aboutsummaryrefslogtreecommitdiff
path: root/package/firmware/ipq-wifi/Makefile
Commit message (Collapse)AuthorAge
* ipq-wifi: update to version 2024-02-25, remove unused ipq8174 extensionPaweł Owoc2024-02-25
| | | | | | | fc30aee ipq8074: remove regdomain, update regdb and rename MX4200 BDF Remove unused ipq8174 extension Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
* ipq40xx: Add support Netgear LBR20Marcin Gajda2024-02-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | **Netgear LBR20** is a router with two gigabit ethernets , three wifi radios and integrated LTE cat.18 modem. SoC Type: Qualcomm IPQ4019 RAM: 512 MiB Flash: 256 MiB , SLC NAND, 2 Gbit (Macronix MX30LF2G18AC) Bootloader: U-Boot Modem: LTE CAT.18 Quectel EG-18EA , Max. 1.2Gbps downlink / 150Mbps uplink WiFi class AC2200: - radio0 : 5G on QCA9888 , WiFi5- 802.11a/n/ac MU-MIMO 2x2 , 887Mbps , 80MHz - limited for low channels - radio1: 2,4G on IPQ4019 ,WiFi4- 802.11b/g/n MIMO2x2 300Mbps 40Mhz - radio2: 5G on IPQ4019 , WiFi5- 802.11a/n/ac MU-MIMO 2x2 , 887Mbps ,80Mhz - limited for high channels (from 100 up to 165) . Becouse of DFS remember to set country before turning on. Ethernet: 2x1GbE (WAN/LAN1, LAN2) LEDs: section power : green and red , section on top (orbi) drived by TLC59208F: red, green ,blue and white USB ports: No Buttons: 2 Reset and SYNC(WPS) Power: 12 VDC, 2,5 A Connector type: Barrel OpenWRT Installation 1. Simplest way is just do upgrade from webpage with *factory.img 2. You can also do it with standard tool for Netgear's debricking - NMPRFlash 3. Most advanced way is to open device , connect to UART console and : - Prepare OpenWrt initramfs image in TFTP server root (server IP 192.168.1.10) - Connect serial console (115200,8n1) to UART connector - Connect TFTP server to RJ-45 port - Stop in u-Boot and run u-Boot command: > setenv serverip 192.168.1.10 > set fdt_high 0x85000000 > tftpboot 0x83000000 openwrt-ipq40xx-generic-netgear_lbr20-initramfs-zImage.itb > bootm 0x83000000 - Login via ssh - upload or download *sysupgrade.bin ( like wget ... or scp transfer) - Install image via "sysupgrade -n" (like “sysupgrade -n /tmp/openwrt-ipq40xx-generic-netgear_lbr20-squashfs-sysupgrade.bin”) Back to Stock - Download firmware from official Netgear's webpage , it will be *.img file after decompressing. - Use NMRPFlash tool ( detailed insructions on project page https://github.com/jclehner/nmrpflash ) Open the case - Unscrew nuts and remove washers from antenna's conectors. - There are two Torx T10 screws under the label next to antenna conectors. You have to unglue this label from left and right corner to get it - Two parts of shell covers will slide out from eachother , you have to unglue two small rubber pads and namplate sticker on bottom to do that. - PCB is screwed with 4Pcs of Torx T10 screws - Before lifting up PCB remove pigtiles for LTE antennas and release them from PCB and radiator (black and white wires) - On other side of PCB ,in left bottom corner there is already soldered with 4 pins UART connector for console. Counting from left it is +3,3V , TX , RX ,GND (reffer to this picture: https://i.ibb.co/Pmrf9KB/20240116-103524.jpg ) BDF's files are in firmware_qca-wireless https://github.com/openwrt/firmware_qca-wireless/ and in parallel sent to ath10k@lists.infradead.org. Signed-off-by: Marcin Gajda <mgajda@o2.pl>
* ipq-wifi: fix archive hashRobert Marko2024-02-23
| | | | | | | | | It seems that ipq-wifi bump included and incorrect PKG_MIRROR_HASH value, so fix it by using: make package/firmware/ipq-wifi/check FIXUP=1 Fixes: 70fd815e57dc ("qualcommax: ipq807x: add support for Linksys MX5300") Signed-off-by: Robert Marko <robimarko@gmail.com>
* qualcommax: ipq807x: add support for Linksys MX5300Paweł Owoc2024-02-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware specification: ======== SoC: Qualcomm IPQ8072A Flash: 512MB (Winbond W29N04GZBIBA) RAM: 1GB (2x Nanya DDR3L NT5CC256M16ER-EK) Ethernet: 5x 10/100/1000Mbps (Qualcomm QCA8075) WiFi1: 5GHz ac 4x4 (Qualcomm QCA9984 + Skyworks SKY85746-11) - channels 100-169 WiFi2: 5GHz ax 4x4 (Qualcomm QCN5054 + Skyworks SKY85755-11) - channels 36-64 WiFi3: 2.4GHz ax 4x4 (Qualcomm QCN5024 + Skyworks SKY8340-11) IoT: Bluetooth 5, Zigbee and Thread (Qualcomm QCA4024 + Skyworks SE2433T-R) IoT Flash: 4MB (Macronix MX25R3235F) RTC: ST M41T00S LED: 1x RGB status (NXP PCA9633) USB: 1x USB 3.0 Button: WPS, Reset Flash instructions: ======== 1. Manually upgrade firmware using openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin image. More details can be found here: https://www.linksys.com/hk/support-article?articleNum=274497 After first boot check actual partition: - fw_printenv -n boot_part and install firmware on second partition using command in case of 2: - mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin kernel and in case of 1: - mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel 2. Installation using serial connection from OEM firmware (default login: root, password: admin): - fw_printenv -n boot_part In case of 2: - flash_erase /dev/mtd21 0 0 nandwrite -p /dev/mtd21 openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin or in case of 1: - flash_erase /dev/mtd23 0 0 nandwrite -p /dev/mtd23 openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin After first boot install firmware on second partition: - mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin kernel or: - mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel 3. Installation from initramfs image using USB FAT32 formatted drive: Stop u-boot and run: - usb start && fatload usb 0:1 $loadaddr openwrt-qualcommax-ipq807x-linksys_mx5300-initramfs-uImage.itb && bootm $loadaddr Write firmware to the flash from initramfs: - mtd -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin kernel and: - mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel 4. Back to the OEM firmware: - mtd -e kernel -n write FW_MX5300_1.1.9.200251_prod.img kernel and: - mtd -r -e alt_kernel -n write FW_MX5300_1.1.9.200251_prod.img alt_kernel 5. USB recovery: - fw_setenv usbimage 'openwrt-qualcommax-ipq807x-linksys_mx5300-initramfs-uImage.itb' fw_setenv bootusb 'usb start && fatload usb 0:1 $loadaddr $usbimage && bootm $loadaddr' fw_setenv bootcmd 'run bootusb; aq_load_fw && if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi' Notes: ======== IoT device is accesible over spi. Not yet supported. Signed-off-by: Paweł Owoc <frut3k7@gmail.com> Reviewed-by: Robert Marko <robimarko@gmail.com>
* ipq-wifi: add support for 8devices Mango boardMantas Pucka2024-02-21
| | | | | | Add support for .ipq6018 BDF suffix and add Mango board entry Signed-off-by: Mantas Pucka <mantas@8devices.com>
* ipq-wifi: update to Git HEAD (2024-02-19)Mantas Pucka2024-02-21
| | | | | | | 1cc59e1 ipq6018: add 8devices Mango BDF 10279cc ipq40xx:Add support for Netgear LBR20 with two BDF's Signed-off-by: Mantas Pucka <mantas@8devices.com>
* ipq807x: add support for CMCC RM2-6Chukun Pan2024-02-15
| | | | | | | | | | | | | | | | | | Hardware specifications: SoC: Qualcomm IPQ8070A RAM: 512MB of DDR3 Flash: 256MB Micron NAND Ethernet: 2x 1G RJ45 port WiFi1: QCN5024 2x2 2.4GHz WiFi2: QCN5054 2x2 5GHz Fan: 1x GPIO controlled Button: Reset, WPS Flash instructions: Upload factory.bin in stock firmware's upgrade page. Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn> Reviewed-by: Robert Marko <robimarko@gmail.com>
* ipq807x: fix whitespace usagePaweł Owoc2024-01-15
| | | | | | Replace with tab and remove unused whitespaces Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
* ipq-wifi: fix PKG_MIRROR_HASHManuel Fombuena2024-01-08
| | | | | | | Incorrect PKG_MIRROR_HASH introduced on #14356 Fixes: 934873f4514b ("ipq-wifi: bump version to 2024-01-06-71f45cff") Signed-off-by: Manuel Fombuena <mfombuena@innovara.co.uk>
* ipq-wifi: bump version to 2024-01-06-71f45cffManuel Fombuena2024-01-08
| | | | | | | | | | | 673662f ipq8074: add Wallys DR8072V01 BDF 7e8b237 ipq40xx: add ZyXEL WSQ50 QCA4019 BDF 831c1bd ipq40xx: add ZyXEL WSQ50 QCA9984 BDF f9ff251 ipq40xx: add ASUS MAP-AC2200 QCA9888 BDF 71f45cf ipq8074: Update MX4200 BDF Signed-off-by: Manuel Fombuena <mfombuena@innovara.co.uk> Reviewed-by: Robert Marko <robimarko@gmail.com>
* ipq807x: add support for Linksys MX4200 V1 and V2Mohammad Sayful Islam2024-01-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linksys MX4200 is a 802.11ax Tri-band router/AP. Specifications: * CPU: Qualcomm IPQ8174 Quad core Cortex-A53 1.4GHz * RAM: 512MB of DDR3 * Storage: 512Mb NAND * Ethernet: 4x1G RJ45 ports (QCA8075) * WLAN: * 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate * 5GHz: Qualcomm QCN5054 2x2@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate * 5GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate * LED-s: * RGB system led * Buttons: 1x Soft reset 1x WPS * Power: 12V DC Jack Installation instructions: Open Linksys Web UI - http://192.168.1.1/ca or http://10.65.1.1/ca depending on your setup. Login with your admin password. The default password can be found on a sticker under the device. To enter into the support mode, click on the “CA” link and the bottom of the page. Open the “Connectivity” menu and upload the squash-factory image with the “Choose file” button. Click start. Ignore all the prompts and warnings by click “yes” in all the popups. The Wifi radios are turned off by default. To configure the router, you will need to connect your computer to the LAN port of the device. Then you would need to write openwrt to the other partition for it to work - First Check booted partition fw_printenv -n boot_part - Then install Openwrt to the other partition if booted in slot 1: mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4200v(X)-squashfs-factory.bin alt_kernel - If in slot 2: mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4200v(X)-squashfs-factory.bin kernel Replace (X) with your model version either 1 or 2 Signed-off-by: Mohammad Sayful Islam <sayf.mohammad01@gmail.com> Reviewed-by: Robert Marko <robimarko@gmail.com>
* ipq807x: add support for ZTE MF269Chukun Pan2023-12-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware specifications: SoC: Qualcomm IPQ8071A RAM: 512MB of DDR3 Flash1: Eon EN25S64 8MB Flash2: MX30UF2G18AC 256MB Ethernet: 2x 2.5G RJ45 port Phone: 1x RJ11 port (SPI) USB: 1x Type-C 2.0 port WiFi1: QCN5024 2.4GHz WiFi2: QCN5054 5GHz Button: Reset, WPS Flash instructions: 1. Connect the router via serial port (115200 8N1 1.8V) 2. Download the initramfs image, rename it to initramfs.bin, and host it with the tftp server. 3. Interrupt U-Boot and run these commands: tftpboot initramfs.bin bootm 4. After openwrt boots up, use scp or luci web to upload sysupgrade.bin to upgrade. Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn> Reviewed-by: Robert Marko <robimarko@gmail.com>
* ipq807x: add Arcadyan AW1000 supportChukun Pan2023-12-13
| | | | | | | | | | | | | | | | | | | | | | | | | | Hardware specification: SoC: Qualcomm IPQ8072A Flash: Toshiba NAND 1GiB RAM: 1 GiB of DDR3 466 MHz Ethernet: 4x 1Gbps + 1x 2.5Gbps WiFi1: QCN5024 2.4GHz ax 4x4 WiFi2: QCN5054 5GHz ax 4x4 Button: WiFi, WPS, Reset Modem: RG500Q-EA USB: 1 x USB 3.0 Power: DC 12V 4A Flash instructions: 1. Download the initramfs image, rename it to initramfs.bin, and host it with tftp server. 2. Interrupt U-Boot and run these commands: tftpboot initramfs.bin bootm 3. After openwrt boots up, use scp or luci web to upload sysupgrade.bin to upgrade. Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn> Reviewed-by: Robert Marko <robimarko@gmail.com>
* ipq-wifi: update to Git HEAD (2023-11-10)Christian Marangi2023-11-10
| | | | | | 0c2e810e71ed qcn9074: fix prpl Foundation Haze BDF for old mac80211 version Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* ipq807x: add support for Yuncore AX880Isaev Ruslan2023-11-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SPECIFICATION: - Chipset: IPQ8072A +QCN5054+QCN5024+QCA8081*2 - Flash NOR-8MB AND NAND-128MB - RAM 1Gb DDR - IEEE 802.11: 802.11ax/ac/b/g/n - 4*4 2.4G Wi-Fi standard 802.11b/g/n/ax - 4*4 5.8G Wi-Fi Standard 802.11 a/n/ac/ax - 2x 1 Gbps Ethernet (QCA8081) with 802.3at PoE input support - 1x Reset - 1x Bluetooth(optional) - 1x DC Port 12V 3A - 4x Antenna IPEX Connector, 3dBi omni antennas - Data Rate: 3657Mbps ( 2.4G: 1182Mbps (11ax 4x4); 5.8G: 2475Mbps (11ax 4x4)) - RF Power: 2.4g ≤ 20dBm; 5.8g ≤ 19dBm - LED light: Sys; 5.8G wifi; 2.4G wifi; WAN; LAN - Max Power Consumption: ≤ 22W - Size: 198mm * 198mm * 41.02mm BACKUP YOUR STOCK FIRMWARE: ``` export device=ax880 mkdir -p /tmp/fw_dump_$device cd /tmp/fw_dump_$device dmesg > dmesg_$device.log dtc -I fs /sys/firmware/devicetree/base > $device.dts cat /proc/device-tree/model > model cat /proc/mtd > proc_mtd while read p; do mtd_dev=$(echo $p | cut -d: -f1) echo $mtd_dev dd if=/dev/$mtd_dev of=$mtd_dev done < proc_mtd md5sum * > md5sum.log tar -cvzf ../$device.tar.gz . export sum=$(md5sum /tmp/$device.tar.gz | cut -d' ' -f1) mv ../$device.tar.gz /tmp/${device}_${sum}.tar.gz echo fw backup saved to: /tmp/${device}_${sum}.tar.gz ``` Upload your backup via tftp to the safe place. INSTALLATION: 1. stock firmware web ui Rename factory.bin fw image file to factory.ubin. Flash this image like ordinary stock fw upgrade. 2. stock firmware telnet method Enter telnet cli (login: root, password: 476t*_f0%g09y) and upload factory.bin fw image and rename it to factory.ubin `cd /tmp && wget <your_web_server_ip>/factory.ubin` `sysupgrade factory.ubin 3. initramfs method Put openwrt-ipq807x-generic-yuncore_ax880-initramfs-uImage.itb to your TFTP server and rename it to ax880.initram Enable serial console and enter to the u-boot cli. Exec these commands: `tftpboot <your_tftp_server_ip>:ax880.initram` `dhcp` When downloading is finished: `bootm` After booting the device, you need to upload to the device factory.ubi fw image. ``` cd /tmp && wget <your_web_server_ip>/factory.ubi` export rootfs=$(cat /proc/mtd | grep rootfs | cut -d: -f1) export rootfs_1=$(cat /proc/mtd | grep rootfs_1 | cut -d: -f1) ubiformat /dev/${rootfs} -y -f factory.ubi ubiformat /dev/${rootfs_1} -y -f factory.ubi reboot ``` 4. u-boot factory.ubi image method Put openwrt-ipq807x-generic-yuncore_ax880-squashfs-factory.ubi to your TFTP server and rename it to ax880.ubi Enter u-boot cli and exec these commands: `tftpboot <your_tftp_server_ip>:ax880.ubi` `dhcp` After downloading is finished: `flash rootfs` `flash rootfs_1` `reset` 5. u-boot factory.bin method Put openwrt-ipq807x-generic-yuncore_ax880-squashfs-factory.bin to your TFTP server and rename it to ax880.bin Enter u-boot cli and exec these commands: `tftpboot <your_tftp_server_ip>:ax880.bin` `dhcp` After downloading is finished: `imgaddr=$fileaddr && nand device 0` Erase rootfs memory: `nand erase 0x00000000 0x03400000` Write rootfs: `nand write $fileaddr 0x00000000 $filesize` Erase rootfs_1 memory: `nand erase 0x3c00000 0x3400000` Write rootfs_1 `nand write $fileaddr 0x3c00000 $filesize` `reset` STOCK FIRMWARE RECOVERY: Boot initramfs image. Upload your rootfs mtd partition to the device using scp or download it from the device using wget. Enter device ssh cli and exec: ``` cd /tmp && wget <your_web_server_ip>/mtd21` export rootfs=$(cat /proc/mtd | grep rootfs | cut -d: -f1) export rootfs_1=$(cat /proc/mtd | grep rootfs_1 | cut -d: -f1) ubiformat /dev/${rootfs} -y -f /tmp/mtd21 ubiformat /dev/${rootfs_1} -y -f /tmp/mtd21 reboot ``` Signed-off-by: Isaev Ruslan <legale.legale@gmail.com> Reviewed-by: Robert Marko <robimarko@gmail.com>
* ipq-wifi: update to version 2023-10-12Kristian Skramstad2023-10-28
| | | | | | | | | Contains the following update: 52a1c29 ipq8074: add Netgear WAX630 Board file for Netgear WAX630. Extracted from stock (WAX630_BDF.bin) firmware and repacked. e7701b8 ipq8074: update RegDB in new submitted BDF cd04ab7 qcn9074: update RegDB in new submitted BDF Signed-off-by: Kristian Skramstad <kristian+github@83.no>
* ipq-wifi: improve and update instructions on how to add board filesChristian Marangi2023-10-02
| | | | | | | Improve and update instructions on how to add board files and both describe the needed step to upstream a board file or to use it locally. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* ipq807x: add support for Netgear WAX620Kristian Skramstad2023-09-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ``` Specifications: * CPU: Qualcomm IPQ8072A, SoC Version: 2.0, Quad core Cortex-A53 1.6896 GHz * RAM: 1 GiB of DDR4 600 MHz * Flash: NAND 2x256 MiB (Macronix MX30UF2G18AC) * 4 RGB LEDs: Power, LAN, 2.4GHz and 5GHz * UART: Two 4-pin unpopulated headers under the LEDs. Use the header closest to LED 4 and 5. They are marked with a white stroke. TX RX GND, beginning from "4". 115200n8. Lan: * One 100/1000/2.5GBASE-T Gigabit Ethernet (QCA8081) Wlan: * 4x4 in 2.4GHz: 802.11b/g/n/ax * 4x4 in 5.0GHz: 802.11a/n/ac/ax * OFDM and OFDMA * Bidir and MU-MIMO * Internal antenna 3.1/4.3 dBi (2.4GHz/5GHz) Power: * PoE+ 802.3at/af 25.5W * DC 12V 2.5A ``` ``` Note: The OpenWrt image is setup with DHCP and not a static IP. 1. Download the OpenWrt initramfs image. Copy the image to a TFTP server 2. Connect to console on the AP, and connect the LAN port to your LAN 3. Stop auto boot to get to U-boot shell, interrupt the autoboot process by pressing '0' when prompted 4. Set active_fw in env # setenv active_fw 1 5. Transfer the initramfs image with TFTP # setenv serverip 192.168.1.10 (IP of TFTP server host) # setenv ipaddr 192.168.1.1 (IP used by the router for getting the image, must be in the same subnet as the TFTP host) # tftpboot openwrt-qualcommax-ipq807x-netgear_wax620-initramfs-uImage.itb 6. Reboot and load the image # bootm 7. SCP factory image to the AP # scp openwrt-qualcommax-ipq807x-netgear_wax620-squashfs-factory.ubi root@192.168.1.1:/tmp/ 8. Connect to device using SSH (use the LAN port) 9. Flash squashfs-factory.ubi from within the initramfs instance of OpenWRT Before you flash, please check your mtd partitions where mtdX is the right mtd rootfs partition. # cat /proc/mtd (To check MTD partitions) # ubiformat /dev/mtd19 -y -f /tmp/openwrt-qualcommax-ipq807x-netgear_wax620-squashfs-factory.ubi 10. Set active_fw to 0 # /usr/sbin/fw_setenv active_fw 0 11. Reboot the AP and your done # reboot ``` Signed-off-by: Kristian Skramstad <kristian+github@83.no>
* ipq40xx: refactor ZTE MF287 seriesAndreas Böhler2023-09-19
| | | | | | | | The ZTE MF287 requires a different board calibration file for ath10k than the ZTE MF287+. The two devices receive their own DTS, thus the device tree is slightly refactored. Signed-off-by: Andreas Böhler <dev@aboehler.at>
* ipq-wifi: update to version 2023-09-16Chukun Pan2023-09-18
| | | | | | | | | | | | | Contains following updates: * ipq8074: add Asus RT-AX89X BDF * ipq8074: update RegDB in new submitted BDF * ipq40xx: add YYeTs LE1 BDF * ipq8074: add Netgear WAX620 * qca-wireless: ipq40xx: add BDFs for ZTE MF287 * ipq8174: Add Linksys MX4200 Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
* ipq807x: add support for Netgear RAX120v2Thomas Kupper2023-08-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Netgear Nighthawk RAX120v2 AX WIFI router with 5 1G and 1 5G ports. The majority of the code is based on @jewwest's PR #11830. Specifications: * CPU: Qualcomm IPQ8074 Quad core Cortex-A53 2.2GHz * RAM: 1024MB of DDR3 (Nanya NT5CC256M16EP-EK × 2) * Flash: SPI-NAND 512 MiB (Winbond W29N04GZBIBA) * Ethernet: 4x 10/100/1000 Mbps LAN, 1x 10/100/1000 Mbps WAN (Qualcomm QCA8075), 1x 10/100/1000/2500/5000 Mbps LAN/WAN (Aquantia AQR111B0 PHY) * Wi-Fi: * 2.4 GHz: Qualcomm QCN5024 4x4 * 2x 5 GHz: Qualcomm QCN5054 4x4 * USB: 2x USB 3.0 * LEDs: Power, 2.4GHz & 5GHz Radio, WPS, WAN, USB1 & USB2, 5G LAN * Keys: LEDs On/Off, Power, Reset, RFKILL, WPS * UART: Marked J9003 VCC TX RX GND, beginning from "1". 3.3v, 115200n8 * Power: 19 VDC, 3.1 A Installation: * Flashing OpenWrt is done in two steps: a) Flash *-squashfs-web-ui-factory.img from stock UI (thanks to @wangyu-). This writes an initramfs based OpenWrt image onto the RAX120v2 b) From OpenWrt flash the *-squashfs-sysupgrade.bin using LuCI or the commandline * U-Boot allows booting an initramfs image via TFTP: - Set ip of your PC to 192.168.1.100 - At the serial console interrupt boot at "Hit any key to stop autoboot:" - In u-boot run `tftpsrv` - On your PC send the OpenWrt initramfs image: tftp 192.168.1.1 -m binary -c put openwrt-ipq807x-generic-netgear_rax120v2-initramfs-uImage.itb Make 5G Aquantia phy work: For the 5G port labeled 'lan5' to work a firmware is needed. This can be loaded in u-boot by writing the firmware to the correct mtd partition. The firmware file found in the Netgear stock firmware under /lib/firmware/ named 'AQR-G3_v4.3.C-AQR_DNI_DR-EQ35AX8-R-prov1_ID23888_VER1311.cld' is needed and has to be converted to a MBN file. The `mkheader.py` script used here can be found in the Netgear V1.2.8.40 GPL source, under 'git_home/u-boot.git/tools/mkheader.py' Convert the CLD file to MBN using: $ python2 mkheader.py 0x44000000 0x13 <*.cld file> aqr_4.3.C.mbn This MBN file can then be flashed to the MTD partition to be used by u-boot. The necessary files can also be found in https://github.com/boretom/openwrt-fork/tree/rax120v2/aquantia-firmware * Write MBN file to MTD partition to be loaded automatically by u-boot: U-boot automatically tries to load the firmware from nand at address 0x7e00000 which corresponds to `/dev/mtd25` in OpenWrt. - find ETHPHYFW partition while running OpenWrt (expected: /dev/mtd25) $ fgrep -i 'ethphyfw' /proc/mtd mtd25: 00080000 00020000 "ethphyfw - copy mbn file to /tmp/ folder of the router $ scp aqr-v4.3.C.mbn 192.168.1.1:/tmp/ - write mbn file to ethphyfw partition $ mtd write /tmp/aqr_v4.3.C.mbn /dev/mtd25 Revert to stock firmware: * Flash the stock firmware to the bootloader using TFTP/NMRP. References to RAX120v2 GPL source: https://www.downloads.netgear.com/files/GPL/RAX120-V1.2.8.40_gpl_src.zip Reviewed-by: Robert Marko <robimarko@gmail.com> Signed-off-by: Thomas Kupper <thomas.kupper@gmail.com>
* ipq-wifi: fix upstream board-2.bin ZTE M289F snafuChristian Lamparter2023-07-04
| | | | | | | | | | | | | | | | | | | | The upstream board-2.bin file in the linux-firmware.git repository for the QCA4019 contains a packed board-2.bin for this device for both 2.4G and 5G wifis. This isn't something that the ath10k driver supports. Until this feature either gets implemented - which is very unlikely -, or the upstream boardfile is mended (both, the original submitter and ath10k-firmware custodian have been notified). OpenWrt will go back and use its own bespoke boardfile. This unfortunately means that 2.4G and on some revisions the 5G WiFi is not available in the initramfs image for this device. Fixes: #12886 Reported-by: Christian Heuff <christian@heuff.at> Debugged-by: Georgios Kourachanis <geo.kourachanis@gmail.com> Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* ipq4019: add support for ZTE MF287+ aka DreiNeoAndreas Böhler2023-06-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ZTE MF287+ is a LTE router used (exclusively?) by the network operator "3". The MF287 (i.e. non-plus aka 3Neo) is also supported (the only difference is the LTE modem) Specifications ============== SoC: IPQ4018 RAM: 256MiB Flash: 8MiB SPI-NOR + 128MiB SPI-NAND LAN: 4x GBit LAN LTE: ZTE Cat12 (MF287+) / ZTE Cat6 (MF287) WiFi: 802.11a/b/g/n/ac SoC-integrated MAC addresses ============= LAN: from config + 2 WiFi 1: from config WiFi 2: from config + 1 Installation ============ Option 1 - TFTP --------------- TFTP installation using UART is preferred. Disassemble the device and connect serial. Put the initramfs image as openwrt.bin to your TFTP server and configure a static IP of 192.168.1.100. Load the initramfs image by typing: setenv serverip 192.168.1.100 setenv ipaddr 192.168.1.1 tftpboot 0x82000000 openwrt.bin bootm 0x82000000 From this intiramfs boot you can take a backup of the currently installed partitions as no vendor firmware is available for download: ubiattach -m14 cat /dev/ubi0_0 > /tmp/ubi0_0 cat /dev/ubi0_1 > /tmp/ubi0_1 Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save. Once booted, transfer the sysupgrade image and run sysupgrade. You might have to delete the stock volumes first: ubirmvol /dev/ubi0 -N ubi_rootfs ubirmvol /dev/ubi0 -N kernel Option 2 - From stock firmware ------------------------------ The installation from stock requires an exploit first. The exploit consists of a backup file that forces the firmware to download telnetd via TFTP from 192.168.0.22 and run it. Once exploited, you can connect via telnet and login as admin:admin. The exploit will be available at the device wiki page. Once inside the stock firmware, you can transfer the -factory.bin file to /tmp by using "scp" from the stock frmware or "tftp". ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write access - you need to read from one file in /proc. Once done, you need to erase the UBI partition and flash OpenWrt. Before performing the operation, make sure that mtd13 is the partition labelled "rootfs" by calling "cat /proc/mtd". Complete commands: cd /tmp tftp -g -r factory.bin 192.168.0.22 cat /proc/driver/sensor_id flash_erase /dev/mtd13 0 0 dd if=/tmp/factory.bin of=/dev/mtdblock13 bs=131072 Afterwards, reboot your device and you should have a working OpenWrt installation. Restore Stock ============= Option 1 - via UART ------------------- Boot an OpenWrt initramfs image via TFTP as for the initial installation. Transfer the two backed-up files to your box to /tmp. Then, run the following commands - replace $kernel_length and $rootfs_size by the size of ubi0_0 and ubi0_1 in bytes. ubiattach -m 14 ubirmvol /dev/ubi0 -N kernel ubirmvol /dev/ubi0 -N rootfs ubirmvol /dev/ubi0 -N rootfs_data ubimkvol /dev/ubi0 -N kernel -s $kernel_length ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0 ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1 Option 2 - from within OpenWrt ------------------------------ This option requires to flash an initramfs version first so that access to the flash is possible. This can be achieved by sysupgrading to the recovery.bin version and rebooting. Once rebooted, you are again in a default OpenWrt installation, but no partition is mounted. Follow the commands from Option 1 to flash back to stock. LTE Modem ========= The LTE modem is similar to other ZTE devices and controls some more LEDs and battery management. Configuring the connection using uqmi works properly, the modem provides three serial ports and a QMI CDC ethernet interface. Signed-off-by: Andreas Böhler <dev@aboehler.at>
* ipq807x: rename target to qualcommaxRobert Marko2023-06-16
| | | | | | | | | | | | | Currently, ipq807x only covers Qualcomm IPQ807x SoC-s. However, Qualcomm also has IPQ60xx and IPQ50xx SoC-s under the AX WiSoC-s and they share a lot of stuff with IPQ807x, especially IPQ60xx so to avoid duplicating kernel patches and everything lets make a common target with per SoC subtargets. Start doing that by renaming ipq807x to qualcommax so that dependencies on ipq807x target can be updated. Signed-off-by: Robert Marko <robimarko@gmail.com>
* ipq-wifi: update to version 2023-06-03Petr Štetiar2023-06-10
| | | | | | | | | | | | | Contains following updates: * ipq8074: update RegDB in new submitted BDF * Revert "ipq8074: update RegDB in new submitted BDF" * qcn9074: update RegDB in new submitted BDF * ipq8074: update RegDB in new submitted BDF * qca-wireless: ipq40xx: add BDFs for ZTE MF287+ * Add BDFs for prpl Foundation Haze board Signed-off-by: Petr Štetiar <ynezz@true.cz>
* Revert "ipq-wifi: add board files for prpl Foundation Haze board"Petr Štetiar2023-06-05
| | | | | | | This reverts commit 6845c53ec3bb25dbbb0e8bbcf435fc380502fc56. as this was commited by accident, its still work in progress. Signed-off-by: Petr Štetiar <ynezz@true.cz>
* Revert "WIP: ipq-wifi: use my fork temporarily until upstreamed"Petr Štetiar2023-06-05
| | | | | | | This reverts commit 1bad93c42669061b0248ca5cff1d83e399a2ef1a as this was commited by accident, its still work in progress. Signed-off-by: Petr Štetiar <ynezz@true.cz>
* WIP: ipq-wifi: use my fork temporarily until upstreamedPetr Štetiar2023-06-05
| | | | Signed-off-by: Petr Štetiar <ynezz@true.cz>
* ipq-wifi: add board files for prpl Foundation Haze boardPetr Štetiar2023-06-05
| | | | | | | | | | | | QSDK based factory firmware was setting following board_ids in DTS: ath11k_pci 0001:01:00.0: chip_id 0x0 chip_family 0x0 board_id 0xa4 soc_id 0xffffffff ath11k c000000.wifi1: chip_id 0x0 chip_family 0x0 board_id 0x294 soc_id 0xffffffff Thus board-prpl_haze.qcn9074` was extracted from `bus=...qmi-board-id=164.bin` file and `board-prpl_haze.ipq8074` from `bus=...qmi-board-id=660.bin` file. Signed-off-by: Petr Štetiar <ynezz@true.cz>
* ipq-wifi: bump to latest git HEADAntti Nykänen2023-05-26
| | | | | | | | | | 0f73d32 ipq8074: update RegDB in new submitted BDF a4cd21f ipq8074: add Compex WPQ873 BDF c888dd0 qca-wireless: ipq40xx: Add BDFs for Eero Cento 6388ba9 ipq8074: update regdb for Netgear SXK80 BDF 77775d2 ipq8074: add Netgear SXK80 Signed-off-by: Antti Nykänen <antti.nykanen@nokia.com>
* ipq-wifi: drop upstreamed board-2.binChristian Lamparter2023-05-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The BDFs for the: Aruba AP-365 Devolo Magic 2 WiFi next Edgecore ECW5410 Edgecore OAP100 Extreme Networks WS-AP3915i GL.iNet GL-A1300 GL.iNet GL-AP1300 GL.iNet GL-S1300 Linksys EA8300 Linksys WHW03v2 Nokia Wi4A AC400i P&W R619AC Pakedge WR-1 Qxwlan E2600AC C1 Sony NCP-HG100/Cellular Teltonika RUTX10 ZTE MF18A were upstreamed to the ath10k-firmware repository and landed in linux-firmware.git. Furthermore the BDFs for the: 8devices Habanero 8devices Jalapeno Qxwlan E2600AC C2 have been updated. Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* ipq-wifi: bump to latest git HEADChristian Marangi2023-04-12
| | | | | | | | b22487d ath11k: qcn8074: Update regDb in every BDF 3add8be ath11k: ipq8074: Update regDb in every BDF 8bb6039 ath11k: ipq8074: add Netgear RAX120v2 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* ipq-wifi: bump to latest git HEADChristian Marangi2023-03-27
| | | | | | | | ccd7e46 ipq40xx: add support for Wallystech DR40x9 2ce60e1 Revert "ipq40xx: add support for Wallystech DR40x9" ea962ca ipq40xx: add Emplus WAP551 BDF Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* ipq40xx: add support for Wallystech DR40x9Robert Marko2023-03-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds support for the Wallys DR40x9 series boards. They come in IPQ4019 and IPQ4029 versions. IPQ4019/4029 only differ in that that IPQ4029 is the industrial version that is rated to higher temperatures. Specifications are: * CPU: Qualcomm IPQ40x9 (4x ARMv7A Cortex A7) at 716 MHz * RAM: 512 MB * Storage: 2MB of SPI-NOR, 128 MB of parallel NAND * USB 3.0 TypeA port for users * MiniPCI-E with PCI-E 2.0 link * MiniPCI-E for LTE modems with only USB2.0 link * 2 SIM card slots that are selected via GPIO11 * MicroSD card slot * Ethernet: 2x GBe with 24~48V passive POE * SFP port (Does not work, I2C and GPIO's not connected on hardware) * DC Jack * UART header * WLAN: In-SoC 2x2 802.11b/g/n and 2x2 802.11a/n/ac * 4x MMCX connectors for WLAN * Reset button * 8x LED-s Installation instructions: Connect to UART, pins are like this: -> 3.3V | TX | RX | GND Settings are 115200 8n1 Boot initramfs from TFTP: tftpboot 0x84000000 openwrt-ipq40xx-generic-wallys_dr40x9-initramfs-fit-uImage.itb bootm Then copy the sysupgrade image to the /tmp folder and execute sysupgrade -n <image_name> The board file binary was provided from Wallystech on March 14th 2023 including full permission to use and distribute. Signed-off-by: Robert Marko <robert.marko@sartura.hr> Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
* ipq-wifi: bump to latest git HEADKoen Vandeputte2023-03-21
| | | | | | f9cece0 ipq40xx: add support for Wallystech DR40x9 Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
* ipq807x: add support for Netgear WAX218Alexandru Gagniuc2023-03-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Netgear WAX218 is a 802.11ax AP claiming AX3600 support. It is wall or ceiling mountable. It can be powered via PoE, or a 12 V adapter. The board has footprints for 2.54mm UART headers. They're difficult to solder because the GND is connected to a large copper plane. Only try soldering if you are very skilled. Otherwise, use pogo pins. Specifications: --------------- * CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz * RAM: 366 MB of RAM available to OS, not sure of total amount * Storage: Macronix MX30UF2G18AC 256MB NAND * Ethernet: * 2.5G RJ45 port (QCA8081) with PoE input * WLAN: * 2.4GHz/5GHz with 8 antennas * LEDs: * Power (Amber) * LAN (Blue) * 2G WLAN (Blue) * 5G WLAN (Blue) * Buttons: * 1x Factory reset * Power: 12V DC Jack * UART: Two 4-pin unpopulated headers near the LEDs * "J2 UART" is the CPU UART, 3.3 V level Installation: ============= Web UI method ------------- Flashing OpenWRT using the vendor's Web UI is problematic on this device. The u-boot mechanism for communicating the active rootfs is antiquated and unreliable. Instead of setting the kernel commandline, it relies on patching the DTS partitions of the nand node. The way partitions are patched is incompatible with newer kernels. Newer kernels use the SMEM partition table, which puts "rootfs" on mtd12. The vendor's Web UI will flash to either mtd12 or mtd14. One reliable way to boot from mtd14 and avoid boot loops is to use an initramfs image. 1. In the factory web UI, navigate to System Manager -> Firmware. 2. In the "Local Firmware Upgrade" section, click Browse 3. Navigate and select the 'web-ui-factory.fit' image 4. Click "Upload" 5. On the following page, click on "Proceed" The flash proceeds at this point and the system will reboot automatically to OpenWRT. 6. Flash the 'nand-sysupgrade.bin' using Luci or the commandline SSH method ---------- Enable SSH using the CLI or Web UI. The root account is locked out to ssh, and the admin account defaults to Netgear's CLI application. So we need to get creative: First, make sure the device boots from the second firmware partition: ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \ /usr/sbin/fw_setenv active_fw 1 Then reboot the device, and run the update: scp -O -o kexalgorithms=diffie-hellman-group14-sha1 \ -o hostkeyalgorithms=ssh-rsa \ netgear_wax218-squashfs-nand-factory.ubi \ admin@<ipaddr>:/tmp/openwrt.ubi ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \ /usr/sbin/ubiformat /dev/mtd12 -f /tmp/openwrt.ubi ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \ /usr/sbin/fw_setenv active_fw 0 Now reboot the device, and it should boot into a ready-to-use OpenWRT. Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com> Reviewed-by: Robert Marko <robimarko@gmail.com> Tested-by: Francisco G Luna <frangonlun@gmail.com>
* ipq-wifi: bump to latest git HEADKristjan Krušič2023-03-19
| | | | | | | 31ff96d ipq806x: add support for Nokia Airscale AC400i 1af1df2 ath11k: ipq8074: add Netgear WAX218 Signed-off-by: Kristjan Krušič <kristjan.krusic@krusic22.com>
* ipq806x: add support for Nokia Airscale AC400iKristjan Krušič2023-03-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware -------- SoC: Qualcomm IPQ8065 RAM: 512 MB DDR3 Flash: 256 MB NAND (Macronix MX30UF2G18AC) (split into 2x128MB) 4 MB SPI-NOR (Macronix MX25U3235F) WLAN: Qualcomm Atheros QCA9984 - 2.4Ghz Qualcomm Atheros QCA9984 - 5Ghz ETH: eth0 - POE (100Mbps in U-Boot, 1000Mbps in OpenWrt) eth1 - (1000Mbps in both) Auto-negotiation broken on both. USB: USB 2.0 LED: 5G, 2.4G, ETH1, ETH2, CTRL, PWR (All support green and red) BTN: Reset Other: SD card slot (non-functional) Serial: 115200bps, near the Ethernet transformers, labeled 9X. Connections from the arrow to the 9X text: [NC] - [TXD] - [GND] - [RXD] - [NC] Installation ------------ 0. Connect to the device Plug your computer into LAN2 (1000Mbps connection required). If you use the LAN1/POE port, set your computer to force a 100Mbps link. Connect to the device via TTL (Serial) 115200n8. Locate the header (or solder pads) labeled 9X, near the Ethernet jacks/transformers. There should be an arrow on the other side of the header marking. The connections should go like this: (from the arrow to the 9X text): NC - TXD - GND - RXD - NC 1. Prepare for installation While the AP is powering up, interrupt the startup process. MAKE SURE TO CHECK YOUR CURRENT PARTITION! If you see: "Current Partition is : partB" or "Need to switch partition from partA to partB", you have to force the device into partA mode, before continuing. This can be done by changing the PKRstCnt to 5 and resetting the device. setenv PKRstCnt 5 saveenv reset After you interrupt the startup process again, you should see: Need to switch partition from partB to partA You can now continue to the next step. If you see: "Current Partition is : partA", you can continue to the next step. 2. Prevent partition switching. To prevent the device from switching partitions, we are going to modify the startup command. set bootcmd "setenv PKRstCnt 0; saveenv; bootipq" setenv 3. First boot Now, we have to boot the OpenWrt intifs. The easiest way to do this is by using Tiny PXE. You can also use the normal U-Boot tftp method. Run "bootp" this will get an IP from the DHCP server and possibly the firmware image. If it doesn't download the firmware image, run "tftpboot". Now run "bootm" to run the image. You might see: "ERROR: new format image overwritten - must RESET the board to recover" this means that the image you are trying to load is too big. Use a smaller image for the initial boot. 4. Install OpenWrt from initfs Once you are booted into OpenWrt, transfer the OpenWrt upgrade image and use sysupgrade to install OpenWrt to the device. Signed-off-by: Kristjan Krušič <kristjan.krusic@krusic22.com>
* ipq-wifi: bump to latest git HEADChristian Marangi2023-03-18
| | | | | | 86180c4 ath10k-firmware: IPQ4019 hw1.0: Rename variant to ZTE MF18A specific BDF Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* ipq-wifi: bump to latest git HEADChristian Marangi2023-03-18
| | | | | | | 1f35a8c ath10k-firmware: IPQ4019 hw1.0: Add variant to Teltonika RUTX10 specific BDF a49672f ath10k-firmware: QCA99X0 hw2.0: Add variant to ZTE MF18A specific BDF Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* ipq-wifi: bump to latest git HEAD and add 8devices boardsMantas Pucka2023-03-17
| | | | | | | | | 2dae618 ipq-wifi: update 8devices Jalapeno BDF 08e92db ipq-wifi: update 8devices Habanero BDF Signed-off-by: Mantas Pucka <mantas@8devices.com> [ split ipq40xx changes in separate commit ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* firmware: ipq-wifi: use project branch and drop local fileChristian Marangi2023-03-15
| | | | | | | Source BDF files out of project dedicated repository and drop local file from openwrt main repository. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* ipq807x: add support for Buffalo WXR-5950AX12INAGAKI Hiroshi2023-02-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Buffalo WXR-5950AX12 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on IPQ8074A. Specification: - SoC : Qualcomm IPQ8074A - RAM : DDR3 1024 MiB (2x Nanya NT5CC256M16ER-EK) - Flash : RAW NAND 256 MiB (Winbond W29N02GZBIBA) - WLAN : 2.4/5 GHz (IPQ8074A) - Ethernet : 5 ports - WAN : 100/1000/2500/10000 Mbps x1 (AQR113C) - LAN : 100/1000/2500/10000 Mbps x1 (AQR113C), 10/100/1000 Mbps x3 (QCA8075) - LED/Keys : 8x/5x - UART : pin header on PCB (J7) - assignment: 3.3V, GND, TX, RX from disc marking - settings : 115200n8 - Power : 12 VDC, 4 A Flash instruction using initramfs image: 1. Prepare TFTP server with IP address 192.168.11.10 2. Rename OpenWrt initramfs image to "WXR-5950AX12-initramfs.uImage and place it to TFTP directory 3. Hold AOSS (WPS) button and power on WXR-5950AX12 4. WXR-5950AX12 downloads initramfs image from TFTP server and boots with it automatically 5. Upload sysupgrade image to WXR-5950AX12 and perform sysupgrade 6. Wait ~120 seconds to complete flashing Partition layout: 0x000000000000-0x000000100000 : "0:sbl1" 0x000000100000-0x000000200000 : "0:mibib" 0x000000200000-0x000000280000 : "0:bootconfig" 0x000000280000-0x000000300000 : "0:bootconfig1" 0x000000300000-0x000000600000 : "0:qsee" 0x000000600000-0x000000900000 : "0:qsee_1" 0x000000900000-0x000000980000 : "0:devcfg" 0x000000980000-0x000000a00000 : "0:devcfg_1" 0x000000a00000-0x000000a80000 : "0:apdp" 0x000000a80000-0x000000b00000 : "0:apdp_1" 0x000000b00000-0x000000b80000 : "0:rpm" 0x000000b80000-0x000000c00000 : "0:rpm_1" 0x000000c00000-0x000000c80000 : "0:cdt" 0x000000c80000-0x000000d00000 : "0:cdt_1" 0x000000d00000-0x000000d80000 : "0:appsblenv" 0x000000d80000-0x000000e80000 : "0:appsbl" 0x000000e80000-0x000000f80000 : "0:appsbl_1" 0x000000f80000-0x000001000000 : "0:art" 0x000001000000-0x000001080000 : "0:art_1" 0x000001080000-0x000001100000 : "0:orgdata" 0x000001100000-0x000001180000 : "0:orgdata_1" 0x000001180000-0x000005180000 : "rootfs" 0x000005180000-0x000009180000 : "rootfs_recover" 0x000009180000-0x000010000000 : "user_property" Notes: - WXR-5950AX12 has 2x OS images on NAND flash. The 1st image is for normal operation and the 2nd one is for recoverying or firmware upgrading on stock. - Stock U-Boot checks MD5 hashes in "fw_hash" volume in each "root*" partition when booting. This is just a comparation of hash strings. Behaviors: - both "fw_hash" volumes exist, hashes are rootfs == rootfs_recover ---> boot from rootfs - both "fw_hash" volumes exist, hashes are rootfs != rootfs_recover ---> boot from rootfs_recover Note: this behavior is used for firmware upgrading on stock - "fw_hash" volume in rootfs is missing ---> boot from rootfs_recover - "fw_hash" volume in rootfs_recover is missing ---> boot from rootfs - "fw_hash" volumes in both root* partition are missing ---> boot from rootfs_recover Reverting to stock firmware: 1. Decrypt official image by buffalo-enc and remove header example of decryption: $ buffalo-enc -i wxr_5950ax12_jp_305 -o wxr_5950ax12_jp_305.dec \ -d -k olaffuB -O 0xc8 example of removing header (v3.05): - before $ hexdump -n 64 -v -C wxr_5950ax12_jp_305.dec 00000000 57 58 52 2d 35 39 35 30 41 58 31 32 5f 33 2e 30 |WXR-5950AX12_3.0| 00000010 35 5f 31 2e 30 31 5f 4a 50 5f 6a 70 5f 71 63 61 |5_1.01_JP_jp_qca| 00000020 0a 66 69 6c 65 6c 65 6e 3d 34 35 33 35 30 39 31 |.filelen=4535091| 00000030 32 0a 55 42 49 23 01 00 00 00 00 00 00 00 00 00 |2.UBI#..........| 00000040 - after $ hexdump -n 64 -v -C wxr_5950ax12_jp_305.ubi 00000000 55 42 49 23 01 00 00 00 00 00 00 00 00 00 00 00 |UBI#............| 00000010 00 00 08 00 00 00 10 00 78 cf c4 91 00 00 00 00 |........x.......| 00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000030 00 00 00 00 00 00 00 00 00 00 00 00 3d 2a 64 fd |............=*d.| 00000040 2. Boot WXR-5950AX12 with OpenWrt initramfs image 3. Upload modified stock image to WXR-5950AX12 4. Find partitions "rootfs" and "rootfs_recover" example: root@OpenWrt:/# cat /proc/mtd dev: size erasesize name ... mtd22: 04000000 00020000 "rootfs" mtd23: 04000000 00020000 "rootfs_recover" ... in this case, "rootfs" is mtd22 and "rootfs_recover" is mtd23 5. Format "rootfs"/"rootfs_recover" partition with the uploaded image example: ubiformat /dev/mtd22 -f /tmp/wxr_5950ax12_jp_305.ubi ubiformat /dev/mtd23 -f /tmp/wxr_5950ax12_jp_305.ubi 6. Remove "rootfs"/"rootfs_data" volume from user_property partition example: . /lib/upgrade/nand.sh UBI=$(nand_attach_ubi user_property) ubirmvol /dev/$UBI -N rootfs ubirmvol /dev/$UBI -N rootfs_data 7. Reboot MAC addresses: LAN : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text)) WAN : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text)) 2.4 GHz: 50:C4:DD:xx:xx:30 (0:APPSBLENV, wlan0addr (text)) 5 GHz : 50:C4:DD:xx:xx:38 (0:APPSBLENV, wlan1addr (text)) Reviewed-by: Robert Marko <robimarko@gmail.com> Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
* ipq807x: Add ZyXEL NBG7815André Valentin2023-01-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ZyXEL NBG7815 is a premium 802.11ax "tri"-band router/AP. Specifications: * CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz * RAM: 1 GB 2x Nanya NT5CC256M16ER-EK * Storage: * 8MB serial flash Winbond W25Q64DW * 4GB eMMC flash Kingston EMMC04G-M627 * Ethernet: * 4x1G RJ45 ports (QCA8074A) with 1x status LED per port * 1x2.5G RJ45 port (QCA8081) with 1x status LED * 1x10G RJ45 port (AQR113C) with 1x status LED * Switch: Qualcomm Atheros QCA8075 * WLAN: * 2.4GHz: Qualcomm QCN5024 4x4@40MHz 802.11b/g/n/ax 1147 Mbps PHY rate * 2x 5GHz: Qualcomm QCN5054 4x4 802.11a/b/g/n/ac/ax 2402 PHY rate * Bluetooth CSR8811 using HSUART, currently unsupported * USB: 1x USB3.0 Type-A port * LED-s currently not supported: * White * Dark Blu * Amber * Purple * Purple and dark blue * Red * Buttons: * 1x Soft reset * Power: 12V DC Jack Installation instructions: * Disconnect WAN * Reset device to factory defaults by pushing reset button 15 sec, LEDs should lit orange color. * After 5-10 minutes, when the LEDs turn constant dark blue, put your LAN cable and connect at address 192.168.123.1 by telnet on port 23 * Login with NBG7815 login: root password: nbg7815@2019 * cd /tmp/ApplicationData * wget -O openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin http://... * wget https://github.com/itorK/nbg7815_tools/blob/main/flash_to_openwrt.sh * run flash_to_openwrt.sh If you can't use wget, you can transfer the files via nc. See https://openwrt.org/inbox/toh/zyxel/nbg7815_armor_g5 for installation details. Bluetooth usage: * you need at least package bluez-utils, recommended bluez-daemon * run following commands to enable and start hciattach /dev/ttyMSM1 bcsp hciconfig hci0 up Many thanks to itorK for his work on this device: https://github.com/itorK/openwrt/tree/nbg7815 Reviewed-by: Robert Marko <robimarko@gmail.com> Signed-off-by: André Valentin <avalentin@marcant.net>
* ipq807x: add Dynalink DL-WRX36Dirk Buchwalder2023-01-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Dynalink DL-WRX36 is a AX WIFI router with 4 1G and 1 2.5G ports. Specifications: • CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz • RAM: 1024MB of DDR3 • Storage: 256MB Nand • Ethernet: 4x 1G RJ45 ports (QCA8075) + 1 2.5G Port (QCA8081) • WLAN: 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 1174 Mbps PHY rate 5GHz: Qualcomm QCN5054 4x4 802.11a/b/g/n/ac/ax 2402 PHY rate • 1x USB 3.0 • 1 gpio-controlled dual color led (blue/red) • Buttons: 1x soft reset / 1x WPS • Power: 12V DC jack A poulated serial header is onboard (J1004) the connector size is a 4-pin 2.0 mm JST PH. RX/TX is working, u-boot bootwait is active, secure boot is enabled. Notes: - Serial is completely deactivated in the stock firmware image. - This commit adds only single partition support, that means sysupgrade is upgrading the current rootfs partition. - Installation can be done by serial connection or SSH access on OEM firmware Installation Instructions: Most part of the installation is performed from an initramfs image running OpenWrt, and there are two options to boot it. Boot initramfs option 1: Using serial connection (3.3V) 1. Stop auto boot to get to U-boot shell 2. Transfer initramfs image to device (openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb) Tested using TFTP and a FAT-formatted USB flash drive. 3. Boot the initramfs image # bootm Boot initramfs option 2: From SSH access on OEM firmware 1. Copy the initramfs image to a FAT-formatted flash drive (tested on single-partition drive) and connect it to device USB port. 2. Change boot command so it loads the initramfs image on next boot Fallback to OEM firmware is provided. # fw_setenv bootcmd 'usb start && fatload usb 0:1 0x44000000 openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb && bootm 0x44000000; bootipq' 3. Reboot the device to boot the initramfs # reboot Install OpenWrt from initramfs image: 1. Use SCP (or other way) to transfer OpenWrt factory image 2. Connect to device using SSH (on a LAN port) 3. Check MTD partition table. rootfs and rootfs_1 should be mtd18 and mtd20 depending on current OEM slot. # cat /proc/mtd 4. Do a ubiformat to both rootfs partitions: # ubiformat /dev/mtd18 -y -f /path_to/factory_image # ubiformat /dev/mtd20 -y -f /path_to/factory_image 5. Set U-boot env variable: mtdids # fw_setenv mtdids 'nand0=nand0' 6. Get offset of mtd18 to determine current OEM slot - If current OEM slot is 1, offset is 16777216 (0x1000000) - If current OEM slot is 2, offset is 127926272 (0x7a00000) # cat /sys/class/mtd/mtd18/offset 7. Set U-boot env variable: mtdparts If current OEM slot is 1, run: # fw_setenv mtdparts 'mtdparts=nand0:0x6100000@0x1000000(fs),0x6100000@0x7a00000(fs_1)' If current OEM slot is 2, run: # fw_setenv mtdparts 'mtdparts=nand0:0x6100000@0x7a00000(fs),0x6100000@0x1000000(fs_1)' 8. Set U-boot env variable: bootcmd # fw_setenv bootcmd 'setenv bootargs console=ttyMSM0,115200n8 ubi.mtd=rootfs rootfstype=squashfs rootwait; ubi part fs; ubi read 0x44000000 kernel; bootm 0x44000000#config@rt5010w-d350-rev0' 9. Reboot the device # reboot Note: this PR adds only single partition support, that means sysupgrade is upgrading the current rootfs partition Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
* ipq807x: add Edgecore EAP102Matthew Hagan2023-01-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Edgecore EAP102 is a wall/ceiling mountable AP. The AP can be powered by either PoE or AC adapter. Device info: - IPQ8071-A SoC - 1GiB RAM - 256MiB NAND flash - 32MiB SPI NOR - 2 Ethernet ports - 1 Console port - 2GHz/5GHz AX WLAN - 2 USB 2.0 ports Install instructions: Prerequistes - TFTP server, preferrably within 192.168.1.0/24 Console cable plugged in (115200 8N1 no flow control) 1. Power on device and interrupt u-boot to obtain u-boot CLI 2. set serverip to IP address of the TFTP server: `setenv serverip 192.168.1.250` 3. Download image from TFTP server: `tftpboot 0x44000000 openwrt-ipq807x-generic-edgecore_eap102-squashfs-nand-factory.ubi` 4. Flash ubi image to both partitions and reset: `sf probe imxtract 0x44000000 ubi nand device 0 nand erase 0x0 0x3400000 nand erase 0x3c00000 0x3400000 nand write $fileaddr 0x0 $filesize nand write $fileaddr 0x3c00000 $filesize reset` Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
* ipq807x: Add Xiaomi AX9000Robert Marko2023-01-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Xiaomi AX9000 is a premium 802.11ax "tri"-band router/AP. Specifications: * CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz * RAM: 1024MB of DDR3 * Storage: 256MB of parallel NAND * Ethernet: * 4x1G RJ45 ports (QCA8075) with 1x status LED per port * 1x2.5G RJ45 port (QCA8081) with 1x status LED * WLAN: * PCI based Qualcomm QCA9889 1x1 802.11ac Wawe 2 for IoT * 2.4GHz: Qualcomm QCN5024 4x4@40MHz 802.11b/g/n/ax 1147 Mbps PHY rate * 5.8GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402Mbps PHY rate * 5GHz: PCI based Qualcomm QCN9024 4x4@160MHz 802.11a/b/g/n/ac/ax 4804Mbps PHY rate * USB: 1x USB3.0 Type-A port * LED-s: * System (Blue and Yellow) * Network (Blue and Yellow) * RGB light bar on top in X shape * Buttons: * 1x Power switch * 1x Soft reset * 1x Mesh button * Power: 12V DC Jack Installation instructions: Obtaining SSH access is mandatory https://openwrt.org/inbox/toh/xiaomi/ax9000#obtain_ssh_access Installation is done by the ubiformat method, through SSH: 1. Open an SSH shell to the router 2. Copy the file openwrt-ipq807x-generic-xiaomi_ax9000-initramfs-factory.ubi to the /tmp directory 3. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1): nvram get flag_boot_rootfs 4. Find the rootfs and rootfs_1 mtd indexes respectively: cat /proc/mtd Please confirm if mtd21 and mtd22 are the correct indexes from above! 5. Use the command ubiformat to flash the opposite mtd with UBI image: If nvram get flag_boot_rootfs returned 0: ubiformat /dev/mtd22 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit otherwise: ubiformat /dev/mtd21 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit 6. Reboot the device by: reboot Previous commands flashed an ubinized OpenWrt initramfs that will serve as the intermediate step since OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for packages. Continue in order to pernamently flash OpenWrt: 7. SSH into OpenWrt from one of the LAN ports 8. Copy the file openwrt-ipq807x-generic-xiaomi_ax9000-squashfs-sysupgrade.bin to the /tmp directory 9. Sysupgrade the device: sysupgrade -n /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-squashfs-sysupgrade.bin Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired. Signed-off-by: Robert Marko <robimarko@gmail.com>
* ipq807x: add QNAP 301wDirk Buchwalder2023-01-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | QNAP 301w is a AX WIFI router with 4 1G and 2 10G ports. Specifications: • CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz • RAM: 1024MB of DDR3 • Storage: 4GB eMMC (contains kernel and rootfs) / 8MB NOR (contains art and u-boot-env) • Ethernet: 4x 1G RJ45 ports + 2 10G ports (Aquantia AQR113C) • WLAN: 2.4GHz: Qualcomm QCN5024 4x4 (40 MHz) 802.11b/g/n/ax 1174 Mbps PHY rate 5GHz: Qualcomm QCN5054 4x4 (80 MHz) or 2x2 (160 MHz) 802.11a/b/g/n/ac/ax 2402 PHY rate • LEDs: 7 x GPIO-controlled dual color LEDs + 2 GPIO-controlled single color LEDs • Buttons: 1x soft reset / 1x WPS • Power: 12V DC jack A poulated serial header is onboard. RX/TX is working, bootwait is active, secure boot is not enabled. SSH can be activated in the stock firmware, hold WPS button til the second beep (yes the router has a buzzer) SSH is available on port 22200, login with user admin and password "mac address of the router". Installation Instructions: • obtain serial access (https://openwrt.org/inbox/toh/qnap/301w#serial) • stop auto boot • setenv serverip 192.168.10.1 • setenv ipaddr 192.168.10.10 • tftpboot the initramfs image (openwrt-ipq807x-generic-qnap_301w-initramfs-fit-uImage.itb) • bootm • make sure that current_entry is set to "0": "fw_printenv -n current_entry" should be print "0". If not, do "fw_setenv current_entry 0" • copy openwrt-ipq807x-generic-qnap_301w-squashfs-sysupgrade.bin to the device to /tmp folder • sysupgrade -n /tmp/openwrt-ipq807x-generic-qnap_301w-squashfs-sysupgrade.bin this flashes openwrt to the first kernel and rootfs partition (mmcblk0p1 / mmcblk0p4) • reboot Note: this leaves the second kernel / rootfs parition untouched. So if you want to go back to stock, stop u-boot autoboot, "setenv current_entry 1" , "saveenv", "bootipq". Stock firmware should start from the second partition. Then do a firmwareupgrade in the stock gui, that should overwrite the openwrt in the first partitions Make 10G Aquantia phy's work: The aquantia phy's need a firmware to work. This can either be loaded in linux with a userspace tool or in u-boot. I was not successfull to load the firmware in linux (aq-fw-download) but luckily there is aq_load_fw available in u-boot. But first the right firmware needs to write to the 0:ETHPHYFW mtd partition (it is empty on my device) Grab the ethphy firmware image from: https://github.com/kirdesde/nbg7815_gpl/blob/master/target/linux/ipq/ipq807x_64/prebuilt_images/AQR_ethphyfw.mbn and scp that to openwrt. Check the 0:ETHPHYFW partition number: cat /proc/mtd|grep "0:ETHPHYFW", should be mtd10. Backup the 0:ETHPHYFW partition: dd if=/dev/mtd10 of=/tmp/ethphyfw.backup, scp ethphyfw.backup to a save place. Write the new firmware image to the 0:ETHPHYFW partition: "mtd erase /dev/mtd10", "mtd -n write AQR_ethphyfw.mbn /dev/mtd10". Reboot to u-boot. Check if aq_load_fw is working: "aq_load_fw 0", that checks the firmware and if successfull, loads iram and dram to one of the aquantia phy's. If that worked, add the aq_load_fw to the bootcmd: setenv bootcmd "aq_load_fw 0 && aq_load_fw 8 && bootipq" "saveenv" "reset" Board reboots and the firmware load to both phy's should start and then openwrt boots. Check if the 10G ports work. Note: lan port labeled "10G-2" is configured as WAN port as per default. All other port are in the br-lan. This can be changed in the network config. Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
* ipq807x: add Edimax CAX1800Dirk Buchwalder2023-01-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Edimax CAX1800 is a 802.11 ax dual-band AP with PoE. AP can be ceiling or wall mount. Specifications: • CPU: Qualcomm IPQ8070A Quad core Cortex-A53 1.4GHz • RAM: 512MB of DDR3 • Storage: 128MB NAND (contains rootfs) / 8MB NOR (contains art and uboot-env) • Ethernet: 1x 1G RJ45 port (QCA8072) PoE • WLAN: 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate 5GHz: Qualcomm QCN5054 2x2 802.11a/b/g/n/ac/ax 1201 PHY rate • LEDs: 3 x GPIO-controlled System-LEDs (form one virtual RGB System-LED) black_small_square Buttons: 1x soft reset black_small_square Power: 12V DC jack or PoE (802.3af ) An unpopulated serial header is onboard. RX/TX is working, bootwait is active, secure boot is not enabled. SSH can be activated in the stock firmware, but it drops only to a limited shell . Installation Instructions: black_small_square obtain serial access black_small_square stop auto boot black_small_square tftpboot the initramfs image (serverip is set to 192.168.99.8 in uboot) black_small_square bootm black_small_square copy openwrt-ipq807x-generic-edimax_cax1800-squashfs-nand-factory.ubi to the device black_small_square write the image to the NAND: black_small_square cat /proc/mtd and look for rootfs partition (should be mtd0) black_small_square ubiformat /dev/mtd0 -f -y openwrt-ipq807x-generic-edimax_cax1800-squashfs- nand-factory.ubi black_small_square reboot Note: Device is not using dual partitioning (NAND contains other partitions with different manufacture data etc.) Draytek VigorAP 960C and Lancom LW-600 both look similar, but I haven't checked them. Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
* ipq807x: add Redmi AX6Zhijun You2023-01-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Redmi AX6 is a budget 802.11ax dual-band router/AP Specifications: * CPU: Qualcomm IPQ8071A Quad core Cortex-A53 1.4GHz * RAM: 512MB of DDR3 * Storage: 128MB NAND * Ethernet: 4x1G RJ45 ports (QCA8075) * WLAN: * 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate * 5GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate * LEDs: * System (Blue/Yellow) * Network (Blue/Yellow) *Buttons: 1x soft reset *Power: 12V DC jack Installation instructions: Obtaining SSH access is mandatory https://openwrt.org/inbox/toh/xiaomi/xiaomi_redmi_ax6_ax3000#ssh_access Installation is done by the ubiformat method, through SSH: 1. Open an SSH shell to the router 2. Copy the file openwrt-ipq807x-generic-redmi_ax6-initramfs-factory.ubi to the /tmp directory 3. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1): nvram get flag_boot_rootfs 4. Find the rootfs and rootfs_1 mtd indexes respectively: cat /proc/mtd Please confirm if mtd12 and mtd13 are the correct indexes from above! 5. Use the command ubiformat to flash the opposite mtd with UBI image: If nvram get flag_boot_rootfs returned 0: ubiformat /dev/mtd13 -y -f /tmp/openwrt-ipq807x-generic-redmi_ax6-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit otherwise: ubiformat /dev/mtd12 -y -f /tmp/openwrt-ipq807x-generic-redmi_ax6-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit 6. Reboot the device by: reboot Previous commands flashed an ubinized OpenWrt initramfs that will serve as the intermediate step since OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for packages. Continue in order to pernamently flash OpenWrt: 7. SSH into OpenWrt from one of the LAN ports 8. Copy the file openwrt-ipq807x-generic-redmi_ax6-squashfs-sysupgrade.bin to the /tmp directory 9. Sysupgrade the device: sysupgrade -n /tmp/openwrt-ipq807x-generic-redmi_ax6-squashfs-sysupgrade.bin Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired. Signed-off-by: Zhijun You <hujy652@gmail.com>