Commit Graph

138 Commits

Author SHA1 Message Date
Robert Marko
9bd7d8b756 ipq-wifi: fix archive hash
It seems that ipq-wifi bump included and incorrect PKG_MIRROR_HASH value,
so fix it by using:
make package/firmware/ipq-wifi/check FIXUP=1

Fixes: 70fd815e57 ("qualcommax: ipq807x: add support for Linksys MX5300")
Signed-off-by: Robert Marko <robimarko@gmail.com>
2024-02-23 14:14:05 +01:00
Paweł Owoc
70fd815e57 qualcommax: ipq807x: add support for Linksys MX5300
Hardware specification:
========
SoC: Qualcomm IPQ8072A
Flash: 512MB (Winbond W29N04GZBIBA)
RAM: 1GB (2x Nanya DDR3L NT5CC256M16ER-EK)
Ethernet: 5x 10/100/1000Mbps (Qualcomm QCA8075)
WiFi1: 5GHz ac 4x4 (Qualcomm QCA9984 + Skyworks SKY85746-11) - channels 100-169
WiFi2: 5GHz ax 4x4 (Qualcomm QCN5054 + Skyworks SKY85755-11) - channels 36-64
WiFi3: 2.4GHz ax 4x4 (Qualcomm QCN5024 + Skyworks SKY8340-11)
IoT: Bluetooth 5, Zigbee and Thread (Qualcomm QCA4024 + Skyworks SE2433T-R)
IoT Flash: 4MB (Macronix MX25R3235F)
RTC: ST M41T00S
LED: 1x RGB status (NXP PCA9633)
USB: 1x USB 3.0
Button: WPS, Reset

Flash instructions:
========
1. Manually upgrade firmware using openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin image.
More details can be found here: https://www.linksys.com/hk/support-article?articleNum=274497
After first boot check actual partition:
- fw_printenv -n boot_part
and install firmware on second partition using command in case of 2:
- mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin kernel
and in case of 1:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel

2. Installation using serial connection from OEM firmware (default login: root, password: admin):
- fw_printenv -n boot_part
In case of 2:
- flash_erase /dev/mtd21 0 0
  nandwrite -p /dev/mtd21 openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin
or in case of 1:
- flash_erase /dev/mtd23 0 0
  nandwrite -p /dev/mtd23 openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin
After first boot install firmware on second partition:
- mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin kernel
or:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel

3. Installation from initramfs image using USB FAT32 formatted drive:
Stop u-boot and run:
- usb start && fatload usb 0:1 $loadaddr openwrt-qualcommax-ipq807x-linksys_mx5300-initramfs-uImage.itb && bootm $loadaddr
Write firmware to the flash from initramfs:
- mtd -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin kernel
and:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel

4. Back to the OEM firmware:
- mtd -e kernel -n write FW_MX5300_1.1.9.200251_prod.img kernel
and:
- mtd -r -e alt_kernel -n write FW_MX5300_1.1.9.200251_prod.img alt_kernel

5. USB recovery:
- fw_setenv usbimage 'openwrt-qualcommax-ipq807x-linksys_mx5300-initramfs-uImage.itb'
  fw_setenv bootusb 'usb start && fatload usb 0:1 $loadaddr $usbimage && bootm $loadaddr'
  fw_setenv bootcmd 'run bootusb; aq_load_fw && if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'

Notes:
========
IoT device is accesible over spi. Not yet supported.

Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2024-02-23 13:34:59 +01:00
Mantas Pucka
10ba730b7b ipq-wifi: add support for 8devices Mango board
Add support for .ipq6018 BDF suffix and add Mango board entry

Signed-off-by: Mantas Pucka <mantas@8devices.com>
2024-02-21 21:42:23 +01:00
Mantas Pucka
03935cf7de ipq-wifi: update to Git HEAD (2024-02-19)
1cc59e1 ipq6018: add 8devices Mango BDF
10279cc ipq40xx:Add support for Netgear LBR20 with two BDF's

Signed-off-by: Mantas Pucka <mantas@8devices.com>
2024-02-21 21:42:23 +01:00
Chukun Pan
b61ecb7d75 ipq807x: add support for CMCC RM2-6
Hardware specifications:
  SoC: Qualcomm IPQ8070A
  RAM: 512MB of DDR3
  Flash: 256MB Micron NAND
  Ethernet: 2x 1G RJ45 port
  WiFi1: QCN5024 2x2 2.4GHz
  WiFi2: QCN5054 2x2 5GHz
  Fan: 1x GPIO controlled
  Button: Reset, WPS

Flash instructions:
  Upload factory.bin in stock firmware's upgrade page.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2024-02-15 18:44:35 +01:00
Paweł Owoc
45f86a1278
ipq807x: fix whitespace usage
Replace with tab and remove unused whitespaces

Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
2024-01-15 16:52:08 +01:00
Manuel Fombuena
c7c2257f82 ipq-wifi: fix PKG_MIRROR_HASH
Incorrect PKG_MIRROR_HASH introduced on #14356

Fixes: 934873f451 ("ipq-wifi: bump version to 2024-01-06-71f45cff")
Signed-off-by: Manuel Fombuena <mfombuena@innovara.co.uk>
2024-01-08 23:58:30 +01:00
Manuel Fombuena
934873f451 ipq-wifi: bump version to 2024-01-06-71f45cff
673662f ipq8074: add Wallys DR8072V01 BDF
7e8b237 ipq40xx: add ZyXEL WSQ50 QCA4019 BDF
831c1bd ipq40xx: add ZyXEL WSQ50 QCA9984 BDF
f9ff251 ipq40xx: add ASUS MAP-AC2200 QCA9888 BDF
71f45cf ipq8074: Update MX4200 BDF

Signed-off-by: Manuel Fombuena <mfombuena@innovara.co.uk>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2024-01-08 00:07:26 +01:00
Mohammad Sayful Islam
46a2490e8f ipq807x: add support for Linksys MX4200 V1 and V2
Linksys MX4200 is a 802.11ax Tri-band router/AP.
Specifications:
* CPU: Qualcomm IPQ8174 Quad core Cortex-A53 1.4GHz
* RAM: 512MB of DDR3
* Storage: 512Mb NAND
* Ethernet: 4x1G RJ45 ports (QCA8075)
* WLAN:
	* 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate
	* 5GHz: Qualcomm QCN5054 2x2@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate
	* 5GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate
* LED-s:
	* RGB system led

* Buttons: 1x Soft reset 1x WPS
* Power: 12V DC Jack

Installation instructions:
Open Linksys Web UI - http://192.168.1.1/ca or http://10.65.1.1/ca depending on your setup.
Login with your admin password. The default password can be found on a sticker under the device.
To enter into the support mode, click on the “CA” link and the bottom of the page.
Open the “Connectivity” menu and upload the squash-factory image with the “Choose file” button.
Click start. Ignore all the prompts and warnings by click “yes” in all the popups.
The Wifi radios are turned off by default. To configure the router, you will need to connect your computer to the LAN port of the device.
Then you would need to write openwrt to the other partition for it to work
- First Check booted partition
fw_printenv -n boot_part

- Then install Openwrt to the other partition if booted in slot 1:
mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4200v(X)-squashfs-factory.bin alt_kernel

- If in slot 2:
mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4200v(X)-squashfs-factory.bin kernel

Replace (X) with your model version either 1 or 2

Signed-off-by: Mohammad Sayful Islam <sayf.mohammad01@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2024-01-06 16:13:23 +01:00
Chukun Pan
c22aa0be3e ipq807x: add support for ZTE MF269
Hardware specifications:
  SoC: Qualcomm IPQ8071A
  RAM: 512MB of DDR3
  Flash1: Eon EN25S64 8MB
  Flash2: MX30UF2G18AC 256MB
  Ethernet: 2x 2.5G RJ45 port
  Phone: 1x RJ11 port (SPI)
  USB: 1x Type-C 2.0 port
  WiFi1: QCN5024 2.4GHz
  WiFi2: QCN5054 5GHz
  Button: Reset, WPS

Flash instructions:
  1. Connect the router via serial port (115200 8N1 1.8V)
  2. Download the initramfs image, rename it to initramfs.bin,
     and host it with the tftp server.
  3. Interrupt U-Boot and run these commands:
     tftpboot initramfs.bin
     bootm
  4. After openwrt boots up, use scp or luci web
     to upload sysupgrade.bin to upgrade.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2023-12-14 10:30:19 +08:00
Chukun Pan
fbcda3616e
ipq807x: add Arcadyan AW1000 support
Hardware specification:
  SoC: Qualcomm IPQ8072A
  Flash: Toshiba NAND 1GiB
  RAM: 1 GiB of DDR3 466 MHz
  Ethernet: 4x 1Gbps + 1x 2.5Gbps
  WiFi1: QCN5024 2.4GHz ax 4x4
  WiFi2: QCN5054 5GHz ax 4x4
  Button: WiFi, WPS, Reset
  Modem: RG500Q-EA
  USB: 1 x USB 3.0
  Power: DC 12V 4A

Flash instructions:
  1. Download the initramfs image, rename it to
     initramfs.bin, and host it with tftp server.
  2. Interrupt U-Boot and run these commands:
     tftpboot initramfs.bin
     bootm
  3. After openwrt boots up, use scp or luci web
     to upload sysupgrade.bin to upgrade.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2023-12-13 17:29:15 +01:00
Christian Marangi
07b5b3978d
ipq-wifi: update to Git HEAD (2023-11-10)
0c2e810e71ed qcn9074: fix prpl Foundation Haze BDF for old mac80211 version

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-11-10 13:20:31 +01:00
Isaev Ruslan
3763a6a075
ipq807x: add support for Yuncore AX880
SPECIFICATION:
    - Chipset:  IPQ8072A +QCN5054+QCN5024+QCA8081*2
    - Flash NOR-8MB AND NAND-128MB
    - RAM 1Gb DDR
    - IEEE 802.11:  802.11ax/ac/b/g/n
    - 4*4 2.4G Wi-Fi standard   802.11b/g/n/ax
    - 4*4 5.8G Wi-Fi Standard   802.11 a/n/ac/ax
    - 2x 1 Gbps Ethernet (QCA8081) with 802.3at PoE input support
    - 1x  Reset
    - 1x  Bluetooth(optional)
    - 1x  DC Port 12V 3A
    - 4x Antenna    IPEX Connector, 3dBi omni antennas
    - Data Rate:    3657Mbps ( 2.4G: 1182Mbps (11ax 4x4); 5.8G: 2475Mbps (11ax 4x4))
    - RF Power: 2.4g ≤ 20dBm; 5.8g ≤ 19dBm
    - LED light:    Sys; 5.8G wifi; 2.4G wifi; WAN; LAN
    - Max Power Consumption:    ≤ 22W
    - Size: 198mm * 198mm * 41.02mm

BACKUP YOUR STOCK FIRMWARE:
```
export device=ax880
mkdir -p /tmp/fw_dump_$device
cd /tmp/fw_dump_$device
dmesg > dmesg_$device.log
dtc -I fs /sys/firmware/devicetree/base > $device.dts
cat /proc/device-tree/model > model
cat /proc/mtd > proc_mtd
while read p; do
mtd_dev=$(echo $p | cut -d: -f1)
echo $mtd_dev
dd if=/dev/$mtd_dev of=$mtd_dev
done < proc_mtd
md5sum * > md5sum.log
tar -cvzf ../$device.tar.gz .
export sum=$(md5sum /tmp/$device.tar.gz | cut -d' ' -f1)
mv ../$device.tar.gz /tmp/${device}_${sum}.tar.gz
echo fw backup saved to: /tmp/${device}_${sum}.tar.gz
```
Upload your backup via tftp to the safe place.

INSTALLATION:
1. stock firmware web ui
Rename factory.bin fw image file to factory.ubin. Flash this image
like ordinary stock fw upgrade.

2. stock firmware telnet method
Enter telnet cli (login: root, password: 476t*_f0%g09y) and upload
 factory.bin fw image and rename it to factory.ubin
`cd /tmp && wget <your_web_server_ip>/factory.ubin`
`sysupgrade factory.ubin

3. initramfs method
    Put openwrt-ipq807x-generic-yuncore_ax880-initramfs-uImage.itb to your
    TFTP server and rename it to ax880.initram
    Enable serial console and enter to the u-boot cli.
    Exec these commands:
    `tftpboot <your_tftp_server_ip>:ax880.initram`
    `dhcp`

    When downloading is finished:
    `bootm`
    After booting the device, you need to upload to the device factory.ubi fw image.
    ```
    cd /tmp && wget <your_web_server_ip>/factory.ubi`
    export rootfs=$(cat /proc/mtd | grep rootfs | cut -d: -f1)
    export rootfs_1=$(cat /proc/mtd | grep rootfs_1 | cut -d: -f1)
    ubiformat /dev/${rootfs} -y -f factory.ubi
    ubiformat /dev/${rootfs_1} -y -f factory.ubi
    reboot
    ```

4. u-boot factory.ubi image method
    Put openwrt-ipq807x-generic-yuncore_ax880-squashfs-factory.ubi to your
    TFTP server and rename it to ax880.ubi
    Enter u-boot cli and exec these commands:
    `tftpboot <your_tftp_server_ip>:ax880.ubi`
    `dhcp`
    After downloading is finished:
    `flash rootfs`
    `flash rootfs_1`
    `reset`

5. u-boot factory.bin method
    Put openwrt-ipq807x-generic-yuncore_ax880-squashfs-factory.bin to your
    TFTP server and rename it to ax880.bin
    Enter u-boot cli and exec these commands:
    `tftpboot <your_tftp_server_ip>:ax880.bin`
    `dhcp`
    After downloading is finished:
    `imgaddr=$fileaddr && nand device 0`
    Erase rootfs memory:
    `nand erase 0x00000000 0x03400000`
    Write rootfs:
    `nand write $fileaddr 0x00000000 $filesize`
    Erase rootfs_1 memory:
    `nand erase 0x3c00000 0x3400000`
    Write rootfs_1
    `nand write $fileaddr 0x3c00000 $filesize`
    `reset`

STOCK FIRMWARE RECOVERY:
Boot initramfs image.
Upload your rootfs mtd partition to the device using scp or download
it from the device using wget.
Enter device ssh cli and exec:
```
cd /tmp && wget <your_web_server_ip>/mtd21`
export rootfs=$(cat /proc/mtd | grep rootfs | cut -d: -f1)
export rootfs_1=$(cat /proc/mtd | grep rootfs_1 | cut -d: -f1)
ubiformat /dev/${rootfs} -y -f /tmp/mtd21
ubiformat /dev/${rootfs_1} -y -f /tmp/mtd21
reboot
```

Signed-off-by: Isaev Ruslan <legale.legale@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
2023-11-09 16:52:10 +01:00
Kristian Skramstad
f9e6218b82 ipq-wifi: update to version 2023-10-12
Contains the following update:
52a1c29 ipq8074: add Netgear WAX630 Board file for Netgear WAX630. Extracted from stock (WAX630_BDF.bin) firmware and repacked.
e7701b8 ipq8074: update RegDB in new submitted BDF
cd04ab7 qcn9074: update RegDB in new submitted BDF

Signed-off-by: Kristian Skramstad <kristian+github@83.no>
2023-10-28 19:49:18 +02:00
Christian Marangi
93182ff272
ipq-wifi: improve and update instructions on how to add board files
Improve and update instructions on how to add board files and both
describe the needed step to upstream a board file or to use it locally.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-10-02 19:00:14 +02:00
Kristian Skramstad
76e419288f ipq807x: add support for Netgear WAX620
```
Specifications:
* CPU: Qualcomm IPQ8072A, SoC Version: 2.0, Quad core Cortex-A53 1.6896 GHz
* RAM: 1 GiB of DDR4 600 MHz
* Flash: NAND 2x256 MiB (Macronix MX30UF2G18AC)
* 4 RGB LEDs: Power, LAN, 2.4GHz and 5GHz
* UART: Two 4-pin unpopulated headers under the LEDs.
  Use the header closest to LED 4 and 5.
  They are marked with a white stroke.
  TX RX GND, beginning from "4". 115200n8.

Lan:
* One 100/1000/2.5GBASE-T Gigabit Ethernet (QCA8081)

Wlan:
* 4x4 in 2.4GHz: 802.11b/g/n/ax
* 4x4 in 5.0GHz: 802.11a/n/ac/ax
* OFDM and OFDMA
* Bidir and MU-MIMO
* Internal antenna 3.1/4.3 dBi (2.4GHz/5GHz)

Power:
* PoE+ 802.3at/af 25.5W
* DC 12V 2.5A
```

```
Note: The OpenWrt image is setup with DHCP and not a static IP.
1.  Download the OpenWrt initramfs image. Copy the image to a TFTP server
2.  Connect to console on the AP, and connect the LAN port to your LAN
3.  Stop auto boot to get to U-boot shell, interrupt the autoboot process by pressing '0' when prompted
4.  Set active_fw in env
    # setenv active_fw 1
5.  Transfer the initramfs image with TFTP
    # setenv serverip 192.168.1.10 (IP of TFTP server host)
    # setenv ipaddr 192.168.1.1 (IP used by the router for getting the image, must be in the same subnet as the TFTP host)
    # tftpboot openwrt-qualcommax-ipq807x-netgear_wax620-initramfs-uImage.itb
6.  Reboot and load the image
    # bootm
7.  SCP factory image to the AP
    # scp openwrt-qualcommax-ipq807x-netgear_wax620-squashfs-factory.ubi root@192.168.1.1:/tmp/
8.  Connect to device using SSH (use the LAN port)
9.  Flash squashfs-factory.ubi from within the initramfs instance of OpenWRT
    Before you flash, please check your mtd partitions where mtdX is the right mtd rootfs partition.
    # cat /proc/mtd (To check MTD partitions)
    # ubiformat /dev/mtd19 -y -f /tmp/openwrt-qualcommax-ipq807x-netgear_wax620-squashfs-factory.ubi
10. Set active_fw to 0
    # /usr/sbin/fw_setenv active_fw 0
11. Reboot the AP and your done
    # reboot
```

Signed-off-by: Kristian Skramstad <kristian+github@83.no>
2023-09-24 13:09:16 +02:00
Andreas Böhler
9c7578d560
ipq40xx: refactor ZTE MF287 series
The ZTE MF287 requires a different board calibration file for ath10k than
the ZTE MF287+. The two devices receive their own DTS, thus the device tree
is slightly refactored.

Signed-off-by: Andreas Böhler <dev@aboehler.at>
2023-09-19 11:43:36 +02:00
Chukun Pan
eb8ddf5d5c
ipq-wifi: update to version 2023-09-16
Contains following updates:

 * ipq8074: add Asus RT-AX89X BDF
 * ipq8074: update RegDB in new submitted BDF
 * ipq40xx: add YYeTs LE1 BDF
 * ipq8074: add Netgear WAX620
 * qca-wireless: ipq40xx: add BDFs for ZTE MF287
 * ipq8174: Add Linksys MX4200

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
2023-09-18 12:20:01 +02:00
Thomas Kupper
4d79a65d60 ipq807x: add support for Netgear RAX120v2
Netgear Nighthawk RAX120v2 AX WIFI router with 5 1G and 1 5G ports.

The majority of the code is based on @jewwest's PR #11830.

Specifications:
    * CPU: Qualcomm IPQ8074 Quad core Cortex-A53 2.2GHz
    * RAM: 1024MB of DDR3 (Nanya NT5CC256M16EP-EK × 2)
    * Flash: SPI-NAND 512 MiB (Winbond W29N04GZBIBA)
    * Ethernet: 4x 10/100/1000 Mbps LAN,
                1x 10/100/1000 Mbps WAN (Qualcomm QCA8075),
                1x 10/100/1000/2500/5000 Mbps LAN/WAN (Aquantia AQR111B0 PHY)
    * Wi-Fi:
        * 2.4 GHz: Qualcomm QCN5024 4x4
        * 2x 5 GHz: Qualcomm QCN5054 4x4
    * USB: 2x USB 3.0
    * LEDs: Power, 2.4GHz & 5GHz Radio, WPS, WAN, USB1 & USB2, 5G LAN
    * Keys: LEDs On/Off, Power, Reset, RFKILL, WPS
    * UART: Marked J9003 VCC TX RX GND, beginning from "1". 3.3v, 115200n8
    * Power: 19 VDC, 3.1 A

Installation:
    * Flashing OpenWrt is done in two steps:
        a) Flash *-squashfs-web-ui-factory.img from stock UI (thanks to @wangyu-).
           This writes an initramfs based OpenWrt image onto the RAX120v2
        b) From OpenWrt flash the *-squashfs-sysupgrade.bin using LuCI or the commandline

    * U-Boot allows booting an initramfs image via TFTP:
    - Set ip of your PC to 192.168.1.100
        - At the serial console interrupt boot at "Hit any key to stop autoboot:"
        - In u-boot run `tftpsrv`
        - On your PC send the OpenWrt initramfs image:

          tftp 192.168.1.1 -m binary -c put openwrt-ipq807x-generic-netgear_rax120v2-initramfs-uImage.itb

Make 5G Aquantia phy work:
    For the 5G port labeled 'lan5' to work a firmware is needed. This can be loaded in
    u-boot by writing the firmware to the correct mtd partition.

    The firmware file found in the Netgear stock firmware under /lib/firmware/ named
    'AQR-G3_v4.3.C-AQR_DNI_DR-EQ35AX8-R-prov1_ID23888_VER1311.cld' is needed and has to
    be converted to a MBN file.

    The `mkheader.py` script used here can be found in the Netgear V1.2.8.40 GPL source,
    under 'git_home/u-boot.git/tools/mkheader.py'

    Convert the CLD file to MBN using:
    $ python2 mkheader.py 0x44000000 0x13 <*.cld file> aqr_4.3.C.mbn

    This MBN file can then be flashed to the MTD partition to be used by u-boot.

    The necessary files can also be found in
        https://github.com/boretom/openwrt-fork/tree/rax120v2/aquantia-firmware

    * Write MBN file to MTD partition to be loaded automatically by u-boot:

      U-boot automatically tries to load the firmware from nand at address 0x7e00000 which
      corresponds to `/dev/mtd25` in OpenWrt.

        - find ETHPHYFW partition while running OpenWrt (expected: /dev/mtd25)

          $ fgrep -i 'ethphyfw' /proc/mtd
          mtd25: 00080000 00020000 "ethphyfw

        - copy mbn file to /tmp/ folder of the router

          $ scp aqr-v4.3.C.mbn 192.168.1.1:/tmp/

        - write mbn file to ethphyfw partition

          $ mtd write /tmp/aqr_v4.3.C.mbn /dev/mtd25

Revert to stock firmware:
    * Flash the stock firmware to the bootloader using TFTP/NMRP.

References to RAX120v2 GPL source:
    https://www.downloads.netgear.com/files/GPL/RAX120-V1.2.8.40_gpl_src.zip

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Thomas Kupper <thomas.kupper@gmail.com>
2023-08-19 17:12:46 +02:00
Christian Lamparter
75505c5ec7 ipq-wifi: fix upstream board-2.bin ZTE M289F snafu
The upstream board-2.bin file in the linux-firmware.git
repository for the QCA4019 contains a packed board-2.bin
for this device for both 2.4G and 5G wifis. This isn't
something that the ath10k driver supports.

Until this feature either gets implemented - which is
very unlikely -, or the upstream boardfile is mended
(both, the original submitter and ath10k-firmware
custodian have been notified). OpenWrt will go back
and use its own bespoke boardfile. This unfortunately
means that 2.4G and on some revisions the 5G WiFi is
not available in the initramfs image for this device.

Fixes: #12886
Reported-by: Christian Heuff <christian@heuff.at>
Debugged-by: Georgios Kourachanis <geo.kourachanis@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2023-07-04 22:06:59 +02:00
Andreas Böhler
f70ee53b08 ipq4019: add support for ZTE MF287+ aka DreiNeo
The ZTE MF287+ is a LTE router used (exclusively?) by the network operator
"3". The MF287 (i.e. non-plus aka 3Neo) is also supported (the only
difference is the LTE modem)

Specifications
==============

SoC: IPQ4018
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 4x GBit LAN
LTE: ZTE Cat12 (MF287+) / ZTE Cat6 (MF287)
WiFi: 802.11a/b/g/n/ac SoC-integrated

MAC addresses
=============

LAN: from config + 2
WiFi 1: from config
WiFi 2: from config + 1

Installation
============

Option 1 - TFTP
---------------

TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:

  setenv serverip 192.168.1.100
  setenv ipaddr 192.168.1.1
  tftpboot 0x82000000 openwrt.bin
  bootm 0x82000000

From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:

  ubiattach -m14
  cat /dev/ubi0_0 > /tmp/ubi0_0
  cat /dev/ubi0_1 > /tmp/ubi0_1

Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.

Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:

  ubirmvol /dev/ubi0 -N ubi_rootfs
  ubirmvol /dev/ubi0 -N kernel

Option 2 - From stock firmware
------------------------------

The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.

The exploit will be available at the device wiki page.

Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".

ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd13 is the partition labelled "rootfs" by calling
"cat /proc/mtd".

Complete commands:

  cd /tmp
  tftp -g -r factory.bin 192.168.0.22
  cat /proc/driver/sensor_id
  flash_erase /dev/mtd13 0 0
  dd if=/tmp/factory.bin of=/dev/mtdblock13 bs=131072

Afterwards, reboot your device and you should have a working OpenWrt
installation.

Restore Stock
=============

Option 1 - via UART
-------------------

Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.

Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.

  ubiattach -m 14
  ubirmvol /dev/ubi0 -N kernel
  ubirmvol /dev/ubi0 -N rootfs
  ubirmvol /dev/ubi0 -N rootfs_data
  ubimkvol /dev/ubi0 -N kernel -s $kernel_length
  ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
  ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
  ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1

Option 2 - from within OpenWrt
------------------------------

This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.

Follow the commands from Option 1 to flash back to stock.

LTE Modem
=========

The LTE modem is similar to other ZTE devices and controls some more LEDs
and battery management.

Configuring the connection using uqmi works properly, the modem
provides three serial ports and a QMI CDC ethernet interface.

Signed-off-by: Andreas Böhler <dev@aboehler.at>
2023-06-25 15:53:03 +02:00
Robert Marko
f02f6aaa8d
ipq807x: rename target to qualcommax
Currently, ipq807x only covers Qualcomm IPQ807x SoC-s.
However, Qualcomm also has IPQ60xx and IPQ50xx SoC-s under the AX WiSoC-s
and they share a lot of stuff with IPQ807x, especially IPQ60xx so to avoid
duplicating kernel patches and everything lets make a common target with
per SoC subtargets.

Start doing that by renaming ipq807x to qualcommax so that dependencies
on ipq807x target can be updated.

Signed-off-by: Robert Marko <robimarko@gmail.com>
2023-06-16 11:11:08 +02:00
Petr Štetiar
c2bb9f055b
ipq-wifi: update to version 2023-06-03
Contains following updates:

 * ipq8074: update RegDB in new submitted BDF
 * Revert "ipq8074: update RegDB in new submitted BDF"
 * qcn9074: update RegDB in new submitted BDF
 * ipq8074: update RegDB in new submitted BDF
 * qca-wireless: ipq40xx: add BDFs for ZTE MF287+
 * Add BDFs for prpl Foundation Haze board

Signed-off-by: Petr Štetiar <ynezz@true.cz>
2023-06-10 21:29:06 +02:00
Petr Štetiar
b6a14ef7b9
Revert "ipq-wifi: add board files for prpl Foundation Haze board"
This reverts commit 6845c53ec3.  as this
was commited by accident, its still work in progress.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
2023-06-05 11:46:37 +02:00
Petr Štetiar
5f2d81cd71
Revert "WIP: ipq-wifi: use my fork temporarily until upstreamed"
This reverts commit 1bad93c426 as this was
commited by accident, its still work in progress.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
2023-06-05 11:46:12 +02:00
Petr Štetiar
1bad93c426
WIP: ipq-wifi: use my fork temporarily until upstreamed
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2023-06-05 08:31:45 +02:00
Petr Štetiar
6845c53ec3
ipq-wifi: add board files for prpl Foundation Haze board
QSDK based factory firmware was setting following board_ids in DTS:

 ath11k_pci 0001:01:00.0: chip_id 0x0 chip_family 0x0 board_id 0xa4 soc_id 0xffffffff
 ath11k c000000.wifi1: chip_id 0x0 chip_family 0x0 board_id 0x294 soc_id 0xffffffff

Thus board-prpl_haze.qcn9074` was extracted from `bus=...qmi-board-id=164.bin`
file and `board-prpl_haze.ipq8074` from `bus=...qmi-board-id=660.bin` file.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
2023-06-05 08:31:44 +02:00
Antti Nykänen
86e7614e0d ipq-wifi: bump to latest git HEAD
0f73d32 ipq8074: update RegDB in new submitted BDF
a4cd21f ipq8074: add Compex WPQ873 BDF
c888dd0 qca-wireless: ipq40xx: Add BDFs for Eero Cento
6388ba9 ipq8074: update regdb for Netgear SXK80 BDF
77775d2 ipq8074: add Netgear SXK80

Signed-off-by: Antti Nykänen <antti.nykanen@nokia.com>
2023-05-26 13:05:02 +03:00
Christian Lamparter
8217f02a1c ipq-wifi: drop upstreamed board-2.bin
The BDFs for the:
	Aruba AP-365
	Devolo Magic 2 WiFi next
	Edgecore ECW5410
	Edgecore OAP100
	Extreme Networks WS-AP3915i
	GL.iNet GL-A1300
	GL.iNet GL-AP1300
	GL.iNet GL-S1300
	Linksys EA8300
	Linksys WHW03v2
	Nokia Wi4A AC400i
	P&W R619AC
	Pakedge WR-1
	Qxwlan E2600AC C1
	Sony NCP-HG100/Cellular
	Teltonika RUTX10
	ZTE MF18A

were upstreamed to the ath10k-firmware repository
and landed in linux-firmware.git.

Furthermore the BDFs for the:
	8devices Habanero
	8devices Jalapeno
	Qxwlan E2600AC C2

have been updated.

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2023-05-18 16:17:52 +02:00
Christian Marangi
69812bf8ed
ipq-wifi: bump to latest git HEAD
b22487d ath11k: qcn8074: Update regDb in every BDF
3add8be ath11k: ipq8074: Update regDb in every BDF
8bb6039 ath11k: ipq8074: add Netgear RAX120v2

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-04-12 12:02:57 +02:00
Christian Marangi
42a5917786
ipq-wifi: bump to latest git HEAD
ccd7e46 ipq40xx: add support for Wallystech DR40x9
2ce60e1 Revert "ipq40xx: add support for Wallystech DR40x9"
ea962ca ipq40xx: add Emplus WAP551 BDF

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-03-27 18:15:13 +02:00
Robert Marko
eb564690c9 ipq40xx: add support for Wallystech DR40x9
Adds support for the Wallys DR40x9 series boards.
They come in IPQ4019 and IPQ4029 versions.
IPQ4019/4029 only differ in that that IPQ4029 is the industrial version that is rated to higher temperatures.

Specifications are:
* CPU: Qualcomm IPQ40x9 (4x ARMv7A Cortex A7) at 716 MHz
* RAM: 512 MB
* Storage: 2MB of SPI-NOR, 128 MB of parallel NAND
* USB 3.0 TypeA port for users
* MiniPCI-E with PCI-E 2.0 link
* MiniPCI-E for LTE modems with only USB2.0 link
* 2 SIM card slots that are selected via GPIO11
* MicroSD card slot
* Ethernet: 2x GBe with 24~48V passive POE
* SFP port (Does not work, I2C and GPIO's not connected on hardware)
* DC Jack
* UART header
* WLAN: In-SoC 2x2 802.11b/g/n and 2x2 802.11a/n/ac
* 4x MMCX connectors for WLAN
* Reset button
* 8x LED-s

Installation instructions:
Connect to UART, pins are like this:
-> 3.3V | TX | RX | GND

Settings are 115200 8n1

Boot initramfs from TFTP:
tftpboot 0x84000000 openwrt-ipq40xx-generic-wallys_dr40x9-initramfs-fit-uImage.itb

bootm

Then copy the sysupgrade image to the /tmp folder and execute sysupgrade -n <image_name>

The board file binary was provided from Wallystech on March 14th 2023
including full permission to use and distribute.

Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
2023-03-21 16:38:23 +01:00
Koen Vandeputte
7699a5b1d7 ipq-wifi: bump to latest git HEAD
f9cece0 ipq40xx: add support for Wallystech DR40x9

Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
2023-03-21 16:38:23 +01:00
Alexandru Gagniuc
7801161c4b ipq807x: add support for Netgear WAX218
Netgear WAX218 is a 802.11ax AP claiming AX3600 support. It is wall
or ceiling mountable. It can be powered via PoE, or a 12 V adapter.

The board has footprints for 2.54mm UART headers. They're difficult to
solder because the GND is connected to a large copper plane. Only try
soldering if you are very skilled. Otherwise, use pogo pins.

Specifications:
---------------
    * CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz
    * RAM: 366 MB of RAM available to OS, not sure of total amount
    * Storage: Macronix MX30UF2G18AC 256MB NAND
    * Ethernet:
            * 2.5G RJ45 port (QCA8081) with PoE input
    * WLAN:
            * 2.4GHz/5GHz with 8 antennas
    * LEDs:
            * Power (Amber)
            * LAN (Blue)
            * 2G WLAN (Blue)
            * 5G WLAN (Blue)
    * Buttons:
            * 1x Factory reset
    * Power: 12V DC Jack
    * UART: Two 4-pin unpopulated headers near the LEDs
            * "J2 UART" is the CPU UART, 3.3 V level

Installation:
=============

Web UI method
-------------

Flashing OpenWRT using the vendor's Web UI is problematic on this
device. The u-boot mechanism for communicating the active rootfs is
antiquated and unreliable. Instead of setting the kernel commandline,
it relies on patching the DTS partitions of the nand node. The way
partitions are patched is incompatible with newer kernels.

Newer kernels use the SMEM partition table, which puts "rootfs" on
mtd12. The vendor's Web UI will flash to either mtd12 or mtd14. One
reliable way to boot from mtd14 and avoid boot loops is to use an
initramfs image.

 1. In the factory web UI, navigate to System Manager -> Firmware.
 2. In the "Local Firmware Upgrade" section, click Browse
 3. Navigate and select the 'web-ui-factory.fit' image
 4. Click "Upload"
 5. On the following page, click on "Proceed"

The flash proceeds at this point and the system will reboot
automatically to OpenWRT.

 6. Flash the 'nand-sysupgrade.bin' using Luci or the commandline

SSH method
----------

Enable SSH using the CLI or Web UI. The root account is locked out to
ssh, and the admin account defaults to Netgear's CLI application.
So we need to get creative:

First, make sure the device boots from the second firmware partition:

    ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \
        /usr/sbin/fw_setenv active_fw 1

Then reboot the device, and run the update:

    scp -O -o kexalgorithms=diffie-hellman-group14-sha1 \
        -o hostkeyalgorithms=ssh-rsa \
        netgear_wax218-squashfs-nand-factory.ubi \
        admin@<ipaddr>:/tmp/openwrt.ubi

    ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \
        /usr/sbin/ubiformat /dev/mtd12 -f /tmp/openwrt.ubi

    ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \
        /usr/sbin/fw_setenv active_fw 0

Now reboot the device, and it should boot into a ready-to-use OpenWRT.

Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
Tested-by: Francisco G Luna <frangonlun@gmail.com>
2023-03-20 11:40:36 -05:00
Kristjan Krušič
cd47a58b73
ipq-wifi: bump to latest git HEAD
31ff96d ipq806x: add support for Nokia Airscale AC400i
1af1df2 ath11k: ipq8074: add Netgear WAX218

Signed-off-by: Kristjan Krušič <kristjan.krusic@krusic22.com>
2023-03-19 18:02:35 +01:00
Kristjan Krušič
f574b535eb
ipq806x: add support for Nokia Airscale AC400i
Hardware
--------

SoC:    Qualcomm IPQ8065
RAM:    512 MB DDR3
Flash:  256 MB NAND (Macronix MX30UF2G18AC) (split into 2x128MB)
        4 MB SPI-NOR (Macronix MX25U3235F)
WLAN:   Qualcomm Atheros QCA9984 - 2.4Ghz
        Qualcomm Atheros QCA9984 - 5Ghz
ETH:    eth0 - POE (100Mbps in U-Boot, 1000Mbps in OpenWrt)
        eth1 - (1000Mbps in both)
        Auto-negotiation broken on both.
USB:    USB 2.0
LED:    5G, 2.4G, ETH1, ETH2, CTRL, PWR (All support green and red)
BTN:    Reset
Other:  SD card slot (non-functional)
Serial: 115200bps, near the Ethernet transformers, labeled 9X.
        Connections from the arrow to the 9X text:
		[NC] - [TXD] - [GND] - [RXD] - [NC]

Installation
------------

0. Connect to the device
Plug your computer into LAN2 (1000Mbps connection required).
If you use the LAN1/POE port, set your computer to force a 100Mbps link.

Connect to the device via TTL (Serial) 115200n8.
Locate the header (or solder pads) labeled 9X,
near the Ethernet jacks/transformers.
There should be an arrow on the other side of the header marking.
The connections should go like this:
(from the arrow to the 9X text): NC - TXD - GND - RXD - NC

1. Prepare for installation
While the AP is powering up, interrupt the startup process.
MAKE SURE TO CHECK YOUR CURRENT PARTITION!

If you see: "Current Partition is : partB" or
"Need to switch partition from partA to partB",
you have to force the device into partA mode, before continuing.
This can be done by changing the PKRstCnt to 5 and resetting the device.

setenv PKRstCnt 5
saveenv
reset

After you interrupt the startup process again,
you should see: Need to switch partition from partB to partA

You can now continue to the next step.

If you see: "Current Partition is : partA",
you can continue to the next step.

2. Prevent partition switching.
To prevent the device from switching partitions,
we are going to modify the startup command.
set bootcmd "setenv PKRstCnt 0; saveenv; bootipq"
setenv

3. First boot
Now, we have to boot the OpenWrt intifs.
The easiest way to do this is by using Tiny PXE.
You can also use the normal U-Boot tftp method.

Run "bootp" this will get an IP from the DHCP server
and possibly the firmware image.
If it doesn't download the firmware image, run "tftpboot".

Now run "bootm" to run the image.

You might see:
"ERROR: new format image overwritten - must RESET the board to recover"
this means that the image you are trying to load is too big.
Use a smaller image for the initial boot.

4. Install OpenWrt from initfs
Once you are booted into OpenWrt,
transfer the OpenWrt upgrade image and
use sysupgrade to install OpenWrt to the device.

Signed-off-by: Kristjan Krušič <kristjan.krusic@krusic22.com>
2023-03-19 18:02:34 +01:00
Christian Marangi
2e72ee1b23
ipq-wifi: bump to latest git HEAD
86180c4 ath10k-firmware: IPQ4019 hw1.0:  Rename variant to ZTE MF18A specific BDF

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-03-18 12:46:33 +01:00
Christian Marangi
880b4811c2
ipq-wifi: bump to latest git HEAD
1f35a8c ath10k-firmware: IPQ4019 hw1.0:  Add variant to Teltonika RUTX10 specific BDF
a49672f ath10k-firmware: QCA99X0 hw2.0:  Add variant to ZTE MF18A specific BDF

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-03-18 12:06:13 +01:00
Mantas Pucka
93b7f0f0ed
ipq-wifi: bump to latest git HEAD and add 8devices boards
2dae618 ipq-wifi: update 8devices Jalapeno BDF
08e92db ipq-wifi: update 8devices Habanero BDF

Signed-off-by: Mantas Pucka <mantas@8devices.com>
[ split ipq40xx changes in separate commit ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-03-17 14:35:49 +01:00
Christian Marangi
f576762814
firmware: ipq-wifi: use project branch and drop local file
Source BDF files out of project dedicated repository and drop local file
from openwrt main repository.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-03-15 16:26:57 +01:00
INAGAKI Hiroshi
f490295bf2
ipq807x: add support for Buffalo WXR-5950AX12
Buffalo WXR-5950AX12 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on
IPQ8074A.

Specification:

- SoC         : Qualcomm IPQ8074A
- RAM         : DDR3 1024 MiB (2x Nanya NT5CC256M16ER-EK)
- Flash       : RAW NAND 256 MiB (Winbond W29N02GZBIBA)
- WLAN        : 2.4/5 GHz (IPQ8074A)
- Ethernet    : 5 ports
  - WAN       : 100/1000/2500/10000 Mbps x1 (AQR113C)
  - LAN       : 100/1000/2500/10000 Mbps x1 (AQR113C),
                10/100/1000 Mbps x3 (QCA8075)
- LED/Keys    : 8x/5x
- UART        : pin header on PCB (J7)
  - assignment: 3.3V, GND, TX, RX from disc marking
  - settings  : 115200n8
- Power       : 12 VDC, 4 A

Flash instruction using initramfs image:

1. Prepare TFTP server with IP address 192.168.11.10
2. Rename OpenWrt initramfs image to "WXR-5950AX12-initramfs.uImage and
   place it to TFTP directory
3. Hold AOSS (WPS) button and power on WXR-5950AX12
4. WXR-5950AX12 downloads initramfs image from TFTP server and boots
   with it automatically
5. Upload sysupgrade image to WXR-5950AX12 and perform sysupgrade
6. Wait ~120 seconds to complete flashing

Partition layout:

0x000000000000-0x000000100000 : "0:sbl1"
0x000000100000-0x000000200000 : "0:mibib"
0x000000200000-0x000000280000 : "0:bootconfig"
0x000000280000-0x000000300000 : "0:bootconfig1"
0x000000300000-0x000000600000 : "0:qsee"
0x000000600000-0x000000900000 : "0:qsee_1"
0x000000900000-0x000000980000 : "0:devcfg"
0x000000980000-0x000000a00000 : "0:devcfg_1"
0x000000a00000-0x000000a80000 : "0:apdp"
0x000000a80000-0x000000b00000 : "0:apdp_1"
0x000000b00000-0x000000b80000 : "0:rpm"
0x000000b80000-0x000000c00000 : "0:rpm_1"
0x000000c00000-0x000000c80000 : "0:cdt"
0x000000c80000-0x000000d00000 : "0:cdt_1"
0x000000d00000-0x000000d80000 : "0:appsblenv"
0x000000d80000-0x000000e80000 : "0:appsbl"
0x000000e80000-0x000000f80000 : "0:appsbl_1"
0x000000f80000-0x000001000000 : "0:art"
0x000001000000-0x000001080000 : "0:art_1"
0x000001080000-0x000001100000 : "0:orgdata"
0x000001100000-0x000001180000 : "0:orgdata_1"
0x000001180000-0x000005180000 : "rootfs"
0x000005180000-0x000009180000 : "rootfs_recover"
0x000009180000-0x000010000000 : "user_property"

Notes:

- WXR-5950AX12 has 2x OS images on NAND flash. The 1st image is for
  normal operation and the 2nd one is for recoverying or firmware
  upgrading on stock.

- Stock U-Boot checks MD5 hashes in "fw_hash" volume in each "root*"
  partition when booting. This is just a comparation of hash strings.

  Behaviors:

  - both "fw_hash" volumes exist, hashes are rootfs == rootfs_recover
    ---> boot from rootfs

  - both "fw_hash" volumes exist, hashes are rootfs != rootfs_recover
    ---> boot from rootfs_recover

    Note: this behavior is used for firmware upgrading on stock

  - "fw_hash" volume in rootfs is missing
    ---> boot from rootfs_recover

  - "fw_hash" volume in rootfs_recover is missing
    ---> boot from rootfs

  - "fw_hash" volumes in both root* partition are missing
    ---> boot from rootfs_recover

Reverting to stock firmware:

1. Decrypt official image by buffalo-enc and remove header

   example of decryption:

   $ buffalo-enc -i wxr_5950ax12_jp_305 -o wxr_5950ax12_jp_305.dec \
                 -d -k olaffuB -O 0xc8

   example of removing header (v3.05):

   - before

   $ hexdump -n 64 -v -C wxr_5950ax12_jp_305.dec
   00000000  57 58 52 2d 35 39 35 30  41 58 31 32 5f 33 2e 30  |WXR-5950AX12_3.0|
   00000010  35 5f 31 2e 30 31 5f 4a  50 5f 6a 70 5f 71 63 61  |5_1.01_JP_jp_qca|
   00000020  0a 66 69 6c 65 6c 65 6e  3d 34 35 33 35 30 39 31  |.filelen=4535091|
   00000030  32 0a 55 42 49 23 01 00  00 00 00 00 00 00 00 00  |2.UBI#..........|
   00000040

   - after

   $ hexdump -n 64 -v -C wxr_5950ax12_jp_305.ubi
   00000000  55 42 49 23 01 00 00 00  00 00 00 00 00 00 00 00  |UBI#............|
   00000010  00 00 08 00 00 00 10 00  78 cf c4 91 00 00 00 00  |........x.......|
   00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
   00000030  00 00 00 00 00 00 00 00  00 00 00 00 3d 2a 64 fd  |............=*d.|
   00000040

2. Boot WXR-5950AX12 with OpenWrt initramfs image

3. Upload modified stock image to WXR-5950AX12

4. Find partitions "rootfs" and "rootfs_recover"

   example:

   root@OpenWrt:/# cat /proc/mtd
   dev:    size   erasesize  name
   ...
   mtd22: 04000000 00020000 "rootfs"
   mtd23: 04000000 00020000 "rootfs_recover"
   ...

   in this case, "rootfs" is mtd22 and "rootfs_recover" is mtd23

5. Format "rootfs"/"rootfs_recover" partition with the uploaded image

   example:

   ubiformat /dev/mtd22 -f /tmp/wxr_5950ax12_jp_305.ubi
   ubiformat /dev/mtd23 -f /tmp/wxr_5950ax12_jp_305.ubi

6. Remove "rootfs"/"rootfs_data" volume from user_property partition

   example:

   . /lib/upgrade/nand.sh
   UBI=$(nand_attach_ubi user_property)
   ubirmvol /dev/$UBI -N rootfs
   ubirmvol /dev/$UBI -N rootfs_data

7. Reboot

MAC addresses:

LAN    : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text))
WAN    : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text))
2.4 GHz: 50:C4:DD:xx:xx:30 (0:APPSBLENV, wlan0addr (text))
5 GHz  : 50:C4:DD:xx:xx:38 (0:APPSBLENV, wlan1addr (text))

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
2023-02-12 01:18:39 +01:00
André Valentin
5dee596501
ipq807x: Add ZyXEL NBG7815
ZyXEL NBG7815 is a premium 802.11ax "tri"-band router/AP.
Specifications:
* CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz
* RAM: 1 GB 2x Nanya NT5CC256M16ER-EK
* Storage:
        * 8MB serial flash Winbond W25Q64DW
        * 4GB eMMC flash Kingston EMMC04G-M627
* Ethernet:
        * 4x1G RJ45 ports (QCA8074A) with 1x status LED per port
        * 1x2.5G RJ45 port (QCA8081) with 1x status LED
        * 1x10G RJ45 port (AQR113C) with 1x status LED
* Switch: Qualcomm Atheros QCA8075
* WLAN:
        * 2.4GHz: Qualcomm QCN5024 4x4@40MHz 802.11b/g/n/ax 1147 Mbps PHY rate
        * 2x 5GHz: Qualcomm QCN5054 4x4 802.11a/b/g/n/ac/ax 2402 PHY rate
* Bluetooth CSR8811 using HSUART, currently unsupported
* USB: 1x USB3.0 Type-A port
* LED-s currently not supported:
        * White
        * Dark Blu
        * Amber
        * Purple
        * Purple and dark blue
        * Red
* Buttons:
        * 1x Soft reset
* Power: 12V DC Jack

Installation instructions:
* Disconnect WAN
* Reset device to factory defaults by pushing reset button 15 sec,
  LEDs should lit orange color.
* After 5-10 minutes, when the LEDs turn constant dark blue,
  put your LAN cable and connect at address 192.168.123.1 by telnet on port 23
* Login with
  NBG7815 login: root
  password: nbg7815@2019
* cd /tmp/ApplicationData
* wget -O openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin http://...
* wget https://github.com/itorK/nbg7815_tools/blob/main/flash_to_openwrt.sh
* run flash_to_openwrt.sh
If you can't use wget, you can transfer the files via nc.
See https://openwrt.org/inbox/toh/zyxel/nbg7815_armor_g5 for installation details.

Bluetooth usage:
* you need at least package bluez-utils, recommended bluez-daemon
* run following commands to enable and start
  hciattach  /dev/ttyMSM1 bcsp
  hciconfig hci0 up

Many thanks to itorK for his work on this device:
https://github.com/itorK/openwrt/tree/nbg7815

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: André Valentin <avalentin@marcant.net>
2023-01-19 13:26:15 +01:00
Dirk Buchwalder
26c095cb4d ipq807x: add Dynalink DL-WRX36
Dynalink DL-WRX36 is a AX WIFI router with 4 1G and 1 2.5G ports.

Specifications:

    •     CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz
    •     RAM: 1024MB of DDR3
    •     Storage: 256MB Nand
    •     Ethernet: 4x 1G RJ45 ports (QCA8075) + 1 2.5G Port (QCA8081)
    •     WLAN:
          2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 1174 Mbps PHY rate
          5GHz: Qualcomm QCN5054 4x4 802.11a/b/g/n/ac/ax 2402 PHY rate
    •     1x USB 3.0

    •     1 gpio-controlled dual color led (blue/red)

            • Buttons: 1x soft reset / 1x WPS
            • Power: 12V DC jack

        A poulated serial header is onboard (J1004)
        the connector size is a 4-pin 2.0 mm JST PH.
        RX/TX is working, u-boot bootwait is active, secure boot is enabled.

        Notes:
	- Serial is completely deactivated in the stock firmware image.
	- This commit adds only single partition support, that means
	  sysupgrade is upgrading the current rootfs partition.
	- Installation can be done by serial connection or
	  SSH access on OEM firmware

	Installation Instructions:

	Most part of the installation is performed from an initramfs image
	running OpenWrt, and there are two options to boot it.

	Boot initramfs option 1: Using serial connection (3.3V)
	1. Stop auto boot to get to U-boot shell
	2. Transfer initramfs image to device
	   (openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb)
	   Tested using TFTP and a FAT-formatted USB flash drive.
	3. Boot the initramfs image
	   # bootm

	Boot initramfs option 2: From SSH access on OEM firmware
	1. Copy the initramfs image to a FAT-formatted flash drive
	   (tested on single-partition drive) and connect it to device USB port.
	2. Change boot command so it loads the initramfs image on next boot
	   Fallback to OEM firmware is provided.
	   # fw_setenv bootcmd 'usb start && fatload usb 0:1 0x44000000 openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb && bootm 0x44000000; bootipq'
	3. Reboot the device to boot the initramfs
	   # reboot

	Install OpenWrt from initramfs image:
	1. Use SCP (or other way) to transfer OpenWrt factory image
	2. Connect to device using SSH (on a LAN port)
	3. Check MTD partition table.
	   rootfs and rootfs_1 should be mtd18 and mtd20
	   depending on current OEM slot.
	   # cat /proc/mtd
	4. Do a ubiformat to both rootfs partitions:
	   # ubiformat /dev/mtd18 -y -f /path_to/factory_image
	   # ubiformat /dev/mtd20 -y -f /path_to/factory_image
	5. Set U-boot env variable: mtdids
	   # fw_setenv mtdids 'nand0=nand0'
	6. Get offset of mtd18 to determine current OEM slot
	   - If current OEM slot is 1, offset is 16777216  (0x1000000)
	   - If current OEM slot is 2, offset is 127926272 (0x7a00000)
	   # cat /sys/class/mtd/mtd18/offset
	7. Set U-boot env variable: mtdparts
	   If current OEM slot is 1, run:
	   # fw_setenv mtdparts 'mtdparts=nand0:0x6100000@0x1000000(fs),0x6100000@0x7a00000(fs_1)'
	   If current OEM slot is 2, run:
	   # fw_setenv mtdparts 'mtdparts=nand0:0x6100000@0x7a00000(fs),0x6100000@0x1000000(fs_1)'
	8. Set U-boot env variable: bootcmd
	   # fw_setenv bootcmd 'setenv bootargs console=ttyMSM0,115200n8 ubi.mtd=rootfs rootfstype=squashfs rootwait; ubi part fs; ubi read 0x44000000 kernel; bootm 0x44000000#config@rt5010w-d350-rev0'
	9. Reboot the device
	   # reboot

        Note: this PR adds only single partition support, that means sysupgrade is
              upgrading the current rootfs partition

Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
2023-01-16 12:42:23 +01:00
Matthew Hagan
6e03304c76 ipq807x: add Edgecore EAP102
The Edgecore EAP102 is a wall/ceiling mountable AP. The AP can be
powered by either PoE or AC adapter.

Device info:
 - IPQ8071-A SoC
 - 1GiB RAM
 - 256MiB NAND flash
 - 32MiB SPI NOR
 - 2 Ethernet ports
 - 1 Console port
 - 2GHz/5GHz AX WLAN
 - 2 USB 2.0 ports

Install instructions:

Prerequistes - TFTP server, preferrably within 192.168.1.0/24
	       Console cable plugged in (115200 8N1 no flow control)

1. Power on device and interrupt u-boot to obtain u-boot CLI

2. set serverip to IP address of the TFTP server:

	`setenv serverip 192.168.1.250`

3. Download image from TFTP server:

	`tftpboot 0x44000000 openwrt-ipq807x-generic-edgecore_eap102-squashfs-nand-factory.ubi`

4. Flash ubi image to both partitions and reset:

	`sf probe
	 imxtract 0x44000000 ubi
	 nand device 0
	 nand erase 0x0 0x3400000
	 nand erase 0x3c00000 0x3400000
	 nand write $fileaddr 0x0 $filesize
	 nand write $fileaddr 0x3c00000 $filesize
	 reset`

Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
2023-01-16 12:42:23 +01:00
Robert Marko
2ddb2057cd ipq807x: Add Xiaomi AX9000
Xiaomi AX9000 is a premium 802.11ax "tri"-band router/AP.
Specifications:
* CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz
* RAM: 1024MB of DDR3
* Storage: 256MB of parallel NAND
* Ethernet:
	* 4x1G RJ45 ports (QCA8075) with 1x status LED per port
	* 1x2.5G RJ45 port (QCA8081) with 1x status LED
* WLAN:
	* PCI based Qualcomm QCA9889 1x1 802.11ac Wawe 2 for IoT
	* 2.4GHz: Qualcomm QCN5024 4x4@40MHz 802.11b/g/n/ax 1147 Mbps PHY rate
	* 5.8GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402Mbps PHY rate
	* 5GHz: PCI based Qualcomm QCN9024 4x4@160MHz 802.11a/b/g/n/ac/ax 4804Mbps PHY rate
* USB: 1x USB3.0 Type-A port
* LED-s:
	* System (Blue and Yellow)
	* Network (Blue and Yellow)
	* RGB light bar on top in X shape
* Buttons:
	* 1x Power switch
	* 1x Soft reset
	* 1x Mesh button
* Power: 12V DC Jack

Installation instructions:

Obtaining SSH access is mandatory
https://openwrt.org/inbox/toh/xiaomi/ax9000#obtain_ssh_access

Installation is done by the ubiformat method, through SSH:
1. Open an SSH shell to the router
2. Copy the file openwrt-ipq807x-generic-xiaomi_ax9000-initramfs-factory.ubi to the /tmp directory
3. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1):
nvram get flag_boot_rootfs

4. Find the rootfs and rootfs_1 mtd indexes respectively:
cat /proc/mtd
Please confirm if mtd21 and mtd22 are the correct indexes from above!

5. Use the command ubiformat to flash the opposite mtd with UBI image:

If nvram get flag_boot_rootfs returned 0:
ubiformat /dev/mtd22 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit

otherwise:
ubiformat /dev/mtd21 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit

6. Reboot the device by:
reboot

Previous commands flashed an ubinized OpenWrt initramfs that will serve as the intermediate step
since OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for packages.
Continue in order to pernamently flash OpenWrt:

7. SSH into OpenWrt from one of the LAN ports
8. Copy the file openwrt-ipq807x-generic-xiaomi_ax9000-squashfs-sysupgrade.bin to the /tmp directory
9. Sysupgrade the device:
sysupgrade -n /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-squashfs-sysupgrade.bin

Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired.

Signed-off-by: Robert Marko <robimarko@gmail.com>
2023-01-16 12:42:23 +01:00
Dirk Buchwalder
bd17683261 ipq807x: add QNAP 301w
QNAP 301w is a AX WIFI router with 4 1G and 2 10G ports.

Specifications:

    •     CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz
    •     RAM: 1024MB of DDR3
    •     Storage: 4GB eMMC (contains kernel and rootfs) / 8MB NOR
          (contains art and u-boot-env)
    •     Ethernet: 4x 1G RJ45 ports + 2 10G ports (Aquantia AQR113C)
    •     WLAN:
          2.4GHz: Qualcomm QCN5024 4x4 (40 MHz) 802.11b/g/n/ax 1174 Mbps PHY rate
          5GHz: Qualcomm QCN5054 4x4 (80 MHz) or 2x2 (160 MHz) 802.11a/b/g/n/ac/ax 2402 PHY rate

    •     LEDs:
          7 x GPIO-controlled dual color LEDs + 2 GPIO-controlled single color LEDs

            • Buttons: 1x soft reset / 1x WPS
            • Power: 12V DC jack

        A poulated serial header is onboard.
        RX/TX is working, bootwait is active, secure boot is not enabled.

        SSH can be activated in the stock firmware, hold WPS button til the second beep
	(yes the router has a buzzer)
        SSH is available on port 22200, login with user admin and
	password "mac address of the router".

        Installation Instructions:

            • obtain serial access (https://openwrt.org/inbox/toh/qnap/301w#serial)
            • stop auto boot
            • setenv serverip 192.168.10.1
            • setenv ipaddr 192.168.10.10
            • tftpboot the initramfs image
              (openwrt-ipq807x-generic-qnap_301w-initramfs-fit-uImage.itb)
            • bootm

            • make sure that current_entry is set to "0":
              "fw_printenv -n current_entry" should be print "0". If not,
	       do "fw_setenv current_entry 0"
            • copy openwrt-ipq807x-generic-qnap_301w-squashfs-sysupgrade.bin
	          to the device to /tmp folder
            • sysupgrade -n /tmp/openwrt-ipq807x-generic-qnap_301w-squashfs-sysupgrade.bin
              this flashes openwrt to the first kernel and rootfs partition (mmcblk0p1 / mmcblk0p4)
            • reboot

        Note: this leaves the second kernel / rootfs parition untouched. So if you want
              to go back to stock, stop u-boot autoboot, "setenv current_entry 1" ,
	       "saveenv", "bootipq".
              Stock firmware should start from the second partition.
	      Then do a firmwareupgrade in the stock gui, that should overwrite the openwrt
	      in the first partitions

        Make 10G Aquantia phy's work:
              The aquantia phy's need a firmware to work. This can either be loaded
	      in linux with a userspace tool or in u-boot.

              I was not successfull to load the firmware in linux (aq-fw-download) but luckily there is
	      aq_load_fw available in u-boot. But first the right firmware needs to write
	      to the 0:ETHPHYFW mtd partition (it is empty on my device)

              Grab the ethphy firmware image from:
	      https://github.com/kirdesde/nbg7815_gpl/blob/master/target/linux/ipq/ipq807x_64/prebuilt_images/AQR_ethphyfw.mbn
	      and scp that to openwrt.

              Check the 0:ETHPHYFW partition number:
              cat /proc/mtd|grep "0:ETHPHYFW", should be mtd10.

              Backup the 0:ETHPHYFW partition:
              dd if=/dev/mtd10 of=/tmp/ethphyfw.backup, scp ethphyfw.backup to a save place.

              Write the new firmware image to the 0:ETHPHYFW partition:
              "mtd erase /dev/mtd10", "mtd -n write AQR_ethphyfw.mbn /dev/mtd10".

              Reboot to u-boot.

              Check if aq_load_fw is working:

              "aq_load_fw 0", that checks the firmware and if successfull,
	      loads iram and dram to one of the aquantia phy's.

              If that worked, add the aq_load_fw to the bootcmd:
              setenv bootcmd "aq_load_fw 0 && aq_load_fw 8 && bootipq"

              "saveenv"

              "reset"

              Board reboots and the firmware load to both phy's should start and
	      then openwrt boots.

              Check if the 10G ports work.

              Note: lan port labeled "10G-2" is configured as WAN port as per default.
	      All other port are in the br-lan. This can be changed in the network config.

Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
2023-01-16 12:42:23 +01:00
Dirk Buchwalder
a36fc589fe ipq807x: add Edimax CAX1800
Edimax CAX1800 is a 802.11 ax dual-band AP
with PoE. AP can be ceiling or wall mount.

Specifications:

    •     CPU: Qualcomm IPQ8070A Quad core Cortex-A53 1.4GHz
    •     RAM: 512MB of DDR3
    •     Storage: 128MB NAND (contains rootfs) / 8MB NOR (contains art and uboot-env)
    •     Ethernet: 1x 1G RJ45 port (QCA8072) PoE
    •     WLAN:
          2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate
          5GHz: Qualcomm QCN5054 2x2 802.11a/b/g/n/ac/ax 1201 PHY rate

    •     LEDs:
          3 x GPIO-controlled System-LEDs
          (form one virtual RGB System-LED)
            black_small_square  Buttons: 1x soft reset
            black_small_square  Power: 12V DC jack or PoE (802.3af )

        An unpopulated serial header is onboard.
        RX/TX is working, bootwait is active, secure boot is not enabled.

        SSH can be activated in the stock firmware, but it drops only
        to a limited shell .

        Installation Instructions:

            black_small_square obtain serial access
            black_small_square stop auto boot

            black_small_square tftpboot the initramfs image (serverip is set to 192.168.99.8 in uboot)
            black_small_square bootm

            black_small_square copy openwrt-ipq807x-generic-edimax_cax1800-squashfs-nand-factory.ubi
	      to the device
            black_small_square write the image to the NAND:
            black_small_square cat /proc/mtd and look for rootfs partition (should be mtd0)
            black_small_square ubiformat /dev/mtd0 -f -y  openwrt-ipq807x-generic-edimax_cax1800-squashfs-
              nand-factory.ubi
            black_small_square reboot

	Note: Device is not using dual partitioning (NAND contains other partitions
        with different manufacture data etc.)
	Draytek VigorAP 960C and Lancom LW-600 both look similar, but I haven't checked them.

Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
2023-01-16 12:42:23 +01:00
Zhijun You
8253cb2de5 ipq807x: add Redmi AX6
Redmi AX6 is a budget 802.11ax dual-band router/AP

Specifications:
* CPU: Qualcomm IPQ8071A Quad core Cortex-A53 1.4GHz
* RAM: 512MB of DDR3
* Storage: 128MB NAND
* Ethernet: 4x1G RJ45 ports (QCA8075)
* WLAN:
	* 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate
	* 5GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate
* LEDs:
	* System (Blue/Yellow)
	* Network (Blue/Yellow)
*Buttons: 1x soft reset
*Power: 12V DC jack

Installation instructions:

Obtaining SSH access is mandatory
https://openwrt.org/inbox/toh/xiaomi/xiaomi_redmi_ax6_ax3000#ssh_access

Installation is done by the ubiformat method, through SSH:
1. Open an SSH shell to the router
2. Copy the file openwrt-ipq807x-generic-redmi_ax6-initramfs-factory.ubi to the /tmp directory
3. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1):
nvram get flag_boot_rootfs

4. Find the rootfs and rootfs_1 mtd indexes respectively:
cat /proc/mtd
Please confirm if mtd12 and mtd13 are the correct indexes from above!

5. Use the command ubiformat to flash the opposite mtd with UBI image:

If nvram get flag_boot_rootfs returned 0:
ubiformat /dev/mtd13 -y -f /tmp/openwrt-ipq807x-generic-redmi_ax6-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit

otherwise:
ubiformat /dev/mtd12 -y -f /tmp/openwrt-ipq807x-generic-redmi_ax6-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit

6. Reboot the device by:
reboot

Previous commands flashed an ubinized OpenWrt initramfs that will serve as the intermediate step
since OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for packages.
Continue in order to pernamently flash OpenWrt:

7. SSH into OpenWrt from one of the LAN ports
8. Copy the file openwrt-ipq807x-generic-redmi_ax6-squashfs-sysupgrade.bin to the /tmp directory
9. Sysupgrade the device:
sysupgrade -n /tmp/openwrt-ipq807x-generic-redmi_ax6-squashfs-sysupgrade.bin

Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired.

Signed-off-by: Zhijun You <hujy652@gmail.com>
2023-01-16 12:42:23 +01:00
Robert Marko
8364f08164 ipq807x: add Xiaomi AX3600
Xiaomi AX3600 is a budget 802.11ax dual-band router/AP.
Specifications:
* CPU: Qualcomm IPQ8071A Quad core Cortex-A53 1.4GHz
* RAM: 512MB of DDR3
* Storage: 256MB of parallel NAND
* Ethernet: 4x1G RJ45 ports (QCA8075) with 1x status LED per port
* WLAN:
	* PCI based Qualcomm QCA9889 1x1 802.11ac Wawe 2 for IoT
	* 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate
	* 5GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate
* LED-s:
	* System (Blue and Yellow)
	* IoT (Blue)
	* Network (Blue and Yellow)
* Buttons: 1x Soft reset
* Power: 12V DC Jack

Installation instructions:

Obtaining SSH access is mandatory
https://openwrt.org/inbox/toh/xiaomi/xiaomi_ax3600#obtain_ssh_access

Installation is done by the ubiformat method, through SSH:
1. Open an SSH shell to the router
2. Copy the file openwrt-ipq807x-generic-xiaomi_ax3600-initramfs-factory.ubi to the /tmp directory
3. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1):
nvram get flag_boot_rootfs

4. Find the rootfs and rootfs_1 mtd indexes respectively:
cat /proc/mtd
Please confirm if mtd12 and mtd13 are the correct indexes from above!

5. Use the command ubiformat to flash the opposite mtd with UBI image:

If nvram get flag_boot_rootfs returned 0:
ubiformat /dev/mtd13 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax3600-initramfs-factory.ubi -s 2048 -O 2048 && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit

otherwise:
ubiformat /dev/mtd12 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax3600-initramfs-factory.ubi -s 2048 -O 2048 && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit

6. Reboot the device by:
reboot

Previous commands flashed an ubinized OpenWrt initramfs that will serve as the intermediate step
since OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for packages.
Continue in order to pernamently flash OpenWrt:

7. SSH into OpenWrt from one of the LAN ports
8. Copy the file openwrt-ipq807x-generic-xiaomi_ax3600-squashfs-sysupgrade.bin to the /tmp directory
9. Sysupgrade the device:
sysupgrade -n /tmp/openwrt-ipq807x-generic-xiaomi_ax3600-squashfs-sysupgrade.bin

Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Signed-off-by: Robert Marko <robimarko@gmail.com>
2023-01-16 12:42:23 +01:00
Vincent Tremblay
9e4ede8344 ipq40xx: add support for Linksys WHW03 V2
SOC:             Qualcomm IPQ4019
WiFi 1:          QCA4019 IEEE 802.11b/g/n
WiFi 2:          QCA4019 IEEE 802.11a/n/ac
WiFi 3:          QCA8888 IEEE 802.11a/n/ac
Bluetooth:       Qualcomm CSR8811 (A12U)
Zigbee:          Silicon Labs EM3581 NCP + Skyworks SE2432L
Ethernet:        Qualcomm Atheros QCA8072 (2-port)
Flash 1:         Mactronix MX30LF4G18AC-XKI
RAM (NAND):      SK hynix H5TC4G63CFR-PBA (512MB)
LED Controller:  NXP PCA9633 (I2C)
Buttons:         Single reset button (GPIO).

- The three WiFis were fully tested and are configured with the same settings as in the vendor firmware.
- The specific board files were submitted to the ATH10k mailing list but I'm still waiting for a reply. They can be removed once they are approved upstream.
- Two ethernet ports are accessible on the device. By default one is configured as WAN and the other one is LAN. They are fully working.

Bluetooth:
========
- Fully working with the following caveats:
  - RFKILL need to be enabled in the kernel.
  - An older version of bluez is needed as bccmd is needed to configure the chip.

Zigbee:
======
- The spidev device is available in the /dev directory.
- GPIOs are configured the same way as in the vendor firmware.
- Tests are on-going. I am working on getting access to the Silicon Labs stack to validate that it is fully working.

Installation:
=========
The squash-factory image can be installed via the Linksys Web UI:
1. Open "http://192.168.1.1/ca" (Change the IP with the IP of your device).
2. Login with your admin password.
3. To enter into the support mode, click on the "CA" link and the bottom of the page.
4. Open the "Connectivity" menu and upload the squash-factory image with the "Choose file" button.
5. Click start. Ignore all the prompts and warnings by click "yes" in all the popups.

The device uses a dual partition mechanism. The device automatically revert to the previous partition after 3 failed boot attempts.
If you want to force the previous firmware to load, you can turn off and then turn on the device for 2 seconds, 3 times in a row.

It can also be done via TFTP:
1. Setup a local TFTP server and configure its IP to 192.168.1.100.
2. Rename your image to "nodes_v2.img" and put it to the TFTP root of your server.
3. Connect to the device through the serial console.
4. Power on device and press enter when prompted to drop into U-Boot.
5. Flash the partition of your choice by typing "run flashimg" or "run flashimg2".
6. Once flashed, enter "reset" to reboot the device.

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Vincent Tremblay <vincent@vtremblay.dev>
2023-01-15 12:55:38 +01:00