A brief update to this topic, after adjusting the memory layout I've managed to boot the OS properly. The 5GHz radio is not working though.
I will look into porting DTS after getting both radios working on ar71xx as a starting guideline.
Also I'm attaching the OEM firmware bootlog
U-Boot 1.1.4-g9e952007-dirty (Dec 20 2015 - 08:47:17)
ap143 - Honey Bee 2.0
DRAM: 128 MB
Flash: 16 MB
eth0 link down
FAIL
eth1 link down
FAIL
Using eth0 device
Tx Timed out
ping failed; host 192.168.1.10 is not alive
Unknown command 'ERROR!' - try 'help'
Hit any key to stop autoboot: 0
## Booting image at 9f020000 ...
Image Name: MIPS OpenWrt Linux-3.10.44
Created: 2018-01-05 8:59:30 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1124162 Bytes = 1.1 MB
Load Address: 80060000
Entry Point: 80060000
Verifying Checksum at 0x9f020040 ...OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728
Starting kernel ...
[ 0.000000] Linux version 3.10.44 (wangqiuqiang@oracle.tecmint.com) (gcc ver8
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[ 0.000000] SoC: Qualcomm Atheros QCA9531 ver 2 rev 0
[ 0.000000] Clocks: CPU:650.000MHz, DDR:391.650MHz, AHB:216.666MHz, Ref:25.0z
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x07ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x07ffffff]
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32s
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pa2
[ 0.000000] Kernel command line: board=COMFAST-CF-WR752AC console=ttyS0,115d
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 125796k/131072k available (2425k kernel code, 5276k rese)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:51
[ 0.000000] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[ 0.050000] pid_max: default: 32768 minimum: 301
[ 0.050000] Mount-cache hash table entries: 512
[ 0.060000] NET: Registered protocol family 16
[ 0.070000] MIPS: machine is COMFAST CF-WR752AC
[ 0.510000] registering PCI controller with io_map_base unset
[ 0.520000] bio: create slab <bio-0> at 0
[ 0.530000] PCI host bridge to bus 0000:00
[ 0.530000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[ 0.540000] pci_bus 0000:00: root bus resource [io 0x0000]
[ 0.540000] pci_bus 0000:00: No busn resource found for root bus, will use []
[ 0.550000] pci 0000:00:00.0: invalid calibration data
[ 0.550000] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64b]
[ 0.560000] pci 0000:00:00.0: using irq 40 for pin 1
[ 0.560000] Switching to clocksource MIPS
[ 0.570000] NET: Registered protocol family 2
[ 0.570000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[ 0.580000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.580000] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.590000] TCP: reno registered
[ 0.590000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.600000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.600000] NET: Registered protocol family 1
[ 0.620000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.630000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORI.
[ 0.640000] msgmni has been set to 245
[ 0.650000] io scheduler noop registered
[ 0.650000] io scheduler deadline registered (default)
[ 0.650000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 0.680000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[ 0.690000] console [ttyS0] enabled, bootconsole disabled
[ 0.690000] console [ttyS0] enabled, bootconsole disabled
[ 0.700000] ath79-spi ath79-spi: master is unqueued, this is deprecated
[ 0.710000] m25p80 spi0.0: found w25q128, expected m25p80
[ 0.720000] m25p80 spi0.0: w25q128 (16384 Kbytes)
[ 0.720000] 7 cmdlinepart partitions found on MTD device spi0.0
[ 0.730000] Creating 7 MTD partitions on "spi0.0":
[ 0.730000] 0x000000000000-0x000000010000 : "u-boot"
[ 0.740000] 0x000000010000-0x000000020000 : "art"
[ 0.750000] 0x000000020000-0x0000001a0000 : "kernel"
[ 0.750000] 0x0000001a0000-0x000000fe0000 : "rootfs"
[ 0.760000] mtd: device 3 (rootfs) set to be root filesystem
[ 0.770000] 1 squashfs-split partitions found on MTD device rootfs
[ 0.770000] 0x000000780000-0x000000fe0000 : "rootfs_data"
[ 0.780000] 0x000000fe0000-0x000000ff0000 : "configs"
[ 0.790000] 0x000000ff0000-0x000001000000 : "nvram"
[ 0.800000] 0x000000020000-0x000000fe0000 : "firmware"
[ 0.820000] libphy: ag71xx_mdio: probed
[ 0.830000] eth0: Atheros AG71xx at 0xba000000, irq 5
[ 1.390000] ag71xx-mdio.1: Found an AR934X built-in switch
[ 1.430000] eth1: Atheros AG71xx at 0xb9000000, irq 4
[ 1.990000] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd]
[ 2.000000] TCP: cubic registered
[ 2.000000] NET: Registered protocol family 17
[ 2.010000] Bridge firewalling registered
[ 2.010000] 8021q: 802.1Q VLAN Support v1.8
[ 2.020000] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[ 2.030000] Freeing unused kernel memory: 276K (8036b000 - 803b0000)
[ 2.990000] init: Console is alive
[ 2.990000] init: - watchdog -
[ 5.000000] init: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 9.660000] jffs2: notice: (372) jffs2_build_xattr_subsystem: complete build.
[ 9.680000] mount_root: switching to jffs2 overlay
2116+0 records in
2116+0 records out
12064+0 records in
12064+0 records out
[ 10.220000] procd: - early -
[ 10.230000] procd: - watchdog -
[ 10.920000] procd: - ubus -
[ 11.930000] procd: - init -
Please press Enter to activate this console.
[ 13.850000] natsemi dp8381x driver, version 2.1, Sept 11, 2006
[ 13.850000] originally by Donald Becker <becker@scyld.com>
[ 13.850000] 2.4.x kernel port by Jeff Garzik, Tjeerd Mulder
[ 13.880000] gre: GRE over IPv4 demultiplexor driver
[ 13.900000] ip_gre: GRE over IPv4 tunneling driver
[ 13.910000] i2c /dev entries driver
[ 13.920000] Loading modules backported from Linux version master-2014-05-22-a
[ 13.930000] Backport generated by backports.git backports-20140320-37-g5c33d0
[ 14.170000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[ 14.180000] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode0
[ 15.090000] ath10k_pci 0000:00:00.0: qca9888 hw2.0 target 0x01000000 chip_id0
[ 15.100000] ath10k_pci 0000:00:00.0: kconfig debug 1 debugfs 1 tracing 1 dfs1
[ 15.130000] ath10k_pci 0000:00:00.0: firmware ver 10.4-3.5.1-00014 api 5 feaa
[ 15.520000] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id 0:0 crc32 9cddb9
[ 17.310000] ath10k_pci 0000:00:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal otp m1
[ 17.460000] u32 classifier
[ 17.460000] input device check on
[ 17.460000] Actions configured
[ 17.480000] Mirror/redirect action on
[ 17.510000] nf_conntrack version 0.5.0 (1969 buckets, 7876 max)
[ 17.590000] Ebtables v2.0 registered
[ 17.600000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 17.660000] Netfilter messages via NETLINK v0.30.
[ 17.720000] xt_time: kernel timezone is -0000
[ 17.750000] ctnetlink v0.93: registering with nfnetlink.
[ 17.760000] PPP generic driver version 2.4.2
[ 17.770000] PPP MPPE Compression module registered
[ 17.780000] NET: Registered protocol family 24
[ 17.840000] ieee80211 phy1: Atheros AR9531 Rev:2 mem=0xb8100000, irq=47
configs:do check configs
[ 28.130000] device eth0 entered promiscuous mode
[ 28.180000] device eth1 entered promiscuous mode
[ 28.210000] br-wan: port 1(eth1) entered forwarding state
[ 28.220000] br-wan: port 1(eth1) entered forwarding state
[ 29.070000] br-wan: port 1(eth1) entered disabled state
[ 32.160000] device wlan8 entered promiscuous mode
[ 35.780000] device wlan0 entered promiscuous mode
[ 41.530000] br-lan: port 2(wlan8) entered forwarding state
[ 41.530000] br-lan: port 2(wlan8) entered forwarding state
[ 43.530000] br-lan: port 2(wlan8) entered forwarding state
[ 46.240000] br-lan: port 3(wlan0) entered forwarding state
[ 46.240000] br-lan: port 3(wlan0) entered forwarding state
[ 48.240000] br-lan: port 3(wlan0) entered forwarding state
this is my current bootlog with only 2.4GHz radio working.
Starting kernel ...
[ 0.000000] Linux version 4.9.120 (joao@joao-box) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r7258-5eb055306f) ) #0 Thu Aug 16 07:51:15 2018
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[ 0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512
[ 0.000000] Kernel command line: board=AP143 console=ttyS0,115200 mtdparts=spi0.0:64k(u-boot)ro,64k(art)ro,1536k(kernel),14592k(rootfs),64k(configs),64k(nvram),16128k@0x20000(firmware) rootfstype=squashfs noinitrd
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 125144K/131072K available (3026K kernel code, 165K rwdata, 700K rodata, 260K init, 215K bss, 5928K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:51
[ 0.000000] Clocks: CPU:650.000MHz, DDR:392.602MHz, AHB:216.666MHz, Ref:25.000MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns
[ 0.000009] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns
[ 0.008278] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[ 0.071115] pid_max: default: 32768 minimum: 301
[ 0.076119] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.083099] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.093935] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.104370] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.111518] NET: Registered protocol family 16
[ 0.118017] MIPS: machine is Qualcomm Atheros AP143 reference board
[ 0.131056] ar71xx: invalid MDIO id 1
[ 0.625238] clocksource: Switched to clocksource MIPS
[ 0.631884] NET: Registered protocol family 2
[ 0.637586] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.644957] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.651738] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.658578] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.664758] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.671729] NET: Registered protocol family 1
[ 0.683103] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[ 0.697431] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.703579] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.730123] io scheduler noop registered
[ 0.734262] io scheduler deadline registered (default)
[ 0.740085] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.749677] console [ttyS0] disabled
[ 0.773620] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A
[ 0.782731] console [ttyS0] enabled
[ 0.782731] console [ttyS0] enabled
[ 0.790287] bootconsole [early0] disabled
[ 0.790287] bootconsole [early0] disabled
[ 0.805743] m25p80 spi0.0: found w25q128, expected m25p80
[ 0.820978] m25p80 spi0.0: w25q128 (16384 Kbytes)
[ 0.825919] 7 cmdlinepart partitions found on MTD device spi0.0
[ 0.832028] Creating 7 MTD partitions on "spi0.0":
[ 0.837001] 0x000000000000-0x000000010000 : "u-boot"
[ 0.844493] 0x000000010000-0x000000020000 : "art"
[ 0.851870] 0x000000020000-0x0000001a0000 : "kernel"
[ 0.859495] 0x0000001a0000-0x000000fe0000 : "rootfs"
[ 0.866565] mtd: device 3 (rootfs) set to be root filesystem
[ 0.872477] 1 squashfs-split partitions found on MTD device rootfs
[ 0.878944] 0x0000009d0000-0x000000fe0000 : "rootfs_data"
[ 0.887191] 0x000000fe0000-0x000000ff0000 : "configs"
[ 0.894858] 0x000000ff0000-0x000001000000 : "nvram"
[ 0.902453] 0x000000020000-0x000000fe0000 : "firmware"
[ 0.911529] libphy: Fixed MDIO Bus: probed
[ 0.941989] libphy: ag71xx_mdio: probed
[ 1.578205] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd042, driver=Generic PHY]
[ 1.588451] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[ 2.217791] ag71xx-mdio.1: Found an AR934X built-in switch
[ 2.271196] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
[ 2.278533] NET: Registered protocol family 17
[ 2.283225] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 2.296784] 8021q: 802.1Q VLAN Support v1.8
[ 2.310609] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[ 2.320100] Freeing unused kernel memory: 260K
[ 2.324692] This architecture does not have kernel memory protection.
[ 2.545252] random: fast init done
[ 2.993990] init: Console is alive
[ 2.997906] init: - watchdog -
[ 4.431111] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 4.575390] usbcore: registered new interface driver usbfs
[ 4.581169] usbcore: registered new interface driver hub
[ 4.586810] usbcore: registered new device driver usb
[ 4.598319] Button Hotplug driver version 0.4.1
[ 4.608693] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 4.626790] init: - preinit -
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 6.739966] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[ 6.812479] urandom-seed: Seed file not found (/etc/urandom.seed)
[ 6.920952] procd: - early -
[ 6.924059] procd: - watchdog -
[ 7.569057] procd: - watchdog -
[ 7.572631] procd: - ubus -
[ 7.727345] random: ubusd: uninitialized urandom read (4 bytes read)
[ 7.739381] random: ubusd: uninitialized urandom read (4 bytes read)
[ 7.746625] random: ubusd: uninitialized urandom read (4 bytes read)
[ 7.754273] procd: - init -
Please press Enter to activate this console.
[ 8.346836] kmodloader: loading kernel modules from /etc/modules.d/*
[ 8.360364] mpls_gso: MPLS GSO support
[ 8.367823] tun: Universal TUN/TAP device driver, 1.6
[ 8.373052] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[ 8.467716] gre: GRE over IPv4 demultiplexor driver
[ 8.475497] ip_gre: GRE over IPv4 tunneling driver
[ 8.492453] Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
[ 8.509254] Netfilter messages via NETLINK v0.30.
[ 8.517476] ip_set: protocol 6
[ 8.628417] u32 classifier
[ 8.631234] input device check on
[ 8.635012] Actions configured
[ 8.751297] Mirror/redirect action on
[ 8.766555] nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
[ 8.784731] arp_tables: arp_tables: (C) 2002 David S. Miller
[ 8.795914] Bridge firewalling registered
[ 8.802778] Loading modules backported from Linux version wt-2017-11-01-0-gfe248fc2c180
[ 8.811131] Backport generated by backports.git v4.14-rc2-1-31-g86cf0e5d
[ 8.822415] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 8.991862] ctnetlink v0.93: registering with nfnetlink.
[ 9.406601] xt_time: kernel timezone is -0000
[ 9.640810] PPP generic driver version 2.4.2
[ 9.667108] NET: Registered protocol family 24
[ 9.898674] ieee80211 phy0: Atheros AR9531 Rev:2 mem=0xb8100000, irq=47
[ 10.004059] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 11.404961] urandom_read: 5 callbacks suppressed
[ 11.404971] random: jshn: uninitialized urandom read (4 bytes read)
[ 11.485861] random: jshn: uninitialized urandom read (4 bytes read)
[ 25.914566] br-lan: port 1(eth1.1) entered blocking state
[ 25.920235] br-lan: port 1(eth1.1) entered disabled state
[ 25.926224] device eth1.1 entered promiscuous mode
[ 25.931175] device eth1 entered promiscuous mode
[ 28.178858] eth0: link up (100Mbps/Full duplex)
I've installed the ath10k kmod and QCA9888 firmware on menu config. I've also tried with the ct versions and got the same results. Should I look into the PCI first?