This commit adds support for the Meraki Z3C "Teleworker" device with
802.11ac, LTE Cat 3 modem, and an integrated 5 port Gigabit switch.
Port 5 has POE output (802.3af). The WAN port is used for tftp booting
in U-Boot.
This device ships with secure boot, and cannot be flashed without an
external programmer.
|||
|--|--|
|Model|Z3C|
|CPU|Qualcomm Atheros IPQ4029|
|Flash MB|128 NAND|
|RAM MB|512|
|WLAN Hardware|Qualcomm Atheros IPQ4029|
|WLAN 2.4GHz|b/g/n 2x2|
|WLAN 5.0GHz|a/n/ac 2x2|
|WWAN|LTE Cat 3|
|Ethernet 1Gbit ports|5|
The LAN/WiFi MAC addresses are sourced from an internal I2C EEPROM.
Z3C-HW-NA (NA: North America) supports LTE bands: 2,4,5,13,17
Z3C-HW-WW (WW: World-wide) supports LTE bands: 1,3,7,8,20
Disassembly:
Remove the four T8 screws on the bottom of the device under the rubber feet.
Using a guitar pick or similar plastic tool, insert it on the side between
the bottom case and the side, pry up gently. The plastic bottom has 18 latches
around the perimeter (but none on the rear by the Ethernet ports).
Remember to remove the SIM tray!
Gently remove the metal RF shield on the bottom of the PCB.
The TSOP48 NAND flash (U30, Spansion S34ML01G200TFV00) is located on the bottom
side of the PCB (facing you as you remove the bottom plastic). To flash, you
will need to desolder the TSOP48. Attempts to flash in-circuit using a 360 clip
were unsuccessful.
The SOIC8 I2C EEPROM (U32, Atmel 24C64) is located on the bottom side of the PCB
under a metal RF shield. It can be flashed in circuit using a chip clip. You may
have to bend the RF shield up to fit the chip clip.
The UART header is on the top (opposite) side of the PCB. You do not need to
remove any more screws to remove the PCB. The PCB has some thermal interface
material for heat dissipation and will be slightly difficult to remove the
first time. Gently pry up on the green PCB from one of the front corners until
the thermal pads break contact with the top case. You can then lift out the
entire PCB, including the attached LTE/WiFi antennas.
Installation:
The dumps to flash can be found in this repository:
https://github.com/halmartin/meraki-openwrt-docs/tree/main/z3c
The device has the following flash layout (offsets with OOB data):
```
0x000000000000-0x000000100000 : "sbl1"
0x000000100000-0x000000200000 : "mibib"
0x000000200000-0x000000300000 : "bootconfig"
0x000000300000-0x000000400000 : "qsee"
0x000000400000-0x000000500000 : "qsee_alt"
0x000000500000-0x000000580000 : "cdt"
0x000000580000-0x000000600000 : "cdt_alt"
0x000000600000-0x000000680000 : "ddrparams"
0x000000700000-0x000000900000 : "u-boot"
0x000000900000-0x000000b00000 : "u-boot-backup"
0x000000b00000-0x000000b80000 : "ART"
0x000000c00000-0x000007c00000 : "ubi"
```
* Dump your original NAND (if using nanddump, include OOB data).
* Decompress `u-boot.bin.gz` dump (contains OOB data) and overwrite the
`u-boot` portion of NAND from `0x738000-0x948000` (length `0x210000`).
* Decompress `ubi.bin.gz` dump (contains OOB data) and overwrite the `ubi`
portion of NAND from `0xc60000-0x8400000` (length `0x77a0000`).
* Dump your original EEPROM. Change the byte at offset `0x49` to `0x1e`
(originally `0x2a`). Remember to re-write the EEPROM with the
modified data.
* This can be done on Linux via the following command:
`printf "\x1e" | dd of=/tmp/eeprom.bin bs=1 seek=$((0x49)) conv=notrunc`
**Note**: the device will not boot if you modify the board major number and
have not yet overwritten the `ubi` and `u-boot` regions of NAND.
* Resolder the NAND after overwriting the `u-boot` and `ubi` regions.
OpenWrt Installation:
* After flashing NAND and EEPROM with external programmers. Plug in an
Ethernet cable and power up the device.
* The new U-Boot build uses the space character `" "` (without quotes) to
interrupt boot.
* Interrupt U-Boot and `tftpboot` the OpenWrt initramfs image from your
tftp server
```
dhcp
setenv serverip <your_tftp>
tftpboot openwrt-ipq40xx-generic-meraki_z3c-initramfs-uImage.itb
```
* Once booted into the OpenWrt initramfs, created the `ART` ubivol with
the WiFi radio calibration from the mtd partition:
```
cat /dev/mtd10 > /tmp/ART.bin
ubiupdatevol /dev/ubi0_1 /tmp/ART.bin
```
* `scp` the `sysupgrade` image to
the device and run the normal `sysupgrade` procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_z3c-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_z3c-squashfs-sysupgrade.bin"
```
* OpenWrt should now be installed on the device.
* Note: To use the LTE modem as a WWAN, you must install `modemmanager`
(you probably also want `luci-proto-modemmanager`) and then configure
the modem for your provider.
Due to OpenWrt policies these packages are not included in the
initramfs/sysupgrade image.
Signed-off-by: Hal Martin <hal.martin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23307
Signed-off-by: Robert Marko <robimarko@gmail.com>
Fix small nits in the Meraki device trees, identified by Claude
during a new device PR.
Signed-off-by: Hal Martin <hal.martin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23307
Signed-off-by: Robert Marko <robimarko@gmail.com>
Remove target/linux/ipq40xx/dts/qcom-ipq4029-wired-qca-common.dtsi
This file is no longer used after the ipq40xx Meraki device tree
refactoring that occurred last year when adding support for the MR30H.
Signed-off-by: Hal Martin <hal.martin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23307
Signed-off-by: Robert Marko <robimarko@gmail.com>
Commit b4d7263bc3 ("kernel: of: avoid some unnecessary bad cell count
warnings") backported Linux commit 6e5773d52f4a ("of/address: Fix WARN
when attempting translating non-translatable addresses"), which started
requiring #address-cells for a device's parent if we want to use the
reg resource in a device node.
Many Chromium devices use a /firmware/coreboot device node that is
patched in by the boot firmware. These structures look something like:
# find /sys/firmware/devicetree/base/firmware/
/sys/firmware/devicetree/base/firmware/
/sys/firmware/devicetree/base/firmware/scm
/sys/firmware/devicetree/base/firmware/scm/compatible
/sys/firmware/devicetree/base/firmware/scm/name
/sys/firmware/devicetree/base/firmware/ranges
/sys/firmware/devicetree/base/firmware/chromeos
/sys/firmware/devicetree/base/firmware/chromeos/fmap-offset
/sys/firmware/devicetree/base/firmware/chromeos/compatible
/sys/firmware/devicetree/base/firmware/chromeos/readonly-firmware-version
/sys/firmware/devicetree/base/firmware/chromeos/nonvolatile-context-storage
/sys/firmware/devicetree/base/firmware/chromeos/hardware-id
/sys/firmware/devicetree/base/firmware/chromeos/firmware-type
/sys/firmware/devicetree/base/firmware/chromeos/vboot-shared-data
/sys/firmware/devicetree/base/firmware/chromeos/nonvolatile-context-offset
/sys/firmware/devicetree/base/firmware/chromeos/firmware-version
/sys/firmware/devicetree/base/firmware/chromeos/nonvolatile-context-size
/sys/firmware/devicetree/base/firmware/chromeos/name
/sys/firmware/devicetree/base/firmware/coreboot
/sys/firmware/devicetree/base/firmware/coreboot/compatible
/sys/firmware/devicetree/base/firmware/coreboot/board-id
/sys/firmware/devicetree/base/firmware/coreboot/reg
/sys/firmware/devicetree/base/firmware/coreboot/name
/sys/firmware/devicetree/base/firmware/name
Notably, there is no #{address,size}-cells in /firmware.
This breaks any driver relying on a device under /firmware, such as the
coreboot_table driver.
This is technically an ill-formatted FDT, and so we might as well just
add the properties ourselves.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22951
Signed-off-by: Robert Marko <robimarko@gmail.com>
In cases where an nvmem definition is applied to the switch ports,
change to apply to the root gmac so that a randomized MAC address does
not get set.
Also remove the aliases. Since nvmem is used, we don't care about the
bootloader.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22857
Signed-off-by: Robert Marko <robimarko@gmail.com>
Remove unnecessary properties as there is no
reg property in child node.
Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22592
Signed-off-by: Robert Marko <robimarko@gmail.com>
In the blamed commit, the wrong partition name for ART was used.
It was later discovered that the partition table uses "0:ART" instead of
"art" for the ART partition name thus breaking caldata extraction.
So, fix the partition name.
Fixes: ee5999cf78 ("treewide: linksys: use nvmem MAC for hw_mac_addr")
Signed-off-by: Anthony Sepa <protectivedad@gmail.com>
Signed-off-by: Robert Marko <robimarko@gmail.com>
Specifications
--------------
- SoC : Qualcomm IPQ4019
- RAM : 256 MiB DDR3-1600 (NT5CC128M16IP)
- Flash : 32 MiB SPI NOR
- V1, V2 : GigaDevice GD25Q256C
- V3 : Winbond W25Q256FV, Micron N25Q128A11
- V320 : EON EN25QH256, XMC XM25QH256BK (with patch included)
- WLAN : IPQ4019 On-chip
- 2.4 GHz : 2x2 MIMO 802.11b/g/n
- 5 GHz : 2x2 MIMO 802.11n/ac
- Ethernet : QCA8072 10/100/1000BASE-T 1x WAN; 1x LAN
- UART : 3v3 115200n, use pins under heatsink
- Buttons : 1x Reset
- LEDs : 1x Combined RGB LED
- V1 : Driven by LP5521 channels (Channel 0, 1, 2?)
- V3, V320 : Driven by GPIO Pins (Pin 28, 32, 35 Active Low)
- Bluetooth :
- V1, V2, V3 : CSR8811
- V320 : AC6368A/B
- Power : DC 12V @ 1.2A
- FCC ID :
- V1 : TE7M5
- V3 : TE7M5V3
- V320 : TE7M5V32, 2AXJ4M5V3, 2BCGWM5V3
- TFTP ID :
- Client : 192.168.0.66
- Router : 192.168.0.11
MAC Addresses
-------------
Label : OPAQUE partition @ 0x0008
LAN : Label
WAN : Label + 1
WLAN 2G : Label + 2
WLAN 5G : Label + 3
Installation
------------
1. Install TFTP server software
2. Rename the factory image to 'M5v1_tp_recovery.bin' and copy it into
the TFTP folder
3. Connect an interface configured to 192.168.0.66/24 to the LAN port
- Note: The LAN port is the ethernet port that is furthest away from
the power plug
4. Press the 'reset' button down before powering up the device, holding
for at least 10 seconds
5. Router should download the factory image, install it, and then reboot
6. Router will start up with address 192.168.1.1
Known Issues
------------
- Some devices (including some V1 and V2 devices) may have flash chips
that are not detected, supported by, or have broken SFDP support
Signed-off-by: Bee Cadorna <r3usrlnd@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17537
Signed-off-by: Robert Marko <robimarko@gmail.com>
Restore the lost band label.
Fixes: 502ac21e8f ("ipq40xx: drop redundant label with new LED color/function format")
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
Hardware
========
SoC: Qualcomm IPQ4018
ETH: Qualcomm QCA8075 (2 x RJ-45)
WDG: OnSemi SCT706
RAM: Micron MT41K128M16JT-125 (256MB)
NOR: Infineon S25FL512S (64MB)
Installation
============
1. Create a ramboot-able image with the command
{ dd if=/dev/zero bs=32 count=1 2>/dev/null; \
cat openwrt-ipq40xx-generic-huawei_ap4050dn-initramfs-uImage.itb; \
} > ramboot.bin`
2. Start a TFTP server in the folder with the ramboot.bin.
3. Plug in a USB-RJ45 serial adapter to the CONSOLE port of the device
and start a serial console session with
9600 baud, no parity, 1 stop bit.
4. Plug in either 12V power or PoE to the device.
5. On the prompt `Press f or F to stop Auto-Boot in 3 seconds`,
press `f` to enter the Huawei U-Boot command line
6. Enter a new password for the u-boot command line
7. In the command line, run these commands to ramboot OpenWrt:
setenv serverip <IPv4 address of TFTP server>
setenv ipaddr <IPv4 address for this AP>
setenv rambootfile ramboot.bin
run ramboot
8. In OpenWrt, set up the network and then `scp` the files
`u-boot-huawei_ap4050dn/uImage` and
`openwrt-ipq40xx-generic-huawei_ap4050dn-squashfs-sysupgrade.bin`
into `/tmp/`
9. To backup the original firmware, run the following:
cat /dev/mtd12 /dev/mtd13 > huawei_ap4050dn_fw_backup.bin.bin
10. Run the following commands to flash u-boot and OpenWrt to the device:
mtd erase uboot
mtd write /tmp/uImage uboot
sysupgrade -n /tmp/openwrt-ipq40xx-generic-huawei_ap4050dn-squashfs-sysupgrade.bin
11. The device should now boot OpenWrt! (sometimes the boot process takes a bit
longer due to the watchdog resetting the device before the watchdog driver runs)
Signed-off-by: Marco von Rosenberg <marcovr@selfnet.de>
Given that Linksys is the same brand and probably use the same OEM, it
stands to reason all devinfo hw_mac_addr implementations are the same.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22092
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit adds support for the Cisco Meraki MR70/Go GR60.
The Meraki MR70 is a Cisco 802.11ac/WiFi 5 outdoor AP with 1 Ethernet port.
It can be powered by a 12V DC barrel jack (5.5x2.5mm, center positive)
or via 802.3af POE.
The Meraki Go GR60 (codename: Dungbeetle Omni) is identical to the MR70
(codename: Toe Biter Omni), so this document will refer to both devices
as the MR70.
MR70 hardware info:
* CPU: Qualcomm IPQ4029
* RAM: 256MB DDR3
* Storage: 128 MB (TSOP48 NAND, 3.3V)
* Networking: 1 Gigabit Ethernet
* WiFi: QCA4019 802.11b/g/n/ac
* Serial: Internal header (J10, 2.54mm, unpopulated)
This device ships with secure boot, and cannot be flashed without
external programmers (TSOP48 NAND and I2C EEPROM)!
Disassembly:
Note: This is an outdoor device that is ultrasonically welded and glued
to weather seal it. Disassembly will compromise the weather seal!
Start by removing the product label on the rear metal mounting plate.
There are four Torx T8 screws under the sticker, remove the screws and
the mounting plate. Remove the two Philips screws under the plate.
Using a chisel (or razor blade) and hammer, cut around the circumfrence
of the device. You need to cut through approximately 2mm of
ultrasonically welded plastic.
After cutting through the plastic, heat the device using a hair drier
(or similar) to soften the glue. A heatgun is NOT recommended as
it will damage the plastic. It is only required to heat the device until
warm (~40C-50C).
Using a plastic pry tool, insert it along the cut you made around
the edge and gently separate. Insert a guitar pick into the opening
while gently lifting the front to cut the glue. The device is glued around
the entire circumfrence.
Once you have removed the plastic front, remove the 4 Philips screws
holding down the main PCB. Release the two WiFi antennas by gently
bending the antenna PCBs to the middle of the unit and pulling up.
Lift the top of the PCB gently while pushing the Ethernet port into the
housing to release it. Turn the PCB over and remove the three Philips
screws holding the metal heat spreader.
The TSOP48 NAND flash (U9, S34ML01G200 or W29N01HV) is located
under the metal heat spreader.
To flash, you need to desolder the TSOP48 or use a 360 clip.
You also need to reprogram the I2C EEPROM (U20, Atmel 24c64). It is not
necessary to desolder the I2C EEPROM, a ch341a USB programmer and SOP-8
clip are inexpensive (~$10) and work well.
Installation:
The dumps to flash can be found in this repository:
https://github.com/halmartin/meraki-openwrt-docs/tree/main/mr70_gr60
The device has the following flash layout (offsets with OOB data):
```
0x000000000000-0x000000100000 : "sbl1"
0x000000100000-0x000000200000 : "mibib"
0x000000200000-0x000000300000 : "bootconfig"
0x000000300000-0x000000400000 : "qsee"
0x000000400000-0x000000500000 : "qsee_alt"
0x000000500000-0x000000580000 : "cdt"
0x000000580000-0x000000600000 : "cdt_alt"
0x000000600000-0x000000680000 : "ddrparams"
0x000000700000-0x000000900000 : "u-boot"
0x000000900000-0x000000b00000 : "u-boot-backup"
0x000000b00000-0x000000b80000 : "ART"
0x000000c00000-0x000007c00000 : "ubi"
```
* Dump your original NAND (if using nanddump, include OOB data).
* Decompress `u-boot.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `u-boot` portion of NAND from
`0x738000`-`0x948000` (length `0x210000`). Offsets here include OOB data.
* Decompress `ubi.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `ubi` portion of NAND from
`0xc60000-0x7fe0000` (length `0x7380000`). Offsets here include OOB data.
* Dump your original EEPROM. Change the byte at offset `0x49` to `0x1e`
(originally `0x2d` or `0x26`). Remember to re-write the EEPROM with the
modified data.
* This can be done on Linux via the following command:
`printf "\x1e" | dd of=/tmp/eeprom.bin bs=1 seek=$((0x49)) conv=notrunc`
**Note**: the device will not boot if you modify the board major number and
have not yet overwritten the `ubi` and `u-boot` regions of NAND.
* Resolder the NAND after overwriting the `u-boot` and `ubi` regions.
OpenWrt Installation:
* After flashing NAND and EEPROM with external programmers. Plug in an
Ethernet cable and power up the device.
* The new U-Boot build uses the space character `" "` (without quotes) to
interrupt boot.
* Interrupt U-Boot and `tftpboot` the OpenWrt initramfs image from your
tftp server
```
dhcp
setenv serverip <your_tftp>
tftpboot openwrt-ipq40xx-generic-meraki_mr70-initramfs-uImage.itb
```
* Once booted into the OpenWrt initramfs, created the `ART` ubivol with
the WiFi radio calibration from the mtd partition:
```
cat /dev/mtd10 > /tmp/ART.bin
ubiupdatevol /dev/ubi0_1 /tmp/ART.bin
```
* `scp` the `sysupgrade` image to
the device and run the normal `sysupgrade` procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_mr70-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_mr70-squashfs-sysupgrade.bin"
```
* OpenWrt should now be installed on the device.
Signed-off-by: Hal Martin <hal.martin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22050
Signed-off-by: Robert Marko <robimarko@gmail.com>
Underdog devices lack a red LED, use the blue LED for
failsafe mode.
Move all config except device name to underdog.dtsi, as
all known underdog devices (MR20/GR10, MR70/GR60) have identical
device tree.
Signed-off-by: Hal Martin <hal.martin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22050
Signed-off-by: Robert Marko <robimarko@gmail.com>
Align the ipq40xx target to the pattern already used on other devices where
the device DTS are placed in a dedicated directory separate from the files
directory.
This, while trying to enforce a common pattern for every target, also permits to
do modification to device DTS without having to trigger a recompilation of the
entire kernel (as the files directory is not touched)
Link: https://github.com/openwrt/openwrt/pull/22040
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
