ipq50xx: Add CMCC PZ-L8 support

[sqliuchang]

CMCC PZ-L8 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on IPQ5000.

Specifications

• SoC : Qualcomm IPQ5000
• RAM : Integrated 256MiB DDR3L
• Flash : 128 MiB SPI-NAND (ESMT F50D1G41LB)
• WLAN : 2.4/5 GHz 2T2R
  • 2.4 GHz : Qualcomm IPQ5000 (SoC)
  • 5 GHz : Qualcomm Atheros QCN6102
• Ethernet : 4x 10/100/1000 Mbps
  • switch : Qualcomm Atheros QCA8337
• LEDs/Keys (GPIO): 2x LEDs, 2x Keys
• UART : Through-hole on PCB, 4pins in the middle of the black aluminum heat sink
  • assignment : 3.3V, GND,TX, RX (from left to right)
  • settings : 115200n8
• Power : 12 VDC, 1 A

Flashing Instructions

U-Boot Method using initramfs Image

1. Place the openwrt-*-initramfs-fit-uImage.itb file on your TFTP server and rename it to initramfs.bin
2. Enable serial console, enter to U-Boot CLI and exec these commands:

   tftpboot <your_tftp_server_ip>:initramfs.bin
   bootm
   

3. Once boot completed:
   • Method A: Upload the sysupgrade.bin file to router's /tmp directory (using scp or wget) and execute the following command in openwrt shell

     sysupgrade -n /tmp/sysupgrade.bin
     

   • Method B: Upload the factory.ubi file to router's /tmp directory (using scp or wget) and execute the following commands in openwrt shell

     export rootfs=$(cat /proc/mtd | grep rootfs | grep -v _ | cut -d: -f1)
     ubiformat /dev/${rootfs} -y -f /tmp/factory.ubi
     

U-Boot Method using UBI Image

1. Place the factory.ubi file on your TFTP server, enter U-Boot CLI and exec these commands:

   tftpboot <your_tftp_server_ip>:factory.ubi
   flash rootfs
   reset
   

SSH Method

1. Enable SSH on the stock firmware
   • Version 501.8 and 501.9:
     1. Log in to http://192.168.10.1 with the password on the sticker
     2. Append "/admin/system/admin" to the URL and press Enter
     3. Delete "Dropbear instance", click "Add instance", then "Save and Apply"
     4. Reboot the router
   • Version 501.11 and 501.12:
     1. While the router is running the stock firmware, press and hold the reset button for 20-30 seconds
     2. Open http://192.168.10.1:56781 and login with usename root and the password on the sticker
     3. Run vi /etc/config/dropbear and delete the line "option enable '0'"
     4. Reboot the router
2. Upload the factory.ubi file to router's /tmp directory (using scp or wget) and execute the following commands in the router's shell

   export rootfs=$(cat /proc/mtd | grep rootfs | grep -v _ | cut -d: -f1)
   ubidetach -f -p /dev/${rootfs} 
   ubiformat /dev/${rootfs} -y -f /tmp/factory.ubi
   

Switching to the Stock Firmware

1. Load the elecom.sh script

   . /lib/upgrade/elecom.sh
   

2. Check the current rootfs index

   bootconfig_rw_index 0:BOOTCONFIG rootfs
   

3. Set the index to inverted value
   • If step 2 returned "0":

   bootconfig_rw_index 0:BOOTCONFIG rootfs 1
   bootconfig_rw_index 0:BOOTCONFIG1 rootfs 1
   

   • If step 2 returned "1":

   bootconfig_rw_index 0:BOOTCONFIG rootfs 0
   bootconfig_rw_index 0:BOOTCONFIG1 rootfs 0
   

4. Reboot

Partition Layout (Stock Firmware)

0x000000000000-0x000000080000 : "0:SBL1"
0x000000080000-0x000000100000 : "0:MIBIB"
0x000000100000-0x000000140000 : "0:BOOTCONFIG"
0x000000140000-0x000000180000 : "0:BOOTCONFIG1"
0x000000180000-0x000000280000 : "0:QSEE"
0x000000280000-0x000000380000 : "0:QSEE_1"
0x000000380000-0x0000003c0000 : "0:DEVCFG"
0x0000003c0000-0x000000400000 : "0:DEVCFG_1"
0x000000400000-0x000000440000 : "0:CDT"
0x000000440000-0x000000480000 : "0:CDT_1"
0x000000480000-0x000000500000 : "0:APPSBLENV"
0x000000500000-0x000000640000 : "0:APPSBL"
0x000000640000-0x000000780000 : "0:APPSBL_1"
0x000000780000-0x000000880000 : "0:ART"
0x000000880000-0x000000900000 : "0:TRAINING"
0x000000900000-0x000004300000 : "rootfs"
0x000004300000-0x000007d00000 : "rootfs_1"

Notes

• This device features a dual-boot capability managed by an index in the 0:bootconfig and 0:bootconfig1 partitions.

MAC Addresses

Interface	MAC Address	Location (binary)
LAN	A4:39:B6:xx:xx:9D	(0:ART, 0x00-0x05)
WAN	A4:39:B6:xx:xx:9E	(0:ART, 0x06-0x0B)
2.4 GHz	A4:39:B6:xx:xx:9F	(0:ART, 0x0C-0x11)
5 GHz	A4:39:B6:xx:xx:A0	(0:ART, 0x12-0x17)