ramips: add support for Ubiquiti UniFi 6 Lite

Hardware
--------
MediaTek MT7621AT
256M DDR3
32M SPI-NOR
MediaTek MT7603 2T2R 802.11n 2.4GHz
MediaTek MT7915 2T2R 802.11ax 5GHz

Not Working
-----------
 - Bluetooth (connected to UART3)

UART
----

UART is located in the lower left corner of the board. Pinout is

0 - 3V3 (don't connect)
1 - RX
2 - TX
3 - GND

Console is 115200 8N1.

Boot
----

1. Connect to the serial console and connect power.

2. Double-press ESC when prompted

3. Set the fdt address

   $ fdt addr $(fdtcontroladdr)

4. Remove the signature node from the control FDT

   $ fdt rm /signature

5. Transfer and boot the OpenWrt initramfs image to the device.
   Make sure to name the file C0A80114.img and have it reachable at
   192.168.1.1/24

   $ tftpboot; bootm

Installation
------------

1. Connect to the booted device at 192.168.1.20 using username/password
   "ubnt".

2. Update the bootloader environment.

   $ fw_setenv devmode TRUE
   $ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr);
     fdt rm /signature; bootubnt"
   $ fw_setenv bootcmd "run boot_openwrt"

3. Transfer the OpenWrt sysupgrade image to the device using SCP.

4. Check the mtd partition number for bs / kernel0 / kernel1

   $ cat /proc/mtd

5. Set the bootselect flag to boot from kernel0

   $ dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock4

6. Write the OpenWrt sysupgrade image to both kernel0 as well as kernel1

   $ dd if=openwrt.bin of=/dev/mtdblock6
   $ dd if=openwrt.bin of=/dev/mtdblock7

7. Reboot the device. It should boot into OpenWrt.

Below are the original installation instructions prior to the discovery
of "devmode=TRUE". They are not required for installation and are
documentation only.

The bootloader employs signature verification on the FIT image
configurations. This way, booting unauthorized image without patching
the bootloader is not possible. Manually configuring the bootcmd in the
U-Boot envronment won't work, as this is restored to the default value
if modified.

The bootloader is made up of three different parts.

1. The SPL performing early board initialization and providing a XModem
   recovery in case the PBL is missing

2. The PBL being the primary U-Boot application and containing the
   control FDT. It is LZMA packed with a uImage header.

3. A Ubiquiti standalone U-Boot application providing the main boot
   routine as well as their recovery mechanism.

In a perfect world, we would only replace the PBL, as the SPL does not
perform checks on the PBLs integrity. However, as the PBL is in the same
eraseblock as the SPL, we need to at least rewrite both.

The bootloader will only verify integrity in case it has a "signature"
node in it's control device-tree. Renaming the signature node to
something else will prevent this from happening.

Warning: These instructions are based on the firmware intially
shipped with the device and potentially brick your device in a way it
can only be recovered using a SPI flasher.

Only (!) proceed if you understand this!

1. Extract the bootloader from the U-Boot partition using the OpenWrt
   initramfs image.

2. Split the bootloader into it's 3 components:

   $ dd if=bootloader.bin of=spl.bin bs=1 skip=0 count=45056
   $ dd if=bootloader.bin of=pbl.uimage bs=1 skip=45056 count=143360
   $ dd if=bootloader.bin of=ubnt.uimage bs=1 skip=188416

3. Strip the uImage header from the PBL

   $ dd if=pbl.uimage of=pbl.lzma bs=64 skip=1

4. Decompress the PBL

   $ lzma -d pbl.lzma --single-stream

   The decompressed PBL sha256sum should be
   d8b406c65240d260cf15be5f97f40c1d6d1b6e61ec3abed37bb841c90fcc1235

5. Open the decompressed PBL using your favorite hexeditor. Locate the
   control FDT at offset 0x4CED0 (0xD00DFEED). At offset 0x4D5BC, the
   label for the signature node is located. Rename the "signature"
   string at this offset to "signaturr".

   The patched PBL sha256sum should be
   d028e374cdb40ba44b6e3cef2e4e8a8c16a3b85eb15d9544d24fdd10eed64c97

6. Compress the patched PBL

   $ lzma -z pbl --lzma1=dict=67108864

   The resulting pbl.lzma file should have the sha256sum
   7ae6118928fa0d0b3fe4ff81abd80ecfd9ba2944cb0f0a462b6ae65913088b42

7. Create the PBL uimage

   $ SOURCE_DATE_EPOCH=1607909492 mkimage -A mips -O u-boot -C lzma
     -n "U-Boot 2018.03 [UniFi,v1.1.40.71]" -a 84000000 -e 84000000
     -T firmware -d pbl.lzma patched_pbl.uimage

   The resulting patched_pbl.uimage should have the sha256sum
   b90d7fa2dcc6814180d3943530d8d6b0d6a03636113c94e99af34f196d3cf2ce

8. Reassemble the complete bootloader

   $ dd if=patched_pbl.uimage of=aligned_pbl.uimage bs=143360 count=1
     conv=sync
   $ cat spl.bin > patched_uboot.bin
   $ cat aligned_pbl.uimage >> patched_uboot.bin
   $ cat ubnt.uimage >> patched_uboot.bin

   The resulting patched_uboot.bin should have the sha256sum
   3e1186f33b88a525687285c2a8b22e8786787b31d4648b8eee66c672222aa76b

9. Transfer your patched bootloader to the device. Also install the
   kmod-mtd-rw package using opkg and load it.

   $ insmod mtd-rw.ko i_want_a_brick=1

   Write the patched bootloader to mtd0

   $ mtd write patched_uboot.bin u-boot

10. Erase the kernel1 partition, as the bootloader might otherwise
    decide to boot from there.

    $ mtd erase kernel1

11. Transfer the OpenWrt sysupgrade image to the device and install
    using sysupgrade.

FIT configurations
------------------

In the future, the MT7621 UniFi6 family can be supported by a single
OpenWrt image.

config@1: U6 Lite
config@2: U6 IW
config@3: U6 Mesh
config@4: U6 Extender
config@5: U6 LR-EA (Early Access - GA is MT7622)

Signed-off-by: David Bauer <mail@david-bauer.net>

9 files changed, 478 insertions, 76 deletions

diff --git a/target/linux/ramips/dts/mt7621_ubnt_unifi-6-lite.dts b/target/linux/ramips/dts/mt7621_ubnt_unifi-6-lite.dts
new file mode 100644
index 0000000000..422d17673b
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_ubnt_unifi-6-lite.dts
@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621_ubnt_unifi.dtsi"
+
+/ {
+	compatible = "ubnt,unifi-6-lite", "mediatek,mt7621-soc";
+	model = "Ubiquiti UniFi 6 Lite";
+
+	chosen {
+		bootargs-override = "console=ttyS0,115200";
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "mx25l25635f", "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x60000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "u-boot-env";
+				reg = <0x60000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@70000 {
+				label = "factory";
+				reg = <0x70000 0x40000>;
+				read-only;
+			};
+
+			eeprom: partition@b0000 {
+				label = "eeprom";
+				reg = <0xb0000 0x10000>;
+				read-only;
+			};
+
+			partition@c0000 {
+				label = "bs";
+				reg = <0xc0000 0x10000>;
+			};
+
+			partition@d0000 {
+				label = "cfg";
+				reg = <0xd0000 0x100000>;
+				read-only;
+			};
+
+			partition@1d0000 {
+				compatible = "denx,fit";
+				label = "firmware";
+				reg = <0x1d0000 0xf10000>;
+			};
+
+			partition@10e0000 {
+				label = "kernel1";
+				reg = <0x10e0000 0xf10000>;
+			};
+		};
+	};
+};
+
+&wlan_2g {
+	mtd-mac-address = <&eeprom 0x0>;
+};
+
+&wlan_5g {
+	mediatek,mtd-eeprom = <&factory 0x20000>;
+	mtd-mac-address = <&eeprom 0x6>;
+};
diff --git a/target/linux/ramips/dts/mt7621_ubnt_unifi-nanohd.dts b/target/linux/ramips/dts/mt7621_ubnt_unifi-nanohd.dts
index 4ba5f6a428..401868362e 100644
--- a/target/linux/ramips/dts/mt7621_ubnt_unifi-nanohd.dts
+++ b/target/linux/ramips/dts/mt7621_ubnt_unifi-nanohd.dts
@@ -1,49 +1,10 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
-#include "mt7621.dtsi"
-
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
+#include "mt7621_ubnt_unifi.dtsi"
 
 / {
 	compatible = "ubnt,unifi-nanohd", "mediatek,mt7621-soc";
 	model = "Ubiquiti UniFi nanoHD";
-
-	aliases {
-		led-boot = &led_white;
-		led-failsafe = &led_white;
-		led-running = &led_blue;
-		led-upgrade = &led_blue;
-		label-mac-device = &gmac0;
-	};
-
-	chosen {
-		bootargs = "console=ttyS0,115200";
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		led_blue: dome_blue {
-			label = "blue:dome";
-			gpios = <&gpio 3 GPIO_ACTIVE_HIGH>;
-		};
-
-		led_white: dome_white {
-			label = "white:dome";
-			gpios = <&gpio 4 GPIO_ACTIVE_HIGH>;
-		};
-	};
-
-	keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
-			linux,code = <KEY_RESTART>;
-		};
-	};
 };
 
 &spi0 {
@@ -109,40 +70,6 @@
 	};
 };
 
-&pcie {
-	status = "okay";
-};
-
-&pcie0 {
-	wifi@0,0 {
-		reg = <0x0 0 0 0 0>;
-		mediatek,mtd-eeprom = <&factory 0x0000>;
-	};
-};
-
-&pcie1 {
-	wifi@0,0 {
-		reg = <0x0 0 0 0 0>;
-		mediatek,mtd-eeprom = <&factory 0x8000>;
-	};
-};
-
-&gmac0 {
-	mtd-mac-address = <&eeprom 0x0>;
-};
-
-&switch0 {
-	ports {
-		port@0 {
-			status = "okay";
-			label = "lan";
-		};
-	};
-};
-
-&state_default {
-	gpio {
-		groups = "i2c", "uart2";
-		function = "gpio";
-	};
+&wlan_5g {
+	mediatek,mtd-eeprom = <&factory 0x8000>;
 };
diff --git a/target/linux/ramips/dts/mt7621_ubnt_unifi.dtsi b/target/linux/ramips/dts/mt7621_ubnt_unifi.dtsi
new file mode 100644
index 0000000000..e0625ba500
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_ubnt_unifi.dtsi
@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	aliases {
+		led-boot = &led_white;
+		led-failsafe = &led_white;
+		led-running = &led_blue;
+		led-upgrade = &led_blue;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_blue: dome_blue {
+			label = "blue:dome";
+			gpios = <&gpio 3 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_white: dome_white {
+			label = "white:dome";
+			gpios = <&gpio 4 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wlan_2g: wifi@0,0 {
+		reg = <0x0 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+	};
+};
+
+&pcie1 {
+	wlan_5g: wifi@0,0 {
+		reg = <0x0 0 0 0 0>;
+	};
+};
+
+&gmac0 {
+	mtd-mac-address = <&eeprom 0x0>;
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "uart2";
+		function = "gpio";
+	};
+};
diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk
index f6b72a699d..720d435665 100644
--- a/target/linux/ramips/image/mt7621.mk
+++ b/target/linux/ramips/image/mt7621.mk
@@ -1130,6 +1130,16 @@ define Device/ubnt_edgerouter-x-sfp
 endef
 TARGET_DEVICES += ubnt_edgerouter-x-sfp
 
+define Device/ubnt_unifi-6-lite
+  $(Device/dsa-migration)
+  DEVICE_VENDOR := Ubiquiti
+  DEVICE_MODEL := UniFi 6 Lite
+  DEVICE_PACKAGES += kmod-mt7603 kmod-mt7915e
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  IMAGE_SIZE := 15424k
+endef
+TARGET_DEVICES += ubnt_unifi-6-lite
+
 define Device/ubnt_unifi-nanohd
   $(Device/dsa-migration)
   DEVICE_VENDOR := Ubiquiti
diff --git a/target/linux/ramips/mt7621/base-files/etc/board.d/02_network b/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
index bca4cc23dc..83c4162e2f 100755
--- a/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
+++ b/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
@@ -29,6 +29,7 @@ ramips_setup_interfaces()
 	tplink,re350-v1|\
 	tplink,re500-v1|\
 	tplink,re650-v1|\
+	ubnt,unifi-6-lite|\
 	ubnt,unifi-nanohd)
 		ucidef_set_interface_lan "lan"
 		;;
diff --git a/target/linux/ramips/mt7621/config-5.4 b/target/linux/ramips/mt7621/config-5.4
index fbfb5b09f1..b2ad37510b 100644
--- a/target/linux/ramips/mt7621/config-5.4
+++ b/target/linux/ramips/mt7621/config-5.4
@@ -209,6 +209,7 @@ CONFIG_MTD_PHYSMAP=y
 CONFIG_MTD_RAW_NAND=y
 CONFIG_MTD_ROUTERBOOT_PARTS=y
 CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_FIT_FW=y
 CONFIG_MTD_SPLIT_MINOR_FW=y
 CONFIG_MTD_SPLIT_SEAMA_FW=y
 CONFIG_MTD_SPLIT_TPLINK_FW=y
diff --git a/target/linux/ramips/patches-5.4/0001-MIPS-cmdline-Clean-up-boot_command_line-initializati.patch b/target/linux/ramips/patches-5.4/0001-MIPS-cmdline-Clean-up-boot_command_line-initializati.patch
new file mode 100644
index 0000000000..eedc7498be
--- /dev/null
+++ b/target/linux/ramips/patches-5.4/0001-MIPS-cmdline-Clean-up-boot_command_line-initializati.patch
@@ -0,0 +1,192 @@
+From: Paul Burton <paul.burton@mips.com>
+Date: Wed, 9 Oct 2019 23:09:45 +0000
+Subject: MIPS: cmdline: Clean up boot_command_line initialization
+
+Our current code to initialize boot_command_line is a mess. Some of this
+is due to the addition of too many options over the years, and some of
+this is due to workarounds for early_init_dt_scan_chosen() performing
+actions specific to options from other architectures that probably
+shouldn't be in generic code.
+
+Clean this up by introducing a new bootcmdline_init() function that
+simplifies the initialization somewhat. The major changes are:
+
+- Because bootcmdline_init() is a function it can return early in the
+  CONFIG_CMDLINE_OVERRIDE case.
+
+- We clear boot_command_line rather than inheriting whatever
+  early_init_dt_scan_chosen() may have left us. This means we no longer
+  need to set boot_command_line to a space character in an attempt to
+  prevent early_init_dt_scan_chosen() from copying CONFIG_CMDLINE into
+  boot_command_line without us knowing about it.
+
+- Indirection via USE_PROM_CMDLINE, USE_DTB_CMDLINE, EXTEND_WITH_PROM &
+  BUILTIN_EXTEND_WITH_PROM macros is removed; they seemingly served only
+  to obfuscate the code.
+
+- The logic is cleaner, clearer & commented.
+
+Two minor drawbacks of this approach are:
+
+1) We call of_scan_flat_dt(), which means we scan through the DT again.
+   The overhead is fairly minimal & shouldn't be noticeable.
+
+2) cmdline_scan_chosen() duplicates a small amount of the logic from
+   early_init_dt_scan_chosen(). Alternatives might be to allow the
+   generic FDT code to keep & expose a copy of the arguments taken from
+   the /chosen node's bootargs property, or to introduce a function like
+   early_init_dt_scan_chosen() that retrieves them without modification
+   to handle CONFIG_CMDLINE. Neither of these sounds particularly
+   cleaner though, and this way we at least keep the extra work in
+   arch/mips.
+
+Origin: upstream, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7784cac697351f0cc0a4bb619594c0c99348c5aa
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: linux-mips@vger.kernel.org
+
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -538,11 +538,88 @@ static void __init check_kernel_sections
+ 	}
+ }
+ 
+-#define USE_PROM_CMDLINE	IS_ENABLED(CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER)
+-#define USE_DTB_CMDLINE		IS_ENABLED(CONFIG_MIPS_CMDLINE_FROM_DTB)
+-#define EXTEND_WITH_PROM	IS_ENABLED(CONFIG_MIPS_CMDLINE_DTB_EXTEND)
+-#define BUILTIN_EXTEND_WITH_PROM	\
+-	IS_ENABLED(CONFIG_MIPS_CMDLINE_BUILTIN_EXTEND)
++static void __init bootcmdline_append(const char *s, size_t max)
++{
++	if (!s[0] || !max)
++		return;
++
++	if (boot_command_line[0])
++		strlcat(boot_command_line, " ", COMMAND_LINE_SIZE);
++
++	strlcat(boot_command_line, s, max);
++}
++
++static int __init bootcmdline_scan_chosen(unsigned long node, const char *uname,
++					  int depth, void *data)
++{
++	bool *dt_bootargs = data;
++	const char *p;
++	int l;
++
++	if (depth != 1 || !data ||
++	    (strcmp(uname, "chosen") != 0 && strcmp(uname, "chosen@0") != 0))
++		return 0;
++
++	p = of_get_flat_dt_prop(node, "bootargs", &l);
++	if (p != NULL && l > 0) {
++		bootcmdline_append(p, min(l, COMMAND_LINE_SIZE));
++		*dt_bootargs = true;
++	}
++
++	return 1;
++}
++
++static void __init bootcmdline_init(char **cmdline_p)
++{
++	bool dt_bootargs = false;
++
++	/*
++	 * If CMDLINE_OVERRIDE is enabled then initializing the command line is
++	 * trivial - we simply use the built-in command line unconditionally &
++	 * unmodified.
++	 */
++	if (IS_ENABLED(CONFIG_CMDLINE_OVERRIDE)) {
++		strlcpy(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);
++		return;
++	}
++
++	/*
++	 * If the user specified a built-in command line &
++	 * MIPS_CMDLINE_BUILTIN_EXTEND, then the built-in command line is
++	 * prepended to arguments from the bootloader or DT so we'll copy them
++	 * to the start of boot_command_line here. Otherwise, empty
++	 * boot_command_line to undo anything early_init_dt_scan_chosen() did.
++	 */
++	if (IS_ENABLED(CONFIG_MIPS_CMDLINE_BUILTIN_EXTEND))
++		strlcpy(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);
++	else
++		boot_command_line[0] = 0;
++
++	/*
++	 * If we're configured to take boot arguments from DT, look for those
++	 * now.
++	 */
++	if (IS_ENABLED(CONFIG_MIPS_CMDLINE_FROM_DTB))
++		of_scan_flat_dt(bootcmdline_scan_chosen, &dt_bootargs);
++
++	/*
++	 * If we didn't get any arguments from DT (regardless of whether that's
++	 * because we weren't configured to look for them, or because we looked
++	 * & found none) then we'll take arguments from the bootloader.
++	 * plat_mem_setup() should have filled arcs_cmdline with arguments from
++	 * the bootloader.
++	 */
++	if (IS_ENABLED(CONFIG_MIPS_CMDLINE_DTB_EXTEND) || !dt_bootargs)
++		bootcmdline_append(arcs_cmdline, COMMAND_LINE_SIZE);
++
++	/*
++	 * If the user specified a built-in command line & we didn't already
++	 * prepend it, we append it to boot_command_line here.
++	 */
++	if (IS_ENABLED(CONFIG_CMDLINE_BOOL) &&
++	    !IS_ENABLED(CONFIG_MIPS_CMDLINE_BUILTIN_EXTEND))
++		bootcmdline_append(builtin_cmdline, COMMAND_LINE_SIZE);
++}
+ 
+ /*
+  * arch_mem_init - initialize memory management subsystem
+@@ -570,48 +647,12 @@ static void __init arch_mem_init(char **
+ {
+ 	extern void plat_mem_setup(void);
+ 
+-	/*
+-	 * Initialize boot_command_line to an innocuous but non-empty string in
+-	 * order to prevent early_init_dt_scan_chosen() from copying
+-	 * CONFIG_CMDLINE into it without our knowledge. We handle
+-	 * CONFIG_CMDLINE ourselves below & don't want to duplicate its
+-	 * content because repeating arguments can be problematic.
+-	 */
+-	strlcpy(boot_command_line, " ", COMMAND_LINE_SIZE);
+-
+ 	/* call board setup routine */
+ 	plat_mem_setup();
+ 	memblock_set_bottom_up(true);
+ 
+-#if defined(CONFIG_CMDLINE_BOOL) && defined(CONFIG_CMDLINE_OVERRIDE)
+-	strlcpy(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);
+-#else
+-	if ((USE_PROM_CMDLINE && arcs_cmdline[0]) ||
+-	    (USE_DTB_CMDLINE && !boot_command_line[0]))
+-		strlcpy(boot_command_line, arcs_cmdline, COMMAND_LINE_SIZE);
+-
+-	if (EXTEND_WITH_PROM && arcs_cmdline[0]) {
+-		if (boot_command_line[0])
+-			strlcat(boot_command_line, " ", COMMAND_LINE_SIZE);
+-		strlcat(boot_command_line, arcs_cmdline, COMMAND_LINE_SIZE);
+-	}
+-
+-#if defined(CONFIG_CMDLINE_BOOL)
+-	if (builtin_cmdline[0]) {
+-		if (boot_command_line[0])
+-			strlcat(boot_command_line, " ", COMMAND_LINE_SIZE);
+-		strlcat(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);
+-	}
+-
+-	if (BUILTIN_EXTEND_WITH_PROM && arcs_cmdline[0]) {
+-		if (boot_command_line[0])
+-			strlcat(boot_command_line, " ", COMMAND_LINE_SIZE);
+-		strlcat(boot_command_line, arcs_cmdline, COMMAND_LINE_SIZE);
+-	}
+-#endif
+-#endif
++	bootcmdline_init(cmdline_p);
+ 	strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE);
+-
+ 	*cmdline_p = command_line;
+ 
+ 	parse_early_param();
diff --git a/target/linux/ramips/patches-5.4/0002-MIPS-Always-define-builtin_cmdline.patch b/target/linux/ramips/patches-5.4/0002-MIPS-Always-define-builtin_cmdline.patch
new file mode 100644
index 0000000000..03124d07d1
--- /dev/null
+++ b/target/linux/ramips/patches-5.4/0002-MIPS-Always-define-builtin_cmdline.patch
@@ -0,0 +1,44 @@
+From b7340422cc16c5deff100812f38114bb5ec81203 Mon Sep 17 00:00:00 2001
+From: Paul Burton <paul.burton@mips.com>
+Date: Sat, 12 Oct 2019 20:43:36 +0000
+Subject: [PATCH] MIPS: Always define builtin_cmdline
+
+Commit 7784cac69735 ("MIPS: cmdline: Clean up boot_command_line
+initialization") made use of builtin_cmdline conditional upon plain C if
+statements rather than preprocessor #ifdef's. This caused build failures
+for configurations with CONFIG_CMDLINE_BOOL=n where builtin_cmdline
+wasn't defined, for example:
+
+   arch/mips/kernel/setup.c: In function 'bootcmdline_init':
+>> arch/mips/kernel/setup.c:582:30: error: 'builtin_cmdline' undeclared
+    (first use in this function); did you mean 'builtin_driver'?
+      strlcpy(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);
+                                 ^~~~~~~~~~~~~~~
+                                 builtin_driver
+   arch/mips/kernel/setup.c:582:30: note: each undeclared identifier is
+    reported only once for each function it appears in
+
+Fix this by defining builtin_cmdline as an empty string in the affected
+configurations. All of the paths that use it should be optimized out
+anyway so the data itself gets optimized away too.
+
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Fixes: 7784cac69735 ("MIPS: cmdline: Clean up boot_command_line initialization")
+Reported-by: kbuild test robot <lkp@intel.com>
+Reported-by: Nathan Chancellor <natechancellor@gmail.com>
+Cc: linux-mips@vger.kernel.org
+---
+ arch/mips/kernel/setup.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -68,6 +68,8 @@ char __initdata arcs_cmdline[COMMAND_LIN
+ 
+ #ifdef CONFIG_CMDLINE_BOOL
+ static char __initdata builtin_cmdline[COMMAND_LINE_SIZE] = CONFIG_CMDLINE;
++#else
++static const char builtin_cmdline[] __initconst = "";
+ #endif
+ 
+ /*
diff --git a/target/linux/ramips/patches-5.4/0010-MIPS-add-bootargs-override-property.patch b/target/linux/ramips/patches-5.4/0010-MIPS-add-bootargs-override-property.patch
new file mode 100644
index 0000000000..c19a0fb480
--- /dev/null
+++ b/target/linux/ramips/patches-5.4/0010-MIPS-add-bootargs-override-property.patch
@@ -0,0 +1,63 @@
+From f15d27f9c90ede4b16eb37f9ae573ef81c2b6996 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Thu, 31 Dec 2020 18:49:12 +0100
+Subject: [PATCH] MIPS: add bootargs-override property
+
+Add support for the bootargs-override property to the chosen node
+similar to the one used on ipq806x or mpc85xx.
+
+This is necessary, as the U-Boot used on some boards, notably the
+Ubiquiti UniFi 6 Lite, overwrite the bootargs property of the chosen
+node leading to a kernel panic when loading OpenWrt.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ arch/mips/kernel/setup.c | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -571,8 +571,28 @@ static int __init bootcmdline_scan_chose
+ 	return 1;
+ }
+ 
++static int __init bootcmdline_scan_chosen_override(unsigned long node, const char *uname,
++						   int depth, void *data)
++{
++	bool *dt_bootargs = data;
++	const char *p;
++	int l;
++
++	if (depth != 1 || !data || strcmp(uname, "chosen") != 0)
++		return 0;
++
++	p = of_get_flat_dt_prop(node, "bootargs-override", &l);
++	if (p != NULL && l > 0) {
++		strlcpy(boot_command_line, p, COMMAND_LINE_SIZE);
++		*dt_bootargs = true;
++	}
++
++	return 1;
++}
++
+ static void __init bootcmdline_init(char **cmdline_p)
+ {
++	bool dt_bootargs_override = false;
+ 	bool dt_bootargs = false;
+ 
+ 	/*
+@@ -586,6 +606,14 @@ static void __init bootcmdline_init(char
+ 	}
+ 
+ 	/*
++	 * If bootargs-override in the chosen node is set, use this as the
++	 * command line
++	 */
++	of_scan_flat_dt(bootcmdline_scan_chosen_override, &dt_bootargs_override);
++	if (dt_bootargs_override)
++		return;
++
++	/*
+ 	 * If the user specified a built-in command line &
+ 	 * MIPS_CMDLINE_BUILTIN_EXTEND, then the built-in command line is
+ 	 * prepended to arguments from the bootloader or DT so we'll copy them