ipq40xx: add support for Cisco Meraki MR30H

This commit adds support for the Cisco Meraki MR30H. The MR30H is a POE
powered 802.11ac access point with an integrated 5 port Gigabit switch.

MR30H hardware info:
* CPU: Qualcomm IPQ4029
* RAM: 256MB DDR3
* Storage: 128 MB (S34ML01G200TFV00)
* Networking: QCA8075 internal switch (5x 1GbE ports)
* WiFi: QCA4019 802.11b/g/n/ac, QCA9889 802.11/b/g/n/ac scanning radio
* Serial: Internal header (J8, 2.54mm, populated)

LAN5 (rear) is for POE input. LAN4 has POE output (802.3af) when powered
by an 802.3at source.

The LAN4 port is used for tftp booting in U-Boot.

This device does not have secure boot, but cannot be flashed without
external programmers (TSOP48 NAND) as Meraki disabled interrupting U-Boot
for any device that updated after ~2017.

Disassembly:

* Remove the two T10 screws on the rear of the AP.

* Using a guitar pick or similar plastic tool, insert it on the side between
the grey metal plate and the white plastic body and pry up gently.
    * The rubberised border on the metal plate does not need to be removed.

* The metal back plate has several latches around the perimeter (but none on
the bottom by the Ethernet ports).

* Once you have removed the metal back plate, push up gently on the bottom
Ethernet ports while pulling gently on the rear-mounted Ethernet port to remove
the PCB.

* The PCB should come free from the plastic housing, pull the bottom
(4 Ethernet ports) up as if you are opening a book.
    * If done carefully, there is no need to remove the WiFi antenna connectors
    to access the NAND flash.

* The TSOP48 NAND flash (U30, Spansion S34ML01G200TFV00) is located on the
opposite side of the PCB.

* To flash, you need to desolder the TSOP48 or use a 360 clip.

Installation:

The dumps to flash can be found in this repository:
https://github.com/halmartin/meraki-openwrt-docs/tree/main/mr30h

The device has the following flash layout (offsets with OOB data):
```
0x000000000000-0x000000100000 : "sbl1"
0x000000100000-0x000000200000 : "mibib"
0x000000200000-0x000000300000 : "bootconfig"
0x000000300000-0x000000400000 : "qsee"
0x000000400000-0x000000500000 : "qsee_alt"
0x000000500000-0x000000580000 : "cdt"
0x000000580000-0x000000600000 : "cdt_alt"
0x000000600000-0x000000680000 : "ddrparams"
0x000000700000-0x000000900000 : "u-boot"
0x000000900000-0x000000b00000 : "u-boot-backup"
0x000000b00000-0x000000b80000 : "ART"
0x000000c00000-0x000007c00000 : "ubi"
```

* Dump your original NAND (if using nanddump, include OOB data).

* Decompress `u-boot.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `u-boot` portion of NAND from
`0x738000`-`0x948000` (length `0x210000`). Offsets here include OOB data.

* Resolder the NAND after overwriting the `u-boot` regions.

OpenWrt Installation:

* After flashing NAND with the external programmer. Plug an Ethernet
cable into port 4. Power up the device.

* The new U-Boot build uses the space character `" "` (without quotes) to
interrupt boot.

* Interrupt U-Boot and `tftpboot` the OpenWrt initramfs image from your
tftp server
```
dhcp
setenv serverip <your_tftp>
tftpboot openwrt-ipq40xx-generic-meraki_mr30h-initramfs-uImage.itb
```

* Once booted into the OpenWrt initramfs, `scp` the `sysupgrade` image to
the device and run the normal `sysupgrade` procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin [email protected]:/tmp/
ssh [email protected] "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin"
```

* OpenWrt should now be installed on the device.

Alternative installation steps if your device has U-Boot older than:
`U-Boot 2017.07-RELEASE-g78ed34f31579 (Sep 29 2017 - 07:43:44 -0700)`

**BIG FAT WARNING BEGIN**

Attmping to interrupt boot on a newer U-Boot release may permanently
brick your device! See: riptidewave93/LEDE-MR33#13

**BIG FAT WARNING END**

* Use `ubootwrite.py` from the above GitHub repository to transfer the
`u-boot.itb`
image to the router.
```
./ubootwrite.py --serial=/dev/ttyUSB0 --write u-boot.itb
```

* To avoid bricking your router, it is highly recommended at this point that
you flash the unlocked U-Boot to the `part.safe` ubi volume.
```
run set_ubi && ubi write $loadaddr part.safe 0x2fd48
```

* Power cycle the router. The stock Meraki U-Boot will boot `part.safe` which
is now the unlocked U-Boot.

* Use the new U-Boot build (`" "` to interrupt boot) to
`tftpboot` the OpenWrt initramfs image:
```
dhcp
setenv serverip <tftp_server_addr>
tftpboot openwrt-ipq40xx-generic-meraki_mr30h-initramfs-uImage.itb
bootm
```

* It is only recommended to flash U-Boot to the `u-boot` NAND region from
Linux:
```
insmod mtd-rw i_want_a_brick=1
```

* Copy `u-boot.elf` to the router:
```
scp -O u-boot.elf [email protected]:/tmp/
```

Note: If any of the below commands fails, YOU WILL HAVE A BRICK IF YOU
REBOOT OR LOSE POWER. Only a hardware programmer can recover the device.
```
flash_erase /dev/mtd8 0 0
nandwrite -p /dev/mtd8 /tmp/u-boot.elf
```

Note: ONLY use `u-boot.elf` when flashing the `u-boot` region (`/dev/mtd8`);
`u-boot.bin` or `u-boot.itb` will BRICK YOUR DEVICE

* `scp` the `sysupgrade` image to the device and run the normal `sysupgrade`
procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin [email protected]:/tmp/
ssh [email protected] "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin"
```

* OpenWrt should now be installed on the device.

Signed-off-by: Hal Martin <[email protected]>
Link: https://github.com/openwrt/openwrt/pull/17026
Signed-off-by: Robert Marko <[email protected]>

package/firmware/ipq-wifi/Makefile

@@ -57,6 +57,7 @@ ALLWIFIBOARDS:= \
 	linksys_mx8500 \
 	linksys_spnmx56 \
 	linksys_whw03 \
+	meraki_mr30h \
 	meraki_z3 \
 	netgear_lbr20 \
 	netgear_rax120v2 \
@@ -231,6 +232,7 @@ $(eval $(call generate-ipq-wifi-package,linksys_mx5500,Linksys MX5500))
 $(eval $(call generate-ipq-wifi-package,linksys_mx8500,Linksys MX8500))
 $(eval $(call generate-ipq-wifi-package,linksys_spnmx56,Linksys SPNMX56))
 $(eval $(call generate-ipq-wifi-package,linksys_whw03,Linksys WHW03))
+$(eval $(call generate-ipq-wifi-package,meraki_mr30h,Meraki MR30H))
 $(eval $(call generate-ipq-wifi-package,meraki_z3,Meraki Z3))
 $(eval $(call generate-ipq-wifi-package,netgear_lbr20,Netgear LBR20))
 $(eval $(call generate-ipq-wifi-package,netgear_rax120v2,Netgear RAX120v2))

target/linux/ipq40xx/base-files/etc/board.d/01_leds

@@ -109,6 +109,16 @@ meraki,z3)
 	ucidef_set_led_netdev "lan4_link" "LAN5 (link)" "green:lan-8" "lan5" "link"
 	ucidef_set_led_netdev "lan4_act" "LAN5 (txrx)" "green:lan-9" "lan5" "tx rx"
 	;;
+meraki,mr30h)
+	ucidef_set_led_netdev "lan1_link" "LAN1 (link)" "green:lan-0" "lan1" "link"
+	ucidef_set_led_netdev "lan1_act" "LAN1 (txrx)" "amber:lan-1" "lan1" "tx rx"
+	ucidef_set_led_netdev "lan2_link" "LAN2 (link)" "green:lan-2" "lan2" "link"
+	ucidef_set_led_netdev "lan2_act" "LAN2 (txrx)" "amber:lan-3" "lan2" "tx rx"
+	ucidef_set_led_netdev "lan3_link" "LAN3 (link)" "green:lan-4" "lan3" "link"
+	ucidef_set_led_netdev "lan3_act" "LAN3 (txrx)" "amber:lan-5" "lan3" "tx rx"
+	ucidef_set_led_netdev "lan4_link" "LAN4 (link)" "green:lan-6" "lan4" "link"
+	ucidef_set_led_netdev "lan4_act" "LAN4 (txrx)" "amber:lan-7" "lan4" "tx rx"
+	;;
 netgear,ex6100v2 |\
 netgear,ex6150v2)
 	ucidef_set_led_wlan "wlan2g" "WLAN2G" "green:router" "phy0tpt"

target/linux/ipq40xx/base-files/etc/board.d/02_network

@@ -138,6 +138,9 @@ ipq40xx_setup_interfaces()
 		ucidef_set_interface_lan "lan1 lan2"
 		ucidef_set_interface "wan" device "/dev/cdc-wdm0" protocol "qmi"
 		;;
+	meraki,mr30h)
+		ucidef_set_interface_lan "lan1 lan2 lan3 lan4 lan5"
+		;;
 	*)
 		echo "Unsupported hardware. Network interfaces not initialized"
 		;;

target/linux/ipq40xx/base-files/lib/upgrade/platform.sh

@@ -178,6 +178,7 @@ platform_do_upgrade() {
 	linksys,whw03)
 		platform_do_upgrade_linksys_emmc "$1"
 		;;
+	meraki,mr30h |\
 	meraki,mr33 |\
 	meraki,mr74)
 		CI_KERNPART="part.safe"

target/linux/ipq40xx/files-6.12/arch/arm/boot/dts/qcom/qcom-ipq4029-mr30h.dts

@@ -0,0 +1,155 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Device Tree Source for Meraki MR30H (Noisy Cricket)
+
+#include "qcom-ipq4029-wired-qca-common.dtsi"
+
+/ {
+	model = "Meraki MR30H";
+	compatible = "meraki,mr30h";
+
+	soc {
+		/* for USB PHY, device has no USB port */
+		tcsr@194b000 {
+			status = "disabled";
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		power_orange: power {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&tlmm 49 GPIO_ACTIVE_LOW>;
+			panic-indicator;
+		};
+
+		led-0 {
+			/* LAN 1 act */
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_ACTIVITY;
+			gpios = <&tlmm 33 GPIO_ACTIVE_LOW>;
+		};
+
+		led-1 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <1>;
+			gpios = <&tlmm 32 GPIO_ACTIVE_LOW>;
+		};
+
+		led-2 {
+			/* LAN 2 act */
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_ACTIVITY;
+			gpios = <&tlmm 27 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-3 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <2>;
+			gpios = <&tlmm 26 GPIO_ACTIVE_LOW>;
+		};
+
+		led-4 {
+			/* LAN 3 act */
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_ACTIVITY;
+			gpios = <&tlmm 25 GPIO_ACTIVE_LOW>;
+		};
+
+		led-5 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <3>;
+			gpios = <&tlmm 24 GPIO_ACTIVE_LOW>;
+		};
+
+		led-6 {
+			/* LAN 4 act */
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_ACTIVITY;
+			gpios = <&tlmm 23 GPIO_ACTIVE_LOW>;
+		};
+
+		led-7 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <4>;
+			gpios = <&tlmm 22 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&usb2_hs_phy {
+	status = "disabled";
+};
+
+&usb2 {
+	status = "disabled";
+};
+
+&usb3_hs_phy {
+	status = "disabled";
+};
+
+&usb3_ss_phy {
+	status = "disabled";
+};
+
+&usb3 {
+	status = "disabled";
+};
+
+&pcie0 {
+	status = "okay";
+	perst-gpio = <&tlmm 38 GPIO_ACTIVE_LOW>;
+	wake-gpio = <&tlmm 50 GPIO_ACTIVE_LOW>;
+};
+
+&pcie_bridge0 {
+	wifi2: wifi@0,0 {
+		compatible = "qcom,ath10k";
+		status = "okay";
+		reg = <0x00010000 0 0 0 0>;
+		nvmem-cells = <&cal_factory_9000>;
+		nvmem-cell-names = "calibration";
+	};
+};
+
+&wifi0 {
+	status = "okay";
+	qcom,ath10k-calibration-variant = "Meraki-MR30H";
+};
+
+&wifi1 {
+	status = "okay";
+	qcom,ath10k-calibration-variant = "Meraki-MR30H";
+};
+
+
+&swport1 {
+	label = "lan4";
+	status = "okay";
+};
+
+&swport2 {
+	label = "lan3";
+	status = "okay";
+};
+
+&swport3 {
+	label = "lan2";
+	status = "okay";
+};
+
+&swport4 {
+	label = "lan1";
+	status = "okay";
+};
+
+&swport5 {
+	label = "lan5";
+	status = "okay";
+};

target/linux/ipq40xx/image/generic.mk

@@ -798,6 +798,7 @@ define Device/meraki_mr30h
 	$(call Device/meraki_common)
 	DEVICE_MODEL := MR30H
 	DEVICE_DTS_CONFIG := config@2
+	DEVICE_PACKAGES += ipq-wifi-meraki_mr30h
 endef
 TARGET_DEVICES += meraki_mr30h