ipq806x: Add support for Xiaomi Mi Router HD (R3D)

[remittor]

Xiaomi R3D is a 2.4/5 GHz band 11ac router, based on IPQ8064.

Specification:

• SoC: Qualcomm IPQ8064
• RAM: 512MB DDR3
• STOR: 256MB NAND (Macronix MX30UF2G18AC-TI)
• ETH: 1x WAN 10/100/1000, 3x LAN 10/100/1000
• WiFi: Qualcomm QCA9984 (5GHz, 4T4R, n/ac)
• WiFi: Qualcomm QCA9980 (2.4GHz, 4T4R, b/g/n)
• USB: 1x 3.0
• SATA: 1x SATA 3.1 (only for internal HDD 3.5")
• BTN: Power, Reset
• LEDS: Status(Green/Blue/Red)
• UART: present as 4-pads on the PCB (3.3V, 115200-8-N-1)

MAC addresses as verified by stock firmware:

Interface	MAC	Partition	Offset	Format
WAN (label)	xx:xx:xx:xx:xx:B2	ART	0x0	binary
LAN	xx:xx:xx:xx:xx:B3	ART	0x6	binary
WiFi 2g	xx:xx:xx:xx:xx:B4	ART	0x1006	binary
WiFi 5g	xx:xx:xx:xx:xx:B5	ART	0x5006	binary

Partition layout and boot:

Stock Xiaomi firmware has the MTD split into (among others)

• kernel0 (@0x0800000)
• kernel1 (@0x0c00000)
• rootfs0 (@0x1000000)
• rootfs1 (@0x3800000)
• overlay (@0x6000000)

Xiaomi uboot expects to find kernels at 0x800000 & 0xc00000 referred to as system 1 & system 2 respectively. a kernel is considered suitable for handing control over if its linux magic number exists & uImage CRC are correct. If either of those conditions fail, a matching sys'n'_fail flag is set in uboot env & a restart performed in the hope that the alternate kernel is okay. If neither kernel checksums ok and both are marked failed, system 2 is booted anyway.

Note uboot's tftp flash install writes the transferred image to both kernel partitions.

Methods for getting SSH access:

1. https://github.com/acecilia/OpenWRTInvasion
2. https://github.com/openwrt-xiaomi/xmir-patcher

Installation:

The installation file for OpenWRT is a *squashfs-factory.bin file that contains the kernel and a ubi partition. This is flashed as follows:

nvram flag_boot_success=1
nvram flag_boot_rootfs=1
nvram flag_last_success=1
nvram flag_try_sys1_failed=0
nvram flag_try_sys2_failed=0
nvram commit
dd if=factory.bin bs=1M count=4 | mtd write - kernel0
dd if=factory.bin bs=1M count=4 | mtd write - kernel1
dd if=factory.bin bs=1M skip=4  | mtd write - rootfs0
reboot

Reverting to stock:

Download facinstall.ipk from link https://github.com/openwrt-xiaomi/facinstall/releases/latest and install its. Install miwifi_r3d_firmware_XXXXX.bin image via LuCI interface.

[motolav]

The kernel module for the fan controller should be in /package/kernel/linux/modules/hwmon.mk

[remittor]

@motolav check it: https://github.com/openwrt/openwrt/pull/14332

[remittor]

@Ansuel , ping

[remittor]

@Ansuel

Callstack:

ath10k_core_probe_fw(ar)
    ath10k_core_pre_cal_download(ar)
        ath10k_download_cal_nvmem(ar, "pre-calibration") 
            devm_nvmem_cell_get(ar->dev, "pre-calibration") 
                nvmem_cell_get(dev, "pre-calibration");
                    of_nvmem_cell_get(dev->of_node, "pre-calibration");
                        np = dev->of_node
                        // of_node.full_name = "/soc/pci@1b500000/bridge@0,0/wifi@1,0"
                        index = of_property_match_string(np, "nvmem-cell-names", id);                        
                        of_parse_phandle_with_optional_args(np, "nvmem-cells", "#nvmem-cell-cells", index, &cell_spec);
                            __of_parse_phandle_with_args(np, "nvmem-cells", "#nvmem-cell-cells", 0, index, &cell_spec);
                                of_for_each_phandle(&it, rc, np, "nvmem-cells", "#nvmem-cell-cells", 0) 

First variant

If the dts contains the following description:

&pcie0 {
    bridge@0,0 {
        wifi@1,0 {
            nvmem-cells = <&macaddr_art_1006 0>, <&precal_art_1000>;
            nvmem-cell-names = "mac-address", "pre-calibration";
        };
    };
};    

dtb:

nand-controller@1ac00000 {
    nand@0 {
        partitions {
            partition@540000 {
                label = "ART";
                nvmem-layout { 
                    macaddr@1006 {
                        reg = <0x1006 0x06>;
                        phandle = <0x2b>;
                    };
                    precal@1000 {
                        reg = <0x1000 0x2f20>;
                        phandle = <0x2c>;
                    };
                };
            };
        };
    };
};
pci@1b500000 {
    bridge@0,0 {
        wifi@1,0 {
            nvmem-cells = <0x2b 0x00 0x2c>;
            nvmem-cell-names = "mac-address\0pre-calibration";
        };
    };
};    

Function __of_parse_phandle_with_args returns -2 Logs:

devm_nvmem_cell_get: id = 'pre-calibration'
of_nvmem_cell_get: id = 'pre-calibration', index = 1
of_nvmem_cell_get: 'bridge@0,0'
of_nvmem_cell_get: 'wifi@1,0'
OF: __of_parse_phandle_with_args: cur_index = 0 , rc = 0 , 2B
OF: __of_parse_phandle_with_args: it.node = 'macaddr@1006'
OF: __of_parse_phandle_with_args: cur_index = 1 , rc = 0 , 0
OF: __of_parse_phandle_with_args: ERR = -2
of_nvmem_cell_get: #nvmem-cell-cells ERROR = -2

Instead PHandle = 0x2C loop of_for_each_phandle processed 0x00

Second variant

If the dts contains the following description:

&pcie0 {
    bridge@0,0 {
        wifi@1,0 {
            nvmem-cells = <&macaddr_art_1006>, <&precal_art_1000>;
            nvmem-cell-names = "mac-address", "pre-calibration";
        };
    };
};    

dtb:

pci@1b500000 {
    bridge@0,0 {
        wifi@1,0 {
            nvmem-cells = <0x2b 0x2c>;
            nvmem-cell-names = "mac-address\0pre-calibration";
        };
    };
};    

Function __of_parse_phandle_with_args returns -22 Logs:

devm_nvmem_cell_get: id = 'pre-calibration'
of_nvmem_cell_get: id = 'pre-calibration', index = 1
of_nvmem_cell_get: 'bridge@0,0'
of_nvmem_cell_get: 'wifi@1,0'
OF: __of_parse_phandle_with_args: cur_index = 0 , rc = 0 , 2B
OF: __of_parse_phandle_with_args: it.node = 'macaddr@1006'
OF: /soc/pci@1b500000/bridge@0,0/wifi@1,0: #nvmem-cell-cells = 1 found 0
OF: __of_parse_phandle_with_args: ERR = -22
of_nvmem_cell_get: #nvmem-cell-cells ERROR = -22

Loop of_for_each_phandle processed only 0x2B PHandle (macaddr@1006)

Third variant (worked)

If the dts contains the following description:

&pcie0 {
    bridge@0,0 {
        wifi@1,0 {
            nvmem-cells = <&precal_art_1000>, <&macaddr_art_1006>;
            nvmem-cell-names = "pre-calibration", "mac-address";
        };
    };
};    

dtb:

                    macaddr@1006 {
                        reg = <0x1006 0x06>;
                        phandle = <0x2c>;
                    };
                    precal@1000 {
                        reg = <0x1000 0x2f20>;
                        phandle = <0x2b>;
                    };
pci@1b500000 {
    bridge@0,0 {
        wifi@1,0 {
            nvmem-cells = <0x2b 0x2c>;
            nvmem-cell-names = "pre-calibration\0mac-address";
        };
    };
};    

Function __of_parse_phandle_with_args returns 0 Logs:

devm_nvmem_cell_get: id = 'pre-calibration'
of_nvmem_cell_get: id = 'pre-calibration', index = 0
of_nvmem_cell_get: 'bridge@0,0'
of_nvmem_cell_get: 'wifi@1,0'
OF: __of_parse_phandle_with_args: cur_index = 0 , rc = 0 , 2B
OF: __of_parse_phandle_with_args: it.node = 'precal@1000'
OF: __of_parse_phandle_with_args: FOUND: it.node = 2B 'precal@1000' c = 0
of_nvmem_cell_get: #nvmem-cell-cells: args_count = 0  np = -574900180
ath10k_pci 0000:01:00.0: board_file api 2 bmi_id 0:1 crc32 0bfe5c35
ath10k_pci 0000:01:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
ath10k_pci 0000:01:00.0: msdu-desc: 2500  skid: 32
ath10k_pci 0000:01:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
ath10k_pci 0000:01:00.0: wmi print 'free: 84920 iram: 13156 sram: 11224'
ath10k_pci 0000:01:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-nvmem max-sta 32 raw 0 hwcrypto 1

Module wifi@1,0 successfully initialized!

[Ansuel]

@remittor mhh can't repro, are you sure you don't have some downstream patch that are messing with this? Anyway whatever doesn't change a thing so i'm ok with it.

[Neustradamus]

To follow

[Neustradamus]

@remittor: Any progress on this PR?

[remittor]

@Neustradamus , I will definitely make corrections within two weeks.