Failed to startup an ipq806x router on kernel 5.4

there should be a way to make the kernel reject this changes... i mean it's him that accept this changes

Well, you cant really as U-boot will modify the FDT before handing it to the kernel.
I can only think of using a legacy image, maybe bootloader wont touch that

i wonder if there is a command in uboot to edit fdt entry

Not it the ancient version that they use.
It appears that they dont use the standard bootipq command, but rather manually set boot partition, load the kernel from UBI volume.
But then they cal cfgsel and bootfdtcmd, now this is where its most likely modifying the FDT.
So, I tried running bootm instead of that last line.

It will find the kernel and the config, but no output from the kernel after starting.
So, I think that I am hitting this situation:
https://www.spinics.net/lists/linux-arm-msm/msg27201.html

on normal ipq8064 to have serial output this 2 clocks needs to be enabled

(if gsbi4 uart is disabled, the kernel doesn't output any log in the serial, but actually continue to boot)

<&gcc GSBI4_UART_CLK>, <&gcc GSBI4_H_CLK>

Hm, actually it looks like UART used in stock FW is really GSBI4 one.
But why does it not work in legacy image?

Check the env of uboot or you are missing the user speed in the bootcmd of the kernel?

Ok, so for whatever reason now UART works inside of the legacy image too.
But it crashes as well.

I append console=ttyMSM0,115200n8 from the DTS as stock bootloaders like to only pass the HSL whatever console.
Although it appears that this bootloader passes console=ttyMSM0,115200n8

Since I am out of ideas, I am gonna start adding blocks of 64MB of reserved memory.
Dont know what to do else.

Full bootlog:

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 5.4.36 (robimarko@localhost.localdomain) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r13140-6e8eead0a5)) #0 SMP Mon May 4 17:29:19 2020
[    0.000000] CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c5787d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] OF: fdt: Machine model: Edgecore ECW5410
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] percpu: Embedded 15 pages/cpu s30028 r8192 d23220 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 56840
[    0.000000] Kernel command line:  console=ttyMSM0,115200n8
[    0.000000] Bootloader command line (ignored): 
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 207020K/229376K available (5892K kernel code, 189K rwdata, 1504K rodata, 11264K init, 228K bss, 22356K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] random: get_random_bytes called from start_kernel+0x340/0x4e8 with crng_init=0
[    0.000000] clocksource: dg_timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 305801671480 ns
[    0.000008] sched_clock: 32 bits at 6MHz, resolution 160ns, wraps every 343597383600ns
[    0.000023] Switching to timer-based delay loop, resolution 160ns
[    0.000223] Calibrating delay loop (skipped), value calculated using timer frequency.. 12.50 BogoMIPS (lpj=62500)
[    0.000244] pid_max: default: 32768 minimum: 301
[    0.000439] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.000457] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.001488] CPU: Testing write buffer coherency: ok
[    0.002633] Setting up static identity map for 0x42300000 - 0x42300060
[    0.002808] rcu: Hierarchical SRCU implementation.
[    0.003298] smp: Bringing up secondary CPUs ...
[    0.005205] smp: Brought up 1 node, 2 CPUs
[    0.005221] SMP: Total of 2 processors activated (25.00 BogoMIPS).
[    0.005232] CPU: All CPU(s) started in SVC mode.
[    0.014929] VFP support v0.3: implementor 51 architecture 64 part 4d variant 2 rev 0
[    0.015084] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.015111] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.015284] pinctrl core: initialized pinctrl subsystem
[    0.016455] NET: Registered protocol family 16
[    0.016763] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.018130] cpuidle: using governor ladder
[    0.018194] cpuidle: using governor menu
[    0.055245] usbcore: registered new interface driver usbfs
[    0.055329] usbcore: registered new interface driver hub
[    0.055413] usbcore: registered new device driver usb
[    0.055471] pps_core: LinuxPPS API ver. 1 registered
[    0.055483] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.055515] PTP clock support registered
[    0.057189] clocksource: Switched to clocksource dg_timer
[    0.058067] thermal_sys: Registered thermal governor 'step_wise'
[    0.060531] NET: Registered protocol family 2
[    0.061101] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.061144] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear)
[    0.061172] TCP bind hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.061204] TCP: Hash tables configured (established 2048 bind 2048)
[    0.061307] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.061336] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.061572] NET: Registered protocol family 1
[    0.061620] PCI: CLS 0 bytes, default 64
[    0.253097] workingset: timestamp_bits=14 max_order=16 bucket_order=2
[    0.263843] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.263865] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.355151] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda not found, using dummy regulator
[    0.355347] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda_phy not found, using dummy regulator
[    0.355506] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda_refclk not found, using dummy regulator
[    0.355955] qcom-pcie 1b500000.pci: host bridge /soc/pci@1b500000 ranges:
[    0.356072] qcom-pcie 1b500000.pci:    IO 0x0fe00000..0x0fefffff -> 0x0fe00000
[    0.356130] qcom-pcie 1b500000.pci:   MEM 0x08000000..0x0fdfffff -> 0x08000000
[    1.507284] qcom-pcie 1b500000.pci: Phy link never came up
[    1.509272] qcom-pcie 1b500000.pci: cannot initialize host
[    1.509842] qcom-pcie: probe of 1b500000.pci failed with error -110
[    1.510251] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda not found, using dummy regulator
[    1.510414] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda_phy not found, using dummy regulator
[    1.510565] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda_refclk not found, using dummy regulator
[    1.510954] qcom-pcie 1b700000.pci: host bridge /soc/pci@1b700000 ranges:
[    1.511053] qcom-pcie 1b700000.pci:    IO 0x31e00000..0x31efffff -> 0x31e00000
[    1.511107] qcom-pcie 1b700000.pci:   MEM 0x2e000000..0x31dfffff -> 0x2e000000
[    1.631289] qcom-pcie 1b700000.pci: PCI host bridge to bus 0001:00
[    1.631327] pci_bus 0001:00: root bus resource [bus 00-ff]
[    1.631355] pci_bus 0001:00: root bus resource [mem 0x2e000000-0x31dfffff]
[    1.636717] PCI: bus0: Fast back to back transfers enabled
[    1.637220] qcom-pcie 1b900000.pci: 1b900000.pci supply vdda not found, using dummy regulator
[    1.637387] qcom-pcie 1b900000.pci: 1b900000.pci supply vdda_phy not found, using dummy regulator
[    1.637663] qcom-pcie 1b900000.pci: 1b900000.pci supply vdda_refclk not found, using dummy regulator
[    1.638073] qcom-pcie 1b900000.pci: host bridge /soc/pci@1b900000 ranges:
[    1.638175] qcom-pcie 1b900000.pci:    IO 0x35e00000..0x35efffff -> 0x35e00000
[    1.638227] qcom-pcie 1b900000.pci:   MEM 0x32000000..0x35dfffff -> 0x32000000
[    1.762126] qcom-pcie 1b900000.pci: PCI host bridge to bus 0002:00
[    1.762157] pci_bus 0002:00: root bus resource [bus 00-ff]
[    1.762184] pci_bus 0002:00: root bus resource [mem 0x32000000-0x35dfffff]
[    1.767591] PCI: bus0: Fast back to back transfers enabled
[    1.770923] L2 @ QSB rate. Forcing new rate.
[    1.771232] L2 @ 384000 KHz
[    1.771443] CPU0 @ 800000 KHz
[    1.771463] CPU1 @ QSB rate. Forcing new rate.
[    1.771752] CPU1 @ 384000 KHz
[    1.777410] gsbi 16300000.gsbi: GSBI port protocol: 6 crci: 0
[    1.778594] gsbi 1a200000.gsbi: GSBI port protocol: 3 crci: 0
[    1.780604] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.781847] msm_serial 16340000.serial: msm_serial: detected port #0
[    1.781930] msm_serial 16340000.serial: uartclk = 7372800
[    1.782045] 16340000.serial: ttyMSM0 at MMIO 0x16340000 (irq = 33, base_baud = 460800) is a MSM
[    1.782101] msm_serial: console setup on port #0
[    2.444167] printk: console [ttyMSM0] enabled
[    2.449300] msm_serial: driver initialized
[    2.461428] loop: module loaded
[    2.463640] nand: device found, Manufacturer ID: 0x01, Chip ID: 0xa1
[    2.463684] nand: AMD/Spansion S34MS01G2
[    2.470104] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    2.473974] 2 fixed-partitions partitions found on MTD device qcom_nand.0
[    2.481373] Creating 2 MTD partitions on "qcom_nand.0":
[    2.488239] 0x000000000000-0x000004000000 : "rootfs1"
[    2.499077] random: fast init done
[    2.612963] 0x000004000000-0x000008000000 : "rootfs2"
[    2.733952] spi_qup 1a280000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    2.735910] spi-nor spi0.0: found w25q128fw, expected s25fl256s1
[    2.755627] spi-nor spi0.0: w25q128fw (16384 Kbytes)
[    2.755754] 19 qcom-smem partitions found on MTD device spi0.0
[    2.759769] Creating 19 MTD partitions on "spi0.0":
[    2.765317] 0x000000000000-0x000000010000 : "0:SBL1"
[    2.771647] 0x000000010000-0x000000030000 : "0:MIBIB"
[    2.776613] 0x000000030000-0x000000060000 : "0:SBL2"
[    2.781694] 0x000000060000-0x000000090000 : "0:SBL3"
[    2.786643] 0x000000090000-0x0000000a0000 : "0:DDRCONFIG"
[    2.791700] 0x0000000a0000-0x0000000b0000 : "0:SSD"
[    2.796873] 0x0000000b0000-0x0000000e0000 : "0:TZ"
[    2.801690] 0x0000000e0000-0x000000100000 : "0:RPM"
[    2.806400] 0x000000100000-0x000000170000 : "0:APPSBL"
[    2.811383] 0x000000170000-0x000000180000 : "0:APPSBLENV"
[    2.816441] 0x000000180000-0x0000001c0000 : "0:ART"
[    2.822029] 0x0000001c0000-0x0000001e0000 : "0:BOOTCONFIG"
[    2.826593] 0x0000001e0000-0x000000210000 : "0:SBL2_1"
[    2.832263] 0x000000210000-0x000000240000 : "0:SBL3_1"
[    2.837253] 0x000000240000-0x000000250000 : "0:DDRCONFIG_1"
[    2.842496] 0x000000250000-0x000000280000 : "0:TZ_1"
[    2.847971] 0x000000280000-0x0000002a0000 : "0:RPM_1"
[    2.853094] 0x0000002a0000-0x000000310000 : "0:APPSBL_1"
[    2.858156] 0x000000310000-0x000000330000 : "0:BOOTCONFIG1"
[    2.865329] libphy: ipq8064_mdio_bus: probed
[    2.913642] libphy: Fixed MDIO Bus: probed
[    2.914397] i2c /dev entries driver
[    2.920072] cpuidle: enable-method property 'qcom,kpss-acc-v1' found operations
[    2.920271] cpuidle: enable-method property 'qcom,kpss-acc-v1' found operations
[    2.928253] sdhci: Secure Digital Host Controller Interface driver
[    2.934611] sdhci: Copyright(c) Pierre Ossman
[    2.940940] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.962683] NET: Registered protocol family 10
[    2.964385] Segment Routing with IPv6
[    2.966187] NET: Registered protocol family 17
[    2.970171] 8021q: 802.1Q VLAN Support v1.8
[    2.974183] Registering SWP/SWPB emulation handler
[    3.011870] qcom_rpm 108000.rpm: RPM firmware 3.0.16777377
[    3.028487] s1a: supplied by regulator-dummy
[    3.028654] s1a: Bringing 0uV into 1050000-1050000uV
[    3.032281] s1b: supplied by regulator-dummy
[    3.036890] s1b: Bringing 0uV into 1050000-1050000uV
[    3.041534] s2a: supplied by regulator-dummy
[    3.046079] s2a: Bringing 0uV into 775000-775000uV
[    3.050767] s2b: supplied by regulator-dummy
[    3.054936] s2b: Bringing 0uV into 775000-775000uV
[    3.061756] Speed bin: 0
[    3.063854] PVS bin: 1
[    3.077038] hcto[    3.089522] Freeing unused kernel memory: 11264K
[    3.107816] Run /init as init process
[    3.167789] init: Console is alive
[    3.168164] init: - watchdog -
[    3.186541] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.191067] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    3.195270] SCSI subsystem initialized
[    3.206176] ehci-fsl: Freescale EHCI Host controller driver
[    3.206670] ehci-platform: EHCI generic platform driver
[    3.211647] 8<--- cut here ---
[    3.215750] Unable to handle kernel paging request at virtual address 8d29e2ac
[    3.218939] pgd = (ptrval)
[    3.226077] [8d29e2ac] *pgd=00000000
[    3.228898] Internal error: Oops: 5 [#1] SMP ARM
[    3.232504] Modules linked in: fsl_mph_dr_of ehci_platform ehci_fsl sd_mod ahci_platform libahci_platform libahci libata scsi_mod ehci_hcd gpio_button_hotplug
[    3.237121] CPU: 1 PID: 91 Comm: kmodloader Not tainted 5.4.36 #0
[    3.251081] Hardware name: Generic DT based system
[    3.257249] PC is at bsearch+0x6c/0x88
[    3.261934] LR is at find_exported_symbol_in_section+0x54/0xd8
[    3.265665] pc : [<c056bec4>]    lr : [<c039e6a4>]    psr: 60000013
[    3.271480] sp : cceffd70  ip : 00000000  fp : c160e2d8
[    3.277643] r10: 00000000  r9 : c039e53c  r8 : cceffdf0
[    3.282852] r7 : 00000000  r6 : bf0772c0  r5 : cceffe1c  r4 : cceffdb4
[    3.288060] r3 : 0000000c  r2 : 00000000  r1 : 00000000  r0 : 00000000
[    3.294662] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
[    3.301171] Control: 10c5787d  Table: 4ef0806a  DAC: 00000051
[    3.308374] Process kmodloader (pid: 91, stack limit = 0x(ptrval))
[    3.314104] Stack: (0xcceffd70 to 0xccf00000)
[    3.320186] fd60:                                     cceffdb4 cceffe1c bf0772c0 00000000
[    3.324619] fd80: cceffdf0 00000000 00000000 c039e6a4 c039e53c bf0be000 c0206fc0 cceffdc8
[    3.332781] fda0: bf0772c0 c039e650 cceffe1c c039f3b4 ccfd39c0 00000000 00000000 00000000
[    3.340939] fdc0: 00000000 00000000 bf076018 bf076144 00000000 00000001 00002c00 00000000
[    3.349098] fde0: 00000000 00000000 00000002 ffffff00 bf05f3f4 ced9538f ced9538f ccefff34
[    3.357258] fe00: cceffec8 bf0b9340 bf0b934c bf0b9340 bf0b934c c039fda4 ced94680 ced9538f
[    3.365418] fe20: c1600101 00000000 00000000 c0a01ab4 00000000 ccefff34 ced9538f 00000850
[    3.373578] fe40: bf0bd5f0 0000005f bf0b934c bf0b9340 bf0b934c c03a130c 00000001 c165a8b8
[    3.381737] fe60: cdac1b80 c165a8b4 cdac11c8 000129d5 ced962c0 bf0b94bc ced94774 c09678b4
[    3.389897] fe80: c09676b4 c0967884 00000000 c09676c0 c0967718 c1604e48 ccfd38c0 fffff000
[    3.398057] fea0: 00000001 ccfd3800 00000006 00000006 00002cc0 ffffffff ccfd38c0 00000400
[    3.406216] fec0: 00002cc2 c0423690 6e72656b 00006c65 00000000 00000000 00000000 00000000
[    3.414375] fee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    3.422536] ff00: 00000000 35d08419 00000000 00005338 ced96338 00000000 00af39a8 ffffe000
[    3.430697] ff20: 000129d5 00000051 00000000 c03a2d28 00000000 ced940ac ced94680 ced91000
[    3.438855] ff40: 00005338 ced95de8 ced95cac ced950cc 00005000 000050c0 00001df0 00005149
[    3.447014] ff60: 00000000 00000000 00000000 00001de0 0000001f 00000020 00000019 00000000
[    3.455176] ff80: 00000013 00000000 00000000 00000000 00000005 00000080 c0301204 ccefe000
[    3.463336] ffa0: 00000080 c0301000 00000000 00000000 00aee670 00005338 000129d5 00000002
[    3.471493] ffc0: 00000000 00000000 00000005 00000080 00005338 00000000 b6f62f70 00000000
[    3.479655] ffe0: be917cf4 be917cd8 00011e14 b6f15e00 60000010 00aee670 00000000 00000000
[    3.487813] [<c056bec4>] (bsearch) from [<c039e6a4>] (find_exported_symbol_in_section+0x54/0xd8)
[    3.495971] [<c039e6a4>] (find_exported_symbol_in_section) from [<c039f3b4>] (each_symbol_section+0x118/0x160)
[    3.504826] [<c039f3b4>] (each_symbol_section) from [<c039fda4>] (resolve_symbol+0x60/0x154)
[    3.514631] [<c039fda4>] (resolve_symbol) from [<c03a130c>] (load_module+0xa38/0x22ec)
[    3.523222] [<c03a130c>] (load_module) from [<c03a2d28>] (sys_init_module+0x168/0x19c)
[    3.530950] [<c03a2d28>] (sys_init_module) from [<c0301000>] (ret_fast_syscall+0x0/0x54)
[    3.538846] Exception stack(0xccefffa8 to 0xcceffff0)
[    3.547095] ffa0:                   00000000 00000000 00aee670 00005338 000129d5 00000002
[    3.552049] ffc0: 00000000 00000000 00000005 00000080 00005338 00000000 b6f62f70 00000000
[    3.560205] ffe0: be917cf4 be917cd8 00011e14 b6f15e00
[    3.568365] Code: e3500000 1afffff2 e1a00005 e1cd40d0 (e1cd60d8) 
[    3.573458] ---[ end trace 1fad5dafd4c33d58 ]---
[    3.579537] Kernel panic - not syncing: Fatal exception
[    3.584167] CPU0: stopping
[    3.589110] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G      D           5.4.36 #0
[    3.591887] Hardware name: Generic DT based system
[    3.599109] [<c030f954>] (unwind_backtrace) from [<c030b96c>] (show_stack+0x14/0x20)
[    3.603972] [<c030b96c>] (show_stack) from [<c08a3ae0>] (dump_stack+0x94/0xa8)
[    3.611866] [<c08a3ae0>] (dump_stack) from [<c030eb80>] (handle_IPI+0x184/0x1b8)
[    3.618900] [<c030eb80>] (handle_IPI) from [<c05b547c>] (gic_handle_irq+0xb4/0xb8)
[    3.626449] [<c05b547c>] (gic_handle_irq) from [<c0301a8c>] (__irq_svc+0x6c/0x90)
[    3.633815] Exception stack(0xc1601ee0 to 0xc1601f28)
[    3.641387] 1ee0: 00000000 00000000 0c854000 cddd4a00 cccee000 00000000 cddd3df0 00000000
[    3.646425] 1f00: 00000000 00000000 d5a1e660 d53b35a0 00000015 c1601f30 c0705bb8 c0705bbc
[    3.654569] 1f20: 80000013 ffffffff
[    3.662728] [<c0301a8c>] (__irq_svc) from [<c0705bbc>] (cpuidle_enter_state+0x94/0x498)
[    3.666029] [<c0705bbc>] (cpuidle_enter_state) from [<c0706004>] (cpuidle_enter+0x30/0x4c)
[    3.674016] [<c0706004>] (cpuidle_enter) from [<c034a5dc>] (do_idle+0x1d8/0x240)
[    3.682348] [<c034a5dc>] (do_idle) from [<c034a8ec>] (cpu_startup_entry+0x1c/0x20)
[    3.689908] [<c034a8ec>] (cpu_startup_entry) from [<c0b00e5c>] (start_kernel+0x4dc/0x4e8)
[    3.697275] Rebooting in 1 seconds..

Hm, it will boot with 64MB of RAM and then crash, but with only 32MB it wont boot at all.
Also, it wont boot if I change the RAM mount point

just to make sure, try disable the cpuidle and cpufreq ( i mean wtf is wrong with this router o.o)
(or try to make the first 64mb reserved)

Ok, will try disabling all powersaving features.

Already tried setting first 64MB as reserved, then it simply wont boot.
It would be helpfull if the kernel printed on which physical address it failed instead of just virtual one.

Also, another weird thing.
You remember that I said that it wont boot with 8064 dtsi but only with 8065 one.
Only major difference being different RPM s2_a and s2_b voltages, well in the stock dmesg they match the 8064 ones and not the 8065 ones.

[    0.550984] SDCC Power: 3300 mV 
[    0.551547] SDC3 GPIO Regulator: 1800 <--> 3000 mV at 3000 mV 
[    0.552562] smb208-s1a: 1050 <--> 1150 mV 
[    0.552900] smb208-s1b: 1050 <--> 1150 mV 
[    0.553224] smb208-s2a: 800 <--> 1250 mV 
[    0.553548] smb208-s2b: 800 <--> 1250 mV

So, why the F it wont boot with those?

i'm starting to fear that is a power problem and not a ram problem... (but by disabling the scaling and idle feature this should not happen)

do you have any source on codeaurora? would be helpful to compare the different driver (since it's a different soc) could be that the regulator are connected to different pin

Well, it could easily be.
Since, as soon I switch to 8064-v2.0 dtsi it will get stuck after RPM

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 5.4.36 (robimarko@localhost.localdomain) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r13140-6e8eead0a5)) #0 SMP Mon May 4 17:29:19 2020
[    0.000000] CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c5787d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] OF: fdt: Machine model: Edgecore ECW5410
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] OF: reserved mem: OVERLAP DETECTED!
[    0.000000] wifi_dump@44000000 (0x44000000--0x44600000) overlaps with wigig_dump@44400000 (0x44400000--0x44600000)
[    0.000000] percpu: Embedded 15 pages/cpu s30028 r8192 d23220 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 55304
[    0.000000] Kernel command line:  console=ttyMSM0,115200n8
[    0.000000] Bootloader command line (ignored): 
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 200912K/223232K available (5892K kernel code, 189K rwdata, 1504K rodata, 11264K init, 228K bss, 22320K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] random: get_random_bytes called from start_kernel+0x340/0x4e8 with crng_init=0
[    0.000000] clocksource: dg_timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 305801671480 ns
[    0.000008] sched_clock: 32 bits at 6MHz, resolution 160ns, wraps every 343597383600ns
[    0.000023] Switching to timer-based delay loop, resolution 160ns
[    0.000223] Calibrating delay loop (skipped), value calculated using timer frequency.. 12.50 BogoMIPS (lpj=62500)
[    0.000243] pid_max: default: 32768 minimum: 301
[    0.000437] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.000455] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.001488] CPU: Testing write buffer coherency: ok
[    0.002631] Setting up static identity map for 0x42300000 - 0x42300060
[    0.002807] rcu: Hierarchical SRCU implementation.
[    0.003303] smp: Bringing up secondary CPUs ...
[    0.005212] smp: Brought up 1 node, 2 CPUs
[    0.005228] SMP: Total of 2 processors activated (25.00 BogoMIPS).
[    0.005238] CPU: All CPU(s) started in SVC mode.
[    0.014875] VFP support v0.3: implementor 51 architecture 64 part 4d variant 2 rev 0
[    0.015026] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.015054] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.015223] pinctrl core: initialized pinctrl subsystem
[    0.016381] NET: Registered protocol family 16
[    0.016685] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.018065] cpuidle: using governor ladder
[    0.018132] cpuidle: using governor menu
[    0.055030] usbcore: registered new interface driver usbfs
[    0.055113] usbcore: registered new interface driver hub
[    0.055203] usbcore: registered new device driver usb
[    0.055263] pps_core: LinuxPPS API ver. 1 registered
[    0.055275] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.055307] PTP clock support registered
[    0.057006] clocksource: Switched to clocksource dg_timer
[    0.057893] thermal_sys: Registered thermal governor 'step_wise'
[    0.060360] NET: Registered protocol family 2
[    0.060945] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.060986] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear)
[    0.061014] TCP bind hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.061046] TCP: Hash tables configured (established 2048 bind 2048)
[    0.061151] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.061179] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.061415] NET: Registered protocol family 1
[    0.061463] PCI: CLS 0 bytes, default 64
[    0.234233] workingset: timestamp_bits=14 max_order=16 bucket_order=2
[    0.241089] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.241104] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.299909] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda not found, using dummy regulator
[    0.300056] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda_phy not found, using dummy regulator
[    0.300170] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda_refclk not found, using dummy regulator
[    0.300461] qcom-pcie 1b500000.pci: host bridge /soc/pci@1b500000 ranges:
[    0.300533] qcom-pcie 1b500000.pci:    IO 0x0fe00000..0x0fefffff -> 0x0fe00000
[    0.300570] qcom-pcie 1b500000.pci:   MEM 0x08000000..0x0fdfffff -> 0x08000000
[    1.448076] qcom-pcie 1b500000.pci: Phy link never came up
[    1.450086] qcom-pcie 1b500000.pci: cannot initialize host
[    1.450504] qcom-pcie: probe of 1b500000.pci failed with error -110
[    1.450774] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda not found, using dummy regulator
[    1.450889] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda_phy not found, using dummy regulator
[    1.451012] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda_refclk not found, using dummy regulator
[    1.451262] qcom-pcie 1b700000.pci: host bridge /soc/pci@1b700000 ranges:
[    1.451323] qcom-pcie 1b700000.pci:    IO 0x31e00000..0x31efffff -> 0x31e00000
[    1.451356] qcom-pcie 1b700000.pci:   MEM 0x2e000000..0x31dfffff -> 0x2e000000
[    1.571095] qcom-pcie 1b700000.pci: PCI host bridge to bus 0001:00
[    1.571118] pci_bus 0001:00: root bus resource [bus 00-ff]
[    1.571136] pci_bus 0001:00: root bus resource [mem 0x2e000000-0x31dfffff]
[    1.574521] PCI: bus0: Fast back to back transfers enabled
[    1.574859] qcom-pcie 1b900000.pci: 1b900000.pci supply vdda not found, using dummy regulator
[    1.574979] qcom-pcie 1b900000.pci: 1b900000.pci supply vdda_phy not found, using dummy regulator
[    1.575088] qcom-pcie 1b900000.pci: 1b900000.pci supply vdda_refclk not found, using dummy regulator
[    1.575346] qcom-pcie 1b900000.pci: host bridge /soc/pci@1b900000 ranges:
[    1.575409] qcom-pcie 1b900000.pci:    IO 0x35e00000..0x35efffff -> 0x35e00000
[    1.575441] qcom-pcie 1b900000.pci:   MEM 0x32000000..0x35dfffff -> 0x32000000
[    1.701991] qcom-pcie 1b900000.pci: PCI host bridge to bus 0002:00
[    1.702010] pci_bus 0002:00: root bus resource [bus 00-ff]
[    1.702026] pci_bus 0002:00: root bus resource [mem 0x32000000-0x35dfffff]
[    1.705347] PCI: bus0: Fast back to back transfers enabled
[    1.707720] L2 @ QSB rate. Forcing new rate.
[    1.707955] L2 @ 384000 KHz
[    1.708140] CPU0 @ 800000 KHz
[    1.708153] CPU1 @ QSB rate. Forcing new rate.
[    1.708281] CPU1 @ 384000 KHz
[    1.712025] gsbi 16300000.gsbi: GSBI port protocol: 6 crci: 0
[    1.713558] gsbi 1a200000.gsbi: GSBI port protocol: 3 crci: 0
[    1.715221] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.716017] msm_serial 16340000.serial: msm_serial: detected port #0
[    1.716071] msm_serial 16340000.serial: uartclk = 7372800
[    1.716144] 16340000.serial: ttyMSM0 at MMIO 0x16340000 (irq = 33, base_baud = 460800) is a MSM
[    1.716179] msm_serial: console setup on port #0
[    2.393045] printk: console [ttyMSM0] enabled
[    2.398087] msm_serial: driver initialized
[    2.407231] loop: module loaded
[    2.408921] nand: device found, Manufacturer ID: 0x01, Chip ID: 0xa1
[    2.409182] nand: AMD/Spansion S34MS01G2
[    2.415780] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    2.419846] 2 fixed-partitions partitions found on MTD device qcom_nand.0
[    2.427065] Creating 2 MTD partitions on "qcom_nand.0":
[    2.434023] 0x000000000000-0x000004000000 : "rootfs1"
[    2.444288] random: fast init done
[    2.546631] 0x000004000000-0x000008000000 : "rootfs2"
[    2.654964] spi_qup 1a280000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    2.656192] spi-nor spi0.0: found w25q128fw, expected s25fl256s1
[    2.674494] spi-nor spi0.0: w25q128fw (16384 Kbytes)
[    2.674591] 19 qcom-smem partitions found on MTD device spi0.0
[    2.678584] Creating 19 MTD partitions on "spi0.0":
[    2.684171] 0x000000000000-0x000000010000 : "0:SBL1"
[    2.689966] 0x000000010000-0x000000030000 : "0:MIBIB"
[    2.695038] 0x000000030000-0x000000060000 : "0:SBL2"
[    2.700105] 0x000000060000-0x000000090000 : "0:SBL3"
[    2.704992] 0x000000090000-0x0000000a0000 : "0:DDRCONFIG"
[    2.710046] 0x0000000a0000-0x0000000b0000 : "0:SSD"
[    2.715250] 0x0000000b0000-0x0000000e0000 : "0:TZ"
[    2.720032] 0x0000000e0000-0x000000100000 : "0:RPM"
[    2.724817] 0x000000100000-0x000000170000 : "0:APPSBL"
[    2.729712] 0x000000170000-0x000000180000 : "0:APPSBLENV"
[    2.734810] 0x000000180000-0x0000001c0000 : "0:ART"
[    2.740388] 0x0000001c0000-0x0000001e0000 : "0:BOOTCONFIG"
[    2.744952] 0x0000001e0000-0x000000210000 : "0:SBL2_1"
[    2.750615] 0x000000210000-0x000000240000 : "0:SBL3_1"
[    2.755662] 0x000000240000-0x000000250000 : "0:DDRCONFIG_1"
[    2.760892] 0x000000250000-0x000000280000 : "0:TZ_1"
[    2.766221] 0x000000280000-0x0000002a0000 : "0:RPM_1"
[    2.771540] 0x0000002a0000-0x000000310000 : "0:APPSBL_1"
[    2.776408] 0x000000310000-0x000000330000 : "0:BOOTCONFIG1"
[    2.783165] libphy: ipq8064_mdio_bus: probed
[    2.846726] libphy: Fixed MDIO Bus: probed
[    2.847324] i2c /dev entries driver
[    2.851950] cpuidle: enable-method property 'qcom,kpss-acc-v1' found operations
[    2.853310] cpuidle: enable-method property 'qcom,kpss-acc-v1' found operations
[    2.861101] sdhci: Secure Digital Host Controller Interface driver
[    2.867770] sdhci: Copyright(c) Pierre Ossman
[    2.873934] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.901522] NET: Registered protocol family 10
[    2.904878] Segment Routing with IPv6
[    2.904995] NET: Registered protocol family 17
[    2.911241] 8021q: 802.1Q VLAN Support v1.8
[    2.912984] Registering SWP/SWPB emulation handler
[    2.938587] qcom_rpm 108000.rpm: RPM firmware 3.0.16777377
[    2.955539] s1a: supplied by regulator-dummy
[    2.955646] s1a: Bringing 0uV into 1050000-1050000uV
[    2.959256] s1b: supplied by regulator-dummy
[    2.963884] s1b: Bringing 0uV into 1050000-1050000uV
[    2.968418] s2a: supplied by regulator-dummy
[    2.973084] s2a: Bringing 0uV into 800000-800000uV
[    2.977617] s2b: supplied by regulator-dummy
[    2.981950] s2b: Bringing 0uV into 800000-800000uV
[    2.987995] Speed bin: 0
[    2.990903] PVS bin: 1
[    3.000775] hctosys: unable to ope[    3.018423] Freeing unused kernel memory: 11264K

Unfortunately not, this CPU is a really rare one.
I can try digging through the codeaurora database, but it should not be that different from other models.
It looks to be 8064 based.

Unfortunately, the vendor simply ignores any request for GPL

Here is the stock DTS:

Ok, when disabling CPUFreq and CPUIdle it will actually boot fully.
So, I presume it has different OPP points, there are defined in the stock DTS but I dont know how to decipher them

in the stock dts they are called differently (while at it also check cache opp)
just give me a sec

They are defined directly in the each CPU node

mh there should be qcom,pvs

@robimarko sorry didn't notice the dts...

will try to understand how to decode that sh*t

i looks like in the format

frequency voltage frequency voltage frequency voltage

Yep can confirm this...

also max freq is 1.4 ghz

cache freq is cache freq, voltage, cpu freq

Anyway they looks the same as ipq8064

@robimarko think i found the cause... could be that on this cpu pvs efuse are not blown and the cpufreq driver by default use the wrong pvs table

https://source.codeaurora.org/quic/qsdk/oss/kernel/linux-msm/commit/?id=8b2089087088e08f5e68b83ba04af44ecc3f9e9d

Hm, it makes sense.
But stock bootlog shows that it identifies the PVS as 1
ACPU PVS: 1

Can we maybe printf debug that?

Just add pr_info to cpufreq nvmem driver (directly in the kernel build)

if you narrow this down to disabling cpuidle as the one factor that allows this board to boot, then I'd suspect

/* SPM register data for 8064 */ 
static const struct spm_reg_data spm_reg_8064_cpu = {                           
        .reg_offset = spm_reg_offset_v1_1,                                      
        .spm_cfg = 0x1F,                                                        
        .pmic_dly = 0x02020004,                                                 
        .pmic_data[0] = 0x0084009C,                                             
        .pmic_data[1] = 0x00A4001C,                                             
        .seq = { 0x03, 0x0F, 0x00, 0x24, 0x54, 0x10, 0x09, 0x03, 0x01,          
                0x10, 0x54, 0x30, 0x0C, 0x24, 0x30, 0x0F },                     
        .start_index[PM_SLEEP_MODE_STBY] = 0,                                   
        .start_index[PM_SLEEP_MODE_SPC] = 2,                                    
};

hardcoded into spm.c might be the issue. I think this is used by the "spc" cpuidle function and is likely specific to 8064 cpus. "wfi" cpuidle may work on this board as it does for 8065.

bootloader moding the fdt and changing kernel memory mapping???? that might explain why I had issues with tsens memory mapping. Interesting stuff.

Sorry for the noise and interjecting here.

This is a special case, I think every other router use the legacy way (bootm)

@robimarko yes first thing i would try is create a dtsi with just cpuidle disabled and the same opp of ipq8064