Adding OpenWrt support for QNAP QHora-301W

Interesting, looks they have 3 kernel-partitions (HLOS) and 3 related rootfs-partitions + 1 rootfs_data partition (boot switch might be current_entry=0)

1 and 2 seem to be the Firmware that I had used before I flashed their latest Version. This could be means to downgrade the FW (because the WebUI does not allow downgrades)

@JunkerJorg Can you check if secure boot is enabled?
U-boot will have a command for that

IPQ807x# is_sec_boot_enabled
secure boot fuse is not enabled
2 Likes

Great, I was afraid that they enabled secure boot as they use encrypted firmware.

So, running custom SW is then possible.

So what are the next steps? What is needed to set up a dev-environment? Are there any "onboarding" guides? And how is the device un-bricked if things go south?

Set up a dev environment is described here:

Adding a new device is described here:

At the moment the platform (ipq807x) of the 301w is unsupported, but there are efforts to run OpenWRT on that.

Robimarko, Ansuel, Apache14 and others are working on support for the Xiaomi AX3600 which uses the ipq8071 (this is a downclocked version of the ipq8072/8074)
Have a look: https://forum.openwrt.org/t/adding-openwrt-support-for-xiaomi-ax3600

And a few guys have ordered the Xiaomi AX9000, which also uses the ipq8072.
That means, maybe there will be support for the ipq8072/8074 as well, that would be the foundation for support for your device.

But there are a lot of things to do to support a specific device. For example, create a valid dts, get the right board files for the radios, find the right flash layout, build sysupgrade support and so on.

The first big step is to build an initramfs image, this can be booted from uboot and runs completely in the ram without interfering the flash partitions.

What you can do is, creating a site for the device with all the necessary informations (uart access, bootlog, printenv, pictures etc.)
Like someone did for the AX3600: https://openwrt.org/inbox/toh/xiaomi/xiaomi_ax3600

The FW can be found here:

The FW can be decrypted using this script:

And the secret are the first 9 characters of the filename...

1 Like

I don't have wiki privileges. But here are some pictures:




1 Like

@JunkerJorg Are you sure that the decryption script works?
For me the output is encrypted still after it doing its thing.

Can you find the UART header or pads on the board?

It works 100% (try not to decompress the img first)
run the script directly on HORA_301W_20210429-1.5.8.0001.img and than decompress the output.

I marked the Rx/Tx pins in the first Image, there was no soldering required.

Yeah, that is what I am doing.

./qnap-qts-fw-cryptor.py d HORA_301W HORA_301W_20210429-1.5.8.0001.img HORA_301W_20210429-1.5.8.0001.img.decrypted

But the output file is still encrypted.

LOL, I see it now in the first image.

That is correct. have you tried opening the decrypted file with 7zip?

TAR now worked fine, it was complaining before, it really does not like when the extension is not correct.

I wanted to see what QSDK version was used, it looks like the NSS FW was a custom build for Qnap.

I am interested in how the dual 10Gb ports are done?
Can you find the AQuantia PHY-s on the board?

Let me know what I can do. I will undust my Linux installation and try to sync the repository. In the meantime will also try to figure out more stuff from the device itself.

The AQuantia Chips are on top of the main SoC in the last image

It would be best to document everything until IPQ8072/4/6/8A are supported as they differ from the IPQ8071A currently supported.
I am still waiting for the AX9000 in shipping, so once that I arrives I can start adding support for those.

Yeah, I can see the AQuantia branding, but the model is not readable.
Can you maybe read it?

The forum limits uploads to less than 1MB even though the error message states 4MB. Anyways here is your crop:

Thanks, those are not upstream supported currently.
But it does not matter as we are using SSDK, but I think that firmware uploading will be required for those.

I dont have any boards with these new AQR 10G PHY-s unfortunately.

Have you looked in usr.squashfs\share\10G_FW\ ... is that what you are looking for?