Adding OpenWrt support for Linksys MX5300

Hi, I got my hands on a set of Linksys Velop MX5300, I use them as accesspoints, but what is the fun of that, if maybe it can support OpenWrt.

The reason I'm asking is because I saw that it is running there own version of OpenWrt en maybe, just maybe it can run OpenWrt.

This is the device:

This is a part of the output of sysinfo.cgi on one of them.

Part of Sysinfo.cgi
page generated on Tue Mar 30 18:32:41 UTC 2021

UpTime:
 18:32:41 up 1 day, 10:56,  0 users,  load average: 1.23, 1.14, 1.07

Firmware Version: 1.1.9.200251
Firmware Builddate: 2020-03-05 04:54
Product.type: production
Linux: Linux version 4.4.60 (root@build-vm) (gcc version 5.2.0 (OpenWrt GCC 5.2.0 998fe11+r49254) ) #1 SMP Wed Mar 4 19:36:57 PST 2020
Board: 

-----U-Boot Data-----
fw_printenv bootdelay: bootdelay=2

fw_printenv mtdparts: 

fw_printenv bootcmd: bootcmd=aq_load_fw && if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi

fw_printenv boot_part: boot_part=1

fw_printenv auto_recovery: auto_recovery=yes

fw_printenv mtdparts_version: 

All fw_printenv:
FwSize=0x9600000
altKernAddr=0xa680000
auto_recovery=yes
baudrate=115200
boot_part=1
boot_part_ready=3
bootargs=console=ttyMSM0,115200n8
bootcmd=aq_load_fw && if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi
bootdelay=2
bootpart1=setenv bootargs $partbootargs1 && nand read $loadaddr $priKernAddr $kernsize && bootm $loadaddr
bootpart2=setenv bootargs $partbootargs2 && nand read $loadaddr $altKernAddr $kernsize && bootm $loadaddr
dumpipq_data=0
eth1addr=C4:41:1E:F9:74:3B
eth2addr=C4:41:1E:F9:74:3B
eth3addr=C4:41:1E:F9:74:3B
eth4addr=C4:41:1E:F9:74:3B
eth5addr=C4:41:1E:F9:74:3B
ethact=eth0
ethaddr=C4:41:1E:F9:74:3B
fdt_high=0x4A400000
fdtcontroladdr=4a97b130
firmwareName=bronx.img
flash_alt_image=tftpboot $loadaddr $firmwareName && nand erase $altKernAddr $FwSize && nand write $loadaddr $altKernAddr $filesize
flash_both_images=run flash_pri_image && nand erase $altKernAddr $FwSize && nand write $loadaddr $altKernAddr $filesize
flash_pri_image=tftpboot $loadaddr $firmwareName && nand erase $priKernAddr $FwSize && nand write $loadaddr $priKernAddr $filesize
flash_type=2
ipaddr=192.168.1.1
kernsize=0x600000
loadaddr=0x44000000
machid=8010008
mtdids=nand0=nand0
netmask=255.255.255.0
partbootargs1=console=ttyMSM0,115200n8 ubi.mtd=rootfs root=ubi0:ubifs rootfstype=ubifs rootwait swiotlb=1
partbootargs2=console=ttyMSM0,115200n8 ubi.mtd=alt_rootfs root=ubi0:ubifs rootfstype=ubifs rootwait swiotlb=1
priKernAddr=0x1080000
sdk_ver=es2
serverip=192.168.1.254
soc_version_major=2
soc_version_minor=0
stderr=serial@78B3000
stdin=serial@78B3000
stdout=serial@78B3000
wan_phy=1G


-----Boot Data-----
cat /proc/cmdline: console=ttyMSM0,115200n8 ubi.mtd=rootfs root=ubi0:ubifs rootfstype=ubifs rootwait swiotlb=1 clk_ignore_unused

cat /proc/mtd: dev:    size   erasesize  name
mtd0: 00100000 00020000 "0:SBL1"
mtd1: 00100000 00020000 "0:MIBIB"
mtd2: 00080000 00020000 "0:BOOTCONFIG"
mtd3: 00080000 00020000 "0:BOOTCONFIG1"
mtd4: 00300000 00020000 "0:QSEE"
mtd5: 00300000 00020000 "0:QSEE_1"
mtd6: 00080000 00020000 "0:DEVCFG"
mtd7: 00080000 00020000 "0:DEVCFG_1"
mtd8: 00080000 00020000 "0:APDP"
mtd9: 00080000 00020000 "0:APDP_1"
mtd10: 00080000 00020000 "0:RPM"
mtd11: 00080000 00020000 "0:RPM_1"
mtd12: 00080000 00020000 "0:CDT"
mtd13: 00080000 00020000 "0:CDT_1"
mtd14: 00080000 00020000 "0:APPSBLENV"
mtd15: 00100000 00020000 "0:APPSBL"
mtd16: 00100000 00020000 "0:APPSBL_1"
mtd17: 00080000 00020000 "0:ART"
mtd18: 00040000 00020000 "u_env"
mtd19: 00020000 00020000 "s_env"
mtd20: 00020000 00020000 "devinfo"
mtd21: 09600000 00020000 "kernel"
mtd22: 09000000 00020000 "rootfs"
mtd23: 09600000 00020000 "alt_kernel"
mtd24: 09000000 00020000 "alt_rootfs"
mtd25: 00200000 00020000 "sysdiag"
mtd26: 00080000 00020000 "0:ETHPHYFW"
mtd27: 0b800000 00020000 "syscfg"
mtd28: 00900000 00020000 "0:WIFIFW"

----EPROM Manufacturer Data-----
mfg_data_version = 1
modelNumber = MX5300-EU
hw_version = 48SAQA01.0GA
hw_mac_addr = C4:41:1E:F9:74:3B
manufacturer_date = 2020/09/25
serial_number = 32N10M39A11583
uuid_key = 1502C953-37AD-F9BF-A996-C4411EF9743B
wps_device_pin = 78619128

----syscfg get device::xxxx ---Manufacturer Data-----
device::uuid=1502C953-37AD-F9BF-A996-C4411EF9743B
device::manufacturerURL=http://www.linksys.com
device::serial_number=32N10M39A11583
device::model_base=MX5300
device::mac_addr=C4:41:1E:F9:74:3B
device::manufacturerDate=2020/09/25
device::cert_region=EU
device::modelNumber=MX5300-EU
device::modelDescription=Velop
device::manufacturer=Linksys
device::default_ssid=_VelopSetup43B
device::wps_pin=78619128
device::hw_revision=1
device::linksys_token=190741C9-BF5E-4B8C-99DA-F017485AD8AC
device::deviceType=urn:home-linksys-com:device:Router:1
device::num_macs=1
 



Sysinfo.cgi is a bit long, so it's on pastebin https://pastebin.com/M7YkrfxD

If it's in essense possible to run OpenWrt on this device, or it's worth the time to make a version for this device, what is needed, that I can do/help?
Open the device /photo's specs etc?

Based on the SOC, theoretically, yes.

But right now we don't have any supported ipq807x device yet - and the vendor also might have done things to prevent that (trusted boot, firmware signing, etc.). At this moment it's not possible to tell.

Ok, crystal clear then :wink:

A bit off topic, Is there any way to try to ssl into the device, a know hack or something?

+1
Any documentation for testing on MX5300?

This is not at all about 'testing' at this point, but very basic/ initial development starting from zero.

Looks like I will have to get my hands on this bad boy too. We'll see here in a bit.

1 Like