How to interact with lantiq WiFi and dsl hardware controllers

Sparks · May 25, 2019, 10:52pm

I’m currently working on adding support for the avm 7490, a lantiq based device.

Last night after I compiled in pcitools into my ram image, to my surprise when I ran lspci it returned blank output / no results.. reading further about these avm devices they are different to others (I only have experience with ar71xx devices before) and I’m not sure how to proceed. Seems I have a big gap in my understanding how the hardware is controlled .

Does anyone know of any documentation / examples for how to test support for these type of devices? Most specifically how do I interact with the wifi and dsl modem? What commands should work - and what kernel module dependencies do they have?

slh · May 25, 2019, 11:00pm

Disclaimer: I don't own the device in question, this is -to a large extent- educated guesswork.

According to the system specifications, the 2.4 GHz wlan is QCA9558 (and the 5 GHz wlan QCA9880). The interesting aspect here is that QCA9558 is not a PCIe WLAN card, but a full (ath79/ ar71xx) SOC, running at 720 MHz. AFAIK, there are two potential modes of operation here, on the one hand switching the ath79 into a PCIe compatibility mode - on the other hand making use of the ath79 SOC as-is, connecting to it via ethernet on a dedicated vlan (see Easybox 904 xDSL with lantiq + RaLink rt3883 as a potential example). You probably have to check the OEM firmware (runtime of GPL tarball) for hints.

Sparks · May 26, 2019, 1:54am

Thanks for the info. Done some further digging and the 5ghz chip supposedly is supported by the ath10k driver .

https://wireless.wiki.kernel.org/en/users/Drivers/ath10k

When I’m back in front of my PC, I’ll try compiling it into the ram image (if it’s not already in there) . Although this page doesn’t look promising https://openwrt.org/docs/techref/driver.wlan/ath10k

Should I maybe start on the 2.4chip QCA9558 even if it’s a bit exotic , since it’s ar71?

slh · May 26, 2019, 2:25am

QCA9880 is supported by ath10k, that's not the issue here - but at least if the QCA9558 is running in SOC mode, I'd expect the QCA9880 card being connected to that one, instead of being exposed to the lantiq host bus.

Sparks · May 26, 2019, 5:11am

(apologies in advance for long post - I kept discovering more details as I was drafting this)
I think you might be onto something with the PCIe compatibility mode.

While testing the gpio buttons , I ran across some "pcie" references in the GPL source files. Values 21 and 22 apparently.

oem GPL sources - gpios summary

		value = <45>;
		module_id = <DEF_IFX_GPIO_MODULE_LED>;
		value = <47>;
		module_id = <DEF_IFX_GPIO_MODULE_LED>;
		value = <36>;
		module_id = <DEF_IFX_GPIO_MODULE_LED>;
		value = <35>;
		module_id = <DEF_IFX_GPIO_MODULE_LED>;
		value = <33>;
		module_id = <DEF_IFX_GPIO_MODULE_LED>;
		value = <46>;
		module_id = <DEF_IFX_GPIO_MODULE_LED>;
		value = <1>;
		module_id = <DEF_IFX_GPIO_MODULE_LED>;
		value = <29>;
		module_id = <DEF_IFX_GPIO_MODULE_LED>;
		value = <30>;
		module_id = <DEF_IFX_GPIO_MODULE_PIGLET>;
		value = <11>;
		module_id = <DEF_IFX_GPIO_MODULE_PIGLET>;
		value = <12>;
		module_id = <DEF_IFX_GPIO_MODULE_PIGLET>;
		value = <15>;
		module_id = <DEF_IFX_GPIO_MODULE_FPGA>;
		value = <28>;
		module_id = <DEF_IFX_GPIO_MODULE_FPGA>;
		value = <20>;
		module_id = <DEF_IFX_GPIO_MODULE_FPGA>;
		value = <19>;
		module_id = <DEF_IFX_GPIO_MODULE_FPGA>;
		value = <8>;
		module_id = <DEF_IFX_GPIO_MODULE_FPGA>;
		value = <9>;
		module_id = <DEF_IFX_GPIO_MODULE_FPGA>;
		value = <7>;
		module_id = <DEF_IFX_GPIO_MODULE_FPGA>;
		value = <0>;
		module_id = <DEF_IFX_GPIO_MODULE_TDMCHECK>;
		value = <40>;
		module_id = <DEF_IFX_GPIO_MODULE_TDMCHECK>;
		value = <0>;
		module_id = <DEF_IFX_GPIO_MODULE_PCMLINK>;
		value = <25>;
		module_id = <DEF_IFX_GPIO_MODULE_PCMLINK>;
		value = <41>;
		module_id = <DEF_IFX_GPIO_MODULE_PCMLINK>;
		value = <40>;
		module_id = <DEF_IFX_GPIO_MODULE_PCMLINK>;
		value = <18>;
		module_id = <DEF_IFX_GPIO_MODULE_SSC>;
		value = <17>;
		module_id = <DEF_IFX_GPIO_MODULE_SSC>;
		value = <16>;
		module_id = <DEF_IFX_GPIO_MODULE_SSC>;
		value = <10>;
		module_id = <DEF_IFX_GPIO_MODULE_SPI_FLASH>;
		value = <13>;
		module_id = <DEF_IFX_GPIO_MODULE_NAND>;
		value = <24>;
		module_id = <DEF_IFX_GPIO_MODULE_NAND>;
		value = <49>;
		module_id = <DEF_IFX_GPIO_MODULE_NAND>;
		value = <48>;
		module_id = <DEF_IFX_GPIO_MODULE_NAND>;
		value = <23>;
		module_id = <DEF_IFX_GPIO_MODULE_NAND>;
		value = <14>;
		module_id = <DEF_IFX_GPIO_MODULE_USB DEF_IFX_GPIO_MODULE_EARLY_REGISTER>;
		value = <3>;
		module_id = <DEF_IFX_GPIO_MODULE_EXTPHY_25MHZ_CLOCK>;
		value = <32>;
		module_id = <DEF_IFX_GPIO_MODULE_EXTPHY_RESET>;
		value = <44>;
		module_id = <DEF_IFX_GPIO_MODULE_EXTPHY_RESET>;
		value = <39>;
		module_id = <DEF_IFX_GPIO_MODULE_EXTPHY_INT>;
		value = <42>;
		module_id = <DEF_IFX_GPIO_MODULE_EXTPHY_MDIO>;
		value = <43>;
		module_id = <DEF_IFX_GPIO_MODULE_EXTPHY_MDIO>;
		value = <21>;
		module_id = <DEF_IFX_GPIO_MODULE_PCIE>;
		value = <22>;
		module_id = <DEF_IFX_GPIO_MODULE_PCIE>;
		value = <5>;
		module_id = <DEF_IFX_GPIO_MODULE_WLAN_OFFLOAD_WASP_RESET>;
		value = <34>;
		module_id = <DEF_IFX_GPIO_MODULE_WLAN_OFFLOAD_WASP_RESET>;
		value = <31>;
		module_id = <DEF_IFX_GPIO_MODULE_WLAN_OFFLOAD_SCRPN_UART>;

If it does need to run in compatibility mode , how does one do that?

In sources, there are references to piglet and ISDN , so I think I can safely ignore anything else with 'piglet' references.

In ifconfig output I found this "wlan@wasp"

I still have the device running on oem firmware, and I'm building ram images, and I have root access into oem firmware - so can get other details if you think they would shed any light - but not sure what else to be even looking for at this point..

Just found some explicit PCIe references in proc -

oem fw: cat proc/iomem and proc/ioports

cat /proc/iomem

00000000-0fffffff : System RAM
00002000-00626e5f : Kernel code
00626e60-008b7fff : Kernel data
01204000-01910000 : module memory
1c000000-1cffffff : PCIe0 Memory space
1c000000-1c0fffff : PCI Bus 0000:01
1c000000-1c001fff : 0000:01:00.0
1c000000-1c001fff : xhci_hcd
1e100c00-1e100cff : AVM Serial (ASC)
1e116000-1e11609f : mei_vr9
1f100000-1f1000a7 : pcmlink_tdm

cat /proc/ioports

1d800000-1d8fffff : PCIe0 I/O space

How can I identify what device(s) are behind these addresses? Anything to do with dect/voip I'm not worried about (and those don't have gpl drivers avaialble for anyway)

Heres the dmesg output from the latest ram image I have compiled.

openwrt initram image - dmesg output

[ 0.000000] Linux version 4.14.91 (wrt@wrt-pc) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r9025-88464cd158)) #0 SMP Sat Jan 12 19:05:40 2019
[ 0.000000] SoC: xRX200 rev 1.2
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019556 (MIPS 34Kc)
[ 0.000000] MIPS: machine is AVM FRITZ!Box 7490
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 20000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Detected 1 available secondary CPU(s)
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x000000000fffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x000000000fffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[ 0.000000] random: get_random_bytes called from start_kernel+0x8c/0x4a0 with crng_init=0
[ 0.000000] percpu: Embedded 14 pages/cpu @8120d000 s25936 r8192 d23216 u57344
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 65024
[ 0.000000] Kernel command line: console=ttyLTQ0,115200
[ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Writing ErrCtl register=0002c520
[ 0.000000] Readback ErrCtl register=0002c520
[ 0.000000] Memory: 247940K/262144K available (4936K kernel code, 187K rwdata, 1340K rodata, 5040K init, 228K bss, 14204K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[ 0.000000] Hierarchical RCU implementation.
[ 0.000000] NR_IRQS: 256
[ 0.000000] Setting up vectored interrupts
[ 0.000000] Setting up IPI vectored interrupts
[ 0.000000] CPU Clock: 500MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041786 ns
[ 0.000011] sched_clock: 32 bits at 250MHz, resolution 4ns, wraps every 8589934590ns
[ 0.007922] Calibrating delay loop... 332.54 BogoMIPS (lpj=665088)
[ 0.046011] pid_max: default: 32768 minimum: 301
[ 0.050940] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.057459] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.066885] Hierarchical SRCU implementation.
[ 0.072364] smp: Bringing up secondary CPUs ...
[ 0.077828] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[ 0.077844] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.077977] CPU1 revision is: 00019556 (MIPS 34Kc)
[ 0.109041] Synchronize counters for CPU 1: done.
[ 0.133381] smp: Brought up 1 node, 2 CPUs
[ 0.142414] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[ 0.152096] futex hash table entries: 512 (order: 2, 16384 bytes)
[ 0.158350] pinctrl core: initialized pinctrl subsystem
[ 0.165003] NET: Registered protocol family 16
[ 0.182064] pinctrl-xway 1e100b10.pinmux: Init done
[ 0.188548] dma-xway 1e104100.dma: Init done - hw rev: 7, ports: 7, channels: 28
[ 0.200703] dcdc-xrx200 1f106a00.dcdc: Core Voltage : 1016 mV
[ 0.426357] ifx_pcie_wait_phy_link_up timeout
[ 0.535465] random: fast init done
[ 0.646847] ifx_pcie_wait_phy_link_up timeout
[ 0.864077] ifx_pcie_wait_phy_link_up timeout
[ 1.081343] ifx_pcie_wait_phy_link_up timeout
[ 1.298569] ifx_pcie_wait_phy_link_up timeout
[ 1.302795] pcie_rc_initialize link up failed!!!!!
[ 1.333856] usbcore: registered new interface driver usbfs
[ 1.339688] usbcore: registered new interface driver hub
[ 1.345100] usbcore: registered new device driver usb
[ 1.353110] clocksource: Switched to clocksource MIPS
[ 1.360844] NET: Registered protocol family 2
[ 1.366170] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[ 1.373101] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[ 1.379628] TCP: Hash tables configured (established 2048 bind 2048)
[ 1.386163] UDP hash table entries: 256 (order: 1, 8192 bytes)
[ 1.391974] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[ 1.398574] NET: Registered protocol family 1
[ 7.383442] gptu: totally 6 16-bit timers/counters
[ 7.388362] gptu: misc_register on minor 63
[ 7.392601] gptu: succeeded to request irq 126
[ 7.397034] gptu: succeeded to request irq 127
[ 7.401527] gptu: succeeded to request irq 128
[ 7.406061] gptu: succeeded to request irq 129
[ 7.410569] gptu: succeeded to request irq 130
[ 7.415092] gptu: succeeded to request irq 131
[ 7.419751] No VPEs reserved for AP/SP, not initialize VPE loader
[ 7.419751] Pass maxvpes= argument as kernel argument
[ 7.431150] No TCs reserved for AP/SP, not initializing RTLX.
[ 7.431150] Pass maxtcs= argument as kernel argument
[ 7.444157] Crashlog allocated RAM at address 0x3f00000
[ 7.449716] workingset: timestamp_bits=30 max_order=16 bucket_order=0
[ 7.468995] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 7.474798] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 7.491972] io scheduler noop registered
[ 7.495803] io scheduler deadline registered (default)
[ 7.505789] 1e100c00.serial: ttyLTQ0 at MMIO 0x1e100c00 (irq = 112, base_baud = 0) is a lantiq,asc
[ 7.514800] console [ttyLTQ0] enabled
[ 7.514800] console [ttyLTQ0] enabled
[ 7.522055] bootconsole [early0] disabled
[ 7.522055] bootconsole [early0] disabled
[ 7.531290] cacheinfo: Failed to find cpu0 device node
[ 7.535102] cacheinfo: Unable to detect cache hierarchy for CPU 0
[ 7.543000] nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xdc
[ 7.547920] nand: Micron MT29F4G08ABADAWP
[ 7.551930] nand: 512 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[ 7.559627] Scanning device for bad blocks
[ 7.846324] 2 fixed-partitions partitions found on MTD device 14000000.nand
[ 7.851874] Creating 2 MTD partitions on "14000000.nand":
[ 7.857283] 0x000000000000-0x000000400000 : "kernel"
[ 7.864185] 0x000000400000-0x000008000000 : "ubi"
[ 7.872405] spi-lantiq-ssc 1e100800.spi: Lantiq SSC SPI controller (Rev 8, TXFS 8, RXFS 8, DMA 1)
[ 7.882381] m25p80 spi0.4: mx25l8005 (1024 Kbytes)
[ 7.885872] 3 fixed-partitions partitions found on MTD device spi0.4
[ 7.892139] Creating 3 MTD partitions on "spi0.4":
[ 7.896916] 0x000000000000-0x000000040000 : "urlader"
[ 7.903797] 0x000000040000-0x0000000a0000 : "tffs (1)"
[ 7.909420] 0x0000000a0000-0x000000100000 : "tffs (2)"
[ 7.918703] libphy: Fixed MDIO Bus: probed
[ 7.926454] wdt 1f8803f0.watchdog: Init done
[ 7.935164] NET: Registered protocol family 10
[ 7.941841] Segment Routing with IPv6
[ 7.944329] NET: Registered protocol family 17
[ 7.948647] 8021q: 802.1Q VLAN Support v1.8
[ 8.063930] libphy: lantiq,xrx200-mdio: probed
[ 8.187822] net-xrx200: invalid MAC, using random
[ 8.260192] Atheros 8035 ethernet 0:00: attached PHY driver [Atheros 8035 ethernet] (mii_bus:phy_addr=0:00, irq=POLL)
[ 8.340174] Atheros 8035 ethernet 0:01: attached PHY driver [Atheros 8035 ethernet] (mii_bus:phy_addr=0:01, irq=POLL)
[ 8.420581] Intel XWAY PHY11G (xRX v1.2 integrated) 0:11: attached PHY driver [Intel XWAY PHY11G (xRX v1.2 integrated)] (mii_bus:phy_addr=0:11, irq=POLL)
[ 8.504582] Intel XWAY PHY11G (xRX v1.2 integrated) 0:13: attached PHY driver [Intel XWAY PHY11G (xRX v1.2 integrated)] (mii_bus:phy_addr=0:13, irq=POLL)
[ 8.520001] UBI error: no valid UBI magic found insi[ 8.532203] Freeing unused kernel memory: 5040K
[ 8.535297] This architecture does not have kernel memory protection.
[ 8.562221] init: Console is alive
[ 8.564720] init: - watchdog -
[ 8.596375] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 8.612121] dwc2 1e101000.usb: 1e101000.usb supply vusb_d not found, using dummy regulator
[ 8.619175] dwc2 1e101000.usb: 1e101000.usb supply vusb_a not found, using dummy regulator
[ 8.627773] dwc2 1e101000.usb: dwc2_core_reset() HANG! Soft Reset GRSTCTL=80000001
[ 8.840453] dwc2 1e101000.usb: DWC OTG Controller
[ 8.843807] dwc2 1e101000.usb: new USB bus registered, assigned bus number 1
[ 8.850861] dwc2 1e101000.usb: irq 62, io mem 0x1e101000
[ 8.858074] hub 1-0:1.0: USB hub found
[ 8.860802] hub 1-0:1.0: 1 port detected
[ 8.865416] dwc2 1e106000.usb: 1e106000.usb supply vusb_d not found, using dummy regulator
[ 8.872865] dwc2 1e106000.usb: 1e106000.usb supply vusb_a not found, using dummy regulator
[ 8.881267] dwc2 1e106000.usb: dwc2_core_reset() HANG! Soft Reset GRSTCTL=80000001
[ 9.088307] dwc2 1e106000.usb: DWC OTG Controller
[ 9.091605] dwc2 1e106000.usb: new USB bus registered, assigned bus number 2
[ 9.098720] dwc2 1e106000.usb: irq 91, io mem 0x1e106000
[ 9.105498] hub 2-0:1.0: USB hub found
[ 9.107974] hub 2-0:1.0: 1 port detected
[ 9.114163] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 9.130807] init: - preinit -
[ 9.310147] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 9.336389] random: procd: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 11.368498] lantiq,xrx200-net 1e108000.eth eth0: port 4 got link
[ 11.373197] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 12.514089] procd: - early -
[ 12.515731] procd: - watchdog -
[ 13.119693] procd: - watchdog -
[ 13.122105] procd: - ubus -
[ 13.133797] random: ubusd: uninitialized urandom read (4 bytes read)
[ 13.174477] random: ubusd: uninitialized urandom read (4 bytes read)
[ 13.180285] random: ubusd: uninitialized urandom read (4 bytes read)
[ 13.187885] procd: - init -
Please press Enter to activate this console.
[ 13.416301] lantiq,xrx200-net 1e108000.eth eth0: port 4 lost link
[ 13.448949] kmodloader: loading kernel modules from /etc/modules.d/*
[ 13.457639] IFXOS, Version 1.5.19 (c) Copyright 2009, Lantiq Deutschland GmbH
[ 13.467872] NET: Registered protocol family 8
[ 13.470915] NET: Registered protocol family 20
[ 13.482980] PPP generic driver version 2.4.2
[ 13.493903] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 13.520218] Lantiq (VRX) DSL CPE MEI driver, version 1.5.17.6, (c) 2007-2015 Lantiq Beteiligungs-GmbH & Co. KG
[ 13.531753]
[ 13.531753]
[ 13.531753] Lantiq CPE API Driver version: DSL CPE API V4.17.18.6
[ 13.549447]
[ 13.549447] Predefined debug level: 3
[ 13.561098] Loading modules backported from Linux version v4.19.7-0-g61c68f2a2af0
[ 13.567238] Backport generated by backports.git v4.19.7-1-0-g148b072d
[ 13.576893] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 13.586362] Infineon Technologies DEU driver version 2.0.0
[ 13.593387] IFX DEU DES initialized (multiblock).
[ 13.598647] IFX DEU AES initialized (multiblock).
[ 13.602786] IFX DEU ARC4 initialized (multiblock).
[ 13.607165] IFX DEU SHA1 initialized.
[ 13.610812] IFX DEU MD5 initialized.
[ 13.614370] IFX DEU SHA1_HMAC initialized.
[ 13.618454] IFX DEU MD5_HMAC initialized.
[ 13.630959] nf_conntrack version 0.5.0 (4096 buckets, 16384 max)
[ 13.695593] NET: Registered protocol family 24
[ 13.717579] xt_time: kernel timezone is -0000
[ 13.816494] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 15.048254] urandom_read: 5 callbacks suppressed
[ 15.048269] random: jshn: uninitialized urandom read (4 bytes read)
[ 16.165971] random: crng init done
[ 35.228806] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 35.252869] device eth0 entered promiscuous mode
[ 35.266149] br-lan: port 1(eth0.1) entered blocking state
[ 35.270288] br-lan: port 1(eth0.1) entered disabled state
[ 35.276485] device eth0.1 entered promiscuous mode
[ 35.287446] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[ 38.312360] lantiq,xrx200-net 1e108000.eth eth0: port 4 got link
[ 38.317392] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 38.336328] br-lan: port 1(eth0.1) entered blocking state
[ 38.340413] br-lan: port 1(eth0.1) entered forwarding state
[ 38.360246] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready

BusyBox v1.30.0 () built-in shell (ash)

| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -| || | | || || |
|___|| |||||_||| |____|
|| W I R E L E S S F R E E D O M

OpenWrt SNAPSHOT, r9025-88464cd158

=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.

root@OpenWrt:/#

I just noticed several pcie timeout errors in amongst the output above...

[    0.864077] ifx_pcie_wait_phy_link_up timeout
[    1.081343] ifx_pcie_wait_phy_link_up timeout
[    1.298569] ifx_pcie_wait_phy_link_up timeout
[    1.302795] pcie_rc_initialize link up failed!!!!!

openwrt cat /proc/iomem and /proc/ioports

root@OpenWrt:/# cat /proc/iomem
14000000-15ffffff : /fpi@10000000/localbus@0/nand@1
1e100800-1e1008ff : /fpi@10000000/spi@e100800
1e100b10-1e100baf : /fpi@10000000/pinmux@e100b10
1e100c00-1e100fff : 1e100c00.serial
1e101000-1e101fff : /fpi@10000000/usb@e101000
1e104100-1e1048ff : /fpi@10000000/dma@e104100
1e105300-1e1053ff : /fpi@10000000/ebu@e105300
1e106000-1e106fff : /fpi@10000000/usb@e106000
1e108000-1e10afff : /fpi@10000000/eth@e108000
1e10b100-1e10b16f : /fpi@10000000/eth@e108000
1e10b1d8-1e10b207 : /fpi@10000000/eth@e108000
1e10b308-1e10b337 : /fpi@10000000/eth@e108000
1e116000-1e11609f : mei_cpe
1f101000-1f101fff : /sram@1f000000/eiu@101000
1f102000-1f102fff : /sram@1f000000/pmu@102000
1f103000-1f103fff : /sram@1f000000/cgu@103000
1f106a00-1f106bff : /sram@1f000000/dcdc@106a00
1f203020-1f203023 : /sram@1f000000/rcu@203000/gphy@20
1f203068-1f20306b : /sram@1f000000/rcu@203000/gphy@68
1f880200-1f880227 : /biu@1f800000/icu@80200
1f880228-1f88024f : /biu@1f800000/icu@80200
1f880250-1f880277 : /biu@1f800000/icu@80200
1f880278-1f88029f : /biu@1f800000/icu@80200
1f8802a0-1f8802c7 : /biu@1f800000/icu@80200
1f8803f0-1f8803ff : /biu@1f800000/watchdog@803f0
root@OpenWrt:/# cat /proc/ioports
root@OpenWrt:/#

any ideas what to try next?

slh · May 26, 2019, 5:22am

dmesg and ls -1 /sys/module/ of the OEM firmware might provide some clues.

slh · May 26, 2019, 5:40am

If the following is correct:

You'll notice the complete absence of ath9k/ ath10k (respectively the proprietary ath_pci) specific loading/ debugging messages (not them listed in the loaded modules), just some pretty unique initialization messages - all of which (and the ethernet messages around it) pointing at "full offloading", meaning the QCA9558 SOC is probably running on its own, taking care of all WLAN needs, decoupled from the lantiq host SOC (you may see dedicated RAM and serial consoles, probably no dedicated flash, for it on the board).

Sparks · May 26, 2019, 5:48am

ls -1 /sys/module/

8021q
Piglet_noemif
avm
avm_dect
avm_fiber_if
avmnet_config
block
block2mtd
bridge
capi_codec
configfs
cprocfsmod
cpuidle
dect_io
dns_resolver
drv_switch_api
dsl_vr9
dynamic_debug
firmware_class
fuse
ifxmips_dma_core
ifxmips_ppa_datapath_vr9_e5
ipip
ipv6
isdn_fbox_fon5
kdsldmod
kernel
keyboard
krtp
l2tp_core
l2tp_eth
l2tp_ip
l2tp_ip6
l2tp_netlink
led_modul_Fritz_Box_HW185
loop
mei_vr9
nbd
pcmlink
printk
random
rcupdate
rcutree
rtc_avm
sch_fq_codel
sch_llq
sch_tbf
sit
spurious
swi_ifx_common
sysrq
tcp
tcp_cubic
tffs_init
tpm
ubi
ubifs
usb_common
usbcore
vt
workqueue
xhci_hcd
xz_dec
yaffs

oem dmesg output

[    0.000000] Linux version 3.10.107 (jpluschke@GU_IQ17p2_NL1_vr9) (gcc version 5.4.0 (Buildroot 2016.05-g4d7c863) ) #1 SMP Tue Sep 11 17:57:0
2 CEST 2018
[    0.000000] [env_init] 0x81018160[0]
[    0.000000] [env_init] 0x810181a0[1]
[    0.000000] [env_init] 0x810182a0[2]
[    0.000000] [env_init] switch to ram location
[    0.000000] [init_avm_kernel_config] AVM Kernel Config (ptr 808a8000)
[    0.000000] [init_avm_kernel_config] AVM Kernel Config: module memory entry
[    0.000000] [init_avm_kernel_config] AVM Kernel Config: version info entry
[    0.000000] [init_avm_kernel_config] AVM Kernel Config: device-tree for subrev 0 found
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019556 (MIPS 34Kc)
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 10000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x0fffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x0fffffff]
[    0.000000] On node 0 totalpages: 65536
[    0.000000] free_area_init_node: node 0, pgdat 8089d960, node_mem_map 81002c60
[    0.000000]   Normal zone: 512 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 65536 pages, LIFO batch:15
[    0.000000] [module-alloc] use 0x70c000 bytes at 0x81204000
[    0.000000] Detected 1 available secondary CPU(s)
[    0.000000] [avm_cache_set_coherency]: setting cache coherency for HWRevision=185 to write back allocate 
[    0.000000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] PERCPU: Embedded 7 pages/cpu @81914000 s7328 r8192 d13152 u32768
[    0.000000] pcpu-alloc: s7328 r8192 d13152 u32768 alloc=8*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
[    0.000000] Kernel command line: console=ttyS0,115200n8r nor_size=0MB sflash_size=1024KB nand_size=512MB ethaddr=38:10:D5:B0:42:DC 
[    0.000000] [NAND] nand_size = 0x20000000
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Writing ErrCtl register=0002c520
[    0.000000] Readback ErrCtl register=0002c520
[    0.000000] Memory: 242328k/262144k available (6291k kernel code, 19816k reserved, 2628k data, 288k init, 0k highmem)
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:181
[    0.000000] SRSConf0 0x3feffbfe: SRS1: 0xffffffff, SRS2 0xffffffff, SRS3 0xffffffff
[    0.000000] Lantiq ICU driver, version 3.0.1, (c) 2001-2011 Lantiq Deutschland GmbH
[    0.000000] Console: colour dummy device 80x25
[    0.000000] console [ttyS0] enabled, bootconsole disabled
[    0.020000] Calibrating delay loop... 331.77 BogoMIPS (lpj=1658880)
[    0.080000] pid_max: default: 32768 minimum: 301
[    0.080000] Security Framework initialized
[    0.080000] Mount-cache hash table entries: 512
[    0.090000] I-cache flushes single-threaded
[    0.090000] D-cache flushes single-threaded
[    0.090000] Performance counters: mips/34K PMU enabled, 2 32-bit counters available to each CPU, irq 6
[    0.100000] [avm_cache_set_coherency]: setting cache coherency for HWRevision=185 to write back allocate 
[    0.100000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[    0.100000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.100000] CPU1 revision is: 00019556 (MIPS 34Kc)
[    0.180000] Brought up 2 CPUs
[    0.180000] [yield_context_init] cpu=1 tc=2 mask=2301
[    0.190000] [yield_context_init] cpu=0 tc=3 mask=410
[    0.190000] devtmpfs: initialized
[    0.210000] pinctrl core: initialized pinctrl subsystem
[    0.210000] Creating Config Table 
[    0.210000] [avm_generate_hw_config_table_from_device_tree] gpio_cnt: 46
[    0.220000] NET: Registered protocol family 16
[    0.230000] FPU Affinity set after 5000 emulations
[    0.230000] avm_check_cpu_features: mips-options: 0x006d638b icache.flags 0x00000000 dcache.flags 0x00000004 isa_level 0x00000063 ases 00000031
[    0.240000] Reboot Status is: Soft-Reboot 
[    0.250000] avm_alloc_page_extension node_extension_table[0] entries=65536 (size=262144)  alloced
[    0.250000] [avmnet] [avmnet_cfg_init] Driver version: 6.295.2.2-iq17p2_nl1-jz32984_revert_NL1Di 11. Sep 17:53:51 CEST 2018
[    0.260000] Port 0 PLL REGFILE
[    0.260000] PCIE_PHY_PLL_CTRL1    0x8e39
[    0.260000] PCIE_PHY_PLL_CTRL2    0x0183
[    0.260000] PCIE_PHY_PLL_CTRL3    0x0042
[    0.260000] PCIE_PHY_PLL_CTRL4    0x0000
[    0.260000] PCIE_PHY_PLL_CTRL5    0x0000
[    0.260000] PCIE_PHY_PLL_CTRL6    0x0000
[    0.260000] PCIE_PHY_PLL_CTRL7    0x0000
[    0.260000] PCIE_PHY_PLL_A_CTRL1  0x120e
[    0.260000] PCIE_PHY_PLL_A_CTRL2  0x39d7
[    0.260000] PCIE_PHY_PLL_A_CTRL3  0x0900
[    0.260000] PCIE_PHY_PLL_STATUS   0x0000
[    0.260000] TX1 REGFILE
[    0.260000] PCIE_PHY_TX1_CTRL1    0x0009
[    0.260000] PCIE_PHY_TX1_CTRL2    0x2e00
[    0.260000] PCIE_PHY_TX1_CTRL3    0x1fff
[    0.260000] PCIE_PHY_TX1_A_CTRL1  0x0810
[    0.260000] PCIE_PHY_TX1_A_CTRL2  0x0706
[    0.260000] PCIE_PHY_TX1_MOD1     0x0000
[    0.260000] PCIE_PHY_TX1_MOD2     0x0000
[    0.270000] PCIE_PHY_TX1_MOD3     0x0180
[    0.270000] TX2 REGFILE
[    0.270000] PCIE_PHY_TX2_CTRL1    0x0009
[    0.270000] PCIE_PHY_TX2_CTRL2    0x3096
[    0.270000] PCIE_PHY_TX2_A_CTRL1  0x8010
[    0.270000] PCIE_PHY_TX2_A_CTRL2  0x4707
[    0.270000] PCIE_PHY_TX2_MOD1     0x0000
[    0.270000] PCIE_PHY_TX2_MOD2     0x0000
[    0.270000] PCIE_PHY_TX2_MOD3     0x0180
[    0.270000] RX1 REGFILE
[    0.270000] PCIE_PHY_RX1_CTRL1    0x0001
[    0.270000] PCIE_PHY_RX1_CTRL2    0x3000
[    0.270000] PCIE_PHY_RX1_CDR      0x0235
[    0.270000] PCIE_PHY_RX1_EI       0x0004
[    0.270000] PCIE_PHY_RX1_A_CTRL   0x6803
[    0.270000] Port 0 PLL REGFILE
[    0.270000] PCIE_PHY_PLL_CTRL1    0x38e4
[    0.270000] PCIE_PHY_PLL_CTRL2    0x03ee
[    0.270000] PCIE_PHY_PLL_CTRL3    0x0000
[    0.270000] PCIE_PHY_PLL_CTRL4    0x1b72
[    0.270000] PCIE_PHY_PLL_CTRL5    0xfae3
[    0.270000] PCIE_PHY_PLL_CTRL6    0x3a04
[    0.270000] PCIE_PHY_PLL_CTRL7    0x0002
[    0.270000] PCIE_PHY_PLL_A_CTRL1  0x120e
[    0.270000] PCIE_PHY_PLL_A_CTRL2  0x39d7
[    0.270000] PCIE_PHY_PLL_A_CTRL3  0x2900
[    0.270000] PCIE_PHY_PLL_STATUS   0x0070
[    0.270000] TX1 REGFILE
[    0.270000] PCIE_PHY_TX1_CTRL1    0x0009
[    0.270000] PCIE_PHY_TX1_CTRL2    0x2e00
[    0.270000] PCIE_PHY_TX1_CTRL3    0x1fff
[    0.270000] PCIE_PHY_TX1_A_CTRL1  0x0810
[    0.270000] PCIE_PHY_TX1_A_CTRL2  0x0706
[    0.270000] PCIE_PHY_TX1_MOD1     0x1ffe
[    0.270000] PCIE_PHY_TX1_MOD2     0xfffe
[    0.270000] PCIE_PHY_TX1_MOD3     0x0001
[    0.270000] TX2 REGFILE
[    0.270000] PCIE_PHY_TX2_CTRL1    0x0009
[    0.270000] PCIE_PHY_TX2_CTRL2    0x3096
[    0.270000] PCIE_PHY_TX2_A_CTRL1  0x8010
[    0.270000] PCIE_PHY_TX2_A_CTRL2  0x4707
[    0.270000] PCIE_PHY_TX2_MOD1     0x1ffe
[    0.270000] PCIE_PHY_TX2_MOD2     0xfffe
[    0.270000] PCIE_PHY_TX2_MOD3     0x0001
[    0.270000] RX1 REGFILE
[    0.270000] PCIE_PHY_RX1_CTRL1    0x0001
[    0.270000] PCIE_PHY_RX1_CTRL2    0x3000
[    0.270000] PCIE_PHY_RX1_CDR      0x0235
[    0.270000] PCIE_PHY_RX1_EI       0x0004
[    0.270000] PCIE_PHY_RX1_A_CTRL   0x6803
[    0.880000] Lantiq PCIe Root Complex driver, version 2.0.0, (c) 2001-2011 Lantiq Deutschland GmbH
[    0.920000] bio: create slab <bio-0> at 0
[    0.930000] PCI host bridge to bus 0000:00
[    0.930000] pci_bus 0000:00: root bus resource [mem 0x1c000000-0x1cffffff]
[    0.940000] pci_bus 0000:00: root bus resource [io  0x1d800000-0x1d8fffff]
[    0.940000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.950000] pci 0000:00:00.0: [1bef:0011] type 01 class 0x060000
[    0.950000] ifx_pcie_rc_class_early_fixup port 0: fixed pcie host bridge to pci-pci bridge
[    0.960000] pci 0000:00:00.0: PME# supported from D0 D3hot
[    0.960000] pci 0000:01:00.0: [1912:0015] type 00 class 0x0c0330
[    0.960000] pci 0000:01:00.0: reg 10: [mem 0x00000000-0x00001fff 64bit]
[    0.960000] pci 0000:01:00.0: PME# supported from D0 D3hot
[    0.960000] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    0.960000] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[    0.960000] pci 0000:00:00.0: BAR 8: assigned [mem 0x1c000000-0x1c0fffff]
[    0.970000] pci 0000:01:00.0: BAR 0: assigned [mem 0x1c000000-0x1c001fff 64bit]
[    0.980000] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.980000] pci 0000:00:00.0:   bridge window [mem 0x1c000000-0x1c0fffff]
[    0.990000] AVM PA for Linux version 3.10.107 (jpluschke@GU_IQ17p2_NL1_vr9) (gcc version 5.4.0 (Buildroot 2016.05-g4d7c863) ) #1 SMP Tue Sep 11 17:57:02 CEST 2018
                (early init)
[    1.010000] NET: Registered protocol family 8
[    1.010000] NET: Registered protocol family 20
[    1.010000] Switching to clocksource MIPS
[    1.060000] NET: Registered protocol family 2
[    1.070000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[    1.070000] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[    1.080000] TCP: Hash tables configured (established 2048 bind 2048)
[    1.090000] TCP: reno registered
[    1.090000] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    1.090000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    1.100000] avm_pa: try to activate hw accelaration for pid 1 (ipv4) called from avm_pa_dev_pidhandle_register_with_ingress
[    1.110000] NET: Registered protocol family 1
[    1.120000] PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
[    1.120000] pci 0000:01:00.0: xHCI HW not ready after 5 sec (HC bug?) status = 0x801
[    1.130000] PCI: CLS 0 bytes, default 32
[    1.130000] Lantiq CGU driver, version 1.1.32, (c) 2001-2011 Lantiq Deutschland GmbH
[    1.140000] IFX DMA driver, version ifxmips_dma_core.c:v1.0.17, (c) 2009 Infineon Technologies AG
                skb_shared_size:184
[    1.150000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.160000] ANTFS Module: Version 2.34
[    1.160000] fuse init (API version 7.22)
[    1.170000] yaffs: yaffs built Sep 11 2018 17:52:19 Installing.
[    1.170000] msgmni has been set to 473
[    1.170000] io scheduler noop registered (default)
[    1.180000] [avm_membench_init]
[    1.480000] ttyS0 at MMIO 0x1e100c00 (irq = 107) is a PORT_IFX_ASC
[    1.490000] ifx_usif_uart_init: uart_register_driver failed
[    1.490000] avm_net_trace: Up and running.
[    1.500000] [loadcontrol] set auto - scale=1
[    1.500000] [avm] configured: watchdog event debug 
[    1.500000] AVM_WATCHDOG: Watchdog Driver for AR7 Hardware (Version 1.0)
[    1.510000] AVM Simple Profiling enabled Version 3.0
[    1.510000] [simple-profiling]:2 performance counters implemented, NEW_34K
[    1.520000] [simple-profiling]Enable Performance Counter 0 for Data cache load/stores (User Supervisor Kernel Exception TC-ID=0) all cores tc: 0
[    1.530000] [simple-profiling]Enable Performance Counter 1 for Data cache load/store misses (User Supervisor Kernel Exception TC-ID=0) all cores tc: 0
[    1.540000] [simple-profiling]Enable Performance Counter 0 for Data cache load/stores (User Supervisor Kernel Exception TC-ID=1) all cores tc: 1
[    1.560000] [simple-profiling]Enable Performance Counter 1 for Data cache load/store misses (User Supervisor Kernel Exception TC-ID=1) all cores tc: 1
[    1.570000] [simple-profiling]Enable Performance Counter 0 for Main pipeline stalls (P) (User Supervisor Kernel Exception TC-ID=2) all cores tc: 2
[    1.580000] [simple-profiling]Enable Performance Counter 1 for Cycles (P) (User Supervisor Kernel Exception TC-ID=2) all cores tc: 2
[    1.600000] [simple-profiling]Enable Performance Counter 0 for Data cache load/stores (User Supervisor Kernel Exception TC-ID=3) all cores tc: 3
[    1.610000] [simple-profiling]Enable Performance Counter 1 for Data cache load/store misses (User Supervisor Kernel Exception TC-ID=3) all cores tc: 3
[    1.620000] [simple-profiling]all cores:performance-mode (round-robin):  cpus on
[    1.630000] Lantiq Thermal Sensor driver, version 1.0.3, (c) 2001-2011 Lantiq Deutschland GmbH
[    1.640000] ifx_pmu_init: Major 244
[    1.640000] Lantiq PMU driver, version 1.2.6, (c) 2001-2011 Lantiq Deutschland GmbH
[    1.650000] Lantiq GPIO driver, version 1.3.2, (c) 2001-2011 Lantiq Deutschland GmbH
[    1.660000] Infineon Technologies RCU driver version 1.0.7 
[    1.680000] loop: module loaded
[    1.680000] nbd: registered device at major 43
[    1.710000] Generic platform RAM MTD, (c) 2004 Simtec Electronics
[    1.710000] [HSNAND] Hardware-ECC activated
[    1.710000] ONFI param page 0 valid
[    1.710000] ONFI flash detected
[    1.720000] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xdc (Micron MT29F4G08ABADAWP), 512MiB, page size: 2048, OOB size: 64
[    1.730000] Scanning device for bad blocks
[    2.110000] Creating 6 MTD partitions on "ifx_hsnand":
[    2.110000] 0x000000000000-0x000000400000 : "kernel"
[    2.120000] 0x000000400000-0x000003400000 : "filesystem"
[    2.130000] 0x000003400000-0x000003800000 : "reserved-kernel"
[    2.130000] 0x000003800000-0x000006800000 : "reserved-filesystem"
[    2.140000] 0x000006800000-0x000006a00000 : "config"
[    2.150000] 0x000006a00000-0x000020000000 : "nand-filesystem"
[    2.150000] [TFFS3_Register_Panic_CB] registering panic callback for mtd ifx_hsnand
[    2.160000] {ifx_sflash_setbaudrate} VR9 A21 high baudrate support
[    2.160000] SPI Device: MX25P8005 0xC2 (MX) 0x20 0x14
[    2.160000] [TFFS3_Register_Panic_CB] registering panic callback for mtd ifx_sflash
[    2.170000] Creating 3 MTD partitions on "ifx_sflash":
[    2.170000] 0x000000000000-0x000000040000 : "urlader"
[    2.180000] 0x000000040000-0x0000000a0000 : "tffs (1)"
[    2.190000] 0x0000000a0000-0x000000100000 : "tffs (2)"
[    2.200000] Lantiq SPI flash driver, version 2.0.2, (c) 2001-2011 Lantiq Deutschland GmbH
[    2.210000] tun: Universal TUN/TAP device driver, 1.6
[    2.210000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    2.220000] IFX SWITCH API, Version 1.1.8.5
[    2.220000] SWAPI: Registered character device [switch_api] with major no [81]
[    2.220000] Switch API: PCE MicroCode loaded !!
[    2.220000] i2c /dev entries driver
[    2.230000] cpuidle: using governor ladder
[    2.230000] cpuidle: using governor menu
[    2.230000] AVM PA for Linux Linux version 3.10.107 (jpluschke@GU_IQ17p2_NL1_vr9) (gcc version 5.4.0 (Buildroot 2016.05-g4d7c863) ) #1 SMP Tue Sep 11 17:57:02 CEST 2018
                (late init)
[    2.250000] Mirror/redirect action on
[    2.260000] u32 classifier
[    2.260000]     Performance counters on
[    2.260000]     Actions configured
[    2.270000] ipip: IPv4 over IPv4 tunneling driver
[    2.270000] TCP: cubic registered
[    2.270000] NET: Registered protocol family 10
[    2.280000] avm_pa: try to activate hw accelaration for pid 4 (ipv6) called from avm_pa_dev_pidhandle_register_with_ingress
[    2.290000] sit: IPv6 over IPv4 tunneling driver
[    2.300000] NET: Registered protocol family 17
[    2.300000] Bridge broadcast ratelimiter registered
[    2.310000] KOAM is loaded successfully.
[    2.310000] l2tp_core: L2TP core driver, V2.0
[    2.310000] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[    2.310000] l2tp_netlink: L2TP netlink interface
[    2.320000] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[    2.330000] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[    2.330000] 8021q: 802.1Q VLAN Support v1.8
[    2.340000] Key type dns_resolver registered
[    2.340000] <ifx_fix_timing>
[    2.350000] [TFFS3_Init] No storage module registered, trying legacy fallback
[    2.350000] [TFFS3_LGCY_Setup] using mtd7(tffs (1)), mtd8(tffs (2))
[    2.360000] [TFFS3_LGCY_Setup] mtd "tffs (1)": segment value 134
[    2.360000] [TFFS3_LGCY_Setup] mtd "tffs (2)": segment value 133
[    2.370000] [TFFS3_LGCY_Setup] Using segment 134 (avail: 134 + 133)
[    2.380000] [TFFS3_LGCY_Setup] mtd7 size=0x60000
[    2.380000] TFFS: tiny flash file system driver. GPL (c) AVM Berlin (Version 3.0)
[    2.390000] Adam2 environment variables API installed.
[    2.400000] {avmnet_cfg_netinit}
[    2.400000] [avmnet] No config found for HWRev 185, HWSubRev 6, Profile-ID 0, trying base config for HWSubRev
[    2.410000] [avmnet] No config found for HWRev 185, HWSubRev 6, trying base config for HWRev
[    2.420000] [avmnet] [avmnet_swi_7port_init] Init on module swi_vr9 called.
[    2.880000] Loading AVM Net Common Datapath Driver for 7Port Switch...... 
[    2.880000] [ppe_eth_init] init_hw()
[    2.890000] [init_hw] ppe_hw_init=0xff successful
[    2.890000] [ppe_eth_init] ifx_proc_file_create()
[    2.890000] [ppe_eth_init] dma_setup_init()
[    2.900000] [avmnet] [avmnet_swi_7port_disable_learning] Configuring CPU-port to receive all unknown unicast frames 0x48
[    2.910000] [avmnet] [avmnet_swi_7port_disable_learning] Configuring CPU-port to receive all unknown multicast frames 0x48
[    6.360000] avm_pa: try to activate hw accelaration for pid 1 (ipv4) called from avm_pa_register_hardware_pa
[    6.370000] drivers/net/ethernet/avm/avm_cpmac/switch/ifx/common/swi_ifx_common.c:649:ifx_ppa_alloc_virtual_tx_device: alloc virtual tx for pid 1 FAILED 
[    6.380000] avm_pa: can't activate tx channel, pid 1 (ipv4)
[    6.390000] avm_pa: try to activate hw accelaration for pid 4 (ipv6) called from avm_pa_register_hardware_pa
[    6.390000] drivers/net/ethernet/avm/avm_cpmac/switch/ifx/common/swi_ifx_common.c:649:ifx_ppa_alloc_virtual_tx_device: alloc virtual tx for pid 4 FAILED 
[    6.410000] avm_pa: can't activate tx channel, pid 4 (ipv6)
[    6.410000] [set_pce_critical_mac] setting critical mac rule for ba:db:ad:c0:ff:ee, sw-m-port=5
[    6.420000] [avmnet_set_macaddr] Setup Mac Addr for Device(eth0): 38:10:d5:xx:xx:dc 
[    6.430000] [avmnet_set_macaddr] Setup Mac Addr for Device(eth1): 38:10:d5:xx:xx:dc 
[    6.440000] [avmnet_set_macaddr] Setup Mac Addr for Device(eth2): 38:10:d5:xx:xx:dc 
[    6.450000] [avmnet_set_macaddr] Setup Mac Addr for Device(eth3): 38:10:d5:xx:xx:dc 
[    6.460000] [avmnet_set_macaddr] Setup Mac Addr for Device(wasp): 00:de:ad:be:ef:ca 
[    6.470000] [avmnet_create_netdevice] setup offload_cpu_link on device wasp
[    6.500000] SQUASHFS error: Can't find a SQUASHFS superblock on mtdblock1
[    6.510000] [ntfs_boot_sector_is_ntfs] <ERROR> NTFS signature is missing.
[    6.520000] yaffs: dev is 32505857 name is "mtdblock1" ro
[    6.520000] yaffs: passed flags ""
[    6.520000] yaffs: yaffs: Attempting MTD mount of 31.1,"mtdblock1"
[    6.520000] yaffs: auto selecting yaffs2
[    6.550000] yaffs: yaffs_read_super: is_checkpointed 1
[    6.550000] VFS: Mounted root (yaffs filesystem) readonly on device 31:1.
[    6.560000] devtmpfs: mounted
[    6.560000] Freeing unused kernel memory: 288K (808b8000 - 80900000)
[    7.560000] TFFS Name Table N
[    7.720000] yaffs: dev is 32505860 name is "mtdblock4" rw
[    7.720000] yaffs: passed flags ""
[    7.730000] yaffs: yaffs: Attempting MTD mount of 31.4,"mtdblock4"
[    7.740000] yaffs: yaffs_read_super: is_checkpointed 0
[    9.230000] [ifx_hsnand_command] read block is critical (column: 0x0 page: 0x21b5)
[   10.420000] led_modul_Fritz_Box_HW185: module license '
               (C) Copyright 2012 by AVM
               ' taints kernel.
[   10.430000] Disabling lock debugging due to kernel taint
[   10.440000] [module-alloc-by-name] give 0x32000 bytes at 0x81204000 to module 'led_modul_Fritz_Box_HW185' (0x6da000 total bytes left)
[   10.460000] [LED] use GPIO 45 for 'gpio_avm_led_power'
[   10.470000] [LED] use GPIO 47 for 'gpio_avm_led_internet'
[   10.470000] [LED] use GPIO 36 for 'gpio_avm_led_festnetz'
[   10.480000] [LED] use GPIO 35 for 'gpio_avm_led_wlan'
[   10.480000] [LED] use GPIO 33 for 'gpio_avm_led_info'
[   10.490000] [LED] use GPIO 46 for 'gpio_avm_led_info_red'
[   10.490000] [BUTTON] use GPIO 29 for 'gpio_avm_button_wlan'
[   10.500000] [BUTTON] use GPIO 1 for 'gpio_avm_button_dect'
[   10.500000] [avm_connect][state_machine_init] starting event worker thread
[   10.520000] AVM_WATCHDOG: System Init Ueberwachung 240 Sekunden
[   11.810000] [module-alloc-by-name] give 0x2000 bytes at 0x81236000 to module 'rtc_avm' (0x6d8000 total bytes left)
[   11.820000] rtc-avm rtc-avm.0: rtc core: registered avm as rtc0
[   11.830000] [avm-rtc]: avm_rtc_probe: register: ret=0x8f6e5400
[   11.830000] [avm-rtc]: avm_rtc_probe: success
[   12.090000] 
               [avm_debug] redirecting kernel-messages (/dev/debug)
[   12.190000] [module-alloc-by-name] give 0xe000 bytes at 0x81238000 to module 'Piglet_noemif' (0x6ca000 total bytes left)
[   12.200000] [piglet]use settings for 185(7 gpios from hw_config)

[   12.300000] [piglet]patch_dectfw: c084a000, totallen = 50798(c66e)
[   12.300000] [piglet]patch_dectfw: patch_adress: a0 max_len: 26 with Version 2 Len: 17
[   12.300000] [piglet]patch_dectfw: RFPI tag found 02967f2210
[   12.300000] [piglet]dect_loader144xx: slow-bootmode
[   13.130000] [0]system-load 100% loadavg 0.53 0.11 0.4 - 44 tasks:56 % curr:modprobe(2 %)max:init(18 %, pid:1) pgstat: sum=59973 free=54863 slab=1507 alloc=2110/s fault=3896/s (sleep 1)

[   13.560000] ************************

[   15.710000] [piglet]dect144xx_file_process: upload of '/lib/modules/dectfw_secondlevel_441.hex' successfull
[   17.750000] [piglet]bitfile for autodetect '/lib/modules/bitfile_isdn.bit'
[   17.750000] [piglet]try to preload in progress-context: /lib/modules/bitfile_isdn.bit
[   18.360000] [piglet] bitfile 72761 bytes done
[   23.460000] [piglet]use preload[0] /lib/modules/bitfile_pots.bit
[   24.040000] [piglet] bitfile 72761 bytes done
[   24.040000] [piglet]-> POTS-Mode
[   24.140000] [piglet]TDM: FS: 8005 Hz CLK: 2047540 Hz 
[   24.670000] yaffs: dev is 32505861 name is "mtdblock5" rw
[   24.670000] yaffs: passed flags ""
[   24.670000] yaffs: yaffs: Attempting MTD mount of 31.5,"mtdblock5"
[   24.680000] yaffs: yaffs_read_super: is_checkpointed 1
[   25.250000] udevd[1378]: starting version 175
[   25.600000] [module-alloc-by-name] give 0x1000 bytes at 0x81246000 to module 'usb_common' (0x6c9000 total bytes left)
[   25.800000] [module-alloc-by-name] give 0x39000 bytes at 0x81247000 to module 'usbcore' (0x690000 total bytes left)
[   25.820000] usbcore: registered new interface driver usbfs
[   25.820000] usbcore: registered new interface driver hub
[   25.820000] usbcore: registered new device driver usb
[   26.100000] [module-alloc-by-name] give 0x1c000 bytes at 0x81280000 to module 'xhci_hcd' (0x674000 total bytes left)
[   26.110000] xhci_hcd 0000:01:00.0: xHCI Host Controller
[   26.110000] xhci_hcd 0000:01:00.0: new USB bus registered, assigned bus number 1
[   26.180000] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
[   26.180000] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[   26.180000] usb usb1: Product: xHCI Host Controller
[   26.180000] usb usb1: Manufacturer: Linux 3.10.107 xhci_hcd
[   26.180000] usb usb1: SerialNumber: 0000:01:00.0
[   26.180000] xHCI xhci_add_endpoint called for root hub
[   26.180000] xHCI xhci_check_bandwidth called for root hub
[   26.190000] hub 1-0:1.0: USB hub found
[   26.190000] hub 1-0:1.0: 2 ports detected
[   26.190000] avm_net_trace: New net trace device 'usb1' registered with minor 161.
[   26.190000] xhci_hcd 0000:01:00.0: xHCI Host Controller
[   26.190000] xhci_hcd 0000:01:00.0: new USB bus registered, assigned bus number 2
[   26.190000] xHCI: delay VBUS POWER on for 100 ms
[   26.190000] usb usb2: New USB device found, idVendor=1d6b, idProduct=0003
[   26.190000] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[   26.190000] usb usb2: Product: xHCI Host Controller
[   26.190000] usb usb2: Manufacturer: Linux 3.10.107 xhci_hcd
[   26.190000] usb usb2: SerialNumber: 0000:01:00.0
[   26.190000] xHCI xhci_add_endpoint called for root hub
[   26.190000] xHCI xhci_check_bandwidth called for root hub
[   26.190000] avm_net_trace: udev device avm_net_trace161 created
[   26.190000] hub 2-0:1.0: USB hub found
[   26.190000] hub 2-0:1.0: 2 ports detected
[   26.190000] AVM: disable USB3 bus#2 port#0 config=0
[   26.190000] AVM: disable USB3 bus#2 port#1 config=0
[   26.190000] avm_net_trace: New net trace device 'usb2' registered with minor 162.
[   26.200000] avm_net_trace: udev device avm_net_trace162 created
[   26.300000] xHCI: delayed VBUS POWER on
[   26.500000] [0]system-load 6 loadavg 0.99 0.24 0.8 - 60 tasks:25 % curr:led-ctrl(0 %)max:migration/0(18 %, pid:7) pgstat: sum=60125 free=53370 slab=1700 alloc=780/s fault=1807/s (sleep 1)
[   26.700000] [1]system-load 4 loadavg 0.99 0.24 0.8 - 58 tasks:1 % curr:create_handle.s(0 %)max:udevadm(0 %, pid:1427) pgstat: sum=60121 free=53177 slab=1880 alloc=46/s fault=63/s (sleep 2)
[   29.810000] [module-alloc-by-name] give 0x1000 bytes at 0x8129c000 to module 'avm_fiber_if' (0x673000 total bytes left)
[   31.480000] [module-alloc-by-name] give 0x2e000 bytes at 0x8129d000 to module 'mei_vr9' (0x645000 total bytes left)
[   31.490000] [dsl_mei] Lantiq (VRX) DSL CPE MEI driver, version 1.4.4, (c) 2013 Lantiq Deutschland GmbH
[   31.490000] [dsl mei] tried to set GDBG Level to 4
               
[   31.490000] [dsl mei] debug_level=4, Global UsrDbgLevel=4 MEI_DRV UsrDbgLevel=4 MEI_MEI_ACCESS UsrDbgLevel=4
               
[   31.490000] [dsl mei] debug_level=4, Global IntDbgLevel=4 MEI_DRV IntDbgLevel=4 MEI_MEI_ACCESS IntDbgLevel=4
               
[   31.490000] [dsl_vr9] AVM_MEI_PowerUpDSLSubsystem enable power domain 'DSL + DFE'
[   31.490000] [AVM_MEI_PowerUpDSLSubsystem] power up 'PPE TC, PPE EMA, LEDC, DFEV1, DFEV0'
[   31.510000] [dsl_vr9] AVM_MEI_PowerUpDSLSubsystem unreset 'DSL, DFE, AFE, VOICE, DSLTC, ARC'
[   31.510000] spi_clc=0x00000200
[   31.680000] [module-alloc-by-name] give 0x4d000 bytes at 0x812cb000 to module 'dsl_vr9' (0x5f8000 total bytes left)
[   31.700000] [dsl drv] Lantiq CPE API Driver version: DSL CPE API V4.17.6
[   31.700000] [dsl drv] Predefined debug level: 4
[   31.700000] [dsl drv] dynamically registered major number 238 for dsl_vr9
[   31.900000] [module-alloc-by-name] give 0x26000 bytes at 0x81318000 to module 'ifxmips_ppa_datapath_vr9_e5' (0x5d2000 total bytes left)
[   31.910000] Loading E5 (MII0/1) driver ...... 
[   31.920000] drivers/net/ethernet/avm/avm_cpmac/switch/ifx/vr9/ifxmips_ppa_datapath_vr9_e5.c:3076:init_local_variables: [init_local_variables] g_eth_wan_mode=0

[   31.920000] drivers/net/ethernet/avm/avm_cpmac/switch/ifx/vr9/ifxmips_ppa_datapath_vr9_e5.c:3135:init_local_variables: g_wan_itf=0x80, g_wanqos_en=8

[   31.930000] CPU_TO_WAN_TX_DESC_BASE[0] =0xbe227400
[   31.930000] [avmnet] [avmnet_swi_7port_disable_learning] Configuring CPU-port to receive all unknown unicast frames 0x48
[   31.930000] [avmnet] [avmnet_swi_7port_disable_learning] Configuring CPU-port to receive all unknown multicast frames 0x48
[   31.930000] [ppe_e5_init] Succeeded!
[   31.930000] PPE datapath driver info:
                 Version ID: 64.3.3.1.0.1.1
                 Family    : VR9
                 DR Type   : Normal Data Path | Indirect-Fast Path
                 Interface : MII0 | MII1
                 Mode      : Routing
                 Release   : 0.1.1
[   31.930000] PPE firmware info:
                 Version ID: 7.5.2.11.1
                 Family    : VR9
                 FW Package: D5
                 Release   : 2.11.1
               PPE firmware feature:
                 ATM/PTM TC-Layer Bonding        Support
                 L2 Trunking                     Support
                 Packet Acceleration             Support
                 IPv4                            Support
                 IPv6                            Support
                 6RD                             Support
                 DS-Lite                         Support
[   32.630000] [module-alloc-by-name] give 0x7c000 bytes at 0x8133e000 to module 'pcmlink' (0x556000 total bytes left)
[   32.790000] activating IRQ mode
[   32.790000] requesting IRQ
[   32.790000] request_irq 
[   32.790000] usedIrq: 57 | usedIsrHandler: 812acb00 | usedFlags: 0x100 | pUsedDevName: mei_vr9 | pUsedDevId: -1896671424
[   32.790000] IRQ requested ok
[   32.790000] MEI_DRV: MEI_IfxRequestIrq(IRQ = 57, .., ), lock = 1
               ^Mcheck this C
[   32.790000] about to check device status
[   33.170000] [module-alloc-by-name] give 0xfd000 bytes at 0x813ba000 to module 'isdn_fbox_fon5' (0x459000 total bytes left)
[   33.230000] [capi_oslib]avm_stack_attach: cpu1 -> cpu1
[   33.230000] [pcmlink]chrony-support
[   33.250000] [isdn]PCMLINK: (fpga2) Codecslots=13 Slics=2 Pots=1 TE=2 NT=2 DECT=4 (CLARE2)  DSP-EC: 0
[   33.670000] [module-alloc-by-name] give 0x6a000 bytes at 0x814b7000 to module 'capi_codec' (0x3ef000 total bytes left)

I hit the character limit - dmesg output trimmed a bit.
Thats very interesting finding - if the QCA9558 is fully on its own then, how do give it commands to do things? Is there anything similar like that already in openwrt?

Borromini · May 26, 2019, 6:51am

Doesn't the 7362SL have a similar layout - Lantiq SoC with an extra QCA SoC for the wireless?

slh · May 26, 2019, 7:19am

No, the 7362sl is using AR9381 (PCIe, ath9k - well, the proprietary ath_pci in case of the OEM firmware) instead.

Sparks · May 29, 2019, 10:58am

I think there is a separate private network between the main CPU and this 2nd set of chips that handle WiFi . There seems to be 3 processes documented here https://boxmatrix.info/wiki/Property:wland_ctl

Question is, how can I try and catch some of the messages to inspect what it’s doing? I don’t have tcpdump on the device-and I’m not sure of my chances compiling tcpdump manually for the oem kernel ( 3.10.107). Are there any standard Linux commands in kernel that would allow me to mirror the traffic so I can capture it on another machine? Am I right in thinking these chips are running another kernel or do these chips support some hardware level functions to manage WiFi? From the scripts , the 7490 does apparently “fully offload” all WiFi stuff.

Sparks · July 15, 2019, 11:49am

A few more insights were found yesterday. Turns out there is a 2nd uart with console which is connected to the 9558 chip, and rather fascinatingly - its running a fully independent (and newer) kernel which is booted from a ram image. I am still yet to work out how its provided from the host system - it looks to be a similar ftp bootloader style mechanism.

Summary

__________________sri____________________
944x BootROM Ver. (asic) 1.0 [Nov  8 2011 13:42:57]
_________________________________________
find_hif: bootstrap = 0x21e78
GMAC start
ROM>:mdio download ready
Firmware Download length 12
Firmware Exec Address bd003000
Firmware checksum 0xdddbce7d
started receiving bytes 13188
completed receiving bytes
Firmware Download is good 
COMMAND TO START FIRMWARE RECEIVED 
[-]
done
*** Warning *** : PCIe WLAN Module not found !!!
*** Warning *** : PCIe WLAN Module not found !!!
... done
errepc: 0xf9ff5dd7

QCA9558 on 720/600/200MHz
...dropping the frame len 90
.............................................dropping the frame len 90
.........dropping the frame len 90
.........dropping the frame len 90
...............
CRC OK
[    0.000000] Linux version 4.4.60 (jpluschke@GU_IQ17p2_NL1_scrpn7490) (gcc version 5.4.0 (Buildroot 2016.05-g4d7c863) ) #1 PREEMPT Wed Aug 29 18:01:14 CEST 2018
[    0.000000] bootconsole [early0] enabled
[    0.000000] [init_avm_kernel_config] AVM Kernel Config (ptr 8052e000)
[    0.000000] [init_avm_kernel_config] AVM Kernel Config: module memory entry
[    0.000000] [init_avm_kernel_config] AVM Kernel Config: version info entry
[    0.000000] [init_avm_kernel_config] AVM Kernel Config: device-tree for subrev 0 found
[    0.000000] [init_avm_kernel_config] AVM Kernel Config: Urlader environment entry
[    0.000000] plat_device_tree_setup: AVM hardware subrevision 0
[    0.000000] DT @ 8052e8f8: d0 0d fe ed 00 00 19 09
[    0.000000] MIPS: machine is AVM FritzBox 7490 - Target
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] Set Port base
[    0.000000] detect_sys_type
[    0.000000] SoC: Qualcomm Atheros QCA9558 ver 1 rev 0

With this new information, I'm practically back to the drawing board. I'm no longer looking at a pcie compatibility mode, but a system within system running 2 kernels with different targets.

I tried finding this one, but nothing turned up that seemed to match this. I've got what appears to be the kconfig from the oem for compiling the 2nd kernel , plus what /proc/cpuinfo has

Summary

# cat /proc/cpuinfo 
system type             : Qualcomm Atheros QCA9558 ver 1 rev 0
machine                 : AVM FritzBox 7490 - Target
processor               : 0
cpu model               : MIPS 74Kc V5.0
BogoMIPS                : 359.42
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp dsp2
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

but I wouldn't know where to start trying to integrate it as a target for the openwrt build environment. Main kernel is lantiq xrx200 xway vr9 (same as 7362).