ramips: add support for ZyXEL WAP6805 (Altibox WiFi+)

Hardware
--------
SoC:   MediaTek MT7621ST
WiFi:  MediaTek MT7603
       Quantenna QT3840BC
Flash: 128M NAND
RAM:   64M
LED:   Dual colour red and green
BTN:   Reset
       WPS
Eth:   4 x 10/100/1000 connected to MT7621 internal switch
       MT7621 RGMII port connected to Quantenna module
GPIO:  Power/reset of Quantenna module

Quantenna module
----------------

The Quantenna QT3840BC (or QV840) is a separate SoC running
another Linux installation.  It is mounted on a wide mini-PCIe
form factor module, but is connected to the RGMII port of
the MT7621.  It loads both a second uboot stage and an os
image from the MT7621 using tftp.  The module is configured
using Quantenna specific RPC calls over IP, using 802.1q
over the RGMII link to support multiple SSIDs.

There is no support for using this module as a WiFi device
in OpenWrt. A package with basic firmware and management
tools is being prepared.

Serial ports
------------

Two serial ports with headers:

RRJ1 - 115200 8N1 - Connected to the Quantenna console
J1   -  57600 8N1 - Connected to the MT7621 console

Both share pinout with many other Zyxel/Mitrastar devices:

1 - NC (VDD)
2 - TX
3 - RX
4 - NC (no pin)
5 - GND

Dual system partitions
----------------------

The vendor firmware and boot loader use a dual partition
scheme storing a counter in the header of each partition. The
partition with the highest number will be selected for boot.

OpenWrt does not support this scheme and will always use the
first OS partition.  It will reset both counters to zero the
first time sysupgrade is run, making sure the first partition
is selected by the boot loader.

Installation from vendor firmware
---------------------------------

1. Run a DHCP server. The WAP6805 is configured as a client device
   and does not have a default static IP address. Make a note of
   which address it is assigned

2. tftp the OpenWrt initramfs-kernel.bin image to this address.
   Wait for the WAP6805 to reboot.

3. ssh to the OpenWrt initramfs system on 192.168.1.1. Make a
   backup of all mtd partitions now.  The last used OEM image is
   still present in either "Kernel" or "Kernel2" at this point,
   and can be restored later if you save a copy.

4. sysupgrade to the OpenWrt sysupgrade.bin image.

Installation from U-Boot
------------------------

This requires serial console access

1. Copy the OpenWrt initramfs-kernel.bin image as "ras.bin" to
   your tftp server directory.  Configure the server address as
   192.168.0.33/24

2. Hit ESC when the message "Hit ESC key to stop autoboot"
   appears

3. Type "ATGU" + Enter, and then "2" immediately after pressing enter.

4. Answer Y to the question "Erase Linux in Flash then burn new
   one. Are you sure?", and answer the address/filename questions.
   Defaults:
        Input device IP (192.168.0.2)
        Input server IP (192.168.0.33)
        Input Linux Kernel filename ("ras.bin")

5. Wait until after you see the message "Done!" and power cycle
   the device.  It will hang after flashing.

6. Continue with step 3 and 4 from the vendor firmware procedure.

Notes on the WAP6805 U-Boot
---------------------------
The bootloader has been modified with both ZyXELs zyloader and the
device specific dual partition scheme.  These changes appear to have
broken a few things.  The zyloader shell claims to support a number
of ZyXEL AT commands, but not all of them work.  The image selection
scheme is unreliable and inconsistent.  A limited U-Boot menu is
available - and used by the above U-Boot install procedure.  But
direct booting into an uploaded image does not work, neither with
ram nor with flash.  Flashing works, but requires a hard reset after
it is finished.

Reverting to OEM firmware
-------------------------

The OEM firmware can be restored by using mtd write from OpenWrt,
flashing it to the "Kernel" partition. E.g.

  ssh root@192.168.1.1 "mtd -r -e Kernel write - Kernel" < oem.bin

OEM firmwares for the WAP6805 are not avaible for public download,
so a backup of the original installation is required.  See above.

Alternatively, firmware for the WAP6806 (Armor X1) may be used. This
is exactly the same hardware.  But the branding features do obviously
differ.

LED controller
--------------

Hardware implementation is unknown.  The dual-color LED is controlled
by 3 GPIOs:

  4: red
  7: blinking green
 13: green

Enabling both red and green makes the LED appear yellow.

The boot loader enables hardware blinking, causing the green LED to blink
slowly on power-on, until the OpenWrt boot mode starts a faster software
blink.

Signed-off-by: Bjørn Mork <bjorn@mork.no>
[fix alphabetic sorting for image build statement]
Signed-off-by: Petr Štetiar <ynezz@true.cz>

5 files changed, 213 insertions, 0 deletions

diff --git a/target/linux/ramips/dts/mt7621_zyxel_wap6805.dts b/target/linux/ramips/dts/mt7621_zyxel_wap6805.dts
new file mode 100644
index 0000000000..8152ca11f8
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_zyxel_wap6805.dts
@@ -0,0 +1,178 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "zyxel,wap6805", "mediatek,mt7621-soc";
+	model = "ZyXEL WAP6805";
+
+	aliases {
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_green;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,57600";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_red: status_red {
+			label = "wap6805:red:status";
+			gpios = <&gpio 4 GPIO_ACTIVE_HIGH>;
+		};
+
+		status_blink {
+			label = "wap6805:blink:status";
+			gpios = <&gpio 7 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_green: status_green {
+			label = "wap6805:green:status";
+			gpios = <&gpio 13 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "Bootloader";
+			reg = <0x0 0x100000>;
+			read-only;
+		};
+
+		partition@100000 {
+			label = "MRD";
+			reg = <0x100000 0x100000>;
+			read-only;
+		};
+
+		factory: partition@200000 {
+			label = "Factory";
+			reg = <0x200000 0x100000>;
+			read-only;
+		};
+
+		partition@300000 {
+			label = "Config";
+			reg = <0x300000 0x100000>;
+		};
+
+		partition@400000 {
+			label = "Kernel";
+			reg = <0x400000 0x2000000>;
+		};
+
+		partition@800000 {
+			label = "ubi";
+			reg = <0x800000 0x1c00000>;
+		};
+
+		partition@2400000 {
+			label = "Kernel2";
+			reg = <0x2400000 0x2000000>;
+		};
+
+		partition@4400000 {
+			label = "Private";
+			reg = <0x4400000 0x100000>;
+		};
+
+		partition@4500000 {
+			label = "Log";
+			reg = <0x4500000 0x1000000>;
+		};
+
+		partition@5500000 {
+			label = "App";
+			reg = <0x5500000 0x2b00000>;
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	mt76@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+	};
+};
+
+&gmac0 {
+	mtd-mac-address = <&factory 0xe000>;
+};
+
+&gmac1 {
+	status = "okay";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan4";
+		};
+		port@1 {
+			status = "okay";
+			label = "lan3";
+		};
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+		port@3 {
+			status = "okay";
+			label = "lan1";
+		};
+	};
+};
+
+&xhci {
+	status = "disabled";
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "uart3", "jtag", "wdt";
+		function = "gpio";
+	};
+};
diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk
index 9103fd6762..ad61440c4c 100644
--- a/target/linux/ramips/image/mt7621.mk
+++ b/target/linux/ramips/image/mt7621.mk
@@ -81,6 +81,11 @@ define Build/iodata-mstc-header
 	)
 endef
 
+define Build/mitrastarimage
+	uimage_padhdr -l 160 -i $@ -o $@.new
+	mv $@.new $@
+endef
+
 define Build/ubnt-erx-factory-image
 	if [ -e $(KDIR)/tmp/$(KERNEL_INITRAMFS_IMAGE) -a "$$(stat -c%s $@)" -lt "$(KERNEL_SIZE)" ]; then \
 		echo '21001:7' > $(1).compat; \
@@ -1129,3 +1134,17 @@ define Device/zio_freezio
 	kmod-usb-ledtrig-usbport wpad-basic
 endef
 TARGET_DEVICES += zio_freezio
+
+define Device/zyxel_wap6805
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_SIZE := 4096k
+  UBINIZE_OPTS := -E 5
+  IMAGE_SIZE := 32448k
+  DEVICE_VENDOR := ZyXEL
+  DEVICE_MODEL := WAP6805
+  DEVICE_PACKAGES := kmod-mt7603 wpad-basic kmod-mt7621-qtn-rgmii
+  KERNEL := $(KERNEL_DTB) | uImage lzma | mitrastarimage
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += zyxel_wap6805
diff --git a/target/linux/ramips/mt7621/base-files/etc/board.d/02_network b/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
index 4b65dd2364..ec05def88f 100755
--- a/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
+++ b/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
@@ -53,6 +53,10 @@ ramips_setup_interfaces()
 	ubnt,edgerouter-x-sfp)
 		ucidef_set_interface_lan_wan "eth1 eth2 eth3 eth4 eth5" "eth0"
 		;;
+	zyxel,wap6805)
+		ucidef_set_interface_lan "lan1 lan2 lan3 lan4"
+		ucidef_set_interface "qtn" ifname "eth1" protocol "static" ipaddr "1.1.1.1" netmask "255.255.255.0"
+		;;
 	*)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
 		;;
diff --git a/target/linux/ramips/mt7621/base-files/etc/board.d/03_gpio_switches b/target/linux/ramips/mt7621/base-files/etc/board.d/03_gpio_switches
index 24bfcb2051..e24e04f1d8 100755
--- a/target/linux/ramips/mt7621/base-files/etc/board.d/03_gpio_switches
+++ b/target/linux/ramips/mt7621/base-files/etc/board.d/03_gpio_switches
@@ -23,6 +23,9 @@ ubnt,edgerouter-x-sfp)
 	ucidef_add_gpio_switch "poe_power_port3" "PoE Power Port3" "403"
 	ucidef_add_gpio_switch "poe_power_port4" "PoE Power Port4" "404"
 	;;
+zyxel,wap6805)
+	ucidef_add_gpio_switch "qtn_power" "Quantenna Module Power" "496" "1"
+	;;
 esac
 
 board_config_flush
diff --git a/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh b/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh
index 00b2ffa89e..a9a0bd40b9 100755
--- a/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh
@@ -71,6 +71,15 @@ platform_do_upgrade() {
 	ubnt,edgerouter-x-sfp)
 		platform_upgrade_ubnt_erx "$1"
 		;;
+	zyxel,wap6805)
+		local kernel2_mtd="$(find_mtd_part Kernel2)"
+		[ "$(hexdump -n 4 -e '"%x"' $kernel2_mtd)" = "56190527" ] &&\
+		[ "$(hexdump -n 4 -s 104 -e '"%x"' $kernel2_mtd)" != "0" ] &&\
+		dd bs=4 count=1 seek=26 conv=notrunc if=/dev/zero of=$kernel2_mtd 2>/dev/null &&\
+		echo "Kernel2 sequence number was reset to 0"
+		CI_KERNPART="Kernel"
+		nand_do_upgrade "$1"
+		;;
 	*)
 		default_do_upgrade "$1"
 		;;