ipq807x: Add support for Netgear WAX218 #47

mrnuke · 2022-06-11T02:04:31Z

ipq807x: add support for Netgear WAX218

Netgear WAX218 is a 802.11ax AP claiming AX3600 support. It is wall
or ceiling mountable. It can be powered via PoE, or a 12 V adapter.

The board has footprints for 2.54mm UART headers. They're difficult to
solder because the GND is connected to a large copper plane. Only try
soldering if you are very skilled. Otherwise, use pogo pins.

Specifications:

* CPU: Qualcomm IPQ8072A Quad core Cortex-A53 2.2GHz
* RAM: 366 MB of RAM available to OS, not sure of total amount
* Storage: Macronix MX30UF2G18AC 256MB NAND
* Ethernet:
        * 2.5G RJ45 port (QCA8081) with PoE input
* WLAN:
        * 2.4GHz/5GHz with 8 antennas
* LEDs:
        * Power (Amber)
        * LAN (Blue)
        * 2G WLAN (Blue)
        * 5G WLAN (Blue)
* Buttons:
        * 1x Factory reset
* Power: 12V DC Jack
* UART: Two 4-pin unpopulated headers near the LEDs
        * "J2 UART" is the CPU UART, 3.3 V level

Not (yet) implemented:

WiFi (Needs board-specific firmware files)

Installation:

Web UI method

Flashing OpenWRT using the vendor's Web UI is problematic on this
device. The u-boot mechanism for communicating the active rootfs is
antiquated and unreliable. Instead of setting the kernel commandline,
it relies on patching the DTS partitions of the nand node. The way
partitions are patched is incompatible with newer kernels.

Newer kernels use the SMEM partition table, which puts "rootfs" on
mtd12. The vendor's Web UI will flash to either mtd12 or mtd14. One
reliable way to boot from mtd14 and avoid boot loops is to use an
initramfs image.

In the factory web UI, navigate to System Manager -> Firmware.
In the "Local Firmware Upgrade" section, click Browse
Navigate and select the 'web-ui-factory.fit' image
Click "Upload"
On the following page, click on "Proceed"

The flash proceeds at this point and the system will reboot
automatically to OpenWRT.

Flash the 'nand-sysupgrade.bin' using Luci or the commandline

SSH method

Enable SSH using the CLI or Web UI. The root account is locked out to
ssh, and the admin account defaults to Netgear's CLI application.
So we need to get creative:

First, make sure the device boots from the second firmware partition:

ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \
    /usr/sbin/fw_setenv active_fw 1

Then reboot the device, and run the update:

scp -O -o kexalgorithms=diffie-hellman-group14-sha1 \
    -o hostkeyalgorithms=ssh-rsa \
    netgear_wax218-squashfs-nand-factory.ubi \
    admin@<ipaddr>:/tmp/openwrt.ubi

ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \
    /usr/sbin/ubiformat /dev/mtd12 -f /tmp/openwrt.ubi

ssh -okexalgorithms=diffie-hellman-group14-sha1 admin@<ipaddr> \
    /usr/sbin/fw_setenv active_fw 0

Now reboot the device, and it should boot into a ready-to-use OpenWRT.

Funny message before I realized I could unlock FW via serial console

The WAX218 claims to be an AX3600 access point. I couldn't really test that, because the vendor firmware asked me to accept to the vendor's SCREW-U-LA. Having accidentally glanced of this SCREW-U-LA, I realized thatI didn't want to sign away rights to my unborn babies. I didn't accept the SCREW-U-LA, thus did not test the firmware.

robimarko · 2022-06-11T19:49:43Z

No point in backporting the upstream QCA807x PHY driver at all, all it will do is conflict with the SSDK one as they are messing with the PHY from various parts of SSDK via the PHY driver

mrnuke · 2022-06-14T00:16:15Z

I agree on the QCA807x PHY driver point.

I have a problem with the firmware files. I see existing ipq-wifi files have some ID strings in the header:

$ strings package/firmware/ipq-wifi/board-qnap_301w.ipq8074 |head -n 4
QCA-ATH11K-BOARD
bus=ahb,qmi-chip-id=0,qmi-board-id=255,variant=QNAP-301w
LPTX\`dh

However, the firmware files I extracted from the vendor firmware do not:

$ strings lib-firmware/IPQ8074/bdwlan.b290 |head -n4
LPTX\`dh


?############

And I don't know how to get ath11k to load these files. Any suggestions?

kirdesde · 2022-06-14T06:42:16Z

You can add the ID string via ath11k-bdencoder (https://github.com/ecsv/qca-swiss-army-knife)

But first you need to figure out, that board id your device is using, have a look in the stock bootlog (board_id etc.)

Create a json file like that for example:

[ { "names": [ "bus=ahb,qmi-chip-id=0,qmi-board-id=255,variant=Netgear-RAX120v2" ], "data": "bus=ahb,qmi-chip-id=0,qmi-board-id=255,variant=Netgear-RAX120v2.bin" }

Rename the board file accordingly (bus=ahb,qmi-chip-id=0,qmi-board-id=255,variant=Netgear-RAX120v2.bin).

Last step is to add a DTS property like that (ID in hexadecimal)

`&wifi {
status = "okay";

qcom,board_id = <0xff>; 
qcom,ath11k-calibration-variant = "Netgear-RAX120v2";

};`

mrnuke · 2022-06-15T02:53:56Z

You can add the ID string via ath11k-bdencoder (https://github.com/ecsv/qca-swiss-army-knife)

That's awesome! Thank you!

mrnuke · 2022-07-04T23:53:19Z

I ran into a snag with UBI. If I flash the ~~-nand-sysupgrade.ubi~~ -squashfs-nand-factory.ubi image, the flash will complete without issue. However, this puts the machine in a bootloop:

Starting kernel ...
Jumping to AARCH64 kernel via monitor
...
[    0.000000] Kernel command line: console=ttyMSM0 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait
...
[    1.047053] 0x000001000000-0x000007f00000 : "rootfs"
[    1.134149] mtd: device 12 (rootfs) set to be root filesystem
[    1.134434] mtdsplit: no squashfs found in "rootfs"
[    1.138906] 0x000007f00000-0x000008800000 : "0:wififw"
[    1.150650] 0x000008800000-0x00000f700000 : "rootfs_1"
[    1.233793] 0x00000f700000-0x000010000000 : "0:wififw_1"
...
[    1.808420] mtd:ubi_rootfs: Can't open blockdev
[    1.808440] VFS: Cannot open root device "mtd:ubi_rootfs" or unknown-block(31,12): error -2
...
[    1.931009] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,12)

Full log here:

https://gist.github.com/mrnuke/f0c31dd4b66bb4cf07e4810dd02f9816

My observations:

The vendor Web UI flashed the image to mtd14
There was no way to select the destination partition (mtd14 or mtd12)

How would I go on about this?

kirdesde · 2022-07-05T06:21:15Z

I ran into a snag with UBI. If I flash the -nand-sysupgrade.ubi image, the flash will complete without issue. However, this puts the machine in a bootloop:

Starting kernel ...
Jumping to AARCH64 kernel via monitor
...
[    0.000000] Kernel command line: console=ttyMSM0 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait
...
[    1.047053] 0x000001000000-0x000007f00000 : "rootfs"
[    1.134149] mtd: device 12 (rootfs) set to be root filesystem
[    1.134434] mtdsplit: no squashfs found in "rootfs"
[    1.138906] 0x000007f00000-0x000008800000 : "0:wififw"
[    1.150650] 0x000008800000-0x00000f700000 : "rootfs_1"
[    1.233793] 0x00000f700000-0x000010000000 : "0:wififw_1"
...
[    1.808420] mtd:ubi_rootfs: Can't open blockdev
[    1.808440] VFS: Cannot open root device "mtd:ubi_rootfs" or unknown-block(31,12): error -2
...
[    1.931009] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,12)

Full log here:

* https://gist.github.com/mrnuke/f0c31dd4b66bb4cf07e4810dd02f9816

My observations:

* The vendor Web UI flashed the image to mtd14

* There was no way to select the destination partition (mtd14 or mtd12)

How would I go on about this?

Are you sure you flashed a -nand-sysupgrade.ubi image? This is not part of your image definition...
Or was it the factory.ubi?

However, I would not rely on the stock firmware upgrade functionality and flash the image from an openwrt initramfs via ubiformat.

ubiformat /dev/mtdx -y -f factory.ubi.

Ubiformat creates then the ubi-device with the ubi volumes according to the openwrt definition.

mrnuke · 2022-07-05T16:03:28Z

You are correct. I did mean to type -squashfs-nand-factory.ubi.

It appears to me that the vendor firmware uses ubiformat and other openwrt niceties:

[  520.259970] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" stops
Performing system upgrade...
senao dual image upgrade, upgrade the alternative partion: rootfs_1
ubiformat: mtd14 (nand), size 116391936 bytes (111.0 MiB), 888 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 887 -- 100 % complete

The issue is, we are booting from mtd14, but looking at mtd12 for the rootfs. How do we convince linux to look at mtd14 for the rootfs?

kirdesde · 2022-07-05T16:10:26Z

You are correct. I did mean to type -squashfs-nand-factory.ubi.

It appears to me that the vendor firmware uses ubiformat and other openwrt niceties:
[  520.259970] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" stops
Performing system upgrade...
senao dual image upgrade, upgrade the alternative partion: rootfs_1
ubiformat: mtd14 (nand), size 116391936 bytes (111.0 MiB), 888 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 887 -- 100 % complete
The issue is, we are booting from mtd14, but looking at mtd12 for the rootfs. How do we convince linux to look at mtd14 for the rootfs?

set bootargs to: ....ubi.mtd=rootfs_1 (actually that should be part of the partition switch logic, but maybe netgear doesn't implemented this in u-boot and uses a different rootfs detection)

mrnuke · 2022-07-05T16:29:46Z

set bootargs to: ....ubi.mtd=rootfs_1 (actually that should be part of the partition switch logic, but maybe netgear doesn't implemented this in u-boot and uses a different rootfs detection)

The netgear FW uses the bootipq command to boot from flash. The few references I found about it also indicated similar issues. Regardless of which firmware is booting, kernel args are set to:

ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait

I did notice that the /soc/qpic-nand/nandcs node contains a parttitions subnode after the vendor kernel comes up, but it's not present in the dtb I extracted from the vendor image. "rootfs" is either mtd12 or mtd14, depending on which image is booting.

I have a couple of leads:

u-boot could be patching the dtb
Each rootfs slot has a different kernel with hardcoded rootfs

robimarko · 2022-07-05T16:50:01Z

U-boot will patch the DTB, it looks for the NAND controller compatible and then patches the partitions but using the legacy bindings.
Using SMEM parser will give you the same but in a modern fashion.

mrnuke · 2022-07-05T17:45:17Z

This is the unpatched nand node from the devicetree I extracted from the vendor image:

                qpic-nand@79b0000 {
                        compatible = "qcom,ebi2-nandc-bam-v1.5.0";
                        reg = <0x79b0000 0x10000>;
                        #address-cells = <0x01>;
                        #size-cells = <0x00>;
                        clocks = <0x03 0xac 0x03 0xab>;
                        clock-names = "core\0aon";
                        dmas = <0x1d 0x00 0x1d 0x01 0x1d 0x02>;
                        dma-names = "tx\0rx\0cmd";
                        status = "ok";
                        pinctrl-0 = <0x1e>;
                        pinctrl-names = "default";

                        nandcs@0 {
                                compatible = "qcom,nandcs";
                                reg = <0x00>;
                                #address-cells = <0x01>;
                                #size-cells = <0x01>;
                                nand-ecc-strength = <0x04>;
                                nand-ecc-step-size = <0x200>;
                                nand-bus-width = <0x08>;
                        };
                };

I think I tried to use compatible = "qcom,nandcs"; in OpenWRT, but u-boot didn't seem to patch the partitions. Am I looking at the wrong "compatible" ?

robimarko · 2022-07-05T18:01:43Z

https://git.codelinaro.org/clo/qsdk/oss/boot/u-boot-2016/-/blob/NHSS.QSDK.12.0/board/qca/arm/common/fdt_fixup.c#L967

Its looking for the NAND controller compatible and will just dump the partitions under it, if you use DTC on a running board and dump the DTS, you will see that it adds the partitions but they are using the legacy bindings and thankfully these are ignored by the kernel.

Due to this crap of a bootloader if you want to use fixed partitions, a dummy partitions subnode under the controller but not under the NAND flash node you add a disabled node like its done for AX9000.

Just use SMEM parser, it will give you the same nodes as bootloader parses SMEM partition table and patches that in

mrnuke · 2022-07-05T18:15:43Z

Thank you for the references!

Just use SMEM parser, it will give you the same nodes as bootloader parses SMEM partition table and patches that in

I have compatible = "qcom,smem-part"; right now. The issue I have is this doesn't work if OpenWRT is flashed to mtd14("rootfs_1"): #47 (comment)_

robimarko · 2022-07-05T18:53:08Z

Hm, I assume that they are using bootconfig as the source of which rootfs to use and update that via SCM.
Thats the only way if bootqca/bootipq is used as bootcmd unless they modified the bootloader which wouldn't be a new thing for Netgear

mrnuke · 2022-07-08T03:04:33Z

In order to get things booting properly, I need to do:

bootargs-append = " ubi.block=0,rootfs root=/dev/ubiblock0_1";

I wonder if there's a way to specify ubi.block and root using the ubi and volume names instead of numerical constants.

mrnuke · 2022-07-08T04:20:54Z

Turns out we really can't rely on the vendor u-boot patching things. T

&qpic_nand {
	compatible = "qcom,ebi2-nandc-bam-v1.5.0", "qcom,ipq8074-nand";
	status = "okay";

	nand@0 {
		reg = <0>;
		nand-ecc-strength = <4>;
		nand-ecc-step-size = <512>;
		nand-bus-width = <8>;
	};
};

Results in:

[    0.674087] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xaa
[    0.675733] nand: Macronix MX30UF2G18AC
[    0.682350] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    0.685901] Block protection check failed
[    0.693782] qcom_nand.0: error parsing ofpart partition /soc/nand@79b0000/nand@0/partition@0 (/soc/nand@79b0000/nand@0)

robimarko · 2022-07-08T10:50:52Z

I think that in theory using names for volumes should work, however, I have never been able to actually get that working.

BTW, whats the purpose of qcom,ebi2-nandc-bam-v1.5.0?

mrnuke · 2022-07-08T14:15:38Z

BTW, whats the purpose of qcom,ebi2-nandc-bam-v1.5.0?

Making sure u-boot patches that DTS with partition information... That worked great!
Using append-ubi | qsdk-ipq-factory-nand is not going to work.

Initramfs in UBI (edited)

My next idea is to ubinize the initramfs image, and place that in a qsdk-ipq-factory-nand container:

	ARTIFACTS := web-ui-factory.fit
	ARTIFACT/web-ui-factory.fit := append-image initramfs-fit-uImage.itb | \
		ubinize-kernel | qsdk-ipq-factory-nand

We need to use ARTIFACTS := instead of IMAGES:= . IMAGES works only if the fit-uImage.itb is already built. On a clean build, there is no dependency to the initramfs. This is resolved by using ARTIFACTS.

robimarko · 2023-01-12T19:59:46Z

Closing for now as target is in OpenWrt PR stage so all new devices will go directly to OpenWrt after target is merged.

jmspswny · 2023-02-02T16:41:15Z

@mrnuke - are you still working on this / issuing a PR to the main openwrt repo?

mrnuke · 2023-02-02T16:42:15Z

@jmspswny I need to rebase my work and re-test it, yes.

jmspswny · 2023-02-02T16:46:23Z

@mrnuke - awesome. I'll leave it alone then. I'm happy to help with testing if you'd like

mrnuke · 2023-02-06T04:41:01Z

@jmspswny, you may go ahead and give https://github.com/mrnuke/openwrt/tree/wax218-devel a try. It's got an annoying behavior where QCA-SSDK spams the kernel log with:

hsl_phy_phydev_get[773]:ERROR:phy_addr 0 phydev is NULL

but otherwise did not brick the box.

mrnuke · 2023-02-07T05:06:08Z

Upstream pull request here: openwrt#11959

robimarko force-pushed the ipq807x-5.15-pr branch from 5966775 to c803843 Compare June 11, 2022 18:44

robimarko force-pushed the ipq807x-5.15-pr branch 2 times, most recently from 8f4ad75 to 7c3bc98 Compare June 13, 2022 17:25

mrnuke force-pushed the ipq807x-wax218-netgear branch from e65af80 to 8dc0025 Compare June 16, 2022 02:34

robimarko force-pushed the ipq807x-5.15-pr branch 4 times, most recently from 6b0cd97 to a0757f6 Compare June 27, 2022 09:44

robimarko force-pushed the ipq807x-5.15-pr branch 2 times, most recently from 9dcef25 to 8379551 Compare June 29, 2022 21:23

mrnuke force-pushed the ipq807x-wax218-netgear branch from 2a19896 to ff6e803 Compare July 4, 2022 23:45

robimarko force-pushed the ipq807x-5.15-pr branch from 8379551 to 7298666 Compare July 8, 2022 11:36

robimarko force-pushed the ipq807x-5.15-pr branch 9 times, most recently from 2f7a3cc to 4203028 Compare December 28, 2022 22:28

robimarko force-pushed the ipq807x-5.15-pr branch 10 times, most recently from 71addb3 to ef42fc4 Compare January 8, 2023 13:16

robimarko force-pushed the ipq807x-5.15-pr branch 4 times, most recently from 8a5c790 to 8d1fb7d Compare January 12, 2023 13:48

robimarko closed this Jan 12, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ipq807x: Add support for Netgear WAX218 #47

ipq807x: Add support for Netgear WAX218 #47

mrnuke commented Jun 11, 2022 •

edited

Loading

robimarko commented Jun 11, 2022

mrnuke commented Jun 14, 2022

kirdesde commented Jun 14, 2022 •

edited

Loading

mrnuke commented Jun 15, 2022

mrnuke commented Jul 4, 2022 •

edited

Loading

kirdesde commented Jul 5, 2022

My observations:

mrnuke commented Jul 5, 2022

kirdesde commented Jul 5, 2022

mrnuke commented Jul 5, 2022

robimarko commented Jul 5, 2022

mrnuke commented Jul 5, 2022

robimarko commented Jul 5, 2022 •

edited

Loading

mrnuke commented Jul 5, 2022

robimarko commented Jul 5, 2022

mrnuke commented Jul 8, 2022

mrnuke commented Jul 8, 2022

robimarko commented Jul 8, 2022

mrnuke commented Jul 8, 2022 •

edited

Loading

robimarko commented Jan 12, 2023

jmspswny commented Feb 2, 2023

mrnuke commented Feb 2, 2023

jmspswny commented Feb 2, 2023

mrnuke commented Feb 6, 2023

mrnuke commented Feb 7, 2023

ipq807x: Add support for Netgear WAX218 #47

ipq807x: Add support for Netgear WAX218 #47

Conversation

mrnuke commented Jun 11, 2022 • edited Loading

ipq807x: add support for Netgear WAX218

Specifications:

Not (yet) implemented:

Installation:

Web UI method

SSH method

Funny message before I realized I could unlock FW via serial console

robimarko commented Jun 11, 2022

mrnuke commented Jun 14, 2022

kirdesde commented Jun 14, 2022 • edited Loading

mrnuke commented Jun 15, 2022

mrnuke commented Jul 4, 2022 • edited Loading

My observations:

kirdesde commented Jul 5, 2022

My observations:

mrnuke commented Jul 5, 2022

kirdesde commented Jul 5, 2022

mrnuke commented Jul 5, 2022

robimarko commented Jul 5, 2022

mrnuke commented Jul 5, 2022

robimarko commented Jul 5, 2022 • edited Loading

mrnuke commented Jul 5, 2022

robimarko commented Jul 5, 2022

mrnuke commented Jul 8, 2022

mrnuke commented Jul 8, 2022

robimarko commented Jul 8, 2022

mrnuke commented Jul 8, 2022 • edited Loading

Initramfs in UBI (edited)

robimarko commented Jan 12, 2023

jmspswny commented Feb 2, 2023

mrnuke commented Feb 2, 2023

jmspswny commented Feb 2, 2023

mrnuke commented Feb 6, 2023

mrnuke commented Feb 7, 2023

mrnuke commented Jun 11, 2022 •

edited

Loading

kirdesde commented Jun 14, 2022 •

edited

Loading

mrnuke commented Jul 4, 2022 •

edited

Loading

robimarko commented Jul 5, 2022 •

edited

Loading

mrnuke commented Jul 8, 2022 •

edited

Loading