ramips: Add support for Beeline SmartBox TURBO+

This adds support for Beeline Smart Box TURBO+ (Serсomm S3 CQR) router.

Device specification
--------------------
SoC Type: MediaTek MT7621AT (880 MHz, 2 cores)
RAM (Nanya NT5CC64M16GP): 128 MiB
Flash (Macronix MX30LF1G18AC): 128 MiB
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7615N): a/n/ac, 4x4
Ethernet: 5 ports - 5×GbE (WAN, LAN1-4)
USB ports: 1xUSB3.0
Buttons: 2 button (reset, wps)
LEDs: Red, Green, Blue
Zigbee (EFR32MG1B232GG): 3.0
Stock bootloader: U-Boot 1.1.3
Power: 12 VDC, 1.5 A

Installation (fw 2.0.9)
-----------------------
1.  Login to the web interface under SuperUser (root) credentials.
    Password: SDXXXXXXXXXX, where SDXXXXXXXXXX is serial number of the
    device written on the backplate stick.
2.  Navigate to Setting -> WAN. Add:
       Name - WAN1
       Connection Type - Static
       IP Address - 172.16.0.1
       Netmask - 255.255.255.0
    Save -> Apply. Set default: WAN1
3.  Enable SSH and HTTP on WAN. Setting -> Remote control. Add:
       Protocol - SSH
       Port - 22
       IP Address - 172.16.0.1
       Netmask - 255.255.255.0
       WAN Interface - WAN1
    Save ->Apply
    Add:
       Protocol - HTTP
       Port - 80
       IP Address - 172.16.0.1
       Netmask - 255.255.255.0
       WAN interface - WAN1
    Save -> Apply
4.  Set up your PC ethernet:
       Connection Type - Static
       IP Address - 172.16.0.2
       Netmask - 255.255.255.0
       Gateway - 172.16.0.1
5.  Connect PC using ethernet cable to the WAN port of the router
6.  Connect to the router using SSH shell under SuperUser account
7.  Make a mtd backup (optional, see related section)
8.  Change bootflag to Sercomm1 and reboot:
        printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
        reboot
9.  Login to the router web interface under admin account
10. Remove dots from the OpenWrt factory image filename
11. Update firmware via web using OpenWrt factory image

Revert to stock
---------------
Change bootflag to Sercomm1 in OpenWrt CLI and then reboot:
   printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3

mtd backup
----------
1. Set up a tftp server (e.g. tftpd64 for windows)
2. Connect to a router using SSH shell and run the following commands:
      cd /tmp
      for i in 0 1 2 3 4 5 6 7 8 9 10; do nanddump -f mtd$i /dev/mtd$i; \
      tftp -l mtd$i -p 172.16.0.2; md5sum mtd$i >> mtd.md5; rm mtd$i; done
      tftp -l mtd.md5 -p 171.16.0.2

Recovery
--------
Use sercomm-recovery tool.
Link: https://github.com/danitool/sercomm-recovery

MAC Addresses (fw 2.0.9)
------------------------
+-----+------------+---------+
| use | address    | example |
+-----+------------+---------+
| LAN | label      | *:e8    |
| WAN | label + 1  | *:e9    |
| 2g  | label + 4  | *:ec    |
| 5g  | label + 5  | *:ed    |
+-----+------------+---------+
The label MAC address was found in Factory 0x21000

Factory image format
--------------------
+---+-------------------+-------------+--------------------+
| # | Offset            | Size        | Description        |
+---+-------------------+-------------+--------------------+
| 1 | 0x0               | 0x200       | Tag Header Factory |
| 2 | 0x200             | 0x100       | Tag Header Kernel1 |
| 3 | 0x300             | 0x100       | Tag Header Kernel2 |
| 4 | 0x400             | SIZE_KERNEL | Kernel             |
| 5 | 0x400+SIZE_KERNEL | SIZE_ROOTFS | RootFS(UBI)        |
+---+-------------------+-------------+--------------------+

Co-authored-by: Mikhail Zhilkin <csharper2005@gmail.com>
Signed-off-by: Maximilian Weinmann <x1@disroot.org>
(cherry picked from commit 8fcfb21b16e7537b9a871a1f67cb218c6be93149)

2 files changed, 68 insertions, 9 deletions

diff --git a/target/linux/ramips/image/common-sercomm.mk b/target/linux/ramips/image/common-sercomm.mk
index 83bb2a742c..fbe29d7017 100644
--- a/target/linux/ramips/image/common-sercomm.mk
+++ b/target/linux/ramips/image/common-sercomm.mk
@@ -1,4 +1,5 @@
 DEVICE_VARS += SERCOMM_KERNEL_OFFSET SERCOMM_ROOTFS_OFFSET
+DEVICE_VARS += SERCOMM_KERNEL2_OFFSET SERCOMM_ROOTFS2_OFFSET
 
 define Build/sercomm-crypto
 	$(TOPDIR)/scripts/sercomm-crypto.py \
@@ -16,6 +17,23 @@ define Build/sercomm-crypto
 	rm -f $@.enc $@.key
 endef
 
+define Build/sercomm-factory-cqr
+	$(TOPDIR)/scripts/sercomm-pid.py \
+		--hw-version $(SERCOMM_HWVER) \
+		--hw-id $(SERCOMM_HWID) \
+		--sw-version $(SERCOMM_SWVER) \
+		--pid-file $@.fhdr
+	printf $$(stat -c%s $(IMAGE_KERNEL)) | \
+		dd seek=$$((0x70)) of=$@.fhdr bs=1 conv=notrunc 2>/dev/null
+	printf $$(($$(stat -c%s $@)-$$(stat -c%s $(IMAGE_KERNEL))-$$((0x200)))) | \
+		dd seek=$$((0x80)) of=$@.fhdr bs=1 conv=notrunc 2>/dev/null
+	dd bs=$$((0x200)) skip=1 if=$@ conv=notrunc 2>/dev/null | \
+		$(MKHASH) md5 | awk '{print $$1}' | tr -d '\n' | \
+		dd seek=$$((0x1e0)) of=$@.fhdr bs=1 conv=notrunc 2>/dev/null
+	dd if=$@ >> $@.fhdr 2>/dev/null
+	mv $@.fhdr $@
+endef
+
 define Build/sercomm-kernel
 	$(TOPDIR)/scripts/sercomm-kernel-header.py \
 		--kernel-image $@ \
@@ -26,6 +44,22 @@ define Build/sercomm-kernel
 	mv $@.hdr $@
 endef
 
+define Build/sercomm-kernel-factory
+	$(TOPDIR)/scripts/sercomm-kernel-header.py \
+		--kernel-image $@ \
+		--kernel-offset $(SERCOMM_KERNEL_OFFSET) \
+		--rootfs-offset $(SERCOMM_ROOTFS_OFFSET) \
+		--output-header $@.khdr1
+	$(TOPDIR)/scripts/sercomm-kernel-header.py \
+		--kernel-image $@ \
+		--kernel-offset $(SERCOMM_KERNEL2_OFFSET) \
+		--rootfs-offset $(SERCOMM_ROOTFS2_OFFSET) \
+		--output-header $@.khdr2
+	cat $@.khdr1 $@.khdr2 > $@.khdr
+	dd if=$@ >> $@.khdr 2>/dev/null
+	mv $@.khdr $@
+endef
+
 define Build/sercomm-part-tag
 	$(call Build/sercomm-part-tag-common,$(word 1,$(1)) $@)
 endef
@@ -64,24 +98,37 @@ define Build/sercomm-prepend-tagged-kernel
 	mv $(IMAGE_KERNEL).tagged $@
 endef
 
-define Device/sercomm_dxx
-  $(Device/dsa-migration)
-  BLOCKSIZE := 128k
-  PAGESIZE := 2048
-  KERNEL_SIZE := 6144k
-  UBINIZE_OPTS := -E 5
+define Device/sercomm
+  $(Device/nand)
   LOADER_TYPE := bin
+  KERNEL_SIZE := 6144k
   KERNEL_LOADADDR := 0x81001000
   LZMA_TEXT_START := 0x82800000
+  SERCOMM_KERNEL_OFFSET := 0x400100
+  SERCOMM_ROOTFS_OFFSET := 0x1000000
+  IMAGES += factory.img
+endef
+
+define Device/sercomm_cxx
+  $(Device/sercomm)
+  SERCOMM_KERNEL2_OFFSET := 0xa00100
+  SERCOMM_ROOTFS2_OFFSET := 0x3000000
+  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | lzma -a0 | \
+	uImage lzma
+  IMAGE/sysupgrade.bin := append-kernel | sercomm-kernel | \
+	sysupgrade-tar kernel=$$$$@ | append-metadata
+  IMAGE/factory.img := append-kernel | sercomm-kernel-factory | \
+	append-ubi | sercomm-factory-cqr
+endef
+
+define Device/sercomm_dxx
+  $(Device/sercomm)
   KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | lzma -a0 | \
 	uImage lzma | sercomm-kernel
   KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | \
 	lzma -a0 | uImage lzma
-  IMAGES += factory.img
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   IMAGE/factory.img := append-ubi | check-size | \
 	sercomm-part-tag rootfs | sercomm-prepend-tagged-kernel kernel | \
 	gzip | sercomm-payload | sercomm-crypto
-  SERCOMM_KERNEL_OFFSET := 0x400100
-  SERCOMM_ROOTFS_OFFSET := 0x1000000
 endef
diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk
index 340d4ba4a1..b8fa0cefdb 100644
--- a/target/linux/ramips/image/mt7621.mk
+++ b/target/linux/ramips/image/mt7621.mk
@@ -410,6 +410,18 @@ define Device/beeline_smartbox-turbo
 endef
 TARGET_DEVICES += beeline_smartbox-turbo
 
+define Device/beeline_smartbox-turbo-plus
+  $(Device/sercomm_cxx)
+  IMAGE_SIZE := 32768k
+  SERCOMM_HWID := CQR
+  SERCOMM_HWVER := 10000
+  SERCOMM_SWVER := 2010
+  DEVICE_VENDOR := Beeline
+  DEVICE_MODEL := SmartBox TURBO+
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware kmod-usb3
+endef
+TARGET_DEVICES += beeline_smartbox-turbo-plus
+
 define Device/belkin_rt1800
   $(Device/nand)
   IMAGE_SIZE := 49152k