Commit graph

94 commits

Author SHA1 Message Date
Mikhail Zhilkin
3a39f682df qualcommax: ipq50xx: add support for CMCC MR3000D-CI
CMCC MR3000D-CI is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on
IPQ5000.

Device specification
--------------------
- SoC			: Qualcomm IPQ5018
- RAM			: 512 MiB DDR3L
- Flash			: 128 MiB SPI-NAND (GigaDevice GD5F1GQ5REYIG)
- WLAN			: 2.4/5 GHz 2T2R
- 	2.4 GHz		: Qualcomm IPQ5018 (SoC)
- 	5 GHz		: Qualcomm Atheros QCN6102
- Ethernet		: 4x 10/100/1000 Mbps
- 	Switch		: Qualcomm Atheros QCA8337
- LEDs/Keys (GPIO)	: 2x LEDs, 2x Buttons
- UART			: Through-hole on PCB
- 	Voltage		: 3.3 V
- 	Assignment	: Silkscreened on PCB
- 	Settings	: 115200n8
- Power			: 12 VDC, 1.5 A

Installation
-----------------
1. Telnet method
    a. Enable telnet
    Log in to http://192.168.10.1/ with the password on the sticker
    Modify URL according to example (keep your unique hash after ";stok=")
    and press Enter:
    http://192.168.10.1/cgi-bin/luci/;stok=78becad1b1490e45be2776025cde2b7d/api/NPCnetwork/ping?url=$(telnetd)
    You should get the following in the browser:
    {"link":0}

    b. Run tftp server on IP 192.168.10.254 and put factory image
    'openwrt-qualcommax-ipq50xx-cmcc_mr3000d-ci-squashfs-factory.ubi'
    in the tftp root dir.

    c. Login to 192.168.10.1 with telnet (user: root, pass: from the
    sticker).

    d. Download factory image from the tftp:
    tftp -l factory.ubi -r openwrt-qualcommax-ipq50xx-cmcc_mr3000d-ci-squashfs-factory.ubi -g 192.168.10.254

    e. Flash factory image:
    export rootfs=$(cat /proc/mtd | grep rootfs | grep -v _ | cut -d: -f1)
    ubidetach -f -p /dev/${rootfs}
    ubiformat /dev/${rootfs} -y -f /tmp/factory.ubi

    f. Reboot:
    reboot

2. U-Boot Method using UBI Image (using UART)
    a. Place the factory.ubi file on your TFTP server, enter U-Boot CLI
    and exec these commands:
    tftpboot <your_tftp_server_ip>:factory.ubi
    flash rootfs
    reset

3. U-Boot Method using initramfs Image (using UART)
    a. Place the openwrt-*-initramfs-fit-uImage.itb file on your TFTP
    server and rename it to initramfs.bin

    b. Enable serial console, enter to U-Boot CLI and exec these commands:
    tftpboot <your_tftp_server_ip>:initramfs.bin
    bootm

    c. Once boot completed, upload the sysupgrade.bin file to router's
    /tmp directory (using scp or wget) and execute the following command
    in openwrt shell:
    sysupgrade -n /tmp/sysupgrade.bin

MAC Addresses
-------------
+--------------+-------------------+-------------+
| Interface    | MAC example       | Location    |
+--------------+-------------------+-------------+
| LAN          | 84:7a:xx:xx:xx:dd | 0:ART, 0x6  |
| WAN (label)  | 84:7a:xx:xx:xx:dc | 0:ART, 0x0  |
| WLAN 2.4 GHz | 84:7a:xx:xx:xx:de | 0:ART, 0xc  |
| WLAN 5       | 84:7a:xx:xx:xx:df | 0:ART, 0x12 |
+--------------+-------------------+-------------+

Notes
-----
1. U-Boot is protected by a password (pass: netpower).

Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21952
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-02-17 20:45:18 +01:00
Christian Marangi
a66e30631c
qualcommax: move Device DTS to dedicated DTS directory
Align the qualcommax target to the pattern already used on other devices where
the device DTS are placed in a dedicated directory separate from the files
directory.

This, while trying to enforce a common pattern for every target, also permits to
do modification to device DTS without having to trigger a recompilation of the
entire kernel (as the files directory is not touched)

Link: https://github.com/openwrt/openwrt/pull/22037
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2026-02-16 13:14:13 +01:00
Michael Lotz
785492e4c1 qualcommax: ipq807x: add Zyxel NWA110AX support
The Zyxel NWA110AX is a dual band 2x2:2 802.11ax wireless access point
with PoE.

The device is very similar to the NWA210AX except for being 2x2 instead
of 4x4 in the 5GHz band and not having the 2.5GbE ethernet port. This
commit factors out a common DTS and device definition and reuses it for
both devices.

Hardware:
* SoC: Qualcomm IPQ8070A
* RAM: 1GiB 1x Samsung K4A8G165WC-BCTD
* Flash: 8MiB Winbond W25Q64DW SPI-NOR, 256MiB Winbond W29N02GZ SPI-NAND
* WLAN 2.4GHz: QCN5024 2x2:2 802.11b/g/n/ax
* WLAN 5GHz: QCN5054 2x2:2 802.11n/ac/ax
* Ethernet: 1x 1GbE with AR8033 PHY
* Serial Config: 3.3V TTL 115200-8-N-1, externally accessible
* Serial Layout: GND TX RX 3.3V (don't connect, marked with triangle)
* LEDs: 1x red, 1x green, 1x blue, 1x white
* Buttons: 1x reset

MAC addresses:
* Uplink: base address on label
* 2.4GHz WLAN: base + 1
* 5GHZ WLAN: base + 2

Flashing Notes:
The device uses a dual-image setup and OpenWrt can only be installed as
image 0. When the currently running stock firmware is image 0, OpenWrt
will be installed as image 1, fail to boot and the device returns to stock
firmware. If this happens, install any version of stock firmware so that
it runs as image 1, before installing OpenWrt. Alternatively, if there
already is a valid stock firmware in image 1, the "debug dual-image show"
and "debug dual-image set boot-image image1" commands can be used in the
stock CLI via serial/SSH/telnet to switch to image 1.

Flashing with Stock Web Interface:
* Get the OpenWrt factory image and rename it to a shorter name, for
  example "openwrt.bin" (the stock firmware has a character limit)
* In the web interface, go to "Maintenance" -> "File Manager" ->
  "Firmware Package" (or click the link next to "Firmware Version" under
  "Device Information" on the dashboard)
* Under "Upload File" browse to the renamed OpenWrt factory image and
  click on "Upload"

Switch Boot Image:
* OpenWrt to stock: "zyxel-bootconfig-ipq807x set image1"
* Stock to OpenWrt: "debug dual-image set boot-image image0"

Unbrick / Revert to Stock with the Boot Module:
* Disconnect the device from power
* Configure your machine to 192.168.1.103/24 and start a TFTP server
* Put the stock firmware image into the TFTP server root and rename it to
  "ZLD-current"
* Establish a serial connection to the device through the console port
* Connect the device to power
* When prompted, press a key to abort automatic boot and enter debug mode
* Use the "atnz" command to flash the firmware image
* Use the "atgo" command to boot from the newly flashed image

Signed-off-by: Michael Lotz <mmlr@mlotz.ch>
Link: https://github.com/openwrt/openwrt/pull/21849
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-02-13 21:35:49 +01:00
Michael Lotz
67e6baf05e qualcommax: ipq60xx: add Netgear RBx350 support
Netgear RBx350 are dual band 4 stream 802.11ax mesh devices from the Orbi
series. The RBR350 is a router with a WAN and 3 LAN ports. The RBS350 is a
satellite without WAN port, only 2 LAN ports and half the flash. The
hardware is otherwise identical. They were sold in kits as RBK352, RBK353,
RBK354 or RBK355, with one router and 1-4 satellites.

Hardware:
* SoC: Qualcomm IPQ6018
* RAM: 512MiB 1x Nanya NT5CC256M16ER-EK
* Flash: 512MiB Winbond W29N04GZ or 256MiB Winbond W29N02GZ
* WLAN 2.4GHz: QCN5022 2x2:2 b/g/n/ax
* WLAN 5GHz: QCN5052 2x2:2 a/n/ac/ax
* Ethernet: QCA8075 switch with 1 WAN and 3 LAN ports or 2 LAN ports
* Serial Config: 3.3V TTL 115200-8-N-1, internal populated header
* Serial Layout: 3.3V (don't connect, marked with dot) RX TX GND
* LEDs: green/red power, white/red/green/blue status
* Buttons: 1x Reset, 1x WPS

MAC addresses:
* LAN1: base address on label, stored in boarddata partition at 0x8
* LAN2: base + 1
* LAN3: base + 2
* WAN: base + 3
* 2.4GHz WLAN: base + 1
* 5GHz WLAN: base + 2

Flashing Notes:
The stock firmware images are signed. Both the bootloader and the stock
web interface check the signature and will fail to boot/flash.
The bootloader automatically does NMRP when a gigabit LAN connection is
present. The stock and factory images contain a U-Boot script that is
executed when flashing using NMRP. This is used to alter and persist the
U-Boot env with a boot command that works with unsigned firmware.

Install OpenWrt:
* Get the nmrpflash utility [0] and OpenWrt factory image
* Find network interface to use: nmrpflash -L
* Start nmrpflash: nmrpflash -i interface -f openwrt-...-factory.img
* Connect the device LAN port closest to the power jack to the same
  network using gigabit
* Plug the device in and wait for the bootloader to flash
* Unplug and replug the device once the power LED blinks amber

Revert to Stock:
The boot command needs to be reverted before flashing the stock firmware,
otherwise it will fail to boot and get stuck in recovery mode (red power
LED flashing).

* Run: fw_setenv bootcmd bootipq
* Restart the device
* Flash the stock firmware RBx350-Va.b.c.d.img using nmrpflash

[0]: https://github.com/jclehner/nmrpflash

Signed-off-by: Michael Lotz <mmlr@mlotz.ch>
Link: https://github.com/openwrt/openwrt/pull/21656
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-02-13 21:32:15 +01:00
Michael Lotz
d0bd7ad1a2 qualcommax: ipq807x: add Netgear RBx750 support
Netgear RBx750 are tri band, 2.4GHz and 2x 5GHz, 8 stream 802.11ax mesh
devices from the Orbi series. The RBR750 is a router with a WAN and 3 LAN
ports. The RBS750 is a satellite without WAN port, only 2 LAN ports and
half the flash. The hardware is otherwise identical. They were sold in
kits as RBK752-RBK757, with one router and 1-6 satellites.

Hardware:
* SoC: Qualcomm IPQ8074
* RAM: 1GiB 1x Samsung
* Flash: 512MiB Winbond W29N04GZ or 256MiB Winbond W29N02GZ
* WLAN 2.4GHz: QCN5024 2x2:2 b/g/n/ax
* WLAN 5GHz Low Band: QCN5054 2x2:2 a/n/ac/ax 5180-5320MHz
* WLAN 5GHz High Band: QCN5054 4x4:4 a/n/ac/ax 5500-5700MHz
* Ethernet: QCA8075 switch with 1 WAN and 3 LAN ports or 2 LAN ports
* Serial Config: 3.3V TTL 115200-8-N-1, internal populated header
* Serial Layout: Bottom <- RX, TX, GND, 3.3V (don't connect) -> Top
* LEDs: green/red power, white/red/green/blue status
* Buttons: 1x Reset, 1x WPS

MAC addresses:
LAN1: base address on label
LAN2: base + 1
LAN3: base + 2
WAN: base + 1
2.4GHz: base + 2
5GHz-Low: base + 3
5GHz-High: base + 4

Flashing Notes:
The stock firmware images are signed. Both the bootloader and the stock
web interface check the signature and will fail to boot/flash.
The bootloader automatically does NMRP when a gigabit LAN connection is
present. The stock and factory images contain a U-Boot script that is
executed when flashing using NMRP. This is used to alter and persist the
U-Boot env with a boot command that works with unsigned firmware.

Install OpenWrt:
* Get the nmrpflash utility [0] and OpenWrt factory image
* Find network interface to use: nmrpflash -L
* Start nmrpflash: nmrpflash -i interface -f openwrt-...-factory.img
* Connect the device LAN port closest to the power jack to the same
  network using gigabit
* Plug the device in and wait for the bootloader to flash
* Unplug and replug the device once the power LED blinks amber

Revert to Stock:
The boot command needs to be reverted before flashing the stock firmware,
otherwise it will fail to boot and get stuck in recovery mode (red power
LED flashing).

* Run: fw_setenv bootcmd bootipq
* Restart the device
* Flash the stock firmware RBx750-Va.b.c.d.img using nmrpflash

[0]: https://github.com/jclehner/nmrpflash

Signed-off-by: Michael Lotz <mmlr@mlotz.ch>
Link: https://github.com/openwrt/openwrt/pull/21938
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-02-13 21:27:16 +01:00
Milan Krstic
ac8b5526bc qualcommax: ipq807x: add support for TCL LINKHUB HH500V
Some checks are pending
Build Kernel / Build all affected Kernels (push) Waiting to run
Build all core packages / Build all core packages for selected target (push) Waiting to run
TCL LINKHUB HH500V also known as Vodafone Gigacube B157 is a dual band
802.11ax 5G NR CPE with an FXS port.

Specifications:
* SoC: Qualcomm IPQ8072A
* RAM: 1024 MB
* NAND flash: 256MB NAND (MT29F2G08ABBGAH4)
* NOR flash: 64MB NOR (MX25U25635F) - only in some variants
* WiFi 5G: Qualcomm QCN5054
* WiFi 2.4G: Qualcomm QCN5024
* Ethernet 2.5G: Qualcomm QCA8081
* Ethernet 1G: Qualcomm QCA8075
* Modem: GosunCn GM800 (Qualcomm Snapdragon X55)
* SIM: 1 nano-SIM card slot
* Buttons: Power, Reset, WPS
* LEDs: Power (B/R), WiFi (B), 4G (B/Y/R), 5G (B/Y/R)
* VoIP: 1 FXS RJ11 port (not supported in OpenWrt)
* Power: 12V, 3A

UART serial console:

* 115200,8N1,1.8V
* Three unmarked test points next to QJ2012A:

 +---------+
 | QJ2012A |
 +---------+
 o TX
 o GND
 o RX
 o
 o
 o

Installation via OEM firmware:

* Use the following process to obtain root ssh access
https://forum.openwrt.org/t/150371/24
* Connect using root with no password on port 42000
* Optionally for serial bootloader access run :
fw_setenv bootdelay=3
* SCP factory.bin to /tmp
* Run:
sysupgrade -n /tmp/factory.bin

Installation via serial console and OEM firmware::

* Use console to access OEM firmware shell
* Proceed with SCP & sysupgrade as described above

Other notes:

* This device uses active partition rotation
* Some versions (TCL branded?) have a NOR chip in addition to NAND
* The above is supported by u-boot patching DT partitions
* DT patching does NOT occur on tftpboot/bootm
* Modem is detected as foxconn-sdx55 by kernel (same VID/PID)
* This works OK-ish and should be improved if we can get OEM modem details

Signed-off-by: Milan Krstic <milan.krstic@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19182
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-01-25 22:21:58 +01:00
John Christoforidis
428bcee2f8 qualcommax: ipq60xx: add support for TP-Link EAP620HD v3
Some checks are pending
Build Kernel / Build all affected Kernels (push) Waiting to run
Build all core packages / Build all core packages for selected target (push) Waiting to run
Specifications:
  * SoC: Qualcomm IPQ6018/AP-CP03-C1 (64-bit Quad-core Arm Cortex-A53 @ 1.2 GHz)
  * RAM: 2x Zentel A3T4GF40BBF-HP (1 GiB DDR3-1866 (13-13-13))
  * Serial Port: 1v8 TTL 115200n8
  * Wi-Fi: Qualcomm QCN5022 (802.11ax/b/g/n)
  * Wi-Fi: Qualcomm QCN5052 (802.11ac/ax/n)
  * Ethernet: RTL8211FS (10/100/1000BASE-T)
  * Flash: GigaDevice PSR1GA30DT (128 MiB)
  * LEDs: 1x Blue Status (GPIO 35 Active High)
  * Buttons: 1x Reset (GPIO 9 Active Low)
  * FCCID: 2AXJ4EAP620HDV3
  * UART: 4-pin unpopulated header by the J1 footprint

Installation Instructions (Serial+TFTP):
  1. Locate the J1 footprint which contains 4 unpopulated pins
  where starting from the arrow, the pins are TX, RX, VCC and GND
  respectively.
  2. Connect a 1v8 TTL port to the 4 pins. Ensure RX and TX are crossed
     over.
  3. Copy openwrt-qualcommax-ipq60xx-tplink_eap620-hd-v3-initramfs-uImage.itb
  to your TFTP server.
  4. Power up the AP and hold Ctrl+B in the serial console (115200n8) until autoboot is halted.
  5. Run the following commands in the U-boot prompt:
     IPQ6018# setenv serverip <TFTP server addr>
     IPQ6018# setenv ipaddr <addr of the AP>
     IPQ6018# tftpboot 0x44000000 openwrt-qualcommax-ipq60xx-tplink_eap620-hd-v3-initramfs-uImage.itb
     IPQ6018# bootm 0x44000000
     You may need to type Ctrl+C and Enter before running these commands
     to clear invisible characters from the buffer.
  6. Run the following command in a terminal to copy the sysupgrade image
     to be installed (check IP address):
     $ scp -O openwrt-qualcommax-ipq60xx-tplink_eap620-hd-v3-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
  7. Activate the OpenWrt serial console and run the following commands:
     # cd /tmp
     # sysupgrade -n openwrt-qualcommax-ipq60xx-tplink_eap620-hd-v3-squashfs-sysupgrade.bin
  8. The AP will reboot and OpenWrt will be successfully installed.

Installation Instructions (Web UI method):
  1. Set up the device using the vendor's web UI. Navigate to
     Management->SSH and enable the "SSH Login" checkbox. Select "Save".

  2. Connect to the machine via SSH:
     $ ssh -o hostkeyalgorithms=ssh-rsa <ip_of_device>

  3. Disable signature verification:
     $ cliclientd stopcs
  4. Rename the "-web-ui-factory" image to something less than 63
     characters, maintaining the ".bin" suffix.

  5. Go to System -> Firmware Update.
     Under "New Firmware File", click "Browse" and select the image.
     Select "Update" and confirm by clicking "OK".

  6. If the update fails, the web UI should show an error message.
     Otherwise, the device should reboot into OpenWrt.

Device support followed from EAP620HD v2 and eap6xx-outdoor for DTS.
Links: openwrt/openwrt#18227

Signed-off-by: John Christoforidis <github@yanny.dev>
Link: https://github.com/openwrt/openwrt/pull/21467
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-01-25 16:17:08 +01:00
Chukun Pan
1c582f7c73 qualcommax: ipq60xx: add JDCloud RE-CS-07 support
Specifications:
  SoC:     Qualcomm IPQ6010 1.8GHz
  RAM:     K4A8G165WC-BCTD x2 2GiB
  ETH:     QCA8075 (3x LAN, 1x WAN)
  Flash:   ICMAX 8GB eMMC
  Power:   DC 12V 2A
  USB:     1x 3.0
  Button:  Reset

Flash instructions:
  1. Download the initramfs image, rename it to
     initramfs.itb, host it with the tftp server.
  2. Enter "jdmt018R" to interrupt U-Boot
     when the following statement appears:
     "disabled console and autoboot in 2 seconds"
  3. Run these commands in U-Boot console:
     tftpboot initramfs.itb
     bootm
  4. After openwrt boots up, use scp or luci web
     to upload sysupgrade.bin to upgrade.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/19840
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-01-18 11:13:54 +01:00
Chukun Pan
53a8e7b2d4 qualcommax: ipq60xx: add JDCloud RE-CS-02 support
Specifications:
  SoC:     Qualcomm IPQ6010 1.8GHz
  RAM:     K4A4G165WF-BCTD x2 1GiB
  Flash:   FORESEE 128GB/256GB eMMC
  ETH:     4x 1Gbps + 1x 2.5Gbps
  WLAN1:   QCN5022 2.4GHz AX 2x2
  WLAN2:   QCN5052 5.8GHz AX 2x2
  WLAN2:   QCN9024 5.2GHz AX 4x4
  Button:  Reset, Screen, Wps
  Power:   DC 12V 3A
  USB:     1x 3.0

Flash instructions:
  1. Download the initramfs image, rename it to
     initramfs.itb, host it with the tftp server.
  2. If the stock firmware version is 4.3.0.r4211
     or higher, enter "jdmt018R" to interrupt
     U-Boot when the following statement appears:
     "disabled console and autoboot in 2 seconds"
  3. Run these commands in U-Boot console:
     tftpboot initramfs.itb
     bootm
  4. After openwrt boots up, use scp or luci web
     to upload sysupgrade.bin to upgrade.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/19840
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-01-18 11:13:54 +01:00
Chukun Pan
16422510b5 qualcommax: ipq60xx: add JDCloud RE-SS-01 support
Some checks are pending
Build Kernel / Build all affected Kernels (push) Waiting to run
Build all core packages / Build all core packages for selected target (push) Waiting to run
Specifications:
  SoC:     Qualcomm IPQ6000 1.2GHz
  RAM:     NT52CB256MB16DP 512MiB
  Flash:   FORESEE 64GB/128GB eMMC
  ETH:     QCA8075 (3x LAN, 1x WAN)
  WLAN1:   QCN5022 2.4GHz AX 2x2
  WLAN2:   QCN5052 5GHz AX 2x2
  Power:   DC 12V 2A
  Button:  Reset, Wps
  USB:     1x 3.0

Flash instructions:
  1. Download the initramfs image, rename it to
     initramfs.itb, host it with the tftp server.
  2. If the stock firmware version is 4.3.0.r4211
     or higher, enter "jdmt018R" to interrupt
     U-Boot when the following statement appears:
     "disabled console and autoboot in 2 seconds"
  3. Run these commands in U-Boot console:
     tftpboot initramfs.itb
     bootm
  4. After openwrt boots up, use scp or luci web
     to upload sysupgrade.bin to upgrade.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/19780
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-01-17 16:18:13 +01:00
Robert Marko
0ff1553bd7 ipq-wifi: rename BDF for EAP623-Outdoor HD v1
Some checks are pending
Build Kernel / Build all affected Kernels (push) Waiting to run
Build all core packages / Build all core packages for selected target (push) Waiting to run
BDF for EAP623-Outdoor HD v1 was renamed in the repo, but ipq-wifi
was not updated to reflect that, so do it now to fix broken wifi.

Fixes: #21432
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-01-08 11:18:23 +01:00
Robert Senderek
f948f71300 qualcommax: ipq50xx: Add support for Zyxel SCR50AXE
Some checks failed
Build Kernel / Build all affected Kernels (push) Has been cancelled
Build all core packages / Build all core packages for selected target (push) Has been cancelled
This is tri-band WiFi6E capable router. Also Zyxel Nebula managed so no real local GUI. To open device 4 screws must be located uder the label.
Four latches are on front and two on each side. Better start from ethernet port side where 3 small latches are easy to handle.
FCC shows It's identical to WSQ65 sold as Zyxel Multy M6E but that's nowhare to be found yet. WSQ65 is not covered by this PR

Speficiations:
* SoC: Qualcomm IPQ5018
* RAM: 1GB DDR3
* Flash: Winbond W25N02KWZEIR 256MB
* UART: PCB "J3"  is located left from front LED strip
              (VCC/TX/RX/     /GND)   3.3V 115200n8
* Wi-Fi1: IPQ5018 (2x2 2.4 Ghz 802.11b/g/n/ax)
* Wi-Fi2: QCN6102 (2x2:2 5 Ghz 802.11an/ac/ax)
* Wi-Fi3: QCN6122 (2x2:2 6 Ghz 802.11an/ac/ax)
* Ethernet: QCA8337 4xLAN 1Gbit / 1xWAN 1Gbit
* Buttons: WPS , Reset
* LEDs: 13 in total
   RGB power, RGB wan, RGB status (cloud), RGB wifi, Green wps
* FCCID: I8803891

*Flash Instructions starts with getting root:
connect uart to J3 connector next to the front LEDs
go to failsafe when this shows up in log:
"Press the [f] key and hit [enter] to enter failsafe mode"
execute:
mount_root
passwd -d root
reboot

logon as root:
look for 'Please press Enter to activate this console.'
login is root password is empty
execute:
fw_setenv DebugFlag=0x1
fw_setenv bootdelay=0x2
passwd -d root
backup ubi partition "rootfs" into safe space
reboot

*OpenWrt installation
stop uboot and execute:
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.10
tftpboot *-factory.ubi
flash rootfs
reset

or:
tftpboot *-initramfs-uImage.itb
bootm
use sysupgrade as usual

*restore OEM from backup
stop uboot and execute:
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.10
tftpboot *-initramfs-uImage.itb
bootm
transfer rootfs.bin backup and execute:
ubiformat /dev/mtd16 -y -f /tmp/rootfs.bin

Signed-off-by: Robert Senderek <robert.senderek@10g.pl>
Link: https://github.com/openwrt/openwrt/pull/21042
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-01-07 11:05:20 +01:00
George Moussalem
d992d95b52 qualcommax: ipq50xx: add support for Linksys MX6200
Linksys MX6200 is a triband Wi-Fi 6E wireless router.

Speficiations:
* SoC: Qualcomm IPQ5018 (64-bit dual-core ARM Cortex-A53 @ 1.0Ghz)
* Memory: Nanya NT5CC256M16ER-EK (512 MiB DDR3-933)
* Serial Port: 3v3 TTL 115200n8
* Wi-Fi: IPQ5018 (2x2 2.4 Ghz 802.11b/g/n/ax)
	 QCN6102 (2x2:2 5 Ghz 802.11an/ac/ax)
	 QCN6122 (2x2:2 6 Ghz 802.11an/ac/ax)
* Ethernet: IPQ5018 integrated virtual switch connected to:
	    - LAN Port: Internal IPQ5018 GE PHY
	    - WAN Port: Maxlinear Ethernet GPY115C PHY
* Flash: Macronix MX35UF2GE4AD (256 MiB)
* LEDs: 1x multi-color PWM LED
* Buttons: 1x WPS (GPIO 27 Active Low)
           1x Reset (GPIO 28 Acive Low)
* FCC ID: 2AYRA-08436

Flash instructions:
************************************************************************
NOTE: serial access is required! Although the web UI allows you to
install the Openwrt image, secure boot is enabled which will prevent
booting an unsigned image. The boot sequence must be adjusted in U-boot
to allow booting unsigned images.
************************************************************************

1. On OEM firmware, login to the web UI (typically @ http://192.168.1.1)
and click 'CA' in the bottom right corner.
Then click -> Connectivity -> Manual Upgrade.
Alternatively, browse to
http://<router IP>/fwupdate.html.
Upload openwrt-qualcommax-ipq50xx-linksys_mx6200-squashfs-factory.ubi.
Continue with step 5.
2. Installation on alternate partition using serial connection from OEM
firmware (default login: root, password: admin):
flash_erase /dev/mtd19 0 0
nandwrite -p /dev/mtd19 openwrt-qualcommax-ipq50xx-linksys_mx6200-squashfs-factory.ubi
reboot
Continue with step 5.
3. Installation using serial connection from initramfs
setup tftp server listening on IP in 192.168.1.0/24 (other than the
router IP 192.168.1.1). In U-boot, load the initramfs image to memory:
tftp $loadaddr <your IP>:openwrt-qualcommax-ipq50xx-linksys_mx6200-initramfs-uImage.itb
boot the image using command:
bootm $loadaddr
when fully booted, scp the sysupgrade image to your router IP (default:
192.168.1.1):
scp -O <path>/openwrt-qualcommax-ipq50xx-linksys_mx6200-squashfs-sysypgrade.bin root@192.168.1.1:/tmp/
use sysupgrade to flash the image to nand:
sysupgrade -n -v /tmp/openwrt-qualcommax-ipq50xx-linksys_mx6200-squashfs-sysupgrade.bin
Continue with step 5.
4. Optionally install on alternate partition. From Openwrt:
mtd -r -e rootfs_1 -n write openwrt-qualcommax-ipq50xx-linksys_mx6200-squashfs-factory.ubi rootfs_1
Continue with step 5.
5. Setup U-boot for ability to dual boot signed (stock) and non-signed
(Openwrt) images with auto-detection.
From U-boot, run (be aware: copy line by line):
setenv setnandbootargs 'setenv bootargs init=/sbin/init ubi.mtd=rootfs rootfstype=squashfs rootwait'
setenv nandinitcmd 'setenv mtdids nand0=nand0; run setrootfscmd; ubi part rootfs 2048'
setenv setrootfscmd 'if test $boot_part = 1; then setenv mtdparts mtdparts=nand0:0x${imgsize}@0x${prikern}(rootfs); else setenv mtdparts mtdparts=nand0:0x${imgsize}@0x${altkern}(rootfs); fi'
setenv readhdr1cmd 'ubi read $loadaddr kernel 0x40; setexpr IMGOFF $loadaddr + 0x10; setexpr CODEOFF $loadaddr + 0x14; setexpr SIGOFF $loadaddr + 0x1c; setexpr CERTOFF $loadaddr + 0x24'
setenv readhdr2cmd 'setexpr.l HDR *$loadaddr; setexpr.l IMGSZ *$IMGOFF; setexpr.l CODESZ *$CODEOFF; setexpr.l SIGSZ *$SIGOFF; setexpr.l CERTSZ *$CERTOFF; setexpr TSIZE $CODESZ + $SIGSZ; setexpr TSIZE $TSIZE + $CERTSZ'
setenv testmbncmd 'if test $HDR -ne edfe0dd0 -a $IMGSZ -eq $TSIZE; then bootipq; else ubi read $loadaddr kernel $kernsize; run setnandbootargs; bootm $loadaddr; fi'
setenv bootcmd2 'if test $auto_recovery = no; then bootipq; else run nandinitcmd; run readhdr1cmd; run readhdr2cmd; run testmbncmd; fi'
setenv bootcmd 'run bootcmd2'
saveenv
6. Back to the OEM firmware.
Download firmware from OEM website:
MX6200: https://support.linksys.com/kb/article/408-en/
From serial/SSH, in Openwrt, flash OEM firmware to alternate partition:
mtd -r -e rootfs_1 -n write FW_MX6200_1.0.11.216041_prod.signed.img rootfs_1

Switching active partition:
1. From U-boot, executive the following to switch to partition 1:
setenv boot_part 1
for partition 2:
setenv boot_part 2
2. From Openwrt:
fw_printenv boot_part
In case it's 1:
fw_setenv boot_part 2
. /lib/upgrade/platform.sh
linksys_bootconfig_set_primaryboot "0:bootconfig" 1
linksys_bootconfig_set_primaryboot "0:bootconfig1" 1
In case it's 2:
fw_setenv boot_part 1
. /lib/upgrade/platform.sh
linksys_bootconfig_set_primaryboot "0:bootconfig" 0
linksys_bootconfig_set_primaryboot "0:bootconfig1" 0
and
reboot

Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/21038
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-12-24 10:42:39 +01:00
Eric Schäfer
401c0a03f1 qualcommax: ipq807x: add support for Zyxel NWA210AX
Some checks are pending
Build Kernel / Build all affected Kernels (push) Waiting to run
Build all core packages / Build all core packages for selected target (push) Waiting to run
The Zyxel NWA210AX is a wall- and ceiling-mountable access point (AP).

Hardware specifications:
- SoC: Qualcomm IPQ8071A
- RAM: 1 GB (Samsung K4A8G165WC-BCTD)
- Flash: 8 MB (Winbond W25Q64DW), 256 MB (Winbond W29N02GZ)
- Ethernet: 1x 2.5 Gbps RJ45 port (QCA8081), 1x 1 Gbps RJ45 port (AR8033)
- WiFi: 2.4 GHz 802.11ax/b/g/n (QCN5024), 5 GHz 802.11 ac/ax/n (QCN5054)
- Power: DC 12V/PoE 802.3at
- Button: Reset
- LEDs: Multicolour red/green/blue/white via LP5562

Installation/flashing instructions:
1. In OEM web interface navigate to gear icon → System → SSH and enable SSH.
2. Log in via SSH (username/password are the same as for the web interface).
3. Run "debug dual-image show".
4. Verify that output is "Current Image num: 1".
5. If this is not the case (i.e. if the output is "Current Image num: 0"):
   a. Either flash a fresh version of factory firmware, or
   b. run "debug dual-image set boot-image image1" and then run "reboot".
6. Log in via SSH again and verify that output is "Current Image num: 1".
7. Rename "openwrt-qualcommax-ipq807x-zyxel_nwa210ax-squashfs-factory.bin" to
   "openwrt.bin" to avoid upload errors in the OEM web interface.
8. Reopen OEM web interface, navigate to wrench icon → File Manager →
   Firmware Package and upload the bin file. Once the upgrade process is
   finished and OpenWrt has booted, the LED will light up green.

Switching between OpenWrt and OEM firmware:
- OpenWrt → Zyxel via ssh command "zyxel-bootconfig-ipq807x set image1".
- Zyxel → OpenWrt via ssh command "debug dual-image set boot-image image0".

This commit is based on the work of Pascal Beleiu  <pascal@beleiu.de>:
93ca21f3 (qualcommax: ipq807x: add support for Zyxel NWA210AX, 2025-03-17)

Signed-off-by: Eric Schäfer <eric@es86.de>
Link: https://github.com/openwrt/openwrt/pull/19828
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-12-01 14:30:27 +01:00
George Moussalem
1f879b8839 qualcommax: ipq50xx: split firmware variants and refactor QCN6122 support
Some checks are pending
Build Kernel / Build all affected Kernels (push) Waiting to run
Build all core packages / Build all core packages for selected target (push) Waiting to run
IPQ5018 based boards come in multiple wireless architectures.
The SOC itself provides 2.4G wifi while 5G wifi is added by either an
IPQ5018-specific QCN6122 (2x2) solution or by the more generally
available PCIe-based QCN9074 (4x4) wifi chip.

On IPQ5018/QCN6122-based boards, both QCN6122 and IPQ5018 wifi is
initialized by IPQ5018 firmware which comes in different versions:
- IPQ5018: firmware files to initialize WCSS and the internal wifi chip
- IPQ5018/QCN6122: above + additional firmware segments to initialize
the QCN6122 chip incl. (de-)assertion of resets and clocks enablement

OpenWrt currently packages the combined IPQ5018/QCN6122 firmware for
both architectures. As such, let's switch to using IPQ5018-only firmware
for boards not packed with QCN6122 chip(s) and keep using the shared
firmware for devices that do have QCN6122(s) chips.
This helps us move to using upstreamed IPQ5018 firmware while using the
legacy repo for IPQ5018/QCN6122 firmware and rule out any initialization
conflicts/issues caused by loading QCN6122 on IPQ5018-only boards.

While at it, default to the secure WCSS remoteproc driver sent upstream
for review, move QCN6122 wifi nodes to a separate dtsi, override the Q6
node to load the multi-PD-based architecture remoteproc driver for
needed only by IPQ5018/QCN6122 designs, reference said dtsi in
boards packed with QCN6122 wifi chip(s), and add provision for migrating
the radio path as the wifi nodes now adhere to linux device tree naming
conventions.

Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/20928
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-11-28 10:27:53 +01:00
Chang Liu
5ab6e6011f qualcommax: ipq50xx: Add support for CMCC PZ-L8
Some checks failed
Build Kernel / Build all affected Kernels (push) Waiting to run
Build all core packages / Build all core packages for selected target (push) Has been cancelled
CMCC PZ-L8 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on IPQ5000.

Specifications:
- SoC			: Qualcomm IPQ5000
- RAM			: Integrated 256MiB DDR3L
- Flash			: 128 MiB SPI-NAND (ESMT F50D1G41LB)
- WLAN			: 2.4/5 GHz 2T2R
- 	2.4 GHz		: Qualcomm IPQ5000 (SoC)
- 	5 GHz		: Qualcomm Atheros QCN6102
- Ethernet		: 4x 10/100/1000 Mbps
- 	switch		: Qualcomm Atheros QCA8337
- LEDs/Keys (GPIO)	: 2x LEDs, 2x Keys
- UART			: Through-hole on PCB, 4pins in the middle of the black aluminum heat sink
- 	assignment	: 3.3V, GND,TX, RX (from left to right)
- 	settings	: 115200n8
- Power			: 12 VDC, 1 A

Flashing Instructions:
1. SSH Method
	(1) Enable SSH on the stock firmware
	a. Version 501.8 and 501.9:
	Log in to http://192.168.10.1 with the password on the sticker
	Append "/admin/system/admin" to the URL and press Enter
	Delete "Dropbear instance", click "Add instance", then "Save and Apply"
	Reboot the router

	b. Version 501.11 and 501.12:
	While the router is running the stock firmware, press and hold the reset button for 20-30 seconds
	Open http://192.168.10.1:56781 and login with username "root" and the password on the sticker
	Run "vi /etc/config/dropbear" and delete the line "option enable '0'"
	Reboot the router

	(2) Upload the factory.ubi file to router's /tmp directory (using scp or wget)
	and execute the following commands in the router's shell

	export rootfs=$(cat /proc/mtd | grep rootfs | grep -v _ | cut -d: -f1)
	ubidetach -f -p /dev/${rootfs}
	ubiformat /dev/${rootfs} -y -f /tmp/factory.ubi

2. U-Boot Method using UBI Image
	Place the factory.ubi file on your TFTP server, enter U-Boot CLI and exec these commands

	tftpboot <your_tftp_server_ip>:factory.ubi
	flash rootfs
	reset

3. U-Boot Method using initramfs Image
	(1) Place the openwrt-*-initramfs-fit-uImage.itb file on your TFTP server
	and rename it to initramfs.bin
	(2) Enable serial console, enter to U-Boot CLI and exec these commands

	tftpboot <your_tftp_server_ip>:initramfs.bin
	bootm

	(3) Once boot completed, upload the sysupgrade.bin file to router's /tmp directory
	(using scp or wget) and execute the following command in openwrt shell

	sysupgrade -n /tmp/sysupgrade.bin

Switching to the Stock Firmware:
Please follow the commit 3b7d72bc2e

Partition Layout (Stock Firmware):
0x000000000000-0x000000080000 : "0:SBL1"
0x000000080000-0x000000100000 : "0:MIBIB"
0x000000100000-0x000000140000 : "0:BOOTCONFIG"
0x000000140000-0x000000180000 : "0:BOOTCONFIG1"
0x000000180000-0x000000280000 : "0:QSEE"
0x000000280000-0x000000380000 : "0:QSEE_1"
0x000000380000-0x0000003c0000 : "0:DEVCFG"
0x0000003c0000-0x000000400000 : "0:DEVCFG_1"
0x000000400000-0x000000440000 : "0:CDT"
0x000000440000-0x000000480000 : "0:CDT_1"
0x000000480000-0x000000500000 : "0:APPSBLENV"
0x000000500000-0x000000640000 : "0:APPSBL"
0x000000640000-0x000000780000 : "0:APPSBL_1"
0x000000780000-0x000000880000 : "0:ART"
0x000000880000-0x000000900000 : "0:TRAINING"
0x000000900000-0x000004300000 : "rootfs"
0x000004300000-0x000007d00000 : "rootfs_1"

Notes:
This device is almost the same as ELECOM WRC-X3000GS2, including partition layout and the dual-boot feature.

Known Issues:
- All Wi-Fi related peripherals are disabled in device tree, since 256 MiB RAM is too few for ath11k.
- This device has another version with nand flash FM25SL01, which is not supported at the moment.
  https://github.com/immortalwrt/immortalwrt/blob/master/target/linux/mediatek/patches-6.12/342-mtd-spinand-Support-fmsh.patch

MAC Addresses:
Interface	MAC Address		Location (binary)
LAN		A4:39:B6:xx:xx:9D	(0:ART, 0x00-0x05)
WAN		A4:39:B6:xx:xx:9E	(0:ART, 0x06-0x0B)
2.4 GHz		A4:39:B6:xx:xx:9F	(0:ART, 0x0C-0x11)
5 GHz		A4:39:B6:xx:xx:A0	(0:ART, 0x12-0x17)

Signed-off-by: Chang Liu <jssqliuchang@gmail.com>
2025-11-12 14:34:07 +01:00
Eric Fahlgren
f5fd7ef888 targetwide: imagebuilder: add explicit guards around initramfs rules
Some checks are pending
Build Kernel / Build all affected Kernels (push) Waiting to run
Additional work building upon f6e0f57be0

Add more explict guards around the unsupported generation of the initramfs
images and suppress requirement for certain others.

Fixes: https://github.com/openwrt/openwrt/issues/20151
Fixes: https://github.com/openwrt/asu/issues/1499
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20460
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-10-21 11:38:18 +02:00
Eric Fahlgren
f6e0f57be0 targetwide: imagebuilder: add explicit guards around initramfs rules
Some checks are pending
Build Kernel / Build all affected Kernels (push) Waiting to run
The imagebuilder is not intended to build initramfs images.  Some
profiles attempt to do this and succeed, due to buildroot leaking
the initramfs-kernel into staging_dir; others attempt it, but fail
due to not having initramfs binaries present in the imagebuilder.

Fix this by adding an explict guard around the unsupported generation
of the initramfs images.  This saves space and time during imagebuilder
runs, fixes those that are currently broken and protects against future
breakage for profiles that inadvertently work now.

Fixes: https://github.com/openwrt/openwrt/issues/20151
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20347
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-10-17 10:51:37 +02:00
Shubham Vishwakarma
5d2994a73e qualcommax: ipq50xx: Add support for Yuncore AX850
Specifications:
SOC: Qualcomm IPQ5018 (64-bit dual-core ARM Cortex-A53 @ 1.0Ghz)
Flash: SPI NOR 8MB (Winbond W25Q64DW) + NAND 128MB (Winbond W25N01GWZEIG)
Memory: 512MB DDR3L
Standard: 802.11ax/ac/b/g/n
2.4G Frequency: 2.4GHz - 2.484GHz
2.4G Wi-Fi standard: 802.11b/g/n/ax
5G Frequency: 5.150GHz~5.850GHz
5G Wi-Fi Standard: 802.11 a/n/ac/ax
Buttons: 1 * Reset button, press 10 seconds to revert to default setting
2.4G Antenna: 2*2.4GHz/5.8GHz dual band antenna: 4dBi
5G Antenna: 2*5.8G antenna: 4dBi
Data Rate: 2.4GHz: 574Mbps, 5GHz:4800Mbps
Power: PoE 802.3at,DC2.0 12V/2A
Max Power Consumption: < 22W
LED Light: WAN, LAN, tricolor LED(sys-red, 2.4G-green, 5.8G-blue)

BACKUP YOUR STOCK FIRMWARE:
- Put openwrt-*-initramfs-uImage.itb to your
  TFTP server and rename it to initramfs.bin
- Enable serial console and enter to u-boot cli
  and exec these commands:
    ```
    tftpboot <your_tftp_server_ip>:initramfs.bin
    bootm
    ```
- Once boot completed and you get the openwrt shell
  execute below commands:
    ```
    device=ax850
    mkdir -p /tmp/fw_backup; cd /tmp/fw_backup
    rootfs=$(cat /proc/mtd | grep \"rootfs\" | cut -d: -f1)
    rootfs_1=$(cat /proc/mtd | grep \"rootfs_1\" | cut -d: -f1)
    dd if=/dev/${rootfs} of=rootfs_${rootfs} bs=1M
    dd if=/dev/${rootfs_1} of=rootfs_1_${rootfs_1} bs=1M
    cp /sys/firmware/fdt fdt.dtb
    md5sum * > md5sum
    tar -cvzf /tmp/${device}.tar.gz .
    sum=$(md5sum /tmp/${device}.tar.gz | cut -d' ' -f1)
    mv /tmp/${device}.tar.gz /tmp/${device}_${sum}.tar.gz
    echo "stock fw backup saved to: /tmp/${device}_${sum}.tar.gz"
    ```
- Upload/save your backup to a safe place.

STOCK FIRMWARE RECOVERY:
- Boot initramfs image
- Upload your backed-up stock fw tarball to the device
  using scp or download it from the device using wget.
- Enter device ssh cli or tty and exec:
    ```
    cd /tmp && wget <your_web_server_ip>/${stock_fw_backup}.tar.gz`
    tar -xpzf ${stock_fw_backup}.tar.gz
    rootfs=$(cat /proc/mtd | grep \"rootfs\" | cut -d: -f1)
    rootfs_1=$(cat /proc/mtd | grep \"rootfs_1\" | cut -d: -f1)
    ubiformat /dev/${rootfs} -y -f /tmp/rootfs_${rootfs}
    ubiformat /dev/${rootfs_1} -y -f /tmp/rootfs_1_${rootfs_1}
    reboot
    ```

INSTALLATION:
1. initramfs method
- Put openwrt-*-initramfs-uImage.itb to your
  TFTP server and rename it to initramfs.bin
- Enable serial console and enter to u-boot cli
  and exec these commands:
    ```
    tftpboot <your_tftp_server_ip>:initramfs.bin
    bootm
    ```
- Once boot completed and you get the openwrt shell
  execute below commands:
    ```
    cd /tmp && wget <your_web_server_ip>/factory.ubi`
    export rootfs=$(cat /proc/mtd | grep rootfs | cut -d: -f1)
    export rootfs_1=$(cat /proc/mtd | grep rootfs_1 | cut -d: -f1)
    ubiformat /dev/${rootfs} -y -f factory.ubi
    ubiformat /dev/${rootfs_1} -y -f factory.ubi
    reboot
    ```

2. u-boot factory.ubi image method
- Put factory.ubi to your TFTP server and
  enter u-boot cli and exec these commands:
    ```
    tftpboot <your_tftp_server_ip>:factory.ubi
    #After downloading is finished:
    flash rootfs
    flash rootfs_1
    reset
    ```

Signed-off-by: Shubham Vishwakarma <shubhamvis98@fossfrog.in>
Link: https://github.com/openwrt/openwrt/pull/19712
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-10-09 13:36:37 +02:00
Shubham Vishwakarma
52e339b8ed qualcommax: ipq50xx: Add support for Yuncore AX830
Some checks failed
Build Kernel / Build all affected Kernels (push) Has been cancelled
Build all core packages / Build all core packages for selected target (push) Has been cancelled
Specifications:
SOC: Qualcomm IPQ5018 (64-bit dual-core ARM Cortex-A53 @ 1.0Ghz)
Memory: 512MB DDR3L
Standard: 802.11ax/ac/b/g/n
Flash: SPI NOR 8MB (Winbond W25Q64DW) + NAND 128MB (Winbond W25N01GWZEIG)
2.4G Frequency: 2.4GHz - 2.484GHz
2.4G Wi-Fi standard: 802.11b/g/n/ax
5.8G Frequency: 4.9~5.9G
5.8G Wi-Fi Standard: 802.11 a/n/ac/ax
Interface:
  Optional 1(Without 8081):
    1 * 10/100 /1000Mbps RJ45 WAN Port and PoE port;
    1* Gigabit Console port;
  Optional 2(With 8081):
    1 * 10/100/1000/2500Mbps RJ45 WAN port and PoE port,
    1*10/100/1000Mbps LAN port
Buttons: 1 * Reset button, press 10 seconds to revert to default setting
Antenna: Build in 4*4dBi dual band MIMO Antenna
Data Rate: 3000Mbps (2.4G 600Mbps, 5.8G 2400Mbps)
End Users: 128+
2.4G RF Power: ≤ 23dBm
5.8G RF Power: ≤ 23dBm
DC: 12V----2A
PoE: 48V (IEEE 802.3at)
LED Light: Sys, WAN, LAN
Power Consumption: ≤ 20W

BACKUP YOUR STOCK FIRMWARE:
- Put openwrt-*-initramfs-uImage.itb to your
  TFTP server and rename it to initramfs.bin
- Enable serial console and enter to u-boot cli
  and exec these commands:
    ```
    tftpboot <your_tftp_server_ip>:initramfs.bin
    bootm
    ```
- Once boot completed and you get the openwrt shell
  execute below commands:
    ```
    device=ax830
    mkdir -p /tmp/fw_backup; cd /tmp/fw_backup
    rootfs=$(cat /proc/mtd | grep \"rootfs\" | cut -d: -f1)
    rootfs_1=$(cat /proc/mtd | grep \"rootfs_1\" | cut -d: -f1)
    dd if=/dev/${rootfs} of=rootfs_${rootfs} bs=1M
    dd if=/dev/${rootfs_1} of=rootfs_1_${rootfs_1} bs=1M
    cp /sys/firmware/fdt fdt.dtb
    md5sum * > md5sum
    tar -cvzf /tmp/${device}.tar.gz .
    sum=$(md5sum /tmp/${device}.tar.gz | cut -d' ' -f1)
    mv /tmp/${device}.tar.gz /tmp/${device}_${sum}.tar.gz
    echo "stock fw backup saved to: /tmp/${device}_${sum}.tar.gz"
    ```
- Upload/save your backup to a safe place.

STOCK FIRMWARE RECOVERY:
- Boot initramfs image
- Upload your backed-up stock fw tarball to the device
  using scp or download it from the device using wget.
- Enter device ssh cli or tty and exec:
    ```
    cd /tmp && wget <your_web_server_ip>/${stock_fw_backup}.tar.gz`
    tar -xpzf ${stock_fw_backup}.tar.gz
    rootfs=$(cat /proc/mtd | grep \"rootfs\" | cut -d: -f1)
    rootfs_1=$(cat /proc/mtd | grep \"rootfs_1\" | cut -d: -f1)
    ubiformat /dev/${rootfs} -y -f /tmp/rootfs_${rootfs}
    ubiformat /dev/${rootfs_1} -y -f /tmp/rootfs_1_${rootfs_1}
    reboot
    ```

INSTALLATION:
1. initramfs method
- Put openwrt-*-initramfs-uImage.itb to your
  TFTP server and rename it to initramfs.bin
- Enable serial console and enter to u-boot cli
  and exec these commands:
    ```
    tftpboot <your_tftp_server_ip>:initramfs.bin
    bootm
    ```
- Once boot completed and you get the openwrt shell
  execute below commands:
    ```
    cd /tmp && wget <your_web_server_ip>/factory.ubi`
    export rootfs=$(cat /proc/mtd | grep rootfs | cut -d: -f1)
    export rootfs_1=$(cat /proc/mtd | grep rootfs_1 | cut -d: -f1)
    ubiformat /dev/${rootfs} -y -f factory.ubi
    ubiformat /dev/${rootfs_1} -y -f factory.ubi
    reboot
    ```

2. u-boot factory.ubi image method
- Put factory.ubi to your TFTP server and
  enter u-boot cli and exec these commands:
    ```
    tftpboot <your_tftp_server_ip>:factory.ubi
    #After downloading is finished:
    flash rootfs
    flash rootfs_1
    reset
    ```

Signed-off-by: Shubham Vishwakarma <shubhamvis98@fossfrog.in>
Link: https://github.com/openwrt/openwrt/pull/18968
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-06-30 14:04:31 +02:00
George Moussalem
d7f9e240c2 qualcommax: ipq50xx: Add support for Xiaomi AX6000
Some checks are pending
Build Kernel / Build all affected Kernels (push) Waiting to run
Build all core packages / Build all core packages for selected target (push) Waiting to run
Add support for Xiaomi AX6000.

Speficiations:
* SoC: Qualcomm IPQ5018 (64-bit dual-core ARM Cortex-A53 @ 1.0Ghz)
* Memory: Etrontech EM6HE16EWAKG 512 MiB DDR3L-933
* Serial Port: 1v8 TTL 115200n8
* Wi-Fi: IPQ5018 (2x2 2.4 Ghz 802.11b/g/n/ax - up to 574 Mbps)
	 QCN9024 (4x4 5 Ghz 802.11an/ac/ax - up to 4804 Mbps)
 	 QCA9887 (1x1 5 Ghz 802.11ac/n - up to 433 Mbps)
* Ethernet: IPQ5018 integrated virtual switch connected to:
	- external QCA8337 switch   (3 LAN Ports 10/100/1000)
	- QCA8081 Phy WAN port  (10/100/1000/2500)
* Flash: Either of:
	- Gigadevice GD5F1GQ4RE9IGD (128 MiB)
	- ESMT F50D1G41LB (128 MiB)
* LEDs: 1x WLAN Link (GPIO 23 Active High)
	1x System Blue   (GPIO 24 Active High)
	1x System Yellow (GPIO 25 Active High)
	1x WAN Link Blue (GPIO 26 Active High)
	1x WAN Link Yellow   (GPIO 27 Active High)
	1x Green - Unused(GPIO 28 Active High)
	3x LAN Phy Green
	1x WAN Phy Green
* Buttons: 1x Reset  (GPIO 38 Active Low)

Known issue:
- QCA9887 doesn't come up (possibly due to 1-lane PCIe phy not coming up or missing method to drive power),
  hence the host PCIe controller is disabled in the DTS.

Flash instructions:

Download XMIR Patcher: https://github.com/openwrt-xiaomi/xmir-patcher

First flash a ubinized OpenWrt initramfs that will serve as the intermediate step, since
OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for
packages, through either of the below two methods:

Installation via XMIR Patcher:

1. Load the initramfs image: openwrt-qualcommax-ipq50xx-xiaomi_ax6000-initramfs-factory.ubi

Installation via ubiformat method, through SSH:

1. If needed, enable SSH using XMIR Patcher.
2. Copy the file openwrt-qualcommax-ipq50xx-xiaomi_ax6000-initramfs-factory.ubi to the /tmp directory
3. Open an SSH shell to the router
4. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1):
nvram get flag_boot_rootfs
5. Find the rootfs and rootfs_1 mtd indexes respectively:
cat /proc/mtd
Please confirm if mtd18 and mtd19 are the correct indexes from above!
6. Use the command ubiformat to flash the opposite mtd with UBI image:
If nvram get flag_boot_rootfs returned 0:
ubiformat /dev/mtd19 -y -f /tmp/openwrt-qualcommax-ipq50xx-xiaomi_ax6000-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit
otherwise:
ubiformat /dev/mtd18 -y -f /tmp/openwrt-qualcommax-ipq50xx-xiaomi_ax6000-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit
7. Reboot the device by:
reboot

Continue in order to pernamently flash OpenWrt:
1. Upload the sysupgrade image to /tmp/ using SCP:
scp -O <path to image> root@192.168.1.1:/tmp/
2. Open an SSH shell to 192.168.1.1 from a PC within the same subnet
3. Use sysupgrade to flash the sysupgrade image:
sysupgrade -n -v /tmp/openwrt-qualcommax-ipq50xx-xiaomi_ax6000-squashfs-sysupgrade.bin

Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired.

Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/19004
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-06-13 12:02:39 +02:00
INAGAKI Hiroshi
0cbdab5038 qualcommax: add support for I-O DATA WN-DAX3000GR
I-O DATA WN-DAX3000GR is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based
on IPQ5018.

Specification:

- SoC             : Qualcomm IPQ5018
- RAM             : DDR3 512 MiB
- Flash           : SPI-NAND 128 MiB (Macronix MX35UF1G24AD-Z4I)
- WLAN            : 2.4/5 GHz 2T2R
  - 2.4 GHz       : Qualcomm IPQ5018 (SoC)
  - 5 GHz         : Qualcomm Atheros QCN6102
- Ethernet        : 5x 10/100/1000 Mbps
  - wan (phy)     : Qualcomm IPQ5018 (SoC)
  - lan (switch)  : Qualcomm Atheros QCA8337
- LEDs/Keys (GPIO): 7x/5x
- UART            : through-hole on PCB (J3)
  - assignment    : 3.3V, TX, RX, NC, GND from tri-angle marking
  - settings      : 115200n8
- USB             : USB 2.0 Type-A (through-hole on PCB, "J6")
- Power           : 12 VDC, 1A (Typ. 930 mA)

Flash instruction using factory.bin image:

1. Boot WN-DAX3000GR with router mode
2. Access to the WebUI ("http://192.168.0.1/") on the device and open
   the firmware update page ("ファームウェア")
3. Select the OpenWrt factory.bin image and click update ("更新") button
4. Wait ~120 seconds to complete flashing

Switching to the stock firmware:

1. Load the elecom.sh script

   . /lib/upgrade/elecom.sh

2. Check the current index of rootfs

   bootconfig_rw_index 0:bootconfig rootfs

3. Set the index to inverted value

   bootconfig_rw_index 0:bootconfig rootfs <value>
   bootconfig_rw_index 0:bootconfig1 rootfs <value>

   example:

   - step2 returned "0":

     bootconfig_rw_index 0:bootconfig rootfs 1
     bootconfig_rw_index 0:bootconfig1 rootfs 1

   - step2 returned "1":

     bootconfig_rw_index 0:bootconfig rootfs 0
     bootconfig_rw_index 0:bootconfig1 rootfs 0

4. Reboot

Partition Layout (Stock FW, bootconfig(rootfs)=1):

0x000000000000-0x000000080000 : "0:SBL1"
0x000000080000-0x000000100000 : "0:MIBIB"
0x000000100000-0x000000140000 : "0:BOOTCONFIG"
0x000000140000-0x000000180000 : "0:BOOTCONFIG1"
0x000000180000-0x000000280000 : "0:QSEE"
0x000000280000-0x000000380000 : "0:QSEE_1"
0x000000380000-0x0000003c0000 : "0:DEVCFG"
0x0000003c0000-0x000000400000 : "0:DEVCFG_1"
0x000000400000-0x000000440000 : "0:CDT"
0x000000440000-0x000000480000 : "0:CDT_1"
0x000000480000-0x000000500000 : "0:APPSBLENV"
0x000000500000-0x000000640000 : "0:APPSBL"
0x000000640000-0x000000780000 : "0:APPSBL_1"
0x000000780000-0x000000880000 : "0:ART"
0x000000880000-0x000000900000 : "0:TRAINING"
0x000000900000-0x000003c40000 : "rootfs_1"
0x000003c40000-0x000003fc0000 : "Config"
0x000003fc0000-0x000007300000 : "rootfs"
0x000007300000-0x000007680000 : "Config_2"
0x000007680000-0x000007700000 : "idmkey"
0x000007700000-0x000007c00000 : "Reserved"
0x000007c00000-0x000007c80000 : "FWHEADER"
0x000007c80000-0x000007d00000 : "Factory"

Known Issues:

- This device has a Macronix MX35UF1G24AD SPI-NAND chip registered as
  oobsize=128 in Linux Kernel. But using BCH8 breaks I/O on the chip
  with the following errors, so this support uses BCH4 instead.

  [    1.542261] 0x000000480000-0x000000500000 : "0:appsblenv"
  [    1.547959] 1 fixed-partitions partitions found on MTD device 0:appsblenv
  [    1.551265] Creating 1 MTD partitions on "0:appsblenv":
  [    1.558096] 0x000000000000-0x000000040000 : "env-data"
  [    1.627282] u-boot-env-layout 79b0000.qpic-nand:flash@0:partitions:partition-0-appsblenv:partition@0:nvmem-layout: probe with driver u-boot-env-layout failed with error -74

  root@OpenWrt:~# strings /dev/mtdblock10
  [   77.806720] mtdblock: MTD device '0:appsblenv' is NAND, please consider using UBI block devices instead.
  [   77.807554] I/O error, dev mtdblock10, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 4 prio class 0
  [   77.815977] I/O error, dev mtdblock10, sector 8 op 0x0:(READ) flags 0x80700 phys_seg 3 prio class 0
  [   77.824721] I/O error, dev mtdblock10, sector 16 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 0
  [   77.834095] I/O error, dev mtdblock10, sector 24 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0
  [   77.843278] I/O error, dev mtdblock10, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
  [   77.851577] Buffer I/O error on dev mtdblock10, logical block 0, async page read

Notes:

- This device has dual-boot feature and it's managed by the index in the
  0:bootconfig and 0:bootconfig1 partitions.

- There are through-holes on PCB for USB 2.0, but it cannot be accessed
  without disassembly of the housing. So it's not enabled in this
  support.

- WN-DAX3000GR has the "bt_fw" volume in the firmware UBI in addition to
  the volumes that will be removed in the section of ELECOM WRC-X3000GS2
  in /lib/upgrade/platform.sh.
  That volume is unnecessary for OpenWrt and add
  `remove_oem_ubi_volume bt_fw` to remove that volume when sysupgrade.
  (that function doesn't anything without errors if no specified volume)

MAC Addresses:

LAN    : 50:41:B9:xx:xx:64 (0:APPSBLENV, "ethaddr"/"eth1addr" (text))
WAN    : 50:41:B9:xx:xx:66 (0:APPSBLENV, "eth0addr" (text))
2.4 GHz: 50:41:B9:xx:xx:64 (0:APPSBLENV, "wifi0"    (text))
5 GHz  : 50:41:B9:xx:xx:65 (0:APPSBLENV, "wifi1"    (text))

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19053
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-06-12 10:54:34 +02:00
INAGAKI Hiroshi
2186f4aa75 qualcommax: make header length configurable on Build/mstc-header
I-O DATA WN-DAX3000GR has a MSTC (Mitra Star Technology Corp.) specific
header with a different length than ELECOM WRC-X3000GS2.
Make the header length configurable by parameterizing on
Build/mstc-header.

- WRC-X3000GS2: 0x400
- WN-DAX3000GR: 0x480

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19053
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-06-12 10:54:34 +02:00
Piotr Dymacz
35c828c168 ipq60xx: add support for ALFA Network AP120C-AX
Some checks are pending
Build Kernel / Build all affected Kernels (push) Waiting to run
Build all core packages / Build all core packages for selected target (push) Waiting to run
ALFA Network AP120C-AX is a dual-band ceiling AP, based on Qualcomm
IPQ6000 + QCN5021 + QCN5052 + QCA8072 chipsets bundle.

Specifications:

- SOC:      Qualcomm IPQ6000 (quad-core Cortex-A53 1.2 GHz)
- DRAM:     DDR3 512 MB (Micron MT41K256M16TW-107)
- Flash:    16 MB SPI NOR (Macronix MX25U12832F, boot device)
            128 MB NAND (Macronix MX30UF1G18AC, dual-firmware)
- Ethernet: 2x 10/100/1000 Mbps Ethernet (QCA8072)
            802.3at/af PoE input in WAN port
- Wi-Fi:    2x2 2.4 GHz Wi-Fi 6 (QCN5021 + RFFM8227 FEM)
            2x2   5 GHz Wi-Fi 6 (QCN5152 + QPF4568 FEM)
- Antenna:  for indoor version: dual-band, internal
            2x (or 4x) U.FL antenna connectors on the PCB
- LED:      for indoor/outdoor versions: 5x on external module (status,
            2x Wi-Fi, 2x Ethernet), PoE LED on-board
            8-pin on-board header for LED module (1.27 mm pitch, J14)
- Button:   1x button (reset)
- USB:      1x 4-pin on-board header for USB 2.0 (2.54 mm pitch, J22)
- UART:     1x micro USB Type-B for system console (Holtek HT42B534)
            1x 4-pin on-board header (2.54 mm pitch, J11)
- Power:    802.3at/af PoE or 12 V DC/2 A (DC jack)
- Other:    8-pin and 4-pin on-board headers for external Bluetooth
            module (1.27 mm pitch, J15, J16, unavailable, thus untested)

MAC addresses:

- WAN:               00:c0:ca:xx:xx:6c (art 0x0, device's label -2)
- LAN:               00:c0:ca:xx:xx:6d (art 0x6, device's label -1)
- 2.4 GHz (IPQ6000): 00:c0:ca:xx:xx:6e (art 0xc, device's label)
-   5 GHz (IPQ6000): 00:c0:ca:xx:xx:6f (device's label + 1)

Flash instructions:

Due to the lack of direct GUI based update capability and dual-firmware
partition configuration, it is recommended to use TFTP + serial console
based approach (console is available in micro USB connector):

1. Set a static IP 192.168.1.1/24 on PC and start TFTP server with the
   '...-factory.ubi' image renamed to 'firmware.bin'.
2. Make sure you can access board's serial console over micro USB.
3. Power up the device, hit any key to enter U-Boot CLI and issue below
   commands.

3.1 Restore U-Boot's environment to default values (double check first
    the '0:APPSBLENV' partition offset using 'smem' command):

    sf probe
    sf erase 0x510000 0x10000
    saveenv

3.2 Download and install OpenWrt in both partitions and reset the board:

    tftpb 0x44000000 firmware.bin
    flash rootfs
    flash rootfs_1
    reset

Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2025-05-27 23:43:55 +02:00
Robert Marko
ca51f7aaf5 qualcommax: ipq60xx: fix EAP625-Outdoor HD BDF package name
Currently, non existing ipq-wifi package name is selected for
EAP625-Outdoor HD, so correct the name.

Fixes: 51c1ea08d0 ("qualcommax: ipq60xx: add TP-Link EAP625-Outdoor HD v1 support")
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-05-15 14:57:14 +02:00
Alexandru Gagniuc
51c1ea08d0 qualcommax: ipq60xx: add TP-Link EAP625-Outdoor HD v1 support
TP-Link EAP625-Outdoor HD is a 802.11ax AP claiming AX1800 support.
It is wall or pole mountable, and rated for outdoor use. It can only
be powered via PoE.

Hardware-wise, it is very similar to the older EAP610-Outdoor model.
Software-wise, I couldn't find a difference other than the board
data files, and device name. For this reason, the majority of the
devicetree from the EAP610-Outdoor is reused.

This device currently comes in a "v1", and "v1.6" version. The
"support-list" of the vendor firmware does not have a distinction
between these versions. This commit was tested on a 'V1.6" device.

Specifications:
---------------
* CPU: Qualcomm IPQ6018 Quad core Cortex-A53
* RAM: 512 MB
* Storage: 128MB NAND
* Ethernet:
  * Gigabit RJ45 port with PoE input
* WLAN:
  * 2.4GHz/5GHz
* LEDs:
  * Multi-color System LED (Green/Amber)
* Buttons:
  * 1x Reset
* UART: 4-pin unpopulated header
  * 1.8 V level, Pinout 1 - TX, 2 - RX, 3 - GND, 4 - 1.8V

Installation:
=============

Web UI method
-------------

Set up the device using the vendor's web UI. After that go to
Management->SSH and enable the "SSH Login" checkbox. Select "Save".
The connect to the machine via SSH:

ssh -o hostkeyalgorithms=ssh-rsa <ip_of_device>

Disable signature verification:

cliclientd stopcs

Rename the "-web-ui-factory" image to something less than 63
characters, maintaining the ".bin" suffix.
 * Go to System -> Firmware Update.
 * Under "New Firmware File", click "Browse" and select the image
 * Select "Update" and confirm by clicking "OK".

If the update fails, the web UI should show an error message.
Otherwise, the device should reboot into OpenWRT.

NOTE: If ssh continues to complain that "no matching host key type
found. Their offer: ssh-rsa,ssh-dss" it likely means that yor distro
has completely disabled deprecated siphers in ssh. In that case, run
the ssh command from a docker container of an older distro.

TFTP method
-----------

To flash via tftp, first place the initramfs image on the TFTP server.

setenv serverip <ip of tftp server>
setenv ipaddr <ip in same subnet as tftp server>
tftpboot tplink_eap625-outdoor-hd-v1-initramfs-uImage.itb
bootm

This should boot OpenWRT. Once booted, flash the sysupgrade.bin image
using either luci or the commandline.

Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18584
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-05-14 19:38:25 +02:00
Scott Mercer
6d4ded04ac qualcommax: ipq5018: glinet_gl-b3000: fix kernel alignment
fixes the following warning seen in bootlog

	"Kernel image misaligned at boot, please fix your bootloader!"

Fixes: 3307fe8 ("qualcommax: ipq50xx: add support for GL.iNET GL-B3000")

Signed-off-by: Scott Mercer <TheRootEd24@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18658
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-05-01 20:11:16 +02:00
INAGAKI Hiroshi
f22d872c65 qualcommax: ipq50xx: drop unused factory.ubi for ELECOM WRC-X3000GS2
Drop the firmware image entry "factory.ubi" from IMAGES for ELECOM
WRC-X3000GS2.
`Device/UbiFit` is added in the early stage of working for adding
support of the device, but finally, only `KERNEL_IN_UBI` is neccesary
and factory.ubi is not. So `Device/UbiFit` should have been replaced
to `KERNEL_IN_UBI` but it was forgotten.

Fixes: 3b7d72bc2e ("qualcommax: add support for ELECOM WRC-X3000GS2")
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18611
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-04-27 11:14:31 +02:00
INAGAKI Hiroshi
3b7d72bc2e qualcommax: add support for ELECOM WRC-X3000GS2
ELECOM WRC-X3000GS2 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on
IPQ5018.

Specification:

- SoC             : Qualcomm IPQ5018
- RAM             : DDR3 256 MiB (Zentel A3T2GF40CBF-HP)
- Flash           : SPI-NAND 128 MiB (Macronix MX35UF1G24AD-Z4I)
- WLAN            : 2.4/5 GHz 2T2R
  - 2.4 GHz       : Qualcomm IPQ5018 (SoC)
  - 5 GHz         : Qualcomm Atheros QCN6102
- Ethernet        : 5x 10/100/1000 Mbps
  - wan (phy)     : Qualcomm IPQ5018 (SoC)
  - lan (switch)  : Qualcomm Atheros QCA8337
- LEDs/Keys (GPIO): 8x/3x
- UART            : through-hole on PCB, 4pins near the barcode
  - assignment    : 3.3V, TX, RX, NC, GND from the barcode side
  - settings      : 115200n8
- Power           : 12 VDC, 1 A (Max. 11.5W)

Flash instruction using initramfs-factory.bin image:

1. Boot WRC-X3000GS2 normally with router mode
2. Access to the WebUI ("http://192.168.2.1/") on the device and open
   the firmware update page ("ファームウェア更新")
3. Select the OpenWrt factory.bin image and click apply ("適用") button
4. Wait ~120 seconds to complete flashing

Switching to the stock firmware:

1. Load the elecom.sh script

   . /lib/upgrade/elecom.sh

2. Check the current index of rootfs

   bootconfig_rw_index 0:bootconfig rootfs

3. Set the index to inverted value

   bootconfig_rw_index 0:bootconfig rootfs <value>
   bootconfig_rw_index 0:bootconfig1 rootfs <value>

   example:

   - step2 returned "0":

     bootconfig_rw_index 0:bootconfig rootfs 1
     bootconfig_rw_index 0:bootconfig1 rootfs 1

   - step2 returned "1":

     bootconfig_rw_index 0:bootconfig rootfs 0
     bootconfig_rw_index 0:bootconfig1 rootfs 0

4. Reboot

Partition Layout (Stock FW):

0x000000000000-0x000000080000 : "0:SBL1"
0x000000080000-0x000000100000 : "0:MIBIB"
0x000000100000-0x000000140000 : "0:BOOTCONFIG"
0x000000140000-0x000000180000 : "0:BOOTCONFIG1"
0x000000180000-0x000000280000 : "0:QSEE"
0x000000280000-0x000000380000 : "0:QSEE_1"
0x000000380000-0x0000003c0000 : "0:DEVCFG"
0x0000003c0000-0x000000400000 : "0:DEVCFG_1"
0x000000400000-0x000000440000 : "0:CDT"
0x000000440000-0x000000480000 : "0:CDT_1"
0x000000480000-0x000000500000 : "0:APPSBLENV"
0x000000500000-0x000000640000 : "0:APPSBL"
0x000000640000-0x000000780000 : "0:APPSBL_1"
0x000000780000-0x000000880000 : "0:ART"
0x000000880000-0x000000900000 : "0:TRAINING"
0x000000900000-0x000003c40000 : "rootfs"
0x000003c40000-0x000003fc0000 : "Config"
0x000003fc0000-0x000007300000 : "rootfs_1"
0x000007300000-0x000007680000 : "Config_2"
0x000007680000-0x000007b80000 : "Reserved"
0x000007b80000-0x000007c00000 : "FWHEADER"
0x000007c00000-0x000007c80000 : "Factory"

Known Issues:

- All Wi-Fi related peripherals are disabled.
  This device has only 256 MiB RAM and it's too few for ath11k. To
  prevent OOM when using LuCI or other softwares, disable Wi-Fi related
  peripherals in device tree at the moment.

- This device has a Macronix MX35UF1G24AD SPI-NAND chip registered as
  oobsize=128 in Linux Kernel. But using BCH8 breaks I/O on the chip
  with the following errors, so this support uses BCH4 instead.

  root@OpenWrt:~# strings /dev/mtdblock10
  [26427.133154] mtdblock: MTD device '0:appsblenv' is NAND, please consider using UBI block devices instead.
  [26427.134125] I/O error, dev mtdblock10, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 4 prio class 2
  [26427.142240] I/O error, dev mtdblock10, sector 8 op 0x0:(READ) flags 0x80700 phys_seg 3 prio class 2
  [26427.151427] I/O error, dev mtdblock10, sector 16 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 2
  [26427.160440] I/O error, dev mtdblock10, sector 24 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
  [26427.169619] I/O error, dev mtdblock10, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
  [26427.178083] Buffer I/O error on dev mtdblock10, logical block 0, async page read

Notes:

- This device has dual-boot feature and it's managed by the index in the
  0:bootconfig and 0:bootconfig1 partitions.

MAC Addresses:

LAN    : 38:97:A4:xx:xx:60 (0:APPSBLENV, "eth1addr"/"ethaddr"  (text))
WAN    : 38:97:A4:xx:xx:63 (0:APPSBLENV, "eth0addr" (text))
2.4 GHz: 38:97:A4:xx:xx:61 (0:APPSBLENV, "wifi0"    (text))
5 GHz  : 38:97:A4:xx:xx:62 (0:APPSBLENV, "wifi1"    (text))

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18543
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-04-22 20:58:29 +02:00
jonathan brophy
8da24b1109 Qualcommax: IPQ807x: Add support for TP-Link Deco X80-5G
The TP-link Deco X80-5G is a AX WIFI router with a single 1G (LAN) and 1 2.5G (WAN) port with a built in Quectel 5G modem.

Specifications:

Architecture	ARMv8-A (aarch64 Cortex A53, 4 cores)
Vendor	Qualcomm
Bootloader	U-Boot (2016)
System-On-Chip	Qualcomm IPQ8074A (Networking Pro 1210 platform)
CPU/Speed	2.2GHZ
Flash-Chip	ESMT F59D1G81MB-45TI 1G-bit NAND
Flash MB	128MB (1Gbit)
RAM-chip	2* ESMT M15T4G16256A-DEBG2G 2Gb DDR3L (32bit)
RAM MB	512MB (4Gbit)
WLan System-On-Chip (5g)	Qualcomm QCN5054
WLan Front end modules (5g)	8* Qorvo QPF4588
WLAN (5G)	A/N/AC/AX
WLAN Antenna (int)	8* (4 shared with 2.5G)
WLan System-On-Chip (2.4G)	Qualcomm QCN5024
WLan Front end modules (2.4G)	4* Skyworks SKY85340-11
WLAN (2.4G)	B/G/N/AX
WLAN Antenna (int)	4* (shared with 5g)
Eithernet-phy (1Gbit)	Qualcomm (Atheros) AR8033-AL1A
Ethernet (1Gbit)	1*
Eithernet-phy (2.5Gbit)	Qualcomm QCA8081
Ethernet (2.5Gbit)	1*
Switch	Embedded in the SOC?
Serial	1.8v 8n1 (testpoints)
Modem System-On-Chip	Qualcomm 5G RG50xQ (Snapdragon X55 platform)
5G modem capability	5000Mbps down 900Mbps up
5G modem bands	N1/N3/N5/N7/N8/N20/N28/N38/N40/N41/N77/N78/N79
4G modem capability	4.5G LTE-Advanced Pro (Cat20 down 2Gbps) (Cat18 up 200Mbps)
4G modem FDD bands	B1/B3/B5/B7/B8/B18/B19/B20/B26/B28
4G modem TDD bands	B34/B38/B39/B40/B41/B42/B43
Modem antenna (int)	8* (5G/4G use)
Modem antenna (ext)	2* SMA connectors (5G/4G use)
SIM type	1* Nano SIM
Telephony	1* POTS RJ11
(see wiki for more info:)
https://openwrt.org/inbox/toh/tp-link/x80-5g_v1

        Notes:
Installation Instructions:

Between antennas 7 and 8 on the PCB with the RGB harness there are three test pads labelled TP1 TP2 and TP3 connections are as follows:
  |TP2|-- RX
  |TP1|-- TX
  |TP3|-- GND

RX requires an external pullup to operate somewhere around 5 K ohm but your luck may vary the Uart is 1.8v

Set a static IP and set up a tftpserver and terminal.
power the router and quickly type the magic string “tpl” and press enter to break into u-boot
in the shell set the environment variables to enable tftp booting
setenv ipaddr (routerIP)
setenv serverip (server IP)
load you initramfs:
tftpboot 0x44000000 (serverIP):openwrt-qualcommax-ipq807x-tplink_x80-5g-initramfs-uImage.itb
boot your initramfs
bootm
upload your factory image to /tmp
format and install the factory image:
ubiformat /dev/mtd12 -y -f /tmp/openwrt-qualcommax-ipq807x-tplink_x80-5g-squashfs-factory.ubi

Note as this device swaps root partitions upon update your boot partition may be set as mtd13

Update script to mount factory tplink partition's for MAC recovery and device data.
Capture Labelmac from Factory_data partition.
Patch LAN from Labelmac.
Patch ART from Labelmac.
Set GPIO to make modem operational from boot.

GPIO fan tables work like the  stock device with three fan maps high active idle with a top fan speed of 6800 RPM.

High temp 70 deg speeds 6-8
Active temp 50 deg speeds 2-5
low temp 25 degree speed 0-1

Signed-off-by: jonathan brophy <professor_jonny@hotmail.com>
Link: https://github.com/openwrt/openwrt/pull/16329
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-04-22 13:25:40 +02:00
Scott Mercer
3307fe8ee4 qualcommax: ipq50xx: add support for GL.iNET GL-B3000
Add support for GL.iNET (AX3000) B3000.

Speficiations:
* SoC: Qualcomm IPQ5018 (64-bit dual-core ARM Cortex-A53 @ 1.0Ghz)
* Memory: Winbond W634GU6NQB-11 (512 MiB DDR3-933)
* Serial Port: 3v3 TTL 115200n8
* Wi-Fi: IPQ5018 (2x2 2.4 Ghz 802.11b/g/n/ax)
* Wi-Fi: QCN6102 (2x2:2 5 Ghz 802.11an/ac/ax)
* Ethernet: IPQ5018 integrated virtual switch connected to an external
            QCA8337 switch (3 Ports 10/100/1000 GBASE-T)
* Flash: Winbond W25N01GWZEIG (128 MiB)
* LEDs: 1x single-color blue LED (GPIO 24 Active High)
        1x single-color white LED (GPIO 23 Active High)
* Buttons: 1x Reset (GPIO 27 Active Low)

Flash Instructions:

*** The .img files are now universal ! ***

Openwrt		--> openwrt-qualcommax-ipq50xx-glinet_gl-b3000-squashfs-factory.img

GL.iNet OEM	--> openwrt-b3000-4.5.18-0731-1722397535.img

Either file can be flashed, in any of the available upgrade options, in both Firmwares.

Pick a file .. pick a method .. and SEND IT !!

Signed-off-by: Scott Mercer <TheRootEd24@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17903
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-04-20 16:11:29 +02:00
Yang Xiwen
5dbf93c8c5 ipq60xx: add support for TP-Link EAP623-Outdoor HD v1
Specifications:
* SoC: Qualcomm IPQ6018 (64-bit Quad-core Arm Cortex-A53 @ 1800MHz)
* Memory: 1 GiB
* Serial Port: 3v3 TTL 115200n8
* Wi-Fi: QCN9074 (4x4 5 GHz 802.11ax)
* Wi-Fi: IPQ6018 (4x4 2.4 GHz 802.11b/g/n/ax)
* Ethernet: RTL8211F (10/100/1GBASE-T)
* Flash: ESMT F59D1G81MB (128 MiB)
* LEDs: 1x Green Status (GPIO 37 Active High), 1x Yellow Status (GPIO 32
  Active High) and an LED global control GPIO (GPIO 36 Active High, set
  up by U-Boot)
* Buttons: 1x Reset (GPIO 9 Active Low)

Installation Instructions (Serial+TFTP):
1. Solder 4 pin header to the pads near T32 and T31.
2. Connect 3V3 TTL port to TX, RX, and GND, which are pad T31, T32 and
   the pad near T31 respectively. Be sure not to connect VCC and
   crossover TX and RX.
3. Copy RAM firmware image
   openwrt-qualcommax-ipq60xx-tplink_eap623od-hd-v1-initramfs-uImage.itb
   to TFTP server root, available at 192.168.0.1.
4. Connect PoE ethernet cable to the RJ45 port and hold Ctrl+B in the
   serial console (115200 baud) until autoboot is halted.
5. Run the following commands in the U-boot prompt:
   # setenv serverip 192.168.0.1
   # setenv ipaddr 192.168.0.99
   # tftpboot 0x44000000 openwrt-qualcommax-ipq60xx-tplink_eap623od-hd-v1-initramfs-uImage.itb
   # bootm
   You may need to type Ctrl+C and Enter before running these commands
   to clear invisible characters from the buffer.
6. Run the following command in a terminal to copy the sysupgrade image
   to be installed (check IP address):
   $ scp openwrt-qualcommax-ipq60xx-tplink_eap623od-hd-v1-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
7. Activate the OpenWrt serial console and run the following commands:
   # cd /tmp
   # sysupgrade -n openwrt-qualcommax-ipq60xx-tplink_eap623od-hd-v1-squashfs-sysupgrade.bin
8. The AP will reboot and OpenWrt will be successfully installed.

Signed-off-by: Yang Xiwen <forbidden405@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/18389
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-04-09 09:50:31 +02:00
Erik Servili
a0c1c9df97 qualcommax: ipq60xx: add support for Netgear WAX610 and WAX610Y
Netgear WAX610 / WAX610Y is a 802.11ax AP claiming AX1800 support.

Specifications:
---------------
* CPU: Qualcomm IPQ6018 Quad core Cortex-A53
* RAM: 512MB
* Storage: Winbond W29N01HZBINF 128MB NAND
* Ethernet:
  * 2.5GbE RJ45 port with PoE input
* WLAN:
  * 2.4GHz/5GHz
* LEDs:
  * Power: Dual-color LED (Green / Orange), Single-color LED (Blue)
  * Ethernet: Dual-color LED (Green / Orange)
  * 2.4Ghz WiFi: 2x Single-color LED (Blue, Green)
  * 5Ghz WiFi: 2x Single-color LED (Blue, Green)
* Buttons:
  * 1x Reset
* UART: 4-pin populated header
  * Pinout 1 - VCC, 2 - GND, 3 - TX, 4 - RX

Installation:
=============

Web UI method
-------------

Set up the device using the stock web UI in local management mode.

Download the ui-factory.tar image.
 * Enter the Management tab
 * Select Maintenance->Upgrade->Firmware Upgrade
 * Ensure the "Upgrade Options" field has "Local" selected
 * Click "Browse File" and select the image
 * Click "Upgrade" (NOT "Upgrade Now") at the bottom of the page

The device will install the image but reboot back into the vendor
firmware. Return the to Firmware Upgrade page as above and select
"Boot up Backup Firmware". The device should reboot into OpenWRT.

TFTP method
-----------

To flash via tftp, first place the initramfs image on the TFTP server.

    setenv serverip <ip of tftp server>
    setenv ipaddr <ip in same subnet as tftp server>
    tftpboot netgear_wax610-initramfs-uImage.itb
    bootm

This should boot OpenWRT. Once booted, flash the sysupgrade.bin image
using either luci or the command line.

Signed-off-by: Erik Servili <serverror@serverror.com>
Link: https://github.com/openwrt/openwrt/pull/18377
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-04-04 14:38:01 +02:00
Weikai Kong
a1bf306bb7 qualcommax: ipq60xx: add Linksys MR7500 support
Codename: Divo

Hardware specification:
========
SoC: Qualcomm IPQ6018
RAM: 512MB (2x ESMT 256MB DDR3L M15T2G16128A–DEBG2R)
NAND Flash: 512MB (Macronix MX30UF4G18AC or SK Hynix H27S4G8F2EDA-BC)
Ethernet: 1x 10/100/1000/2500/5000Mbps (Marvell AQR114C-B0)
Ethernet: 4x 10/100/1000Mbps (Qualcomm QCA8075)
WiFi1: 6GHz ax 4x4@20/40/160 MHz (Qualcomm QCN9024 + Skyworks SKY85784-11) - channels 33-229
WiFi2: 5GHz ax 2x2@20/40/80 MHz (Qualcomm QCN5052 + Skyworks SKY85755-11) - channels 36-177
WiFi3: 2.4GHz ax 2x2@20/40 MHz (Qualcomm QCN5022 + Skyworks SKY8340-11)
IoT: Bluetooth 5 (CSR8811) - not implemented
LED: 1x RGB status + USB Blue (PWM)
USB: 1x USB 3.0
Button: WPS, Reset

Flash instructions (Without Serial):
========
Open Linksys Web UI - http://192.168.1.1/ca or http://linksysxxxxx.lan/ca depending on your setup.
  xxxxx is the last 5 digits from the SN found on a sticker under the device.
Click on the Linksys Logo to by-pass smart app registration.
Login with your admin password. The default password can be found on the same sticker.
To enter into the support mode, click on the “CA” link and the bottom of the page.
Open the “Connectivity” menu and upload the squash-factory image with the “Choose file” button.
Click start. Ignore all the prompts and warnings by click “yes” in all the popups.

Flash instructions (With Serial):
========
1. Installation using serial connection from OEM firmware (default login: root, password: admin):
- fw_printenv -n boot_part
In case of 2:
- flash_erase /dev/mtd13 0 0
- nandwrite -p /dev/mtd13 openwrt-qualcommax-ipq60xx-linksys_mr7500-squashfs-factory.bin
or in case of 1:
- flash_erase /dev/mtd15 0 0
- nandwrite -p /dev/mtd15 openwrt-qualcommax-ipq60xx-linksys_mr7500-squashfs-factory.bin
After first boot install firmware on second partition:
- mtd -r -e kernel -n write openwrt-qualcommax-ipq60xx-linksys_mr7500-squashfs-factory.bin kernel
or:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq60xx-linksys_mr7500-squashfs-factory.bin alt_kernel

2. Installation from initramfs image using USB drive:
Put the initramfs image on the USB drive:
- dd bs=1M if=openwrt-qualcommax-ipq60xx-linksys_mr7500-initramfs-uImage.itb of=/dev/sda
Stop u-boot and run:
- usb start && usbboot $loadaddr 0 && bootm $loadaddr
Write firmware to the flash from initramfs:
- mtd -e kernel -n write openwrt-qualcommax-ipq60xx-linksys_mr7500-squashfs-factory.bin kernel
and:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq60xx-linksys_mr7500-squashfs-factory.bin alt_kernel

3. Back to the OEM firmware:
- mtd -e kernel -n write FW_MR7500_1.1.12.211919_prod.img kernel
and:
- mtd -r -e alt_kernel -n write FW_MR7500_1.1.12.211919_prod.img alt_kernel

4. USB recovery:
Put the initramfs image on the USB:
- dd bs=1M if=openwrt-qualcommax-ipq60xx-linksys_mr7500-initramfs-uImage.itb of=/dev/sda
Set u-boot env:
- fw_setenv bootusb 'usb start && usbboot $loadaddr 0 && bootm $loadaddr'
- fw_setenv bootcmd 'run bootusb; if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'

AQR firmware:
========
0. Firmware extracting:
To extract the firmware, use unblob (unblob.org)
1. Firmware loading:
To properly load the firmware and initialize AQR PHY, we must use the u-boot aq_load_fw function.
To do this, you need to modify u-boot env:
With USB recovery:
- fw_setenv bootcmd 'aq_load_fw; run bootusb; if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'
and without:
- fw_setenv bootcmd 'aq_load_fw; if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'
2. Firmware updating:
Newer firmware (AQR114C.cld) is available in the latest OEM firmware (https://downloads.linksys.com/support/assets/firmware/FW_MR7500_1.1.12.211919_prod.img).
Copy AQR114C.cld to /lib/firmware/marvell

Link: openwrt#17428

Signed-off-by: Weikai Kong <priv@pppig236.com>
Link: https://github.com/openwrt/openwrt/pull/18185
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-03-28 12:38:33 +01:00
Weikai Kong
284f37ed80 ipq60xx: define common Linksys MR devices configuration
ipq60xx series MR devices share some common attributes such as LED for
USB port.

Signed-off-by: Weikai Kong <priv@pppig236.com>
Link: https://github.com/openwrt/openwrt/pull/18185
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-03-28 12:38:33 +01:00
Shymon Samsel
8a15a75e94 qualcommax: ipq807x: Create working factory images for EAP620 HD v1 and EAP660 HD v1
Create factory tar for EAP620 HD v1 and EAP660 HD v1 which is accepted by the stock UI.
Fix bug in ipq807x and ipq60xx makefiles so TPLINK_SUPPORT_STRING is handled properly.
Modify tplink-mkimage-2022 script and relevant makefiles to allow spaces in support strings (required for EAP620 HD v1 and EAP660 HD v1).

Installation steps are identical to EAP610-Outdoor:
Web UI method
-------------

Set up the device using the vendor's web UI. After that go to
Management->SSH and enable the "SSH Login" checkbox. Select "Save".
The connect to the machine via SSH:

    ssh -o hostkeyalgorithms=ssh-rsa <ip_of_device>

Disable signature verification:

    cliclientd stopcs

Rename the "-web-ui-factory" image to something less than 63
characters, maintaining the ".bin" suffix.
 * Go to System -> Firmware Update.
 * Under "New Firmware File", click "Browse" and select the image
 * Select "Update" and confirm by clicking "OK".

If the update fails, the web UI should show an error message.
Otherwise, the device should reboot into OpenWRT.

Signed-off-by: Shymon Samsel <ssamsel@umass.edu>
Link: https://github.com/openwrt/openwrt/pull/18340
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-03-27 17:42:04 +01:00
Erik Servili
2758eebc76 qualcommax: ipq807x: Create working factory tar for WAX620 and WAX630.
Create factory tar for WAX620 and WAX630 which is accepted by the stock UI.
Must use 'Boot up Backup Firmware' button on stock upgrade page after install and reboot to swap partitions.

Signed-off-by: Erik Servili <serverror@serverror.com>
Link: https://github.com/openwrt/openwrt/pull/18334
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-03-26 09:52:41 +01:00
Chukun Pan
c3f2bb7afc qualcommax: ipq60xx: add GL.iNet GL-AX1800/AXT1800 support
Specifications:
  SoC:     Qualcomm IPQ6000
  RAM:     512 MiB
  Flash:   128 MiB NAND
  ETH:     Qualcomm QCA8075
  WLAN1:   2.4GHz 802.11b/g/n/ax 2x2
  WLAN2:   5GHz 802.11a/n/ac/ax 2x2
  Button:  Reset, Switch
  USB:     1x 3.0
  SD slot: 1 in GL-AXT1800

Install via stock firmware:
  Upload factory.bin in stock firmware's upgrade page,
  do not preserve settings.

Install via uboot web failsafe:
  Push the reset button for 5 seconds, then use broswer
  to access http://192.168.1.1, and upload factory.ubi.

Afterwards upgrade can use sysupgrade image.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/14950
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-03-24 10:16:00 +01:00
George Moussalem
9a7192c08e qualcommax: ipq50xx: Add support for Linksys MR5500
Add support for Linksys MR5500 (Hydra 6 Pro).

Speficiations:
* SoC: Qualcomm IPQ5018 (64-bit dual-core ARM Cortex-A53 @ 1.0Ghz)
* Memory: Kingston D2516ECMDXGJD (512 MiB)
* Serial Port: 3v3 TTL 115200n8
* Wi-Fi: IPQ5018 (2x2 2.4 Ghz 802.11b/g/n/ax)
         QCN9024 (4x4:4 5 Ghz 802.11an/ac/ax)
* Ethernet: IPQ5018 integrated virtual switch connected to an external
            QCA8337 switch (4 Ports 10/100/1000 GBASE-T)
* Flash: Gigadevice GD5F2GQ5REYIH (256 MiB)
* LEDs: 1x multi-color PWM LED
        1x blue led for USB (GPIO 19 Active High)
* Buttons: 1x WPS (GPIO 27 Active Low)
           1x Reset (GPIO 28 Acive Low)
           5x ethernet port LEDs (amber for activity & green for link up)
* Peripherals: 1x USB2 (powered by GPIO 17 Active Low)
               support for USB3 will be added in a separate PR
* FCC ID: 2AYRA-03734

Flash instructions:
1. On OEM firmware, login to the device (typically at http://192.168.1.1) and click 'CA'
in the bottom right corner -> Connectivity -> Manual Upgrade. Alternatively, browse to
http://<router IP>/fwupdate.html.
Upgrade firmware using openwrt-qualcommax-ipq50xx-linksys_mr5500-squashfs-factory.bin image.
Optionally install on second partition, after first boot check actual partition:
fw_printenv -n boot_part
and install firmware on second partition using command in case of 2:
mtd -r -e kernel -n write openwrt-qualcommax-ipq50xx-linksys_mr5500-squashfs-factory.bin kernel
and in case of 1:
mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq50xx-linksys_mr5500-squashfs-factory.bin alt_kernel
2. Installation using serial connection from OEM firmware (default login: root, password: admin):
fw_printenv -n boot_part
In case of 2:
flash_erase /dev/mtd12 0 0
nandwrite -p /dev/mtd12 openwrt-qualcommax-ipq50xx-linksys_mr5500-squashfs-factory.bin
or in case of 1:
flash_erase /dev/mtd14 0 0
nandwrite -p /dev/mtd14 openwrt-qualcommax-ipq50xx-linksys_mr5500-squashfs-factory.bin
After first boot install firmware on second partition:
mtd -r -e kernel -n write openwrt-qualcommax-ipq50xx-linksys_mr5500-squashfs-factory.bin kernel
or:
mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq50xx-linksys_mr5500-squashfs-factory.bin alt_kernel
3. Back to the OEM firmware.
Download firmware from OEM website:
MR5500: https://support.linksys.com/kb/article/207-en/
From serial or SSH:
fw_printenv boot_part
in case of 1:
mtd -r -e alt_kernel -n write FW_MR5500_1.1.2.209598_prod.img alt_kernel
else in case of 2:
mtd -r -e kernel -n write FW_MR5500_1.1.2.209598_prod.img kernel
4. Boot from USB
This allows you loading an OpenWrt image into RAM and is meant for recovery scenarios only.
Enable loading image from USB in u-boot. From serial or SSH:
fw_setenv bootusb 'usb start && usbboot &loadaddr && bootm $loadaddr'
fw_setenv bootcmd 'run bootusb; if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'
Copy OpenWrt initramfs image to USB:
dd bs=1M if=openwrt-qualcommax-ipq50xx-linksys_mr5500-initramfs-uImage.itb of=/dev/sda

Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/17958
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-03-02 11:42:48 +01:00
Paweł Owoc
3b7a92754e linux: use packages kmod-hci-uart and kmod-btusb instead of kmod-bluetooth
Use Bluetooth UART and USB packages separetly.

Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15118
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2025-02-24 00:08:42 +01:00
George Moussalem
fe379eb1c1 qualcommax: ipq50xx: add support for Linksys SPNMX56
The SPNMX56 is an ISP-branded and distributed device similar to the MX5500
with the same Wifi chips (IPQ5018 for 2.4G and QCN9074 for 5G) but has an
additional QCA8081 PHY providing a 2.5gbps ethernet WAN port.

Speficiations:
* SoC: Qualcomm IPQ5018 (64-bit dual-core ARM Cortex-A53 @ 1.0Ghz)
* Memory: Winbond W634GU6NB-11 (512 MiB DDR3-933)
* Serial Port: 3v3 TTL 115200n8
* Wi-Fi: IPQ5018 (2x2 2.4 Ghz 802.11b/g/n/ax)
         QCN9024 (4x4:4 5 Ghz 802.11an/ac/ax)
* Ethernet: IPQ5018 integrated virtual switch connected to an external
            QCA8337 switch (3 Ports 10/100/1000 GBASE-T) and a
            QCA8081 phy (up to 2.5 Gbps)
* Flash: Gigadevice GD5F2GM7RExxG (256 MiB)
* LEDs: 1x multi-color PWM LED
* Buttons: 1x WPS (GPIO 27 Active Low)
           1x Reset (GPIO 28 Acive Low)

Flash instructions:
1. On OEM firmware, login to the device (typically at http://192.168.1.1)
and click 'CA' in the bottom right corner -> Connectivity ->
Manual Upgrade. Alternatively, browse to http://<router IP>/fwupdate.html
Upload openwrt-qualcommax-ipq50xx-linksys_spnmx56-squashfs-factory.bin
Optionally flash 2nd partition, after first boot check actual partition:
fw_printenv -n boot_part
and install firmware on second partition using command in case of 2:
mtd -r -e kernel -n write openwrt-qualcommax-ipq50xx-linksys_spnmx56-squashfs-factory.bin kernel
and in case of 1:
mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq50xx-linksys_spnmx56-squashfs-factory.bin alt_kernel
2. Installation using serial connection from OEM firmware
hit Enter once booted and enter credentials (login: root, password: admin)
fw_printenv -n boot_part
In case of 2:
flash_erase /dev/mtd12 0 0
nandwrite -p /dev/mtd12 openwrt-qualcommax-ipq50xx-linksys_spnmx56-squashfs-factory.bin
or in case of 1:
flash_erase /dev/mtd14 0 0
nandwrite -p /dev/mtd14 openwrt-qualcommax-ipq50xx-linksys_spnmx56-squashfs-factory.bin
After first boot install firmware on second partition:
mtd -r -e kernel -n write openwrt-qualcommax-ipq50xx-linksys_spnmx56-squashfs-factory.bin kernel
or:
mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq50xx-linksys_spnmx56-squashfs-factory.bin alt_kernel
3. Back to the OEM firmware.
Download firmware from OEM website:
Firmware for this device cannot be searched for on the Linksys website.
Instead, we'd have to use serial to intercept the URL of the firmware
while it's trying to update. Firmware is ISP specific:
Toob (UK): http://download.linksys.com/updates/20241125t080737/FW_MX56TB_1.0.1.216218_prod.img

The intention is to collect URLs for different ISPs on a wiki page.

From serial or SSH:
fw_printenv boot_part
in case of 1:
mtd -r -e alt_kernel -n write FW_MX56TB_1.0.1.216218_prod.img alt_kernel
else in case of 2:
mtd -r -e kernel -n write FW_MX56TB_1.0.1.216218_prod.img kernel

Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/17968
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-02-18 09:37:25 +01:00
Chukun Pan
51d485ef31 qualcommax: add support for Aliyun AP8220
Aliyun AP8220 is an AP manufactured by Edgecore.
(Very similar to Edgecore EAP102)

Hardware specifications:
  SoC: Qualcomm IPQ8071A
  RAM: 1GB of DDR4 600MHz
  Flash1: MX25U3235F 4MB
  Flash2: MX30UF1G18AC 128MB
  Ethernet: 2x 2.5G RJ45 port
  USB: 2x USB-A 2.0 port
  WiFi1: QCN5024 2.4GHz
  WiFi2: QCN5054 5GHz
  Power: DC 12V / PoE

Flash instructions:
  1. Connect the router via serial port
  2. Keep pressing @ until uboot is interrupted
  3. Download the initramfs image, rename it to
     initramfs.bin, host it with tftp server
  4. Run these commands:
     tftpboot initramfs.bin
     bootm
  5. After openwrt boots up, use scp or luci
     to upload sysupgrade.bin to upgrade.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/17970
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-02-17 10:21:21 +01:00
George Moussalem
398f4a9737 qualcommax: ipq50xx: add support for Linksys MX2000 and MX5500
Add support for Linksys MX2000 (Atlas 6) and MX5500 (Atlas 6 Pro).
These devices are completely identical except for the secondary wifi
chip used for 5Ghz: QCN6102 is used on MX2000 while QCN9024 is used
on MX5500

Speficiations:
* SoC: Qualcomm IPQ5018 (64-bit dual-core ARM Cortex-A53 @ 1.0Ghz)
* Memory: Winbond W634GU6NB-11 (512 MiB DDR3-933)
* Serial Port: 3v3 TTL 115200n8
* Wi-Fi: IPQ5018 (2x2 2.4 Ghz 802.11b/g/n/ax)
* Wi-Fi: MX2000: QCN6102 (2x2:2 5 Ghz 802.11an/ac/ax)
         MX5500: QCN9024 (4x4:4 5 Ghz 802.11an/ac/ax)
* Ethernet: IPQ5018 integrated virtual switch connected to an external
            QCA8337 switch (4 Ports 10/100/1000 GBASE-T)
* Flash: Macronix MX35UF2GE4AD (256 MiB)
* LEDs: 1x multi-color PWM LED
* Buttons: 1x WPS (GPIO 27 Active Low)
           1x Reset (GPIO 28 Acive Low)

Flash instructions (in case of MX2000, else replace with MX5500 images):
1. On OEM firmware, login to the device (typically at http://192.168.1.1) and click 'CA'
in the bottom right corner -> Connectivity -> Manual Upgrade. Alternatively, browse to
http://<router IP>/fwupdate.html.
Upgrade firmware using openwrt-qualcommax-ipq50xx-linksys_mx2000-squashfs-factory.bin image.
Optionally install on second partition, after first boot check actual partition:
fw_printenv -n boot_part
and install firmware on second partition using command in case of 2:
mtd -r -e kernel -n write openwrt-qualcommax-ipq50xx-linksys_mx2000-squashfs-factory.bin kernel
and in case of 1:
mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq50xx-linksys_mx2000-squashfs-factory.bin alt_kernel
2. Installation using serial connection from OEM firmware (default login: root, password: admin):
fw_printenv -n boot_part
In case of 2:
flash_erase /dev/mtd12 0 0
nandwrite -p /dev/mtd12 openwrt-qualcommax-ipq50xx-linksys_mx2000-squashfs-factory.bin
or in case of 1:
flash_erase /dev/mtd14 0 0
nandwrite -p /dev/mtd14 openwrt-qualcommax-ipq50xx-linksys_mx2000-squashfs-factory.bin
After first boot install firmware on second partition:
mtd -r -e kernel -n write openwrt-qualcommax-ipq50xx-linksys_mx2000-squashfs-factory.bin kernel
or:
mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq50xx-linksys_mx2000-squashfs-factory.bin alt_kernel
3. Back to the OEM firmware.
Download firmware from OEM website:
MX2000: https://support.linksys.com/kb/article/585-en/
MX5500: https://support.linksys.com/kb/article/587-en/
From serial or SSH:
fw_printenv boot_part
in case of 1:
mtd -r -e alt_kernel -n write FW_MX2000_1.1.7.210469_prod.img alt_kernel
else in case of 2:
mtd -r -e kernel -n write FW_MX2000_1.1.7.210469_prod.img kernel

Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/17182
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-02-06 09:51:13 +01:00
George Moussalem
34d9172655 qualcommax: add ipq50xx target
Introduce support for the Qualcomm IPQ50xx SoC.
This series adds support for the following components:
- minimal boot support: GCC/pinctrl/watchdog/CPUFreq/SDI (upstreamed)
- USB2 (upstreamed)
- Thermal/Tsens
- PCIe gen2 1&2-lane PHY and controller
- PWM and PWM LED
- QPIC SPI NAND controller
- CMN PLL Block (provider of fixed rate clocks to GCC/ethernet/more.)
- Ethernet: IPQ5018 Internal GE PHY (1 gbps)
- Remoteproc MPD driver for IPQ5018 (2.4G) & QCN6122 (5/6G) Wifi

Co-developed-by: Ziyang Huang <hzyitc@outlook.com>
Signed-off-by: Ziyang Huang <hzyitc@outlook.com>
Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/17182
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-02-06 09:51:13 +01:00
Paweł Owoc
07f8319d2d qualcommax: ipq807x: add support for Linksys HomeWRK
Hardware specification:
========
SoC: Qualcomm IPQ8174
Flash: 1GB (Micron MT29F8G08ABBCAH4 or AMD/Spansion S34MS08G2)
RAM: 2GB (2x Kingston B5116ECMDXGJD or ESMT M15T2G16128A DDR3L)
Ethernet: 4x 10/100/1000Mbps (Qualcomm QCA8075)
WiFi1: 5GHz ax 2x2 (Qualcomm QCN5054 + Skyworks SKY85755-11) - channels 36-64 (low band)
WiFi2: 2.4GHz ax 2x2 (Qualcomm QCN5024 + Skyworks SKY85340-11)
WiFi3: 5GHz ax 4x4 (Qualcomm QCN5054 + Skyworks SKY85755-11) - channels 100-177 (high band)
LED: 1x RGB status (NXP PCA9633)
USB: 1x USB 3.0
Button: WPS, Reset

Flash instructions:
========
1. Installation from initramfs image using USB drive:
Put the initramfs image on the USB drive:
- dd bs=1M if=openwrt-qualcommax-ipq807x-linksys_homewrk-initramfs-uImage.itb of=/dev/sdX
Connect serial console (JST PH 6-pin connector):
- 1 - GND, 2 - TX, 4 - RX (115200, 8N1, 3.3V)
Stop u-boot and run:
- usb start && usbboot 44000000 0 && bootm 44000000
Write firmware to the flash from initramfs:
- sysupgrade -n openwrt-qualcommax-ipq807x-linksys_homewrk-squashfs-sysupgrade.bin
or
- ubiformat /dev/mtd22 -y -f openwrt-qualcommax-ipq807x-linksys_homewrk-squashfs-factory.ubi

2. USB recovery:
Put the initramfs image on the USB:
- dd bs=1M if=openwrt-qualcommax-ipq807x-linksys_homewrk-initramfs-uImage.itb of=/dev/sdX
Set u-boot env:
- fw_setenv bootusb 'usb start && usbboot 44000000 0 && bootm 44000000'
- fw_setenv bootcmd 'run bootusb; bootipq'

Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17463
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-01-15 11:25:01 +01:00
Alexandru Gagniuc
a00ff9f6d1 qualcommax: ipq60xx: add TP-Link EAP610-Outdoor support
TP-Link EAP610-Outdoor is a 802.11ax AP claiming AX1800 support. It is
wall or pole mountable, and rated for outdoor use. It can only be
powered via PoE.

Specifications:
---------------
* CPU: Qualcomm IPQ6018 Quad core Cortex-A53
* RAM: 512 MB
* Storage: ESMT PSR1GA30DT 128MB NAND
* Ethernet:
  * Gigabit RJ45 port with PoE input
* WLAN:
  * 2.4GHz/5GHz
* LEDs:
  * Multi-color System LED (Green/Amber)
* Buttons:
  * 1x Reset
* UART: 4-pin unpopulated header
  * 1.8 V level, Pinout 1 - TX, 2 - RX, 3 - GND, 4 - 1.8V

Installation:
=============

Web UI method
-------------

Set up the device using the vendor's web UI. After that go to
Management->SSH and enable the "SSH Login" checkbox. Select "Save".
The connect to the machine via SSH:

    ssh -o hostkeyalgorithms=ssh-rsa <ip_of_device>

Disable signature verification:

    cliclientd stopcs

Rename the "-web-ui-factory" image to something less than 63
characters, maintaining the ".bin" suffix.
 * Go to System -> Firmware Update.
 * Under "New Firmware File", click "Browse" and select the image
 * Select "Update" and confirm by clicking "OK".

If the update fails, the web UI should show an error message.
Otherwise, the device should reboot into OpenWRT.

TFTP method
-----------

To flash via tftp, first place the initramfs image on the TFTP server.

    setenv serverip <ip of tftp server>
    setenv ipaddr <ip in same subnet as tftp server>
    tftpboot tplink_eap610-outdoor-initramfs-uImage.itb
    bootm

This should boot OpenWRT. Once booted, flash the sysupgrade.bin image
using either luci or the commandline.

The tplink2022 image format
============================

The vendor images of this device are packaged in a format that does
not match any previous tplink formats. In order for flashing to work
from the vendor's web UI, firmware updates need to be packaged in
this format. The `tplink-mkimage-2022.py` is provided for this
purpose.

This script can also analyze vendor images, and extract the required
"support" string. This string is checked by the vendor firmware, and
images with a missing or incorrect string are rejected.

Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/14922
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-01-12 16:54:51 +01:00
Robert Marko
39b61ee36f Revert "qualcommax: ipq807x: mx4200v2: fix LED controller"
This reverts commit 7ce4ed4829.

Turns out that this requires more work, so revert to prevent making the
LED uncontrollable.

Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-01-05 12:32:32 +01:00
Manuel Fombuena
7ce4ed4829 qualcommax: ipq807x: mx4200v2: fix LED controller
The Linksys MX4200v2 doesn't have the same LED controller as the MX4200v1 or MX4300.  It comes with the STMicroelectronics LED1202 while the others come with the NXP PCA9633.

This LED controller has a driver under development which is currently being reviewed by the respective kernel maintainers. They are currently on v11.

Apart from the changes needed on the MX4200v2, this commit also amends the configuration of other devices affected by this change as the LED controller is no common to all of them as it was originally thought.

Signed-off-by: Manuel Fombuena <fombuena@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/17451
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-01-05 12:12:12 +01:00
Paweł Owoc
adfb1b7696 qualcommax: ipq807x: add support for Linksys MX4300 (LN1301)
Hardware specification:
========
SoC: Qualcomm IPQ8174
Flash: 1GB (Micron MT29F8G08ABBCAH4 or AMD/Spansion S34MS08G2)
RAM: 2GB (2x Kingston B5116ECMDXGJD or ESMT M15T2G16128A DDR3L)
Ethernet: 4x 10/100/1000Mbps (Qualcomm QCA8075)
WiFi1: 5GHz ax 2x2 (Qualcomm QCN5054 + Skyworks SKY85755-11) - channels 36-64 (low band)
WiFi2: 2.4GHz ax 2x2 (Qualcomm QCN5024 + Skyworks SKY85340-11)
WiFi3: 5GHz ax 4x4 (Qualcomm QCN5054 + Skyworks SKY85755-11) - channels 100-177 (high band)
LED: 1x RGB status (NXP PCA9633)
USB: 1x USB 3.0
Button: WPS, Reset

Flash instructions:
========
1. Manually upgrade firmware using openwrt-qualcommax-ipq807x-linksys_mx4300-squashfs-factory.bin image.
More details can be found here: https://support.linksys.com/kb/article/6564-en/
After first boot check actual partition:
- fw_printenv -n boot_part
and install firmware on second partition using command in case of 2:
- mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4300-squashfs-factory.bin kernel
and in case of 1:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4300-squashfs-factory.bin alt_kernel

2. Installation using serial connection from OEM firmware (default login: root, password: admin):
- fw_printenv -n boot_part
In case of 2:
- flash_erase /dev/mtd21 0 0
- nandwrite -p /dev/mtd21 openwrt-qualcommax-ipq807x-linksys_mx4300-squashfs-factory.bin
or in case of 1:
- flash_erase /dev/mtd23 0 0
- nandwrite -p /dev/mtd23 openwrt-qualcommax-ipq807x-linksys_mx4300-squashfs-factory.bin
After first boot install firmware on second partition:
- mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4300-squashfs-factory.bin kernel
or:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4300-squashfs-factory.bin alt_kernel

3. Installation from initramfs image using USB drive:
Put the initramfs image on the USB drive:
- dd bs=1M if=openwrt-qualcommax-ipq807x-linksys_mx4300-initramfs-uImage.itb of=/dev/sdX
Stop u-boot and run:
- usb start && usbboot $loadaddr 0 && bootm $loadaddr
Write firmware to the flash from initramfs:
- mtd -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4300-squashfs-factory.bin kernel
and:
- mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4300-squashfs-factory.bin alt_kernel

4. Back to the OEM firmware:
- mtd -e kernel -n write FW_MX4300_1.0.4.215382_prod.img kernel
and:
- mtd -r -e alt_kernel -n write FW_MX4300_1.0.4.215382_prod.img alt_kernel

5. USB recovery:
Put the initramfs image on the USB:
- dd bs=1M if=openwrt-qualcommax-ipq807x-linksys_mx4300-initramfs-uImage.itb of=/dev/sdX
Set u-boot env:
- fw_setenv bootusb 'usb start && usbboot $loadaddr 0 && bootm $loadaddr'
- fw_setenv bootcmd 'run bootusb; if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'

Co-authored-by: Qiyuan Zhang <zhang.github@outlook.com>
Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16070
Signed-off-by: Robert Marko <robimarko@gmail.com>
2024-12-31 17:44:10 +01:00
Paweł Owoc
dbafc95cc5 qualcommax: ipq807x: define configuration for Linksys MX4x00 devices
Define shared configuration for Linksys MX4x00 devices.

Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16070
Signed-off-by: Robert Marko <robimarko@gmail.com>
2024-12-31 17:44:10 +01:00