IPQ4019: Adding support for TP-Link Deco M5

For Developers
1

Hi Developers !

I started to dig into my Deco M5 and now I want to add a full OpenWRT support.
Can someone helps me through that process ?

Especially : how to deal with the mtd partitions, especially with 1:HLOS and 1:rootfs

root@M5:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00030000 00010000 "0:SBL1"
mtd1: 00010000 00010000 "0:BOOTCONFIG"
mtd2: 00010000 00010000 "0:MIBIB"
mtd3: 00010000 00010000 "0:BOOTCONFIG1"
mtd4: 00060000 00010000 "0:QSEE"
mtd5: 00010000 00010000 "0:CDT"
mtd6: 00010000 00010000 "0:DDRPARAMS"
mtd7: 00010000 00010000 "0:APPSBLENV"
mtd8: 00080000 00010000 "0:APPSBL"
mtd9: 00010000 00010000 "0:ART"
mtd10: 000c0000 00010000 "OPAQUE"
mtd11: 00300000 00010000 "0:HLOS"
mtd12: 007d0000 00010000 "0:rootfs"
mtd13: 00080000 00010000 "0:APPSBL_1"
mtd14: 00400000 00010000 "1:HLOS"
mtd15: 00e70000 00010000 "1:rootfs"

I was able to add the Deco M5 device under the IPQ40XX terget in the make menuconfig menu.
Now I need a bit oh help for creating the DTS and add the related modules/files.

Kind regards.

1 Like
2

OK, Now I am struggling with wifi calibration data.
I built the wifi firmwares but I don't know how to integrate it to OpenWRT

Here is the process on the stock firmare :slight_smile:

root@M5:/# grep -r "caldata" /lib/*
conn-indicator: ERR: [util_get_mode] Failed to open /tmp/group-info: Resource temporarily unavailable
/lib/modules/3.14.43/adf.ko:%s[%d]: caldata data size mismatch, fsize=%d, cal_size=%d
/lib/modules/3.14.43/ath_hal.ko:/tmp/wifi0.caldata
/lib/modules/3.14.43/ath_hal.ko:/tmp/wifi1.caldata
/lib/modules/3.14.43/ath_hal.ko:/tmp/wifi2.caldata
/lib/modules/3.14.43/ath_hal.ko:/tmp/wifi0.caldata
/lib/modules/3.14.43/ath_hal.ko:/tmp/wifi1.caldata
/lib/modules/3.14.43/ath_hal.ko:/tmp/wifi2.caldata
/lib/modules/3.14.43/ath_hal.ko:is_valid_caldata
/lib/modules/3.14.43/umac.ko:wmi_unified_pdev_caldata_version_check_cmd
/lib/modules/3.14.43/umac.ko:ol_transfer_target_eeprom_caldata
/lib/modules/3.14.43/umac.ko:/tmp/wifi0.caldata
/lib/modules/3.14.43/umac.ko:/tmp/wifi1.caldata
/lib/modules/3.14.43/umac.ko:/tmp/wifi2.caldata
/lib/modules/3.14.43/umac.ko:%s %d: target eeprom caldata memory allocation failed
/lib/modules/3.14.43/umac.ko:%s: Target EEPROM caldata len %d doesn't equal to %d
/lib/modules/3.14.43/umac.ko:%s %d: Download Target EEPROM caldata len %d
/lib/modules/3.14.43/umac.ko:wmi_unified_pdev_caldata_version_check_cmd
/lib/modules/3.14.43/umac.ko:ol_transfer_target_eeprom_caldata
/lib/modules/3.14.43/umac.ko:wmi_unified_pdev_caldata_version_check_event_handler
/lib/preinit/81_load_wifi_board_bin:. /lib/read_caldata_to_fs.sh
/lib/read_caldata_to_fs.sh:                    dd if=${mtdblock} of=${apdk}/wifi0.caldata bs=32 count=377 skip=128
/lib/read_caldata_to_fs.sh:                    dd if=${mtdblock} of=${apdk}/wifi1.caldata bs=32 count=377 skip=640
/lib/read_caldata_to_fs.sh:                    dd if=${mtdblock} of=${apdk}/wifi0.caldata bs=32 count=377 skip=128
/lib/read_caldata_to_fs.sh:                    dd if=${mtdblock} of=${apdk}/wifi1.caldata bs=32 count=377 skip=640
/lib/read_caldata_to_fs.sh:                    dd if=${mtdblock} of=${apdk}/wifi2.caldata bs=32 count=377 skip=1152
3

I don't know anything about this device, but looking at different git commits for similar devices and partition schemes will be the best start for caldata, DTS etc.

E.g. using "git blame" to find the individual new device commits:


Hopefully all the hardware is already supported in the present kernel. If you haven't already done so, making a raw flash dump using a SOP16 clip before flashing the device or modifying the DTS partition scheme is a good idea, as even small typo's can lead to essential partitions being overwritten unintentionally.

1 Like
4

Do you think it is enough or do I have to dump with my CH314 ?

(IPQ40xx) # setenv serverip 192.168.0.20
(IPQ40xx) # sf probe 0
SF: Detected GD25Q256 with page size 4 KiB, total 32 MiB
sf read 0x84000000 0x0 0x2000000
tftpput 0x84000000 0x2000000 decoM5_v2_dump.bin

binwalk decoM5_v2_dump.bin

$ binwalk decoM5_v2_dump.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
19432         0x4BE8          Ubiquiti partition header, header size: 56 bytes, name: "PARTNUM_SHFT", base address: 0x08A16B46, data size: -1912995176 bytes
81400         0x13DF8         Unix path: /dev/icbcfg/boot
262460        0x4013C         YAFFS filesystem, little endian
263424        0x40500         ATAGs msm parition table (msmptbl), version: 4, number of paritions: 16
393216        0x60000         ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
618103        0x96E77         XML document, version: "1.0"
983040        0xF0000         ELF, 32-bit LSB shared object, ARM, version 1 (SYSV)
1336145       0x146351        Certificate in DER format (x509 v3), header length: 4, sequence length: 1284
1336261       0x1463C5        Certificate in DER format (x509 v3), header length: 4, sequence length: 1288
1402320       0x1565D0        CRC32 polynomial table, little endian
1404008       0x156C68        CRC32 polynomial table, little endian
2359296       0x240000        Flattened device tree, size: 3046892 bytes, version: 17
2359524       0x2400E4        gzip compressed data, maximum compression, has original file name: "Image", from Unix, last modified: 2018-08-16 10:12:23
4957968       0x4BA710        Flattened device tree, size: 36972 bytes, version: 17
4995220       0x4C3894        Flattened device tree, size: 37328 bytes, version: 17
5032828       0x4CCB7C        Flattened device tree, size: 37305 bytes, version: 17
5070416       0x4D5E50        Flattened device tree, size: 41920 bytes, version: 17
5112616       0x4E0328        Flattened device tree, size: 34223 bytes, version: 17
5147120       0x4E89F0        Flattened device tree, size: 34077 bytes, version: 17
5181480       0x4F1028        Flattened device tree, size: 34223 bytes, version: 17
5215984       0x4F96F0        Flattened device tree, size: 37360 bytes, version: 17
5253624       0x5029F8        Flattened device tree, size: 40954 bytes, version: 17
5294860       0x50CB0C        Flattened device tree, size: 37022 bytes, version: 17
5332164       0x515CC4        Flattened device tree, size: 34376 bytes, version: 17
5366820       0x51E424        Flattened device tree, size: 37425 bytes, version: 17
5505024       0x540000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 7860320 bytes, 1529 inodes, blocksize: 262144 bytes, created: 2018-08-16 10:13:22
13697024      0xD10000        ELF, 32-bit LSB shared object, ARM, version 1 (SYSV)
14050745      0xD665B9        Certificate in DER format (x509 v3), header length: 4, sequence length: 1284
14050861      0xD6662D        Certificate in DER format (x509 v3), header length: 4, sequence length: 1288
14117648      0xD76B10        CRC32 polynomial table, little endian
14119336      0xD771A8        CRC32 polynomial table, little endian
14221312      0xD90000        Flattened device tree, size: 3048968 bytes, version: 17
14221540      0xD900E4        gzip compressed data, maximum compression, has original file name: "Image", from Unix, last modified: 2020-10-22 10:32:25
16821124      0x100AB84       Flattened device tree, size: 37462 bytes, version: 17
16858868      0x1013EF4       Flattened device tree, size: 42054 bytes, version: 17
16901204      0x101E454       Flattened device tree, size: 37106 bytes, version: 17
16938592      0x1027660       Flattened device tree, size: 37360 bytes, version: 17
16976232      0x1030968       Flattened device tree, size: 37439 bytes, version: 17
17013952      0x1039CC0       Flattened device tree, size: 34223 bytes, version: 17
17048456      0x1042388       Flattened device tree, size: 34077 bytes, version: 17
17082816      0x104A9C0       Flattened device tree, size: 41088 bytes, version: 17
17124184      0x1054B58       Flattened device tree, size: 34223 bytes, version: 17
17158688      0x105D220       Flattened device tree, size: 37156 bytes, version: 17
17196124      0x106645C       Flattened device tree, size: 37559 bytes, version: 17
17233964      0x106F82C       Flattened device tree, size: 34376 bytes, version: 17
18415616      0x1190000       Squashfs filesystem, little endian, version 4.0, compression:xz, size: 11977376 bytes, 2007 inodes, blocksize: 524288 bytes, created: 2021-01-08 21:29:58
5 
 00_kernel                                        15_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx
'01_dtbdump_P@0M<`.dtb'                          '16_dtbdump_'$'\n''p@-.dtb'
'01_dtbdump_'$'\n''p@-.dtb'                       17_dtbdump_0p@-.dtb
 02_dtbdump_0p@-.dtb                             '18_dtbdump_ARM_OpenWrt_FIT_(Flattened_Image_Tree).dtb'
'03_dtbdump_\[uN3.dtb'                            19_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx
 04_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx   20_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx
 05_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx   21_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx
 06_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx   22_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx
 07_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx   23_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx
 08_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx   24_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx
 09_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx   25_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx
 10_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx   26_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx
 11_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx   27_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx
 12_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx   28_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx
 13_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx   29_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx
 14_dtbdump_Qualcomm_Technologies,_Inc._IPQ40xx   30_dtbdump.dtb

decom5/firmware/dtb$ dtc -I dtb -O dts 18_dtbdump_ARM_OpenWrt_FIT_\(Flattened_Image_Tree\).dtb
FATAL ERROR: EOF before reading 3048968 bytes of DT blob
6

That dump looks OK, just a good precaution from past experience:)

I suggest including "IPQ4019" in the thread title to get suggestions from people who have worked there before.

7

Thanks, I tried to change the topic title but unfortunately I cannot.

8

Changed it for you.

1 Like
9

OK, I can build successfully OpenWRT but I am unable to load the Wifi firmwares

All my changes are here :

https://github.com/openwrt/openwrt/compare/master...bdherouville:master

This is the error on OpenWRT 19.07 compared to the log for the oem openwrt (15.05)

[    8.224820] NET: Registered protocol family 24
[    8.997588] ath10k_ahb a000000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[    8.997643] ath10k_ahb a000000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[    9.010867] ath10k_ahb a000000.wifi: firmware ver 10.4-3.6-00140 api 5 features no-p2p,mfp,peer-flow-ctrl,btcoex-param,allows-mesh-bcast,no-ps crc32 ba79b746
[    9.031633] ath10k_ahb a000000.wifi: failed to fetch board data for bus=ahb,vendor=0000,device=0000,subsystem-vendor=0000,subsystem-device=0000,variant=TPL Deco M5 from ath10k/QCA4019/hw1.0/board-2.bin
[    9.094770] ath10k_ahb a000000.wifi: failed to fetch board-2.bin or board.bin from ath10k/QCA4019/hw1.0
[    9.094825] ath10k_ahb a000000.wifi: failed to fetch board file: -12
[    9.103620] ath10k_ahb a000000.wifi: could not probe fw (-12)
[    9.907192] ath10k_ahb a800000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[    9.907238] ath10k_ahb a800000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[    9.920423] ath10k_ahb a800000.wifi: firmware ver 10.4-3.6-00140 api 5 features no-p2p,mfp,peer-flow-ctrl,btcoex-param,allows-mesh-bcast,no-ps crc32 ba79b746
[    9.941222] ath10k_ahb a800000.wifi: failed to fetch board data for bus=ahb,vendor=0000,device=0000,subsystem-vendor=0000,subsystem-device=0000,variant=TPL Deco M5 from ath10k/QCA4019/hw1.0/board-2.bin
[   10.006578] ath10k_ahb a800000.wifi: failed to fetch board-2.bin or board.bin from ath10k/QCA4019/hw1.0
[   10.006624] ath10k_ahb a800000.wifi: failed to fetch board file: -12
[   10.015035] ath10k_ahb a800000.wifi: could not probe fw (-12)
[   10.072719] kmodloader: done loading kernel modules from /etc/modules.d/*
[   21.277325] br-lan: port 1(eth0) entered blocking state
[   21.277367] br-lan: port 1(eth0) entered disabled state
[   21.281933] device eth0 entered promiscuous mode
[   21.401755] ess_edma c080000.edma eth1: Link is Down
[   22.330129] br-lan: port 1(eth0) entered blocking state
[   22.330174] br-lan: port 1(eth0) entered forwarding state
[   22.334572] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
^CPlease press Enter to activate this console.

OEM Bootlog :

[   39.428205] ol_transfer_bin_file: flash data file defined
[   39.433795] ol_transfer_bin_file[3661] Get Caldata for wifi0.
[   39.439355] __adf_os_fs_read[42], Open File /tmp/wifi0.caldata SUCCESS!!
[   39.446235] file system magic:16914836 
[   39.449816] super blocksize:4096 
[   39.453269] inode 2511 
[   39.455539] file size:12064 
[   39.458498] qc98xx_verify_checksum: flash checksum passed: 0x94bc
[   39.464793] ol_transfer_bin_file 3722: Download Flash data len 12064
[   39.471289] Board extended Data download address: 0x0
[   39.497837] 
[   39.497837]  Board data initialized
[   39.501957] ol_ath_download_firmware: Download OTP, flash download ADDRESS 0xc0000
[   39.509338] 
[   39.509338]  Selecting  OTP binary for CHIP Version 0
[   39.557427] ath10k_ahb a000000.wifi: Firmware loaded from user helper succesfully
[   39.563987] ol_transfer_bin_file 3542: downloading file 0, Download data len 4424
[   39.592146] 
[   39.592146]  First OTP send param 8000
[   39.601193] ol_ath_download_firmware :First OTP download and Execute is good address:0x5000 return param 4660
[   39.611804] ol_ath_download_firmware:##Board Id 20 , CHIP Id 0
[   39.617601] ol_ath_download_firmware: BOARDDATA DOWNLOAD TO address 0xc0000
[   39.624363] __adf_os_fs_read[42], Open File /tmp/country SUCCESS!!
[   39.631752] file system magic:16914836 
[   39.634566] super blocksize:4096 
[   39.637866] inode 2738 
[   39.640298] file size:3 
[   39.643069] __adf_os_fs_read[55]: caldata data size mismatch, fsize=3, cal_size=2
[   39.650291] !!!!!!!!!!!!!country code is DE!!!!!!!!!!!!!!!
[   39.656063] __adf_os_fs_read[42], Open File /tmp/hardversion SUCCESS!!
[   39.662439] file system magic:16914836 
[   39.666069] super blocksize:4096 
[   39.669366] inode 2739 
[   39.672064] file size:4 
[   39.674340] keep hardversion as 1 unchanged
 wifi0: Selecting board data file name boardData_1_0_IPQ4019_DK04_2G.bin
[   39.685944] ol_transfer_bin_file: Board Data File download to address=0xc0000 file name=IPQ4019/hw.1/boardData_1_0_IPQ4019_DK04_2G.bin
[   39.697366] ath10k_ahb a000000.wifi: Firmware loaded from user helper succesfully
[   39.705205] ol_transfer_bin_file 3542: downloading file 3, Download data len 12064
[   39.712466] Board extended Data download address: 0x0
[   39.742152] ol_ath_download_firmware: Using 0x1234 for the remainder of init
[   39.748182] 
[   39.748182]  Selecting  OTP binary for CHIP Version 0
[   39.761418] ath10k_ahb a000000.wifi: Firmware loaded from user helper succesfully
[   39.767977] ol_transfer_bin_file 3542: downloading file 0, Download data len 4424
[   39.796031] 
[   39.796031]  [Flash] : Ignore Module param
[   39.800595] 
[   39.800595]  Second otp download Param 10000 
[   39.816984] ol_ath_download_firmware : Second OTP download and Execute is good, param=0x0 
[   39.824325] 
[   39.824325]  Mission mode: Firmware CHIP Version 0
[   40.682851] ath10k_ahb a000000.wifi: Firmware loaded from user helper succesfully
[   40.689573] ol_swap_seg_alloc: Successfully allocated memory for SWAP size=262144 
[   40.697427] ath10k_ahb a000000.wifi: Firmware loaded from user helper succesfully
[   40.704615] Swap: bytes_left to copy: fw:16; dma_page:110657
[   40.709967] Swap: wrong length read:0
[   40.713654] ol_swap_wlan_memory_expansion: Swap total_bytes copied: 151487 Target address 417220 
[   40.722732] scn=cc2404c0  target_write_addr=417220 seg_info=cc0a3310 
[   40.728892] ol_transfer_swap_struct:Code swap structure successfully downloaded for bin type =2 
[   40.737708] bin_filename=IPQ4019/hw.1/athwlan.bin swap_filename=/lib/firmware/IPQ4019/hw.1/athwlan.codeswap.bin 
[   40.747917] ol_transfer_bin_file: Downloading firmware file: IPQ4019/hw.1/athwlan.bin
[   40.757550] ath10k_ahb a000000.wifi: Firmware loaded from user helper succesfully
[   40.764073] ol_transfer_bin_file 3542: downloading file 1, Download data len 363808
[   42.002625] ol_target_init() Download FW done. 
[   42.006213] ol_ath_attach() WMI attached. wmi_handle cc320000 
[   42.013809] htc_wmi_init() HT Create . cdce7800
[   42.017317] htc_wmi_init() HIF Claim.
[   42.021175] htc_wmi_init 7625 host_enable 0 nss_nwifi_offload 0
[   42.026978] ol_ath_set_default_tgt_config : AC Minfree buffer allocation through module param (umac.ko)
[   42.041601]  OL_ACBKMinfree : 0
[   42.043826]  OL_ACBEMinfree : 0
[   42.046849]  OL_ACVIMinfree : 0
[   42.050973]  OL_ACVOMinfree : 0
[   42.056459] CE_recv_buf_enqueue 877 Populate last entry 512 for CE 5
[   42.061835] CE_recv_buf_enqueue 886 CE 5 wi 511 dest_ptr 0x8b0b4040 nbytes 0 recv_ctxt 0xcc383180
[   42.071092] Startup Mode-0 set
[   42.073762] 
[   42.073762] <=== cfg max peer id 1056 ====>
[   42.079754] HTC Service:0x0300 ep:1 TX flow control disabled
[   42.085502] htt_peer_map_timer_init Enter pdev cb140000 hrtimer cb144860
[   42.091747] 
[   42.091747]  htt_alloc_peer_map_mem : Alloc Success : host q vaddr cd2d2000 paddr 8d2d2000
[   42.101402] 
[   42.101402]  htt_alloc_peer_map_mem : Flush Interval Configured to 256 pkts
[   42.113171] CE_pkt_dl_len_set CE 4 Pkt download length 64
[   42.117725] ol_txrx_pdev_attach: 2500 tx desc's allocated ; range starts from cadc0000
[   42.126786] HTC Service:0x0100 ep:2 TX flow control disabled
[   42.132630] wmi_service_ready_event_rx:  WMI UNIFIED SERVICE READY event 
[   42.138466] Firmware_Build_Number:92 
[   42.142145] num_rf_chain:0x00000002  ht_cap_info:0x0000085b  vht_cap_info:0x339959b2  vht_supp_mcs:0x0000fffa
[   42.151986] 
[   42.151986]  RES CFG Support wmi_service_bitmap 9778 
[   42.163007]

and my board-2.json

firmware$ cat board-2.json
[
    {
        "data": "boardData_1_0_IPQ4019_DK04_2G.bin",
        "names": [
            "bus=ahb,vendor=0000,device=0000,subsystem-vendor=0000,subsystem-device=0000,variant=TPL Deco M5"
        ]
    },
    {
        "data": "boardData_1_0_IPQ4019_DK04_5G.bin",
        "names": [
            "bus=ahb,vendor=0000,device=0000,subsystem-vendor=0000,subsystem-device=0000,variant=TPL Deco M5"
        ]
    }
]

Once I generated board-2.bin I copy it with that command :slight_smile:

cp board-2.bin ../../openwrt/package/firmware/ipq-wifi/board-tplink_deco-m5.qca4019

Pehap's I am wrong ?

10

I think my DTS file is completely wrong. If someone know how to extract it from the FIT file.
I can also try to uploas DTC on the board but I don' have the good binary version.

11

This is link to a pastebin with all the infos about the device.

[https://pastebin.com/x4y7Wy6j](https://Collecting relevant data)

13

Can't you dump it from the running stock firmware? Isn't there a node like /sys/firmware/devicetree/base or something

14

Did you manage to make on progress on this?
I would love to run Openwrt on this device.
Is there anything I can do help?

15

Is m5 openwrt firmware is ready :sweat_smile:

16

You should take a look at the GPL source at https://static.tp-link.com/resources/gpl/GPL_M5.tar.gz. In folder qca\src\linux-3.14\arch\arm\boot\dts\ there are quite a lot of qcom* dts and dtb files for various boards. Unfortunately i am not quite sure how to determine the correct one, maybe in your stitched together dtb there are some hints? I don't own a deco m5 to test myself.

17

If anyone is interested, this is running quite well on my Deco’s (M5 EU v3.0):

6 Likes
18

Nice job ! I would like to try it on my Deco.

Can you share details on how to push the image on the device ? I tried by a software upgrade but it did not succeeded.

I am also willing to help to make that device officially supported. (21.02 is coming...)

1 Like
19

I used procedure to recover M5 found on the TP-link FAQ to push the image I built with @frankveltmans sources.
Seems to be ok.
I made some performance test and results are close to the original firmware.

2 Likes
20

I know it's a different model, but do you think it would work with an S4?

21

I could find no information about that device. I suggest you start digging into that device, take a look at the wiki to understand how to add support for a new device : https://openwrt.org/docs/guide-developer/add.new.device