[RFC PATCH v1 2/3] ipq40xx: add support for Cambium Networks cnPilot E410
Phil Taylor
phil at m0vse.uk
Sun Sep 20 15:51:55 PDT 2026
The Cambium Networks cnPilot E410 is an enterprise access point based on
the Qualcomm IPQ4019 platform.
Hardware specifications:
* Qualcomm IPQ4019 SoC
* 256 MiB RAM
* 8 MiB SPI NOR flash
* 128 MiB SPI NAND flash
* one Gigabit Ethernet port with 802.3af/at PoE
* two integrated 2x2 QCA4019 802.11ac radios
* four status LEDs and one WPS button
* UART console at 115200 8N1
The OEM layout stores two kernel and root filesystem pairs in UBI volumes
named linux0/rootfs0 and linux1/rootfs1. Preserve those volume names and
sizes so either slot can remain available as a fallback. The U-Boot
environment is the only writable SPI NOR partition.
The bootloader expects FIT configuration config at ap.dk01.1-c2 and cannot
boot an LZMA-compressed kernel. Generate an uncompressed FIT kernel and a
UBIFS image matching the factory 2 KiB page and 126976-byte LEB geometry.
A separate recovery profile keeps the complete SPI NAND layout read-only
for non-destructive RAM boot validation.
Initial installation requires access to the OEM root shell or serial
console. Back up the U-Boot environment, ART, manufacturing data and the
inactive OEM slot before writing anything. Write kernel.itb and
rootfs.ubifs to the inactive linuxN/rootfsN volume pair with ubiupdatevol,
then configure U-Boot to load that pair and invoke:
bootm 0x84000000#config at ap.dk01.1-c2
Restoring bootcmd=bootipq and the original image variable returns control
to the unchanged OEM slot.
Tested on hardware:
* TFTP initramfs boot and persistent UBI boot
* Gigabit Ethernet and DHCP management
* both radios with per-device ART calibration
* wired and wireless MAC address sources
* all four LEDs and the WPS button
* U-Boot environment read/write and OEM-slot recovery
Signed-off-by: Phil Taylor <phil at m0vse.uk>
---
.../uboot-tools/uboot-envtools/files/ipq40xx | 1 +
.../ipq40xx/base-files/etc/board.d/02_network | 4 +
.../dts/qcom-ipq4019-e410-recovery.dts | 9 +
.../linux/ipq40xx/dts/qcom-ipq4019-e410.dts | 5 +
.../linux/ipq40xx/dts/qcom-ipq4019-e410.dtsi | 328 ++++++++++++++++++
target/linux/ipq40xx/image/generic.mk | 43 +++
6 files changed, 390 insertions(+)
create mode 100644 target/linux/ipq40xx/dts/qcom-ipq4019-e410-recovery.dts
create mode 100644 target/linux/ipq40xx/dts/qcom-ipq4019-e410.dts
create mode 100644 target/linux/ipq40xx/dts/qcom-ipq4019-e410.dtsi
diff --git a/package/boot/uboot-tools/uboot-envtools/files/ipq40xx b/package/boot/uboot-tools/uboot-envtools/files/ipq40xx
index 25e0d5e..a28771f 100644
--- a/package/boot/uboot-tools/uboot-envtools/files/ipq40xx
+++ b/package/boot/uboot-tools/uboot-envtools/files/ipq40xx
@@ -13,6 +13,7 @@ board=$(board_name)
case "$board" in
alfa-network,ap120c-ac|\
+cambiumnetworks,e410|\
devolo,magic-2-wifi-next|\
edgecore,ecw5211|\
glinet,gl-a1300 |\
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/02_network b/target/linux/ipq40xx/base-files/etc/board.d/02_network
index 5193c6c..6012abd 100644
--- a/target/linux/ipq40xx/base-files/etc/board.d/02_network
+++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network
@@ -74,6 +74,10 @@ ipq40xx_setup_interfaces()
zte,mf282plus)
ucidef_set_interface_lan "lan"
;;
+ cambiumnetworks,e410)
+ # Managed access point: obtain its management address upstream.
+ ucidef_set_interface_lan "lan" "dhcp"
+ ;;
aruba,ap-303h|\
buffalo,wtr-m2133hp|\
ezviz,cs-w3-wd1200g-eup|\
diff --git a/target/linux/ipq40xx/dts/qcom-ipq4019-e410-recovery.dts b/target/linux/ipq40xx/dts/qcom-ipq4019-e410-recovery.dts
new file mode 100644
index 0000000..de77c04
--- /dev/null
+++ b/target/linux/ipq40xx/dts/qcom-ipq4019-e410-recovery.dts
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+
+#include "qcom-ipq4019-e410.dtsi"
+
+&fs_partition {
+ read-only;
+};
diff --git a/target/linux/ipq40xx/dts/qcom-ipq4019-e410.dts b/target/linux/ipq40xx/dts/qcom-ipq4019-e410.dts
new file mode 100644
index 0000000..08a4d3c
--- /dev/null
+++ b/target/linux/ipq40xx/dts/qcom-ipq4019-e410.dts
@@ -0,0 +1,5 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+
+#include "qcom-ipq4019-e410.dtsi"
diff --git a/target/linux/ipq40xx/dts/qcom-ipq4019-e410.dtsi b/target/linux/ipq40xx/dts/qcom-ipq4019-e410.dtsi
new file mode 100644
index 0000000..e9c84dc
--- /dev/null
+++ b/target/linux/ipq40xx/dts/qcom-ipq4019-e410.dtsi
@@ -0,0 +1,328 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq4019.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+ model = "Cambium Networks cnPilot E410";
+ compatible = "cambiumnetworks,e410", "qcom,ipq4019";
+
+ aliases {
+ ethernet0 = &swport4;
+ label-mac-device = &swport4;
+ led-boot = &led_status_amber;
+ led-failsafe = &led_status_red;
+ led-running = &led_status_green;
+ led-upgrade = &led_status_amber;
+ };
+
+ chosen {
+ bootargs-append = " clk_ignore_unused";
+ stdout-path = &blsp1_uart1;
+ };
+
+ memory {
+ device_type = "memory";
+ reg = <0x80000000 0x10000000>;
+ };
+
+ reserved-memory {
+ ranges;
+
+ rsvd1 at 87000000 {
+ reg = <0x87000000 0x500000>;
+ no-map;
+ };
+
+ wifi_dump at 87500000 {
+ reg = <0x87500000 0x600000>;
+ no-map;
+ };
+
+ rsvd2 at 87b00000 {
+ /* smem and trustzone reserve the final 2 MiB separately. */
+ reg = <0x87b00000 0x300000>;
+ no-map;
+ };
+ };
+
+ soc {
+ counter at 4a1000 {
+ compatible = "qcom,qca-gcnt";
+ reg = <0x4a1000 0x4>;
+ };
+
+ tcsr at 1949000 {
+ compatible = "qcom,tcsr";
+ reg = <0x1949000 0x100>;
+ qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+ };
+
+ ess_tcsr at 1953000 {
+ compatible = "qcom,tcsr";
+ reg = <0x1953000 0x1000>;
+ qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+ };
+
+ tcsr at 1957000 {
+ compatible = "qcom,tcsr";
+ reg = <0x1957000 0x100>;
+ qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+ };
+ };
+
+ keys {
+ compatible = "gpio-keys";
+
+ wps {
+ label = "wps";
+ gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
+ linux,code = <KEY_WPS_BUTTON>;
+ };
+ };
+
+ leds {
+ compatible = "gpio-leds";
+
+ led_status_amber: led-0 {
+ function = LED_FUNCTION_STATUS;
+ color = <LED_COLOR_ID_AMBER>;
+ gpios = <&tlmm 0 GPIO_ACTIVE_LOW>;
+ };
+
+ led_status_green: led-1 {
+ function = LED_FUNCTION_STATUS;
+ color = <LED_COLOR_ID_GREEN>;
+ gpios = <&tlmm 1 GPIO_ACTIVE_LOW>;
+ };
+
+ led_status_red: led-2 {
+ function = LED_FUNCTION_STATUS;
+ color = <LED_COLOR_ID_RED>;
+ gpios = <&tlmm 2 GPIO_ACTIVE_LOW>;
+ };
+
+ led_status_blue: led-3 {
+ function = LED_FUNCTION_STATUS;
+ color = <LED_COLOR_ID_BLUE>;
+ gpios = <&tlmm 3 GPIO_ACTIVE_LOW>;
+ };
+ };
+};
+
+&watchdog {
+ status = "okay";
+};
+
+&prng {
+ status = "okay";
+};
+
+&blsp_dma {
+ status = "okay";
+};
+
+&blsp1_uart1 {
+ status = "okay";
+ pinctrl-0 = <&serial_pins>;
+ pinctrl-names = "default";
+};
+
+&blsp1_spi1 {
+ status = "okay";
+ pinctrl-0 = <&spi_pins>;
+ pinctrl-names = "default";
+ cs-gpios = <&tlmm 54 GPIO_ACTIVE_LOW>,
+ <&tlmm 59 GPIO_ACTIVE_LOW>;
+
+ flash at 0 {
+ compatible = "jedec,spi-nor";
+ reg = <0>;
+ spi-max-frequency = <24000000>;
+
+ partitions {
+ compatible = "fixed-partitions";
+ #address-cells = <1>;
+ #size-cells = <1>;
+
+ partition at 0 {
+ label = "0:SBL1";
+ reg = <0x000000 0x040000>;
+ read-only;
+ };
+
+ partition at 40000 {
+ label = "0:MIBIB";
+ reg = <0x040000 0x020000>;
+ read-only;
+ };
+
+ partition at 60000 {
+ label = "0:QSEE";
+ reg = <0x060000 0x060000>;
+ read-only;
+ };
+
+ partition at c0000 {
+ label = "0:CDT";
+ reg = <0x0c0000 0x010000>;
+ read-only;
+ };
+
+ partition at d0000 {
+ label = "0:DDRPARAMS";
+ reg = <0x0d0000 0x010000>;
+ read-only;
+ };
+
+ partition at e0000 {
+ label = "0:APPSBLENV";
+ reg = <0x0e0000 0x010000>;
+ };
+
+ partition at f0000 {
+ label = "0:APPSBL";
+ reg = <0x0f0000 0x080000>;
+ read-only;
+ };
+
+ partition at 170000 {
+ label = "0:ART";
+ reg = <0x170000 0x010000>;
+ read-only;
+
+ nvmem-layout {
+ compatible = "fixed-layout";
+ #address-cells = <1>;
+ #size-cells = <1>;
+
+ precal_art_1000: precal at 1000 {
+ reg = <0x1000 0x2f20>;
+ };
+
+ precal_art_5000: precal at 5000 {
+ reg = <0x5000 0x2f20>;
+ };
+ };
+ };
+
+ partition at 180000 {
+ label = "mfginfo";
+ reg = <0x180000 0x010000>;
+ read-only;
+ };
+
+ partition at 190000 {
+ label = "crashLog";
+ reg = <0x190000 0x010000>;
+ read-only;
+ };
+
+ partition at 1a0000 {
+ label = "config";
+ reg = <0x1a0000 0x010000>;
+ read-only;
+ };
+ };
+ };
+
+ nand at 1 {
+ compatible = "spi-nand";
+ reg = <1>;
+ spi-max-frequency = <24000000>;
+
+ partitions {
+ compatible = "fixed-partitions";
+ #address-cells = <1>;
+ #size-cells = <1>;
+
+ /* Preserve the factory A/B UBI layout and volume names. */
+ fs_partition: partition at 0 {
+ label = "fs";
+ reg = <0x0000000 0x8000000>;
+ };
+ };
+ };
+};
+
+&tlmm {
+ mdio_pins: mdio_pinmux {
+ mux_mdio {
+ pins = "gpio53";
+ function = "mdio";
+ bias-pull-up;
+ };
+
+ mux_mdc {
+ pins = "gpio52";
+ function = "mdc";
+ bias-pull-up;
+ };
+ };
+
+ serial_pins: serial_pinmux {
+ mux {
+ pins = "gpio60", "gpio61";
+ function = "blsp_uart0";
+ bias-disable;
+ };
+ };
+
+ spi_pins: spi_pinmux {
+ mux_spi {
+ function = "blsp_spi0";
+ pins = "gpio55", "gpio56", "gpio57";
+ drive-strength = <12>;
+ bias-disable;
+ };
+
+ mux_cs {
+ function = "gpio";
+ pins = "gpio54", "gpio59";
+ drive-strength = <2>;
+ bias-disable;
+ output-high;
+ };
+ };
+
+ phy_reset {
+ gpio-hog;
+ line-name = "phy-reset";
+ gpios = <62 GPIO_ACTIVE_HIGH>;
+ output-high;
+ };
+};
+
+&mdio {
+ status = "okay";
+ pinctrl-0 = <&mdio_pins>;
+ pinctrl-names = "default";
+};
+
+&gmac {
+ status = "okay";
+};
+
+&switch {
+ status = "okay";
+};
+
+&swport4 {
+ status = "okay";
+ label = "lan";
+};
+
+&wifi0 {
+ status = "okay";
+ nvmem-cell-names = "pre-calibration";
+ nvmem-cells = <&precal_art_1000>;
+};
+
+&wifi1 {
+ status = "okay";
+ nvmem-cell-names = "pre-calibration";
+ nvmem-cells = <&precal_art_5000>;
+};
diff --git a/target/linux/ipq40xx/image/generic.mk b/target/linux/ipq40xx/image/generic.mk
index 3930d86..defd44b 100644
--- a/target/linux/ipq40xx/image/generic.mk
+++ b/target/linux/ipq40xx/image/generic.mk
@@ -35,6 +35,13 @@ define Device/UbiFit
IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
endef
+define Build/e410-rootfs-ubifs
+ rm -f $@
+ $(STAGING_DIR_HOST)/bin/mkfs.ubifs \
+ -m 2048 -e 126976 -c 372 --space-fixup --compr=zlib \
+ --squash-uids -r $(TARGET_DIR) -o $@
+endef
+
define Device/DniImage
$(call Device/FitzImage)
NETGEAR_BOARD_ID :=
@@ -337,6 +344,42 @@ define Device/cellc_rtl30vw
endef
TARGET_DEVICES += cellc_rtl30vw
+# The OEM bootloader reads a FIT from a 34-LEB linuxN volume and mounts the
+# matching 372-LEB rootfsN volume as UBIFS. Keep these size limits explicit;
+# platform upgrade code will manage the existing A/B volumes separately.
+define Device/cambiumnetworks_e410-recovery
+ $(call Device/FitzImage)
+ DEVICE_VENDOR := Cambium Networks
+ DEVICE_MODEL := cnPilot E410
+ DEVICE_VARIANT := RAM recovery
+ DEVICE_DTS := qcom-ipq4019-e410-recovery
+ DEVICE_DTS_CONFIG := config at ap.dk01.1-c2
+ DEVICE_FIT_COMPATIBLE := cambiumnetworks,e410
+ SOC := qcom-ipq4019
+ BLOCKSIZE := 128k
+ PAGESIZE := 2048
+ IMAGES :=
+endef
+TARGET_DEVICES += cambiumnetworks_e410-recovery
+
+define Device/cambiumnetworks_e410
+ $(call Device/FitzImage)
+ KERNEL_INITRAMFS = kernel-bin | fit none $$(KDIR)/image-$$(DEVICE_DTS).dtb
+ DEVICE_VENDOR := Cambium Networks
+ DEVICE_MODEL := cnPilot E410
+ SOC := qcom-ipq4019
+ DEVICE_DTS_CONFIG := config at ap.dk01.1-c2
+ DEVICE_FIT_COMPATIBLE := cambiumnetworks,e410
+ BLOCKSIZE := 128k
+ PAGESIZE := 2048
+ KERNEL_INSTALL := 1
+ KERNEL_SIZE := 4216k
+ IMAGES := $(if $(CONFIG_TARGET_ROOTFS_INITRAMFS),,kernel.itb rootfs.ubifs)
+ IMAGE/kernel.itb := append-kernel | check-size 4216k
+ IMAGE/rootfs.ubifs := e410-rootfs-ubifs | check-size 46128k
+endef
+TARGET_DEVICES += cambiumnetworks_e410
+
define Device/cilab_meshpoint-one
$(call Device/8dev_jalapeno-common)
DEVICE_VENDOR := Crisis Innovation Lab
--
2.54.0 (Apple Git-157)
More information about the openwrt-devel
mailing list