IPQ8074A: Add Support for Ubiquiti AmpliFi Alien Router

For Developers
1

Device Info

  • Model: Ubiquiti AmpliFi Alien Router (AFI-ALN-R)
  • SoC: Qualcomm IPQ8074A (ARM Cortex-A53, quad-core @ 2.2 GHz)
  • RAM: 1 GB DDR3
  • Flash: NAND flash-256 MB
  • Wi-Fi: Tri-band Wi-Fi 6 (802.11ax)
  • Current Firmware: Ubiquiti’s custom OpenWrt/LEDE-based firmware
  • Access Level: Full UART access and root shell confirmed
  • UART: 115200 8n1 3v3

Additional U-Boot Info

Captured from UART (after interrupting U-Boot boot sequence using serial console):

  • RAM Size: 1 GB (0x40000000)
  • Bootloader: U-Boot with accessible console
  • UART Baudrate: 115200 bps
  • Relocation Address: 0x4A900000
  • TLB Address: 0x4A990000
  • Default Ethernet Device: eth0
  • Default Ethernet MAC Address: 00:03:7f:ba:db:ad
  • Default IP Address in U-Boot: 192.168.10.10

Access obtained by stopping the normal boot process during early UART output (using a key press when prompted).

What's Included

I've attached a full system dump gathered over UART from the running system (normal mode, not fail-safe). It includes:

  • Bootlog (captured separately)
  • CPU, RAM, and kernel info
  • Full MTD and flash layout
  • Partition mounts and filesystem usage
  • Active network interfaces and MACs
  • Loaded modules and dmesg log
  • Device tree check and board info (as available)

:paperclip: Full system dump (.zip): [Download here] (https://drive.google.com/file/d/1Ll3lGWGWGbYM5mRTYsh8OVa5OJOxdxiw/view?usp=drive_link)

:paperclip: Bootlog (.txt): [Download here]
(https://drive.google.com/file/d/1CpReDxdF1QgpBUdRtHWOvH6_6qaBbTS7/view?usp=drive_link)

:paperclip: Additional infos from the firmware extracted with Binwalk (.bin): [Download here]
https://drive.google.com/drive/folders/1AakD95KbanqsrVuBvXNEOGNFGBr8EBXa?usp=drive_link

:paperclip: FCC ID Photo: https://fccid.io/SWX-AFAR/Internal-Photos/Internal-Photos-4592179.pdf
:paperclip: FCC ID Photo 1: https://fccid.io/SWX-AFAR/Internal-Photos/Internal-Photos-4505639.pdf

Why Support This Device?

The AmpliFi Alien is a powerful and widely available device that already runs a stripped-down OpenWrt base. It uses the well-supported IPQ807x platform, making it a strong candidate for official OpenWrt support.

Note

I’m fairly new to OpenWrt development and reverse-engineering — I created this info dump with the help of ChatGPT. While I’ll try to assist where I can (testing, logs, etc.), please understand that I may not always be able to help with advanced development tasks without guidance.

This device shares the IPQ807x platform with other devices already in development (e.g., TP-Link Deco X80, Xiaomi AX9000), so I believe support is feasible.

Thanks for your time, and happy to hear any thoughts or next steps.

2

Are you able to interrupt U-Boot when this message is shown?

Hit any key to stop autoboot: 2 1 0

2 Likes
3

Yes i am :slight_smile: i get that message after a few seconds when i plug it to power.

4

dmesg Output (full boot)

ubnt@AFi-ALN-R-82482E:/# dmesg | head -n 150
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpuset
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 4.4.60 (jenkins@hive) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 149-0-geeac86ad1d) ) #0 SMP Wed Dec 11 14:42:45 2024
[    0.000000] Boot CPU: AArch64 Processor [410fd034]
[    0.000000] Ignoring memory range 0x40000000 - 0x41000000
[    0.000000] Reserved memory: OVERLAP DETECTED!
[    0.000000] wifi_dump@51000000 (0x0000000051000000--0x0000000051600000) overlaps with wigig_dump@51200000 (0x0000000051200000--0x0000000051600000)
[    0.000000] On node 0 totalpages: 228864
[    0.000000]   DMA zone: 3576 pages used for memmap
[    0.000000]   DMA zone: 0 pages reserved
[    0.000000]   DMA zone: 228864 pages, LIFO batch:31
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] PERCPU: Embedded 14 pages/cpu @ffffffc03ef54000 s18840 r8192 d30312 u57344
[    0.000000] pcpu-alloc: s18840 r8192 d30312 u57344 alloc=14*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 225288
[    0.000000] Kernel command line: console=ttyMSM0,115200 ubi.mtd=ubi  rootfstype=squashfs rootwait swiotlb=1 clk_ignore_unused loglevel=3
[    0.000000] PID hash table entries: 4096 (order: 3, 32768 bytes)
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes)
[    0.000000] software IO TLB [mem 0x7fe0c000-0x7fe4c000] (0MB) mapped at [ffffffc03ee0c000-ffffffc03ee4bfff]
[    0.000000] Memory: 885784K/915456K available (5615K kernel code, 516K rwdata, 3904K rodata, 208K init, 310K bss, 29672K reserved, 0K cma-reserved)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vmalloc : 0xffffff8000000000 - 0xffffffbdbfff0000   (   246 GB)
[    0.000000]     vmemmap : 0xffffffbdc0000000 - 0xffffffbfc0000000   (     8 GB maximum)
[    0.000000]               0xffffffbdc0040000 - 0xffffffbdc1000000   (    15 MB actual)
[    0.000000]     fixed   : 0xffffffbffa7fd000 - 0xffffffbffac00000   (  4108 KB)
[    0.000000]     PCI I/O : 0xffffffbffae00000 - 0xffffffbffbe00000   (    16 MB)
[    0.000000]     modules : 0xffffffbffc000000 - 0xffffffc000000000   (    64 MB)
[    0.000000]     memory  : 0xffffffc000000000 - 0xffffffc03f000000   (  1008 MB)
[    0.000000]       .init : 0xffffffc0009cd000 - 0xffffffc000a01000   (   208 KB)
[    0.000000]       .text : 0xffffffc000080000 - 0xffffffc0009cc534   (  9522 KB)
[    0.000000]       .data : 0xffffffc000a0a000 - 0xffffffc000a8b100   (   517 KB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000]  Build-time adjustment of leaf fanout to 64.
[    0.000000] NR_IRQS:64 nr_irqs:64 0
[    0.000000] Architected cp15 timer(s) running at 19.20MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[    0.000004] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[    0.000417] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=192000)
[    0.000428] pid_max: default: 32768 minimum: 301
[    0.000516] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes)
[    0.000525] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes)
[    0.001014] Initializing cgroup subsys io
[    0.001029] Initializing cgroup subsys memory
[    0.001057] Initializing cgroup subsys pids
[    0.001295] ASID allocator initialised with 65536 entries
[    0.002403] MSM Memory Dump base table set up
[    0.002421] MSM Memory Dump apps data table set up
[    0.002997] Detected VIPT I-cache on CPU1
[    0.003041] CPU1: Booted secondary processor [410fd034]
[    0.003437] Detected VIPT I-cache on CPU2
[    0.003464] CPU2: Booted secondary processor [410fd034]
[    0.003840] Detected VIPT I-cache on CPU3
[    0.003865] CPU3: Booted secondary processor [410fd034]
[    0.003909] Brought up 4 CPUs
[    0.003933] SMP: Total of 4 processors activated.
[    0.003942] CPU: All CPU(s) started at EL1
[    0.020499] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.020525] futex hash table entries: 1024 (order: 5, 131072 bytes)
[    0.020717] pinctrl core: initialized pinctrl subsystem
[    0.021602] NET: Registered protocol family 16
[    0.049846] cpuidle: using governor ladder
[    0.079861] cpuidle: using governor menu
[    0.080012] vdso: 2 pages (1 code @ ffffffc000a11000, 1 data @ ffffffc000a10000)
[    0.080111] DMA: preallocated 256 KiB pool for atomic allocations
[    0.080234] CPU: IPQ8074A, SoC Version: 2.0
[    0.080272] <CORE> glink_init: IPC Logging Disabled
[    0.080603] IPC logging disabled
[    0.080609] IPC logging disabled
[    0.080613] IPC logging disabled
[    0.080617] IPC logging disabled
[    0.080621] IPC logging disabled
[    0.083327] Soc version is not 1, changing clock offsets
[    0.091767] irq: no irq domain found for /soc/smp2p-wcss/slave-kernel !
[    0.093824] irq: no irq domain found for /soc/smp2p-wcss/slave-kernel !
[    0.096867] sps:sps is ready.
[    0.102569] spmi spmi-0: PMIC Arb Version-2 (0x20010000)
[    0.108426] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    0.108679] qcom,cpr3-npu-regulator a4000.npu-cpr: NPU CPR valid fuse count: 2
[    0.140599] ACPI: Interpreter disabled.
[    0.143001] Advanced Linux Sound Architecture Driver Initialized.
[    0.144006] cfg80211: World regulatory domain updated:
[    0.144015] cfg80211:  DFS Master region: unset
[    0.144020] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[    0.144031] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[    0.144040] cfg80211:   (2457000 KHz - 2482000 KHz @ 20000 KHz, 92000 KHz AUTO), (N/A, 2000 mBm), (N/A)
[    0.144049] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[    0.144058] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (N/A)
[    0.144068] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s)
[    0.144077] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[    0.144085] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[    0.144093] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[    0.144114] clocksource: Switched to clocksource arch_sys_counter
[    0.144429] pnp: PnP ACPI: disabled
[    0.147162] NET: Registered protocol family 2
[    0.147599] TCP established hash table entries: 8192 (order: 4, 65536 bytes)
[    0.147685] TCP bind hash table entries: 8192 (order: 5, 131072 bytes)
[    0.147830] TCP: Hash tables configured (established 8192 bind 8192)
[    0.147879] UDP hash table entries: 512 (order: 2, 16384 bytes)
[    0.147914] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes)
[    0.148076] NET: Registered protocol family 1
[    0.148113] PCI: CLS 0 bytes, default 128
[    0.149231] Crashlog allocated RAM at address 0x4a300000
[    0.155370] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.155385] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.158534] io scheduler noop registered
[    0.158546] io scheduler deadline registered (default)
[    0.160755] 20000000.pci supply vdda not found, using dummy regulator
[    0.160804] 20000000.pci supply vdda_phy not found, using dummy regulator
[    0.160839] 20000000.pci supply vdda_refclk not found, using dummy regulator
[    0.161365] PCI host bridge /soc/pci@20000000 ranges:
[    0.161388]    IO 0x20200000..0x2020ffff -> 0x20200000
[    0.161402]   MEM 0x20220000..0x2fffffff -> 0x20220000
[    1.315622] qcom-pcie 20000000.pci: phy link never came up
[    1.317179] qcom-pcie 20000000.pci: hostinit failed
[    1.317189] qcom-pcie 20000000.pci: cannot initialize host
[    1.317329] qcom-pcie: probe of 20000000.pci failed with error -110
[    1.317466] 10000000.pci supply vdda not found, using dummy regulator
[    1.317504] 10000000.pci supply vdda_phy not found, using dummy regulator
[    1.317557] 10000000.pci supply vdda_refclk not found, using dummy regulator
[    1.318018] PCI host bridge /soc/pci@10000000 ranges:
[    1.318038]    IO 0x10200000..0x1020ffff -> 0x10200000
[    1.318050]   MEM 0x10220000..0x1fffffff -> 0x10220000
[    2.465615] qcom-pcie 10000000.pci: phy link never came up
[    2.467169] qcom-pcie 10000000.pci: hostinit failed
[    2.467179] qcom-pcie 10000000.pci: cannot initialize host
[    2.467277] qcom-pcie: probe of 10000000.pci failed with error -110
[    2.472684] NET: Registered protocol family 27
[    2.472697] IPC_RTR: ipc_router_create_log_ctx: IPC Logging disabled
[    2.472711] qmi_log_init: IPC Logging disabled
[    2.472716] qmi_log_init: IPC Logging disabled
[    2.472806] msm_rpm_log_probe: OK
[    2.473758] TZ Log : Will warn on Access Violation, as paniconaccessviolation is not set
[    2.475256] msm_serial 78af000.serial: msm_serial: detected port #2
[    2.475299] msm_serial 78af000.serial: uartclk = 19200000
[    2.475337] 78af000.serial: ttyMSM2 at MMIO 0x78af000 (irq = 77, base_baud = 1200000) is a MSM
[    2.475584] msm_serial 78b3000.serial: msm_serial: detected port #0
[    2.475614] msm_serial 78b3000.serial: uartclk = 3686400
[    2.475645] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 78, base_baud = 230400) is a MSM
[    2.475661] msm_serial: console setup on port #0
[    2.476120] console [ttyMSM0] enabled
[    2.476397] msm_serial 78b1000.serial: msm_serial: detected port #1
ubnt@AFi-ALN-R-82482E:/#

Full dmesg available in my uploaded system dump if needed.

5

do you think you could contact the gpl team and get the gpl sources?
I believe their contact details are requests@ui.com.
they may ask for proof of purchase or serial number, I can rip the dts from your device but it is much better if we can get it from them instead of an extracted one.

Ill have a look an see if i can find your board file and add it to openwrt it will be required to get wifi working.

2 Likes
6

Alright thanks :slightly_smiling_face: let me know :+1:

For the GPL part I’m not sure how I could do that… and I don’t even know if it’s the right email. I’m gonna try opensource-requests@ui.com too. The company which build this device is called AMPLIFI, and I heard that they sometimes ignore GPL requests… I think they are or were the parent company of ubiquiti. I’m gonna wait for more information from you till I do anything :+1:.

Thank you for your time and effort.

7

It looks as if it has a smem partition table and the configuration is Using 'config@1'

You can likely just try to load the tplink-x80-5g initram fs image and it will probably boot as is but best to get the gpl dts so we can greate a proper one and set the drive strengths for the nand controller and all other gpio correctly it is a lot harder to decipher it from a dump thats all as it loses the txt comments when compiled.

The boot log is rather limited compared to my TP-link device.

There is a board file in your binwalk image so that can be submitted upstream.
Can you break into uboot and log it and print envargs and help commands?

1 Like
8

Thanks for the detailed explanation!
I’m sending a request to Ubiquiti’s GPL team now to try to get the official DTS.

If needed, I’m ready to help try booting the tplink-x80-5g initramfs too later — I have full UART access.

Let me know if you want me to prepare anything else for testing! Just so you know I’m an newbie😁

BTW the request to requests@ui.com didn’t work because that email doesn’t exist, so I’ve sent my request to opensource-requests@ui.com instead which seems to work but I’m still a bit unsure.

9

In the below link step 1 is how I loaded my initramfs image the same process will work for you to load a ram based OpenWrt image I believe.

You could try load a smem based initramfs image, I don't think the tplink initramfs will be best as you it looks like you have a spi flash chip going by your bootlog.

You can possibly try one of the spi initramfs images like the zytel armor as you likely have a qca8081 and a qca8075 phy chip, that is very close to your device.

I'd hang off until you hear back about gpl sources and get a proper dts, but I can extract the dts from your image and see if I can hobble something together if they don't reply.

It should be fairly easy to port this device.

[OpenWrt Wiki] TP-Link X80-5G V1

1 Like
10

can you post the output of smeminfo from uboot ?

1 Like
11

I extracted the stock DTS and removed some crap so it would fit here.

Pictures seem to suggest that there is a fan but I did not see it mentioned in the DTS.

/dts-v1/;

/ {
	#address-cells = <0x02>;
	#size-cells = <0x02>;
	qcom,msm-id = <0x143 0x00 0x186 0x00>;
	interrupt-parent = <0x01>;
	qcom,board-id = <0x08 0x00>;
	qcom,pmic-id = <0x00 0x00 0x00 0x00>;
	model = "Ubiquiti AmpliFi Alien Router";
	compatible = "ubiquiti,afi-aln-r\0qcom,ipq807x";

	aliases {
		mhi1 = "/soc/qcom,mhi@1";
		serial0 = "/soc/serial@78B3000";
		serial1 = "/soc/serial@78B1000";
		ethernet0 = "/soc/dp1";
		ethernet1 = "/soc/dp2";
		ethernet2 = "/soc/dp3";
		ethernet3 = "/soc/dp4";
		ethernet4 = "/soc/dp5";
		ethernet5 = "/soc/dp6";
		serial2 = "/soc/serial@78af000";
	};

			spi_0_pins {
				linux,phandle = <0x0a>;
				phandle = <0x0a>;

				mux {
					pins = "gpio38\0gpio39\0gpio40\0gpio41";
					function = "blsp0_spi";
					drive-strength = <0x08>;
					bias-disable;
				};
			};

			qpic_pins {
				linux,phandle = <0x22>;
				phandle = <0x22>;

				data_0 {
					pins = "gpio15";
					function = "qpic_pad0";
					drive-strength = <0x08>;
					bias-disable;
				};

				data_1 {
					pins = "gpio12";
					function = "qpic_pad1";
					drive-strength = <0x08>;
					bias-disable;
				};

				data_2 {
					pins = "gpio13";
					function = "qpic_pad2";
					drive-strength = <0x08>;
					bias-disable;
				};

				data_3 {
					pins = "gpio14";
					function = "qpic_pad3";
					drive-strength = <0x08>;
					bias-disable;
				};

				data_4 {
					pins = "gpio5";
					function = "qpic_pad4";
					drive-strength = <0x08>;
					bias-disable;
				};

				data_5 {
					pins = "gpio6";
					function = "qpic_pad5";
					drive-strength = <0x08>;
					bias-disable;
				};

				data_6 {
					pins = "gpio7";
					function = "qpic_pad6";
					drive-strength = <0x08>;
					bias-disable;
				};

				data_7 {
					pins = "gpio8";
					function = "qpic_pad7";
					drive-strength = <0x08>;
					bias-disable;
				};

				data_8 {
					pins = "gpio16";
					function = "qpic_pad8";
					drive-strength = <0x08>;
					bias-disable;
				};

				qpic_pad {
					pins = "gpio0\0gpio1\0gpio2\0gpio3\0gpio4\0gpio9\0gpio10\0gpio11\0gpio17";
					function = "qpic_pad";
					drive-strength = <0x08>;
					bias-disable;
				};
			};

			ledc_pinmux {

				led_clk {
					pins = "gpio18";
					function = "gpio";
					drive-strength = <0x08>;
					bias-pull-down;
				};

				led_data {
					pins = "gpio19";
					function = "gpio";
					drive-strength = <0x08>;
					bias-pull-down;
				};

				led_clr {
					pins = "gpio20";
					function = "gpio";
					drive-strength = <0x08>;
					bias-pull-up;
				};
			};

			uniphy_pinmux {
				linux,phandle = <0x1b>;
				phandle = <0x1b>;

				mux {
					pins = "gpio60";
					function = "rx2";
					bias-disable;
				};

				sfp_tx {
					pins = "gpio59";
					function = "gpio";
					drive-strength = <0x08>;
					bias-pull-down;
					output-low;
				};
			};

			pwm_pinmux {
				linux,phandle = <0x2d>;
				phandle = <0x2d>;

				mux_1 {
					pins = "gpio25";
					function = "pwm02";
					drive-strength = <0x08>;
				};
			};

		spi@78b5000 {
			compatible = "qcom,spi-qup-v2.2.1";
			#address-cells = <0x01>;
			#size-cells = <0x00>;
			reg = <0x78b5000 0x600>;
			interrupts = <0x00 0x5f 0x00>;
			spi-max-frequency = <0x2faf080>;
			clocks = <0x03 0x56 0x03 0x54>;
			clock-names = "core\0iface";
			dmas = <0x08 0x0c 0x08 0x0d>;
			dma-names = "tx\0rx";
			status = "ok";
			pinctrl-0 = <0x0a>;
			pinctrl-names = "default";

			mx25u6435f@0 {
				#address-cells = <0x01>;
				#size-cells = <0x01>;
				reg = <0x00>;
				compatible = "mx25u6435f\0jedec,spi-nor";
				spi-max-frequency = <0x2faf080>;

				SBL1@0 {
					label = "SBL1";
					reg = <0x00 0x50000>;
					read-only;
				};

				MIBIB@50000 {
					label = "MIBIB";
					reg = <0x50000 0x10000>;
					read-only;
				};

				BOOTCONFIG@60000 {
					label = "BOOTCONFIG";
					reg = <0x60000 0x20000>;
					read-only;
				};

				BOOTCONFIG1@80000 {
					label = "BOOTCONFIG1";
					reg = <0x80000 0x20000>;
					read-only;
				};

				QSEE@a0000 {
					label = "QSEE";
					reg = <0xa0000 0x180000>;
				};

				QSEE_1@220000 {
					label = "QSEE_1";
					reg = <0x220000 0x180000>;
					read-only;
				};

				DEVCFG@3a0000 {
					label = "DEVCFG";
					reg = <0x3a0000 0x10000>;
				};

				DEVCFG_1@3b0000 {
					label = "DEVCFG_1";
					reg = <0x3b0000 0x10000>;
					read-only;
				};

				APDP@3c0000 {
					label = "APDP";
					reg = <0x3c0000 0x10000>;
					read-only;
				};

				APDP_1@3d0000 {
					label = "APDP_1";
					reg = <0x3d0000 0x10000>;
					read-only;
				};

				RPM@3e0000 {
					label = "RPM";
					reg = <0x3e0000 0x40000>;
					read-only;
				};

				RPM_1@420000 {
					label = "RPM_1";
					reg = <0x420000 0x40000>;
					read-only;
				};

				CDT@460000 {
					label = "CDT";
					reg = <0x460000 0x10000>;
					read-only;
				};

				CDT_1@470000 {
					label = "CDT_1";
					reg = <0x470000 0x10000>;
					read-only;
				};

				APPSBLENV@250000 {
					label = "u-boot-env";
					reg = <0x480000 0x10000>;
				};

				APPSBL@490000 {
					label = "u-boot";
					reg = <0x490000 0xa0000>;
				};

				APPSBL_1@530000 {
					label = "u-boot2";
					reg = <0x530000 0xa0000>;
				};

				ART@5d0000 {
					label = "ART";
					reg = <0x5d0000 0x40000>;
					read-only;
				};

				eeprom@610000 {
					label = "eeprom";
					reg = <0x610000 0x10000>;
					linux,phandle = <0x57>;
					phandle = <0x57>;
				};

				reserved@620000 {
					label = "reserved";
					reg = <0x620000 0x70000>;
					read-only;
				};

				prst@690000 {
					label = "prst";
					reg = <0x690000 0x10000>;
				};
			};
		};

		spi@78b8000 {
			compatible = "qcom,spi-qup-v2.2.1";
			#address-cells = <0x01>;
			#size-cells = <0x00>;
			reg = <0x78b8000 0x600>;
			interrupts = <0x00 0x62 0x00>;
			spi-max-frequency = <0x2faf080>;
			clocks = <0x03 0x5c 0x03 0x54>;
			clock-names = "core\0iface";
			dmas = <0x08 0x12 0x08 0x13>;
			dma-names = "tx\0rx";
			status = "disabled";
		};

		qcom,smem@4AB00000 {
			compatible = "qcom,smem";
			memory-region = <0x14>;
			hwlocks = <0x15 0x00>;
		};

		mdio@90000 {
			#address-cells = <0x01>;
			#size-cells = <0x01>;
			compatible = "qcom,ipq40xx-mdio";
			reg = <0x90000 0x64>;
			pinctrl-0 = <0x17>;
			pinctrl-names = "default";
			phy-reset-gpio = <0x18 0x25 0x00 0x18 0x1f 0x01>;

			ethernet-phy@0 {
				reg = <0x00>;
			};

			ethernet-phy@1 {
				reg = <0x01>;
			};

			ethernet-phy@2 {
				reg = <0x02>;
			};

			ethernet-phy@3 {
				reg = <0x03>;
			};

			ethernet-phy@4 {
				reg = <0x04>;
			};

			ethernet-phy@5 {
				reg = <0x1c>;
			};
		};

		qcom_q6v5_wcss@CD00000 {
			compatible = "qcom,ipq8074-wcss-pil";
			reg = <0xcd00000 0x4040 0x4ab000 0x20>;
			reg-names = "qdsp6\0rmb";
			qca,auto-restart;
			qca,extended-intc;
			interrupts-extended = <0x01 0x00 0x145 0x01 0x0d 0x00 0x00 0x0d 0x01 0x00 0x0d 0x02 0x00 0x0d 0x03 0x00>;
			interrupt-names = "wdog\0fatal\0ready\0handover\0stop-ack";
			resets = <0x03 0x59 0x03 0x16 0x03 0x17>;
			reset-names = "wcss_aon_reset\0wcss_reset\0wcss_q6_reset";
			qcom,halt-regs = <0x19 0xa000 0xd000 0x00>;
			qcom,smem-states = <0x0e 0x00 0x0e 0x01>;
			qcom,smem-state-names = "shutdown\0stop";
			memory-region = <0x0b>;
			linux,phandle = <0x2b>;
			phandle = <0x2b>;

			glink-edge {
				interrupts = <0x00 0x141 0x01>;
				qcom,remote-pid = <0x01>;
				mboxes = <0x1a 0x08>;

				rpm_requests {
					qcom,glink-channels = "IPCRTR";
				};
			};
		};

		ess-switch@3a000000 {
			compatible = "qcom,ess-switch-ipq807x";
			reg = <0x3a000000 0x1000000>;
			switch_access_mode = "local bus";
			switch_cpu_bmp = <0x01>;
			switch_inner_bmp = <0x80>;
			clocks = <0x03 0xe3 0x03 0xe4 0x03 0xb1 0x03 0xbc 0x03 0xbd 0x03 0xc0 0x03 0xc1 0x03 0xc4 0x03 0x92 0x03 0x93 0x03 0x94 0x03 0x95 0x03 0x96 0x03 0x97 0x03 0x86 0x03 0x85 0x03 0x8d 0x03 0x8c 0x03 0x75 0x03 0x74 0x03 0x87 0x03 0x84 0x03 0x6d 0x03 0x77 0x03 0xd9 0x03 0x6a 0x03 0x72 0x03 0x76 0x03 0x88 0x03 0x78 0x03 0x79 0x03 0x7a 0x03 0x7b 0x03 0x7c 0x03 0x7d 0x03 0x7e 0x03 0x7f 0x03 0x80 0x03 0x81 0x03 0x82 0x03 0x83 0x03 0xb2 0x03 0xb3 0x03 0xb4 0x03 0xb5 0x03 0xb6 0x03 0xb7 0x03 0xb8 0x03 0xb9 0x03 0xba 0x03 0xbb 0x03 0xbe 0x03 0xbf 0x03 0xc2 0x03 0xc3 0x03 0x0e 0x03 0x0f>;
			clock-names = "cmn_ahb_clk\0cmn_sys_clk\0uniphy0_ahb_clk\0uniphy0_sys_clk\0uniphy1_ahb_clk\0uniphy1_sys_clk\0uniphy2_ahb_clk\0uniphy2_sys_clk\0port1_mac_clk\0port2_mac_clk\0port3_mac_clk\0port4_mac_clk\0port5_mac_clk\0port6_mac_clk\0nss_ppe_clk\0nss_ppe_cfg_clk\0nssnoc_ppe_clk\0nssnoc_ppe_cfg_clk\0nss_edma_clk\0nss_edma_cfg_clk\0nss_ppe_ipe_clk\0nss_ppe_btq_clk\0gcc_mdio_ahb_clk\0gcc_nss_noc_clk\0gcc_nssnoc_snoc_clk\0gcc_mem_noc_nss_axi_clk\0gcc_nss_crypto_clk\0gcc_nss_imem_clk\0gcc_nss_ptp_ref_clk\0nss_port1_rx_clk\0nss_port1_tx_clk\0nss_port2_rx_clk\0nss_port2_tx_clk\0nss_port3_rx_clk\0nss_port3_tx_clk\0nss_port4_rx_clk\0nss_port4_tx_clk\0nss_port5_rx_clk\0nss_port5_tx_clk\0nss_port6_rx_clk\0nss_port6_tx_clk\0uniphy0_port1_rx_clk\0uniphy0_port1_tx_clk\0uniphy0_port2_rx_clk\0uniphy0_port2_tx_clk\0uniphy0_port3_rx_clk\0uniphy0_port3_tx_clk\0uniphy0_port4_rx_clk\0uniphy0_port4_tx_clk\0uniphy0_port5_rx_clk\0uniphy0_port5_tx_clk\0uniphy1_port5_rx_clk\0uniphy1_port5_tx_clk\0uniphy2_port6_rx_clk\0uniphy2_port6_tx_clk\0nss_port5_rx_clk_src\0nss_port5_tx_clk_src";
			resets = <0x03 0x83 0x03 0x84 0x03 0x85 0x03 0x86 0x03 0x87 0x03 0x88 0x03 0x89 0x03 0x8b 0x03 0x8c 0x03 0x8d 0x03 0x8e 0x03 0x8f 0x03 0x90>;
			reset-names = "ppe_rst\0uniphy0_soft_rst\0uniphy0_xpcs_rst\0uniphy1_soft_rst\0uniphy1_xpcs_rst\0uniphy2_soft_rst\0uniphy2_xpcs_rst\0nss_port1_rst\0nss_port2_rst\0nss_port3_rst\0nss_port4_rst\0nss_port5_rst\0nss_port6_rst";
			pinctrl-0 = <0x1b>;
			pinctrl-names = "default";
			switch_lan_bmp = <0x3e>;
			switch_wan_bmp = <0x40>;
			switch_mac_mode = <0x00>;
			switch_mac_mode1 = <0xff>;
			switch_mac_mode2 = <0x0f>;
			bm_tick_mode = <0x00>;
			tm_tick_mode = <0x00>;

			port_scheduler_resource {

				port@0 {
					port_id = <0x00>;
					ucast_queue = <0x00 0x8f>;
					mcast_queue = <0x100 0x10f>;
					l0sp = <0x00 0x23>;
					l0cdrr = <0x00 0x2f>;
					l0edrr = <0x00 0x2f>;
					l1cdrr = <0x00 0x07>;
					l1edrr = <0x00 0x07>;
				};

				port@1 {
					port_id = <0x01>;
					ucast_queue = <0x90 0x9f>;
					mcast_queue = <0x110 0x113>;
					l0sp = <0x24 0x27>;
					l0cdrr = <0x30 0x3f>;
					l0edrr = <0x30 0x3f>;
					l1cdrr = <0x08 0x0b>;
					l1edrr = <0x08 0x0b>;
				};

				port@2 {
					port_id = <0x02>;
					ucast_queue = <0xa0 0xaf>;
					mcast_queue = <0x114 0x117>;
					l0sp = <0x28 0x2b>;
					l0cdrr = <0x40 0x4f>;
					l0edrr = <0x40 0x4f>;
					l1cdrr = <0x0c 0x0f>;
					l1edrr = <0x0c 0x0f>;
				};

				port@3 {
					port_id = <0x03>;
					ucast_queue = <0xb0 0xbf>;
					mcast_queue = <0x118 0x11b>;
					l0sp = <0x2c 0x2f>;
					l0cdrr = <0x50 0x5f>;
					l0edrr = <0x50 0x5f>;
					l1cdrr = <0x10 0x13>;
					l1edrr = <0x10 0x13>;
				};

				port@4 {
					port_id = <0x04>;
					ucast_queue = <0xc0 0xcf>;
					mcast_queue = <0x11c 0x11f>;
					l0sp = <0x30 0x33>;
					l0cdrr = <0x60 0x6f>;
					l0edrr = <0x60 0x6f>;
					l1cdrr = <0x14 0x17>;
					l1edrr = <0x14 0x17>;
				};

				port@5 {
					port_id = <0x05>;
					ucast_queue = <0xd0 0xdf>;
					mcast_queue = <0x120 0x123>;
					l0sp = <0x34 0x37>;
					l0cdrr = <0x70 0x7f>;
					l0edrr = <0x70 0x7f>;
					l1cdrr = <0x18 0x1b>;
					l1edrr = <0x18 0x1b>;
				};

				port@6 {
					port_id = <0x06>;
					ucast_queue = <0xe0 0xef>;
					mcast_queue = <0x124 0x127>;
					l0sp = <0x38 0x3b>;
					l0cdrr = <0x80 0x8f>;
					l0edrr = <0x80 0x8f>;
					l1cdrr = <0x1c 0x1f>;
					l1edrr = <0x1c 0x1f>;
				};

				port@7 {
					port_id = <0x07>;
					ucast_queue = <0xf0 0xff>;
					mcast_queue = <0x128 0x12b>;
					l0sp = <0x3c 0x3f>;
					l0cdrr = <0x90 0x9f>;
					l0edrr = <0x90 0x9f>;
					l1cdrr = <0x20 0x23>;
					l1edrr = <0x20 0x23>;
				};
			};

			port_scheduler_config {

				port@0 {
					port_id = <0x00>;

					l1scheduler {

						group@0 {
							sp = <0x00 0x01>;
							cfg = <0x00 0x00 0x00 0x00>;
						};
					};

					l0scheduler {

						group@0 {
							ucast_queue = <0x00 0x04 0x08>;
							mcast_queue = <0x100 0x104>;
							cfg = <0x00 0x00 0x00 0x00 0x00>;
						};

						group@1 {
							ucast_queue = <0x01 0x05 0x09>;
							mcast_queue = <0x101 0x105>;
							cfg = <0x00 0x01 0x01 0x01 0x01>;
						};

						group@2 {
							ucast_queue = <0x02 0x06 0x0a>;
							mcast_queue = <0x102 0x106>;
							cfg = <0x00 0x02 0x02 0x02 0x02>;
						};

						group@3 {
							ucast_queue = <0x03 0x07 0x0b>;
							mcast_queue = <0x103 0x107>;
							cfg = <0x00 0x03 0x03 0x03 0x03>;
						};
					};
				};

				port@1 {
					port_id = <0x01>;

					l1scheduler {

						group@0 {
							sp = <0x24>;
							cfg = <0x00 0x08 0x00 0x08>;
						};

						group@1 {
							sp = <0x25>;
							cfg = <0x01 0x09 0x01 0x09>;
						};
					};

					l0scheduler {

						group@0 {
							ucast_queue = <0x90>;
							ucast_loop_pri = <0x10>;
							mcast_queue = <0x110>;
							mcast_loop_pri = <0x04>;
							cfg = <0x24 0x00 0x30 0x00 0x30>;
						};
					};
				};

				port@2 {
					port_id = <0x02>;

					l1scheduler {

						group@0 {
							sp = <0x28>;
							cfg = <0x00 0x0c 0x00 0x0c>;
						};

						group@1 {
							sp = <0x29>;
							cfg = <0x01 0x0d 0x01 0x0d>;
						};
					};

					l0scheduler {

						group@0 {
							ucast_queue = <0xa0>;
							ucast_loop_pri = <0x10>;
							mcast_queue = <0x114>;
							mcast_loop_pri = <0x04>;
							cfg = <0x28 0x00 0x40 0x00 0x40>;
						};
					};
				};

				port@3 {
					port_id = <0x03>;

					l1scheduler {

						group@0 {
							sp = <0x2c>;
							cfg = <0x00 0x10 0x00 0x10>;
						};

						group@1 {
							sp = <0x2d>;
							cfg = <0x01 0x11 0x01 0x11>;
						};
					};

					l0scheduler {

						group@0 {
							ucast_queue = <0xb0>;
							ucast_loop_pri = <0x10>;
							mcast_queue = <0x118>;
							mcast_loop_pri = <0x04>;
							cfg = <0x2c 0x00 0x50 0x00 0x50>;
						};
					};
				};

				port@4 {
					port_id = <0x04>;

					l1scheduler {

						group@0 {
							sp = <0x30>;
							cfg = <0x00 0x14 0x00 0x14>;
						};

						group@1 {
							sp = <0x31>;
							cfg = <0x01 0x15 0x01 0x15>;
						};
					};

					l0scheduler {

						group@0 {
							ucast_queue = <0xc0>;
							ucast_loop_pri = <0x10>;
							mcast_queue = <0x11c>;
							mcast_loop_pri = <0x04>;
							cfg = <0x30 0x00 0x60 0x00 0x60>;
						};
					};
				};

				port@5 {
					port_id = <0x05>;

					l1scheduler {

						group@0 {
							sp = <0x34>;
							cfg = <0x00 0x18 0x00 0x18>;
						};

						group@1 {
							sp = <0x35>;
							cfg = <0x01 0x19 0x01 0x19>;
						};
					};

					l0scheduler {

						group@0 {
							ucast_queue = <0xd0>;
							ucast_loop_pri = <0x10>;
							mcast_queue = <0x120>;
							mcast_loop_pri = <0x04>;
							cfg = <0x34 0x00 0x70 0x00 0x70>;
						};
					};
				};

				port@6 {
					port_id = <0x06>;

					l1scheduler {

						group@0 {
							sp = <0x38>;
							cfg = <0x00 0x1c 0x00 0x1c>;
						};

						group@1 {
							sp = <0x39>;
							cfg = <0x01 0x1d 0x01 0x1d>;
						};
					};

					l0scheduler {

						group@0 {
							ucast_queue = <0xe0>;
							ucast_loop_pri = <0x10>;
							mcast_queue = <0x124>;
							mcast_loop_pri = <0x04>;
							cfg = <0x38 0x00 0x80 0x00 0x80>;
						};
					};
				};

				port@7 {
					port_id = <0x07>;

					l1scheduler {

						group@0 {
							sp = <0x3c>;
							cfg = <0x00 0x20 0x00 0x20>;
						};
					};

					l0scheduler {

						group@0 {
							ucast_queue = <0xf0>;
							mcast_queue = <0x128>;
							cfg = <0x3c 0x00 0x90 0x00 0x90>;
						};
					};
				};
			};
		};

		ess-uniphy@7a00000 {
			compatible = "qcom,ess-uniphy";
			reg = <0x7a00000 0x30000>;
			uniphy_access_mode = "local bus";
		};

		edma@3ab00000 {
			compatible = "qcom,edma";
			reg = <0x3ab00000 0x76900>;
			reg-names = "edma-reg-base";
			qcom,txdesc-ring-start = <0x17>;
			qcom,txdesc-rings = <0x01>;
			qcom,txcmpl-ring-start = <0x07>;
			qcom,txcmpl-rings = <0x01>;
			qcom,rxfill-ring-start = <0x07>;
			qcom,rxfill-rings = <0x01>;
			qcom,rxdesc-ring-start = <0x0f>;
			qcom,rxdesc-rings = <0x01>;
			interrupts = <0x00 0x159 0x04 0x00 0x161 0x04 0x00 0x169 0x04 0x00 0x158 0x04>;
			resets = <0x03 0x8a>;
			reset-names = "edma_rst";
		};

		qpic-nand@79b0000 {
			compatible = "qcom,ebi2-nandc-bam-v1.5.0";
			reg = <0x79b0000 0x10000>;
			#address-cells = <0x01>;
			#size-cells = <0x00>;
			clocks = <0x03 0xac 0x03 0xab>;
			clock-names = "core\0aon";
			dmas = <0x21 0x00 0x21 0x01 0x21 0x02>;
			dma-names = "tx\0rx\0cmd";
			status = "okay";
			pinctrl-0 = <0x22>;
			pinctrl-names = "default";

			nandcs@0 {
				compatible = "qcom,nandcs";
				reg = <0x00>;
				#address-cells = <0x01>;
				#size-cells = <0x01>;
				nand-ecc-strength = <0x04>;
				nand-ecc-step-size = <0x200>;
				nand-bus-width = <0x08>;

				partitions {
					compatible = "fixed-partitions";
					#address-cells = <0x01>;
					#size-cells = <0x01>;

					ubi@0 {
						label = "ubi";
						reg = <0x00 0x7800000>;
					};
				};
			};
		};

		gpio-keys {
			compatible = "gpio-keys";

			reset {
				label = "reset";
				linux,code = <0x198>;
				gpios = <0x18 0x3d 0x01>;
			};
		};

		dp1 {
			device_type = "network";
			compatible = "qcom,nss-dp";
			qcom,id = <0x01>;
			reg = <0x3a001000 0x200>;
			qcom,mactype = <0x00>;
			mtd-mac-address = <0x57 0x00>;
			mtd-mac-address-increment = <0x04>;
			qcom,link-poll = <0x01>;
			qcom,phy-mdio-addr = <0x00>;
			phy-mode = "sgmii";
		};

		dp2 {
			device_type = "network";
			compatible = "qcom,nss-dp";
			qcom,id = <0x02>;
			reg = <0x3a001200 0x200>;
			qcom,mactype = <0x00>;
			mtd-mac-address = <0x57 0x00>;
			mtd-mac-address-increment = <0x03>;
			qcom,link-poll = <0x01>;
			qcom,phy-mdio-addr = <0x01>;
			phy-mode = "sgmii";
		};

		dp3 {
			device_type = "network";
			compatible = "qcom,nss-dp";
			qcom,id = <0x03>;
			reg = <0x3a001400 0x200>;
			qcom,mactype = <0x00>;
			mtd-mac-address = <0x57 0x00>;
			mtd-mac-address-increment = <0x02>;
			qcom,link-poll = <0x01>;
			qcom,phy-mdio-addr = <0x02>;
			phy-mode = "sgmii";
		};

		dp4 {
			device_type = "network";
			compatible = "qcom,nss-dp";
			qcom,id = <0x04>;
			reg = <0x3a001600 0x200>;
			qcom,mactype = <0x00>;
			mtd-mac-address = <0x57 0x00>;
			mtd-mac-address-increment = <0x01>;
			qcom,link-poll = <0x01>;
			qcom,phy-mdio-addr = <0x03>;
			phy-mode = "sgmii";
		};

		dp5 {
			device_type = "network";
			compatible = "qcom,nss-dp";
			qcom,id = <0x05>;
			reg = <0x3a001800 0x200>;
			qcom,mactype = <0x00>;
			mtd-mac-address = <0x57 0x00>;
			mtd-mac-address-increment = <0x00>;
			qcom,link-poll = <0x01>;
			qcom,phy-mdio-addr = <0x04>;
			phy-mode = "sgmii";
		};

		dp6 {
			device_type = "network";
			compatible = "qcom,nss-dp";
			qcom,id = <0x06>;
			reg = <0x3a001a00 0x200>;
			qcom,mactype = <0x01>;
			mtd-mac-address = <0x57 0x00>;
			mtd-mac-address-increment = <0x00>;
			qcom,link-poll = <0x01>;
			qcom,phy-mdio-addr = <0x1c>;
			phy-mode = "sgmii";
		};
	};

	memory {
		device_type = "memory";
		reg = <0x00 0x40000000 0x00 0x20000000>;
	};

	reserved-memory {
		#address-cells = <0x02>;
		#size-cells = <0x02>;
		ranges;

		nss@40000000 {
			no-map;
			reg = <0x00 0x40000000 0x00 0x1000000>;
		};

		uboot@4a600000 {
			no-map;
			reg = <0x00 0x4a600000 0x00 0x400000>;
		};

		sbl@4aa00000 {
			no-map;
			reg = <0x00 0x4aa00000 0x00 0x100000>;
		};

		smem@4ab00000 {
			no-map;
			reg = <0x00 0x4ab00000 0x00 0x100000>;
			linux,phandle = <0x14>;
			phandle = <0x14>;
		};

		tz@4ac00000 {
			no-map;
			reg = <0x00 0x4ac00000 0x00 0x400000>;
		};

		wcnss@4b000000 {
			no-map;
			reg = <0x00 0x4b000000 0x00 0x5f00000>;
			linux,phandle = <0x0b>;
			phandle = <0x0b>;
		};

		tzapp@4a400000 {
			no-map;
			reg = <0x00 0x4a400000 0x00 0x200000>;
		};

		q6_etr_dump@50f00000 {
			no-map;
			reg = <0x00 0x50f00000 0x00 0x100000>;
			linux,phandle = <0x0c>;
			phandle = <0x0c>;
		};

		wifi_dump@51000000 {
			no-map;
			reg = <0x00 0x51000000 0x00 0x600000>;
		};

		wigig_dump@51200000 {
			no-map;
			reg = <0x00 0x51200000 0x00 0x400000>;
		};
	};

	firmware {

		scm {
			compatible = "qcom,scm-ipq807x";
		};

		qfprom {
			compatible = "qcom,qfprom-sec";
			img-addr = "J@\0";
			img-size = <0x700000>;
		};
	};

	qseecom {
		compatible = "ipq807x-qseecom";
		mem-start = "J@\0";
		mem-size = <0x200000>;
	};

	clocks {

		sleep_clk {
			compatible = "fixed-clock";
			clock-frequency = <0x7d00>;
			#clock-cells = <0x00>;
			linux,phandle = <0x1e>;
			phandle = <0x1e>;
		};

		xo {
			compatible = "fixed-clock";
			clock-frequency = <0x124f800>;
			#clock-cells = <0x00>;
		};

		bias_pll_cc_clk {
			compatible = "fixed-clock";
			clock-frequency = <0x11e1a300>;
			#clock-cells = <0x00>;
		};

		bias_pll_nss_noc_clk {
			compatible = "fixed-clock";
			clock-frequency = <0x18d34920>;
			#clock-cells = <0x00>;
		};

		pcie20_phy1_pipe_clk {
			compatible = "fixed-clock";
			clock-frequency = <0x7735940>;
			#clock-cells = <0x00>;
		};

		usb3phy_0_cc_pipe_clk {
			compatible = "fixed-clock";
			clock-frequency = <0x7735940>;
			#clock-cells = <0x00>;
		};

		usb3phy_1_cc_pipe_clk {
			compatible = "fixed-clock";
			clock-frequency = <0x7735940>;
			#clock-cells = <0x00>;
		};
	};

	fixed-regulator@0 {
		compatible = "regulator-fixed";
		regulator-name = "e-smps1-reg";
		regulator-min-microvolt = <0x325aa0>;
		regulator-max-microvolt = <0x325aa0>;
		regulator-always-on;
		regulator-boot-on;
		linux,phandle = <0x2c>;
		phandle = <0x2c>;
	};

	chosen {
		bootargs = "console=ttyMSM0,115200,n8";
		bootargs-append = " swiotlb=1 clk_ignore_unused loglevel=3";
	};
};
1 Like
12

Sure here you go:

smeminfo Output

IPQ807x# is_sec_boot_enabled
secure boot fuse is not enabled
IPQ807x# smeminfo
flash_type:             0x6
flash_index:            0x0
flash_chip_select:      0x0
flash_block_size:       0x10000
flash_density:          0x1000000
partition table offset  0x0
No.: Name             Attributes            Start             Size
  0: 0:SBL1           0x0000ffff  00          0x10000
  8: 0:APDP           0x0000ffff         0x3c0000          0x10000
  9: 0:APDP_1         0x0000ffff         0x3d0000          0x10000
 10: 0:RPM            0x0000ffff         0x3e0000          0x40000
 11: 0:RPM_1          0x0000ffff         0x420000          0x40000
 12: 0:CDT            0x0000ffff         0x460000          0x10000
 13: 0:CDT_1          0x0000ffff         0x470000          0x10000
 14: 0:APPSBLENV      0x0000ffff         0x480000          0x10000
 15: 0:APPSBL         0x0000ffff         0x490000          0xa0000
 16: 0:APPSBL_1       0x0000ffff         0x530000          0xa0000
 17: 0:ART            0x0000ffff         0x5d0000          0x40000
 18: 0:eeprom         0x0000ffff         0x610000          0x10000
 19: 0:reserved       0x0000ffff         0x620000          0x70000
 20: 0:prst           0x0000ffff         0x690000          0x10000
 21: rootfs           0x0100ffff              0x0        0x7800000
 22: 0:WIFIFW         0x0100ffff        0x7800000         0x800000
 23: rootfs_1         0x0100ffff        0x8000000        0x3400000
 24: 0:WIFIFW_1       0x0100ffff        0xb400000         0x800000
IPQ807x#


Thanks so much for extracting and cleaning up the DTS — I really appreciate it!

From what I understand so far:

The DTS looks great overall — RAM, SPI flash, Ethernet PHYs, and Wi-Fi radios are all mapped correctly.

There's no fan node in the DTS. It’s likely hardware-controlled via an LM63 sensor and hwmon (I can hear it spin up sometimes).

Partition details still need to be confirmed (I'll post smeminfo shortly).

I'm ready to help with testing whenever you're ready.
Still waiting to hear back regarding the GPL sources too, but this progress already looks very promising!

Also, I'm standing by if you want me to try booting a test initramfs image!

Just to clarify:
The UART access and OpenWrt porting work are for my main AmpliFi Alien router (AFI-ALN-R) — the model with 5 Ethernet ports (4 LAN + 1 WAN).
The Alien MeshPoint has fewer Ethernet ports and might use a QCA8072 PHY, but that’s not the main focus right now.
It’s very likely the main router uses a QCA8075, since it has 4x 1 Gigabit LAN ports and 1x 1 Gigabit WAN port. let me know if i schould open it even more to double check which phy chip is used :)

Thanks again for all your help — I’m really excited about this!
13

and yes like i already told it has an internal cooling fan, the main router even has an LCM screen which sits on its own board and SoC and i think it has an USB debug port :slight_smile: it is talking with the mainboard.

and it has an green LED ring in the base as well, and an speaker too for boot chime :+1:.

14

U-Boot Environment Variables (printenv)

IPQ807x# printenv
baudrate=115200
bootargs=console=ttyMSM0,115200 ubi.mtd=ubi  rootfstype=squashfs rootwait
bootcmd=ubi part fs && ubi read 0x44000000 kernel && bootm
bootdelay=2
ethact=eth0
ethaddr=00:03:7f:ba:db:ad
fdt_high=0x4A400000
fdtcontroladdr=4a96c8f0
flash_type=7
ipaddr=192.168.10.10
machid=8010000
mtdids=nand0=nand0
mtdparts=mtdparts=nand0:0x10000000@0x0(fs)
netmask=255.255.255.0
serverip=192.168.10.1
soc_hw_version=200d0200
soc_version_major=2
soc_version_minor=0
stderr=serial@78B3000
stdin=serial@78B3000
stdout=serial@78B3000

Environment size: 570/65532 bytes

U-Boot Available Commands (help)

IPQ807x# help
?       - alias for 'help'
aes_256 - AES 256 CBC/ECB encryption/decryption
aq_load_fw- LOAD aq-fw-binary
aq_phy_restart- Restart Aquantia phy
base    - print or set address offset
bdinfo  - print Board Info structure
bootipq - bootipq from flash device
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
bootz   - boot Linux zImage image from memory
canary  - test stack canary
chpart  - change active partition
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dcache  - enable or disable data cache
dhcp    - boot image via network using DHCP/TFTP protocol
dm      - Driver model low level access
echo    - echo args to console
env     - environment handling commands
erase   - erase FLASH memory
exectzt - execute TZT

exit    - exit script
false   - do nothing, unsuccessfully
fdt     - flattened device tree utility commands
flash   - flash part_name
        flash part_name load_addr file_size

flasherase- flerase part_name

flinfo  - print FLASH memory information
fuseipq - fuse QFPROM registers from memory

go      - start application at address 'addr'
help    - print command description/usage
icache  - enable or disable instruction cache
imxtract- extract a part of a multi-image
ipq_mdio- IPQ mdio utility commands
is_sec_boot_enabled- check secure boot fuse is enabled or not

itest   - return true/false on integer compare
loop    - infinite loop on address range
md      - memory display
meminfo - display memory information
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
runmulticore- Enable and schedule secondary cores
saveenv - save environment variables to persistent storage
secure_authenticate- authenticate the signed image

setenv  - set environment variables
sf      - SPI flash sub-system
showvar - print local hushshell variables
sleep   - delay execution for some time
smeminfo- print SMEM FLASH information
source  - run script from memory
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
tftpput - TFTP put command, for uploading files to a server
true    - do nothing, successfully
uart    - UART sub-system
ubi     - ubi commands
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version
IPQ807x# <INTERRUPT>
IPQ807x# <INTERRUPT>
IPQ807x#
15

I checked the dmesg logs, and I can confirm that the system successfully probes the Qualcomm Malibu PHY driver.
It looks like QCA807x / QCA808x PHYs are active inside the Alien, which matches your assumptions.

let me know if you want me to run anything else. :grinning_face:

16

What should I try?

17

You should be able to run the initramfs from the zytel armor using the method explained above in my wiki post as it uses the same phy chips and is smem also.

The load address should be the same except your IP address is 192.168.10.10 so you will need to make your tftp server in that range say 192.168.10.1 from your pc or manually set the envargs in the range of your pc.

I have yet to run your board file through the toolkit and put on the headder and put a pull request on the qca firmware repo for your new target.

I found one of the devices at a local store, but it is very expensive I'm sort of interested in the touch screen to play with.

can you look in sysfs to see if there is gpio listed for the fan? I'm guessing it is pwm controlled I saw that listed in the dts.

I will create a small pr and create a new target when i get some free time.

1 Like
18

I found that there is an hwmon0 device active, and it seems to be an LM63 chip based on the structure.

This would explain the fan behavior — it's probably controlled via the lm63 sensor through hwmon sysfs.

I'll explore it more and let you know the exact files available.

Update: Fan Controller and Temperature Sensor Found

I explored the sysfs paths you suggested.

  • /sys/class/hwmon/hwmon0/ exists :white_check_mark:
  • /sys/class/hwmon/hwmon0/name says lm63 :white_check_mark:

So the device has an LM63 hardware temperature sensor and fan controller onboard, detected by Linux and exposed through the hwmon subsystem.

Later, in OpenWrt, fan speed and temperature can likely be monitored and controlled through standard lm63 driver support.

This explains the automatic fan behavior seen in the OEM firmware — the fan is managed by the LM63 controller, not directly by simple GPIOs or PWM devices.

i could set the fan speed with the command echo 50 > /sys/class/hwmon/hwmon0/pwm1 for example.

Thanks again for all the help!
Now preparing the TFTP setup to try booting the Zyxel G5 initramfs image into RAM soon!

19

it seems like it kinda worked:


[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.137 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23630-842932a63d) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Tue Nov 14 13:38:11 2023
[    0.000000] Machine model: Zyxel NBG7815
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000040ffffff]
[    0.000000]   node   0: [mem 0x0000000041000000-0x000000004a3fffff]
[    0.000000]   node   0: [mem 0x000000004a400000-0x00000000510fffff]
[    0.000000]   node   0: [mem 0x0000000051100000-0x000000007fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] psci: OSI mode supported.
[    0.000000] percpu: Embedded 17 pages/cpu s30808 r8192 d30632 u69632
[    0.000000] pcpu-alloc: s30808 r8192 d30632 u69632 alloc=17*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 258048
[    0.000000] Kernel command line: console=ttyMSM0,115200 ubi.mtd=ubi  rootfstype=squashfs rootwait
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 880832K/1048576K available (7808K kernel code, 860K rwdata, 1400K rodata, 8896K init, 289K bss, 167744K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: 0xffffffc00837cdb0
[    0.000000] GICv2m: range[mem 0x0b00a000-0x0b00affc], SPI[448:479]
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[    0.000001] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[    0.000112] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=192000)
[    0.000129] pid_max: default: 32768 minimum: 301
[    0.000602] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.000620] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.002608] rcu: Hierarchical SRCU implementation.
[    0.003381] smp: Bringing up secondary CPUs ...
[    0.004014] Detected VIPT I-cache on CPU1
[    0.004081] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.004712] Detected VIPT I-cache on CPU2
[    0.004753] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.005367] Detected VIPT I-cache on CPU3
[    0.005404] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.005470] smp: Brought up 1 node, 4 CPUs
[    0.005498] SMP: Total of 4 processors activated.
[    0.005505] CPU features: detected: 32-bit EL0 Support
[    0.005513] CPU features: detected: CRC32 instructions
[    0.005566] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.005575] CPU: All CPU(s) started at EL1
[    0.005597] alternatives: patching kernel code
[    0.015560] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.015596] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.015829] pinctrl core: initialized pinctrl subsystem
[    0.017274] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.017789] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.017832] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.017869] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.018255] thermal_sys: Registered thermal governor 'step_wise'
[    0.019946] cpuidle: using governor menu
[    0.020187] ASID allocator initialised with 65536 entries
[    0.076162] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    0.085621] SCSI subsystem initialized
[    0.085831] usbcore: registered new interface driver usbfs
[    0.085897] usbcore: registered new interface driver hub
[    0.085948] usbcore: registered new device driver usb
[    0.086172] CPUidle PSCI: failed to enable OSI mode: -95
[    0.086481] qcom_scm: convention: smc arm 64
[    0.088059] clocksource: Switched to clocksource arch_sys_counter
[    0.089081] NET: Registered PF_INET protocol family
[    0.089213] IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.090263] tcp_listen_portaddr_hash hash table entries: 512 (order: 1, 8192 bytes, linear)
[    0.090294] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.090311] TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.090398] TCP bind hash table entries: 8192 (order: 5, 131072 bytes, linear)
[    0.090547] TCP: Hash tables configured (established 8192 bind 8192)
[    0.090657] UDP hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.090698] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.090898] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.090933] PCI: CLS 0 bytes, default 64
[    0.092073] workingset: timestamp_bits=46 max_order=18 bucket_order=0
[    0.096814] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.096837] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.098125] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 248)
[    0.102128] qcom-qmp-phy 58000.phy: supply vdda-phy not found, using dummy regulator
[    0.102321] qcom-qmp-phy 58000.phy: supply vdda-pll not found, using dummy regulator
[    0.103397] qcom-qmp-phy 58000.phy: Registered Qcom-QMP phy
[    0.103698] qcom-qmp-phy 78000.phy: supply vdda-phy not found, using dummy regulator
[    0.103887] qcom-qmp-phy 78000.phy: supply vdda-pll not found, using dummy regulator
[    0.104923] qcom-qmp-phy 78000.phy: Registered Qcom-QMP phy
[    0.105978] qcom-qusb2-phy 59000.phy: supply vdda-pll not found, using dummy regulator
[    0.106157] qcom-qusb2-phy 59000.phy: supply vdda-phy-dpdm not found, using dummy regulator
[    0.106313] qcom-qusb2-phy 59000.phy: Registered Qcom-QUSB2 phy
[    0.106514] qcom-qusb2-phy 79000.phy: supply vdda-pll not found, using dummy regulator
[    0.106619] qcom-qusb2-phy 79000.phy: supply vdda-phy-dpdm not found, using dummy regulator
[    0.106806] qcom-qusb2-phy 79000.phy: Registered Qcom-QUSB2 phy
[    0.111543] bam-dma-engine 704000.dma-controller: num-channels unspecified in dt
[    0.111573] bam-dma-engine 704000.dma-controller: num-ees unspecified in dt
[    0.115689] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.117705] msm_serial 78b1000.serial: msm_serial: detected port #1
[    0.117756] msm_serial 78b1000.serial: uartclk = 19200000
[    0.117811] 78b1000.serial: ttyMSM1 at MMIO 0x78b1000 (irq = 24, base_baud = 1200000) is a MSM
[    0.118313] msm_serial 78b3000.serial: msm_serial: detected port #0
[    0.118353] msm_serial 78b3000.serial: uartclk = 3686400
[    0.118402] 78b3000.serial: ttyMS[  488.968179] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
M0 at MMIO 0x78b3000 (irq = 25, base_baud = 230400) is a MSM
[    0.118430] msm_serial: console setup on port #0
[    0.817903] printk: console [ttyMSM0] enabled
[    0.823078] msm_serial: driver initialized
[    0.831395] loop: module loaded
[    0.831467] Loading iSCSI transport class v2.0-870.
[    0.835534] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    0.839763] spi-nor spi0.0: mx25u6435f (8192 Kbytes)
[    0.854014] 22 fixed-partitions partitions found on MTD device spi0.0
[    0.854869] Creating 22 MTD partitions on "spi0.0":
[    0.859485] 0x000000000000-0x000000050000 : "0:sbl1"
[    0.864781] 0x000000050000-0x000000060000 : "0:mibib"
[    0.869967] 0x000000060000-0x000000080000 : "0:bootconfig"
[    0.874705] 0x000000080000-0x0000000a0000 : "0:bootconfig1"
[    0.880136] 0x0000000a0000-0x000000220000 : "0:qsee"
[    0.885537] 0x000000220000-0x0000003a0000 : "0:qsee_1"
[    0.890778] 0x0000003a0000-0x0000003b0000 : "0:devcfg"
[    0.895731] 0x0000003b0000-0x0000003c0000 : "0:devcfg_1"
[    0.900855] 0x0000003c0000-0x0000003d0000 : "0:apdp"
[    0.906355] 0x0000003d0000-0x0000003e0000 : "0:apdp_1"
[    0.911293] 0x0000003e0000-0x000000420000 : "0:rpm"
[    0.916177] 0x000000420000-0x000000460000 : "0:rpm_1"
[    0.921002] 0x000000460000-0x000000470000 : "0:cdt"
[    0.926175] 0x000000470000-0x000000480000 : "0:cdt_1"
[    0.930860] 0x000000480000-0x000000540000 : "0:appsbl"
[    0.936099] 0x000000540000-0x000000600000 : "0:appsbl_1"
[    0.941172] 0x000000600000-0x000000610000 : "0:appsblenv"
[    0.946486] 0x000000610000-0x000000650000 : "0:art"
[    0.951970] 0x000000650000-0x0000006d0000 : "0:ethphyfw"
[    0.956534] 0x0000006d0000-0x0000006e0000 : "0:crt"
[    0.962158] 0x0000006e0000-0x0000006f0000 : "dual_flag"
[    0.966702] 0x0000006f0000-0x000000800000 : "reserved"
[    0.979742] spmi spmi-0: PMIC arbiter version v2 (0x20010000)
[    0.982992] s1: supplied by regulator-dummy
[    0.984697] s2: supplied by regulator-dummy
[    0.988661] vdd_s3: supplied by regulator-dummy
[    0.992930] vdd_s4: supplied by regulator-dummy
[    0.997480] s5: supplied by regulator-dummy
[    1.001863] l1: supplied by regulator-dummy
[    1.006028] l2: supplied by regulator-dummy
[    1.010192] l3: supplied by regulator-dummy
[    1.014317] l4: supplied by regulator-dummy
[    1.018564] l5: supplied by regulator-dummy
[    1.022664] l6: supplied by regulator-dummy
[    1.026831] l7: supplied by regulator-dummy
[    1.031041] l8: supplied by regulator-dummy
[    1.035193] l9: supplied by regulator-dummy
[    1.039453] l11: supplied by regulator-dummy
[    1.043527] l12: supplied by regulator-dummy
[    1.047998] l13: supplied by regulator-dummy
[    1.105461] mdio_bus 90000.mdio-1: MDIO device at address 8 is missing.
[    1.106080] i2c_dev: i2c /dev entries driver
[    1.116543] sdhci: Secure Digital Host Controller Interface driver
[    1.116589] sdhci: Copyright(c) Pierre Ossman
[    1.121737] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.130097] remoteproc remoteproc0: releasing cd00000.q6v5_wcss
[    1.148692] u_boot_env 78b5000.spi:flash@0:partitions:partition@600000: Invalid calculated CRC32: 0x705fe70e (expected: 0xffffffff)
[    1.148757] u_boot_env: probe of 78b5000.spi:flash@0:partitions:partition@600000 failed with error -22
[    1.158295] mmc0: SDHCI controller on 7824900.mmc [7824900.mmc] using ADMA 64-bit
[    1.160339] NET: Registered PF_INET6 protocol family
[    1.177228] Segment Routing with IPv6
[    1.181357] In-situ OAM (IOAM) with IPv6
[    1.184920] NET: Registered PF_PACKET protocol family
[    1.188916] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.193927] 8021q: 802.1Q VLAN Support v1.8
[    1.224639] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    1.224961] cpr4_ipq807x_apss_read_fuse_data: apc_corner: speed bin = 0
[    1.230800] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR fusing revision = 1
[    1.237366] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR misc fuse value = 0
[    1.245045] cpr4_ipq807x_apss_read_fuse_data: apc_corner: Voltage boost fuse config = 0 boost = disable
[    1.252539] cpr3_mem_acc_init: apc: not using memory accelerator regulator
[    1.261679] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      SVS: open-loop= 704000 uV
[    1.268627] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      NOM: open-loop= 816000 uV
[    1.278609] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused    TURBO: open-loop= 880000 uV
[    1.288418] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused   STURBO: open-loop= 960000 uV
[    1.298276] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      SVS: quot[ 7]= 736, quot_offset[ 7]=   0
[    1.308030] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      NOM: quot[ 7]= 945, quot_offset[ 7]= 205
[    1.318889] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused    TURBO: quot[ 7]=1053, quot_offset[ 7]= 105
[    1.329826] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused   STURBO: quot[ 7]=1196, quot_offset[ 7]= 140
[    1.340919] cpr3_regulator_init_ctrl: apc: Default CPR mode = closed-loop
[    1.343604] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 19200 KHz, changing to: 1017600 KHz
[    1.359541] remoteproc remoteproc0: cd00000.q6v5_wcss is available
[    1.369532] UBI error: cannot open mtd ubi, error -2
[    1.378431] Freeing unused kernel memory: 8896K
[    1.448204] Run /init as init process
[    1.448228]   with arguments:
[    1.448231]     /init
[    1.448234]   with environment:
[    1.448236]     HOME=/
[    1.448239]     TERM=linux
[    1.630035] init: Console is alive
[    1.630203] init: - watchdog -
[    1.637212] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.657856] ssdk_switch_device_num_init[1335]:INFO:ess-switch dts node number: 1
[    1.657967] ssdk_dt_get_switch_node[1124]:INFO:ess-switch DT exist!
[    1.664383] ssdk_dt_parse_access_mode[999]:INFO:switch_access_mode: local bus
[    1.670326] ssdk_dt_parse_access_mode[1012]:INFO:switchreg_base_addr: 0x3a000000
[    1.677609] ssdk_dt_parse_access_mode[1013]:INFO:switchreg_size: 0x1000000
[    1.685079] ssdk_dt_parse_mac_mode[327]:INFO:mac mode = 0x0
[    1.691759] ssdk_dt_parse_mac_mode[336]:INFO:mac mode1 = 0xf
[    1.697225] ssdk_dt_parse_mac_mode[345]:INFO:mac mode2 = 0xd
[    1.703145] ssdk_dt_parse_phy_info[716]:INFO:[PORT 5] port_mac_sel = QGMAC_PORT
[    1.708810] ssdk_dt_parse_uniphy[364]:INFO:ess-uniphy DT exist!
[    1.715898] ssdk_dt_parse_intf_mac[942]:INFO:dp1 MAC 00:03:7f:ba:db:ad
[    1.721942] ssdk_plat_init[1692]:INFO:ssdk_plat_init start
[    1.849150] ssdk_gcc_clock_init[1275]:INFO:SSDK gcc clock init successfully!
[    1.850176] ssdk_phy_driver_init[363]:INFO:dev_id = 0, phy_adress = 28, phy_id = 0xffffffff phytype doesn't match
[    1.855342] ssdk_phy_driver_init[363]:INFO:dev_id = 0, phy_adress = 8, phy_id = 0xffffffff phytype doesn't match
[    1.865461] malibu_phy_api_ops_init[2846]:INFO:qca probe malibu phy driver succeeded!
[    1.880024] regi_init[3953]:INFO:Initializing HPPE!!
[    2.118073] ssdk_ppe_reset_init[1535]:INFO:ppe reset successfully!
[    2.121561] qca_hppe_portctrl_hw_init[126]:INFO:Hawkeye PPE port initializing
[    3.280244] ssdk_switch_register[2017]:INFO:Chip version 0x1500
[    3.280277] qca_link_polling_select[1487]:INFO:link-polling-required node does not exist
[    3.284966] ssdk_switch_register[2043]:INFO:polling is selected
[    3.293304] regi_init[3957]:INFO:Initializing HPPE Done!!
[    3.299024] ssdk_genl_init[211]:INFO:ssdk genl family register success.
[    3.304500] regi_init[4020]:INFO:qca-ssdk module init succeeded!
[    3.312569] EDMA ver 1 hw init
[    3.317383] EDMA HW Reset completed succesfully
[    3.320075] Num rings - TxDesc:1 (23-23) TxCmpl:1 (7-7)
[    3.324456] RxDesc:1 (15-15) RxFill:1 (7-7)
[    3.330228] Generic PHY 90000.mdio-1:00: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:00, irq=POLL)
[    3.334351] nss-dp 3a001000.dp1 lan1: Registered netdev lan1(qcom-id:1)
[    3.343808] GMAC2(ffffff8003b9e900) Invalid MAC@ - using e6:58:bd:5e:ef:8e
[    3.350141] Generic PHY 90000.mdio-1:01: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:01, irq=POLL)
[    3.357524] nss-dp 3a001200.dp2 lan2: Registered netdev lan2(qcom-id:2)
[    3.366819] GMAC3(ffffff800394b900) Invalid MAC@ - using d6:a6:93:3b:63:32
[    3.373131] Generic PHY 90000.mdio-1:02: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:02, irq=POLL)
[    3.380465] nss-dp 3a001400.dp3 lan3: Registered netdev lan3(qcom-id:3)
[    3.389806] GMAC4(ffffff8003b9c900) Invalid MAC@ - using e2:56:ac:c7:79:27
[    3.396132] Generic PHY 90000.mdio-1:03: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:03, irq=POLL)
[    3.403504] nss-dp 3a001600.dp4 lan4: Registered netdev lan4(qcom-id:4)
[    3.412813] GMAC5(ffffff8003948900) Invalid MAC@ - using 32:14:64:0f:47:0c
[    3.419224] Generic PHY 90000.mdio-1:1c: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:1c, irq=POLL)
[    3.426461] nss-dp 3a001800.dp5 wan: Registered netdev wan(qcom-id:5)
[    3.435848] GMAC6(ffffff8002eae900) Invalid MAC@ - using d2:1a:19:bf:2c:68
[    3.442037] nss-dp 3a007000.dp6-syn: Could not attach to PHY
[    3.448837] nss-dp: probe of 3a007000.dp6-syn failed with error -14
[    3.454661] **********************************************************
[    3.460593] * NSS Data Plane driver
[    3.467162] **********************************************************
[    3.621361] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    3.621409] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 1
[    3.625879] xhci-hcd xhci-hcd.1.auto: hcc params 0x0220fe65 hci version 0x110 quirks 0x0000000002010010
[    3.633351] xhci-hcd xhci-hcd.1.auto: irq 93, io mem 0x08a00000
[    3.642752] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    3.648579] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 2
[    3.654135] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed
[    3.662069] hub 1-0:1.0: USB hub found
[    3.668336] hub 1-0:1.0: 1 port detected
[    3.672271] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    3.676371] hub 2-0:1.0: USB hub found
[    3.684228] hub 2-0:1.0: 1 port detected
[    3.688064] xhci-hcd xhci-hcd.2.auto: xHCI Host Controller
[    3.691808] xhci-hcd xhci-hcd.2.auto: new USB bus registered, assigned bus number 3
[    3.697231] xhci-hcd xhci-hcd.2.auto: hcc params 0x0220fe65 hci version 0x110 quirks 0x0000000002010010
[    3.704717] xhci-hcd xhci-hcd.2.auto: irq 94, io mem 0x08c00000
[    3.714105] xhci-hcd xhci-hcd.2.auto: xHCI Host Controller
[    3.719934] xhci-hcd xhci-hcd.2.auto: new USB bus registered, assigned bus number 4
[    3.725488] xhci-hcd xhci-hcd.2.auto: Host supports USB 3.0 SuperSpeed
[    3.733356] hub 3-0:1.0: USB hub found
[    3.739684] hub 3-0:1.0: 1 port detected
[    3.743672] usb usb4: We don't know the algorithms for LPM for this host, disabling LPM.
[    3.747700] hub 4-0:1.0: USB hub found
[    3.755534] hub 4-0:1.0: 1 port detected
[    3.760110] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.765043] init: - preinit -
[    3.825963] random: jshn: uninitialized urandom read (4 bytes read)
[    3.843794] random: jshn: uninitialized urandom read (4 bytes read)
[    3.853283] random: jshn: uninitialized urandom read (4 bytes read)
[    4.048071] usb 3-1: new full-speed USB device number 2 using xhci-hc[  490.008181] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
d
[    4.328239] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[    5.368175] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[    5.942316] procd: - early -
[    5.942416] procd: - watchdog -
[    6.408167] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[    6.468166] procd: - watchdog -
[    6.468410] procd: - ubus -
[    6.472721] random: ubusd: uninitialized urandom read (4 bytes read)
[    6.519948] random: ubusd: uninitialized urandom read (4 bytes read)
[    6.520128] random: ubusd: uninitialized urandom read (4 bytes read)
[    6.526248] procd: - init -
[    6.634424] kmodloader: loading kernel modules from /etc/modules.d/*
[    6.658283] Loading modules backported from Linux version v6.1.24-0-g0102425ac76b
[    6.658322] Backport generated by backports.git v5.15.92-1-44-gd6ea70fafd36
[    6.667556] NET: Registered PF_QIPCRTR protocol family
[    6.692162] PPP generic driver version 2.4.2
[    6.692646] NET: Registered PF_PPPOX protocol family
[    6.700864] ath11k c000000.wifi: ipq8074 hw2.0
[    6.700897] ath11k c000000.wifi: FW memory mode: 0
[    6.704921] remoteproc remoteproc0: powering up cd00000.q6v5_wcss
[    6.709783] remoteproc remoteproc0: Booting fw image IPQ8074/q6_fw.mdt, size 668
[    6.756865] urngd: v1.0.2 started.
[    6.850410] random: crng init done
[    6.850429] random: 26 urandom warning(s) missed due to ratelimiting
[    7.060528] remoteproc remoteproc0: remote processor cd00000.q6v5_wcss is now up
[    7.063300] kmodloader: done loading kernel modules from /etc/modules.d/*
[    7.104436] ath11k c000000.wifi: qmi ignore invalid mem req type 3
[    7.111891] ath11k c000000.wifi: chip_id 0x0 chip_family 0x0 board_id 0xff soc_id 0xffffffff
[    7.111925] ath11k c000000.wifi: fw_version 0x290c84a5 fw_build_timestamp 2023-03-25 07:34 fw_build_id WLAN.HK.2.9.0.1-01385-QCAHKSWPL_SILICONZ-1
[    7.171955] ath11k c000000.wifi: failed to fetch board data for bus=ahb,qmi-chip-id=0,qmi-board-id=255,variant=Zyxel-NBG7815 from ath11k/IPQ8074/hw2.0/board-2.bin
[    7.172020] ath11k c000000.wifi: failed to fetch board data for bus=ahb,qmi-chip-id=0,qmi-board-id=255 from ath11k/IPQ8074/hw2.0/board-2.bin
[    7.185470] ath11k c000000.wifi: failed to fetch board.bin from IPQ8074/hw2.0
[    7.198230] ath11k c000000.wifi: qmi failed to fetch board file: -12
[    7.205166] ath11k c000000.wifi: failed to load board data file: -12
[    7.448178] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[    8.488185] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[    9.528136] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   10.568235] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   10.914330] br-lan: port 1(lan1) entered blocking state
[   10.914375] br-lan: port 1(lan1) entered disabled state
[   10.918628] device lan1 entered promiscuous mode
[   10.931684] br-lan: port 2(lan2) entered blocking state
[   10.931729] br-lan: port 2(lan2) entered disabled state
[   10.935950] device lan2 entered promiscuous mode
[   10.944454] br-lan: port 3(lan3) entered blocking state
[   10.945798] br-lan: port 3(lan3) entered disabled state
[   10.951033] device lan3 entered promiscuous mode
[   10.959358] br-lan: port 4(lan4) entered blocking state
[   10.960815] br-lan: port 4(lan4) entered disabled state
[   10.965980] device lan4 entered promiscuous mode
[   11.612861] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   12.648178] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   13.688166] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   14.088526] nss-dp 3a001600.dp4 lan4: PHY Link up speed: 1000
[   14.088594] br-lan: port 4(lan4) entered blocking state
[   14.093251] br-lan: port 4(lan4) entered forwarding state
[   14.098567] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   14.728203] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   15.768316] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   16.808179] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   17.848165] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   18.888169] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   19.928164] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   20.968328] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   22.008163] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   23.048159] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   24.088167] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   25.128154] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   26.168156] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   27.208159] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   28.248158] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   29.288162] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   30.328158] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   31.368177] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   32.408166] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   33.448157] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   34.488162] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   35.528159] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   36.568154] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   37.608168] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   38.648159] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   39.688153] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   40.728161] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   41.768153] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   42.808163] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   43.848155] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   44.888162] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   45.928164] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   46.968152] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   48.008163] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   49.048160] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   50.088162] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   51.128169] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   52.168157] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   53.208162] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   54.248153] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   55.288163] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   56.328159] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   57.368163] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   58.408163] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   59.448163] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   60.488167] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   61.528155] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   62.568157] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   63.608165] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   64.648158] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   65.688164] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL
[   66.728156] hsl_phy_phydev_get[773]:ERROR:phy_addr 8 phydev is NULL

but i get that ERROR message which does not stop :thinking:

and the luci web interface did work but it got like this after some time:

Screenshot 2025-04-28 021657
Screenshot 2025-04-28 0216571734×961 34.6 KB

i think because the alien just rebooted to the OEM Firmware automatically...

Hardware update:

  • Ethernet PHY confirmed: QCA8075 (5 ports)

  • Wi-Fi Radios confirmed: 2x QCN5054 + 1x QCN5024 (Wi-Fi 6, 8x8 MU-MIMO support)

  • Fan controller: LM63 chip through hwmon0

  • TFTPboot preparation complete.

we can continue later today :+1:

Thank you :slightly_smiling_face:

20

The phy error is just because you don't have the same phy chip or something and it keeps on probing it, it is expected if the dts is incorrect, you need a proper dts specific to your device with the correct phy setup.

It looks like they are all referenced at address 9000 but port 6 fails init, i dont know enough about the chips but i can create a dts for your device:

[    3.330228] Generic PHY 90000.mdio-1:00: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:00, irq=POLL)
[    3.334351] nss-dp 3a001000.dp1 lan1: Registered netdev lan1(qcom-id:1)
[    3.343808] GMAC2(ffffff8003b9e900) Invalid MAC@ - using e6:58:bd:5e:ef:8e
[    3.350141] Generic PHY 90000.mdio-1:01: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:01, irq=POLL)
[    3.357524] nss-dp 3a001200.dp2 lan2: Registered netdev lan2(qcom-id:2)
[    3.366819] GMAC3(ffffff800394b900) Invalid MAC@ - using d6:a6:93:3b:63:32
[    3.373131] Generic PHY 90000.mdio-1:02: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:02, irq=POLL)
[    3.380465] nss-dp 3a001400.dp3 lan3: Registered netdev lan3(qcom-id:3)
[    3.389806] GMAC4(ffffff8003b9c900) Invalid MAC@ - using e2:56:ac:c7:79:27
[    3.396132] Generic PHY 90000.mdio-1:03: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:03, irq=POLL)
[    3.403504] nss-dp 3a001600.dp4 lan4: Registered netdev lan4(qcom-id:4)
[    3.412813] GMAC5(ffffff8003948900) Invalid MAC@ - using 32:14:64:0f:47:0c
[    3.419224] Generic PHY 90000.mdio-1:1c: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:1c, irq=POLL)
[    3.426461] nss-dp 3a001800.dp5 wan: Registered netdev wan(qcom-id:5)
[    3.435848] GMAC6(ffffff8002eae900) Invalid MAC@ - using d2:1a:19:bf:2c:68
[    3.442037] nss-dp 3a007000.dp6-syn: Could not attach to PHY
[    3.448837] nss-dp: probe of 3a007000.dp6-syn failed with error -14

[    1.105461] mdio_bus 90000.mdio-1: MDIO device at address 8 is missing.

have you pulled the device apart? and taken shots of the chips to id them?
I don't know specifically what chips you have, as a qca8084 is a four port 2.5g and the documentation states it is 1gig Lan/ Wan on your device, I'm a little confused I don't know much about the different chip offerings.

I'm guessing the wan port won't operate?
I expect the Wi-Fi to fail as the ath11k hotplug script would not be able to pull the caldata and the board file is wrong.

Can you dump the mtd partitions from the OpenWrt initramfs image and post them on dropbox?
it would be a good idea for you to make a backup if something gets bricked, you might have to use something nand aware because of the ecc.

1 Like