ramips: add support for Buffalo WSR-2533DHPLS

Buffalo WSR-2533DHPLS is a 2.4/5 GHz band 11ac router, based on MediaTek
MT7621A.

Very similar to Buffalo WSR-2533DHPL, but with NAND, different GPIO
and TRX partitions.

Specification:

- SoC           : MediaTek MT7621AT
- RAM           : DDR3 256 MiB (Samsung K4B2G1646F-BYMA)
- Flash         : RAW-NAND 128 MiB
                  (Winbond W29N01HV or KIOXIA TC58BVG0S3HTAI0)
- WLAN          : 2.4/5 GHz (2x MediaTek MT7615N)
- Ethernet      : 10/100/1000 Mbps
  - Switch      : MediaTek MT7530 (SoC) 4 ports
- LED/keys      : 8x/6x (2x buttons, 1x slide-switch)
- UART          : through-hole on PCB (J4)
  - arrangement : 3.3V, GND, TX, RX from triangle-mark
  - settings    : 115200n8
- Power         : 12VDC 1.5A

Flash instruction using factory.bin image:

1. boot WSR-2533DHPLS normally with "Router" mode
2. access to the WebI ("http://192.168.11.1/") on the device and open
   firmware update page
   ("管理" -> "ファームウェア更新")
3. select the OpenWrt factory.bin image and click update ("更新実行")
   button
   Attention: do not use "factory-uboot.bin" image
4. Wait ~120 seconds to complete flashing

Flash instruction using initramfs image:

1. prepare the TFTP server with the initramfs image renamed to
   "linux.trx-recovery" and IP address "192.168.11.2"
2. press the "AOSS" button while powering on the WSR-2533DHPLS
3. after 10 seconds, release the "AOSS" button, WSR-2533DHPLS downloads
   the initramfs image and boot with it automatically
4. on the initramfs image, download the factory-uboot.bin image to the
   device and perform sysupgrade with it and "-F" option
5. wait ~120 seconds to complete flashing

Notes:

- The embedded addresses in eeprom data in Factory partition have
  Buffalo's OUI, but they don't match with the actual addresses
  assigned to wlan devices. So fixup addresses by the user-space
  script.

  root@localhost:/# hexdump -C /dev/mtdblock3 | grep "^0000[08]000\s"
  00000000  15 76 a0 00 88 57 ee bc  01 a8 15 76 c3 14 00 80  |.v...W.....v....|
  00008000  15 76 a0 00 88 57 ee bc  01 f8 15 76 c3 14 00 80  |.v...W.....v....|

  See "MAC addresses" below for actual addresses.

- There are 2x factory*.bin images for different purposes.

  - factory.bin      : for flashing on OEM WebUI
  - factory-uboot.bin: for flashing on OEM bootloader or initramfs image

  factory-uboot.bin is useful for recoverying the device, or refreshing
  when the kernel partition is expanded in the future. sysupgrade on
  this device accepts factory-uboot.bin with option "-F", but on that
  situation, user configurations won't be kept, so it's not for normal
  use.

MAC addresses:

LAN    : 90:96:F3:xx:xx:30 (board_data, "mac" (text))
WAN    : 90:96:F3:xx:xx:30 (board_data, "mac" (text))
2.4 GHz: 90:96:F3:xx:xx:31
5 GHz  : 90:96:F3:xx:xx:38

[original work]
Signed-off-by: Audun-Marius Gangstø <audun@gangsto.org>
[convert to ubi, fix/improve DT, add sysupgrade support]
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>

8 files changed, 448 insertions, 2 deletions

diff --git a/target/linux/ramips/dts/mt7621_buffalo_wsr-2533dhpls.dts b/target/linux/ramips/dts/mt7621_buffalo_wsr-2533dhpls.dts
new file mode 100644
index 0000000000..9ed94cf7b2
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_buffalo_wsr-2533dhpls.dts
@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621_buffalo_wsr-2533dhplx.dtsi"
+
+/ {
+	compatible = "buffalo,wsr-2533dhpls", "mediatek,mt7621-soc";
+	model = "Buffalo WSR-2533DHPLS";
+
+	chosen {
+		bootargs = "console=ttyS0,115200n8 ubi.block=0,rootfs root=/dev/ubiblock0_0";
+	};
+};
+
+&nand {
+	status = "okay";
+
+	mediatek,nmbm;
+	/*
+	 * -  u-boot - (kernel (6MiB, in "firmware"))
+	 * - Kernel2 - WTB
+	 */
+	mediatek,bmt-remap-range = <0x0 0x780000>,
+				   <0x1980000 0x5b00000>;
+};
+
+&partitions {
+	partition@100000 {
+		label = "factory";
+		reg = <0x100000 0x80000>;
+		read-only;
+
+		nvmem-layout {
+			compatible = "fixed-layout";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			eeprom_factory_0: eeprom@0 {
+				reg = <0x0 0x4da8>;
+			};
+
+			eeprom_factory_8000: eeprom@8000 {
+				reg = <0x8000 0x4da8>;
+			};
+		};
+	};
+
+	partition@180000 {
+		compatible = "brcm,trx";
+		brcm,trx-magic = <0x534c4844>;
+		label = "firmware";
+		reg = <0x180000 0x1800000>;
+	};
+
+	partition@1980000 {
+		label = "Kernel2";
+		reg = <0x1980000 0x1800000>;
+	};
+
+	partition@3180000 {
+		label = "glbcfg";
+		reg = <0x3180000 0x200000>;
+		read-only;
+	};
+
+	partition@3380000 {
+		label = "board_data";
+		reg = <0x3380000 0x200000>;
+		read-only;
+	};
+
+	partition@3580000 {
+		label = "debug_log";
+		reg = <0x3580000 0x900000>;
+		read-only;
+	};
+
+	partition@3e80000 {
+		label = "WTB";
+		reg = <0x3e80000 0x3600000>;
+		read-only;
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_buffalo_wsr-2533dhplx.dtsi b/target/linux/ramips/dts/mt7621_buffalo_wsr-2533dhplx.dtsi
new file mode 100644
index 0000000000..33d23d4675
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_buffalo_wsr-2533dhplx.dtsi
@@ -0,0 +1,175 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_amber;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_green;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_AMBER>;
+			function = "router";
+		};
+
+		led-1 {
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_WLAN;
+		};
+
+		led-2 {
+			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_WAN_ONLINE;
+		};
+
+		led-3 {
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WAN_ONLINE;
+		};
+
+		led_power_green: led-4 {
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led_power_amber: led-5 {
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led-6 {
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+		};
+
+		led-7 {
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = "router";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		button-aoss {
+			label = "aoss";
+			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		switch-router {
+			label = "router";
+			gpios = <&gpio 7 GPIO_ACTIVE_HIGH>;
+			linux,code = <BTN_0>;
+			linux,input-type = <EV_SW>;
+		};
+	};
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy0>;
+};
+
+&ethphy0 {
+	/delete-property/ interrupts;
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan3";
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	partitions: partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <0x01>;
+
+		partition@0 {
+			label = "u-boot";
+			reg = <0x00 0x80000>;
+			read-only;
+		};
+
+		partition@80000 {
+			label = "u-boot-env";
+			reg = <0x80000 0x80000>;
+			read-only;
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&eeprom_factory_0>;
+		nvmem-cell-names = "eeprom";
+		ieee80211-freq-limit = <2400000 2500000>;
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&eeprom_factory_8000>;
+		nvmem-cell-names = "eeprom";
+		ieee80211-freq-limit = <5000000 6000000>;
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "uart2", "uart3";
+		function = "gpio";
+	};
+};
+
+&xhci {
+	status = "disabled";
+};
diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk
index 0643cd29f4..904fd11b1a 100644
--- a/target/linux/ramips/image/mt7621.mk
+++ b/target/linux/ramips/image/mt7621.mk
@@ -7,7 +7,13 @@ include ./common-tp-link.mk
 
 DEFAULT_SOC := mt7621
 
-DEVICE_VARS += ELECOM_HWNAME LINKSYS_HWNAME DLINK_HWID
+DEVICE_VARS += BUFFALO_TRX_MAGIC ELECOM_HWNAME LINKSYS_HWNAME DLINK_HWID
+
+define Image/Prepare
+	# For UBI we want only one extra block
+	rm -f $(KDIR)/ubi_mark
+	echo -ne '\xde\xad\xc0\xde' > $(KDIR)/ubi_mark
+endef
 
 define Build/append-dlink-covr-metadata
 	echo -ne '{"supported_devices": "$(1)", "firmware": "' > $@metadata.tmp
@@ -533,6 +539,38 @@ define Device/buffalo_wsr-2533dhpl
 endef
 TARGET_DEVICES += buffalo_wsr-2533dhpl
 
+define Device/buffalo_wsr-2533dhplx
+  $(Device/dsa-migration)
+  DEVICE_VENDOR := Buffalo
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
+  BUFFALO_TAG_PLATFORM := MTK
+  BUFFALO_TAG_VERSION := 9.99
+  BUFFALO_TAG_MINOR := 9.99
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  UBINIZE_OPTS := -E 5
+  KERNEL_SIZE := 6144k
+  IMAGES += factory.bin factory-uboot.bin
+  IMAGE/factory.bin = append-ubi | \
+	buffalo-trx $$$$(BUFFALO_TRX_MAGIC) $$$$@ $(KDIR)/ubi_mark |\
+	buffalo-enc $$(DEVICE_MODEL) 9.99 -l | \
+	buffalo-tag-dhp $$(DEVICE_MODEL) JP JP | buffalo-enc-tag -l | \
+	buffalo-dhp-image
+  IMAGE/factory-uboot.bin := append-ubi | \
+	buffalo-trx $$$$(BUFFALO_TRX_MAGIC) $$$$@ $(KDIR)/ubi_mark | append-metadata
+  IMAGE/sysupgrade.bin := \
+	buffalo-trx $$$$(BUFFALO_TRX_MAGIC) $(KDIR)/tmp/$$(DEVICE_NAME).null | \
+	sysupgrade-tar kernel=$$$$@ | append-metadata
+endef
+
+define Device/buffalo_wsr-2533dhpls
+  $(Device/buffalo_wsr-2533dhplx)
+  DEVICE_MODEL := WSR-2533DHPLS
+  BUFFALO_TRX_MAGIC := 0x534c4844
+  IMAGE_SIZE := 24576k
+endef
+TARGET_DEVICES += buffalo_wsr-2533dhpls
+
 define Device/buffalo_wsr-600dhp
   $(Device/dsa-migration)
   $(Device/uimage-lzma-loader)
diff --git a/target/linux/ramips/mt7621/base-files/etc/board.d/02_network b/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
index ea479ddd38..71a342f8f4 100644
--- a/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
+++ b/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
@@ -11,6 +11,7 @@ ramips_setup_interfaces()
 	alfa-network,ax1800rm|\
 	ampedwireless,ally-r1900k|\
 	asus,rt-ax53u|\
+	buffalo,wsr-2533dhpls|\
 	gehua,ghl-r-001|\
 	h3c,tx1800-plus|\
 	h3c,tx1801-plus|\
@@ -215,7 +216,8 @@ ramips_setup_macs()
 		label_mac=$(macaddr_add "$wan_mac" 3)
 		lan_mac=$label_mac
 		;;
-	buffalo,wsr-1166dhp)
+	buffalo,wsr-1166dhp|\
+	buffalo,wsr-2533dhpls)
 		wan_mac=$(mtd_get_mac_ascii board_data "mac")
 		lan_mac=$wan_mac
 		label_mac=$wan_mac
diff --git a/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac b/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
index 0ec46bb0ea..9350d67466 100644
--- a/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
+++ b/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
@@ -27,6 +27,13 @@ case "$board" in
 		hw_mac_addr=$(macaddr_unsetbit $hw_mac_addr 28)
 		[ "$PHYNBR" = "1" ] && macaddr_setbit_la $hw_mac_addr > /sys${DEVPATH}/macaddress
 		;;
+	buffalo,wsr-2533dhpls)
+		lan_mac_addr=$(mtd_get_mac_ascii board_data "mac")
+		[ "$PHYNBR" = "0" ] && \
+			macaddr_add $lan_mac_addr 1 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && \
+			macaddr_add $lan_mac_addr 8 > /sys${DEVPATH}/macaddress
+		;;
 	comfast,cf-e390ax)
 		[ "$PHYNBR" = "0" ] && echo -n "$(mtd_get_mac_binary factory 0x0004)" > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "1" ] && echo -n "$(mtd_get_mac_binary factory 0x8004)" > /sys${DEVPATH}/macaddress
diff --git a/target/linux/ramips/mt7621/base-files/etc/uci-defaults/09_fix_crc b/target/linux/ramips/mt7621/base-files/etc/uci-defaults/09_fix_crc
new file mode 100644
index 0000000000..89889bc1c2
--- /dev/null
+++ b/target/linux/ramips/mt7621/base-files/etc/uci-defaults/09_fix_crc
@@ -0,0 +1,19 @@
+. /lib/functions.sh
+
+# don't modify FW data when booting with initramfs image
+fstype="$(/bin/mount | awk '($3 ~ /^\/$/) && ($5 !~ /rootfs/) { print $5 }')"
+[ "$fstype" = "tmpfs" ] && \
+	exit 0
+
+fixup_trx_crc() {
+	local trx_magic="$1"
+	local kernel_size=$(sed -n 's/mtd[0-9]*: \([0-9a-f]*\).*"\(kernel\|linux\)".*/\1/p' /proc/mtd)
+
+	mtd -M $trx_magic ${kernel_size:+-c 0x$kernel_size} fixtrx firmware
+}
+
+case "$(board_name)" in
+buffalo,wsr-2533dhpls)
+	fixup_trx_crc 0x44484C53
+	;;
+esac
diff --git a/target/linux/ramips/mt7621/base-files/lib/upgrade/buffalo.sh b/target/linux/ramips/mt7621/base-files/lib/upgrade/buffalo.sh
new file mode 100644
index 0000000000..8040d4c768
--- /dev/null
+++ b/target/linux/ramips/mt7621/base-files/lib/upgrade/buffalo.sh
@@ -0,0 +1,109 @@
+# The mtd partitions "firmware" and "Kernel2" on NAND flash are os-image
+# partitions. These partitions are called as "Image1/Image2" in U-Boot
+# on WSR-2533DHPLx devices, and they are checked conditions when booting.
+# "Image1" is always used for booting.
+#
+# == U-Boot Behaviors ==
+#
+# - "Image1"/"Image2" images are good, images are different or
+#   "Image2" image is broken
+#   -> copy os-image to "Image2" from "Image1"
+#
+# - "Image1" image is broken
+#   -> copy os-image to "Image1" from "Image2"
+#
+# - "Image1"/"Image2" images are broken
+#   -> fall to U-Boot command line
+
+# TRX magic numbers of each model
+case "$(board_name)" in
+buffalo,wsr-2533dhpls)
+	BUFFALO_TRX_MAGIC="44484c53" # "DHLS"
+	;;
+esac
+
+buffalo_check_image() {
+	local board="$1"
+	local boardname="$(echo $board | tr ',' '_')"
+	local magic="$2"
+	local fw_image="$3"
+
+	# return error state if TRX + UBI formatted image specified
+	# to notify about configurations
+	if [ "$magic" = "$BUFFALO_TRX_MAGIC" ]; then
+		echo "Your configurations won't be saved if factory-uboot.bin image specified."
+		echo "But if you want to upgrade, please execute sysupgrade with \"-F\" option."
+		return 1
+	fi
+
+	# check if valid tar file specifed
+	if ! tar tf "$fw_image" &>/dev/null; then
+		echo "Specified file is not a tar archive: $fw_image"
+		return 1
+	fi
+
+	local control_len=$( (tar xf $fw_image sysupgrade-$boardname/CONTROL -O | wc -c) 2> /dev/null)
+
+	# check if valid sysupgrade tar archive
+	if [ "$control_len" = "0" ]; then
+		echo "Invalid sysupgrade file: $fw_image"
+		return 1
+	fi
+
+	local kern_part_len=$(grep "\"linux\"" /proc/mtd | sed "s/mtd[0-9]*:[ \t]*\([^ \t]*\).*/\1/")
+	[ -z "$kern_part_len" ] && {
+		echo "Unable to get \"linux\" partition size"
+		return 1
+	}
+	kern_part_len=$((0x$kern_part_len))
+
+	# this also checks if the sysupgrade image is for correct models
+	local kern_bin_len=$( (tar xf $fw_image sysupgrade-${boardname}/kernel -O | wc -c) 2> /dev/null)
+	if [ -z "$kern_bin_len" ]; then
+		echo "Failed to get new kernel size, is valid sysupgrade image specified for the device?"
+		return 1
+	fi
+
+	# kernel binary has a trx header (len: 28 (0x1c))
+	kern_bin_len=$((kern_bin_len - 28))
+
+	if [ "$kern_bin_len" != "$kern_part_len" ]; then
+		echo -n "The length of new kernel is invalid for current "
+		echo "\"linux\" partition, please use factory-uboot.bin image."
+		echo "\"linux\" partition: $kern_part_len, new kernel: $kern_bin_len"
+		return 1
+	fi
+}
+
+# for TRX + UBI formatted image
+buffalo_upgrade_ubinized() {
+	sync
+	echo 3 > /proc/sys/vm/drop_caches
+
+	local mtdnum="$( find_mtd_index "ubi" )"
+	# if no "ubi", don't return error for the purpose of recovery
+	# ex: recovery after accidental erasing "firmware" partition
+	if [ ! "$mtdnum" ]; then
+		echo "cannot find ubi mtd partition \"ubi\", skip detachment"
+	else
+		ubidetach -m "$mtdnum"
+	fi
+
+	# erase all data in "firmware"
+	mtd erase "${PART_NAME}"
+	# write TRX + UBI formatted image to "firmware"
+	get_image "$1" | mtd $MTD_ARGS write - "${PART_NAME:-firmware}"
+	if [ $? -ne 0 ]; then
+		echo "Failed to write the specified image."
+		exit 1
+	fi
+}
+
+buffalo_do_upgrade() {
+	if [ "$(get_magic_long "$1")" = "$BUFFALO_TRX_MAGIC" ]; then
+		buffalo_upgrade_ubinized "$1"
+	else
+		CI_KERNPART="firmware"
+		nand_do_upgrade "$1"
+	fi
+}
diff --git a/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh b/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh
index 46ca89e991..82eda0bf2f 100755
--- a/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh
@@ -9,6 +9,17 @@ RAMFS_COPY_BIN='fw_printenv fw_setenv'
 RAMFS_COPY_DATA='/etc/fw_env.config /var/lock/fw_printenv.lock'
 
 platform_check_image() {
+	local board=$(board_name)
+	local magic="$(get_magic_long "$1")"
+
+	[ "$#" -gt 1 ] && return 1
+
+	case "$board" in
+	buffalo,wsr-2533dhpls)
+		buffalo_check_image "$board" "$magic" "$1" || return 1
+		;;
+	esac
+
 	return 0
 }
 
@@ -132,6 +143,9 @@ platform_do_upgrade() {
 	zyxel,nwa55axe)
 		nand_do_upgrade "$1"
 		;;
+	buffalo,wsr-2533dhpls)
+		buffalo_do_upgrade "$1"
+		;;
 	elecom,wrc-x1800gs)
 		[ "$(fw_printenv -n bootmenu_delay)" != "0" ] || \
 			fw_setenv bootmenu_delay 3