Anyone out there figured maybe out where the serial console pins can be?
I made some photos, but the only thing I can see is like 8 testpoints above the QCA9882 and all 8 are some sort of data pins as they look like (first photo, bottom of pcb).
Under the small shielding is the QCA9563 and nothing else.
Probably I miss something; anyone any clue?
TiA!
So as per source code and pinout of qca9563 I was simply soldering my wires on the gpio outs and here we go with a functional serial console, since I didn't find any other lead to it:
For Board AP152:
asuswrt/release/src-qca/uboot/board/atheros/common/serial.c:
UART_RX18_TX20 -> rx=gpio18, tx=gpio20
#elif defined(UART_RX18_TX20)
val = (ath_reg_rd(GPIO_OE_ADDRESS) & (~0x100000)) | 0x40000;
ath_reg_wr(GPIO_OE_ADDRESS, val);
val = ath_reg_rd(GPIO_OUT_ADDRESS) | 0xeffff6;
ath_reg_wr(GPIO_OUT_ADDRESS, val);
ath_reg_rmw_clear(GPIO_OUT_FUNCTION5_ADDRESS,
GPIO_OUT_FUNCTION5_ENABLE_GPIO_20_MASK);
ath_reg_rmw_set(GPIO_OUT_FUNCTION5_ADDRESS,
GPIO_OUT_FUNCTION5_ENABLE_GPIO_20_SET(0x16));
ath_reg_rmw_clear(GPIO_IN_ENABLE0_ADDRESS,
GPIO_IN_ENABLE0_UART_SIN_MASK);
ath_reg_rmw_set(GPIO_IN_ENABLE0_ADDRESS,
GPIO_IN_ENABLE0_UART_SIN_SET(0x12));
This can also work for other devices 
U-Boot 1.1.4-g37ca0402 (Jan 18 2016 - 09:33:38)
PL-AC56 bootloader version: 1.0.0.1
ap152 - Dragonfly 1.0DRAM:
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0xf, 0xf, 0xf, 0xf)
64 MB
ASUS PL-AC56 gpio init : wps / reset pin
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Maximum malloc length: 128 KBytes
mem_malloc_start/brk/end: 0x83f98000/83f98000/83fc8000
*** Warning - bad CRC, using default environment
plat_dev_init: read 16384 bytes from offset 9fff1000 of WLANCAL fail! (r = -1)
In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
Fetching MAC Address from 0x83fed5ec
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 18:31:bf:68:0e:10
eth0 up
eth0
ath_set_tuning_caps: read WLANCAL fail!!! (r = -1)
Please choose the operation:
1: Load System code to SDRAM via TFTP.
2: Load System code then write to Flash via TFTP.
3: Boot System code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP. 0
3: Boot System code via Flash (default).
PL-AC56 bootloader version: 1.0.0.1
MAC Address: 18:31:BF:68:0E:10
## Checking 1st firmware at 9f060000 ...
Image Name: MIPS OpenWrt Linux-5.10.88
Created: 2021-12-31 12:21:39 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 2224918 Bytes = 2.1 MB
Load Address: 80060000
Entry Point: 80060000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
## Giving linux ramsize: 67108864 (64 MB)
Starting kernel ...
[ 0.000000] Linux version 5.10.88 (osboxes@osboxes) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r18442-8a0a17814e) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 Fri Dec 31 12:21:39 2021
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[ 0.000000] MIPS: machine is ASUS PL-AC56
[ 0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16240
[ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 56188K/65536K available (5433K kernel code, 592K rwdata, 1192K rodata, 1220K init, 201K bss, 9348K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 51
[ 0.000000] random: get_random_bytes called from start_kernel+0x3c0/0x5b0 with crng_init=0
[ 0.000000] CPU clock: 775.000 MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[ 0.000007] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[ 0.008214] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[ 0.074761] pid_max: default: 32768 minimum: 301
[ 0.079752] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.087464] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.097309] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[ 0.107597] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.117998] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[ 0.125266] pinctrl core: initialized pinctrl subsystem
[ 0.131694] NET: Registered protocol family 16
[ 0.185392] clocksource: Switched to clocksource MIPS
[ 0.191820] NET: Registered protocol family 2
[ 0.196601] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.204713] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[ 0.213624] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.221726] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.229170] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.235997] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.242898] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.250553] NET: Registered protocol family 1
[ 0.255176] PCI: CLS 0 bytes, default 32
[ 0.264639] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[ 0.274926] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.281135] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.294833] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[ 0.301869] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 0.309267] printk: console [ttyS0] disabled
[ 0.313831] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[ 0.322977] printk: console [ttyS0] enabled
[ 0.322977] printk: console [ttyS0] enabled
[ 0.332041] printk: bootconsole [early0] disabled
[ 0.332041] printk: bootconsole [early0] disabled
[ 0.351470] spi-nor spi0.0: mx25l12805d (16384 Kbytes)
[ 0.356891] 5 fixed-partitions partitions found on MTD device spi0.0
[ 0.363450] Creating 5 MTD partitions on "spi0.0":
[ 0.368421] 0x000000000000-0x000000040000 : "u-boot"
[ 0.376927] 0x000000040000-0x000000050000 : "u-boot-env"
[ 0.383236] 0x000000050000-0x000000060000 : "art"
[ 0.390434] 0x000000060000-0x000000f80000 : "firmware"
[ 0.396786] 2 uimage-fw partitions found on MTD device firmware
[ 0.402913] Creating 2 MTD partitions on "firmware":
[ 0.408094] 0x000000000000-0x000000220000 : "kernel"
[ 0.415343] 0x000000220000-0x000000f20000 : "rootfs"
[ 0.421267] mtd: device 5 (rootfs) set to be root filesystem
[ 0.428008] 1 squashfs-split partitions found on MTD device rootfs
[ 0.434408] 0x0000005b0000-0x000000f20000 : "rootfs_data"
[ 0.440786] 0x000000f80000-0x000001000000 : "plc"
[ 0.452692] libphy: Fixed MDIO Bus: probed
[ 0.460336] ag71xx 19000000.eth: invalid MAC address, using random address
[ 1.146061] libphy: ag71xx_mdio: probed
[ 1.153326] switch0: Atheros AR8337 rev. 2 switch registered on mdio.0
[ 1.160162] Atheros AR8216/AR8236/AR8316: probe of mdio.0:00 failed with error -22
[ 1.245513] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd036, driver=Qualcomm Atheros 8337 internal PHY]
[ 1.257322] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii
[ 1.263880] i2c /dev entries driver
[ 1.269470] NET: Registered protocol family 10
[ 1.280261] Segment Routing with IPv6
[ 1.284145] NET: Registered protocol family 17
[ 1.288854] 8021q: 802.1Q VLAN Support v1.8
[ 1.293886] PCI host bridge /ahb/pcie-controller@18250000 ranges:
[ 1.300256] MEM 0x0000000012000000..0x0000000013ffffff
[ 1.305666] IO 0x0000000000000000..0x0000000000000000
[ 1.311243] PCI host bridge to bus 0000:00
[ 1.315522] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[ 1.322621] pci_bus 0000:00: root bus resource [io 0x0000]
[ 1.328386] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[ 1.335407] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 1.343626] pci 0000:00:00.0: [168c:003c] type 00 class 0x028000
[ 1.349872] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[ 1.356942] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[ 1.363932] pci 0000:00:00.0: supports D1
[ 1.368089] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[ 1.374864] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[ 1.381749] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[ 1.389330] pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[ 1.403710] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[ 1.417709] Freeing unused kernel memory: 1220K
[ 1.422389] This architecture does not have kernel memory protection.
[ 1.429074] Run /sbin/init as init process
[ 1.957202] init: Console is alive
[ 1.961188] init: - watchdog -
[ 2.409279] random: fast init done
[ 2.892210] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 2.926327] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 2.944264] init: - preinit -
[ 4.219445] random: jshn: uninitialized urandom read (4 bytes read)
[ 4.353326] random: jshn: uninitialized urandom read (4 bytes read)
[ 4.426397] random: jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 8.974663] jffs2: notice: (450) jffs2_build_xattr_subsystem: complete building xattr subsystem, 20 of xdatum (0 unchecked, 12 orphan) and 23 of xref (12 dead, 0 orphan) found.
[ 8.992797] mount_root: switching to jffs2 overlay
[ 9.000796] overlayfs: upper fs does not support tmpfile.
[ 9.013050] urandom-seed: Seeding with /etc/urandom.seed
[ 9.173243] procd: - early -
[ 9.176650] procd: - watchdog -
[ 9.834348] procd: - watchdog -
[ 9.861486] procd: - ubus -
[ 10.008282] urandom_read: 5 callbacks suppressed
[ 10.008290] random: ubusd: uninitialized urandom read (4 bytes read)
[ 10.041030] random: ubusd: uninitialized urandom read (4 bytes read)
[ 10.053937] procd: - init -
Please press Enter to activate this console.
[ 11.138811] kmodloader: loading kernel modules from /etc/modules.d/*
[ 11.539574] urngd: v1.0.2 started.
[ 11.668879] Loading modules backported from Linux version v5.15.8-0-g43e577d7a2cb
[ 11.676661] Backport generated by backports.git v5.15.8-1-0-g83f664bb
[ 11.741054] xt_time: kernel timezone is -0000
[ 11.747232] random: crng init done
[ 12.035889] PPP generic driver version 2.4.2
[ 12.042682] NET: Registered protocol family 24
[ 12.131253] ath10k 5.15 driver, optimized for CT firmware, probing pci device: 0x3c.
[ 12.156542] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002)
[ 12.163187] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[ 15.814666] ath10k_pci 0000:00:00.0: qca988x hw2.0 target 0x4100016c chip_id 0x043222ff sub 0000:0000
[ 15.824247] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[ 15.836209] ath10k_pci 0000:00:00.0: firmware ver 10.1-ct-8x-__fW-022-ecad3248 api 2 features wmi-10.x,has-wmi-mgmt-tx,mfp,txstatus-noack,wmi-10.x-CT,ratemask-CT,txrate-CT,get-temp-CT,tx-rc-CT,cust-stats-CT,retry-gt2-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT crc32 3e4cf97f
[ 16.351550] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id N/A crc32 bebc7c08
[ 17.339843] ath10k_pci 0000:00:00.0: 10.1 wmi init: vdevs: 16 peers: 127 tid: 256
[ 17.357832] ath10k_pci 0000:00:00.0: wmi print 'P 128 V 8 T 410'
[ 17.364079] ath10k_pci 0000:00:00.0: wmi print 'msdu-desc: 1424 sw-crypt: 0 ct-sta: 0'
[ 17.372369] ath10k_pci 0000:00:00.0: wmi print 'alloc rem: 24984 iram: 38672'
[ 17.429072] ath10k_pci 0000:00:00.0: htt-ver 2.1 wmi-op 2 htt-op 2 cal file max-sta 128 raw 0 hwcrypto 1
[ 17.444323] ath10k_pci 0000:00:00.0: NOTE: Firmware DBGLOG output disabled in debug_mask: 0x10000000
[ 17.676467] ieee80211 phy1: Atheros AR9561 Rev:0 mem=0xb8100000, irq=2
[ 17.704001] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 32.246019] br-lan: port 1(eth0) entered blocking state
[ 32.251430] br-lan: port 1(eth0) entered disabled state
[ 32.257141] device eth0 entered promiscuous mode
BusyBox v1.34.1 (2021-12-30 09:47:22 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt SNAPSHOT, r18464-6c96d9b71c
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#
That's a very cool way to expose the serial port!
Question now is whether the uboot on the device can be made to tftpboot without console access (eg; the asus tftp recovery method), to allow openwrt to boot without soldering.
Also, there's the broader issue of accessing the powerline functionality. There's a previous thread here; Support for Asus PL-AC56 (QCA956X SOC, QCA9558 + PLC-chip) however the poster didn't get anywhere.
Yep, it works booting an initramfs from uboot, above log is already from there and also flashes via asus recovery without problem. The wireless is already up and running, I'm using completely the same approach as for RP-AC66. Now I'm dumping the switch config and already looked into the qca7500 plc, which can be indeed problematic.
I'll open a separate thread if I can advance there 
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.