ipq40xx: add support for Sophos APX 120

ipq40xx: add support for Sophos APX 120

Specifications
--------------
- SoC       : Qualcomm IPQ4019 (4x ARMv7 Cortex-A7 @ 716 MHz, NEON/VFPv4)
- RAM       : 256 MiB DDR3
- SPI-NOR   : Macronix MX25L1606E (2 MiB) - bootloader + ART calibration
- SPI-NAND  : Winbond W25M02GV (256 MiB, dual-die) - kernel + rootfs (UBI)
- WLAN      : IPQ4019 on-chip, 2 radios
  - 2.4 GHz : 2x2 802.11b/g/n (wifi0)
  - 5 GHz   : 2x2 802.11n/ac (wifi1)
- Ethernet  : 1x RJ45 via QCA8075 PHY, jack wired to switch port 5
- TPM       : Atmel AT97SC3204T on i2c @ 0x29
- Buttons   : 1x Reset (gpio2, active low)
- LEDs      : green (gpio3, power), red (gpio4, status / panic)
- UART      : 115200 8N1 3.3V (gpio60 TX / gpio61 RX)
- Power     : DC 12V

MAC addresses
-------------
Read from the ART partition on SPI-NOR flash at offset 0x0,
encoded as a nvmem cell in the DTS.

Flash layout
------------
SPI-NOR (2 MiB) carries the QCA bootloader chain and ART:

  SBL1       0x000000  256 KiB  (bootloader stage 1)
  MIBIB      0x040000  128 KiB  (flash partition table)
  QSEE       0x060000  384 KiB  (TrustZone / secure env)
  CDT        0x0c0000   64 KiB  (configuration data tbl)
  DDRPARAMS  0x0d0000   64 KiB  (DDR training parameters)
  APPSBLENV  0x0e0000   64 KiB  (U-Boot environment)
  APPSBL     0x0f0000  512 KiB  (U-Boot)
  ART        0x170000   64 KiB  (WiFi calibration + MAC)

The W25M02GV SPI-NAND is split at the die boundary
(die 0 = rootfs, die 1 = data) to work around a stock U-Boot bug:
the die-select is broken, causing reads from die 1 to return
0xFF. If UBI wear-leveling relocated the layout volume to
die 1, U-Boot would fail to attach UBI, bricking boot.
Splitting the chip keeps all UBI metadata U-Boot reads from
die 0.

Stock U-Boot hardcodes the UBI attach window to 64 MiB;
the bootcmd replacement expands it to 128 MiB to use the
full die 0.

  rootfs  0x00000000  128 MiB
  data    0x08000000  128 MiB

Installation
------------
1. Build image for sophos_apx120 target
2. Start TFTP server in folder with
   openwrt-ipq40xx-generic-sophos_apx120-initramfs-
   uImage.itb
3. Plug in Serial TTL Adapter (115200 baud):

| APX 120 | VCC  | RX  | GND | TX  |
|--------|------|-----|-----|-----|
| USB    | X    | TX  | GND | RX  |
|--------|------|-----|-----|-----|

3. Short U26 pin 8 (first pin on left, top row on NAND
   Chip, with ethernet port facing you) to ground for a
   fraction of a second during power-on. Expected output shows
   NAND detection and CRC warning, then U-Boot prompt.
4. In U-Boot run:
   $ setenv bootdelay 5
   $ setenv verify no
   $ saveenv
   $ tftpboot 0x84000000
   openwrt-ipq40xx-generic-sophos_apx120-initramfs-uImage.itb
   $ bootm 0x84000000
5. Setup Networking Transfer the sysupgrade image using a
   HTTP server or scp
6. In OpenWrt run:
   $ fw_setenv bootcmd 'set fdt_high 0x87000000 && \
       set bootargs ubi.mtd=rootfs root=mtd:ubi_rootfs \
       rootfstype=squashfs rootwait && nand device 1 && \
       set mtdids nand1=nand1 && set mtdparts \
       mtdparts=nand1:0x8000000@0x0(fs) && \
       ubi part fs && ubi read 0x84000000 kernel && \
       bootm 0x84000000#config@ap.dk01.1-c2'
   $ ubiformat /dev/mtd9 -y
   $ sysupgrade -n
   openwrt-ipq40xx-generic-sophos_apx120-squashfs-sysupgrade.bin
7. Device should reboot into OpenWrt

Notes
-----
- With firmware version 1.0.019, the image drops directly
  into a shell, so NAND glitching may be skipped.
- The platform sysupgrade script reflashes the entire
  die-0 UBI partition via `ubiformat` — live volume
  manipulation would leave the UBI layout in a state the
  stock U-Boot rejects, which bricks the device.

Known Issues
------------
- Some device revisions have an TPM chip that
  is not detected/supported or is broken

Signed-off-by: Morice Olbert <synapse7062@spnkr.de>
Link: https://github.com/openwrt/openwrt/pull/24328
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>