ath79: add support for ZyXEL NBG6616

Specifications:

  SoC: Qualcomm Atheros QCA9557
  RAM: 128 MB (Nanya NT5TU32M16EG-AC)
  Flash: 16 MB (Macronix MX25L12845EMI-10G)
  Ethernet: 5x 10/100/1000 (1x WAN, 4x LAN)
  Wireless: QCA9557 2.4GHz (nbg), QCA9882 5GHz (ac)
  USB: 2x USB 2.0 port
  Buttons: 1x Reset
  Switches: 1x Wifi
  LEDs: 11 (Pwr, WAN, 4x LAN, 2x Wifi, 2x USB, WPS)

MAC addresses:

WAN *:3f uboot-env ethaddr + 3
LAN *:3e uboot-env ethaddr + 2
2.4GHz *:3c uboot-env ethaddr
5GHz *:3d uboot-env ethaddr + 1

The label contains all four MAC addresses, however the one without
increment is first, so this one is taken for label MAC address.

Notes:

The Wifi is controlled by an on/off button, i.e. has to be implemented
by a switch (EV_SW). Despite, it appears that GPIO_ACTIVE_HIGH needs
to be used, just like recently fixed for the NBG6716.
Both parameters have been wrong at ar71xx.

Flash Instructions:

At first the U-Boot variables need to be changed in order to boot the
new combined image format. ZyXEL uses a split kernel + root setup and
the current kernel is too large to fit into the partition. As resizing
didnt do the trick, I've decided to use the prefered combined image
approach to be future-kernel-enlargement-proof (thanks to blocktrron for
the assistance).

First add a new variable called boot_openwrt:
setenv boot_openwrt bootm 0x9F120000

After that overwrite the bootcmd and save the environment:
setenv bootcmd run boot_openwrt
saveenv

After that you can flash the openwrt factory image via TFTP. The servers
IP has to be 192.168.1.33. Connect to one of the LAN ports and hold the
WPS Button while booting. After a few seconds the NBG6616 will look for
a image file called 'ras.bin' and flash it.

Return to vendor firmware is possible by resetting the bootcmd:
setenv bootcmd run boot_flash
saveenv
and flashing the vendor image via the TFTP method as described above.

Accessing the U-Boot Shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:

|    Hit any key to stop autoboot:  3

The user is then dropped to a locked shell.

| NBG6616> ?
| ATEN	x,(y)     set BootExtension Debug Flag (y=password)
| ATSE	x         show the seed of password generator
| ATSH	          dump manufacturer related data in ROM
| ATRT	(x,y,z,u) ATRT RAM read/write test (x=level, y=start addr, z=end addr, u=iterations
| ATGO	          boot up whole system
| ATUR	x         upgrade RAS image (filename)

In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!

First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.

| NBG6616> ATSE NBG6616
| 00C91D7EAC3C

This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):

- tool.sh -
ror32() {
  echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -

| # bash ./tool.sh 00C91D7EAC3C
| ATEN 1,10FDFF5

Copy and paste the result into the shell to unlock zloader.

| NBG6616> ATEN 1,10FDFF5

If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.

| NBG6616> ATGU
| NBG6616#

Signed-off-by: Christoph Krapp <achterin@googlemail.com>
[move keys to DTSI, adjust usb_power DT label, remove kernel config
change, extend commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>

8 files changed, 313 insertions, 145 deletions

diff --git a/target/linux/ath79/dts/qca9557_zyxel_nbg6616.dts b/target/linux/ath79/dts/qca9557_zyxel_nbg6616.dts
new file mode 100644
index 0000000000..81fe766fd9
--- /dev/null
+++ b/target/linux/ath79/dts/qca9557_zyxel_nbg6616.dts
@@ -0,0 +1,126 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+
+#include "qca955x_zyxel_nbg6x16.dtsi"
+
+/ {
+	compatible = "zyxel,nbg6616", "qca,qca9557";
+	model = "ZyXEL NBG6616";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "nbg6616:green:power";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		usb1 {
+			label = "nbg6616:green:usb1";
+			gpios = <&gpio 21 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "usbport";
+			trigger-sources = <&hub_port0>;
+		};
+
+		usb2 {
+			label = "nbg6616:green:usb2";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "usbport";
+			trigger-sources = <&hub_port1>;
+		};
+
+		wifi2g {
+			label = "nbg6616:green:wifi2g";
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wifi5g {
+			label = "nbg6616:green:wifi5g";
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wps {
+			label = "nbg6616:green:wps";
+			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&gpio_usb_power {
+	line-name = "nbg6616:power:usb";
+};
+
+&spi {
+	status = "okay";
+
+	num-cs = <1>;
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x030000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x030000 0x010000>;
+			};
+
+			art: partition@40000 {
+				label = "art";
+				reg = <0x040000 0x010000>;
+				read-only;
+			};
+
+			partition@50000 {
+				label = "zyxel_rfsd";
+				reg = <0x050000 0x060000>;
+			};
+
+			partition@b0000 {
+				label = "romd";
+				reg = <0x0b0000 0x060000>;
+			};
+
+			partition@110000 {
+				label = "header";
+				reg = <0x110000 0x010000>;
+			};
+
+			partition@120000 {
+				label = "firmware";
+				reg = <0x120000 0xee0000>;
+				compatible = "denx,uimage";
+			};
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+
+	wifi@0,0 {
+		compatible = "qcom,ath10k";
+		reg = <0 0 0 0 0>;
+		qca,no-eeprom;
+	};
+};
diff --git a/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts b/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
index 2249263522..90328078dd 100644
--- a/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
+++ b/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
@@ -1,10 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 /dts-v1/;
 
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-
-#include "qca955x.dtsi"
+#include "qca955x_zyxel_nbg6x16.dtsi"
 
 / {
 	compatible = "zyxel,nbg6716", "qca,qca9558";
@@ -61,59 +58,26 @@
 			gpios = <&gpio 21 GPIO_ACTIVE_LOW>;
 		};
 	};
+};
 
-	keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			linux,code = <KEY_RESTART>;
-			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
-
-		wifi {
-			label = "WiFi button";
-			linux,code = <KEY_RFKILL>;
-			linux,input-type = <EV_SW>;
-			gpios = <&gpio 1 GPIO_ACTIVE_HIGH>;
-			debounce-interval = <60>;
-		};
-
-		usb1 {
-			label = "USB1 eject button";
-			linux,code = <BTN_1>;
-			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
-
-		usb2 {
-			label = "USB2 eject button";
-			linux,code = <BTN_2>;
-			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
-
-		wps {
-			label = "WPS button";
-			linux,code = <KEY_WPS_BUTTON>;
-			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
+&keys {
+	usb1 {
+		label = "USB1 eject button";
+		linux,code = <BTN_1>;
+		gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
+		debounce-interval = <60>;
 	};
-};
 
-&gpio {
-	usb_power {
-		gpio-hog;
-		gpios = <16 0>;
-		output-high;
-		line-name = "nbg6716:power:usb";
+	usb2 {
+		label = "USB2 eject button";
+		linux,code = <BTN_2>;
+		gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		debounce-interval = <60>;
 	};
 };
 
-&uart {
-	status = "okay";
+&gpio_usb_power {
+	line-name = "nbg6716:power:usb";
 };
 
 &spi {
@@ -196,71 +160,6 @@
 	};
 };
 
-&mdio0 {
-	status = "okay";
-
-	phy17: ethernet-phy@11 {
-		reg = <0x11>;
-		phy-mode = "rgmii-id";
-	};
-
-	switch0@1f {
-		compatible = "qca,ar8327";
-		reg = <0x1f>;
-		qca,ar8327-initvals = <
-			0x04 0x87600000 /* PORT0 PAD MODE CTRL */
-			0x0c 0x00080080 /* PORT6 PAD MODE CTRL */
-			0x10 0x81000080 /* POWER_ON_STRAP */
-			0x50 0xffb7ffb7 /* LED_CTRL0 */
-			0x54 0xffb7ffb7 /* LED_CTRL1 */
-			0x58 0xffb7ffb7 /* LED_CTRL2 */
-			0x5c 0x03ffff00 /* LED_CTRL3 */
-			0x7c 0x0000007e /* PORT0_STATUS */
-			0x94 0x0000007e /* PORT6 STATUS */
-			>;
-	};
-};
-
-&mdio1 {
-	status = "okay";
-
-	phy1: ethernet-phy@1 {
-		reg = <1>;
-		phy-mode = "sgmii";
-	};
-};
-
-
-&eth0 {
-	status = "okay";
-
-	pll-data = <0xa6000000 0x00000101 0x00001616>;
-	phy-handle = <&phy17>;
-
-	fixed-link {
-		speed = <1000>;
-		full-duplex;
-	};
-};
-
-&eth1 {
-	status = "okay";
-
-	pll-data = <0x03000101 0x00000101 0x00001616>;
-	phy-handle = <&phy1>;
-
-	fixed-link {
-		speed = <1000>;
-		full-duplex;
-	};
-};
-
-&wmac {
-	status = "okay";
-
-	mtd-cal-data = <&art 0x1000>;
-};
-
 &pcie1 {
 	status = "okay";
 
@@ -270,30 +169,3 @@
 		qcom,ath10k-calibration-variant = "ZyXEL-NBG6716";
 	};
 };
-
-&usb_phy0 {
-	status = "okay";
-};
-
-&usb_phy1 {
-	status = "okay";
-};
-
-&usb0 {
-	status = "okay";
-
-	hub_port0: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
-
-};
-
-&usb1 {
-	status = "okay";
-
-	hub_port1: port@1 {
-		reg = <1>;
-		#trigger-source-cells = <0>;
-	};
-};
diff --git a/target/linux/ath79/dts/qca955x_zyxel_nbg6x16.dtsi b/target/linux/ath79/dts/qca955x_zyxel_nbg6x16.dtsi
new file mode 100644
index 0000000000..dfc6728be1
--- /dev/null
+++ b/target/linux/ath79/dts/qca955x_zyxel_nbg6x16.dtsi
@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+#include "qca955x.dtsi"
+
+/ {
+	keys: keys {
+		compatible = "gpio-keys";
+
+		wifi {
+			label = "WiFi on/off button";
+			linux,code = <KEY_RFKILL>;
+			linux,input-type = <EV_SW>;
+			gpios = <&gpio 1 GPIO_ACTIVE_HIGH>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "WPS button";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		reset {
+			label = "Reset button";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+};
+
+&gpio {
+	gpio_usb_power: usb_power {
+		gpio-hog;
+		gpios = <16 0>;
+		output-high;
+	};
+};
+
+&uart {
+	status = "okay";
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy17: ethernet-phy@11 {
+		reg = <0x11>;
+		phy-mode = "rgmii-id";
+	};
+
+	switch0@1f {
+		compatible = "qca,ar8327";
+		reg = <0x1f>;
+		qca,ar8327-initvals = <
+			0x04 0x87600000 /* PORT0 PAD MODE CTRL */
+			0x0c 0x00080080 /* PORT6 PAD MODE CTRL */
+			0x10 0x81000080 /* POWER_ON_STRAP */
+			0x50 0xffb7ffb7 /* LED_CTRL0 */
+			0x54 0xffb7ffb7 /* LED_CTRL1 */
+			0x58 0xffb7ffb7 /* LED_CTRL2 */
+			0x5c 0x03ffff00 /* LED_CTRL3 */
+			0x7c 0x0000007e /* PORT0_STATUS */
+			0x94 0x0000007e /* PORT6 STATUS */
+			>;
+	};
+};
+
+&mdio1 {
+	status = "okay";
+
+	phy1: ethernet-phy@1 {
+		reg = <1>;
+		phy-mode = "sgmii";
+	};
+};
+
+
+&eth0 {
+	status = "okay";
+
+	pll-data = <0xa6000000 0x00000101 0x00001616>;
+	phy-handle = <&phy17>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&eth1 {
+	status = "okay";
+
+	pll-data = <0x03000101 0x00000101 0x00001616>;
+	phy-handle = <&phy1>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&wmac {
+	status = "okay";
+
+	mtd-cal-data = <&art 0x1000>;
+};
+
+&usb_phy0 {
+	status = "okay";
+};
+
+&usb_phy1 {
+	status = "okay";
+};
+
+&usb0 {
+	status = "okay";
+
+	hub_port0: port@1 {
+		reg = <1>;
+		#trigger-source-cells = <0>;
+	};
+
+};
+
+&usb1 {
+	status = "okay";
+
+	hub_port1: port@1 {
+		reg = <1>;
+		#trigger-source-cells = <0>;
+	};
+};
diff --git a/target/linux/ath79/generic/base-files/etc/board.d/02_network b/target/linux/ath79/generic/base-files/etc/board.d/02_network
index b4e1829618..01b083ddad 100755
--- a/target/linux/ath79/generic/base-files/etc/board.d/02_network
+++ b/target/linux/ath79/generic/base-files/etc/board.d/02_network
@@ -131,7 +131,8 @@ ath79_setup_interfaces()
 			"0@eth0" "1:lan" "2:lan" "3:lan" "4:lan"
 		;;
 	comfast,cf-wr650ac-v1|\
-	comfast,cf-wr650ac-v2)
+	comfast,cf-wr650ac-v2|\
+	zyxel,nbg6616)
 		ucidef_add_switch "switch0" \
 			"0@eth0" "1:lan" "2:lan" "3:lan" "4:lan" "5:wan" "6@eth1"
 		;;
@@ -540,6 +541,9 @@ ath79_setup_macs()
 	wd,mynet-wifi-rangeextender)
 		lan_mac=$(nvram get et0macaddr)
 		;;
+	zyxel,nbg6616)
+		label_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
+		;;
 	esac
 
 	[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
diff --git a/target/linux/ath79/generic/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ath79/generic/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
index 863fdc842a..37f1792fad 100644
--- a/target/linux/ath79/generic/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+++ b/target/linux/ath79/generic/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -59,7 +59,8 @@ case "$FIRMWARE" in
 	engenius,epg5000|\
 	iodata,wn-ac1167dgr|\
 	iodata,wn-ac1600dgr2|\
-	sitecom,wlr-7100)
+	sitecom,wlr-7100|\
+	zyxel,nbg6616)
 		caldata_extract "art" 0x5000 0x844
 		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +1)
 		;;
diff --git a/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac b/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
index 8ea23a8ac6..b592da00e3 100644
--- a/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
+++ b/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
@@ -50,4 +50,9 @@ case "$board" in
 		[ "$PHYNBR" -eq 0 ] && \
 			macaddr_add "$(mtd_get_mac_text mac 0x18)" 1 > /sys${DEVPATH}/macaddress
 		;;
+	zyxel,nbg6616)
+		# Set mac address for 2.4g device
+		[ "$PHYNBR" -eq 1 ] && \
+			mtd_get_mac_ascii u-boot-env ethaddr > /sys${DEVPATH}/macaddress
+		;;
 esac
diff --git a/target/linux/ath79/generic/base-files/lib/preinit/10_fix_eth_mac.sh b/target/linux/ath79/generic/base-files/lib/preinit/10_fix_eth_mac.sh
index c5d9cd536f..ad7372eb03 100644
--- a/target/linux/ath79/generic/base-files/lib/preinit/10_fix_eth_mac.sh
+++ b/target/linux/ath79/generic/base-files/lib/preinit/10_fix_eth_mac.sh
@@ -17,6 +17,11 @@ preinit_set_mac_address() {
 	siemens,ws-ap3610)
 		ip link set dev eth0 address $(mtd_get_mac_ascii cfg1 ethaddr)
 		;;
+	zyxel,nbg6616)
+		ethaddr=$(mtd_get_mac_ascii u-boot-env ethaddr)
+		ip link set dev eth0 address $(macaddr_add $ethaddr 2)
+		ip link set dev eth1 address $(macaddr_add $ethaddr 3)
+		;;
 	esac
 }
 
diff --git a/target/linux/ath79/image/generic.mk b/target/linux/ath79/image/generic.mk
index 81117f0827..e2c37f7a57 100644
--- a/target/linux/ath79/image/generic.mk
+++ b/target/linux/ath79/image/generic.mk
@@ -1510,3 +1510,20 @@ define Device/zbtlink_zbt-wd323
 	kmod-usb-serial kmod-usb-serial-cp210x uqmi
 endef
 TARGET_DEVICES += zbtlink_zbt-wd323
+
+define Device/zyxel_nbg6616
+  SOC := qca9557
+  DEVICE_VENDOR := ZyXEL
+  DEVICE_MODEL := NBG6616
+  DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport kmod-rtc-pcf8563 \
+	kmod-ath10k-ct ath10k-firmware-qca988x-ct
+  IMAGE_SIZE := 15232k
+  RAS_BOARD := NBG6616
+  RAS_ROOTFS_SIZE := 14464k
+  RAS_VERSION := "OpenWrt Linux-$(LINUX_VERSION)"
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
+	append-rootfs | pad-rootfs | pad-to 64k | check-size | zyxel-ras-image
+  SUPPORTED_DEVICES += nbg6616
+endef
+TARGET_DEVICES += zyxel_nbg6616