ath79: add support for Fortinet FAP-221-B

FCC ID: U2M-CAP4100AG

Fortinet FAP-221-B is an indoor access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+

Hardware and board design from Senao

**Specification:**

 - AR9344 SOC		2G 2x2, 5G 2x2, 25 MHz CLK
 - AR9382 WLAN		2G 2x2 PCIe, 40 MHz CLK
 - AR8035-A PHY		RGMII, PoE+ IN, 25 MHz CLK
 - 16 MB FLASH		MX25L12845EMI-10G
 - 2x 32 MB RAM		W9725G6JB-25
 - UART at J11		populated, 9600 baud
 - 6 LEDs, 1 button	power, ethernet, wlan, reset

  Note:	ethernet LEDs are not enabled
	because a new netifd hotplug is required
	in order to operate like OEM.
	Board has 1 amber and 1 green
	for each of the 3 case viewports.

**MAC addresses:**

1 MAC Address in flash at end of uboot
ASCII encoded, no delimiters
Labeled as "MAC Address" on case
OEM firmware sets offsets 1 and 8 for wlan

  eth0 *:1e	uboot 0x3ff80
  phy0 *:1f	uboot 0x3ff80 +1
  phy1 *:26	uboot 0x3ff80 +8

**Serial Access:**

Pinout: (arrow) VCC GND RX TX

Pins are populated with a header and traces not blocked.
Bootloader is set to 9600 baud, 8 data, 1 stop.

**Console Access:**

Bootloader:

Interrupt boot with Ctrl+C
Press "k" and enter password "1"
OR
Hold reset button for 5 sec during power on
Interrupt the TFTP transfer with Ctrl+C

to print commands available, enter "help"

OEM:

default username is "admin", password blank
telnet is available at default address 192.168.1.2
serial is available with baud 9600

to print commands available, enter "help"
or tab-tab (busybox list of commands)

**Installation:**

Use factory.bin with OEM upgrade procedures
OR
Use initramfs.bin with uboot TFTP commands.
Then perform a sysupgrade with sysupgrade.bin

**TFTP Recovery:**

Using serial console, load initramfs.bin using TFTP
to boot openwrt without touching the flash.
TFTP is not reliable due to bugged bootloader,
set MTU to 600 and try many times.
If your TFTP server supports setting block size,
higher block size is better.
Splitting the file into 1 MB parts may be necessary

example:

$ tftpboot 0x80100000 image1.bin
$ tftpboot 0x80200000 image2.bin
$ tftpboot 0x80300000 image3.bin
$ tftpboot 0x80400000 image4.bin
$ tftpboot 0x80500000 image5.bin
$ tftpboot 0x80600000 image6.bin
$ bootm 0x80100000

**Return to OEM:**

The best way to return to OEM firmware
is to have a copy of the MTD partitions
before flashing Openwrt.

Backup copies should be made of partitions
"fwconcat0", "loader", and "fwconcat1"
which together is the same flash range
as OEM's "rootfs" and "uimage"
by loading an initramfs.bin
and using LuCI to download the mtdblocks.

It is also possible to extract from the
OEM firmware upgrade image by splitting it up
in parts of lengths that correspond
to the partitions in openwrt
and write them to flash,
after gzip decompression.

After writing to the firmware partitions,
erase the "reserved" partition and reboot.

**OEM firmware image format:**

Images from Fortinet for this device
ending with the suffix .out
are actually a .gz file

The gzip metadata stores the original filename
before compression, which is a special string
used to verify the image during OEM upgrade.

After gzip decompression, the resulting file
is an exact copy of the MTD partitions
"rootfs" and "uimage" combined in the same order and size
that they appear in /proc/mtd and as they are on flash.

OEM upgrade is performed by a customized busybox
with the command "upgrade".
Another binary, "restore"
is a wrapper for busybox's "tftp" and "upgrade".

Signed-off-by: Michael Pratt <mcpratt@pm.me>

8 files changed, 252 insertions, 0 deletions

diff --git a/target/linux/ath79/dts/ar9344_fortinet_ap-dual.dtsi b/target/linux/ath79/dts/ar9344_fortinet_ap-dual.dtsi
new file mode 100644
index 0000000000..d5275c496e
--- /dev/null
+++ b/target/linux/ath79/dts/ar9344_fortinet_ap-dual.dtsi
@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar9344.dtsi"
+#include "ar934x_fortinet_loader.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,9600";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&ref {
+	clock-frequency = <25000000>;
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		eee-broken-100tx;
+		eee-broken-1000t;
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	phy-handle = <&phy0>;
+	phy-mode = "rgmii-txid";
+
+	pll-data = <0x02000000 0x00000101 0x00001313>;
+};
+
+&pcie {
+	status = "okay";
+
+	ath9k: wifi@0,0,0 {
+		compatible = "pci168c,0030";
+		reg = <0x0 0 0 0 0>;
+	};
+};
+
+&wmac {
+	status = "okay";
+};
diff --git a/target/linux/ath79/dts/ar9344_fortinet_fap-221-b.dts b/target/linux/ath79/dts/ar9344_fortinet_fap-221-b.dts
new file mode 100644
index 0000000000..b78a588f5c
--- /dev/null
+++ b/target/linux/ath79/dts/ar9344_fortinet_fap-221-b.dts
@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "ar9344_fortinet_ap-dual.dtsi"
+
+/ {
+	compatible = "fortinet,fap-221-b", "qca,ar9344";
+	model = "Fortinet FAP-221-B";
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power_green {
+			label = "green:power";
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		power_amber {
+			label = "amber:power";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		eth_green {
+			label = "green:eth";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		eth_amber {
+			label = "amber:eth";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		wifi5g {
+			label = "green:wifi5g";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wifi2g {
+			label = "amber:wifi2g";
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+	};
+
+	virtual_flash {
+		devices = <&fwconcat0 &fwconcat1 &fwconcat2>;
+	};
+};
+
+&ath9k {
+	ieee80211-freq-limit = <2402000 2482000>;
+
+	nvmem-cells = <&calibration_pcie>;
+	nvmem-cell-names = "calibration";
+};
+
+&wmac {
+	ieee80211-freq-limit = <2402000 2482000 4900000 5990000>;
+
+	nvmem-cells = <&calibration_wmac>;
+	nvmem-cell-names = "calibration";
+};
+
+&art {
+	compatible = "nvmem-cells";
+
+	calibration_wmac: calibration@1000 {
+		reg = <0x1000 0x440>;
+	};
+
+	calibration_pcie: calibration@5000 {
+		reg = <0x5000 0x440>;
+	};
+};
diff --git a/target/linux/ath79/dts/ar934x_fortinet_loader.dtsi b/target/linux/ath79/dts/ar934x_fortinet_loader.dtsi
new file mode 100644
index 0000000000..d7cbf2e737
--- /dev/null
+++ b/target/linux/ath79/dts/ar934x_fortinet_loader.dtsi
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include <dt-bindings/mtd/partitions/uimage.h>
+
+/ {
+	virtual_flash {
+		compatible = "mtd-concat";
+
+		devices = <&fwconcat0 &fwconcat1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				compatible = "openwrt,uimage", "denx,uimage";
+				openwrt,ih-magic = <0x73714f4b>;
+				label = "firmware";
+				reg = <0x0 0x0>;
+			};
+		};
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+			fwconcat0: partition@40000 {
+				label = "fwconcat0";
+				reg = <0x040000 0x900000>;
+			};
+
+			partition@940000 {
+				label = "loader";
+				reg = <0x940000 0x010000>;
+			};
+
+			fwconcat1: partition@950000 {
+				label = "fwconcat1";
+				reg = <0x950000 0x1a0000>;
+			};
+
+			fwconcat2: partition@af0000 {
+				label = "reserved";
+				reg = <0xaf0000 0x500000>;
+			};
+
+			art: partition@ff0000 {
+				label = "art";
+				reg = <0xff0000 0x010000>;
+				read-only;
+			};
+		};
+	};
+};
diff --git a/target/linux/ath79/generic/base-files/etc/board.d/02_network b/target/linux/ath79/generic/base-files/etc/board.d/02_network
index 92541cd9f8..8b0fba7c69 100644
--- a/target/linux/ath79/generic/base-files/etc/board.d/02_network
+++ b/target/linux/ath79/generic/base-files/etc/board.d/02_network
@@ -45,6 +45,7 @@ ath79_setup_interfaces()
 	engenius,ecb600|\
 	enterasys,ws-ap3705i|\
 	extreme-networks,ws-ap3805i|\
+	fortinet,fap-221-b|\
 	glinet,gl-ar300m-lite|\
 	glinet,gl-usb150|\
 	hak5,wifi-pineapple-nano|\
@@ -674,6 +675,10 @@ ath79_setup_macs()
 	enterasys,ws-ap3705i)
 		label_mac=$(mtd_get_mac_ascii u-boot-env0 ethaddr)
 		;;
+	fortinet,fap-221-b)
+		lan_mac=$(mtd_get_mac_text u-boot 0x3ff80 12)
+		label_mac=$lan_mac
+		;;
 	hak5,lan-turtle|\
 	hak5,packet-squirrel)
 		label_mac=$(mtd_get_mac_binary u-boot 0x1fc00)
diff --git a/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac b/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
index 57458cdef0..74345843f5 100644
--- a/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
+++ b/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
@@ -35,6 +35,9 @@ case "$board" in
 		[ "$PHYNBR" -eq 1 ] && \
 			mtd_get_mac_ascii bdcfg "wlanmac" > /sys${DEVPATH}/macaddress
 		;;
+	fortinet,fap-221-b)
+		macaddr_add "$(mtd_get_mac_text u-boot 0x3ff80 12)" $((PHYNBR*7+1)) > /sys${DEVPATH}/macaddress
+		;;
 	iodata,wn-ac1600dgr)
 		# There is no eeprom data for 5 GHz wlan in "art" partition
 		# which would allow to patch the macaddress
diff --git a/target/linux/ath79/generic/base-files/lib/preinit/10_fix_eth_mac.sh b/target/linux/ath79/generic/base-files/lib/preinit/10_fix_eth_mac.sh
index d06f043ad4..bf40efe72b 100644
--- a/target/linux/ath79/generic/base-files/lib/preinit/10_fix_eth_mac.sh
+++ b/target/linux/ath79/generic/base-files/lib/preinit/10_fix_eth_mac.sh
@@ -19,6 +19,9 @@ preinit_set_mac_address() {
 	siemens,ws-ap3610)
 		ip link set dev eth0 address $(mtd_get_mac_ascii cfg1 ethaddr)
 		;;
+	fortinet,fap-221-b)
+		ip link set dev eth0 address $(mtd_get_mac_text u-boot 0x3ff80 12)
+		;;
 	tplink,deco-s4-v2)
 		base_mac=$(mtd_get_mac_encrypted_deco $(find_mtd_part config))
 		ip link set dev eth0 address $base_mac
diff --git a/target/linux/ath79/generic/base-files/lib/upgrade/platform.sh b/target/linux/ath79/generic/base-files/lib/upgrade/platform.sh
index 0de3dbf3b5..d03163a8ea 100644
--- a/target/linux/ath79/generic/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ath79/generic/base-files/lib/upgrade/platform.sh
@@ -54,6 +54,17 @@ platform_do_upgrade() {
 		ROOTFS_FILE="root.squashfs"
 		platform_do_upgrade_failsafe_datachk "$1"
 		;;
+	fortinet,fap-221-b)
+		SKIP_HASH="1"
+		ENV_SCRIPT="/dev/null"
+		IMAGE_LIST="tar tzf $1"
+		IMAGE_CMD="tar xzOf $1"
+		KERNEL_PART="loader"
+		ROOTFS_PART="fwconcat0"
+		KERNEL_FILE="uImage-lzma.bin"
+		ROOTFS_FILE="root.squashfs"
+		platform_do_upgrade_failsafe_datachk "$1"
+		;;
 	jjplus,ja76pf2)
 		platform_do_upgrade_redboot_fis "$1" linux
 		;;
diff --git a/target/linux/ath79/image/generic.mk b/target/linux/ath79/image/generic.mk
index a19412498a..59bc449f12 100644
--- a/target/linux/ath79/image/generic.mk
+++ b/target/linux/ath79/image/generic.mk
@@ -1324,6 +1324,22 @@ define Device/extreme-networks_ws-ap3805i
 endef
 TARGET_DEVICES += extreme-networks_ws-ap3805i
 
+define Device/fortinet_fap-221-b
+  $(Device/senao_loader_okli)
+  SOC := ar9344
+  DEVICE_VENDOR := Fortinet
+  DEVICE_MODEL := FAP-221-B
+  FACTORY_IMG_NAME := FP221B-9.99-AP-build999-999999-patch99
+  IMAGE_SIZE := 9216k
+  LOADER_FLASH_OFFS := 0x040000
+  IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
+	append-rootfs | pad-rootfs | \
+	check-size | pad-to $$$$(IMAGE_SIZE) | \
+	append-loader-okli-uimage $(1) | pad-to 10944k | \
+	gzip-filename $$$$(FACTORY_IMG_NAME)
+endef
+TARGET_DEVICES += fortinet_fap-221-b
+
 define Device/glinet_6408
   $(Device/tplink-8mlzma)
   SOC := ar9331