ARRIS SURFboard W6B/W6U

rwg · November 3, 2025, 7:09am

In July 2022, ARRIS released their W6 line of Wi-Fi 6E devices. The W6B is sold in pairs as pre-configured, pre-paired Wi-Fi 6E-only wireless bridges under the marketing name "SURFboard Thruster Gaming Acceleration Kit." The W6U is sold as a Wi-Fi 6E-only wireless access point under the marketing name "SURFboard Wi-Fi 6E Network Upgrade Kit."

For whatever reason, these devices are now selling for not too much money from various online stores. I just paid US$33 for a new-in-box pair of the W6B units, and a new-in-box W6U unit would’ve cost me US$43. (ARRIS is still selling them for US$281 and US$171, respectively.)

Though their plastic shells are different colors, both models use identical PCBs and hardware:

Qualcomm IPQ6010 SoC
512 MB of RAM
128 MB of NAND flash
Qualcomm QCN9024 radio (4SS 802.11ax w/ 160 MHz channels, "AX4800" class)
Qualcomm QCA8081 Ethernet PHY (2.5GBASE-T capable)

The PCB has two 3.3V TTL serial ports, with each port exposed as four vias, and both sets of vias have silkscreen labels showing the order of the lines (RX/TX/GND/3V3). The serial port closest to the front of the unit is the one that will get you U-Boot’s messages and console, Linux’s boot messages, and a root shell at 115200 8N1.

The device and U-Boot both appear to be unlocked, and the default firmware offers a root shell without a password to anyone willing to press Enter on the serial port.

The latest factory firmware images are available at:

The W6B units are sold in pairs. One is labeled “Main Access Point," and the other is labeled “Satellite.” All of the logs/captures in my following messages come from a “Satellite” unit, but its matching “Main Access Point” unit appears to use an identical firmware image with (at least) a different UCI configuration so it acts as an AP instead of a STA.

I’ll pull a device tree out of the kernel image and maybe try building a minimal OpenWrt image for it later this week.

rwg · November 3, 2025, 7:11am

Boot log, part one:

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.XF.0.3-00100-IPQ60xxLZB-1
S - IMAGE_VARIANT_STRING=IPQ6018LA
S - OEM_IMAGE_VERSION_STRING=crm-ubuntu124
S - Boot Interface: NAND
S - Secure Boot: Off
S - Boot Config @ 0x000a602c = 0x000002e5
S - JTAG ID @ 0x000a607c = 0x0013a0e1
S - OEM ID @ 0x000a6080 = 0x00000000
S - Serial Number @ 0x000a4128 = 0x46b7ff16
S - OEM Config Row 0 @ 0x000a4188 = 0x0000000000000000
S - OEM Config Row 1 @ 0x000a4190 = 0x0000000000000000
S - Feature Config Row 0 @ 0x000a4130 = 0x0000000008000001
S - Feature Config Row 1 @ 0x000a4138 = 0x02c3e83383000009
S - PBL Patch Ver: 1
S - I-cache: On
S - D-cache: On
B -      3413 - PBL, Start
B -       592 - bootable_media_detect_entry, Start
B -      4339 - bootable_media_detect_success, Start
B -      5147 - elf_loader_entry, Start
B -      5319 - auth_hash_seg_entry, Start
B -      7786 - auth_hash_seg_exit, Start
B -      8282 - elf_segs_hash_verify_entry, Start
B -    103630 - elf_segs_hash_verify_exit, Start
B -    107819 - auth_xbl_sec_hash_seg_entry, Start
B -    107964 - auth_xbl_sec_hash_seg_exit, Start
B -    114517 - xbl_sec_segs_hash_verify_entry, Start
B -    114518 - xbl_sec_segs_hash_verify_exit, Start
B -    115448 - PBL, End
B -     97386 - SBL1, Start
B -    240279 - GCC [RstStat:0x0, RstDbg:0x600000] WDog Stat : 0x4
B -    242719 - clock_init, Start
D -      3812 - clock_init, Delta
B -    252357 - boot_flash_init, Start
D -     30500 - boot_flash_init, Delta
B -    285083 - sbl1_ddr_set_default_params, Start
D -       244 - sbl1_ddr_set_default_params, Delta
B -    291702 - boot_config_data_table_init, Start
D -      4941 - boot_config_data_table_init, Delta - (575 Bytes)
B -    301828 - CDT Version:2,Platform ID:8,Major ID:3,Minor ID:0,Subtype:2
B -    306372 - Image Load, Start
D -      6619 - OEM_MISC Image Loaded, Delta - (0 Bytes)
B -    315736 - Image Load, Start
D -      5063 - PMIC Image Loaded, Delta - (0 Bytes)
B -    323605 - sbl1_ddr_set_params, Start
B -    328576 - CPR configuration: 0x555
B -    331779 - Pre_DDR_clock_init, Start
D -       213 - Pre_DDR_clock_init, Delta
D -         0 - sbl1_ddr_set_params, Delta
B -    365908 - Image Load, Start
D -       519 - APDP Image Loaded, Delta - (0 Bytes)
B -    384422 - Image Load, Start
D -       518 - QTI_MISC Image Loaded, Delta - (0 Bytes)
B -    386953 - Image Load, Start
D -       824 - Auth Metadata
D -       702 - Segments hash check
D -     23699 - QSEE Dev Config Image Loaded, Delta - (37154 Bytes)
B -    412512 - Image Load, Start
D -      6588 - Auth Metadata
D -     10461 - Segments hash check
D -    363011 - QSEE Image Loaded, Delta - (1439116 Bytes)
B -    776072 - Image Load, Start
D -       701 - Auth Metadata
D -      1067 - Segments hash check
D -     36905 - RPM Image Loaded, Delta - (102800 Bytes)
B -    814350 - Image Load, Start
D -       702 - Auth Metadata
D -      2836 - Segments hash check
D -    119743 - APPSBL Image Loaded, Delta - (493278 Bytes)
B -    962732 - SBL1, End
D -    865712 - SBL1, Delta
S - Flash Throughput, 4000 KB/s  (2073595 Bytes,  450962 us)
S - Core 0 Frequency, 800 MHz
S - DDR Frequency, 466 MHz


U-Boot 2016.01-20220516 (May 16 2022 - 20:48:00 +0800)

DRAM:  smem ram ptable found: ver: 2 len: 4
512 MiB
NAND:  ONFI device found
ID = 1580a1c2
Vendor = c2
Device = a1
128 MiB
PCI Link Intialized
In:    serial@78B1000
Out:   serial@78B1000
Err:   serial@78B1000
machid: 8030002
eth0 MAC Address from ART is not valid
eth1 MAC Address from ART is not valid
eth2 MAC Address from ART is not valid
eth3 MAC Address from ART is not valid
eth4 MAC Address from ART is not valid
eth5 MAC Address from ART is not valid
Board ID: [1,1]
HW Version: [V1H2]
Hit any key to stop autoboot:  0 
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 51 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 413, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 10/3, WL threshold: 4096, image sequence number: 710607249
ubi0: available PEBs: 0, total reserved PEBs: 413, PEBs reserved for bad PEB handling: 20
Read 0 bytes from volume kernel to 44000000
No size specified -> Using max size (4347672)
## Loading kernel from FIT Image at 44000000 ...
   Using 'config@cp01-c3' configuration
   Trying 'kernel@1' kernel subimage
     Description:  ARM64 OpenWrt Linux-4.4.60
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x440000e8
     Data Size:    3919843 Bytes = 3.7 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x41080000
     Entry Point:  0x41080000
     Hash algo:    crc32
     Hash value:   f1cdf282
     Hash algo:    sha1
     Hash value:   80c8e3048affe706fad9d6c0a1bd9181e12674e5
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
   Using 'config@cp01-c3' configuration
   Trying 'fdt@cp01-c3' fdt subimage
     Description:  ARM64 OpenWrt qcom-ipq60xx-cpxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x443f0120
     Data Size:    72119 Bytes = 70.4 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   2f7eacc6
     Hash algo:    sha1
     Hash value:   600ca3e9102e7bdb9ba93251c8d1759fc3875ff1
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x443f0120
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 484eb000, end 484ff9b6 ... OK
Using machid 0x8030002 from environment

Starting kernel ...

Jumping to AARCH64 kernel via monitor
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpuset
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 4.4.60 (bo@build.gj.sh) (gcc version 5.2.0 (OpenWrt GCC 5.2.0 563cb68+r49254) ) #1 SMP PREEMPT Fri May 20 00:14:43 CST 2022
[    0.000000] Boot CPU: AArch64 Processor [51af8014]
[    0.000000] Ignoring memory range 0x40000000 - 0x41000000
[    0.000000] Machine: Qualcomm Technologies, Inc. IPQ6018/AP-CP01-C3
[    0.000000] efi: Getting EFI parameters from FDT:
[    0.000000] efi: UEFI not found.
[    0.000000] Reserved memory: created DMA memory pool at 0x0000000050200000, size 16 MiB
[    0.000000] Reserved memory: initialized node dma_pool0@50200000, compatible id shared-dma-pool
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] PERCPU: Embedded 15 pages/cpu @ffffffc01ef5e000 s20864 r8192 d32384 u61440
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 96516
[    0.000000] Kernel command line: console=ttyMSM0,115200n8 cnss2.bdf_pci0=0xa3 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait mtdoops.mtddev=LOG mtdoops.record_size=16384 swiotlb=1 coherent_pool=2M
[    0.000000] PID hash table entries: 2048 (order: 2, 16384 bytes)
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes)
[    0.000000] software IO TLB [mem 0x5fe5a000-0x5fe9a000] (0MB) mapped at [ffffffc01ee5a000-ffffffc01ee99fff]
[    0.000000] Memory: 364968K/392192K available (5364K kernel code, 608K rwdata, 2296K rodata, 236K init, 433K bss, 27224K reserved, 0K cma-reserved)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vmalloc : 0xffffff8000000000 - 0xffffffbdbfff0000   (   246 GB)
[    0.000000]     vmemmap : 0xffffffbdc0000000 - 0xffffffbfc0000000   (     8 GB maximum)
[    0.000000]               0xffffffbdc0040000 - 0xffffffbdc0800000   (     7 MB actual)
[    0.000000]     fixed   : 0xffffffbffa7fd000 - 0xffffffbffac00000   (  4108 KB)
[    0.000000]     PCI I/O : 0xffffffbffae00000 - 0xffffffbffbe00000   (    16 MB)
[    0.000000]     modules : 0xffffffbffc000000 - 0xffffffc000000000   (    64 MB)
[    0.000000]     memory  : 0xffffffc000000000 - 0xffffffc01f000000   (   496 MB)
[    0.000000]       .init : 0xffffffc0007fd000 - 0xffffffc000838000   (   236 KB)
[    0.000000]       .text : 0xffffffc000080000 - 0xffffffc0007fd000   (  7668 KB)
[    0.000000]       .data : 0xffffffc000847000 - 0xffffffc0008df200   (   609 KB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] 	Build-time adjustment of leaf fanout to 64.
[    0.000000] NR_IRQS:64 nr_irqs:64 0
[    0.000000] Architected cp15 timer(s) running at 24.00MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
[    0.000005] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
[    0.000432] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
[    0.000443] pid_max: default: 32768 minimum: 301
[    0.000535] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes)
[    0.000545] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes)
[    0.001089] Initializing cgroup subsys io
[    0.001106] Initializing cgroup subsys memory
[    0.001134] Initializing cgroup subsys devices
[    0.001149] Initializing cgroup subsys freezer
[    0.001160] Initializing cgroup subsys net_cls
[    0.001170] Initializing cgroup subsys pids
[    0.001414] EFI services will not be available.
[    0.001434] ASID allocator initialised with 65536 entries
[    0.051864] MSM Memory Dump base table set up
[    0.051887] MSM Memory Dump apps data table set up
[    0.090147] Detected VIPT I-cache on CPU1
[    0.090189] CPU1: Booted secondary processor [51af8014]
[    0.120128] Detected VIPT I-cache on CPU2
[    0.120156] CPU2: Booted secondary processor [51af8014]
[    0.150157] Detected VIPT I-cache on CPU3
[    0.150184] CPU3: Booted secondary processor [51af8014]
[    0.150237] Brought up 4 CPUs
[    0.150263] SMP: Total of 4 processors activated.
[    0.150273] CPU: All CPU(s) started at EL1
[    0.165279] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.165308] futex hash table entries: 1024 (order: 5, 131072 bytes)
[    0.165669] pinctrl core: initialized pinctrl subsystem
[    0.166595] NET: Registered protocol family 16
[    0.190072] cpuidle: using governor ladder
[    0.220090] cpuidle: using governor menu
[    0.220298] NET: Registered protocol family 42
[    0.220403] vdso: 2 pages (1 code @ ffffffc00084d000, 1 data @ ffffffc00084c000)
[    0.220433] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[    0.221342] DMA: preallocated 2048 KiB pool for atomic allocations
[    0.221479] Read of property:soc_version_minor from node failed
[    0.221489] CPU: IPQ6010, SoC Version: 1.0
[    0.221906] IPC logging disabled
[    0.221912] IPC logging disabled
[    0.221916] IPC logging disabled
[    0.221921] IPC logging disabled
[    0.221925] IPC logging disabled
[    0.238721] irq: no irq domain found for /soc/smp2p-wcss/slave-kernel !
[    0.239530] sps:sps is ready.
[    0.242606] irq: no irq domain found for /soc/smp2p-wcss/slave-kernel !
[    0.249193] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    0.280938] socinfo_select_format: Unsupported format v0.13. Falling back to v0.12.
[    0.280963] socinfo_print: v0.12, id=422, ver=1.0, raw_id=314, raw_ver=0, hw_plat=8, hw_plat_ver=196608
[    0.280963]  accessory_chip=0, hw_plat_subtype=2, pmic_model=0, pmic_die_revision=0 foundry_id=2 serial_number=1186463510 num_pmics=0 chip_family=0x66 raw_device_family=0x2 raw_device_number=0x17
[    0.281756] pps_core: LinuxPPS API ver. 1 registered
[    0.281763] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.281787] PTP clock support registered
[    0.283040] qcom_glink_rpm soc:qcom,rpmsg-rpm@60000: RPM TOC has invalid magic
[    0.283062] qcom_glink_rpm: probe of soc:qcom,rpmsg-rpm@60000 failed with error -22
[    0.283438] Advanced Linux Sound Architecture Driver Initialized.
[    0.284103] clocksource: Switched to clocksource arch_sys_counter
[    0.286382] NET: Registered protocol family 2
[    0.287009] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.287070] TCP bind hash table entries: 4096 (order: 4, 65536 bytes)
[    0.287166] TCP: Hash tables configured (established 4096 bind 4096)
[    0.287213] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.287240] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.287404] NET: Registered protocol family 1
[    0.288101] hw perfevents: enabled with armv8_cortex_a53 PMU driver, 7 counters available
[    0.295635] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.295651] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.299130] Key type asymmetric registered
[    0.299145] Asymmetric key parser 'x509' registered
[    0.299174] io scheduler noop registered
[    0.299187] io scheduler deadline registered (default)
[    0.301226] 20000000.pci supply vdda not found, using dummy regulator
[    0.301270] 20000000.pci supply vdda_phy not found, using dummy regulator
[    0.301308] 20000000.pci supply vdda_refclk not found, using dummy regulator
[    0.301820] PCI host bridge /soc/pci@20000000 ranges:
[    0.301846]    IO 0x20200000..0x202fffff -> 0x20200000
[    0.301860]   MEM 0x20300000..0x302fffff -> 0x20300000
[    0.555640] qcom-pcie 20000000.pci: link up
[    0.555783] qcom-pcie 20000000.pci: PCI host bridge to bus 0000:00
[    0.555797] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.555811] pci_bus 0000:00: root bus resource [io  0x0000-0xfffff] (bus address [0x20200000-0x202fffff])
[    0.555821] pci_bus 0000:00: root bus resource [mem 0x20300000-0x302fffff]
[    0.556139] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.557068] pci 0000:00:00.0: BAR 8: assigned [mem 0x20400000-0x205fffff]
[    0.557083] pci 0000:00:00.0: BAR 9: assigned [mem 0x20600000-0x207fffff 64bit pref]
[    0.557096] pci 0000:00:00.0: BAR 0: assigned [mem 0x20300000-0x20300fff 64bit]
[    0.557112] pci 0000:00:00.0: BAR 7: assigned [io  0x1000-0x1fff]
[    0.557126] pci 0000:01:00.0: BAR 0: assigned [mem 0x20400000-0x205fffff 64bit]
[    0.557176] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.557186] pci 0000:00:00.0:   bridge window [io  0x1000-0x1fff]
[    0.557197] pci 0000:00:00.0:   bridge window [mem 0x20400000-0x205fffff]
[    0.557208] pci 0000:00:00.0:   bridge window [mem 0x20600000-0x207fffff 64bit pref]
[    0.557260] PCIe: RC0 enabled during bootup
[    0.557655] MDSS QPIC HW Base phy_Address=0x7980000 virt=ffffff8000340000
[    0.557974] mdss_qpic_panel_probe: Panel Name = qpic lcd panel
[    0.559537] mdss_fb_register: FrameBuffer[0] 800x480 registered successfully!
[    0.564019] msm_rpm_log_probe: OK
[    0.564340] msm-dcc b3000.dcc: DCC XPU is not specified
[    0.564584] msm-dcc b3000.dcc: jiffies_64: 0xffff8b08, cntvct_64: 0x5ef51a0
[    0.564597] msm-dcc b3000.dcc: gcnt_hi: 0x00000000(0xffffff800030e004)
[    0.564607] msm-dcc b3000.dcc: gcnt_lo: 0x05ef53eb(0xffffff800030e000)
[    0.565405] TZ SMMU State: SMMU Stage2 Enabled
[    0.565462] TZ Log : Will warn on Access Violation, as paniconaccessviolation is not set
[    0.566129] msm_serial 78b1000.serial: msm_serial: detected port #0
[    0.566161] msm_serial 78b1000.serial: uartclk = 1843199
[    0.566193] 78b1000.serial: ttyMSM0 at MMIO 0x78b1000 (irq = 5, base_baud = 115199) is a MSM
[    0.566213] msm_serial: console setup on port #0
[    1.464838] console [ttyMSM0] enabled
[    1.469721] msm_serial: driver initialized
[    1.473239] msm_serial_hsl_init: driver initialized
[    1.485838] brd: module loaded
[    1.490177] loop: module loaded
[    1.491653] QPIC controller hw version Major:1, Minor:5
[    1.492421] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xa1
[    1.497397] nand: ONFI 10-Compliant Macronix MX30UF1G18AC
[    1.503926] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.509360] 22 ofpart partitions found on MTD device qcom_nand.0
[    1.516712] Creating 22 MTD partitions on "qcom_nand.0":
[    1.522852] 0x000000000000-0x000000180000 : "0:SBL1"
[    1.529972] 0x000000180000-0x000000280000 : "0:MIBIB"
[    1.534443] 0x000000280000-0x000000300000 : "0:BOOTCONFIG"
[    1.539023] 0x000000300000-0x000000380000 : "0:BOOTCONFIG1"
[    1.544435] 0x000000380000-0x000000700000 : "0:QSEE"
[    1.552072] 0x000000700000-0x000000a80000 : "0:QSEE_1"
[    1.557313] 0x000000a80000-0x000000b00000 : "0:DEVCFG"
[    1.560025] 0x000000b00000-0x000000b80000 : "0:DEVCFG_1"
[    1.565164] 0x000000b80000-0x000000c00000 : "0:RPM"
[    1.570613] 0x000000c00000-0x000000c80000 : "0:RPM_1"
[    1.575250] 0x000000c80000-0x000000d00000 : "0:CDT"
[    1.580412] 0x000000d00000-0x000000d80000 : "0:CDT_1"
[    1.585155] 0x000000d80000-0x000000e00000 : "0:APPSBLENV"
[    1.590334] 0x000000e00000-0x000000f80000 : "0:APPSBL"
[    1.596466] 0x000000f80000-0x000001100000 : "0:APPSBL_1"
[    1.601474] 0x000001100000-0x000001180000 : "0:ART"
[    1.606250] 0x000001180000-0x000001200000 : "0:FACENV"
[    1.610824] 0x000001200000-0x0000045a0000 : "rootfs"
[    1.653370] mtd: device 17 (rootfs) set to be root filesystem
[    1.653629] mtdsplit: no squashfs found in "rootfs"
[    1.658108] 0x0000045a0000-0x000007940000 : "rootfs_1"
[    1.700746] 0x000007940000-0x000007b40000 : "CFG"
[    1.702872] 0x000007b40000-0x000007b80000 : "POT"
[    1.705242] 0x000007b80000-0x000007c80000 : "LOG"
[    1.731375] mtdoops: Attached to MTD device 21
[    1.732597] libphy: Fixed MDIO Bus: probed
[    1.955450] qca-mdio 90000.mdio: Could not find phy-reset-gpio
[    1.955564] libphy: qca_mdio: probed
[    1.960541] qca-mdio 90000.mdio: qca-mdio driver was registered
[    1.964009] cnss: INFO: IPC Logging is disabled!
[    1.969850] cnss[27]: INFO: Platform driver probed successfully. plat ffffffc01c900018 tgt 0x1104
[    1.974823] cnss[27]: INFO: PCI device ffffffc01d5b6800 probed successfully
[    1.983223] i2c /dev entries driver
[    2.034512] device-mapper: ioctl: 4.34.0-ioctl (2015-10-28) initialised: dm-devel@redhat.com
[    2.035580] qcom_ice_get_device_tree_data: No vdd-hba-supply regulator, assuming not needed
[    2.042061] ICE IRQ = 32
[    2.050615] 
[    2.050615] Version Rollback Feature Disabled
[    2.055383] qcom-q6v5-wcss-pil cd00000.qcom_q6v5_wcss: ssr registeration success qcom_q6v5_wcss
[    2.058576] remoteproc remoteproc0: cd00000.qcom_q6v5_wcss is available
[    2.067773] of_graph_get_next_endpoint(): no port node found in /soc/csr@6001000
[    2.073769] coresight-csr 6001000.csr: CSR initialized
[    2.081483] of_graph_get_next_endpoint(): no port node found in /soc/cti@6010000
[    2.086447] of_graph_get_next_endpoint(): no port node found in /soc/cti@6011000
[    2.093973] of_graph_get_next_endpoint(): no port node found in /soc/cti@6012000
[    2.101367] of_graph_get_next_endpoint(): no port node found in /soc/cti@6013000
[    2.108746] of_graph_get_next_endpoint(): no port node found in /soc/cti@6014000
[    2.116124] of_graph_get_next_endpoint(): no port node found in /soc/cti@6015000
[    2.123485] of_graph_get_next_endpoint(): no port node found in /soc/cti@6016000
[    2.130882] of_graph_get_next_endpoint(): no port node found in /soc/cti@6017000
[    2.138258] of_graph_get_next_endpoint(): no port node found in /soc/cti@6018000
[    2.145648] of_graph_get_next_endpoint(): no port node found in /soc/cti@6019000
[    2.153002] of_graph_get_next_endpoint(): no port node found in /soc/cti@601a000
[    2.160399] of_graph_get_next_endpoint(): no port node found in /soc/cti@601b000
[    2.167771] of_graph_get_next_endpoint(): no port node found in /soc/cti@601c000
[    2.175162] of_graph_get_next_endpoint(): no port node found in /soc/cti@601d000
[    2.182518] of_graph_get_next_endpoint(): no port node found in /soc/cti@601e000
[    2.189912] of_graph_get_next_endpoint(): no port node found in /soc/cti@601f000
[    2.197295] of_graph_get_next_endpoint(): no port node found in /soc/cti@6198000
[    2.204813] of_graph_get_next_endpoint(): no port node found in /soc/cti@6199000
[    2.212148] of_graph_get_next_endpoint(): no port node found in /soc/cti@619a000
[    2.219575] of_graph_get_next_endpoint(): no port node found in /soc/cti@619b000
[    2.226992] of_graph_get_next_endpoint(): no port node found in /soc/cti@610c000
[    2.234339] sps_register_bam_device : unable to create IPC Logging 0 for bam 0x0000000006064000
[    2.241408] sps_register_bam_device : unable to create IPC Logging 1 for bam 0x0000000006064000sps_register_bam_device : unable to create IPC Logging 2 for bam 0x0000000006064000
[    2.258516] sps_register_bam_device : unable to create IPC Logging 3 for bam 0x0000000006064000sps_register_bam_device : unable to create IPC Logging 4 for bam 0x0000000006064000
[    2.274400] sps:BAM 0x0000000006064000 is registered.[    2.282086] coresight-tmc 6048000.tmc: TMC initialized
[    2.286840] coresight-tmc 6047000.tmc: TMC initialized
[    2.291981] coresight-funnel 6041000.funnel: FUNNEL initialized
[    2.297029] coresight-funnel 6100000.funnel: FUNNEL initialized
[    2.302815] coresight-funnel 6130000.funnel: FUNNEL initialized
[    2.308738] coresight-funnel 6120000.funnel: FUNNEL initialized
[    2.314656] coresight-funnel 61a1000.funnel: FUNNEL initialized
[    2.321037] coresight-etm4x 619c000.etm: ETM 4.0 initialized
[    2.326770] coresight-etm4x 619d000.etm: ETM 4.0 initialized
[    2.332684] coresight-etm4x 619e000.etm: ETM 4.0 initialized
[    2.338378] coresight-etm4x 619f000.etm: ETM 4.0 initialized
[    2.343654] coresight-replicator-qcom 6046000.replicator: REPLICATOR 1.0 initialized
[    2.349405] coresight-stm 6002000.stm: STM initialized
[    2.357900] of_graph_get_next_endpoint(): no port node found in /soc/hwevent@6101000
[    2.361813] coresight-hwevent 6101000.hwevent: Hardware Event driver initialized
[    2.370996] NET: Registered protocol family 10
[    2.377697] NET: Registered protocol family 17
[    2.381280] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    2.385734] Bridge firewalling registered
[    2.398447] 8021q: 802.1Q VLAN Support v1.8
[    2.402434] dev-monitor: Device monitor module version 0.0.1 init
[    2.407722] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    2.413275] ubi0: attaching mtd17
[    2.643887] ubi0: scanning is finished
[    2.650124] ubi0: attached mtd17 (name "rootfs", size 51 MiB)
[    2.650149] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    2.654859] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    2.661614] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    2.668482] ubi0: good PEBs: 413, bad PEBs: 0, corrupted PEBs: 0
[    2.675250] ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
[    2.681494] ubi0: max/mean erase counter: 10/3, WL threshold: 4096, image sequence number: 710607249
[    2.688539] ubi0: available PEBs: 0, total reserved PEBs: 413, PEBs reserved for bad PEB handling: 20
[    2.697838] ubi0: background thread "ubi_bgt0d" started, PID 117
[    2.709182] hctosys: unable to open rtc device (rtc0)
[    2.723105] ALSA device list:
[    2.723129]   No soundcards found.
[    2.727900] VFS: Mounted root (squashfs filesystem) readonly on device 31:24.
[    2.728522] Freeing unused kernel memory: 236K (ffffffc0007fd000 - ffffffc000838000)
[    2.735632] Freeing alternatives memory: 40K (ffffffc000838000 - ffffffc000842000)
[    2.862085] random: nonblocking pool is initialized
[    3.245759] init: Console is alive
[    3.245918] init: - watchdog -
[    4.983922] Button Hotplug driver version 0.4.1
[    4.985255] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    4.988447] SCSI subsystem initialized
[    5.254384] init: - preinit -
Before mount_root
[    5.529159] UBIFS (ubi0:3): background thread "ubifs_bgt0_3" started, PID 138
[    5.557778] UBIFS (ubi0:3): recovery needed
[    5.636066] UBIFS (ubi0:3): recovery completed
[    5.636144] UBIFS (ubi0:3): UBIFS: mounted UBI device 0, volume 3, name "rootfs_data"
[    5.639400] UBIFS (ubi0:3): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    5.647328] UBIFS (ubi0:3): FS size: 20062208 bytes (19 MiB, 158 LEBs), journal size 1015809 bytes (0 MiB, 8 LEBs)
[    5.657211] UBIFS (ubi0:3): reserved for root: 947587 bytes (925 KiB)
[    5.667449] UBIFS (ubi0:3): media format: w4/r0 (latest is w4/r0), UUID 2638669B-7F84-4A39-9D87-FB8B9DA393E3, small LPT model
[    5.677526] mount_root: switching to jffs2 overlay
After mount_root
65536+0 records in
65536+0 records out
65536 bytes (64.0KB) copied, 0.308460 seconds, 207.5KB/s
131072+0 records in
131072+0 records out
131072 bytes (128.0KB) copied, 0.626114 seconds, 204.4KB/s
ln: /lib/firmware/qcn9000/caldata_1.bin: File exists
[    6.671868] procd: - early -
[    6.672818] procd: - watchdog -
[    7.314742] procd: - ubus -
[    8.317726] procd: - init -
Please press Enter to activate this console.
[    8.763028] ubi: mtd17 is already attached to ubi0 WIFI FW mount is successful

[   10.291567] ubi: mtd17 is already attached to ubi0[   10.699718] ntfs: driver 2.1.32 [Flags: R/O MODULE].
[   10.704828] Initializing XFRM netlink socket
[   10.705824] NET: Registered protocol family 15
[   10.757129] ssdk_switch_device_num_init[1159]:INFO:ess-switch dts node number: 1
[   10.757230] ssdk_dt_get_switch_node[970]:INFO:ess-switch DT exist!
[   10.763594] ssdk_dt_parse_access_mode[856]:INFO:switch_access_mode: local bus
[   10.769610] ssdk_dt_parse_access_mode[869]:INFO:switchreg_base_addr: 0x3a000000
[   10.776798] ssdk_dt_parse_access_mode[870]:INFO:switchreg_size: 0x1000000
[   10.783903] ssdk_dt_parse_mac_mode[295]:INFO:mac mode = 0x0
[   10.790855] ssdk_dt_parse_mac_mode[304]:INFO:mac mode1 = 0xf
[   10.796240] ssdk_dt_parse_mac_mode[313]:INFO:mac mode2 = 0xff
[   10.802138] ssdk_dt_parse_phy_info[659]:INFO:[PORT 5] port_mac_sel = QGMAC_PORT
[   10.807819] ssdk_dt_parse_uniphy[332]:INFO:ess-uniphy DT exist!
[   10.815067] ssdk_dt_parse_intf_mac[801]:INFO:dp1 MAC 6c:a6:04:[REDACTED]
[   10.821022] ssdk_plat_init start
[   10.905895] ssdk_gcc_clock_init[1033]:INFO:SSDK gcc clock init successfully!
[   10.906299] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   10.906511] HPPE initializing...
[   10.906577] ssdk_phy_driver_init[328]:INFO:dev_id = 0, phy_adress = 0, phy_id = 0xffffffff phytype doesn't match
[   10.906609] ssdk_phy_driver_init[328]:INFO:dev_id = 0, phy_adress = 1, phy_id = 0xffffffff phytype doesn't match
[   10.906641] ssdk_phy_driver_init[328]:INFO:dev_id = 0, phy_adress = 2, phy_id = 0xffffffff phytype doesn't match
[   10.906672] ssdk_phy_driver_init[328]:INFO:dev_id = 0, phy_adress = 3, phy_id = 0xffffffff phytype doesn't match
[   10.906705] qca808x_phy_api_ops_init[2208]:INFO:qca probe qca808x phy driver succeeded!
[   10.907493] regi_init[3567]:INFO:Initializing HPPE!!
[   10.971329] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   11.124108] ssdk_ppe_reset_init[1265]:INFO:ppe reset successfully!
[   11.127198] qca_hppe_tdm_hw_init[684]:INFO:tdm setup num=96
[   11.129446] qca_hppe_portctrl_hw_init[107]:INFO:Cypress PPE port initializing
[   11.244528] __adpt_hppe_uniphy_psgmii_mode_set[635]:INFO:uniphy 0 psgmii channel selection
[   12.491173] ssdk_switch_register[1718]:INFO:Chip version 0x1501
[   12.491210] qca_link_polling_select[1315]:INFO:link-polling-required node does not exist
[   12.495909] ssdk_switch_register[1744]:INFO:polling is selected
[   12.504236] regi_init[3571]:INFO:Initializing HPPE Done!!
[   12.509924] regi_init[3631]:INFO:qca-ssdk module init succeeded!
[   12.521629] tun: Universal TUN/TAP device driver, 1.6
[   12.521655] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[   12.530445] EDMA ver 1 hw init
[   12.532738] EDMA HW Reset completed succesfully
[   12.535628] Num rings - TxDesc:1 (23-23) TxCmpl:1 (23-23)
[   12.539985] RxDesc:1 (15-15) RxFill:1 (7-7)
[   12.747440] **********************************************************
[   12.747467] * NSS Data Plane driver
[   12.747695] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   12.756272] **********************************************************
[   12.772819] l2tp_core: L2TP core driver, V2.0
[   12.773427] l2tp_netlink: L2TP netlink interface
[   13.124855] nss_driver - fw of size 857212  bytes copied to load addr: 40000000, nss_id : 0
[   13.127298] Supported Frequencies - 
[   13.132002] 187.2 MHz 748.8 MHz 
[   13.137985] 1.4976 GHz [   13.138942] 
[   13.141326] ffffffbffc542e00: set sdma ffffffc01a560400
[   13.142882] node size 2 # items 4
[   13.147734] memory: 40000000 536870912 (avl 396427264) items 4 active_cores 1
[   13.151198] addr/size storage words 2 2 # words 4 in DTS, ddr size 1000000
[   13.158327] ffffffbffc542e00: NSS core 0 DDR from 40000000 to 41000000
[   13.165231] ffffffbffc542e00: meminfo init succeed
[   13.177566] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   13.201363] sit: IPv6 over IPv4 tunneling driver
[   13.203019] node size 2 # items 4
[   13.204661] nat46: module (version 8ff2ae59ec9840a7b8b45f976c51cae80abe0226) loaded.
[   13.207146] gre: GRE over IPv4 demultiplexor driver
[   13.208123] ip_gre: GRE over IPv4 tunneling driver
[   13.210204] ip6_gre: GRE over IPv6 tunneling driver
[   13.213407] Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
[   13.230317] memory: 40000000 536870912 (avl 396541952) items 4 active_cores 1
[   13.230625] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   13.240519] nf_conntrack version 0.5.0 (2853 buckets, 11412 max)
[   13.244519] openvswitch: Open vSwitch switching datapath
[   13.255414] addr/size storage words 2 2 # words 4 in DTS, ddr size 1000000
[   13.256586] PPP generic driver version 2.4.2
[   13.267393] ffffffbffc542e00: nss core 0 booted successfully
[   13.315186] nss_lag_init[352]:LAG Manager Installed
[   13.317118] NET: Registered protocol family 24
[   13.321721] PPTP driver version 0.8.5
[   13.331209] diag: IPC Logging disabled
[   13.331791] TRACK: P[0]	PMask[4]
[   13.333842] TRACK: P[1]	PMask[4]
[   13.337280] TRACK: P[2]	PMask[4]
[   13.344307] TRACK: P[3]	PMask[4]
[   13.344391] nik 4097 info->svc_id
[   13.349614] QCA multicast snooping installed successfully
[   13.352327] <NSS-CRYPTO>:module loaded Build_ID - 05/20/22, 00:03:30 SoC=ipq60xx_64
[   13.357922] nss-macsec0 DT exist!
[   13.357987] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   13.404837] cannot find nss-macsec1 node
[   13.404914] cannot find nss-macsec2 node
[   13.407815] nss_macsec init success
[   13.432242] u32 classifier
[   13.432262]     input device check on
[   13.433831]     Actions configured
[   13.438756] Mirror/redirect action on
[   13.455301] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4

rwg · November 3, 2025, 7:12am

Boot log, part two:

[   13.466066] fuse init (API version 7.23)
[   13.470298] arp_tables: (C) 2002 David S. Miller
[   13.481246] Ebtables v2.0 registered
[   13.484132] ip_tables: (C) 2000-2006 Netfilter Core Team
[   13.489443] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[   13.513753] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   13.605770] nf_conntrack_rtsp v0.6.21 loading
[   13.720326] nf_nat_rtsp v0.6.21 loading
[   13.725595] PPP MPPE Compression module registered
[   13.752195] xt_time: kernel timezone is -0000
qcawifi configuration is disable
[   18.444760] configuring additional NSS pbufs
[   18.455571] additional pbufs of size 3100672 got added to NSS
[   18.491552] mem_manager: module license 'Proprietary' taints kernel.
[   18.491582] Disabling lock debugging due to kernel taint
[   19.322791] wlan: [1062:I:RPTR] qca_multi_link_init_module: 
[   19.322791] ******QCA Repeater Initialization Done***********
[   19.322791] 
***** starting cnssdaemon  -i integrated -i pci0 *****
*****cnssdaemon pid=1130*********
[   20.496613] cnss[27]: INFO: Setting daemon_support=1 for instance_id 0x27
[   20.539252] cnss: ERR: Failed to get plat_priv for instance_id 0x2
[   20.553900] cnss[27]: INFO: Setting cold_boot_support=1 for instance_id 0x27
[   20.595860] cnss: ERR: Failed to get plat_priv for instance_id 0x2
*********initiating cold boot calibration*************
[   21.014862] wlan: [1212:I:ANY] =======ol_if_register_wifi3_0==========
[   21.014862] 
[   21.014911] wlan: [1212:I:ANY] osif_nss_register_module: NSS wifi ops registered for target_type:1 with soc_ops:ffffffbffd3c0b78
[   21.022079] wlan: [1212:I:ANY] ol_ath_wifi_ssr: ol_ath_wifi_ssr: SSR event 2 bus_type 0
[   21.033590] cnss_pci 0000:01:00.0: BAR 0: assigned [mem 0x20400000-0x205fffff 64bit]
[   21.041338] cnss_pci 0000:01:00.0: enabling device (0000 -> 0002)
[   21.049923] cnss[27]: INFO: MHI IPC Logging is disabled!
[   22.331075] wlan: [1212:I:ANY] ol_ath_wifi_ssr: ol_ath_wifi_ssr: SSR event 3 bus_type 0
[   22.331129] cnss[27]: INFO: Waiting for FW ready. Device: 0x1104, FW ready timeout: 15 seconds
[   22.331790] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   22.332337] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   22.333200] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   22.337355] cnss[27]: INFO: QMI WLFW service connected, state: 0x11
[   22.337950] cnss[27]: INFO: device_id : 4356 mem mode : [1]
[   22.469110] cnss[27]: INFO: platform name: Qualcomm Technologies, Inc. IPQ6018/AP-CP01-C3
[   22.469110] cnss[27]: INFO: Target capability: chip_id: 0x0, chip_family: 0x0, board_id: 0xff, soc_id: 0xffffffff, fw_version: 0x250282e9, fw_build_timestamp: 2021-08-05 01:14, otp_version: 0x0 eeprom_caldata_read_timeout 0s
[   22.489837] cnss[27]: INFO: Downloading BDF: qcn9000/bdwlan.ba3, size: 131072
[   22.515370] cnss[27]: INFO: Downloading BDF: qcn9000/caldata_1.bin, size: 131072
[   22.704114] cnss[27]: INFO: FW ready received for device 0x1104
[   22.704163] wlan: [1212:I:ANY] pld_pcie_wlan_enable: pld_pcie_wlan_enable: Invalid wlan_cfg config
[   22.708846] cnss[27]: INFO: Sending mode message, mode: COLDBOOT CALIBRATION(7), state: 0x1f
[   22.811221] wlan: [1212:I:ANY] init_ath_pci_3_0: 6ath_ol_pci_wifi3.0 :  (Atheros/multi-bss)
[   22.818730] wlan: [1217:I:ANY] ol_ath_wifi_ssr: ol_ath_wifi_ssr: SSR event 0 bus_type 0
[   22.818778] cnss[27]: INFO: Coldboot Calbration wait started for Device: 0x1104, timeout: 60 seconds
[   47.445921] cnss[27]: INFO: Coldboot Calibration completed successfully for device 0x1104
[   47.464148] cnss[27]: INFO: Coldboot Calibration wait ended for device 0x1104
[   47.464191] cnss[27]: INFO: Sending mode message, mode: OFF(4), state: 0x127
[   47.472849] cnss[27]: INFO: QMI WLFW service disconnected, state: 0x126
[   47.472853] cnss[27]: INFO: Shutting down QCN9000
[   47.504304] Removing device for chan:LOOPBACK
[   47.504330] mhi_reset_data_chan rp           (null) wp           (null)
[   47.507655] mhi_reset_data_chan rp           (null) wp           (null)
[   47.514263] Removing device for chan:DIAG
[   47.520789] mhi_reset_data_chan rp ffffff8007def000 wp ffffff8007def120
[   47.524917] mhi_reset_data_chan rp ffffff8007ded000 wp ffffff8007ded000
[   47.531404] Removing device for chan:IPCR
[   47.537886] mhi_reset_data_chan rp ffffff8007dfc0b0 wp ffffff8007dfc0a0
[   47.542321] mhi_reset_data_chan rp ffffff8007df6050 wp ffffff8007df6050
[   47.574192] wlan: [1217:I:ANY] ol_ath_wifi_ssr: ol_ath_wifi_ssr: SSR event 1 bus_type 0
[   47.944178] wlan: [1231:I:ANY] =======ol_if_register_wifi3_0==========
[   47.944178] 
[   47.944246] wlan: [1231:I:ANY] osif_nss_register_module: NSS wifi ops registered for target_type:1 with soc_ops:ffffffbffd666b78
[   47.951305] wlan: [1231:I:ANY] ol_ath_wifi_ssr: ol_ath_wifi_ssr: SSR event 2 bus_type 0
[   47.962908] cnss_pci 0000:01:00.0: BAR 0: assigned [mem 0x20400000-0x205fffff 64bit]
[   47.971284] cnss[27]: INFO: MHI IPC Logging is disabled!
[   48.407269] wlan: [1231:I:ANY] ol_ath_wifi_ssr: ol_ath_wifi_ssr: SSR event 3 bus_type 0
[   48.407322] cnss[27]: INFO: Waiting for FW ready. Device: 0x1104, FW ready timeout: 15 seconds
[   48.407961] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   48.408508] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   48.409380] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   48.413477] cnss[27]: INFO: QMI WLFW service connected, state: 0x11
[   48.414180] cnss[27]: INFO: device_id : 4356 mem mode : [1]
[   48.438755] cnss[27]: INFO: platform name: Qualcomm Technologies, Inc. IPQ6018/AP-CP01-C3
[   48.438755] cnss[27]: INFO: Target capability: chip_id: 0x0, chip_family: 0x0, board_id: 0xff, soc_id: 0xffffffff, fw_version: 0x250282e9, fw_build_timestamp: 2021-08-05 01:14, otp_version: 0x0 eeprom_caldata_read_timeout 0s
[   48.439164] cnss[27]: INFO: Downloading BDF: qcn9000/bdwlan.ba3, size: 131072
[   48.458289] cnss[27]: INFO: Downloading BDF: qcn9000/caldata_1.bin, size: 131072
[   48.491689] cnss[27]: INFO: FW ready received for device 0x1104
[   48.500044] cnss[27]: INFO: Sending mode message, mode: MISSION(0), state: 0x17
[   48.524567] wlan: [1231:I:ANY] qca_napi_create: qca_napi_create: napi instance 0 created on pipe 4
[   48.524886] wlan: [1231:I:ANY] __ol_ath_attach: Allocated soc ffffffc016600880
[   48.532507] wlan: [1231:D:dfs] WLAN_DEBUG_DFS1 : dfs_psoc_obj_create_notification: DFS obj attach to psoc successfully
[   48.597702] wlan: [1231:I:ANY] osif_nss_wifi_soc_setup: nss-wifili:#1 register wifili function for soc 
[   48.597751] wlan: [1231:I:ANY] osif_nss_wifi_soc_setup: nss register id -1 nss config 1 Target Type 1a 
[   48.605944] wlan: [1231:I:ANY] __ol_ath_attach: dev name soc0
[   48.615535] wlan: [1231:I:ANY] ol_ath_soc_attach: WMI attached. wmi_handle ffffffc018228000 
[   48.623858] wlan: [1231:I:MBSSIE] ol_ath_sanitize_ema_vendor_ie_config: vendor_ie_size: 0 ven_ie_size_nibble: 1
[   48.629713] wlan: [1231:I:MBSSIE] ol_ath_sanitize_ema_vendor_ie_config: vendor_ie_size: 0 ven_ie_size_nibble: 1
[   48.639518] wlan: [1231:I:MBSSIE] ol_ath_sanitize_ema_vendor_ie_config: vendor_ie_size: 0 ven_ie_size_nibble: 1
[   48.649587] wlan: [1231:I:MBSSIE] ol_ath_sanitize_ema_vendor_ie_config: vendor_ie_size: 0 ven_ie_size_nibble: 1
[   48.659655] wlan: [1231:I:MBSSIE] ol_ath_sanitize_ema_vendor_ie_config: vendor_ie_size: 0 ven_ie_size_nibble: 1
[   48.669725] wlan: [1231:I:MBSSIE] ol_ath_sanitize_ema_vendor_ie_config: vendor_ie_size: 0 ven_ie_size_nibble: 1
[   48.679795] wlan: [1231:I:MBSSIE] ol_ath_sanitize_ema_vendor_ie_config: vendor_ie_size: 0 ven_ie_size_nibble: 7
[   48.689862] wlan: [1231:I:MBSSIE] ol_ath_sanitize_ema_vendor_ie_config: vendor_ie_size: 0 ven_ie_size_nibble: 7
[   48.699933] wlan: [1231:I:MBSSIE] ol_ath_sanitize_ema_vendor_ie_config: vendor_ie_size: 0 ven_ie_size_nibble: 7
[   48.710002] wlan: [1231:I:MBSSIE] ol_ath_sanitize_ema_vendor_ie_config: vendor_ie_size: 0 ven_ie_size_nibble: 7
[   48.720072] wlan: [1231:I:MBSSIE] ol_ath_sanitize_ema_vendor_ie_config: vendor_ie_size: 0 ven_ie_size_nibble: 1
[   48.730146] wlan: [1231:I:MBSSIE] ol_ath_sanitize_ema_vendor_ie_config: vendor_ie_size: 0 ven_ie_size_nibble: 1
[   48.740211] wlan: [1231:I:MBSSIE] ol_ath_sanitize_ema_vendor_ie_config: vendor_ie_size: 0 ven_ie_size_nibble: 1
[   48.750280] wlan: [1231:I:MBSSIE] ol_ath_sanitize_ema_vendor_ie_config: vendor_ie_size: 0 ven_ie_size_nibble: 7
[   48.760350] wlan: [1231:I:MBSSIE] ol_ath_sanitize_ema_vendor_ie_config: vendor_ie_size: 0 ven_ie_size_nibble: 7
[   48.770464] wlan: [1231:I:ANY] htc_wmi_init: HT Create . ffffffc01860c000
[   48.780492] wlan: [1231:I:ANY] htc_wmi_init: Skipping BMI Done
[   48.787424] wlan: [1231:I:ANY] htc_wmi_init: host_enable 0
[   48.796442] wlan: [1231:F:ANY] dp_config_full_mon_mode: Configure full monitor mode val: 1 
[   48.802656] wlan: [1231:I:ANY] ol_target_init_complete: CDP soc attach success
[   48.806882] wlan: [1231:I:ANY] ol_target_init_complete: Soc attach success NSS config 0 
[   48.814249] wlan: [1231:I:ANY] htc_set_async_ep: htc_set_async_ep: htc_handle ffffffc01860c000, ep 2, value 1
[   48.823506] wlan: [819:I:TIF] HE_CAP Info = 9a18010d
[   48.832232] wlan: [819:I:TIF] Num HW modes = 1
[   48.837248] wlan: [819:I:TIF] Num PHY = 1
[   48.841490] wlan: [819:I:TIF] FW Build Version (Ext.) = 200
[   48.845583] wlan: [819:I:TIF] HDL Version: MajorVersion.MinorVersion = 8.3
[   48.850961] wlan: [819:I:TIF] Preferred HW Mode = 0 Num Radios = 1
[   48.857941] wlan: [819:W:TIF] add_11ax_mode_flags: 11AX wireless modes are not populated by the target in reg capabilities, adding 11AX wireless modes
[   48.864123] wlan: [819:I:TIF] init_deinit_add_11ax_modes: hw_mode_id = 0 phy_id = 0 wireless modes = 0
[   48.878230] wlan: [819:I:TIF] init_deinit_alloc_pdevs: CDP PDEV ATTACH success
[   48.886827] wlan: [819:I:TIF] init_deinit_get_total_num_ema_vaps: num_radios: 1
[   48.894016] wlan: [819:I:TIF] init_deinit_get_total_num_ema_vaps: ema_max_vap_cnt: 0
[   48.901234] wlan: [819:I:TIF] init_deinit_get_total_num_vdevs_for_soc: num_vdevs: 9
[   48.909220] wlan: [819:I:TIF] init_deinit_set_per_pdev_mbssid_config: pdev supporting 6ghz
[   48.916596] wlan: [819:I:TIF] init_deinit_set_per_pdev_mbssid_config: MBSSID feature enabled for 6ghz pdev  - pdev_idx: 0
[   48.924935] wlan: [819:I:TIF] init_deinit_set_per_pdev_mbssid_config: EMA AP feature enabled for 6Ghz pdev - pdev_idx: 0
[   48.935960] wlan: [819:I:TIF] init_deinit_get_total_num_ema_vaps: num_radios: 1
[   48.946890] wlan: [819:I:TIF] init_deinit_get_total_num_ema_vaps: ema_max_vap_cnt: 16
[   48.953912] wlan: [819:I:TIF] init_deinit_get_total_num_vdevs_for_soc: num_vdevs: 16
[   48.961910] wlan: [819:I:TIF] init_deinit_get_total_num_ema_vaps: num_radios: 1
[   48.969718] wlan: [819:I:TIF] init_deinit_get_total_num_ema_vaps: ema_max_vap_cnt: 16
[   48.976753] wlan: [819:I:TIF] init_deinit_get_ema_max_pp: ema_ap_max_pp: 6
[   48.984735] wlan: [819:I:TIF] init_deinit_get_total_num_ema_vaps: num_radios: 1
[   48.991498] wlan: [819:I:TIF] init_deinit_get_total_num_ema_vaps: ema_max_vap_cnt: 16
[   48.998713] wlan: [819:I:TIF] init_deinit_get_total_num_vdevs_for_soc: num_vdevs: 16
[   49.006704] wlan: [819:I:TIF] init_deinit_get_total_num_ema_vaps: num_radios: 1
[   49.014558] wlan: [819:I:TIF] init_deinit_get_total_num_ema_vaps: ema_max_vap_cnt: 16
[   49.021534] wlan: [819:I:TIF] init_deinit_get_total_num_vdevs_for_soc: num_vdevs: 16
[   49.029536] wlan: [819:I:ANY] init_deinit_update_pdev_tgt_info: pdev id:0 wmi_handle:ffffffc018228000
[   49.039934] wlan: [819:I:ANY] init_deinit_update_pdev_tgt_info: Pdev = 0 Number of peers = 137 vdevs = 9
[   49.046466] wlan: [819:I:TIF] init_deinit_update_pdev_tgt_info: CDP PDEV INIT success
[   49.156198] wlan: [819:I:ANY] copy_fw_abi_version_tlv: copy_fw_abi_version_tlv: INIT_CMD version: 1, 0, 0x5f414351, 0x4c4d, 0x0, 0x0
[   49.455122] wlan: [819:I:ANY] ready_extract_init_status_tlv: ready_extract_init_status_tlv:0
[   49.455162] wlan: [819:E:TIF] init_deinit_ready_event_handler: Host Requested 144 peers. FW Supports 137 peers
[   49.462635] wlan: [819:I:ANY] dp_peer_map_attach_wifi3: dp_peer_map_attach_wifi3 max_peers 163, max_ast_index: 528
[   49.462635] 
[   49.472559] wlan: [1231:I:ANY] ol_ath_connect_htc: WMI is ready
[   49.491448] wlan: [1231:I:ANY] ath_get_radio_index: Error: Could not match the device name : wifi%d
[   49.491491] wlan: [1231:E:NSS] [nss-wifili]: pdev:ffffffc016ba0880 radio_ifnum:28 scheme_id:0 radio_priority:1 
[   49.503384] wlan: [1231:E:TIF] target_if_lro_hash_config: pdev with id 0 is NULL
[   49.509795] wlan: [1231:I:ANY] ol_ath_soc_attach: connect HTC
[   49.517021] wlan: [1231:I:ANY] ol_ath_soc_attach: bypasswmi : 0
[   49.522684] wlan: [1231:I:MSCS] qca_mscs_module_init: 
[   49.522684] ****QCA MSCS Initialization Done**** SoC ffffffc016600880
[   49.528397] wlan: [1231:I:ANY] ol_ath_soc_attach: UMAC attach
[   49.540271] wlan: [1231:I:ANY] __ol_ath_attach: pdev_netdev name wifi0
[   49.545853] wlan: [1231:I:ANY] __ol_ath_attach: Skip txrx_pdev_attach_target
[   49.553448] wlan: [1231:I:ANY] __ol_ath_attach: BURSTING enabled by default
[   49.559553] wlan: [1231:I:ANY] ol_ath_pdev_attach: interface_id 0
[   49.566158] wlan: [1231:I:TIF] ol_ath_pdev_regdmn_init:  phy id = 0 Modes supported
[   49.572393] wlan: [1231:I:TIF] ol_ath_pdev_regdmn_init:  11b = 0 11g = 0 11a = 1 11n = 1 11ac = 1 11ax = 1
[   49.579874] wlan: [1231:I:TIF] ol_ath_pdev_regdmn_init:  Reg cap - phy_id = 0 supp_bnd = 2, modes = f9000000, lo_2g = 0, hi_2g = 0 lo_g5 = 5925, hi_5g = 7125
[   49.589600] wlan: [1231:I:ANY] ol_ath_update_wireless_modes: wireless_modes = f9000000 before update
[   49.603739] wlan: [1231:I:ANY] ol_ath_update_wireless_modes: Wireless_modes = f9000000 after update
[   49.612943] wlan: [1231:I:ANY] ol_ath_update_ext_caps: 11ax 5G supported case
[   49.621766] wlan: [1231:I:MBSSIE] ol_ath_assign_mbssid_ref_bssid: MBSSID reference bssid is 02:03:7f:12:ba:ba soc: soc0 pdev: wifi0
[   49.629119] wlan: [1231:I:MBSSIE] ieee80211_mbss_attach: :>
[   49.640630] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: config_low: 0x77111111
[   49.646190] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: config_high: 0x7711177
[   49.656261] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: beacon position for mbss cache node with bssidx: 1 is 0
[   49.666073] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: beacon position for mbss cache node with bssidx: 2 is 0
[   49.678664] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: beacon position for mbss cache node with bssidx: 3 is 0
[   49.691335] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: beacon position for mbss cache node with bssidx: 4 is 1
[   49.704007] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: beacon position for mbss cache node with bssidx: 5 is 1
[   49.716680] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: beacon position for mbss cache node with bssidx: 6 is 1
[   49.729355] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: beacon position for mbss cache node with bssidx: 7 is 2
[   49.742028] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: beacon position for mbss cache node with bssidx: 8 is 2
[   49.754710] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: beacon position for mbss cache node with bssidx: 9 is 3
[   49.767377] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: beacon position for mbss cache node with bssidx: 10 is 3
[   49.780051] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: beacon position for mbss cache node with bssidx: 11 is 4
[   49.792723] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: beacon position for mbss cache node with bssidx: 12 is 4
[   49.805482] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: beacon position for mbss cache node with bssidx: 13 is 4
[   49.818244] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: beacon position for mbss cache node with bssidx: 14 is 5
[   49.831007] wlan: [1231:I:MBSSIE] ieee80211_allocate_beacon_pos_for_mbss_cache_nodes: beacon position for mbss cache node with bssidx: 15 is 5
[   49.843765] wlan: [1231:I:MBSSIE] ieee80211_determine_max_non_transmit_vaps: :< 16
[   49.856513] wlan: [1231:I:MBSSIE] ieee80211_mbss_attach: :<
[   49.864055] wlan: [1231:I:ANY] ol_resmgr_create: OL Resmgr Init-ed
[   49.869735] wlan: [1231:I:ANY] acfg_attach: acfg_attach: 3323: Netlink socket created:ffffffc01822b800
[   49.875798] wlan: [1231:I:ANY] ol_ath_stats_attach: periodic_chan_stats: 1
[   49.886552] wlan: [1231:I:ANY] wlan_scan_update_channel_list: num_chan: 59
[   49.892071] wlan: [0:I:ANY] ol_ath_pdev_attach: Set global_ic[1], ptr:ffffffbffd071560
[   49.898797] wlan: [0:I:ANY] dp_lag_soc_enable: pdev(ffffffc014642810) Enabling DBDC Repeater 0  soc_lag ffffffc01b445100
[   49.906721] wlan: [0:I:ANY] dp_lag_pdev_set_primary_radio: pdev(ffffffc014642810) is_primary 0 
[   49.906728] wlan: [0:E:NSS] [nss-wifili]: NSS Wifili DBDC Repeater enable message passed
[   49.926750] wlan: [0:I:ANY] ol_ath_twt_enable_complete_event_handler: twt enabled
[   49.926975] wlan: [1231:E:CFR] cfr_streamfs_init: Chan create failed
[   49.927008] wlan: [1231:E:CFR] wlan_cfr_pdev_open: cfr_streamfs_init failed with 16
[   49.927008] 
[   49.927049] wlan: [1231:I:ANY] ol_ath_ucfg_set_rx_pkt_protocol_tagging: Set RX packet type TAG, opcode : 0, pkt_type : 18, metadata : 0xca0,pdev_id = 0, REO dest ring = 5
[   49.927049] 
[   49.927188] wlan: [1231:I:ANY] ol_ath_pri20_cfg_blockchanlist_parse: cfg block channel list is empty
[   49.927207] wlan: [1231:I:ANY] ol_ath_configure_cong_ctrl_max_msdus: pdev_idx = 0 tx_desc_limit = 8192
[   49.927265] wlan: [1231:I:ANY] __ol_ath_attach: needed_headroom reservation 60
[   49.927278] wlan: [1231:I:ANY] ol_ath_enable_fraglist: Enabled Fraglist bit for the radio wifi0 features 41 
[   49.927601] wlan: [1231:I:ANY] ieee80211_cfg80211_radio_attach: ic: 0xffffffc016ba0880, wdev: 0xffffffc016bb8940, wiphy: 0xffffffc016fedaa0, netdev: 0xffffffc016ba0000 
[   49.928426] wlan: [1231:I:Dynamic Mode Change] ol_ath_check_and_reconfig_hw_mode: Running with HW mode = 0
[   49.928865] wlan: [1231:E:QLD] qld_register: Handle or address is NULL
[   49.928909] wlan: [1231:I:ANY] wlan_pdev_operation: num_radios=1, wifi_radios[0].sc = ffffffc016ba0880_radio_type = 2
[   49.928924] Event 0x3 is registered for RC 0
[   49.928950] wlan: [1231:I:ANY] init_ath_pci_3_0: 6ath_ol_pci_wifi3.0 :  (Atheros/multi-bss)
[   50.084750] wlan: [1237:I:ANY] osif_nss_register_module: NSS wifi ops registered for target_type:0 with soc_ops:ffffffbffd1bd058
[   50.085129] wlan: [1237:I:ANY] init_ath_pci_2_0: 6ath_ol_pci_2_0:  (Atheros/multi-bss)
No Direct-Attach chipsets found.
acfg_tool: Issuing blocking call to wait for events
Start mdnsrecord.
acfg_tool: Issuing blocking call to wait for events
[   54.607025] copy from user[10]: |ath01 eth0|
[   54.607052] listening on interface: |ath01||eth0|
[   55.776280] ECM init
[   55.776343] ECM database jhash random seed: 0x1b108253
[   55.814643] ECM init complete
[   55.828909] ECM OVS Test INIT
[   56.426260] device eth0 entered promiscuous mode
[   56.427668] br-lan: port 1(eth0) entered forwarding state
[   56.429993] br-lan: port 1(eth0) entered forwarding state
qcawifi qcawificfg80211 disable radio wifi0
qcawifi qcawificfg80211: enable radio wifi0
[   57.414238] br-lan: port 1(eth0) entered disabled state
[   57.519596] mc_attach: enabled snooping on br-lan.
[   58.385494] S95done (3069): drop_caches: 3
[   58.706119] wlan: [3093:I:MBSSIE] ol_ath_assign_mbssid_ref_bssid: MBSSID reference bssid is 6e:a6:04:b5:32:8f soc: soc0 pdev: wifi0
[   58.706175] wlan: [3093:I:ANY] wlan_cfg80211_set_hwaddr: wlan_cfg80211_set_hwaddr :6c:a6:04:b5:32:8f ret: 0 
[   58.757401] wlan: [3096:I:ANY] ol_ath_set_config_param: set TXBF_SND_PERIOD: val 100 stat 0
Start fotacheck-backhaul.
[   58.883366] wlan: [0:I:ANY] ol_ath_set_config_param: Disconnect_timeout value: 10
[   58.924589] wlan: [0:I:ANY] ol_ath_set_config_param: Reconfiguration_timeout value:60
**** Platform Name: ap-cp01-c3 *****
Copy ART caldata from /dev/mtdblock15 to /tmp/virtual_art.bin
number of vifs: cfg023579 
[   59.489503] wlan: [3225:I:ANY] wlan_cfg80211_add_virtual_intf: proprietary mode 1 for interface: ath0 : clone params: 0x00000001 
[   59.489591] wlan: [3225:I:MBSSIE] ieee80211_mbssid_get_num_vaps_in_mbss_cache: num_vaps: 0
[   59.500240] wlan: [3225:E:MBSSIE] osif_mbssid_sanity_check: mbssid sanity required for AP VAPs only
[   59.508504] wlan: [3225:I:MBSSIE] osif_mbssid_sanity_check: mbssid_sanity_ok: YES
[   59.517289] wlan: [3225:I:ANY] osifp_create_wlan_vap: VDEV Create 6c:a6:04:b5:32:8f
[   59.524988] wlan: [3225:I:ANY] wlan_vap_create: devhandle=0xffffffc016ba0880, opmode=IEEE80211_M_STA, flags=0x1
[   59.524988] 
[   59.533378] wlan: [3225:I:ANY] ol_ath_vap_set_param: Setting SGI value: 1
[   59.544274] wlan: [3225:I:ANY] ol_ath_vap_set_param: VDEV params:HE su_bfee:1|su_bfer:1|mu_bfee:0|mu_bfer:0|dl_muofdma:0|ul_muofdma:0|ul_mumimo:1|dl_muofdma_bfer:0
[   59.550851] wlan: [3225:I:ANY] ol_ath_vap_set_param: he_bf_cap=0x43
[   59.565323] wlan: [3225:I:ANY] ol_ath_vap_set_param: VDEV params: AC/VHT sounding mode:HE|SU/MU sounding mode:SU|Trig/Non-Trig sounding mode:Non-Trigged
[   59.571651] wlan: [3225:I:ANY] osif_nss_ol_vap_create: NSS wifi offload VAP create IF 30 nss_id -1 
[   59.585440] wlan: [3225:I:ANY] osif_nss_ol_vap_create: NSS radio_if 28
[   59.594299] wlan: [0:I:ANY] osif_nss_vdev_cfg_callback: VDEV configuration success: 0
[   59.600764] wlan: [3225:I:ANY] osif_nss_ol_vap_create: vap create ffffffc013780880 : if_num 30 
[   59.608798] wlan: [3225:I:ANY] dp_lag_pdev_set_sta_vdev: dp_lag_pdev_set_sta_vdev pdev(ffffffc014642810) sta_vdev ffffffc012f5b000 
[   59.617212] wlan: [3225:E:ANY] wlan_create_attach_vdev_rawsim_ctxt: simulation module not registerd
[   59.629389] wlan: [3225:I:ANY] osif_create_vap_complete: TX Checksum:1|SG:1|TSO:1|LRO:0
[   59.638018] wlan: [3225:I:ANY] WLAN-NSS: VAP NSS ops initialized 
[   59.646106] wlan: [3225:I:ANY] dp_lag_pdev_set_sta_vdev: dp_lag_pdev_set_sta_vdev pdev(ffffffc014642810) sta_vdev ffffffc012f5b000 
[   59.653417] wlan: [3225:I:ANY] VAP device ath0 created osifp: (ffffffc013780880) os_if: (ffffffc011e18000)
[   60.261085] wlan: [3325:I:ANY] osif_nss_vdev_set_cfg: setting me mode 5 target type 0
[   60.261129] wlan: [3325:I:ANY] osif_nss_vdev_set_cfg: Mcast command 5
[   60.268530] wlan: [3325:I:ANY] ol_ath_vap_set_param: Implicitly disabling dependant feature igmp ME
[   60.446414] wlan: [3335:I:ANY] DES SSID SET=ARRISBH-[REDACTED]
[   60.744193] nss-dp 3a001800.dp1 eth0: PHY Link up speed: 1000
[   60.744291] br-lan: port 1(eth0) entered forwarding state
[   60.748981] br-lan: port 1(eth0) entered forwarding state
[   61.083220] 8021q: adding VLAN 0 to HW filter on device ath0
[   61.237469] wlan: [2022:I:ANY] wlan_cfg80211_set_wificonfiguration: wlan_cfg80211_set_wificonfiguration: Unsuported Genric command: 0 
[   61.319448] device ath0 entered promiscuous mode
udhcpc 3396
****** Starting QDSS for qcn9000 pci0 ********
[   61.647800] coresight-funnel 6130000.funnel: FUNNEL inport 5 enabled
[   61.648000] coresight-funnel 6041000.funnel: FUNNEL inport 6 enabled
[   61.655165] coresight-tmc 6048000.tmc: TMC enabled
[   61.659562] coresight-replicator-qcom 6046000.replicator: REPLICATOR enabled
[   61.664187] coresight-tmc 6047000.tmc: TMC enabled
[   61.671363] coresight-funnel 6041000.funnel: FUNNEL inport 7 enabled
[   61.676048] coresight-stm 6002000.stm: STM tracing enabled
***** QDSS Tracing Configuration completed *******
****** Starting QDSS for Integrated ********
[   62.744110] br-lan: port 1(eth0) entered forwarding state

rwg · November 3, 2025, 7:13am

Pressing Enter to get a shell:

Please press Enter to activate this console.



BusyBox v1.35.0 (2022-05-19 23:57:40 CST) built-in shell (ash)

     MM           NM                    MMMMMMM          M       M
   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
  MMMMMMM:      MMMMMMM     M         MMMMMMMMMMMM  MMMMMMM MMMMMMM
    MMMMMM       MMMMN     M           MMMMMMMMM      MMMM    MMMM
     MMMM          M                    MMMMMMM        M       M
       M
 ---------------------------------------------------------------
   For those about to rock... (Chaos Calmer, 563cb68+r49254)
 ---------------------------------------------------------------

Contents of /proc/cpuinfo:

processor       : 0
BogoMIPS        : 48.00
Features        : fp asimd evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x51
CPU architecture: 8
CPU variant     : 0xa
CPU part        : 0x801
CPU revision    : 4

processor       : 1
BogoMIPS        : 48.00
Features        : fp asimd evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x51
CPU architecture: 8
CPU variant     : 0xa
CPU part        : 0x801
CPU revision    : 4

processor       : 2
BogoMIPS        : 48.00
Features        : fp asimd evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x51
CPU architecture: 8
CPU variant     : 0xa
CPU part        : 0x801
CPU revision    : 4

processor       : 3
BogoMIPS        : 48.00
Features        : fp asimd evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x51
CPU architecture: 8
CPU variant     : 0xa
CPU part        : 0x801
CPU revision    : 4

Hardware        : Qualcomm Technologies, Inc IPQ6010

Contents of /proc/meminfo:

MemTotal:         365244 kB
MemFree:          202488 kB
MemAvailable:     215012 kB
Buffers:            2868 kB
Cached:            13616 kB
SwapCached:            0 kB
Active:            21040 kB
Inactive:           7616 kB
Active(anon):      12860 kB
Inactive(anon):      352 kB
Active(file):       8180 kB
Inactive(file):     7264 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 4 kB
Writeback:             0 kB
AnonPages:         12312 kB
Mapped:             9944 kB
Shmem:               932 kB
Slab:              79320 kB
SReclaimable:       6140 kB
SUnreclaim:        73180 kB
KernelStack:        2928 kB
PageTables:          660 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:      182620 kB
Committed_AS:      36496 kB
VmallocTotal:   258998208 kB
VmallocUsed:           0 kB
VmallocChunk:          0 kB
CmaTotal:              0 kB
CmaFree:               0 kB

Contents of /proc/mtd:

dev:    size   erasesize  name
mtd0: 00180000 00020000 "0:SBL1"
mtd1: 00100000 00020000 "0:MIBIB"
mtd2: 00080000 00020000 "0:BOOTCONFIG"
mtd3: 00080000 00020000 "0:BOOTCONFIG1"
mtd4: 00380000 00020000 "0:QSEE"
mtd5: 00380000 00020000 "0:QSEE_1"
mtd6: 00080000 00020000 "0:DEVCFG"
mtd7: 00080000 00020000 "0:DEVCFG_1"
mtd8: 00080000 00020000 "0:RPM"
mtd9: 00080000 00020000 "0:RPM_1"
mtd10: 00080000 00020000 "0:CDT"
mtd11: 00080000 00020000 "0:CDT_1"
mtd12: 00080000 00020000 "0:APPSBLENV"
mtd13: 00180000 00020000 "0:APPSBL"
mtd14: 00180000 00020000 "0:APPSBL_1"
mtd15: 00080000 00020000 "0:ART"
mtd16: 00080000 00020000 "0:FACENV"
mtd17: 033a0000 00020000 "rootfs"
mtd18: 033a0000 00020000 "rootfs_1"
mtd19: 00200000 00020000 "CFG"
mtd20: 00040000 00020000 "POT"
mtd21: 00100000 00020000 "LOG"
mtd22: 00425718 0001f000 "kernel"
mtd23: 00376800 0001f000 "wifi_fw"
mtd24: 01097000 0001f000 "ubi_rootfs"
mtd25: 01458000 0001f000 "rootfs_data"

df -hT:

Filesystem           Type            Size      Used Available Use% Mounted on
mtd:ubi_rootfs       squashfs       16.5M     16.5M         0 100% /rom
tmpfs                tmpfs         178.3M    944.0K    177.4M   1% /tmp
/dev/ubi0_3          ubifs          17.0M    376.0K     15.8M   2% /overlay
overlayfs:/overlay   overlay        17.0M    376.0K     15.8M   2% /
tmpfs                tmpfs         512.0K         0    512.0K   0% /dev
/dev/mtdblock23      squashfs        3.5M      3.5M         0 100% /lib/firmware/IPQ6018/WIFI_FW

U-Boot things, after running fw_setenv bootdelay 5 and stopping U-Boot's autoboot on the next boot:

Hit any key to stop autoboot:  0 

Net:   MAC0 addr:0:3:7f:ba:db:ad
PHY ID1: 0x4d
PHY ID2: 0xd101
EDMA ver 1 hw init
Num rings - TxDesc:1 (0-0) TxCmpl:1 (0-0)
RxDesc:1 (15-15) RxFill:1 (7-7)
ipq6018_edma_alloc_rings: successfull
ipq6018_edma_setup_ring_resources: successfull
ipq6018_edma_configure_rings: successfull
ipq6018_edma_hw_init: successfull
eth0
Warning: eth0 MAC addresses don't match:
Address in SROM is         00:03:7f:ba:db:ad
Address in environment is  6c:a6:04:[REDACTED]

IPQ6018# version

U-Boot 2016.01-20220516 (May 16 2022 - 20:48:00 +0800)
arm-openwrt-linux-muslgnueabi-gcc (OpenWrt GCC 5.2.0 96f01c4+r49254) 5.2.0
GNU ld (GNU Binutils) 2.24.0

IPQ6018# help
?       - alias for 'help'
aq_load_fw- LOAD aq-fw-binary
aq_phy_restart- Restart Aquantia phy
base    - print or set address offset
bdinfo  - print Board Info structure
bootelf - Boot from an ELF image in memory
bootipq - bootipq from flash device
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
bootvx  - Boot vxWorks from an ELF image
bootz   - boot Linux zImage image from memory
canary  - test stack canary
chpart  - change active partition
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dhcp    - boot image via network using DHCP/TFTP protocol
dm      - Driver model low level access
echo    - echo args to console
editenv - edit environment variable
env     - environment handling commands
erase   - erase FLASH memory
exectzt - execute TZT

exit    - exit script
false   - do nothing, unsuccessfully
fdt     - flattened device tree utility commands
flash   - flash part_name
        flash part_name load_addr file_size

flasherase- flerase part_name
fuseipq - fuse QFPROM registers from memory

go      - start application at address 'addr'
help    - print command description/usage
i2c     - I2C sub-system
imxtract- extract a part of a multi-image
ipq_mdio- IPQ mdio utility commands
is_sec_boot_enabled- check secure boot fuse is enabled or not

itest   - return true/false on integer compare
loop    - infinite loop on address range
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mtdparts- define flash/nand partitions
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
part    - disk partition related commands
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
runmulticore- Enable and schedule secondary cores
saveenv - save environment variables to persistent storage
secure_authenticate- authenticate the signed image

setenv  - set environment variables
setexpr - set environment variable as the result of eval expression
showvar - print local hushshell variables
sleep   - delay execution for some time
smeminfo- print SMEM FLASH information
source  - run script from memory
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
tftpput - TFTP put command, for uploading files to a server
true    - do nothing, successfully
tzt     - load and run tzt

uart    - UART sub-system
ubi     - ubi commands
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version

IPQ6018# printenv
baudrate=115200
bootargs=console=ttyMSM0,115200n8 cnss2.bdf_pci0=0xa3
bootcmd=bootipq
bootdelay=5
ethact=eth0
ethaddr=6C:A6:04:[REDACTED]
fdt_high=0x48500000
fdtcontroladdr=4a4677c0
fenv_hardware=V1H2
flash_type=2
ipaddr=192.168.10.10
machid=8030002
netmask=255.255.255.0
serverip=192.168.10.1
soc_hw_version=20170100
soc_version_major=1
soc_version_minor=0
stderr=serial@78B1000
stdin=serial@78B1000
stdout=serial@78B1000

Environment size: 462/262140 bytes

IPQ6018# is_sec_boot_enabled
secure boot fuse is not enabled

frollic · November 3, 2025, 7:30am

I got a pair of these since I couple of months, made it as far as you did

Tried tftpboot:ing some of the IPQ60xx initramfs:es available in the snapshot folder, but they all came back with some kind of "incorrect format" error (don't recall, it's been a while).

rwg · November 13, 2025, 12:12am

I haven't had a chance to really play with this since I started the thread, but I wanted to post before the thread gets auto-locked.

I also tried TFTP booting a few of the existing .ubi images out of qualcommax/ipq60xx without much success. U-Boot is able to parse the FIT images, find a kernel and a devicetree, relocate the FDT in memory, decompress the kernel, and jump to the kernel, but the device then immediately reboots. It does give me hope, though — U-Boot is going through all of the motions like it's completely unlocked and doesn't care about image signatures, so it's probably "just" a matter of getting a good kernel and devicetree for it.

I've already pulled the FDT out of the factory firmware image and made a .dts file, so after I make a new OpenWrt build VM (my current one is years old and pretty crusty), I'll see about building a FIT image with a better devicetree...