Adding support for Arista C-130 / Mojo C-130 / WatchGuard AP420

For Developers
1

I recently picked up a Mojo C-130 and thought this line of APs would be a good project to see if more life could be brought through OpenWRT since they are not usable without an annual enterprise license to the cloud configuration software.

From what I can tell the SoC/radios have existing support in OpenWRT, so hopefully I have a chance of getting something running on these.

FCCID: TOR-C130
SoC: IPQ8068
RAM: 256MB (According to spec sheet, boot log for this unit seems to indicate more)
Radios: 2x QCA9994, 1x QCA9882
Ethernet PHY: 2x AR8033
Storage: 128MB

External serial console port is open and verbose. U-Boot even has a nice 3 second delay.

Full boot log here, highlights below:

U-Boot 2012.07 [Enterprise IPQ806X.LN,r37758] (Apr 12 2016 - 12:35:30)

smem ram ptable found: ver: 0 len: 5
DRAM:  491 MiB
NAND:  SF: Detected S25FL256S with page size 64 KiB, total 32 MiB
ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x2000000
160 MiB
MMC:   
PCI0 Link Intialized
PCI1 Link Intialized
In:    serial
Out:   serial
Err:   serial
MMC Device 0 not found
cdp: get part failed for rootfs
MMC Device 0 not found
cdp: get part failed for opt
Net:   MAC2 addr:88:b1:e1:24:9a:ff
Port:2 speed 10Mbps
Skipping switch init
Switch inits done
MAC3 addr:88:b1:e1:24:9a:fe
Port:3 speed 10Mbps
eth0, eth1
Hit enter key to stop autoboot:  2  1  0 
Device 1: nand1... is now current device

NAND read: device 1 offset 0x9a0000, size 0x500000
 5242880 bytes read: OK

## Checking Image at 44000000 ...
   Legacy image found
   Image Name:   Linux-3.4.103
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1860152 Bytes = 1.8 MiB
   Load Address: 41508000
   Entry Point:  41508000
   Verifying Checksum ... OK
MMC Device 0 not found
MMC Device 0 not found

NAND read: device 1 offset 0x9a0000, size 0x500000
 5242880 bytes read: OK
   Image Name:   Linux-3.4.103
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1860152 Bytes = 1.8 MiB
   Load Address: 41508000
   Entry Point:  41508000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK
Using machid 0x1260 from environment

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0
[    0.000000] CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c5387d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] Machine: Qualcomm Atheros AP148 reference board
[    0.000000] Partition (from atag) rootfs -- Offset:0 Size:100
[    0.000000] Partition (from atag) opt -- Offset:100 Size:100
[    0.000000] Partition (from atag) rootfs2 -- Offset:200 Size:100
[    0.000000] Partition (from atag) opt2 -- Offset:300 Size:100
[    0.000000] msm_reserve_memory: 0x44000000, 0x600000
[    0.000000] msm_reserve_memory: 0x44600000, 0x200000
[    0.000000] memory pool 3 (start 5fc00000 size 400000) initialized
[    0.000000] Memory policy: ECC disabled, Data cache writealloc
[    0.000000] smem_find(137, 80): wrong size 72
[    0.000000] socinfo_init: v6, id=204, ver=2.0, raw_id=2313, raw_ver=2313, hw_plat=0,  hw_plat_ver=65536
[    0.000000]  accessory_chip=0 hw_plat_subtype=0
[    0.000000] PERCPU: Embedded 8 pages/cpu @c0c6c000 s10624 r8192 d13952 u32768
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 121642
[    0.000000] Kernel command line: console=ttyHSL1,115200n8 ubi.mtd=rootfs2 root=mtd:ubi_rootfs rootfstype=squashfs
[    0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Memory: 43MB 436MB = 479MB total
[    0.000000] Memory: 477280k/489568k available, 13216k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0xdf000000 - 0xff000000   ( 512 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xdeb00000   ( 491 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0008000 - 0xc050d000   (5140 kB)
[    0.000000]       .init : 0xc0600000 - 0xc0702980   (1035 kB)
[    0.000000]       .data : 0xc0704000 - 0xc07a3068   ( 637 kB)
[    0.000000]        .bss : 0xc07a308c - 0xc0868bb0   ( 791 kB)
[    0.000000] SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] NR_IRQS:1689
[    0.000000] sched_clock: 32 bits at 32kHz, resolution 31240ns, wraps every 134175798ms
[    0.000000] Console: colour dummy device 80x30
[    0.150452] Calibrating delay using timer specific routine.. 12.55 BogoMIPS (lpj=62797)
[    0.150484] pid_max: default: 32768 minimum: 301
[    0.150952] Mount-cache hash table entries: 512
[    0.152421] CPU: Testing write buffer coherency: ok
[    0.152639] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[    0.152639] hw perfevents: enabled with ARMv7 Krait PMU driver, 5 counters available
[    0.152764] Setting up static identity map for 0x41894aa0 - 0x41894b28
[    0.155107] CPU1: Booted secondary processor
[    0.155170] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
[    0.155263] Brought up 2 CPUs
[    0.155295] SMP: Total of 2 processors activated (25.11 BogoMIPS).
[    0.171883] dummy: 
[    0.172602] NET: Registered protocol family 16
[    0.173414] AXI: msm_bus_fabric_init_driver(): msm_bus_fabric_init_driver
[    0.176444] meminfo_init: smem ram ptable found: ver: 0 len: 5
[    0.176444] Found 1 memory banks grouped into 8 memory regions
[    0.177038] gpiochip_add: registered GPIOs 0 to 151 on device: msmgpio
[    0.177819] smem_find(137, 80): wrong size 72
[    0.177850] socinfo_init: v6, id=204, ver=2.0, raw_id=2313, raw_ver=2313, hw_plat=0,  hw_plat_ver=65536
[    0.177850]  accessory_chip=0 hw_plat_subtype=0
[    0.177913] msm_rpm_init: RPM firmware 3.0.16777364
[    0.185879] clk_tbl_nss - loaded
[    0.211902] Andrew: AP148_W_2PHYS defined !!!!!!
[    0.214214] hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
[    0.214245] hw-breakpoint: maximum watchpoint size is 8 bytes.
...
[    0.408997] spi_qsd spi_qsd.5: master is unqueued, this is deprecated
[    0.411590] spi_qsd spi_qsd.6: master is unqueued, this is deprecated
[    0.415151] Switching to clocksource gp_timer
[    0.438019] NET: Registered protocol family 2
[    0.447891] IP route cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.448484] TCP established hash table entries: 16384 (order: 5, 131072 bytes)
[    0.448672] TCP bind hash table entries: 16384 (order: 5, 131072 bytes)
[    0.448890] TCP: Hash tables configured (established 16384 bind 16384)
[    0.448890] TCP: reno registered
[    0.448922] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.448922] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.449359] NET: Registered protocol family 1
[    0.450827] Detected 5 counters on the L2CC PMU.
[    0.451890] smd: register irq failed on wcnss_a11
[    0.451890] smd: deregistering IRQs
[    0.451952] SMD: smd_core_platform_init() failed
[    0.452702] Partition(from smem) SBL1 -- Offset:0 Size:20000
[    0.452733] Partition(from smem) MIBIB -- Offset:20000 Size:20000
[    0.452733] Partition(from smem) SBL2 -- Offset:40000 Size:40000
[    0.452764] Partition(from smem) SBL3 -- Offset:80000 Size:80000
[    0.452764] Partition(from smem) DDRCONFIG -- Offset:100000 Size:10000
[    0.452796] Partition(from smem) SSD -- Offset:110000 Size:10000
[    0.452796] Partition(from smem) TZ -- Offset:120000 Size:80000
[    0.452827] Partition(from smem) RPM -- Offset:1a0000 Size:80000
[    0.452858] Partition(from smem) APPSBL -- Offset:220000 Size:100000
[    0.452858] Partition(from smem) APPSBLENV -- Offset:320000 Size:40000
[    0.452889] Partition(from smem) ART -- Offset:360000 Size:100000
[    0.452920] Partition(from smem) vendordata -- Offset:460000 Size:20000
[    0.452920] Partition(from smem) BOOTCONFIG -- Offset:490000 Size:10000
[    0.452952] Partition(from smem) kernel1 -- Offset:4a0000 Size:500000
[    0.452952] Partition(from smem) kernel2 -- Offset:9a0000 Size:500000
[    0.452983] Partition(from smem) user_config -- Offset:ea0000 Size:400000
[    0.453014] Partition(from smem) recovery -- Offset:12a0000 Size:d00000
[    0.453014] smem_find(427, 88): wrong size 96
[    0.468791] acpuclk-ipq806x acpuclk-ipq806x: SPEED BIN: 0
[    0.468822] acpuclk-ipq806x acpuclk-ipq806x: ACPU PVS: 1
[    0.475882] acpuclk-ipq806x acpuclk-ipq806x: CPU0: 6 frequencies supported
[    0.475913] acpuclk-ipq806x acpuclk-ipq806x: CPU1: 6 frequencies supported
[    0.477538] msm_rpm_log_probe: OK
[    0.501530] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.501530] jffs2: version 2.2. (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) © 2001-2006 Red Hat, Inc.
[    0.502842] msgmni has been set to 932
[    0.504779] Asymmetric key parser 'x509' registered
[    0.504873] io scheduler noop registered
[    0.504904] io scheduler deadline registered (default)
[    0.506904] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.509184] msm_serial_hs: probe of msm_serial_hs.0 failed with error -2
[    0.509497] msm_serial_hs module loaded
[    0.509746] msm_serial_hsl: detected port #1
[    0.509996] msm_serial_hsl.1: ttyHSL1 at MMIO 0x16340000 (irq = 184) is a MSM
[    0.510465] msm_serial_hsl: console setup on port #1
[    1.413901] console [ttyHSL1] enabled
[    1.418431] msm_serial_hsl: driver initialized
[    1.427491] ahci ahci.0: forcing PORTS_IMPL to 0x1
[    1.431302] ahci ahci.0: AHCI 0001.0300 32 slots 1 ports 6 Gbps 0x1 impl platform mode
[    1.439206] ahci ahci.0: flags: ncq sntf pm led clo only pmp pio slum part ccc apst 
[    1.448297] scsi0 : ahci_platform
[    1.451296] ata1: SATA max UDMA/133 mmio [mem 0x29000000-0x2900017f] port 0x100 irq 241
[    1.461012] msm_nand_probe: phys addr 0x1ac00000 
[    1.464667] msm_nand_probe: dmac 0x3
[    1.468291] msm_nand_probe: allocated dma buffer at ffdfc000, dma_addr 5f6a8000
[    1.476975] status: 20
[    1.478319] nandid: 1580a1c2 maker c2 device a1
[    1.482817] ONFI probe : Found an ONFI compliant device MX30UF1G18AC        \C2
[    1.490128] Found a supported NAND device
[    1.493939] NAND Controller ID : 0x4030
[    1.497844] NAND Device ID  : 0x1580a1c2
[    1.501655] Buswidth : 8 Bits
[    1.504623] Density  : 128 MByte
[    1.507872] Pagesize : 2048 Bytes
[    1.511121] Erasesize: 131072 Bytes
[    1.514589] Oobsize  : 64 Bytes
[    1.517806] CFG0 Init  : 0xa8d408c0
[    1.521180] CFG1 Init  : 0x0004745c
[    1.524648] ECCBUFCFG  : 0x00000203
[    1.528928] Creating 4 MTD partitions on "msm_nand":
[    1.533114] 0x000000000000-0x000002000000 : "rootfs"
[    1.612246] mtd: partition "rootfs" set to be root filesystem
[    1.617838] split_squashfs: no squashfs found in "msm_nand"
[    1.622524] 0x000002000000-0x000004000000 : "opt"
[    1.701187] 0x000004000000-0x000006000000 : "rootfs2"
[    1.779162] 0x000006000000-0x000008000000 : "opt2"
[    1.805279] ata1: SATA link down (SStatus 0 SControl 300)
[    1.861824] m25p80 spi5.0: found s25fl256s1, expected s25fl512s
[    1.866791] m25p80 spi5.0: s25fl256s1 (32768 Kbytes)
[    1.872258] Creating 17 MTD partitions on "m25p80":
[    1.876694] 0x000000000000-0x000000020000 : "SBL1"
[    1.883786] 0x000000020000-0x000000040000 : "MIBIB"
[    1.890096] 0x000000040000-0x000000080000 : "SBL2"
[    1.896251] 0x000000080000-0x000000100000 : "SBL3"
[    1.902467] 0x000000100000-0x000000110000 : "DDRCONFIG"
[    1.909278] 0x000000110000-0x000000120000 : "SSD"
[    1.915526] 0x000000120000-0x0000001a0000 : "TZ"
[    1.921587] 0x0000001a0000-0x000000220000 : "RPM"
[    1.927803] 0x000000220000-0x000000320000 : "APPSBL"
[    1.934145] 0x000000320000-0x000000360000 : "APPSBLENV"
[    1.941455] 0x000000360000-0x000000460000 : "ART"
[    1.947578] 0x000000460000-0x000000480000 : "vendordata"
[    1.954295] 0x000000490000-0x0000004a0000 : "BOOTCONFIG"
[    1.961199] 0x0000004a0000-0x0000009a0000 : "kernel1"
[    1.967978] 0x0000009a0000-0x000000ea0000 : "kernel2"
[    1.974414] 0x000000ea0000-0x0000012a0000 : "user_config"
[    1.981349] 0x0000012a0000-0x000001fa0000 : "recovery"
[    1.989409] UBI: attaching mtd2 to ubi0
[    1.992221] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[    1.998844] UBI: logical eraseblock size:    126976 bytes
[    2.003842] UBI: smallest flash I/O unit:    2048
[    2.008778] UBI: VID header offset:          2048 (aligned 2048)
[    2.014526] UBI: data offset:                4096
[    2.544048] UBI: max. sequence number:       57
[    2.570446] UBI: attached mtd2 to ubi0
[    2.573164] UBI: MTD device name:            "rootfs2"
[    2.578381] UBI: MTD device size:            32 MiB
[    2.583161] UBI: number of good PEBs:        256
[    2.587816] UBI: number of bad PEBs:         0
[    2.592189] UBI: number of corrupted PEBs:   0
[    2.596657] UBI: max. allowed volumes:       128
[    2.601218] UBI: wear-leveling threshold:    4096
[    2.605935] UBI: number of internal volumes: 1
[    2.610340] UBI: number of user volumes:     2
[    2.614745] UBI: available PEBs:             0
[    2.619462] UBI: total number of reserved PEBs: 256
[    2.624054] UBI: number of PEBs reserved for bad PEB handling: 2
[    2.630084] UBI: max/mean erase counter: 77/2
[    2.634364] UBI: image sequence number:  766175402
[    2.639206] UBI: background thread "ubi_bgt0d" started, PID 676
[    2.677788] GPIO Bitbanged MDIO: probed
[    2.680912] i2c /dev entries driver
[    2.691408] cpuidle: using governor ladder
[    2.694501] cpuidle: using governor menu
[    2.699500] TCP: cubic registered
[    2.701780] NET: Registered protocol family 17
[    2.706904] Bridge firewalling registered
[    2.710215] 8021q: 802.1Q VLAN Support v1.8
[    2.714526] VFP support v0.3: implementor 51 architecture 64 part 4d variant 2 rev 0
[    2.722118] Registering SWP/SWPB emulation handler
[    2.726929] clock_late_init: Removing enables held for handed-off clocks
[    2.742924] ipq_nss_get_mac_addr: MAC[0]: 88:b1:e1:24:9a:ff
[    2.747641] ipq_nss_get_mac_addr: MAC[1]: 88:b1:e1:24:9a:fe
[    2.753233] no pmic restart interrupt specified
[    2.771009] VFS: Mounted root (squashfs filesystem) readonly on device 31:21.
[    2.777756] Freeing init memory: 1032K
- preinit -
- regular preinit -
[    7.171540] UBIFS: recovery needed
[    7.366041] UBIFS: recovery completed
[    7.368697] UBIFS: mounted UBI device 0, volume 1, name "ubi_rootfs_data"
[    7.375476] UBIFS: file system size:   18157568 bytes (17732 KiB, 17 MiB, 143 LEBs)
[    7.383067] UBIFS: journal size:       1015809 bytes (992 KiB, 0 MiB, 7 LEBs)
[    7.390221] UBIFS: media format:       w4/r0 (latest is w4/r0)
[    7.396032] UBIFS: default compressor: lzo
[    7.400093] UBIFS: reserved for root:  857626 bytes (837 KiB)
switching to ubifs
- init -

init started:  BusyBox v1.01 (2016.06.22-13:51+0000) multi-call binary
[    9.527741] UBI: attaching mtd3 to ubi1
[    9.530552] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[    9.536863] UBI: logical eraseblock size:    126976 bytes
[    9.542174] UBI: smallest flash I/O unit:    2048
[    9.546891] UBI: VID header offset:          2048 (aligned 2048)
[    9.552858] UBI: data offset:                4096
[   10.006904] UBI: max. sequence number:       69
[   10.028053] UBI: attached mtd3 to ubi1
[   10.030740] UBI: MTD device name:            "opt2"
[   10.035645] UBI: MTD device size:            32 MiB
[   10.040456] UBI: number of good PEBs:        256
[   10.045079] UBI: number of bad PEBs:         0
[   10.049515] UBI: number of corrupted PEBs:   0
[   10.053920] UBI: max. allowed volumes:       128
[   10.058856] UBI: wear-leveling threshold:    4096
[   10.063199] UBI: number of internal volumes: 1
[   10.067666] UBI: number of user volumes:     1
[   10.072071] UBI: available PEBs:             0
[   10.076507] UBI: total number of reserved PEBs: 256
[   10.081349] UBI: number of PEBs reserved for bad PEB handling: 2
[   10.087347] UBI: max/mean erase counter: 25/1
[   10.091690] UBI: image sequence number:  1254854445
[   10.096563] UBI: background thread "ubi_bgt1d" started, PID 1269
[   10.210965] UBIFS: recovery needed
[   10.448328] UBIFS: recovery completed
[   10.451015] UBIFS: mounted UBI device 1, volume 0, name "ubi_opt"
[   10.457107] UBIFS: file system size:   30474240 bytes (29760 KiB, 29 MiB, 240 LEBs)
[   10.464667] UBIFS: journal size:       4317184 bytes (4216 KiB, 4 MiB, 34 LEBs)
[   10.471977] UBIFS: media format:       w4/r0 (latest is w4/r0)
[   10.477788] UBIFS: default compressor: lzo
[   10.481849] UBIFS: reserved for root:  0 bytes (0 KiB)
[   10.747079] jffs2: notice: (1288) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   16.187816] **********************************************************
[   16.193314] * Driver    :NSS GMAC Driver for RTL v(3.72a)
[   16.198719] * Version   :1.0
[   16.201562] * Copyright :Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
[   16.210090] **********************************************************
[   16.427428] nss_driver - fw of size 377152  bytes copied to load addr: 40000000, nss_id : 0
[   16.455576] nss_driver - Turbo Support 1
[   16.458575] Supported Frequencies - 110Mhz 550Mhz 733Mhz 
[   16.546110] nss_driver - fw of size 190784  bytes copied to load addr: 40800000, nss_id : 1
[   16.567416] Error - Duplicate Interface CB Registered for interface 107
[   16.573008] Error - Duplicate Interface CB Registered for interface 110
[   16.674601] NET: Registered protocol family 10
[   16.678881] ADDRCONF(NETDEV_UP): eth0: link is not ready
[   16.683380] ADDRCONF(NETDEV_UP): eth1: link is not ready
Booting in Standalone AP mode
[   16.947360] device eth0 entered promiscuous mode
[   16.955982] ADDRCONF(NETDEV_UP): br0: link is not ready
[   17.007029] led_driver: module license 'Proprietary' taints kernel.
[   17.012308] Disabling lock debugging due to kernel taint
[   17.017931] LED driver initializing
[   17.021087] apmode is 1
[   17.023523] Initializing C120 leds
[   20.219993] br0: port 1(eth0) entered forwarding state
[   20.224273] br0: port 1(eth0) entered forwarding state
[   20.229459] eth0: 1000 Mbps Full Duplex
[   20.233208] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   20.239081] ADDRCONF(NETDEV_CHANGE): br0: link becomes ready
[   37.453889] ath_hal: 0.9.17.1 (AR5416, AR9380, DEBUG, WRITE_EEPROM, 11D)
[   37.462917] ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
[   37.601905] ath_spectral: Version 2.0.0
[   37.601905] Copyright (c) 2005-2009 Atheros Communications, Inc. All Rights Reserved
[   37.612464] SPECTRAL module built on Jun 22 2016 19:12:57
[   37.623180] ath_dfs: Version 2.0.0
[   37.623180] Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
[   37.636207] ath_tx99: Version 2.0
[   37.636207] Copyright (c) 2010 Atheros Communications, Inc, All Rights Reserved
[   37.839737] ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
[   38.961324] ath_pci:  (Atheros/multi-bss)
[   38.964323] ol_ath_pci_probe: PCI device id 0046 :0046
[   38.969447] PCI: enabling device 0000:01:00.0 (0140 -> 0142)
[   38.975132]  *********** Cascade *************
[   38.979662] ath_pci 0000:01:00.0: ath DEBUG: sc=0xd80d5c00
[   38.984942] 
[   38.984942]  ol_ath_pci_configure : num_desired MSI set to 0
[   38.992096] 
[   38.992096]  Using PCI Legacy Interrupt
[   38.997407] chip_id 0xa chip_revision 0x0 
[   39.001468] TARGID is d80d5c00
[   39.004623] TARGID is d80d5c00
[   39.007622] TARGID is d80d5c00
[   39.010652] TARGID is d80d5c00
[   39.023024] 
[   39.023024]  CLOCK PLL skipped 
[   39.028678] __ol_ath_attach: dev name wifi0
[   39.031865] ol_ath_attach() BMI inited.
[   39.035801] ol_ath_attach() BMI Get Target Info.
[   39.040299] Chip id: 0xa, chip version: 0x1000000
[   39.044985] 
[   39.044985]  CE WAR Disabled
[   39.049515] NUM_DEV=1 FWMODE=0x2 FWSUBMODE=0x0 FWBR_BUF 0
[   39.054920] ol_ath_attach() configure Target .
[   39.059262] 
[   39.059262]  Target Version is 1000000
[   39.064323] 
[   39.064323]  Flash Download Address  c0000 
[   39.070009] ol_transfer_bin_file: flash data file defined
[   39.075382] Cal location [0]: 00000000
[   39.079100] 
[   39.079100]  Wifi0 NAND FLASH Select OFFSET 0x1000
[   39.104404] qc98xx_verify_checksum: flash checksum passed: 0x f68
[   39.109559] ol_transfer_bin_file 3782: Download Flash data len 12064
[   39.116088] Board extended Data download address: 0x0
[   39.141049] 
[   39.141049]  Board data initialized
[   39.145048] ol_ath_download_firmware: Download OTP, flash download ADDRESS 0xc0000
[   39.152577] 
[   39.152577]  Selecting  OTP binary for CHIP Version 0
[   39.288128] ol_transfer_bin_file 3639: downloading file 0, Download data len 8844
[   39.323898] 
[   39.323898]  First OTP send param 8000
[   39.332271] ol_ath_download_firmware :First OTP download and Execute is good address:0x400 return param 4660
[   39.341112] ol_ath_download_firmware:##Board Id 1 , CHIP Id 0
[   39.347047] ol_ath_download_firmware: BOARDDATA DOWNLOAD TO address 0xc0000
[   39.572914] ol_transfer_bin_file: Board Data File download to address=0xc0000 file name=QCA9984/hw.1/boardData_QCA9984_CUS239_5G_v1_001.bin
[   39.735301] ol_transfer_bin_file 3639: downloading file 3, Download data len 12832
[   39.742049] Board extended Data download address: 0x0
[   39.768634] ol_ath_download_firmware: Using 0x1234 for the remainder of init
[   39.774664] 
[   39.774664]  Selecting  OTP binary for CHIP Version 0
[   39.801437] ol_transfer_bin_file 3639: downloading file 0, Download data len 8844
[   39.837207] 
[   39.837207]  [Flash] : Ignore Module param
[   39.841830] 
[   39.841830]  Second otp download Param 10000 
[   39.859262] ol_ath_download_firmware : Second OTP download and Execute is good, param=0x0 
[   39.866541] 
[   39.866541]  Mission mode: Firmware CHIP Version 0
[   39.894220] ol_swap_seg_alloc: Successfully allocated memory for SWAP size=262144 
[   39.921961] Swap: bytes_left to copy: fw:16; dma_page:87516
[   39.926616] Swap: wrong length read:0
[   39.930178] ol_swap_wlan_memory_expansion: Swap total_bytes copied: 174628 Target address 41b868 
[   39.939331] scn=d81c0480  target_write_addr=41b868 seg_info=d9d6fa10 
[   39.945517] ol_transfer_swap_struct:Code swap structure successfully downloaded for bin type =2 
[   39.954264] bin_filename=QCA9984/hw.1/athwlan.bin swap_filename=/lib/firmware/QCA9984/hw.1/athwlan.codeswap.bin 
[   39.964511] ol_transfer_bin_file: Downloading firmware file: QCA9984/hw.1/athwlan.bin
[   40.439612] ol_transfer_bin_file 3639: downloading file 1, Download data len 359816
[   41.613277] ol_ath_attach() Download FW done. 
[   41.616776] ol_ath_attach() HT Create .
[   41.620524] ol_ath_attach() HIF Claim.
[   41.624304] ol_ath_attach() BMI Done. 
[   41.628022] ol_ath_attach 7578 host_enable 0 nss_nwifi_offload 0
[   41.633989] ol_ath_set_default_tgt_config : AC Minfree buffer allocation through module param (umac.ko)
[   41.643392]  OL_ACBKMinfree : 0
[   41.646485]  OL_ACBEMinfree : 0
[   41.649609]  OL_ACVIMinfree : 0
[   41.652827]  OL_ACVOMinfree : 0
[   41.655888] ol_ath_attach() WMI attached. wmi_handle d82e0000 
[   41.664667] CE_recv_buf_enqueue 853 Populate last entry 512 for CE 5
[   41.670040] CE_recv_buf_enqueue 862 CE 5 wi 511 dest_ptr 0x58646040 nbytes 0 recv_ctxt 0xd818c840
[   41.679381] Startup Mode-0 set
[   41.681911] 
[   41.681911] <=== cfg max peer id 1056 ====>
[   41.687722] HTC Service:0x0300 ep:1 TX flow control disabled
[   41.695095] htt_peer_map_timer_init Enter pdev d71c8000 hrtimer d71cc890
[   41.700874] 
[   41.700874]  htt_alloc_peer_map_mem : Alloc Success : host q vaddr d6e68000 paddr 58368000
[   41.710559] 
[   41.710559]  htt_alloc_peer_map_mem : Flush Interval Configured to 256 pkts
[   41.719056] CE_pkt_dl_len_set CE 4 Pkt download length 64
[   41.724398] ol_txrx_pdev_attach: 2500 tx desc's allocated ; range starts from d6e80000
[   41.732552] HTC Service:0x0100 ep:2 TX flow control disabled
[   41.738644] wmi_service_ready_event_rx:  WMI UNIFIED SERVICE READY event 
[   41.744611] Firmware_Build_Number:33 
[   41.748266] host/RAM_fw Build Ver Mismatch: H:0x1B, F:0x21 ! 
[...
[   42.076944] wmi_ready_event_rx:  WMI UNIFIED READY event 
[   42.081349] ol_ath_connect_htc() WMI is ready
[   42.085816] target uses HTT version 2.2; host uses 2.2
[   42.095845] ol_ath_attach() connect HTC. 
...
[   42.430053] rate power table override is only supported for AR98XX
...
[   42.659856] __ol_ath_attach: dev name wifi1
[   42.659887] ol_ath_attach() BMI inited.
[   42.866166] ol_ath_attach() BMI Get Target Info.
[   42.866416] 0x12, 0x1e, 0x94c, 0x94c, 0x0 )
[   42.866416] [wifi0] FWLOG: [42851] WAL_DBGID_TX_AC_BUFFER_SET ( 0x45, 0x1e, 0x94c, 0x94c, 0x0 )
[   42.866447] [wifi0] FWLOG: [42851] WAL_DBGID_TX_AC_BUFFER_SET ( 0x67, 0x1e, 0x94c, 0x94c, 0x0 )
[   42.891565] Chip id: 0xa, chip version: 0x1000000
[   42.896251]  CE WAR Disabled
[   42.900749] NUM_DEV=1 FWMODE=0x2 FWSUBMODE=0x0 FWBR_BUF 0
[   42.906248] ol_ath_attach() configure Target .
[   42.910527]  Target Version is 1000000
[   42.915651]  Flash Download Address  c0000 
[   42.921305] ol_transfer_bin_file: flash data file defined
[   42.926679] Cal location [1]: 00004000
[   42.930427]  wifi1 NAND FLASH Select OFFSET 0x5000
[   42.955701] qc98xx_verify_checksum: flash checksum passed: 0xfbbf
[   42.960855] ol_transfer_bin_file 3782: Download Flash data len 12064
[   42.967322] Board extended Data download address: 0x0
[   42.992471]  Board data initialized
[   42.996501] ol_ath_download_firmware: Download OTP, flash download ADDRESS 0xc0000
[   43.003967]  Selecting  OTP binary for CHIP Version 0
[   43.030677] ol_transfer_bin_file 3639: downloading file 0, Download data len 8844
[   43.066541]  First OTP send param 8000
[   43.074914] ol_ath_download_firmware :First OTP download and Execute is good address:0x800 return param 4660
[   43.083817] ol_ath_download_firmware:##Board Id 2 , CHIP Id 0
[   43.089597] ol_ath_download_firmware: BOARDDATA DOWNLOAD TO address 0xc0000
[   43.096469] ol_transfer_bin_file: Board Data File download to address=0xc0000 file name=QCA9984/hw.1/boardData_QCA9984_CUS260_2G_v1_002.bin
[   43.129209] ol_transfer_bin_file 3639: downloading file 3, Download data len 12064
[   43.135988] Board extended Data download address: 0x0
[   43.161293] ol_ath_download_firmware: Using 0x1234 for the remainder of init
[   43.167447]  Selecting  OTP binary for CHIP Version 0
[   43.194158] ol_transfer_bin_file 3639: downloading file 0, Download data len 8844
...
[   43.234582]  Second otp download Param 10000 
[   43.252077] ol_ath_download_firmware : Second OTP download and Execute is good, param=0x0 
[   43.259356] 
[   43.259356]  Mission mode: Firmware CHIP Version 0
[   43.286972] ol_swap_seg_alloc: Successfully allocated memory for SWAP size=262144 
[   43.314807] Swap: bytes_left to copy: fw:16; dma_page:87516
[   43.319368] Swap: wrong length read:0
[   43.322992] ol_swap_wlan_memory_expansion: Swap total_bytes copied: 174628 Target address 41b868 
[   43.332021] scn=d6a80480  target_write_addr=41b868 seg_info=d9d6f510 
[   43.338363] ol_transfer_swap_struct:Code swap structure successfully downloaded for bin type =2 
[   43.347079] bin_filename=QCA9984/hw.1/athwlan.bin swap_filename=/lib/firmware/QCA9984/hw.1/athwlan.codeswap.bin 
[   43.357263] ol_transfer_bin_file: Downloading firmware file: QCA9984/hw.1/athwlan.bin
[   43.387222] ol_transfer_bin_file 3639: downloading file 1, Download data len 359816
[   44.565010] ol_ath_attach() Download FW done. 
[   44.568509] ol_ath_attach() HT Create .
[   44.572258] ol_ath_attach() HIF Claim.
[   44.576163] ol_ath_attach() BMI Done. 
[   44.579756] ol_ath_attach 7578 host_enable 0 nss_nwifi_offload 0
...
[   44.696126] Firmware_Build_Number:33 
[   44.699750] host/RAM_fw Build Ver Mismatch: H:0x1B, F:0x21 ! 
[   44.705498] num_rf_chain:0x00000004  ht_cap_info:0x0000085b  vht_cap_info:0x339b79f2  vht_supp_mcs:0x0000ffea
[   44.715401]  RES CFG Support wmi_service_bitmap 9778 
...
[   49.491471]  pktlog_init: Initializing Pktlog for AR900B, pktlog_hdr_size = 16
[   49.497906]  pktlog_init: Initializing Pktlog for AR900B, pktlog_hdr_size = 16
[   49.504935]  pktlog_init: Initializing Pktlog for AR9888, pktlog_hdr_size = 12
...
Jan  1 00:00:56 passwd[5592]: password changed 

/bin/sh: cannot create /proc/simple_config/led1_glisten: Directory nonexistent

 (none) armv7l #1 SMP PREEMPT Wed Jun 22 19:02:55 IST 2016 (none)

(none) login:

Next steps:

  • See what I can dump of the existing flash
  • Get basic image built with the image builder and attempt boot from TFTP

Mojo C-130 - Front
Mojo C-130 - Front1920×1887 42.5 KB

Top side with indicator LEDs
Mojo C-130 - Bottom
Mojo C-130 - Bottom4032×3024 412 KB

Underside with 2x 1Gb Ethernet 1x PoE+ and DC power
Mojo C-130 - Serial-USB
Mojo C-130 - Serial-USB1920×1440 65.2 KB

Side with cover removed showing reset button, USB, and serial console

1 Like
2

I thought I was making some progress by getting an image configured and built for the target IPQ806X but booting it has me stumped at the moment. U-Boot is not behaving nicely with the network and I suspect it has something to do with the ethernet driver using spaces in the device names.

(IPQ) # mii info


PHY 0x02: OUI = 0x1374, Model = 0x07, Rev = 0x04, 100baseT, FDX
PHY 0x03: OUI = 0x1374, Model = 0x07, Rev = 0x04,  10baseT, HDX
(IPQ) # mii device


MII devices: 'IPQ MDIO2' 'IPQ MDIO3' 
Current device: 'IPQ MDIO2'
(IPQ) # print ethact


ethact=eth0
(IPQ) # setenv ethact 'IPQ MDIO2'


(IPQ) # print ethact


ethact=IPQ MDIO2
(IPQ) # ping 192.168.1.244


Using eth0 device
ping failed; host 192.168.1.244 is not alive
(IPQ) # print ethact


ethact=eth0
(IPQ) #

USB might also be an option but I haven't figured out the correct offsets needed to load from a USB drive yet, only encountered xhci errors so far.

3

Said who? Note that your two Ethernet interfaces are called eth0 and eth1 in U-Boot. BTW: What Ethernet cable did you actually plug in to what exactly?

4

I tried both eth0 and eth1 initially and was not able to capture any activity on the host device when in the factory U-Boot which made me think maybe I needed the names reported by mii and ran into the behavior above.

Some background, I initially connected directly to a Raspberry Pi 4 with a regular patch cable and confirmed with tcpdump there is activity and it successfully pulls an IP from the local DHCP server when booting normally. When in U-Boot, I was not able to see any activity in tcpdump. I also tried a patch cable just in case there was some auto negotiation magic that happened at a different level of the boot sequence but still unable to capture any activity from U-Boot.

5

That is, the tftp fw.bin and tftpboot fw.bin commands does not work?

6

Correct, the tftpboot does not produce any network packet activity and just gives what I presume are timeouts until I manually ctrl+c abort:

(IPQ) # tftpboot openwrt-ipq806x-generic-qcom_ipq8064-ap148-squashfs-nand-sysupgrade.bin
Using eth0 device
TFTP from server 192.168.1.244; our IP address is 192.168.1.245
Filename 'openwrt-ipq806x-generic-qcom_ipq8064-ap148-squashfs-nand-sysupgrade.bin'.
Load address: 0x44000000
Loading: T T T T T T 
Abort
7

try setting your interface to the lowest possible MTU (500 or 600)

8

I tried setting the MTU to 500 and 600, still no difference:

On the Raspberry Pi:

pi@raspberrypi:~ $ ip addr show dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 500 qdisc mq state UP group default qlen 1000
    link/ether dc:a6:32:c6:23:75 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.244/24 brd 192.168.1.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever

With that set at 500 I tried to ping .244 from U-Boot and the local .245 address from U-Boot with no activity:

(IPQ) # ping 192.168.1.244           
Using eth0 device
ping failed; host 192.168.1.244 is not alive
(IPQ) # print ipaddr
ipaddr=192.168.1.245
(IPQ) # ping 192.168.1.245
Using eth0 device
ping failed; host 192.168.1.245 is not alive
(IPQ) # mii info
PHY 0x02: OUI = 0x1374, Model = 0x07, Rev = 0x04, 100baseT, FDX
PHY 0x03: OUI = 0x1374, Model = 0x07, Rev = 0x04,  10baseT, HDX
(IPQ) # mii device 
MII devices: 'IPQ MDIO2' 'IPQ MDIO3' 
Current device: 'IPQ MDIO2'
(IPQ) # tftpboot openwrt-ipq806x-generic-qcom_ipq8064-ap148-squashfs-nand-sysupgrade.bin
Using eth0 device
TFTP from server 192.168.1.244; our IP address is 192.168.1.245
Filename 'openwrt-ipq806x-generic-qcom_ipq8064-ap148-squashfs-nand-sysupgrade.bin'.
Load address: 0x44000000
Loading: T T T T T T T T T T T T T T 
Abort

This is all I see with tcpdump on the Pi with MTU 1500, 600, and 500:

pi@raspberrypi:~ $ sudo tcpdump -i eth0 -vv
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes

I noticed the Pi was reporting a link of 1000baseT but mii info in U-Boot has 100baseT. Both agree on full duplex. Forcing the Pi to 100baseT didn't make any difference.

pi@raspberrypi:~ $ ethtool eth0
Settings for eth0:
	Supported ports: [ TP MII ]
	Supported link modes:   10baseT/Half 10baseT/Full 
	                        100baseT/Half 100baseT/Full 
	                        1000baseT/Half 1000baseT/Full 
	Supported pause frame use: Symmetric Receive-only
	Supports auto-negotiation: Yes
	Supported FEC modes: Not reported
	Advertised link modes:  100baseT/Full 
	Advertised pause frame use: Symmetric Receive-only
	Advertised auto-negotiation: Yes
	Advertised FEC modes: Not reported
	Link partner advertised link modes:  10baseT/Half 10baseT/Full 
	                                     100baseT/Half 100baseT/Full 
	                                     1000baseT/Full 
	Link partner advertised pause frame use: Symmetric Receive-only
	Link partner advertised auto-negotiation: Yes
	Link partner advertised FEC modes: Not reported
	Speed: 100Mb/s
	Duplex: Full
	Port: Twisted Pair
	PHYAD: 1
	Transceiver: internal
	Auto-negotiation: on
	MDI-X: Unknown
Cannot get wake-on-lan settings: Operation not permitted
	Current message level: 0x00000007 (7)
			       drv probe link
	Link detected: yes
9

U-Boot commands on Xiaomi R3D:

U-Boot 2012.07 [ ,uart_en] (Nov 02 2017 - 17:14:39)

smem ram ptable found: ver: 0 len: 5
DRAM:  494 MiB
NAND:  SF: Unsupported manufacturer 00
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
PCI0 Link Intialized
PCI1 Link Intialized
In:    serial
Out:   serial
Err:   serial
cdp: get part failed for 0:HLOS
cdp: get part failed for rootfs
Net:   MAC1 addr:40:31:3c:dc:1e:b2
athrs17_reg_init: complete
athrs17_vlan_config ...done
S17c init  done
MAC2 addr:40:31:3c:dc:1e:b3
eth0, eth1
Hit any key to stop autoboot:  0

(IPQ) # ping 192.168.31.100
Using eth1 device
host 192.168.31.100 is alive
(IPQ) # print ipaddr
ipaddr=192.168.31.1
(IPQ) # mii info
PHY 0x00: OUI = 0x1374, Model = 0x03, Rev = 0x06, 100baseT, FDX
PHY 0x01: OUI = 0x1374, Model = 0x03, Rev = 0x06,  10baseT, HDX
PHY 0x02: OUI = 0x1374, Model = 0x03, Rev = 0x06,  10baseT, HDX
PHY 0x03: OUI = 0x1374, Model = 0x03, Rev = 0x06,  10baseT, HDX
PHY 0x04: OUI = 0x1374, Model = 0x03, Rev = 0x06,  10baseT, HDX
PHY 0x10: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x11: OUI = 0xC1000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x12: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x13: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x14: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x15: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x16: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x17: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x18: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
(IPQ) # mii device
MII devices: 'IPQ MDIO1' 'IPQ MDIO2'
Current device: 'IPQ MDIO2'
(IPQ) #
10

Thanks @remittor that did help understand that it should be a working configuration. I kept trying different configurations and found if I move the cable to eth1 and powercycle after the cable was moved, then I can setenv ethact eth1 and get ping/tftpboot to work. Previously I started plugged into eth0 and had swapped ports to test but must have only used the u-boot reset so it was not functional.

I suspect eth0 being a poe+ port might need some extra configuration to function.

Now I just need to get a correct setup for the boot files and I can start testing image configurations.

11

A little progress, certainly have work to do to better understand the kernel configuration and boot parameters but I can get it to attempt booting from the initram image loaded in memory over TFTP.

Right now it attempts to start the kernel and hangs.

(IPQ) # tftpboot openwrt-ipq806x-generic-qcom_ipq8064-ap148-initramfs-fit-uImage.itb
Using eth1 device
TFTP from server 192.168.1.244; our IP address is 192.168.1.245
Filename 'openwrt-ipq806x-generic-qcom_ipq8064-ap148-initramfs-fit-uImage.itb'.
Load address: 0x44000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ################################################
done
Bytes transferred = 12147692 (b95bec hex)
(IPQ) # bootm 44000000
## Booting kernel from FIT Image at 44000000 ...
   Using 'config@1' configuration
   Trying 'kernel@1' kernel subimage
     Description:  ARM OpenWrt Linux-5.4.154
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x440000e4
     Data Size:    12118209 Bytes = 11.6 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x42208000
     Entry Point:  0x42208000
     Hash algo:    crc32
     Hash value:   d4e36ffe
     Hash algo:    sha1
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Flattened Device Tree from FIT Image at 44000000
   Using 'config@1' configuration
   Trying 'fdt@1' FDT blob subimage
     Description:  ARM OpenWrt qcom_ipq8064-ap148 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x44b8eae4
     Data Size:    27608 Bytes = 27 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   bf4b228b
     Hash algo:    sha1
     Hash value:   36a8618d7c008d65af55a5ce8caa303834681075
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x44b8eae4
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 5eaf6000, end 5eaffbd7 ... OK
MMC Device 0 not found
cdp: get part failed for rootfs
MMC Device 0 not found
cdp: get part failed for opt
mtdparts = mtdparts=nand0:0x2000000@0(rootfs);nand1:128K@0x0(0:SBL1),128K@0x20000(0:MIBIB),256K@0x40000(0:SBL2),512K@0x80000(0:SBL3),64K@0x100000(0:DDRCONFIG),64K@0x110000(0:SSD),512K@0x120000(0:TZ),512K@0x1a0000(0:RPM),1024K@0x220000(0:APPSBL),256K@0x320000(0:APPSBLENV),1024K@0x360000(0:ART),128K@0x460000(0:VENDORDATA),64K@0x490000(0:BOOTCONFIG),5M@0x4a0000(0:HLOS),5M@0x9a0000(0:HLOS1),4M@0xea0000(0:UCONFIG),13M@0x12a0000(0:RECOVERY),
Using machid 0x1260 from environment

Starting kernel ...
12

Hi, is it crashing or just not producing output? The factory image uses ttyHSL1 for the output and pushes that into the command line, does your dts have that tty defined?

If there’s no valid tty in the command line you won’t get output.

If that’s not it, try extracting just the kernel.bin from your openwrt image and tftp that, the old kernel is 1/4 the size, possible memory range or size issue

13

That is a good question about the output versus crashing. I will dig deeper to see if I can determine any issues with the serial configuration in the images I am building, otherwise I will jump to booting the kernel only. Thanks for the tips!

14

Try to refuse FIT images.
Take a look here: https://github.com/openwrt-xiaomi/openwrt/commit/912fe9a77a7ea920b3fded09bd667c6337aea0f4
Legacy image: https://github.com/openwrt-xiaomi/openwrt/blob/912fe9a77a7ea920b3fded09bd667c6337aea0f4/target/linux/ipq806x/image/Makefile#L397
Boot log from xiaomi R3D: https://pastebin.com/h8Hgm0nV

15

Would suggest you look at using the Edge-core ECW5410 or Meraki MR52 as a template as these devices are very similar.

As for the uboot issue it is quite possible there is a GPIO config needed to activate the Ethernet PHYs. Are you able to browse the stock OS for any relevant init scripts?

Also from the stock OS can you run devmem or devmem2? If so can you run the devmem script from here and report what you get. This may be useful for determining which GPIOs to use.

Adapt as required:

echo -e "pin\treg\t\tval"; for p in $(seq 0 68); do print
f "%2d\t0x801%02x0\t" $p $p; ./busybox devmem 0x801$(printf "%02x" $p)0; done
16

I did a quick test compiling against the Edge-core ECW5410 profile, since it was already in 21.02 tag I had checked out locally, and was able to successfully boot to the OpenWRT prompt, which is encouraging. As expected no PHYs came up but I now have a workflow to test with.

(IPQ) # setenv ethact eth1
(IPQ) # tftpboot openwrt-ipq806x-generic-edgecore_ecw5410-initramfs-fit-uImage.itb
Using eth1 device
TFTP from server 192.168.1.244; our IP address is 192.168.1.245
Filename 'openwrt-ipq806x-generic-edgecore_ecw5410-initramfs-fit-uImage.itb'.
Load address: 0x44000000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #############################
done
Bytes transferred = 16640720 (fdead0 hex)
(IPQ) # bootm
## Booting kernel from FIT Image at 44000000 ...
   Using 'config@v2.0-ap160' configuration
   Trying 'kernel@1' kernel subimage
     Description:  ARM OpenWrt Linux-5.4.154
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x440000e4
     Data Size:    16608678 Bytes = 15.8 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x42208000
     Entry Point:  0x42208000
     Hash algo:    crc32
     Hash value:   0ea50e75
     Hash algo:    sha1
     Hash value:   45a91836a9d482d9cc6fdc0ac9f9517e686fb647
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Flattened Device Tree from FIT Image at 44000000
   Using 'config@v2.0-ap160' configuration
   Trying 'fdt@1' FDT blob subimage
     Description:  ARM OpenWrt edgecore_ecw5410 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x44fd6fc8
     Data Size:    30150 Bytes = 29.4 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   b22913da
     Hash algo:    sha1
     Hash value:   44ba9d10c9fd3bfedd69caedaa72c4ae8eb1a7a8
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x44fd6fc8
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 5eaf5000, end 5eaff5c5 ... OK
MMC Device 0 not found
cdp: get part failed for rootfs
MMC Device 0 not found
cdp: get part failed for opt
mtdparts = mtdparts=nand0:0x2000000@0(rootfs);nand1:128K@0x0(0:SBL1),128K@0x20000(0:MIBIB),256K@0x40000(0:SBL2),512K@0x80000(0:SBL3),64K@0x100000(0:DDRCONFIG),64K@0x110000(0:SSD),512K@0x120000(0:TZ),512K@0x1a0000(0:RPM),1024K@0x220000(0:APPSBL),256K@0x320000(0:APPSBLENV),1024K@0x360000(0:ART),128K@0x460000(0:VENDORDATA),64K@0x490000(0:BOOTCONFIG),5M@0x4a0000(0:HLOS),5M@0x9a0000(0:HLOS1),4M@0xea0000(0:UCONFIG),13M@0x12a0000(0:RECOVERY),
Using machid 0x1260 from environment

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 5.4.154 (jacob@OpenWRT-BuildServer) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16325-88151b8303)) #0 SMP Sun Oct 24 09:01:35 2021
[    0.000000] CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c5787d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] OF: fdt: Machine model: Edgecore ECW5410
[    0.000000] OF: fdt: Ignoring memory range 0x40000000 - 0x42000000
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] percpu: Embedded 15 pages/cpu s30156 r8192 d23092 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 120264
[    0.000000] Kernel command line: console=ttyHSL1,115200n8 ubi.mtd=rootfs2 root=mtd:ubi_rootfs rootfstype=squashfs console=ttyMSM0,115200n8 root=/dev/ubiblock0_1
[    0.000000] Bootloader command line not present
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 458488K/485376K available (6083K kernel code, 193K rwdata, 1532K rodata, 13312K init, 231K bss, 26888K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] random: get_random_bytes called from start_kernel+0x340/0x4ec with crng_init=0
[    0.000000] clocksource: dg_timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 305801671480 ns
[    0.000007] sched_clock: 32 bits at 6MHz, resolution 160ns, wraps every 343597383600ns
[    0.000019] Switching to timer-based delay loop, resolution 160ns
[    0.000229] Calibrating delay loop (skipped), value calculated using timer frequency.. 12.50 BogoMIPS (lpj=62500)
[    0.000249] pid_max: default: 32768 minimum: 301
[    0.000460] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.000478] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.001516] CPU: Testing write buffer coherency: ok
[    0.002668] Setting up static identity map for 0x42300000 - 0x42300060
[    0.002849] rcu: Hierarchical SRCU implementation.
[    0.003336] smp: Bringing up secondary CPUs ...
[    0.005242] smp: Brought up 1 node, 2 CPUs
[    0.005258] SMP: Total of 2 processors activated (25.00 BogoMIPS).
[    0.005269] CPU: All CPU(s) started in SVC mode.
[    0.015243] VFP support v0.3: implementor 51 architecture 64 part 4d variant 2 rev 0
[    0.015392] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.015420] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.015564] pinctrl core: initialized pinctrl subsystem
[    0.016743] NET: Registered protocol family 16
[    0.017080] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.018485] cpuidle: using governor ladder
[    0.018554] cpuidle: using governor menu
[    0.049687] usbcore: registered new interface driver usbfs
[    0.049772] usbcore: registered new interface driver hub
[    0.049842] usbcore: registered new device driver usb
[    0.049905] pps_core: LinuxPPS API ver. 1 registered
[    0.049918] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.049953] PTP clock support registered
[    0.050772] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[    0.052037] clocksource: Switched to clocksource dg_timer
[    0.052935] thermal_sys: Registered thermal governor 'step_wise'
[    0.055370] NET: Registered protocol family 2
[    0.055544] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.056226] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.056267] TCP established hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.056307] TCP bind hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.056360] TCP: Hash tables configured (established 4096 bind 4096)
[    0.056460] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.056494] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.056742] NET: Registered protocol family 1
[    0.056804] PCI: CLS 0 bytes, default 64
[    2.023225] workingset: timestamp_bits=14 max_order=17 bucket_order=3
[    2.033848] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    2.033870] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    2.110473] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda not found, using dummy regulator
[    2.110669] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda_phy not found, using dummy regulator
[    2.110863] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda_refclk not found, using dummy regulator
[    2.111301] qcom-pcie 1b700000.pci: host bridge /soc/pci@1b700000 ranges:
[    2.111410] qcom-pcie 1b700000.pci:    IO 0x31e00000..0x31efffff -> 0x31e00000
[    2.111471] qcom-pcie 1b700000.pci:   MEM 0x2e000000..0x31dfffff -> 0x2e000000
[    2.339397] qcom-pcie 1b700000.pci: Link up
[    2.339655] qcom-pcie 1b700000.pci: PCI host bridge to bus 0001:00
[    2.339690] pci_bus 0001:00: root bus resource [bus 00-ff]
[    2.339721] pci_bus 0001:00: root bus resource [io  0x0000-0xfffff] (bus address [0x31e00000-0x31efffff])
[    2.339749] pci_bus 0001:00: root bus resource [mem 0x2e000000-0x31dfffff]
[    2.339847] pci 0001:00:00.0: [17cb:0101] type 01 class 0xff0000
[    2.340065] pci 0001:00:00.0: supports D1
[    2.340092] pci 0001:00:00.0: PME# supported from D0 D1 D3hot
[    2.346307] PCI: bus0: Fast back to back transfers disabled
[    2.346761] pci 0001:01:00.0: [168c:0046] type 00 class 0x028000
[    2.347151] pci 0001:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    2.348381] pci 0001:01:00.0: PME# supported from D0 D3hot D3cold
[    2.354754] PCI: bus1: Fast back to back transfers disabled
[    2.354886] pci 0001:00:00.0: BAR 8: assigned [mem 0x2e000000-0x2e1fffff]
[    2.354926] pci 0001:01:00.0: BAR 0: assigned [mem 0x2e000000-0x2e1fffff 64bit]
[    2.355072] pci 0001:00:00.0: PCI bridge to [bus 01-ff]
[    2.355109] pci 0001:00:00.0:   bridge window [mem 0x2e000000-0x2e1fffff]
[    2.356304] pcieport 0001:00:00.0: AER: enabled with IRQ 35
[    2.357070] qcom-pcie 1b900000.pci: 1b900000.pci supply vdda not found, using dummy regulator
[    2.357268] qcom-pcie 1b900000.pci: 1b900000.pci supply vdda_phy not found, using dummy regulator
[    2.357432] qcom-pcie 1b900000.pci: 1b900000.pci supply vdda_refclk not found, using dummy regulator
[    2.357865] qcom-pcie 1b900000.pci: host bridge /soc/pci@1b900000 ranges:
[    2.357966] qcom-pcie 1b900000.pci:    IO 0x35e00000..0x35efffff -> 0x35e00000
[    2.358020] qcom-pcie 1b900000.pci:   MEM 0x32000000..0x35dfffff -> 0x32000000
[    2.579286] qcom-pcie 1b900000.pci: Link up
[    2.579534] qcom-pcie 1b900000.pci: PCI host bridge to bus 0002:00
[    2.579565] pci_bus 0002:00: root bus resource [bus 00-ff]
[    2.579592] pci_bus 0002:00: root bus resource [mem 0x32000000-0x35dfffff]
[    2.579681] pci 0002:00:00.0: [17cb:0101] type 01 class 0xff0000
[    2.579880] pci 0002:00:00.0: supports D1
[    2.579904] pci 0002:00:00.0: PME# supported from D0 D1 D3hot
[    2.586066] PCI: bus0: Fast back to back transfers disabled
[    2.586511] pci 0002:01:00.0: [168c:003c] type 00 class 0x028000
[    2.586904] pci 0002:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    2.587353] pci 0002:01:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    2.588251] pci 0002:01:00.0: supports D1
[    2.588274] pci 0002:01:00.0: PME# supported from D0 D1 D3hot
[    2.594664] PCI: bus1: Fast back to back transfers disabled
[    2.594786] pci 0002:00:00.0: BAR 8: assigned [mem 0x32000000-0x322fffff]
[    2.594825] pci 0002:01:00.0: BAR 0: assigned [mem 0x32000000-0x321fffff 64bit]
[    2.594979] pci 0002:01:00.0: BAR 6: assigned [mem 0x32200000-0x3220ffff pref]
[    2.595008] pci 0002:00:00.0: PCI bridge to [bus 01-ff]
[    2.595041] pci 0002:00:00.0:   bridge window [mem 0x32000000-0x322fffff]
[    2.596265] pcieport 0002:00:00.0: AER: enabled with IRQ 37
[    2.600078] L2 @ QSB rate. Forcing new rate.
[    2.600384] L2 @ 384000 KHz
[    2.600601] CPU0 @ 800000 KHz
[    2.600620] CPU1 @ QSB rate. Forcing new rate.
[    2.600911] CPU1 @ 384000 KHz
[    2.606722] gsbi 12440000.gsbi: GSBI port protocol: 4 crci: 0
[    2.607800] gsbi 16300000.gsbi: GSBI port protocol: 6 crci: 0
[    2.608798] gsbi 1a200000.gsbi: GSBI port protocol: 3 crci: 0
[    2.610894] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    2.612513] msm_serial 12450000.serial: msm_serial: detected port #1
[    2.612607] msm_serial 12450000.serial: uartclk = 25000000
[    2.612716] 12450000.serial: ttyMSM1 at MMIO 0x12450000 (irq = 38, base_baud = 1562500) is a MSM
[    2.613130] msm_serial 16340000.serial: msm_serial: detected port #0
[    2.613202] msm_serial 16340000.serial: uartclk = 7372800
[    2.613300] 16340000.serial: ttyMSM0 at MMIO 0x16340000 (irq = 39, base_baud = 460800) is a MSM
[    2.613348] msm_serial: console setup on port #0
[    3.447632] printk: console [ttyMSM0] enabled
[    3.452818] msm_serial: driver initialized
[    3.465039] loop: module loaded
[    3.466886] spi_qup 1a280000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    3.469708] spi-nor spi0.0: s25fl256s1 (32768 Kbytes)
[    3.474507] 17 qcom-smem partitions found on MTD device spi0.0
[    3.479326] Creating 17 MTD partitions on "spi0.0":
[    3.485160] 0x000000000000-0x000000020000 : "0:SBL1"
[    3.491375] 0x000000020000-0x000000040000 : "0:MIBIB"
[    3.496491] 0x000000040000-0x000000080000 : "0:SBL2"
[    3.501349] 0x000000080000-0x000000100000 : "0:SBL3"
[    3.506506] 0x000000100000-0x000000110000 : "0:DDRCONFIG"
[    3.511318] 0x000000110000-0x000000120000 : "0:SSD"
[    3.516739] 0x000000120000-0x0000001a0000 : "0:TZ"
[    3.521330] 0x0000001a0000-0x000000220000 : "0:RPM"
[    3.526283] 0x000000220000-0x000000320000 : "0:APPSBL"
[    3.530957] 0x000000320000-0x000000360000 : "0:APPSBLENV"
[    3.536316] 0x000000360000-0x000000460000 : "0:ART"
[    3.541666] 0x000000460000-0x000000480000 : "0:VENDORDATA"
[    3.546481] 0x000000490000-0x0000004a0000 : "0:BOOTCONFIG"
[    3.551878] 0x0000004a0000-0x0000009a0000 : "0:HLOS"
[    3.557419] 0x0000009a0000-0x000000ea0000 : "0:HLOS1"
[    3.562620] 0x000000ea0000-0x0000012a0000 : "0:UCONFIG"
[    3.567437] 0x0000012a0000-0x000001fa0000 : "0:RECOVERY"
[    3.574017] mdio-gpio soc:mdio: failed to get alias id
[    3.576808] libphy: GPIO Bitbanged MDIO: probed
[    3.582984] mdio_bus gpio-0: MDIO device at address 0 is missing.
[    3.587285] mdio_bus gpio-0: MDIO device at address 1 is missing.
[    3.593360] libphy: Fixed MDIO Bus: probed
[    3.598770] ipq806x-gmac-dwmac 37400000.ethernet: IRQ eth_wake_irq not found
[    3.602436] ipq806x-gmac-dwmac 37400000.ethernet: IRQ eth_lpi not found
[    3.609906] ipq806x-gmac-dwmac 37400000.ethernet: PTP uses main clock
[    3.617012] ipq806x-gmac-dwmac 37400000.ethernet: User ID: 0x10, Synopsys ID: 0x37
[    3.622606] ipq806x-gmac-dwmac 37400000.ethernet: 	DWMAC1000
[    3.629939] ipq806x-gmac-dwmac 37400000.ethernet: DMA HW capability register supported
[    3.635854] ipq806x-gmac-dwmac 37400000.ethernet: RX Checksum Offload Engine supported
[    3.643571] ipq806x-gmac-dwmac 37400000.ethernet: COE Type 2
[    3.651376] ipq806x-gmac-dwmac 37400000.ethernet: TX Checksum insertion supported
[    3.657284] ipq806x-gmac-dwmac 37400000.ethernet: Wake-Up On Lan supported
[    3.664660] ipq806x-gmac-dwmac 37400000.ethernet: Enhanced/Alternate descriptors
[    3.671345] ipq806x-gmac-dwmac 37400000.ethernet: Enabled extended descriptors
[    3.678999] ipq806x-gmac-dwmac 37400000.ethernet: Ring mode enabled
[    3.686028] ipq806x-gmac-dwmac 37400000.ethernet: Enable RX Mitigation via HW Watchdog Timer
[    3.692109] ipq806x-gmac-dwmac 37400000.ethernet: device MAC address 5a:e4:a3:d9:38:46
[    4.273922] libphy: stmmac: probed
[    4.275293] ipq806x-gmac-dwmac 37600000.ethernet: IRQ eth_wake_irq not found
[    4.276246] ipq806x-gmac-dwmac 37600000.ethernet: IRQ eth_lpi not found
[    4.283875] ipq806x-gmac-dwmac 37600000.ethernet: PTP uses main clock
[    4.290258] ipq806x-gmac-dwmac 37600000.ethernet: User ID: 0x10, Synopsys ID: 0x37
[    4.296488] ipq806x-gmac-dwmac 37600000.ethernet: 	DWMAC1000
[    4.303932] ipq806x-gmac-dwmac 37600000.ethernet: DMA HW capability register supported
[    4.309657] ipq806x-gmac-dwmac 37600000.ethernet: RX Checksum Offload Engine supported
[    4.317481] ipq806x-gmac-dwmac 37600000.ethernet: COE Type 2
[    4.325352] ipq806x-gmac-dwmac 37600000.ethernet: TX Checksum insertion supported
[    4.331100] ipq806x-gmac-dwmac 37600000.ethernet: Wake-Up On Lan supported
[    4.338569] ipq806x-gmac-dwmac 37600000.ethernet: Enhanced/Alternate descriptors
[    4.345346] ipq806x-gmac-dwmac 37600000.ethernet: Enabled extended descriptors
[    4.352876] ipq806x-gmac-dwmac 37600000.ethernet: Ring mode enabled
[    4.359830] ipq806x-gmac-dwmac 37600000.ethernet: Enable RX Mitigation via HW Watchdog Timer
[    4.943498] libphy: stmmac: probed
[    4.945209] i2c /dev entries driver
[    4.949367] cpuidle: enable-method property 'qcom,kpss-acc-v1' found operations
[    4.949564] cpuidle: enable-method property 'qcom,kpss-acc-v1' found operations
[    4.957506] sdhci: Secure Digital Host Controller Interface driver
[    4.963858] sdhci: Copyright(c) Pierre Ossman
[    4.970021] sdhci-pltfm: SDHCI platform and OF driver helper
[    4.977952] NET: Registered protocol family 10
[    4.982244] Segment Routing with IPv6
[    4.984712] NET: Registered protocol family 17
[    4.988469] 8021q: 802.1Q VLAN Support v1.8
[    4.992781] Registering SWP/SWPB emulation handler
[    5.032597] qcom_rpm 108000.rpm: RPM firmware 3.0.16777364
[    5.049246] s1a: Bringing 0uV into 1050000-1050000uV
[    5.049656] s1a: supplied by regulator-dummy
[    5.053602] s1b: Bringing 0uV into 1050000-1050000uV
[    5.057877] s1b: supplied by regulator-dummy
[    5.062781] s2a: Bringing 0uV into 800000-800000uV
[    5.067087] s2a: supplied by regulator-dummy
[    5.071549] s2b: Bringing 0uV into 800000-800000uV
[    5.076192] s2b: supplied by regulator-dummy
[    5.092628] UBI error: cannot open mtd rootfs2, erro�[    5.104969] Freeing unused kernel memory: 13312K
[    5.142842] Run /init as init process
[    5.704375] init: Console is alive
[    5.704510] init: - watchdog -
[    5.725713] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    5.730323] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    5.734915] SCSI subsystem initialized
[    5.746359] ehci-fsl: Freescale EHCI Host controller driver
[    5.746961] ehci-platform: EHCI generic platform driver
[    5.754387] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    5.756358] ohci-platform: OHCI generic platform driver
[    5.765011] dwc3-qcom 110f8800.usb3: IRQ hs_phy_irq not found
[    5.767312] dwc3-qcom 110f8800.usb3: IRQ dp_hs_phy_irq not found
[    5.773304] dwc3-qcom 110f8800.usb3: IRQ dm_hs_phy_irq not found
[    5.779290] dwc3-qcom 110f8800.usb3: IRQ ss_phy_irq not found
[    5.786931] dwc3-qcom 100f8800.usb3: IRQ hs_phy_irq not found
[    5.790923] dwc3-qcom 100f8800.usb3: IRQ dp_hs_phy_irq not found
[    5.796732] dwc3-qcom 100f8800.usb3: IRQ dm_hs_phy_irq not found
[    5.802800] dwc3-qcom 100f8800.usb3: IRQ ss_phy_irq not found
[    5.819739] dwc3 11000000.dwc3: Failed to get clk 'ref': -2
[    5.882101] dwc3 10000000.dwc3: Failed to get clk 'ref': -2
[    5.954804] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    5.954849] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1
[    5.959339] xhci-hcd xhci-hcd.0.auto: hcc params 0x0228f065 hci version 0x100 quirks 0x0000000002010010
[    5.966852] xhci-hcd xhci-hcd.0.auto: irq 42, io mem 0x11000000
[    5.976391] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    5.982014] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2
[    5.987655] xhci-hcd xhci-hcd.0.auto: Host supports USB 3.0 SuperSpeed
[    5.995698] hub 1-0:1.0: USB hub found
[    6.001743] hub 1-0:1.0: 1 port detected
[    6.006643] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    6.009905] hub 2-0:1.0: USB hub found
[    6.017699] hub 2-0:1.0: 1 port detected
[    6.021464] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    6.025319] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 3
[    6.030679] xhci-hcd xhci-hcd.1.auto: hcc params 0x0228f065 hci version 0x100 quirks 0x0000000002010010
[    6.038200] xhci-hcd xhci-hcd.1.auto: irq 43, io mem 0x10000000
[    6.047742] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    6.053446] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 4
[    6.058922] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed
[    6.067768] hub 3-0:1.0: USB hub found
[    6.073332] hub 3-0:1.0: 1 port detected
[    6.077505] usb usb4: We don't know the algorithms for LPM for this host, disabling LPM.
[    6.081795] hub 4-0:1.0: USB hub found
[    6.089318] hub 4-0:1.0: 1 port detected
[    6.094670] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    6.099683] init: - preinit -
[    6.183512] ipq806x-gmac-dwmac 37600000.ethernet eth1: no phy at addr -1
[    6.183545] ipq806x-gmac-dwmac 37600000.ethernet eth1: stmmac_open: Cannot attach to PHY (error: -19)
ip: SIOCSIFFLAGS: No such device
sendto(): Network unreachable
[    6.205594] random: procd: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
sendto(): Network unreachable
sendto(): Network unreachable
sendto(): Network unreachable
[   10.316706] procd: - early -
[   10.316775] procd: - watchdog -
[   10.864264] procd: - watchdog -
[   10.865037] procd: - ubus -
[   10.876269] random: ubusd: uninitialized urandom read (4 bytes read)
[   10.916860] random: ubusd: uninitialized urandom read (4 bytes read)
[   10.917645] random: ubusd: uninitialized urandom read (4 bytes read)
[   10.928329] procd: - init -
Please press Enter to activate this console.
[   11.118151] urngd: v1.0.2 started.
[   11.135673] kmodloader: loading kernel modules from /etc/modules.d/*
[   11.143450] Loading modules backported from Linux version v5.10.68-0-g4d8524048a35
[   11.143476] Backport generated by backports.git v5.10.68-1-0-ga4f9ba32
[   11.146365] random: crng init done
[   11.156533] random: 6 urandom warning(s) missed due to ratelimiting
[   11.158004] xt_time: kernel timezone is -0000
[   11.196748] PPP generic driver version 2.4.2
[   11.197238] NET: Registered protocol family 24
[   11.201822] wireguard: WireGuard 1.0.0 loaded. See www.wireguard.com for information.
[   11.204415] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
[   11.247731] ath10k 5.10 driver, optimized for CT firmware, probing pci device: 0x46.
[   11.248991] ath10k_pci 0001:01:00.0: enabling device (0140 -> 0142)
[   11.255232] ath10k_pci 0001:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0
[   12.117793] ath10k_pci 0001:01:00.0: Failed to find firmware-N.bin (N between 2 and 6) from ath10k/QCA9984/hw1.0: -12
[   12.117826] ath10k_pci 0001:01:00.0: could not fetch firmware files (-12)
[   12.127458] ath10k_pci 0001:01:00.0: could not probe fw (-12)
[   12.134457] ath10k 5.10 driver, optimized for CT firmware, probing pci device: 0x3c.
[   12.140428] ath10k_pci 0002:01:00.0: enabling device (0140 -> 0142)
[   12.148330] ath10k_pci 0002:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0
[   12.960477] ath10k_pci 0002:01:00.0: Failed to find firmware-N.bin (N between 2 and 6) from ath10k/QCA988X/hw2.0: -12
[   12.960516] ath10k_pci 0002:01:00.0: could not fetch firmware files (-12)
[   12.970159] ath10k_pci 0002:01:00.0: could not probe fw (-12)
[   12.979460] kmodloader: done loading kernel modules from /etc/modules.d/*
[   20.038355] ipq806x-gmac-dwmac 37600000.ethernet eth1: no phy at addr -1
[   20.038386] ipq806x-gmac-dwmac 37600000.ethernet eth1: stmmac_open: Cannot attach to PHY (error: -19)
[   20.044372] br-lan: port 1(eth1) entered blocking state
[   20.053333] br-lan: port 1(eth1) entered disabled state
[   20.058477] device eth1 entered promiscuous mode
[   20.074588] ipq806x-gmac-dwmac 37400000.ethernet eth0: no phy at addr -1
[   20.074615] ipq806x-gmac-dwmac 37400000.ethernet eth0: stmmac_open: Cannot attach to PHY (error: -19)



BusyBox v1.33.1 (2021-10-24 09:01:35 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 21.02.1, r16325-88151b8303
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#
2 Likes
17

I also started a fork on github from 21.02 and will work from there to continue learning the development etiquette and start building the dts for these C-130 APs. In the meantime I will continue working to see if I can get shell access on the factory firmware. Right now it restricts to a configuration login and passing a shell init parameter in the bootargs drops to a shell before the overlays are applied and devmem/devmem2 are not present in busybox. Not sure if it is as simple as mounting the overlayfs but I am working that path at the moment.

(IPQ) # print bootargs
bootargs=console=ttyHSL1,115200n8 ubi.mtd=rootfs2 root=mtd:ubi_rootfs rootfstype=squashfs
(IPQ) # setenv bootargs console=ttyHSL1,115200n8 ubi.mtd=rootfs2 root=mtd:ubi_rootfs rootfstype=squashfs init=/bin/sh
(IPQ) # print bootargs
bootargs=console=ttyHSL1,115200n8 ubi.mtd=rootfs2 root=mtd:ubi_rootfs rootfstype=squashfs init=/bin/sh
(IPQ) # bootipq
MMC Device 0 not found
MMC Device 0 not found
Device 1: nand1... is now current device

NAND read: device 1 offset 0x9a0000, size 0x500000
 5242880 bytes read: OK
   Image Name:   Linux-3.4.103
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1860152 Bytes = 1.8 MiB
   Load Address: 41508000
   Entry Point:  41508000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK
Using machid 0x1260 from environment

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0
[    0.000000] CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c5387d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] Machine: Qualcomm Atheros AP148 reference board
[    0.000000] Partition (from atag) rootfs -- Offset:0 Size:100
[    0.000000] Partition (from atag) opt -- Offset:100 Size:100
[    0.000000] Partition (from atag) rootfs2 -- Offset:200 Size:100
[    0.000000] Partition (from atag) opt2 -- Offset:300 Size:100
[    0.000000] msm_reserve_memory: 0x44000000, 0x600000
[    0.000000] msm_reserve_memory: 0x44600000, 0x200000
[    0.000000] memory pool 3 (start 5fc00000 size 400000) initialized
[    0.000000] Memory policy: ECC disabled, Data cache writealloc
[    0.000000] smem_find(137, 80): wrong size 72
[    0.000000] socinfo_init: v6, id=204, ver=2.0, raw_id=2313, raw_ver=2313, hw_plat=0,  hw_plat_ver=65536
[    0.000000]  accessory_chip=0 hw_plat_subtype=0
[    0.000000] PERCPU: Embedded 8 pages/cpu @c0c6c000 s10624 r8192 d13952 u32768
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 121642
[    0.000000] Kernel command line: console=ttyHSL1,115200n8 ubi.mtd=rootfs2 root=mtd:ubi_rootfs rootfstype=squashfs init=/bin/sh
[    0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Memory: 43MB 436MB = 479MB total
[    0.000000] Memory: 477280k/489568k available, 13216k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0xdf000000 - 0xff000000   ( 512 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xdeb00000   ( 491 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0008000 - 0xc050d000   (5140 kB)
[    0.000000]       .init : 0xc0600000 - 0xc0702980   (1035 kB)
[    0.000000]       .data : 0xc0704000 - 0xc07a3068   ( 637 kB)
[    0.000000]        .bss : 0xc07a308c - 0xc0868bb0   ( 791 kB)
[    0.000000] SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] NR_IRQS:1689
[    0.000000] sched_clock: 32 bits at 32kHz, resolution 31240ns, wraps every 134175798ms
[    0.000000] Console: colour dummy device 80x30
[    0.150452] Calibrating delay using timer specific routine.. 12.55 BogoMIPS (lpj=62797)
[    0.150484] pid_max: default: 32768 minimum: 301
[    0.150952] Mount-cache hash table entries: 512
[    0.152421] CPU: Testing write buffer coherency: ok
[    0.152639] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[    0.152639] hw perfevents: enabled with ARMv7 Krait PMU driver, 5 counters available
[    0.152764] Setting up static identity map for 0x41894aa0 - 0x41894b28
[    0.155107] CPU1: Booted secondary processor
[    0.155170] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
[    0.155263] Brought up 2 CPUs
[    0.155295] SMP: Total of 2 processors activated (25.11 BogoMIPS).
[    0.171915] dummy: 
[    0.172633] NET: Registered protocol family 16
[    0.173445] AXI: msm_bus_fabric_init_driver(): msm_bus_fabric_init_driver
[    0.176476] meminfo_init: smem ram ptable found: ver: 0 len: 5
[    0.176476] Found 1 memory banks grouped into 8 memory regions
[    0.177069] gpiochip_add: registered GPIOs 0 to 151 on device: msmgpio
[    0.177881] smem_find(137, 80): wrong size 72
[    0.177881] socinfo_init: v6, id=204, ver=2.0, raw_id=2313, raw_ver=2313, hw_plat=0,  hw_plat_ver=65536
[    0.177913]  accessory_chip=0 hw_plat_subtype=0
[    0.177944] msm_rpm_init: RPM firmware 3.0.16777364
[    0.185910] clk_tbl_nss - loaded
[    0.211902] Andrew: AP148_W_2PHYS defined !!!!!!
[    0.214214] hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
[    0.214214] hw-breakpoint: maximum watchpoint size is 8 bytes.
[    0.214651] msm_dmov_memcpy_init: Success
[    0.222524] sps:BAM 0x12244000 enabled: ver:0x5, number of pipes:20
[    0.222524] sps:BAM 0x12244000 is registered.
[    0.222805] sps:sps is ready.
[    0.280974] msm_pcie_setup: link initialized
[    0.281349] PCI host bridge to bus 0000:00
[    0.281380] pci_bus 0000:00: root bus resource [mem 0x08000000-0x0fefffff]
[    0.281880] PCI: bus0: Fast back to back transfers disabled
[    0.281911] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.282630] PCI: bus1: Fast back to back transfers disabled
[    0.341143] msm_pcie_setup: link initialized
[    0.341487] PCI host bridge to bus 0000:02
[    0.341518] pci_bus 0000:02: root bus resource [mem 0x2e000000-0x31efffff]
[    0.341986] PCI: bus2: Fast back to back transfers disabled
[    0.341986] pci 0000:02:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.342830] PCI: bus3: Fast back to back transfers disabled
[    0.381255] msm_pcie_setup: link initialized
[    0.381599] PCI host bridge to bus 0000:04
[    0.381630] pci_bus 0000:04: root bus resource [mem 0x32000000-0x35efffff]
[    0.382099] PCI: bus4: Fast back to back transfers disabled
[    0.382099] pci 0000:04:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.382942] PCI: bus5: Fast back to back transfers disabled
[    0.383942] pci 0000:04:00.0: BAR 8: assigned [mem 0x32000000-0x321fffff]
[    0.383973] pci 0000:04:00.0: BAR 9: assigned [mem 0x32200000-0x322fffff pref]
[    0.384004] pci 0000:05:00.0: BAR 0: assigned [mem 0x32000000-0x321fffff 64bit]
[    0.384036] pci 0000:05:00.0: BAR 6: assigned [mem 0x32200000-0x3220ffff pref]
[    0.384036] pci 0000:04:00.0: PCI bridge to [bus 05-05]
[    0.384067] pci 0000:04:00.0:   bridge window [mem 0x32000000-0x321fffff]
[    0.384098] pci 0000:04:00.0:   bridge window [mem 0x32200000-0x322fffff pref]
[    0.384161] PCI: enabling device 0000:04:00.0 (0140 -> 0143)
[    0.384223] pci 0000:02:00.0: BAR 8: assigned [mem 0x2e000000-0x2e1fffff]
[    0.384223] pci 0000:03:00.0: BAR 0: assigned [mem 0x2e000000-0x2e1fffff 64bit]
[    0.384286] pci 0000:02:00.0: PCI bridge to [bus 03-03]
[    0.384286] pci 0000:02:00.0:   bridge window [mem 0x2e000000-0x2e1fffff]
[    0.384348] PCI: enabling device 0000:02:00.0 (0140 -> 0143)
[    0.384411] pci 0000:00:00.0: BAR 8: assigned [mem 0x08000000-0x081fffff]
[    0.384442] pci 0000:01:00.0: BAR 0: assigned [mem 0x08000000-0x081fffff 64bit]
[    0.384473] pci 0000:00:00.0: PCI bridge to [bus 01-01]
[    0.384504] pci 0000:00:00.0:   bridge window [mem 0x08000000-0x081fffff]
[    0.384536] PCI: enabling device 0000:00:00.0 (0140 -> 0143)
[    0.405498] bio: create slab <bio-0> at 0
[    0.407091] SCSI subsystem initialized
[    0.408997] spi_qsd spi_qsd.5: master is unqueued, this is deprecated
[    0.411621] spi_qsd spi_qsd.6: master is unqueued, this is deprecated
[    0.415182] Switching to clocksource gp_timer
[    0.438019] NET: Registered protocol family 2
[    0.447891] IP route cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.448484] TCP established hash table entries: 16384 (order: 5, 131072 bytes)
[    0.448672] TCP bind hash table entries: 16384 (order: 5, 131072 bytes)
[    0.448890] TCP: Hash tables configured (established 16384 bind 16384)
[    0.448890] TCP: reno registered
[    0.448922] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.448922] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.449359] NET: Registered protocol family 1
[    0.450827] Detected 5 counters on the L2CC PMU.
[    0.451890] smd: register irq failed on wcnss_a11
[    0.451890] smd: deregistering IRQs
[    0.451952] SMD: smd_core_platform_init() failed
[    0.452702] Partition(from smem) SBL1 -- Offset:0 Size:20000
[    0.452733] Partition(from smem) MIBIB -- Offset:20000 Size:20000
[    0.452733] Partition(from smem) SBL2 -- Offset:40000 Size:40000
[    0.452764] Partition(from smem) SBL3 -- Offset:80000 Size:80000
[    0.452764] Partition(from smem) DDRCONFIG -- Offset:100000 Size:10000
[    0.452796] Partition(from smem) SSD -- Offset:110000 Size:10000
[    0.452796] Partition(from smem) TZ -- Offset:120000 Size:80000
[    0.452827] Partition(from smem) RPM -- Offset:1a0000 Size:80000
[    0.452827] Partition(from smem) APPSBL -- Offset:220000 Size:100000
[    0.452858] Partition(from smem) APPSBLENV -- Offset:320000 Size:40000
[    0.452889] Partition(from smem) ART -- Offset:360000 Size:100000
[    0.452889] Partition(from smem) vendordata -- Offset:460000 Size:20000
[    0.452920] Partition(from smem) BOOTCONFIG -- Offset:490000 Size:10000
[    0.452952] Partition(from smem) kernel1 -- Offset:4a0000 Size:500000
[    0.452952] Partition(from smem) kernel2 -- Offset:9a0000 Size:500000
[    0.452983] Partition(from smem) user_config -- Offset:ea0000 Size:400000
[    0.453014] Partition(from smem) recovery -- Offset:12a0000 Size:d00000
[    0.453014] smem_find(427, 88): wrong size 96
[    0.469165] acpuclk-ipq806x acpuclk-ipq806x: SPEED BIN: 0
[    0.469165] acpuclk-ipq806x acpuclk-ipq806x: ACPU PVS: 1
[    0.476163] acpuclk-ipq806x acpuclk-ipq806x: CPU0: 6 frequencies supported
[    0.476194] acpuclk-ipq806x acpuclk-ipq806x: CPU1: 6 frequencies supported
[    0.477819] msm_rpm_log_probe: OK
[    0.500531] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.500562] jffs2: version 2.2. (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) © 2001-2006 Red Hat, Inc.
[    0.501874] msgmni has been set to 932
[    0.503873] Asymmetric key parser 'x509' registered
[    0.503967] io scheduler noop registered
[    0.503967] io scheduler deadline registered (default)
[    0.506029] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.508372] msm_serial_hs: probe of msm_serial_hs.0 failed with error -2
[    0.508684] msm_serial_hs module loaded
[    0.508934] msm_serial_hsl: detected port #1
[    0.509153] msm_serial_hsl.1: ttyHSL1 at MMIO 0x16340000 (irq = 184) is a MSM
[    0.509621] msm_serial_hsl: console setup on port #1
[    1.414214] console [ttyHSL1] enabled
[    1.418619] msm_serial_hsl: driver initialized
[    1.427678] ahci ahci.0: forcing PORTS_IMPL to 0x1
[    1.431490] ahci ahci.0: AHCI 0001.0300 32 slots 1 ports 6 Gbps 0x1 impl platform mode
[    1.439393] ahci ahci.0: flags: ncq sntf pm led clo only pmp pio slum part ccc apst 
[    1.448547] scsi0 : ahci_platform
[    1.451608] ata1: SATA max UDMA/133 mmio [mem 0x29000000-0x2900017f] port 0x100 irq 241
[    1.461324] msm_nand_probe: phys addr 0x1ac00000 
[    1.464979] msm_nand_probe: dmac 0x3
[    1.468634] msm_nand_probe: allocated dma buffer at ffdfc000, dma_addr 5f5ce000
[    1.477257] status: 20
[    1.478600] nandid: 1580a1c2 maker c2 device a1
[    1.483130] ONFI probe : Found an ONFI compliant device MX30UF1G18AC        �
[    1.491315] Found a supported NAND device
[    1.494314] NAND Controller ID : 0x4030
[    1.498188] NAND Device ID  : 0x1580a1c2
[    1.502030] Buswidth : 8 Bits
[    1.504967] Density  : 128 MByte
[    1.508403] Pagesize : 2048 Bytes
[    1.511496] Erasesize: 131072 Bytes
[    1.514964] Oobsize  : 64 Bytes
[    1.518213] CFG0 Init  : 0xa8d408c0
[    1.521555] CFG1 Init  : 0x0004745c
[    1.525023] ECCBUFCFG  : 0x00000203
[    1.529365] Creating 4 MTD partitions on "msm_nand":
[    1.533489] 0x000000000000-0x000002000000 : "rootfs"
[    1.613870] mtd: partition "rootfs" set to be root filesystem
[    1.619462] split_squashfs: no squashfs found in "msm_nand"
[    1.624148] 0x000002000000-0x000004000000 : "opt"
[    1.704935] 0x000004000000-0x000006000000 : "rootfs2"
[    1.785035] 0x000006000000-0x000008000000 : "opt2"
[    1.805310] ata1: SATA link down (SStatus 0 SControl 300)
[    1.870321] m25p80 spi5.0: found s25fl256s1, expected s25fl512s
[    1.875382] m25p80 spi5.0: s25fl256s1 (32768 Kbytes)
[    1.880818] Creating 17 MTD partitions on "m25p80":
[    1.885035] 0x000000000000-0x000000020000 : "SBL1"
[    1.892346] 0x000000020000-0x000000040000 : "MIBIB"
[    1.898594] 0x000000040000-0x000000080000 : "SBL2"
[    1.904686] 0x000000080000-0x000000100000 : "SBL3"
[    1.911027] 0x000000100000-0x000000110000 : "DDRCONFIG"
[    1.917775] 0x000000110000-0x000000120000 : "SSD"
[    1.923867] 0x000000120000-0x0000001a0000 : "TZ"
[    1.930021] 0x0000001a0000-0x000000220000 : "RPM"
[    1.936176] 0x000000220000-0x000000320000 : "APPSBL"
[    1.942580] 0x000000320000-0x000000360000 : "APPSBLENV"
[    1.949640] 0x000000360000-0x000000460000 : "ART"
[    1.955982] 0x000000460000-0x000000480000 : "vendordata"
[    1.962636] 0x000000490000-0x0000004a0000 : "BOOTCONFIG"
[    1.969384] 0x0000004a0000-0x0000009a0000 : "kernel1"
[    1.975913] 0x0000009a0000-0x000000ea0000 : "kernel2"
[    1.982380] 0x000000ea0000-0x0000012a0000 : "user_config"
[    1.989971] 0x0000012a0000-0x000001fa0000 : "recovery"
[    1.997500] UBI: attaching mtd2 to ubi0
[    2.000312] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[    2.006997] UBI: logical eraseblock size:    126976 bytes
[    2.011933] UBI: smallest flash I/O unit:    2048
[    2.016963] UBI: VID header offset:          2048 (aligned 2048)
[    2.022617] UBI: data offset:                4096
[    2.551890] UBI: max. sequence number:       146
[    2.578350] UBI: attached mtd2 to ubi0
[    2.581068] UBI: MTD device name:            "rootfs2"
[    2.586223] UBI: MTD device size:            32 MiB
[    2.591034] UBI: number of good PEBs:        256
[    2.595688] UBI: number of bad PEBs:         0
[    2.600062] UBI: number of corrupted PEBs:   0
[    2.604498] UBI: max. allowed volumes:       128
[    2.609153] UBI: wear-leveling threshold:    4096
[    2.613776] UBI: number of internal volumes: 1
[    2.618244] UBI: number of user volumes:     2
[    2.622649] UBI: available PEBs:             0
[    2.627210] UBI: total number of reserved PEBs: 256
[    2.631927] UBI: number of PEBs reserved for bad PEB handling: 2
[    2.637956] UBI: max/mean erase counter: 77/3
[    2.642268] UBI: image sequence number:  766175402
[    2.647110] UBI: background thread "ubi_bgt0d" started, PID 676
[    2.686098] GPIO Bitbanged MDIO: probed
[    2.689222] i2c /dev entries driver
[    2.700124] cpuidle: using governor ladder
[    2.703186] cpuidle: using governor menu
[    2.708247] TCP: cubic registered
[    2.710559] NET: Registered protocol family 17
[    2.715276] Bridge firewalling registered
[    2.718962] 8021q: 802.1Q VLAN Support v1.8
[    2.723305] VFP support v0.3: implementor 51 architecture 64 part 4d variant 2 rev 0
[    2.730896] Registering SWP/SWPB emulation handler
[    2.735707] clock_late_init: Removing enables held for handed-off clocks
[    2.751608] ipq_nss_get_mac_addr: MAC[0]: 88:b1:e1:24:9a:ff
[    2.756263] ipq_nss_get_mac_addr: MAC[1]: 88:b1:e1:24:9a:fe
[    2.761918] no pmic restart interrupt specified
[    2.779662] VFS: Mounted root (squashfs filesystem) readonly on device 31:21.
[    2.786379] Freeing init memory: 1032K

�Enter 'help' for a list of built-in commands.

/bin/sh: can't access tty; job control turned off
/ # ls
bin         lib         mnt         proc        sbin        usr
dev         linuxrc     opt         rom         sys         var
etc         lost+found  overlay     root        tmp
/ # ls /etc/
ath                    hotplug.d              profile
config                 hotplug2-common.rules  rc.d
confutils.sh           hotplug2-init.rules    resolv.conf
dhclient6.script       hotplug2.rules         resolv.conf.dhclient6
diag.sh                init.d                 services
filesystems            inittab                shadow
fstab                  issue                  shells
functions.sh           nsswitch.conf          udhcpc.script
fw_env.config          openwrt_release        udhcpd.conf
group                  passwd                 upgrade_sec_image.sh
host.conf              preinit
/ # cat /etc/openwrt_release 
DISTRIB_ID="QSDK"
DISTRIB_RELEASE="IPQ806X.LN"
DISTRIB_REVISION="r37758"
DISTRIB_CODENAME="enterprise"
DISTRIB_TARGET="ipq806x/generic"
DISTRIB_DESCRIPTION="QSDK Enterprise IPQ806X.LN"
/ # cat /etc/filesystems 
ntfs-3g
/ #
18

Would recommend that you work using master instead as 21.02 is dated.

Is there anything interesting in /etc/init.d?

19

/etc/init.d is symlinked to /opt/init.d but I haven't been able to mount that yet. Trying to see if I can jump in the boot script after the init call, just tricky due to all the variables that get set during runtime.

/ # ls -lah /etc/
drwxr-xr-x    1 0        0             224 Jun 22  2016 .
drwxr-xr-x    1 0        0             632 Jan  1 00:00 ..
drwxr-xr-x    2 0        0             201 Jun 20  2016 ath
drwxr-xr-x    2 0        0              29 Jun 20  2016 config
-rwxr-xr-x    1 0        0            8.5k Jun 22  2016 confutils.sh
-rwxr-xr-x    1 0        0             161 Jun 20  2016 dhclient6.script
-rwxr-xr-x    1 0        0              68 Jun 22  2016 diag.sh
-rwxr-xr-x    1 0        0               8 Jun 22  2016 filesystems
-rwxr-xr-x    1 0        0              67 Jun 20  2016 fstab
-rwxr-xr-x    1 0        0            7.1k Jun 22  2016 functions.sh
-rw-r-xr-x    1 0        0             507 Jun 22  2016 fw_env.config
lrwxrwxrwx    1 0        0              10 Jun 22  2016 group -> /opt/group
-rwxr-xr-x    1 0        0              26 Jun 20  2016 host.conf
drwxr-xr-x   10 0        0             126 Jun 22  2016 hotplug.d
-rwxr-xr-x    1 0        0             833 Jun 22  2016 hotplug2-common.rules
-rwxr-xr-x    1 0        0              80 Jun 22  2016 hotplug2-init.rules
-rwxr-xr-x    1 0        0             242 Jun 22  2016 hotplug2.rules
lrwxrwxrwx    1 0        0              11 Jun 22  2016 init.d -> /opt/init.d
-rwxr-xr-x    1 0        0             159 Jun 20  2016 inittab
-rwxr-xr-x    1 0        0              13 Jun 20  2016 issue
-rwxr-xr-x    1 0        0             215 Jun 20  2016 nsswitch.conf
-rwxr-xr-x    1 0        0             185 Jun 22  2016 openwrt_release
lrwxrwxrwx    1 0        0              11 Jun 22  2016 passwd -> /opt/passwd
-rwxr-xr-x    1 0        0             944 Jun 22  2016 preinit
lrwxrwxrwx    1 0        0              12 Jun 22  2016 profile -> /tmp/profile
drwxr-xr-x    2 0        0             163 Jun 22  2016 rc.d
lrwxrwxrwx    1 0        0              16 Jun 22  2016 resolv.conf -> /var/resolv.conf
lrwxrwxrwx    1 0        0              26 Jun 22  2016 resolv.conf.dhclient6 -> /var/resolv.conf.dhclient6
-rwxr-xr-x    1 0        0            5.8k Jun 20  2016 services
lrwxrwxrwx    1 0        0              11 Jun 22  2016 shadow -> /opt/shadow
lrwxrwxrwx    1 0        0              11 Jun 22  2016 shells -> /opt/shells
-rwxr-xr-x    1 0        0             126 Jun 20  2016 udhcpc.script
-rwxr-xr-x    1 0        0            2.9k Jun 20  2016 udhcpd.conf
-rwxr-xr-x    1 0        0            2.6k Jun 22  2016 upgrade_sec_image.sh

From what I have determined there is a script /etc/preinit that starts by sourcing /lib/functions.sh and /lib/functions/boot.sh. From there it starts to run some of the boot functions, sources the rest of the preinit scripts, and mounts /proc before trying to call init which fails due to sh already having process id 1.

I posted the scripts if they might be useful, but it looks like most are probably standard OpenWRT stuff.

Here is first level listing of what I can get mounted.

20

Can you look through all *.sh files in the first level listing you provided. Some of those names are potentially relevant, eg /sbin/gpio.sh, /sbin/gpio_dump.sh and /lib/ipq806x.sh.

What happens when you correct the PHY IDs in the devicetree?

You should still be able to make progress in other areas too while figuring this bit out, like WLAN and LED's. Also did you request a GPL archive or is there one provided?