openwrt/target/linux
Hal Martin 60bbf46930 ipq40xx: add support for Cisco Meraki Z3
This commit adds support for the Cisco Meraki Z3. The Z3 is a "teleworker"
device with 802.11ac and an integrated 5 port Gigabit switch.

Z3 hardware info:
* CPU: Qualcomm IPQ4029
* RAM: 512MB DDR3
* Storage: 128 MB (S34ML01G200TFV00)
* Networking: QCA8075 internal switch (5x 1GbE ports)
* WiFi: QCA4019 802.11b/g/n/ac
* USB: 1x USB3.0
* Serial: Internal header (J8, 2.54mm, populated)

Port 5 has POE output (802.3af). The Internet/WAN port is used for tftp booting
in U-Boot.

This device ships with secure boot, and cannot be flashed without
external programmers (TSOP48 NAND and I2C EEEPROM)!

Disassembly:

* Remove the four T8 screws on the bottom of the device under the rubber feet.

* Using a guitar pick or similar plastic tool, insert it on the side between
the bottom case and the side, pry up gently. The plastic bottom has several
latches around the perimeter (but none on the rear by the Ethernet ports).

* The TSOP48 NAND flash (U30, Spansion S34ML01G200TFV00) is located on the
bottom side of the PCB (facing you as you remove the bottom plastic).
To flash, you will need to desolder the TSOP48. Attempts to flash in-circuit
using a 360 clip were unsuccessful.

* The SOIC8 I2C EEPROM (U32, Atmel 24C64) is located on the bottom side of
the PCB (facing you as you remove the bottom plastic). It can be flashed in
circuit using a SOIC8 chip clip.

Installation:

The dumps to flash can be found in this repository:
https://github.com/halmartin/meraki-openwrt-docs/tree/main/z3_gx20

The device has the following flash layout (offsets with OOB data):
```
0x000000000000-0x000000100000 : "sbl1"
0x000000100000-0x000000200000 : "mibib"
0x000000200000-0x000000300000 : "bootconfig"
0x000000300000-0x000000400000 : "qsee"
0x000000400000-0x000000500000 : "qsee_alt"
0x000000500000-0x000000580000 : "cdt"
0x000000580000-0x000000600000 : "cdt_alt"
0x000000600000-0x000000680000 : "ddrparams"
0x000000700000-0x000000900000 : "u-boot"
0x000000900000-0x000000b00000 : "u-boot-backup"
0x000000b00000-0x000000b80000 : "ART"
0x000000c00000-0x000007c00000 : "ubi"
```

* Dump your original NAND (if using nanddump, include OOB data).

* Decompress `u-boot.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `u-boot` portion of NAND from
`0x738000`-`0x948000` (length `0x210000`). Offsets here include OOB data.

* Decompress `ubi.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `ubi` portion of NAND from
`0xc60000`-`0x8400000` (length `0x77a0000`). Offsets here include OOB data.

* Dump your original EEPROM. Change the byte at offset `0x49` to `0x1e`
(originally `0x24`). Remember to re-write the EEPROM with the modified data.
    * This can be done on Linux via the following command:
    `printf "\x1e" | dd of=/tmp/eeprom.bin bs=1 seek=$((0x49)) conv=notrunc`

**Note**: the device will not boot if you modify the board major number and
have not yet overwritten the `ubi` and `u-boot` regions of NAND.

* Resolder the NAND after overwriting the `u-boot` and `ubi` regions.

OpenWrt Installation:

* After flashing NAND and EEPROM with external programmers. Plug an Ethernet
cable into the Internet/WAN port. Power up the device.

* The new U-Boot build uses the space character `" "` (without quotes) to
interrupt boot.

* Interrupt U-Boot and `tftpboot` the OpenWrt initramfs image from your
tftp server
```
dhcp
setenv serverip <your_tftp>
tftpboot openwrt-ipq40xx-generic-meraki_z3-initramfs-uImage.itb
```

* Once booted into the OpenWrt initramfs, created the `ART` ubivol with
the WiFi radio calibration from the mtd partition:
```
cat /dev/mtd10 > /tmp/ART.bin
ubimkvol /dev/ubi0 -N ART -s 524288
ubiupdatevol /dev/ubi0_1 /tmp/ART.bin
```

* `scp` the `sysupgrade` image to
the device and run the normal `sysupgrade` procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_z3-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_z3-squashfs-sysupgrade.bin"
```

* OpenWrt should now be installed on the device.

Signed-off-by: Hal Martin <hal.martin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17026
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-10-19 19:33:18 +02:00
..
airoha airoha: spi: use airoha snfi driver for EN7523 2025-10-10 10:30:10 +02:00
apm821xx apm821xx: sata: refresh config 2025-07-27 18:22:31 +02:00
armsr armsr: Make kernel modules depend on target 2025-07-26 01:11:21 +02:00
at91 treewide: strip trailing whitespace 2025-05-20 00:47:37 +02:00
ath79 targetwide: imagebuilder: add explicit guards around initramfs rules 2025-10-17 10:51:37 +02:00
bcm27xx kernel: bump 6.12 to 6.12.50 2025-10-04 16:18:49 +02:00
bcm47xx treewide: strip trailing whitespace 2025-05-20 00:47:37 +02:00
bcm53xx bcm53xx: modify 180-usb-xhci-add-support-for-performing-fake-doorbell.patch 2025-10-19 16:25:15 +02:00
bcm4908 bcm63xx-cfe: install into image staging dir 2025-04-13 10:44:19 +02:00
bmips treewide: remove of_gpio.h 2025-09-20 12:47:23 +02:00
d1 kernel: remove duplicate PREEMPT settings 2025-06-08 15:59:55 +02:00
econet econet: Add basic USB support with Mass Storage 2025-09-18 22:36:28 +02:00
gemini gemini: Add module for VSC73xx switches 2025-09-15 23:12:56 +02:00
generic kernel: rtl8261n: fix kernel module name 2025-10-18 01:30:13 +02:00
imx kernel: bump 6.6 to 6.6.103 2025-09-01 02:05:24 +02:00
ipq40xx ipq40xx: add support for Cisco Meraki Z3 2025-10-19 19:33:18 +02:00
ipq806x ipq806x: 6.12: adapt OPP patch with upstream changes 2025-10-14 10:27:29 +02:00
ixp4xx ixp4xx: Add back Actiontec MI424WR A/C/D 2025-09-26 23:40:40 +02:00
kirkwood treewide: replace numbers with GPIO_ACTIVE 2025-10-08 14:26:24 +02:00
lantiq generic: 6.12: add pending patch to address PCI sysfs creation entry race 2025-10-14 10:27:30 +02:00
layerscape kernel: bump 6.12 to 6.12.43 2025-08-26 21:35:36 +02:00
loongarch64 loongarch64: switch to Linux 6.12 by default 2025-09-09 00:10:31 +02:00
malta malta: drop 6.6 support 2025-07-20 23:37:37 +02:00
mediatek targetwide: imagebuilder: add explicit guards around initramfs rules 2025-10-17 10:51:37 +02:00
mpc85xx mpc85xx: p1010: kernel: add missing symbol 2025-10-16 22:23:44 +02:00
mvebu treewide: gpio to gpios 2025-10-08 14:26:24 +02:00
mxs mxs: drop 6.6 support 2025-05-24 16:15:53 +02:00
octeon treewide: replace numbers with GPIO_ACTIVE 2025-10-08 14:26:24 +02:00
omap omap: enable 6.12 testing kernel 2025-08-22 20:18:16 +02:00
pistachio treewide: reset-gpio to reset-gpios 2025-10-08 14:26:24 +02:00
qoriq kernel: Activate CONFIG_NET_SWITCHDEV in generic config 2025-03-15 13:54:59 +01:00
qualcommax targetwide: imagebuilder: add explicit guards around initramfs rules 2025-10-17 10:51:37 +02:00
qualcommbe kernel: bump 6.12 to 6.12.45 2025-09-07 11:42:46 +02:00
ramips targetwide: imagebuilder: add explicit guards around initramfs rules 2025-10-17 10:51:37 +02:00
realtek realtek: dsa: rtl931x: Fix port L2 table flushing 2025-10-16 16:35:20 +02:00
rockchip rockchip: add FriendlyElec NanoPi R76S support 2025-10-16 21:39:16 +02:00
sifiveu kernel: remove duplicate PREEMPT settings 2025-06-08 15:59:55 +02:00
siflower treewide: gpio to gpios 2025-10-08 14:26:24 +02:00
starfive kernel: bump 6.12 to 6.12.48 2025-09-21 12:14:36 +02:00
stm32 generic: 6.12: add new config symbols 2025-07-13 15:27:54 +02:00
sunxi sunxi: add F1C100 (arm926ej-s) support 2025-10-06 10:26:56 +02:00
tegra tegra: add 6.12 as testing kernel 2025-07-13 00:49:37 +02:00
uml kernel: bump 6.12 to 6.12.33 2025-06-12 12:42:15 +02:00
x86 x86/64: enable 8250_DW 2025-10-10 10:32:20 +02:00
zynq zynq: disable unused Vitesse PHY 2025-09-08 14:21:50 +02:00
Makefile linux: fix missing default packages in profiles.json 2024-11-17 19:29:06 +01:00