mediatek: mt7622: add a second u-boot for redmi-ax6s

The vendor u-boot knows nothing about UBI, and we used to have a
fixed-size kernel partition for vendor u-boot and UBI for rootfs.
However, that fixed partition becomes too small eventually, and
expanding it requires complicated procedure.

This commit changed the flash layout and added a second u-boot
where the kernel supposed to be.
Now the vendor u-boot chainloads our mainline u-boot, and our
u-boot reads kernel+rootfs from UBI, verifies it, and boot
into OpenWrt.

There are two possible ways to convert from the old fw:
Flash the factory image using mtd (provided by @rany2):

mount -o remount,ro /
mount -o remount,ro /overlay
cd /tmp
dd if=factory.bin bs=1M count=4 | mtd write - kernel
dd if=factory.bin bs=1M skip=4 | mtd -r write - ubi

Or, flash the 2nd u-boot via mtd and upload the firmware
to the 2nd u-boot using tftp:

1. prepare a tftp server at 192.168.1.254 to serve the
   sysupgrade image:
   openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-squashfs-sysupgrade.itb
2. upload the ubi-loader.itb to OpenWrt /tmp, and flash it to
   the old kernel partition:
   mtd -r write openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-ubi-loader.itb
3. The router should reboot and flash the sysupgrade image via TFTP.

Procedure for flashing from vendor firmware shouldn't change.

Signed-off-by: Chuanhong Guo <gch981213@gmail.com>

target/linux/mediatek/dts/mt7622-xiaomi-redmi-router-ax6s.dts

@@ -22,7 +22,8 @@
 
 	chosen {
 		stdout-path = "serial0:115200n8";
-		bootargs = "earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n8 swiotlb=512";
+		rootdisk = <&ubi_rootfs>;
+		bootargs = "earlycon=uart8250,mmio32,0x11002000 swiotlb=512 ubi.block=0,fit root=/dev/fit0";
 	};
 
 	memory {
@@ -230,7 +231,7 @@
 
 		mediatek,bmt-v2;
 		mediatek,bmt-table-size = <0x1000>;
-		mediatek,bmt-remap-range = <0x0 0x6c0000>;
+		mediatek,bmt-remap-range = <0x0 0x340000>;
 
 		partitions {
 			compatible = "fixed-partitions";
@@ -295,12 +296,9 @@
 				read-only;
 			};
 
-			/* Shrunk and renamed from "firmware"
-			 * as to not break luci size checks
-			 */
 			partition@2c0000 {
-				label = "kernel";
+				label = "ubi-loader";
-				reg = <0x2c0000 0x400000>;
+				reg = <0x2c0000 0x80000>;
 			};
 
 			/* ubi partition is the result of squashing
@@ -310,9 +308,16 @@
 			 * - overlay
 			 * - obr
 			 */
-			partition@6c0000 {
+			partition@340000 {
 				label = "ubi";
-				reg = <0x6C0000 0x6f00000>;
+				reg = <0x340000 0x7280000>;
+				compatible = "linux,ubi";
+
+				volumes {
+					ubi_rootfs: ubi-volume-fit {
+						volname = "fit";
+					};
+				};
 			};
 		};
 	};

target/linux/mediatek/image/mt7622.mk

@@ -37,6 +37,21 @@ define Build/bl31-uboot
 	cat $(STAGING_DIR_IMAGE)/mt7622_$1-u-boot.fip >> $@
 endef
 
+define Build/uboot-bin
+	cat $(STAGING_DIR_IMAGE)/mt7622_$1-u-boot.bin >> $@
+endef
+
+define Build/uboot-fit
+	$(TOPDIR)/scripts/mkits.sh \
+		-D $(DEVICE_NAME) -o $@.its -k $@ \
+		-C $(word 1,$(1)) \
+		-a 0x41e00000 -e 0x41e00000 \
+		-c "config-1" \
+		-A $(LINUX_KARCH) -v u-boot
+	PATH=$(LINUX_DIR)/scripts/dtc:$(PATH) mkimage -f $@.its $@.new
+	@mv $@.new $@
+endef
+
 # Append header to a D-Link M32/R32 Kernel 1 partition
 define Build/m32-r32-recovery-header-kernel1
 	$(eval header_start=$(word 1,$(1)))
@@ -458,12 +473,20 @@ define Device/xiaomi_redmi-router-ax6s
   BOARD_NAME := xiaomi,redmi-router-ax6s
   DEVICE_PACKAGES := kmod-mt7915-firmware
   UBINIZE_OPTS := -E 5
-  IMAGES += factory.bin
   BLOCKSIZE := 128k
   PAGESIZE := 2048
-  KERNEL_SIZE := 4096k
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
   KERNEL_INITRAMFS_SUFFIX := -recovery.itb
-  IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi
+  IMAGES := sysupgrade.itb
-  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  IMAGE/sysupgrade.itb := append-kernel | fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  ARTIFACTS := ubi-loader.itb
+  ARTIFACT/ubi-loader.itb := uboot-bin xiaomi_redmi-router-ax6s-ubi-loader | lzma | uboot-fit lzma
+ifneq ($(CONFIG_TARGET_ROOTFS_SQUASHFS),)
+  ARTIFACTS += factory.bin
+  ARTIFACT/factory.bin := uboot-bin xiaomi_redmi-router-ax6s-ubi-loader | lzma | uboot-fit lzma | pad-to 512k | ubinize-image fit squashfs-sysupgrade.itb
+endif
+  DEVICE_COMPAT_VERSION := 2.0
+  DEVICE_COMPAT_MESSAGE := Flash layout changes require a manual reinstall using factory.bin.
 endef
-# TARGET_DEVICES += xiaomi_redmi-router-ax6s
+TARGET_DEVICES += xiaomi_redmi-router-ax6s

target/linux/mediatek/mt7622/base-files/etc/uci-defaults/05_fix-compat-version

@@ -9,7 +9,8 @@ case "$(board_name)" in
 	uci set system.@system[0].compat_version="1.1"
 	uci commit system
 	;;
-	linksys,e8450-ubi)
+	linksys,e8450-ubi|\
+	xiaomi,redmi-router-ax6s)
 	uci set system.@system[0].compat_version="2.0"
 	uci commit system
 	;;

target/linux/mediatek/mt7622/base-files/lib/upgrade/platform.sh

@@ -10,7 +10,8 @@ platform_do_upgrade() {
 	linksys,e8450-ubi|\
 	ubnt,unifi-6-lr-v1-ubootmod|\
 	ubnt,unifi-6-lr-v2-ubootmod|\
-	ubnt,unifi-6-lr-v3-ubootmod)
+	ubnt,unifi-6-lr-v3-ubootmod|\
+	xiaomi,redmi-router-ax6s)
 		[ -e /dev/fit0 ] && fitblk /dev/fit0
 		[ -e /dev/fitrw ] && fitblk /dev/fitrw
 		bootdev="$(fitblk_get_bootdev)"
@@ -48,8 +49,7 @@ platform_do_upgrade() {
 	elecom,wrc-x3200gst3|\
 	mediatek,mt7622-rfb1-ubi|\
 	netgear,wax206|\
-	totolink,a8000ru|\
+	totolink,a8000ru)
-	xiaomi,redmi-router-ax6s)
 		nand_do_upgrade "$1"
 		;;
 	linksys,e8450)
@@ -84,8 +84,7 @@ platform_check_image() {
 	elecom,wrc-x3200gst3|\
 	mediatek,mt7622-rfb1-ubi|\
 	netgear,wax206|\
-	totolink,a8000ru|\
+	totolink,a8000ru)
-	xiaomi,redmi-router-ax6s)
 		nand_do_platform_check "$board" "$1"
 		return $?
 		;;