ipq807x: add support for Buffalo WXR-5950AX12

Buffalo WXR-5950AX12 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on
IPQ8074A.

Specification:

- SoC         : Qualcomm IPQ8074A
- RAM         : DDR3 1024 MiB (2x Nanya NT5CC256M16ER-EK)
- Flash       : RAW NAND 256 MiB (Winbond W29N02GZBIBA)
- WLAN        : 2.4/5 GHz (IPQ8074A)
- Ethernet    : 5 ports
  - WAN       : 100/1000/2500/10000 Mbps x1 (AQR113C)
  - LAN       : 100/1000/2500/10000 Mbps x1 (AQR113C),
                10/100/1000 Mbps x3 (QCA8075)
- LED/Keys    : 8x/5x
- UART        : pin header on PCB (J7)
  - assignment: 3.3V, GND, TX, RX from disc marking
  - settings  : 115200n8
- Power       : 12 VDC, 4 A

Flash instruction using initramfs image:

1. Prepare TFTP server with IP address 192.168.11.10
2. Rename OpenWrt initramfs image to "WXR-5950AX12-initramfs.uImage and
   place it to TFTP directory
3. Hold AOSS (WPS) button and power on WXR-5950AX12
4. WXR-5950AX12 downloads initramfs image from TFTP server and boots
   with it automatically
5. Upload sysupgrade image to WXR-5950AX12 and perform sysupgrade
6. Wait ~120 seconds to complete flashing

Partition layout:

0x000000000000-0x000000100000 : "0:sbl1"
0x000000100000-0x000000200000 : "0:mibib"
0x000000200000-0x000000280000 : "0:bootconfig"
0x000000280000-0x000000300000 : "0:bootconfig1"
0x000000300000-0x000000600000 : "0:qsee"
0x000000600000-0x000000900000 : "0:qsee_1"
0x000000900000-0x000000980000 : "0:devcfg"
0x000000980000-0x000000a00000 : "0:devcfg_1"
0x000000a00000-0x000000a80000 : "0:apdp"
0x000000a80000-0x000000b00000 : "0:apdp_1"
0x000000b00000-0x000000b80000 : "0:rpm"
0x000000b80000-0x000000c00000 : "0:rpm_1"
0x000000c00000-0x000000c80000 : "0:cdt"
0x000000c80000-0x000000d00000 : "0:cdt_1"
0x000000d00000-0x000000d80000 : "0:appsblenv"
0x000000d80000-0x000000e80000 : "0:appsbl"
0x000000e80000-0x000000f80000 : "0:appsbl_1"
0x000000f80000-0x000001000000 : "0:art"
0x000001000000-0x000001080000 : "0:art_1"
0x000001080000-0x000001100000 : "0:orgdata"
0x000001100000-0x000001180000 : "0:orgdata_1"
0x000001180000-0x000005180000 : "rootfs"
0x000005180000-0x000009180000 : "rootfs_recover"
0x000009180000-0x000010000000 : "user_property"

Notes:

- WXR-5950AX12 has 2x OS images on NAND flash. The 1st image is for
  normal operation and the 2nd one is for recoverying or firmware
  upgrading on stock.

- Stock U-Boot checks MD5 hashes in "fw_hash" volume in each "root*"
  partition when booting. This is just a comparation of hash strings.

  Behaviors:

  - both "fw_hash" volumes exist, hashes are rootfs == rootfs_recover
    ---> boot from rootfs

  - both "fw_hash" volumes exist, hashes are rootfs != rootfs_recover
    ---> boot from rootfs_recover

    Note: this behavior is used for firmware upgrading on stock

  - "fw_hash" volume in rootfs is missing
    ---> boot from rootfs_recover

  - "fw_hash" volume in rootfs_recover is missing
    ---> boot from rootfs

  - "fw_hash" volumes in both root* partition are missing
    ---> boot from rootfs_recover

Reverting to stock firmware:

1. Decrypt official image by buffalo-enc and remove header

   example of decryption:

   $ buffalo-enc -i wxr_5950ax12_jp_305 -o wxr_5950ax12_jp_305.dec \
                 -d -k olaffuB -O 0xc8

   example of removing header (v3.05):

   - before

   $ hexdump -n 64 -v -C wxr_5950ax12_jp_305.dec
   00000000  57 58 52 2d 35 39 35 30  41 58 31 32 5f 33 2e 30  |WXR-5950AX12_3.0|
   00000010  35 5f 31 2e 30 31 5f 4a  50 5f 6a 70 5f 71 63 61  |5_1.01_JP_jp_qca|
   00000020  0a 66 69 6c 65 6c 65 6e  3d 34 35 33 35 30 39 31  |.filelen=4535091|
   00000030  32 0a 55 42 49 23 01 00  00 00 00 00 00 00 00 00  |2.UBI#..........|
   00000040

   - after

   $ hexdump -n 64 -v -C wxr_5950ax12_jp_305.ubi
   00000000  55 42 49 23 01 00 00 00  00 00 00 00 00 00 00 00  |UBI#............|
   00000010  00 00 08 00 00 00 10 00  78 cf c4 91 00 00 00 00  |........x.......|
   00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
   00000030  00 00 00 00 00 00 00 00  00 00 00 00 3d 2a 64 fd  |............=*d.|
   00000040

2. Boot WXR-5950AX12 with OpenWrt initramfs image

3. Upload modified stock image to WXR-5950AX12

4. Find partitions "rootfs" and "rootfs_recover"

   example:

   root@OpenWrt:/# cat /proc/mtd
   dev:    size   erasesize  name
   ...
   mtd22: 04000000 00020000 "rootfs"
   mtd23: 04000000 00020000 "rootfs_recover"
   ...

   in this case, "rootfs" is mtd22 and "rootfs_recover" is mtd23

5. Format "rootfs"/"rootfs_recover" partition with the uploaded image

   example:

   ubiformat /dev/mtd22 -f /tmp/wxr_5950ax12_jp_305.ubi
   ubiformat /dev/mtd23 -f /tmp/wxr_5950ax12_jp_305.ubi

6. Remove "rootfs"/"rootfs_data" volume from user_property partition

   example:

   . /lib/upgrade/nand.sh
   UBI=$(nand_attach_ubi user_property)
   ubirmvol /dev/$UBI -N rootfs
   ubirmvol /dev/$UBI -N rootfs_data

7. Reboot

MAC addresses:

LAN    : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text))
WAN    : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text))
2.4 GHz: 50:C4:DD:xx:xx:30 (0:APPSBLENV, wlan0addr (text))
5 GHz  : 50:C4:DD:xx:xx:38 (0:APPSBLENV, wlan1addr (text))

Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>

4 files changed, 65 insertions, 0 deletions

diff --git a/target/linux/ipq807x/base-files/etc/board.d/02_network b/target/linux/ipq807x/base-files/etc/board.d/02_network
index a8d9d5d6cf..43c67a0f31 100644
--- a/target/linux/ipq807x/base-files/etc/board.d/02_network
+++ b/target/linux/ipq807x/base-files/etc/board.d/02_network
@@ -11,6 +11,7 @@ ipq807x_setup_interfaces()
 	local board="$1"
 
 	case "$board" in
+	buffalo,wxr-5950ax12|\
 	dynalink,dl-wrx36|\
 	xiaomi,ax9000)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
diff --git a/target/linux/ipq807x/base-files/etc/hotplug.d/firmware/11-ath11k-caldata b/target/linux/ipq807x/base-files/etc/hotplug.d/firmware/11-ath11k-caldata
index 304d3a71b8..eec286e269 100644
--- a/target/linux/ipq807x/base-files/etc/hotplug.d/firmware/11-ath11k-caldata
+++ b/target/linux/ipq807x/base-files/etc/hotplug.d/firmware/11-ath11k-caldata
@@ -9,6 +9,7 @@ board=$(board_name)
 case "$FIRMWARE" in
 "ath11k/IPQ8074/hw2.0/cal-ahb-c000000.wifi.bin")
 	case "$board" in
+	buffalo,wxr-5950ax12|\
 	edgecore,eap102|\
 	edimax,cax1800|\
 	dynalink,dl-wrx36|\
diff --git a/target/linux/ipq807x/base-files/lib/upgrade/buffalo.sh b/target/linux/ipq807x/base-files/lib/upgrade/buffalo.sh
new file mode 100644
index 0000000000..d0ed258890
--- /dev/null
+++ b/target/linux/ipq807x/base-files/lib/upgrade/buffalo.sh
@@ -0,0 +1,55 @@
+. /lib/functions.sh
+
+# Prepare UBI devices for OpenWrt installation
+# - rootfs (mtd22)
+#   - remove "ubi_rootfs" volume (rootfs on stock)
+#   - remove "fw_hash" volume (firmware hash)
+# - user_property (mtd24)
+#   - remove "user_property_ubi" volume (user configuration)
+#   - remove "extra_property" volume (gzipped syslog)
+buffalo_upgrade_prepare() {
+	local ubi_rootdev ubi_propdev
+
+	if ! ubi_rootdev="$(nand_attach_ubi rootfs)" || \
+	   ! ubi_propdev="$(nand_attach_ubi user_property)"; then
+		echo "failed to attach UBI volume \"rootfs\" or \"user_property\", rebooting..."
+		reboot -f
+	fi
+
+	ubirmvol /dev/$ubi_rootdev -N ubi_rootfs &> /dev/null || true
+	ubirmvol /dev/$ubi_rootdev -N fw_hash &> /dev/null || true
+
+	ubirmvol /dev/$ubi_propdev -N user_property_ubi &> /dev/null || true
+	ubirmvol /dev/$ubi_propdev -N extra_property &> /dev/null || true
+}
+
+# Re-create small dummy ubi_rootfs volume and update
+# fw_hash volume to pass the checking by U-Boot
+# - rootfs (mtd22)
+#   - re-create "ubi_rootfs" volume
+#   - re-create and update "fw_hash" volume
+# - rootfs_recover (mtd23)
+#   - update "fw_hash" volume
+buffalo_upgrade_optvol() {
+	local ubi_rootdev ubi_rcvrdev
+	local hashvol_root hashvol_rcvr
+
+	if ! ubi_rootdev="$(nand_attach_ubi rootfs)" || \
+	   ! ubi_rcvrdev="$(nand_attach_ubi rootfs_recover)"; then
+		echo "failed to attach UBI volume \"rootfs\" or \"rootfs_recover\", rebooting..."
+		reboot -f
+	fi
+
+	ubimkvol /dev/$ubi_rootdev -N ubi_rootfs -S 1
+	ubimkvol /dev/$ubi_rootdev -N fw_hash -S 1 -t static
+
+	if ! hashvol_root="$(nand_find_volume $ubi_rootdev fw_hash)" || \
+	   ! hashvol_rcvr="$(nand_find_volume $ubi_rcvrdev fw_hash)"; then
+		echo "\"fw_hash\" volume in \"rootfs\" or \"rootfs_recover\" not found, rebooting..."
+		reboot -f
+	fi
+
+	echo -n "00000000000000000000000000000000" > /tmp/dummyhash.txt
+	ubiupdatevol /dev/$hashvol_root /tmp/dummyhash.txt
+	ubiupdatevol /dev/$hashvol_rcvr /tmp/dummyhash.txt
+}
diff --git a/target/linux/ipq807x/base-files/lib/upgrade/platform.sh b/target/linux/ipq807x/base-files/lib/upgrade/platform.sh
index 4a6a91b5f5..683015898a 100644
--- a/target/linux/ipq807x/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ipq807x/base-files/lib/upgrade/platform.sh
@@ -43,6 +43,14 @@ platform_pre_upgrade() {
 
 platform_do_upgrade() {
 	case "$(board_name)" in
+	buffalo,wxr-5950ax12)
+		CI_KERN_UBIPART="rootfs"
+		CI_ROOT_UBIPART="user_property"
+		buffalo_upgrade_prepare
+		nand_do_flash_file "$1" || nand_do_upgrade_failed
+		nand_do_restore_config || nand_do_upgrade_failed
+		buffalo_upgrade_optvol
+		;;
 	dynalink,dl-wrx36)
 		nand_do_upgrade "$1"
 		;;