On the T45
18 Oct 2025as already rumored, the T45 is basically a beefed-up T40, with some parts substituted for (likely) cheaper alternatives. i wanted to check that myself, so i decided ask on the OpenWrt forum if anyone had a T45 they could provide flash dumps from.
Acquiring Dumps
to figure out the difference, i knew i needed the following:
- at least the first 256 bytes of the spi flash, containing PBI and RCW
- the kernel and device tree blob, on watchguard firmwares usually bundled in a u-boot .itb file
- output of
mdio listfrom u-boot, to double-check the PHY configuration
assuming watchguard doesn’t do some crazy initialization in either u-boot or the linux kernel itself, that should be enough information to figure out the hardware differences.
the very kind user @hmartin on the OpenWrt forum provided me with the first and third items. as for the kernel and device tree, well… it turns out you can just extract them from the official firmware update files. simply download the update image for use from the web-ui, and open it with a tool like 7-zip. nothing special there.
sadly (or luckily, if you’re watchguard), there’s some checks in the firmware updater that prevent us from using a modified update image.
Differences and Findings
first of, i also ask for the same information from a T40, just to be sure that my T40 matches what others have. luckily, it does.
now, let’s get to the differences between the T40 and T45:
- the RCW has no significant differences, only some pin muxing changes. and, of course, the PLL ratio of the cpu cores is changed.
- MDIO assignments as reported by u-boot are identical
- the LAN1-4 PHYs are likely the same, but the WAN0 PHY differs (Qualcomm AR8035 vs RealTek RTL8211F). Both are RGMII tho, so likely not significant.
- the device tree is fairly similar, with some differences here and there. i’m not fully sure, but i think that the ethernet PHY configuration should still be close enough to make the T40 dts work on the T45.
i think that you’d just need to add the kernel driver for the Realtek PHY to my T40 Linux in order to get WAN0 working on the T45.
Details
- RCW:
- CGA_PLL1_RAT: 10:1 -> 16:1 (1GHz -> 1.6GHz CPU)
- UART_BASE: 0x07 -> 0x06: UART pinmux differs
- SDHC_BASE: 0x01 -> 0x00: SDHC pinmux differs
- SPI_BASE: 0x02 -> 0x01: SPI pinmux differs
- IFC_GRP_E1_EXT: 0x00 -> 0x02: IFC pinmux differs
- IFC_GRP_E1_BASE: 0x01 -> 0x00: IFC pinmux differs
- IIC2_EXT: 0x02 -> 0x00: IIC2 Pinmux differs
- Device Tree:
esdhc@1560000 is enabled,bus-widthis changed to 8 bits andcap-mmc-highspeedis addedtpm@29(atmel,at97sc3204t) node is replaced bytpm@2e(tcg,tpm)- PWM controller
pwm0@2a30000is added on T45 compatible = "ethernet-phy-id001c.c984", "ethernet-phy-ieee802.3-c22"andcompatible = "ethernet-phy-id001c.c916";are added to PHY nodes on T45, absent on T40
RCW Dump Output for T40 and T45
T40:
-- System Info --
Flash dump: t45\t40_flashstart_mm.bin
Initial QSPI endianess: QWORD_LITTLE_ENDIAN
Assumed SOC Model: LS1043A
-- PBI Parser Messages ---
ALTCBAR set to 00002200 by PBI write
ALTCBAR set to 00000300 by PBI write
QSPI Endianess set to DWORD_LITTLE_ENDIAN due to QUADSPI_MCR write
-- RAW PBI Frames --
WRITE @ DCFG_CCSR_RCWSR0 (0x01EE0100): 0610000a0a0000000000000000000000455800020000001240044000c10020000000000000000000000000000003fffe200045040418320a0000009600000001 (CCSR)
WRITE @ SCFG_QSPI_CFG (0x0157015C): 40100000 (CCSR)
WRITE @ SCFG_SCRATCHRW0 (0x01570600): 00000000 (CCSR)
WRITE @ SCFG_SCRATCHRW1 (0x01570604): 40100000 (CCSR)
WRITE @ LNDSSCR1 (0x01EA08DC): 00502880 (CCSR)
WRITE @ CCI_UNKN_BARRIER_DISABLE (0x01570178): 0000e010 (CCSR)
WRITE @ CCI_400_Control_Override (0x01180000): 00000008 (CCSR)
WRITE @ SCFG_USB_REFCLK_SELCR1 (0x01570418): 0000009e (CCSR)
WRITE @ SCFG_USB_REFCLK_SELCR2 (0x0157041C): 0000009e (CCSR)
WRITE @ SCFG_USB_REFCLK_SELCR3 (0x01570420): 0000009e (CCSR)
WRITE @ DCFG_CCSR_RSTRQMR1 (0x01EE00C0): 00004400 (CCSR)
WRITE @ SCFG_ALTCBAR (0x01570158): 00002200 (CCSR)
WRITE @ PEX_OUTBOUND_WRITE_HANG_ERRATUM (0x22008040): 00000001 (ACS)
WRITE @ LNDSSCR1 (0x01EA08DC): 00502880 (CCSR)
WRITE @ SCFG_ALTCBAR (0x01570158): 00000300 (CCSR)
WRITE @ PEX1_GEN3_RElATED_OFF_ERRATUM (0x03400890): 01000100 (ACS)
WRITE @ PEX2_GEN3_RElATED_OFF_ERRATUM (0x03500890): 01000100 (ACS)
WRITE @ PEX3_GEN3_RElATED_OFF_ERRATUM (0x03600890): 01000100 (ACS)
WRITE @ QUADSPI_MCR (0x01550000): 000f400c (CCSR)
COMMAND @ PBI_CRC: 0x06DE05A9 (current) == 0x06DE05A9 (calculated) -> PASS
-- RCW Fields --
SYS_PLL_CFG: 0x0 | 0 | 0b0 | OK
SYS_PLL_RAT: 0x3 | 3 | 0b11 | 3:1
MEM_PLL_CFG: 0x0 | 0 | 0b0 | OK
MEM_PLL_RAT: 0x10 | 16 | 0b10000 | 16:1
CGA_PLL1_CFG: 0x0 | 0 | 0b0 | OK
CGA_PLL1_RAT: 0xA | 10 | 0b1010 | 10:1
CGA_PLL2_CFG: 0x0 | 0 | 0b0 | OK
CGA_PLL2_RAT: 0xA | 10 | 0b1010 | 10:1
C1_PLL_SEL: 0x0 | 0 | 0b0 | CGA_PLL1 /1
SRDS_PRTCL_S1: 0x4558 | 17752 | 0b100010101011000 |
FM1_MAC_RAT: 0x1 | 1 | 0b1 |
SRDS_PLL_REF_CLK_SEL_S1: 0x0 | 0 | 0b0 |
HDLC1_MODE: 0x0 | 0 | 0b0 |
HDLC2_MODE: 0x0 | 0 | 0b0 |
SRDS_PLL_PD_S1: 0x0 | 0 | 0b0 |
SRDS_DIV_PEX: 0x0 | 0 | 0b0 |
DDR_REFCLK_SEL: 0x1 | 1 | 0b1 |
LYNX_REFCLK_SEL: 0x0 | 0 | 0b0 |
DDR_FDBK_MULT: 0x2 | 2 | 0b10 |
PBI_SRC: 0x4 | 4 | 0b100 | QSPI
BOOT_HO: 0x0 | 0 | 0b0 | All cores expect core 0 in hold off
SB_EN: 0x0 | 0 | 0b0 | Secure Boot Disabled
IFC_MODE: 0x44 | 68 | 0b1000100 |
HWA_CGA_M1_CLK_SEL: 0x6 | 6 | 0b110 | Async mode, Cluster Group A PLL 2 /3 is clock
DRAM_LAT: 0x1 | 1 | 0b1 | 8-8-8 or higher latency DRAMs
DDR_RATE: 0x0 | 0 | 0b0 |
DDR_RSV0: 0x0 | 0 | 0b0 |
SYS_PLL_SPD: 0x1 | 1 | 0b1 |
MEM_PLL_SPD: 0x0 | 0 | 0b0 |
CGA_PLL1_SPD: 0x0 | 0 | 0b0 |
CGA_PLL2_SPD: 0x0 | 0 | 0b0 |
HOST_AGT_PEX: 0x0 | 0 | 0b0 |
GP_INFO: 0x0 | 0 | 0b0 |
UART_EXT: 0x0 | 0 | 0b0 | See UART_BASE
IRQ_EXT: 0x0 | 0 | 0b0 |
SPI_EXT: 0x0 | 0 | 0b0 | See SPI_BASE
SDHC_EXT: 0x0 | 0 | 0b0 | See SDHC_BASE
UART_BASE: 0x7 | 7 | 0b111 | { UART1_SOUT, UART1_SIN, UART3_SOUT,UART3_SIN, UART2_SOUT, UART2_SIN, UART4_SOUT, UART4_SIN }
ASLEEP: 0x1 | 1 | 0b1 |
RTC: 0x1 | 1 | 0b1 |
SDHC_BASE: 0x1 | 1 | 0b1 | GPIO2[4:9]
IRQ_OUT: 0x1 | 1 | 0b1 |
IRQ_BASE: 0x1FF | 511 | 0b111111111 |
SPI_BASE: 0x2 | 2 | 0b10 | GPIO2[0:3]
IFC_GRP_A_EXT: 0x1 | 1 | 0b1 |
IFC_GRP_D_EXT: 0x0 | 0 | 0b0 |
IFC_GRP_E1_EXT: 0x0 | 0 | 0b0 | See IFC_GRP_E1_BASE
IFC_GRP_F_EXT: 0x1 | 1 | 0b1 |
IFC_GRP_G_EXT: 0x0 | 0 | 0b0 |
IFC_GRP_E1_BASE: 0x1 | 1 | 0b1 | GPIO2[10:12]
IFC_GRP_D_BASE: 0x1 | 1 | 0b1 |
IFC_GRP_A_BASE: 0x1 | 1 | 0b1 |
IFC_A_22_24: 0x0 | 0 | 0b0 |
EC1: 0x0 | 0 | 0b0 | RGMII1
EC2: 0x1 | 1 | 0b1 | GPIO3, GPIO3[19:23]
EM1: 0x0 | 0 | 0b0 | MDC/MDIO (EM1)
EM2: 0x0 | 0 | 0b0 | MDC/MDIO (EM2)
EMI2_DMODE: 0x1 | 1 | 0b1 |
EMI2_CMODE: 0x1 | 1 | 0b1 |
USB_DRVVBUS: 0x0 | 0 | 0b0 | USB_DRVVBUS
USB_PWRFAULT: 0x0 | 0 | 0b0 | USB_PWRFAULT
TVDD_VSEL: 0x1 | 1 | 0b1 | 2.5V
DVDD_VSEL: 0x2 | 2 | 0b10 | 3.3V
QE_CLK_OVRRIDE: 0x0 | 0 | 0b0 |
EMI1_DMODE: 0x1 | 1 | 0b1 |
EVDD_VSEL: 0x0 | 0 | 0b0 | 1.8V
IIC2_BASE: 0x0 | 0 | 0b0 | OK
EMI1_CMODE: 0x1 | 1 | 0b1 |
IIC2_EXT: 0x2 | 2 | 0b10 | GPIO4_2, GPIO4_3
SYSCLK_FREQ: 0x258 | 600 | 0b1001011000 | 100.000 MHz (100000200 Hz)
HWA_CGA_M2_CLK_SEL: 0x1 | 1 | 0b1 | Async mode, Cluster Group A PLL 2 /1 is clock
-- Effective Clocks --
SYSCLK: 100.00 MHz
System (Bus): 300.00 MHz
CGA (Cores): 1000.00 MHz
MEM (Memory): 1600.00 MHz
HWA_CGA_M1 (FMAN): 500.00 MHz
HWA_CGA_M2 (eSDHC & QuadSPI): 1000.00 MHz
-- Erratum Workarounds --
Erratum A-009859 workaround: Yes
Erratum A-009929 workaround: Yes
-- CRC Results --
CRC Frame Present: Yes
CRC Offset: 0x00DC
In-File CRC: 0x06DE05A9
Calculated CRC: 0x06DE05A9
CRC Valid?: Yes
T45:
-- System Info --
Flash dump: t45\t45_flashstart_mm.bin
Initial QSPI endianess: QWORD_LITTLE_ENDIAN
Assumed SOC Model: LS1043A
-- PBI Parser Messages ---
ALTCBAR set to 00002200 by PBI write
ALTCBAR set to 00000300 by PBI write
QSPI Endianess set to DWORD_LITTLE_ENDIAN due to QUADSPI_MCR write
-- RAW PBI Frames --
WRITE @ DCFG_CCSR_RCWSR0 (0x01EE0100): 061000100a0000000000000000000000455800020000001240044000c100200000000000000000000000000000036ffd20044104041832080000009600000001 (CCSR)
WRITE @ SCFG_QSPI_CFG (0x0157015C): 40100000 (CCSR)
WRITE @ SCFG_SCRATCHRW0 (0x01570600): 00000000 (CCSR)
WRITE @ SCFG_SCRATCHRW1 (0x01570604): 40100000 (CCSR)
WRITE @ LNDSSCR1 (0x01EA08DC): 00502880 (CCSR)
WRITE @ CCI_UNKN_BARRIER_DISABLE (0x01570178): 0000e010 (CCSR)
WRITE @ CCI_400_Control_Override (0x01180000): 00000008 (CCSR)
WRITE @ SCFG_USB_REFCLK_SELCR1 (0x01570418): 0000009e (CCSR)
WRITE @ SCFG_USB_REFCLK_SELCR2 (0x0157041C): 0000009e (CCSR)
WRITE @ SCFG_USB_REFCLK_SELCR3 (0x01570420): 0000009e (CCSR)
WRITE @ DCFG_CCSR_RSTRQMR1 (0x01EE00C0): 00004400 (CCSR)
WRITE @ SCFG_ALTCBAR (0x01570158): 00002200 (CCSR)
WRITE @ PEX_OUTBOUND_WRITE_HANG_ERRATUM (0x22008040): 00000001 (ACS)
WRITE @ LNDSSCR1 (0x01EA08DC): 00502880 (CCSR)
WRITE @ SCFG_ALTCBAR (0x01570158): 00000300 (CCSR)
WRITE @ PEX1_GEN3_RElATED_OFF_ERRATUM (0x03400890): 01000100 (ACS)
WRITE @ PEX2_GEN3_RElATED_OFF_ERRATUM (0x03500890): 01000100 (ACS)
WRITE @ PEX3_GEN3_RElATED_OFF_ERRATUM (0x03600890): 01000100 (ACS)
WRITE @ QUADSPI_MCR (0x01550000): 000f400c (CCSR)
COMMAND @ PBI_CRC: 0x67AAF2F5 (current) == 0x67AAF2F5 (calculated) -> PASS
-- RCW Fields --
SYS_PLL_CFG: 0x0 | 0 | 0b0 | OK
SYS_PLL_RAT: 0x3 | 3 | 0b11 | 3:1
MEM_PLL_CFG: 0x0 | 0 | 0b0 | OK
MEM_PLL_RAT: 0x10 | 16 | 0b10000 | 16:1
CGA_PLL1_CFG: 0x0 | 0 | 0b0 | OK
CGA_PLL1_RAT: 0x10 | 16 | 0b10000 | 16:1
CGA_PLL2_CFG: 0x0 | 0 | 0b0 | OK
CGA_PLL2_RAT: 0xA | 10 | 0b1010 | 10:1
C1_PLL_SEL: 0x0 | 0 | 0b0 | CGA_PLL1 /1
SRDS_PRTCL_S1: 0x4558 | 17752 | 0b100010101011000 |
FM1_MAC_RAT: 0x1 | 1 | 0b1 |
SRDS_PLL_REF_CLK_SEL_S1: 0x0 | 0 | 0b0 |
HDLC1_MODE: 0x0 | 0 | 0b0 |
HDLC2_MODE: 0x0 | 0 | 0b0 |
SRDS_PLL_PD_S1: 0x0 | 0 | 0b0 |
SRDS_DIV_PEX: 0x0 | 0 | 0b0 |
DDR_REFCLK_SEL: 0x1 | 1 | 0b1 |
LYNX_REFCLK_SEL: 0x0 | 0 | 0b0 |
DDR_FDBK_MULT: 0x2 | 2 | 0b10 |
PBI_SRC: 0x4 | 4 | 0b100 | QSPI
BOOT_HO: 0x0 | 0 | 0b0 | All cores expect core 0 in hold off
SB_EN: 0x0 | 0 | 0b0 | Secure Boot Disabled
IFC_MODE: 0x44 | 68 | 0b1000100 |
HWA_CGA_M1_CLK_SEL: 0x6 | 6 | 0b110 | Async mode, Cluster Group A PLL 2 /3 is clock
DRAM_LAT: 0x1 | 1 | 0b1 | 8-8-8 or higher latency DRAMs
DDR_RATE: 0x0 | 0 | 0b0 |
DDR_RSV0: 0x0 | 0 | 0b0 |
SYS_PLL_SPD: 0x1 | 1 | 0b1 |
MEM_PLL_SPD: 0x0 | 0 | 0b0 |
CGA_PLL1_SPD: 0x0 | 0 | 0b0 |
CGA_PLL2_SPD: 0x0 | 0 | 0b0 |
HOST_AGT_PEX: 0x0 | 0 | 0b0 |
GP_INFO: 0x0 | 0 | 0b0 |
UART_EXT: 0x0 | 0 | 0b0 | See UART_BASE
IRQ_EXT: 0x0 | 0 | 0b0 |
SPI_EXT: 0x0 | 0 | 0b0 | See SPI_BASE
SDHC_EXT: 0x0 | 0 | 0b0 | See SDHC_BASE
UART_BASE: 0x6 | 6 | 0b110 | { UART1_SOUT, UART1_SIN, UART1_RTS_B, UART1_CTS_B, UART2_SOUT, UART2_SIN, UART2_RTS_B, UART2_CTS_B }
ASLEEP: 0x1 | 1 | 0b1 |
RTC: 0x1 | 1 | 0b1 |
SDHC_BASE: 0x0 | 0 | 0b0 | { SDHC_CMD, SDHC_DAT[0:3], SDHC_CLK }
IRQ_OUT: 0x1 | 1 | 0b1 |
IRQ_BASE: 0x1FF | 511 | 0b111111111 |
SPI_BASE: 0x1 | 1 | 0b1 | SDHC_DAT[4:7] for 8-bit MMC card support
IFC_GRP_A_EXT: 0x1 | 1 | 0b1 |
IFC_GRP_D_EXT: 0x0 | 0 | 0b0 |
IFC_GRP_E1_EXT: 0x2 | 2 | 0b10 | { FTM7_CH0, FTM7_CH1, FTM7_EXTCLK }
IFC_GRP_F_EXT: 0x1 | 1 | 0b1 |
IFC_GRP_G_EXT: 0x0 | 0 | 0b0 |
IFC_GRP_E1_BASE: 0x0 | 0 | 0b0 | IFC_CS_B[1:3]
IFC_GRP_D_BASE: 0x1 | 1 | 0b1 |
IFC_GRP_A_BASE: 0x1 | 1 | 0b1 |
IFC_A_22_24: 0x0 | 0 | 0b0 |
EC1: 0x0 | 0 | 0b0 | RGMII1
EC2: 0x1 | 1 | 0b1 | GPIO3, GPIO3[19:23]
EM1: 0x0 | 0 | 0b0 | MDC/MDIO (EM1)
EM2: 0x0 | 0 | 0b0 | MDC/MDIO (EM2)
EMI2_DMODE: 0x1 | 1 | 0b1 |
EMI2_CMODE: 0x1 | 1 | 0b1 |
USB_DRVVBUS: 0x0 | 0 | 0b0 | USB_DRVVBUS
USB_PWRFAULT: 0x0 | 0 | 0b0 | USB_PWRFAULT
TVDD_VSEL: 0x1 | 1 | 0b1 | 2.5V
DVDD_VSEL: 0x2 | 2 | 0b10 | 3.3V
QE_CLK_OVRRIDE: 0x0 | 0 | 0b0 |
EMI1_DMODE: 0x1 | 1 | 0b1 |
EVDD_VSEL: 0x0 | 0 | 0b0 | 1.8V
IIC2_BASE: 0x0 | 0 | 0b0 | OK
EMI1_CMODE: 0x1 | 1 | 0b1 |
IIC2_EXT: 0x0 | 0 | 0b0 | IIC2_SCL, IIC2_SDA
SYSCLK_FREQ: 0x258 | 600 | 0b1001011000 | 100.000 MHz (100000200 Hz)
HWA_CGA_M2_CLK_SEL: 0x1 | 1 | 0b1 | Async mode, Cluster Group A PLL 2 /1 is clock
-- Effective Clocks --
SYSCLK: 100.00 MHz
System (Bus): 300.00 MHz
CGA (Cores): 1600.00 MHz
MEM (Memory): 1600.00 MHz
HWA_CGA_M1 (FMAN): 500.00 MHz
HWA_CGA_M2 (eSDHC & QuadSPI): 1000.00 MHz
-- Erratum Workarounds --
Erratum A-009859 workaround: Yes
Erratum A-009929 workaround: Yes
-- CRC Results --
CRC Frame Present: Yes
CRC Offset: 0x00DC
In-File CRC: 0x67AAF2F5
Calculated CRC: 0x67AAF2F5
CRC Valid?: Yes