Adding Support for Qnap QMiro Plus 201W

For Developers
1

I'm looking for someone who can help me adding support for the Qmiro Plus, currently i was able to access the serial port (soldering required) and was able to boot a similar hardware recovery kernel ( GL.iNet GL-B2200 ), but thats all, i'm not expert in this kind oh hardware hacking but i like to learn :smiley:

Device Hardware:
CPU: IPQ4019
RAM: 512MB
Flash: eMMC 4GB
NET: QCA8075
WLAN: QCA9886

BootLog:

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00135
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Reset status Config, 0x00000010
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1339 - bootable_media_detect_entry, Start
B -      1679 - bootable_media_detect_success, Start
B -      1692 - elf_loader_entry, Start
B -      5069 - auth_hash_seg_entry, Start
B -      7214 - auth_hash_seg_exit, Start
B -    577910 - elf_segs_hash_verify_entry, Start
B -    695454 - PBL, End
B -    695478 - SBL1, Start
B -    789865 - pm_device_init, Start
D -         9 - pm_device_init, Delta
B -    791378 - boot_flash_init, Start
D -     52739 - boot_flash_init, Delta
B -    848241 - boot_config_data_table_init, Start
D -      3827 - boot_config_data_table_init, Delta - (419 Bytes)
B -    855448 - clock_init, Start
D -      7566 - clock_init, Delta
B -    867500 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:2,Subtype:1
B -    870912 - sbl1_ddr_set_params, Start
B -    876009 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    880391 - Pre_DDR_clock_init, Start
D -         4 - Pre_DDR_clock_init, Delta
D -     13175 - sbl1_ddr_set_params, Delta
B -    893703 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    964937 - sbl1_wait_for_ddr_training, Start
D -        27 - sbl1_wait_for_ddr_training, Delta
B -    981486 - Image Load, Start
D -    153385 - QSEE Image Loaded, Delta - (300072 Bytes)
B -   1135303 - Image Load, Start
D -      1441 - SEC Image Loaded, Delta - (2048 Bytes)
B -   1145595 - Image Load, Start
D -    219069 - APPSBL Image Loaded, Delta - (448544 Bytes)
B -   1365060 - QSEE Execution, Start
D -        60 - QSEE Execution, Delta
B -   1371282 - SBL1, End
D -    677883 - SBL1, Delta
S - Flash Throughput, 2009 KB/s  (751083 Bytes,  373702 us)
S - DDR Frequency, 672 MHz


U-Boot 2016.01 (Aug 31 2020 - 12:07:40 +0800)

DRAM:  smem ram ptable found: ver: 1 len: 3
512 MiB
NAND:  Could not find nand_gpio in dts, no defaults defined
SPI_ADDR_LEN=3
SF: Detected MX25L3205D with page size 256 Bytes, erase size 64 KiB, total 4 MiB
ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x400000
4 MiB
MMC:   <NULL>: 0
In:    serial@78af000
Out:   serial@78af000
Err:   serial@78af000
machid: 8010201
Hit any key to stop autoboot:  0 

MMC read: dev # 0, block # 34, count 32768 ... 32768 blocks read: OK
## Loading kernel from FIT Image at 84000000 ...
   Using 'config@ap.dk04.1-c3' configuration
   Trying 'kernel@1' kernel subimage
     Description:  ARM OpenWrt Linux-4.4.60
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x840000e4
     Data Size:    4922176 Bytes = 4.7 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x80208000
     Entry Point:  0x80208000
     Hash algo:    crc32
     Hash value:   841940e7
     Hash algo:    sha1
     Hash value:   c58f9f484877c062a7429cd58db622b94479d23a
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 84000000 ...
   Using 'config@ap.dk04.1-c3' configuration
   Trying 'fdt@ap.dk04.1-c3' fdt subimage
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x844b1d70
     Data Size:    28582 Bytes = 27.9 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   44d626d6
     Hash algo:    sha1
     Hash value:   ea9f5e5906a59070aaffc7fd377a4ef9e6ef8c4c
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x844b1d70
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 86ff6000, end 86ffffa5 ... OK
Using machid 0x8010201 from environment

Starting kernel ...

@P@S0#
2

https://openwrt.org/docs/guide-developer/add.new.device
https://openwrt.org/docs/guide-developer/adding_new_device

what part are you interested in ?
the NAS part should work OOTB, if you can get it installed, the router part needs to be added.

weird 2in1 combo

image
image1920×1068 121 KB

3

I'm trying to run OpenWRT on the Router Part, the NAS part works well.

Fun Fact, on the bootlog of the Official Firmware the Kernel description is:
ARM OpenWrt Linux-4.4.60

4

that's common, even for unsupportable devices.

5

anyway, i was testing GPIOS section in the doc, none of the leds powered on but looks than the gpio 428 is the NAS part power button :rofl:

6

currently blocked with the following error

FATAL ERROR: Couldn't open "/builder/build_dir/target-arm_cortex-a7+neon-vfpv4_musl_eabi/linux-ipq40xx_generic/linux-5.10.208/arch/arm/boot/dts/qcom-ipq4019-201w.dtb": No such file or directory

Any idea?

7

is old, what's the source for the build ?
vendor SDK ?

8

i'm working on branch 22.03 of the openwrt github repo

9

why ?

kernel version 5.10.208 seems to belong to a 22.03 snapshot (beta).

go for 23.05 stable, or the upcoming 24 release snapshots.
the device won't get supported on any older release anyway.

as for the file, you need to create it, it's part of the process of adding new hw.

10

I created the .dts file, even if I don't really understand how it works, for now I based mine on an already existing one. but i expect the .dtb to be an autogenerated file

11

is there any way to extract at least some info of the device tree from the official firmware?