openwrt-mirror/package/firmware
Hal Martin 60bbf46930 ipq40xx: add support for Cisco Meraki Z3
This commit adds support for the Cisco Meraki Z3. The Z3 is a "teleworker"
device with 802.11ac and an integrated 5 port Gigabit switch.

Z3 hardware info:
* CPU: Qualcomm IPQ4029
* RAM: 512MB DDR3
* Storage: 128 MB (S34ML01G200TFV00)
* Networking: QCA8075 internal switch (5x 1GbE ports)
* WiFi: QCA4019 802.11b/g/n/ac
* USB: 1x USB3.0
* Serial: Internal header (J8, 2.54mm, populated)

Port 5 has POE output (802.3af). The Internet/WAN port is used for tftp booting
in U-Boot.

This device ships with secure boot, and cannot be flashed without
external programmers (TSOP48 NAND and I2C EEEPROM)!

Disassembly:

* Remove the four T8 screws on the bottom of the device under the rubber feet.

* Using a guitar pick or similar plastic tool, insert it on the side between
the bottom case and the side, pry up gently. The plastic bottom has several
latches around the perimeter (but none on the rear by the Ethernet ports).

* The TSOP48 NAND flash (U30, Spansion S34ML01G200TFV00) is located on the
bottom side of the PCB (facing you as you remove the bottom plastic).
To flash, you will need to desolder the TSOP48. Attempts to flash in-circuit
using a 360 clip were unsuccessful.

* The SOIC8 I2C EEPROM (U32, Atmel 24C64) is located on the bottom side of
the PCB (facing you as you remove the bottom plastic). It can be flashed in
circuit using a SOIC8 chip clip.

Installation:

The dumps to flash can be found in this repository:
https://github.com/halmartin/meraki-openwrt-docs/tree/main/z3_gx20

The device has the following flash layout (offsets with OOB data):
```
0x000000000000-0x000000100000 : "sbl1"
0x000000100000-0x000000200000 : "mibib"
0x000000200000-0x000000300000 : "bootconfig"
0x000000300000-0x000000400000 : "qsee"
0x000000400000-0x000000500000 : "qsee_alt"
0x000000500000-0x000000580000 : "cdt"
0x000000580000-0x000000600000 : "cdt_alt"
0x000000600000-0x000000680000 : "ddrparams"
0x000000700000-0x000000900000 : "u-boot"
0x000000900000-0x000000b00000 : "u-boot-backup"
0x000000b00000-0x000000b80000 : "ART"
0x000000c00000-0x000007c00000 : "ubi"
```

* Dump your original NAND (if using nanddump, include OOB data).

* Decompress `u-boot.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `u-boot` portion of NAND from
`0x738000`-`0x948000` (length `0x210000`). Offsets here include OOB data.

* Decompress `ubi.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `ubi` portion of NAND from
`0xc60000`-`0x8400000` (length `0x77a0000`). Offsets here include OOB data.

* Dump your original EEPROM. Change the byte at offset `0x49` to `0x1e`
(originally `0x24`). Remember to re-write the EEPROM with the modified data.
    * This can be done on Linux via the following command:
    `printf "\x1e" | dd of=/tmp/eeprom.bin bs=1 seek=$((0x49)) conv=notrunc`

**Note**: the device will not boot if you modify the board major number and
have not yet overwritten the `ubi` and `u-boot` regions of NAND.

* Resolder the NAND after overwriting the `u-boot` and `ubi` regions.

OpenWrt Installation:

* After flashing NAND and EEPROM with external programmers. Plug an Ethernet
cable into the Internet/WAN port. Power up the device.

* The new U-Boot build uses the space character `" "` (without quotes) to
interrupt boot.

* Interrupt U-Boot and `tftpboot` the OpenWrt initramfs image from your
tftp server
```
dhcp
setenv serverip <your_tftp>
tftpboot openwrt-ipq40xx-generic-meraki_z3-initramfs-uImage.itb
```

* Once booted into the OpenWrt initramfs, created the `ART` ubivol with
the WiFi radio calibration from the mtd partition:
```
cat /dev/mtd10 > /tmp/ART.bin
ubimkvol /dev/ubi0 -N ART -s 524288
ubiupdatevol /dev/ubi0_1 /tmp/ART.bin
```

* `scp` the `sysupgrade` image to
the device and run the normal `sysupgrade` procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_z3-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_z3-squashfs-sysupgrade.bin"
```

* OpenWrt should now be installed on the device.

Signed-off-by: Hal Martin <hal.martin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17026
Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-10-19 19:33:18 +02:00
..
ath10k-ct-firmware ath10k-ct-firmware: update wave2 chip firmware to latest beta version 2025-08-24 00:21:26 +02:00
ath11k-firmware ath11k-firmware: fix legacy FW tarball hash 2025-05-08 13:19:34 +02:00
broadcom-sprom treewide: update PKG_MIRROR_HASH to zst 2024-04-06 11:24:18 +02:00
cypress-firmware cypress-firmware: fix version for APK 2024-10-29 00:07:51 +01:00
cypress-nvram cypress-nvram: consolidate NVRAM packages 2022-11-16 20:14:13 +01:00
intel-microcode intel-microcode: update to 20250812 2025-09-17 23:04:09 +02:00
ipq-wifi ipq40xx: add support for Cisco Meraki Z3 2025-10-19 19:33:18 +02:00
ixp4xx-microcode firmware: Resurrect the ixp4xx microcode package 2023-10-25 11:28:15 +02:00
lantiq lantiq-gphy-firmware: add package 2025-03-15 13:52:40 +01:00
layerscape ppfe-firmware: Bump to lf-6.12.20-2.0.0 2025-08-17 19:00:58 +02:00
linux-firmware linux-firmware: update to 20251011 2025-10-16 21:40:44 +02:00
murata-firmware murata-firmware: add new package 2024-11-23 15:53:21 +01:00
murata-nvram murata-nvram: add symlink for STM32MP157C-DK2 2025-04-19 18:41:16 +02:00
omnia-mcu-firmware packages: drop DEVICE specific dependency for omnia 2024-11-05 09:59:49 +01:00
prism54-firmware prism54-firmware: set DL_DIR to package specific subdirectory 2022-09-22 16:48:37 -04:00
wireless-regdb wireless-regdb: Update to version 2025.07.10 2025-07-21 23:18:17 +02:00