A
* 1 x Unpopulated mPCIe Slot (see below how to connect it)
* 1 x Unpopulated Sim Card Slot
Installation:
1. Access to tty console via UART serial
2. Enter failsafe mode and mount rootfs
<https://openwrt.org/docs/guide-user/troubleshooting/failsafe_and_factory_reset>
3. Edit inittab to enable shell on tty console
`sed -i 's/#ttyM/ttyM/' /etc/inittab`
4. Reboot and upload `-nand-factory.bin` to the router (using wget)
5. Use `sysupgrade` command to install
Another installation method is to hijack the upgrade server domain
of stock firmware, because it's using insecure http.
This commit is based on @LGA1150(at GitHub)'s work
<a4932c8d5a>
With some changes:
1. Added `qpic_bam` node in dts. I don't know much about this,
but I observed other dtses have this node.
2. Removed `ldo` node under `sd_0_pinmux`, because `ldo` cause SD card not
working. This fix is from
<51143b4c75>
3. Removed the 32MB NOR variant.
4. Removed `cd-gpios` in `sdhci` node, because it's reported that it makes
wlan2g led light up.
5. Added ethphy led config in dts.
6. Changed nand partition label from `rootfs` to `ubi`.
About the 128MiB variant: The stock bootloader sets size of nand to 64MiB.
But most of this devices have 128MiB nand. If you want to use all 128MiB,
you need to modify the `MIBIB` data of bootloader. More details can be
found on github:
<https://github.com/openwrt/openwrt/pull/3691#issuecomment-818770060>
For instructions on how to flash the MIBIB partition from u-boot console:
<https://github.com/openwrt/openwrt/pull/3691#issuecomment-819138232>
About the Mini PCIe slot: (from "ygleg")
"The REFCLK signals on the Mini PCIe slot is not connected on
this board out of the box. If you want to use the Mini PCIe slot
on the board, you need to (preferably) solder two 0402 resistors:
R436 (REFCLK+) and R444 (REFCLK-)..."
This and much more information is provoided in the github comment:
<https://github.com/openwrt/openwrt/pull/3691#issuecomment-968054670>
Signed-off-by: Richard Yu <yurichard3839@gmail.com>
Signed-off-by: DENG Qingfang <dqfext@gmail.com>
[Added comment about MIBIB+128 MiB variant. Added commit
message section about pcie slot. Renamed gpio-leds' subnodes
and added color, function+enum properties.]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
The Netgear SRS60 and SRR60 (sold together as SRK60) are two almost
identical AC3000 routers. The SRR60 has one port labeled as wan while
the SRS60 not. The RBR50 and RBS50 (sold together as RBK50) have a
different external shape but they have an USB 2.0 port on the back.
This patch has been tested only on SRS60 and RBR50, but should work
on SRR60 and RBS50.
Hardware
--------
SoC: Qualcomm IPQ4019 (717 MHz, 4 cores 4 threads)
RAM: 512MB DDR3
FLASH: 4GB EMMC
ETH:
- 3x 10/100/1000 Mbps Ethernet
- 1x 10/100/1000 Mbps Ethernet (WAN)
WIFI:
- 2.4GHz: 1x IPQ4019 (2x2:2)
- 5GHz: 1x IPQ4019 (2x2:2)
- 5GHz: 1x QCA9984 (4x4:4)
- 6 internal antennas
BTN:
- 1x Reset button
- 1x Sync button
- 1x ON/OFF button
LEDS:
- 8 leds controlled by TLC59208F (they can be switched on/off
independendently but the color can by changed by GPIOs)
- 1x Red led (Power)
- 1x Green led (Power)
UART:
- 115200-8-N-1
Everything works correctly.
Installation
------------
These routers have a dual partition system. However this firmware works
only on boot partition 1 and the OEM web interface will always flash on
the partition currently not booted.
The following steps will use the SRS60 firmware, but you have to chose
the right firmware for your router.
There are 2 ways to install Openwrt the first time:
1) Using NMRPflash
1. Download nmrpflash (https://github.com/jclehner/nmrpflash)
2. Put the openwrt-ipq40xx-generic-netgear_srs60-squashfs-factory.img
file in the same folder of the nmrpflash executable
3. Connect your pc to the router using the port near the power button.
4. Run "nmrpflash -i XXX -f openwrt-ipq40xx-generic-netgear_srs60-squashfs-factory.img".
Replace XXX with your network interface (can be identified by
running "nmrpflash -L")
5. Power on the router and wait for the flash to complete. After about
a minute the router should boot directly to Openwrt. If nothing
happens try to reboot the router. If you have problems flashing
try to set "10.164.183.253" as your computer IP address
2) Without NMRPflash
The OEM web interface will always flash on the partition currently not
booted, so to flash OpenWrt for the first time you have to switch to
boot partition 2 and then flash the factory image directly from the OEM
web interface.
To switch on partition 2 you have to enable telnet first:
1. Go to http://192.168.1.250/debug.htm and check "Enable Telnet".
2. Connect through telent ("telnet 192.168.1.250") and login using
admin/password.
To read the current boot_part:
artmtd -r boot_part
To write the new boot_part:
artmtd -w boot_part 02
Then reboot the router and then check again the current booted
partition
Now that you are on boot partition 2 you can flash the factory Openwrt
image directly from the OEM web interface.
Restore OEM Firmware
--------------------
1. Download the stock firmware from official netgear support.
2. Follow the nmrpflash procedure like above, using the official
Netgear firmware (for example SRS60-V2.2.1.210.img)
nmrpflash -i XXX -f SRS60-V2.2.1.210.img
Notes
-----
1) You can check and edit the boot partition in the Uboot shell using
the UART connection.
"boot_partition_show" shows the current boot partition
"boot_partition_set 1" sets the current boot partition to 1
2) Router mac addresses:
LAN XX:XX:XX:XX:XX:69
WAN XX:XX:XX:XX:XX:6a
WIFI 2G XX:XX:XX:XX:XX:69
WIFI 5G XX:XX:XX:XX:XX:6b
WIFI 5G (2nd) XX:XX:XX:XX:XX:6c
LABEL XX:XX:XX:XX:XX:69
Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
Signed-off-by: Robert Marko <robimarko@gmail.com>
[added 5.10 changes for 901-arm-boot-add-dts-files.patch, moved
sysupgrade mmc.sh to here and renamed it, various dtsi changes]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Refresh the kernel patches on top of 5.10 so they apply.
Manually fixup the 705-net-add-qualcomm-ar40xx-phy.patch
to apply.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
