IPQ8074A: Add Support for Ubiquiti AmpliFi Alien Router

A-Somebody_8272 · May 8, 2025, 6:00pm

Hey! Just finished testing the latest image. Here’s what I found:

lm63 now shows up fine under /sys/class/hwmon, so that’s working.

All 3 serial ports (ttyMSM0, MSM1, MSM2) are showing up correctly.

Overlay rootfs is writable — confirmed by writing a test file.

Well Wi-Fi is working again and i see it in luci, but no ath10k logs or devices in dmesg...

UBI still not mounted. mount | grep ubi returns nothing.

No /sys/firmware/devicetree/base/nvmem path yet.

GPIO error on lcm_swrst: “duplicate filename” still shows in dmesg. Also the LCM display still stays stuck at 99% so nothing new happened

Also, lspci not found, so I couldn’t test PCIe from userspace.

.

A-Somebody_8272 · May 8, 2025, 6:01pm

root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 10000000 00020000 "ubi"
mtd1: 00050000 00010000 "0:SBL1"
mtd2: 00010000 00010000 "0:MIBIB"
mtd3: 00020000 00010000 "0:BOOTCONFIG"
mtd4: 00020000 00010000 "0:BOOTCONFIG1"
mtd5: 00180000 00010000 "0:QSEE"
mtd6: 00180000 00010000 "0:QSEE_1"
mtd7: 00010000 00010000 "0:DEVCFG"
mtd8: 00010000 00010000 "0:DEVCFG_1"
mtd9: 00010000 00010000 "0:APDP"
mtd10: 00010000 00010000 "0:APDP_1"
mtd11: 00040000 00010000 "0:RPM"
mtd12: 00040000 00010000 "0:RPM_1"
mtd13: 00010000 00010000 "0:CDT"
mtd14: 00010000 00010000 "0:CDT_1"
mtd15: 00010000 00010000 "0:u-boot-env"
mtd16: 000a0000 00010000 "0:u-boot"
mtd17: 000a0000 00010000 "0:u-boot2"
mtd18: 00040000 00010000 "0:ART"
mtd19: 00010000 00010000 "0:eeprom"
mtd20: 00070000 00010000 "0:reserved"
mtd21: 00010000 00010000 "0:prst"
root@OpenWrt:~#

A-Somebody_8272 · May 8, 2025, 6:03pm

Dmesg Output: (Newest image)

root@OpenWrt:~# dmesg
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 6.6.89 (professor_jonny@MRSPARKLE) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.2.0 r29478-09b7cc291a) 14.2.0, GNU ld (GNU Binutils) 2.42) #0 SMP Thu May  8 11:59:51 2025
[    0.000000] Machine model: Ubiquiti Amplifi Alien Router
[    0.000000] OF: reserved mem: 0x0000000040000000..0x0000000040ffffff (16384 KiB) nomap non-reusable nss@40000000
[    0.000000] OF: reserved mem: 0x000000004a400000..0x000000004a5fffff (2048 KiB) nomap non-reusable tzapp@4a400000
[    0.000000] OF: reserved mem: 0x000000004a600000..0x000000004a9fffff (4096 KiB) nomap non-reusable bootloader@4a600000
[    0.000000] OF: reserved mem: 0x000000004aa00000..0x000000004aafffff (1024 KiB) nomap non-reusable sbl@4aa00000
[    0.000000] OF: reserved mem: 0x000000004ab00000..0x000000004abfffff (1024 KiB) nomap non-reusable smem@4ab00000
[    0.000000] OF: reserved mem: 0x000000004ac00000..0x000000004affffff (4096 KiB) nomap non-reusable memory@4ac00000
[    0.000000] OF: reserved mem: 0x000000004b000000..0x0000000050efffff (97280 KiB) nomap non-reusable wcnss@4b000000
[    0.000000] OF: reserved mem: 0x0000000050f00000..0x0000000050ffffff (1024 KiB) nomap non-reusable q6_etr_dump@50f00000
[    0.000000] OF: reserved mem: 0x0000000051000000..0x00000000510fffff (1024 KiB) nomap non-reusable m3_dump@51000000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000040ffffff]
[    0.000000]   node   0: [mem 0x0000000041000000-0x000000004a3fffff]
[    0.000000]   node   0: [mem 0x000000004a400000-0x00000000510fffff]
[    0.000000]   node   0: [mem 0x0000000051100000-0x000000007fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] psci: OSI mode supported.
[    0.000000] psci: [Firmware Bug]: failed to set PC mode: -1
[    0.000000] percpu: Embedded 18 pages/cpu s35624 r8192 d29912 u73728
[    0.000000] pcpu-alloc: s35624 r8192 d29912 u73728 alloc=18*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: console=ttyMSM0,115200 ubi.mtd=ubi  rootfstype=squashfs rootwait root=/dev/ubiblock0_1
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 258048
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 1MB
[    0.000000] software IO TLB: area num 4.
[    0.000000] software IO TLB: mapped [mem 0x000000007eb00000-0x000000007ec00000] (1MB)
[    0.000000] Memory: 870524K/1048576K available (8448K kernel code, 916K rwdata, 2536K rodata, 16320K init, 279K bss, 178052K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv2m: range[mem 0x0b00a000-0x0b00affc], SPI[448:479]
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[    0.000000] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[    0.000108] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=192000)
[    0.000122] pid_max: default: 32768 minimum: 301
[    0.005131] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.005145] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.009371] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[    0.009598] rcu: Hierarchical SRCU implementation.
[    0.009603] rcu:     Max phase no-delay instances is 1000.
[    0.010557] smp: Bringing up secondary CPUs ...
[    0.011216] Detected VIPT I-cache on CPU1
[    0.011322] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.011990] Detected VIPT I-cache on CPU2
[    0.012061] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.012710] Detected VIPT I-cache on CPU3
[    0.012777] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.012845] smp: Brought up 1 node, 4 CPUs
[    0.012853] SMP: Total of 4 processors activated.
[    0.012858] CPU features: detected: 32-bit EL0 Support
[    0.012863] CPU features: detected: CRC32 instructions
[    0.012925] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.012931] CPU: All CPU(s) started at EL1
[    0.012934] alternatives: applying system-wide alternatives
[    0.024243] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.024270] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.026000] pinctrl core: initialized pinctrl subsystem
[    0.028113] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.028683] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.028722] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.028756] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.029160] thermal_sys: Registered thermal governor 'step_wise'
[    0.029218] cpuidle: using governor menu
[    0.029439] ASID allocator initialised with 65536 entries
[    0.036897] /soc@0/phy@84000/phy@84200: Fixed dependency cycle(s) with /soc@0/gcc@1800000
[    0.036989] /soc@0/gcc@1800000: Fixed dependency cycle(s) with /soc@0/phy@84000/phy@84200
[    0.037940] /soc@0/phy@84000: Fixed dependency cycle(s) with /soc@0/gcc@1800000
[    0.037957] /soc@0/phy@84000/phy@84200: Fixed dependency cycle(s) with /soc@0/gcc@1800000
[    0.040082] /soc@0/phy@84000/phy@84200: Fixed dependency cycle(s) with /soc@0/gcc@1800000
[    0.040151] /soc@0/phy@84000: Fixed dependency cycle(s) with /soc@0/gcc@1800000
[    0.040420] /soc@0/gcc@1800000: Fixed dependency cycle(s) with /soc@0/phy@84000/phy@84200
[    0.088076] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    0.090292] Modules: 25600 pages in range for non-PLT usage
[    0.090300] Modules: 517120 pages in range for PLT usage
[    0.095077] SCSI subsystem initialized
[    0.095284] usbcore: registered new interface driver usbfs
[    0.095318] usbcore: registered new interface driver hub
[    0.095354] usbcore: registered new device driver usb
[    0.095801] qcom_scm: convention: smc arm 64
[    0.097558] clocksource: Switched to clocksource arch_sys_counter
[    0.101341] NET: Registered PF_INET protocol family
[    0.101499] IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.104041] tcp_listen_portaddr_hash hash table entries: 512 (order: 1, 8192 bytes, linear)
[    0.104065] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.104080] TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.104165] TCP bind hash table entries: 8192 (order: 6, 262144 bytes, linear)
[    0.104435] TCP: Hash tables configured (established 8192 bind 8192)
[    0.104962] MPTCP token hash table entries: 1024 (order: 2, 24576 bytes, linear)
[    0.105141] UDP hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.105178] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.105623] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.105663] PCI: CLS 0 bytes, default 64
[    0.119437] workingset: timestamp_bits=46 max_order=18 bucket_order=0
[    0.120005] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.120016] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.130163] qcom-qmp-usb-phy 58000.phy: supply vdda-phy not found, using dummy regulator
[    0.130349] qcom-qmp-usb-phy 58000.phy: supply vdda-pll not found, using dummy regulator
[    0.131860] qcom-qmp-usb-phy 78000.phy: supply vdda-phy not found, using dummy regulator
[    0.132000] qcom-qmp-usb-phy 78000.phy: supply vdda-pll not found, using dummy regulator
[    0.133899] qcom-qusb2-phy 59000.phy: supply vdd not found, using dummy regulator
[    0.134054] qcom-qusb2-phy 59000.phy: supply vdda-pll not found, using dummy regulator
[    0.134133] qcom-qusb2-phy 59000.phy: supply vdda-phy-dpdm not found, using dummy regulator
[    0.134303] qcom-qusb2-phy 59000.phy: Registered Qcom-QUSB2 phy
[    0.134516] qcom-qusb2-phy 79000.phy: supply vdd not found, using dummy regulator
[    0.134640] qcom-qusb2-phy 79000.phy: supply vdda-pll not found, using dummy regulator
[    0.134682] qcom-qusb2-phy 79000.phy: supply vdda-phy-dpdm not found, using dummy regulator
[    0.134843] qcom-qusb2-phy 79000.phy: Registered Qcom-QUSB2 phy
[    0.137341] gpio-export lcm_boot0: 3 gpio(s) exported
[    0.138779] qcom-pcie 20000000.pci: host bridge /soc@0/pci@20000000 ranges:
[    0.138841] qcom-pcie 20000000.pci:       IO 0x0020200000..0x002020ffff -> 0x0000000000
[    0.138868] qcom-pcie 20000000.pci:      MEM 0x0020220000..0x002fffffff -> 0x0020220000
[    0.146175] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.147240] msm_serial 78af000.serial: msm_serial: detected port #2
[    0.147283] msm_serial 78af000.serial: uartclk = 19200000
[    0.147668] 78af000.serial: ttyMSM2 at MMIO 0x78af000 (irq = 20, base_baud = 1200000) is a MSM
[    0.148180] msm_serial 78b1000.serial: msm_serial: detected port #1
[    0.148215] msm_serial 78b1000.serial: uartclk = 19200000
[    0.148571] 78b1000.serial: ttyMSM1 at MMIO 0x78b1000 (irq = 23, base_baud = 1200000) is a MSM
[    0.149022] msm_serial 78b3000.serial: msm_serial: detected port #0
[    0.149071] msm_serial 78b3000.serial: uartclk = 3686400
[    0.149406] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 24, base_baud = 230400) is a MSM
[    0.149435] msm_serial: console setup on port #0
[    0.149475] printk: console [ttyMSM0] enabled
[    0.269141] qcom-pcie 20000000.pci: iATU: unroll T, 8 ob, 8 ib, align 4K, limit 1024G
[    0.271210] msm_serial: driver initialized
[    1.136340] loop: module loaded
[    1.137969] nand: device found, Manufacturer ID: 0xef, Chip ID: 0xaa
[    1.138300] nand: Winbond W29N02GZ
[    1.144889] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.267646] qcom-pcie 20000000.pci: Phy link never came up
[    1.268159] qcom-pcie 20000000.pci: PCI host bridge to bus 0000:00
[    1.272050] pci_bus 0000:00: root bus resource [bus 00-ff]
[    1.278245] pci_bus 0000:00: root bus resource [io  0x0000-0xffff]
[    1.283674] pci_bus 0000:00: root bus resource [mem 0x20220000-0x2fffffff]
[    1.289896] pci 0000:00:00.0: [17cb:1002] type 01 class 0x060400
[    1.296752] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x00000fff]
[    1.302961] pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
[    1.312277] 1 fixed-partitions partitions found on MTD device qcom_nand.0
[    1.312764] pci 0000:00:00.0: BAR 0: assigned [mem 0x20220000-0x20220fff]
[    1.315097] Creating 1 MTD partitions on "qcom_nand.0":
[    1.321889] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    1.328643] 0x000000000000-0x000010000000 : "ubi"
[    1.336475] pcieport 0000:00:00.0: PME: Signaling with IRQ 26
[    1.344066] pcieport 0000:00:00.0: AER: enabled with IRQ 26
[    1.540113] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    1.541037] spi-nor spi0.0: mx25u6435f (8192 Kbytes)
[    1.565492] 21 fixed-partitions partitions found on MTD device spi0.0
[    1.565549] Creating 21 MTD partitions on "spi0.0":
[    1.570954] 0x000000000000-0x000000050000 : "0:SBL1"
[    1.576230] 0x000000050000-0x000000060000 : "0:MIBIB"
[    1.581430] 0x000000060000-0x000000080000 : "0:BOOTCONFIG"
[    1.586248] 0x000000080000-0x0000000a0000 : "0:BOOTCONFIG1"
[    1.591690] 0x0000000a0000-0x000000220000 : "0:QSEE"
[    1.597078] 0x000000220000-0x0000003a0000 : "0:QSEE_1"
[    1.602315] 0x0000003a0000-0x0000003b0000 : "0:DEVCFG"
[    1.607284] 0x0000003b0000-0x0000003c0000 : "0:DEVCFG_1"
[    1.612435] 0x0000003c0000-0x0000003d0000 : "0:APDP"
[    1.617889] 0x0000003d0000-0x0000003e0000 : "0:APDP_1"
[    1.622853] 0x0000003e0000-0x000000420000 : "0:RPM"
[    1.627763] 0x000000420000-0x000000460000 : "0:RPM_1"
[    1.632508] 0x000000460000-0x000000470000 : "0:CDT"
[    1.637816] 0x000000470000-0x000000480000 : "0:CDT_1"
[    1.642398] 0x000000480000-0x000000490000 : "0:u-boot-env"
[    1.647659] 0x000000490000-0x000000530000 : "0:u-boot"
[    1.653004] 0x000000530000-0x0000005d0000 : "0:u-boot2"
[    1.658188] 0x0000005d0000-0x000000610000 : "0:ART"
[    1.663271] 0x000000610000-0x000000620000 : "0:eeprom"
[    1.668129] 0x000000620000-0x000000690000 : "0:reserved"
[    1.673342] 0x000000690000-0x0000006a0000 : "0:prst"
[    1.687242] spmi spmi-0: PMIC arbiter version v2 (0x20010000)
[    1.801844] i2c_dev: i2c /dev entries driver
[    1.809710] sdhci: Secure Digital Host Controller Interface driver
[    1.809756] sdhci: Copyright(c) Pierre Ossman
[    1.814791] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.821242] remoteproc remoteproc0: releasing cd00000.q6v5_wcss
[    1.828602] NET: Registered PF_INET6 protocol family
[    1.832007] Segment Routing with IPv6
[    1.835836] In-situ OAM (IOAM) with IPv6
[    1.839483] NET: Registered PF_PACKET protocol family
[    1.843513] 8021q: 802.1Q VLAN Support v1.8
[    1.879605] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    1.879943] cpr4_ipq807x_apss_read_fuse_data: apc_corner: speed bin = 0
[    1.885732] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR fusing revision = 1
[    1.892384] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR misc fuse value = 0
[    1.900023] cpr4_ipq807x_apss_read_fuse_data: apc_corner: Voltage boost fuse config = 0 boost = disable
[    1.907526] cpr3_mem_acc_init: apc: not using memory accelerator regulator
[    1.916635] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      SVS: open-loop= 704000 uV
[    1.923606] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      NOM: open-loop= 816000 uV
[    1.933593] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused    TURBO: open-loop= 880000 uV
[    1.943405] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused   STURBO: open-loop= 960000 uV
[    1.953287] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      SVS: quot[ 7]= 736, quot_offset[ 7]=   0
[    1.963021] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      NOM: quot[ 7]= 945, quot_offset[ 7]= 205
[    1.973872] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused    TURBO: quot[ 7]=1053, quot_offset[ 7]= 105
[    1.984807] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused   STURBO: quot[ 7]=1196, quot_offset[ 7]= 140
[    1.995974] cpr3_regulator_init_ctrl: apc: Default CPR mode = closed-loop
[    1.999341] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 800000 KHz, changing to: 1017600 KHz
[    2.015306] remoteproc remoteproc0: cd00000.q6v5_wcss is available
[    2.024432] ubi0: attaching mtd0
[    2.667557] random: crng init done
[    3.166504] ubi0: scanning is finished
[    3.174459] ubi0: attached mtd0 (name "ubi", size 256 MiB)
[    3.174500] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.178860] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.185705] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.192569] ubi0: good PEBs: 2048, bad PEBs: 0, corrupted PEBs: 0
[    3.199338] ubi0: user volume: 10, internal volumes: 1, max. volumes count: 128
[    3.205585] ubi0: max/mean erase counter: 42/26, WL threshold: 4096, image sequence number: 553677150
[    3.212718] ubi0: available PEBs: 418, total reserved PEBs: 1630, PEBs reserved for bad PEB handling: 40
[    3.222098] ubi0: background thread "ubi_bgt0d" started, PID 698
[    3.232217] block ubiblock0_5: created from ubi0:5(rootfs)
[    3.237639] ubiblock: device ubiblock0_5 (rootfs) set to be root filesystem
[    3.243022] clk: Disabling unused clocks
[    3.256879] Freeing unused kernel memory: 16320K
[    3.257005] Run /init as init process
[    3.260597]   with arguments:
[    3.260600]     /init
[    3.260603]   with environment:
[    3.260605]     HOME=/
[    3.260608]     TERM=linux
[    3.520014] init: Console is alive
[    3.520136] init: - watchdog -
[    3.531779] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.545874] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    3.546452] gpio-keys: probe of gpio_keys failed with error -16
[    3.563357] ssdk_dt_parse_interrupt[941]:INFO:intr-gpio does not exist
[    3.993707] regi_init[2525]:INFO:Initializing HPPE Done!!
[    3.993851] regi_init[2574]:INFO:qca-ssdk module init succeeded!
[    4.000401] EDMA ver 1 hw init
[    4.004390] EDMA HW Reset completed succesfully
[    4.007065] Num rings - TxDesc:1 (23-23) TxCmpl:1 (7-7)
[    4.011479] RxDesc:1 (15-15) RxFill:1 (7-7)
[    4.208332] Qualcomm QCA8075 90000.mdio-1:00: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:00, irq=POLL)
[    4.209446] GMAC2(ffffff8002ef2900) Invalid MAC@ - using 16:91:0f:70:cb:f8
[    4.287923] Qualcomm QCA8075 90000.mdio-1:01: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:01, irq=POLL)
[    4.289009] GMAC3(ffffff80077da900) Invalid MAC@ - using 82:ae:12:76:12:6c
[    4.357918] Qualcomm QCA8075 90000.mdio-1:02: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:02, irq=POLL)
[    4.358938] GMAC4(ffffff80077d9900) Invalid MAC@ - using 0e:3b:9a:48:cb:0f
[    4.437893] Qualcomm QCA8075 90000.mdio-1:03: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:03, irq=POLL)
[    4.527909] Qualcomm QCA8075 90000.mdio-1:04: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:04, irq=POLL)
[    4.528747] **********************************************************
[    4.536823] * NSS Data Plane driver
[    4.543339] **********************************************************
[    4.563551] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    4.563599] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 1
[    4.568075] xhci-hcd xhci-hcd.1.auto: hcc params 0x0220fe65 hci version 0x110 quirks 0x0000008002000010
[    4.575528] xhci-hcd xhci-hcd.1.auto: irq 46, io mem 0x08a00000
[    4.584951] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    4.590773] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 2
[    4.596326] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed
[    4.604283] hub 1-0:1.0: USB hub found
[    4.610556] hub 1-0:1.0: 1 port detected
[    4.614456] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    4.618773] hub 2-0:1.0: USB hub found
[    4.626374] hub 2-0:1.0: 1 port detected
[    4.630424] xhci-hcd xhci-hcd.2.auto: xHCI Host Controller
[    4.633998] xhci-hcd xhci-hcd.2.auto: new USB bus registered, assigned bus number 3
[    4.639463] xhci-hcd xhci-hcd.2.auto: hcc params 0x0220fe65 hci version 0x110 quirks 0x0000008002000010
[    4.646883] xhci-hcd xhci-hcd.2.auto: irq 47, io mem 0x08c00000
[    4.656305] xhci-hcd xhci-hcd.2.auto: xHCI Host Controller
[    4.662128] xhci-hcd xhci-hcd.2.auto: new USB bus registered, assigned bus number 4
[    4.667689] xhci-hcd xhci-hcd.2.auto: Host supports USB 3.0 SuperSpeed
[    4.675590] hub 3-0:1.0: USB hub found
[    4.681850] hub 3-0:1.0: 1 port detected
[    4.685812] usb usb4: We don't know the algorithms for LPM for this host, disabling LPM.
[    4.689950] hub 4-0:1.0: USB hub found
[    4.697731] hub 4-0:1.0: 1 port detected
[    4.702601] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.707983] init: - preinit -
[    4.977566] usb 3-1: new full-speed USB device number 2 using xhci-hcd
[    8.007749] nss-dp 3a001000.dp1 lan1: PHY Link up speed: 1000
[    8.929442] nss-dp 3a001000.dp1 lan1: PHY Link is down
[    8.933072] procd: - early -
[    8.933536] procd: - watchdog -
[    9.463357] procd: - watchdog -
[    9.463602] procd: - ubus -
[    9.517074] procd: - init -
[    9.662402] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.775654] hid: raw HID events driver (C) Jiri Kosina
[    9.776415] GACT probability on
[    9.780427] Mirror/redirect action on
[    9.786239] u32 classifier
[    9.786540]     input device check on
[    9.789163]     Actions configured
[    9.802551] Bluetooth: Core ver 2.22
[    9.802679] NET: Registered PF_BLUETOOTH protocol family
[    9.805199] Bluetooth: HCI device and connection manager initialized
[    9.810537] Bluetooth: HCI socket layer initialized
[    9.816831] Bluetooth: L2CAP socket layer initialized
[    9.821448] Bluetooth: SCO socket layer initialized
[    9.823728] urngd: v1.0.2 started.
[    9.831511] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[    9.834800] Bluetooth: BNEP filters: protocol multicast
[    9.840284] Bluetooth: BNEP socket layer initialized
[    9.845741] Loading modules backported from Linux version v6.12.6-0-ge9d65b48ce1a
[    9.850450] Backport generated by backports.git v6.1.110-1-35-g410656ef04d2
[    9.858556] Bluetooth: HCI UART driver ver 2.3
[    9.864573] Bluetooth: HCI UART protocol H4 registered
[    9.869102] Bluetooth: HCI UART protocol BCSP registered
[    9.875000] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[    9.879707] Bluetooth: HIDP socket layer initialized
[    9.902427] NET: Registered PF_QIPCRTR protocol family
[    9.904202] Bluetooth: RFCOMM TTY layer initialized
[    9.906470] Bluetooth: RFCOMM socket layer initialized
[    9.911336] Bluetooth: RFCOMM ver 1.11
[    9.925567] xt_time: kernel timezone is -0000
[    9.957045] PPP generic driver version 2.4.2
[    9.957944] NET: Registered PF_PPPOX protocol family
[    9.962051] wireguard: WireGuard 1.0.0 loaded. See www.wireguard.com for information.
[    9.965336] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
[    9.991795] ath11k c000000.wifi: ipq8074 hw2.0
[    9.991828] ath11k c000000.wifi: FW memory mode: 0
[   10.013169] remoteproc remoteproc0: powering up cd00000.q6v5_wcss
[   10.013268] remoteproc remoteproc0: Booting fw image IPQ8074/q6_fw.mdt, size 668
[   10.364249] remoteproc remoteproc0: remote processor cd00000.q6v5_wcss is now up
[   10.408208] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req
[   10.415647] ath11k c000000.wifi: chip_id 0x0 chip_family 0x0 board_id 0xff soc_id 0xffffffff
[   10.415683] ath11k c000000.wifi: fw_version 0x290b84a5 fw_build_timestamp 2024-09-23 11:32 fw_build_id WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1
[   15.700798] remoteproc remoteproc0: stopped remote processor cd00000.q6v5_wcss
[   15.700840] remoteproc remoteproc0: powering up cd00000.q6v5_wcss
[   15.706981] remoteproc remoteproc0: Booting fw image IPQ8074/q6_fw.mdt, size 668
[   16.056997] remoteproc remoteproc0: remote processor cd00000.q6v5_wcss is now up
[   16.060556] kmodloader: done loading kernel modules from /etc/modules.d/*
[   16.100678] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req
[   16.108137] ath11k c000000.wifi: chip_id 0x0 chip_family 0x0 board_id 0xff soc_id 0xffffffff
[   16.108173] ath11k c000000.wifi: fw_version 0x290b84a5 fw_build_timestamp 2024-09-23 11:32 fw_build_id WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1
[   16.407473] ath11k c000000.wifi: htt event 48 not handled
[   20.499939] br-lan: port 1(lan1) entered blocking state
[   20.499984] br-lan: port 1(lan1) entered disabled state
[   20.504017] nss-dp 3a001000.dp1 lan1: entered allmulticast mode
[   20.509514] nss-dp 3a001000.dp1 lan1: entered promiscuous mode
[   20.524034] br-lan: port 2(lan2) entered blocking state
[   20.524078] br-lan: port 2(lan2) entered disabled state
[   20.528191] nss-dp 3a001200.dp2 lan2: entered allmulticast mode
[   20.533493] nss-dp 3a001200.dp2 lan2: entered promiscuous mode
[   20.545624] br-lan: port 3(lan3) entered blocking state
[   20.545670] br-lan: port 3(lan3) entered disabled state
[   20.550313] nss-dp 3a001400.dp3 lan3: entered allmulticast mode
[   20.555639] nss-dp 3a001400.dp3 lan3: entered promiscuous mode
[   20.565332] br-lan: port 4(lan4) entered blocking state
[   20.567228] br-lan: port 4(lan4) entered disabled state
[   20.572451] nss-dp 3a001600.dp4 lan4: entered allmulticast mode
[   20.578009] nss-dp 3a001600.dp4 lan4: entered promiscuous mode
[   23.607847] nss-dp 3a001000.dp1 lan1: PHY Link up speed: 1000
[   23.607907] br-lan: port 1(lan1) entered blocking state
[   23.612587] br-lan: port 1(lan1) entered forwarding state
[   33.767592] l11: disabling
root@OpenWrt:~#

A-Somebody_8272 · May 8, 2025, 6:08pm

Starting kernel ...

Jumping to AARCH64 kernel via monitor
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 6.6.89 (professor_jonny@MRSPARKLE) (aarch64-openwrt                                                                                                                                   -linux-musl-gcc (OpenWrt GCC 14.2.0 r29478-09b7cc291a) 14.2.0, GNU ld (GNU Binut                                                                                                                                   ils) 2.42) #0 SMP Thu May  8 11:59:51 2025
[    0.000000] Machine model: Ubiquiti Amplifi Alien Router
[    0.000000] OF: reserved mem: 0x0000000040000000..0x0000000040ffffff (16384 K                                                                                                                                   iB) nomap non-reusable nss@40000000
[    0.000000] OF: reserved mem: 0x000000004a400000..0x000000004a5fffff (2048 Ki                                                                                                                                   B) nomap non-reusable tzapp@4a400000
[    0.000000] OF: reserved mem: 0x000000004a600000..0x000000004a9fffff (4096 Ki                                                                                                                                   B) nomap non-reusable bootloader@4a600000
[    0.000000] OF: reserved mem: 0x000000004aa00000..0x000000004aafffff (1024 Ki                                                                                                                                   B) nomap non-reusable sbl@4aa00000
[    0.000000] OF: reserved mem: 0x000000004ab00000..0x000000004abfffff (1024 Ki                                                                                                                                   B) nomap non-reusable smem@4ab00000
[    0.000000] OF: reserved mem: 0x000000004ac00000..0x000000004affffff (4096 Ki                                                                                                                                   B) nomap non-reusable memory@4ac00000
[    0.000000] OF: reserved mem: 0x000000004b000000..0x0000000050efffff (97280 K                                                                                                                                   iB) nomap non-reusable wcnss@4b000000
[    0.000000] OF: reserved mem: 0x0000000050f00000..0x0000000050ffffff (1024 Ki                                                                                                                                   B) nomap non-reusable q6_etr_dump@50f00000
[    0.000000] OF: reserved mem: 0x0000000051000000..0x00000000510fffff (1024 Ki                                                                                                                                   B) nomap non-reusable m3_dump@51000000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000040ffffff]
[    0.000000]   node   0: [mem 0x0000000041000000-0x000000004a3fffff]
[    0.000000]   node   0: [mem 0x000000004a400000-0x00000000510fffff]
[    0.000000]   node   0: [mem 0x0000000051100000-0x000000007fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] psci: OSI mode supported.
[    0.000000] psci: [Firmware Bug]: failed to set PC mode: -1
[    0.000000] percpu: Embedded 18 pages/cpu s35624 r8192 d29912 u73728
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: console=ttyMSM0,115200 ubi.mtd=ubi  rootfsty                                                                                                                                   pe=squashfs rootwait root=/dev/ubiblock0_1
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes,                                                                                                                                    linear)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, li                                                                                                                                   near)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 258048
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 1MB
[    0.000000] software IO TLB: area num 4.
[    0.000000] software IO TLB: mapped [mem 0x000000007eb00000-0x000000007ec0000                                                                                                                                   0] (1MB)
[    0.000000] Memory: 870524K/1048576K available (8448K kernel code, 916K rwdat                                                                                                                                   a, 2536K rodata, 16320K init, 279K bss, 178052K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jif                                                                                                                                   fies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv2m: range[mem 0x0b00a000-0x0b00affc], SPI[448:479]
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt                                                                                                                                   ).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles:                                                                                                                                    0x46d987e47, max_idle_ns: 440795202767 ns
[    0.000000] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 43980                                                                                                                                   46511078ns
[    0.000108] Calibrating delay loop (skipped), value calculated using timer fr                                                                                                                                   equency.. 38.40 BogoMIPS (lpj=192000)
[    0.000122] pid_max: default: 32768 minimum: 301
[    0.005131] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, line                                                                                                                                   ar)
[    0.005145] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes,                                                                                                                                    linear)
[    0.009371] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adju                                                                                                                                   st=1 rcu_task_cpu_ids=4.
[    0.009598] rcu: Hierarchical SRCU implementation.
[    0.009603] rcu:     Max phase no-delay instances is 1000.
[    0.010557] smp: Bringing up secondary CPUs ...
[    0.011216] Detected VIPT I-cache on CPU1
[    0.011322] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.011990] Detected VIPT I-cache on CPU2
[    0.012061] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.012710] Detected VIPT I-cache on CPU3
[    0.012777] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.012845] smp: Brought up 1 node, 4 CPUs
[    0.012853] SMP: Total of 4 processors activated.
[    0.012858] CPU features: detected: 32-bit EL0 Support
[    0.012863] CPU features: detected: CRC32 instructions
[    0.012925] CPU features: emulated: Privileged Access Never (PAN) using TTBR0                                                                                                                                   _EL1 switching
[    0.012931] CPU: All CPU(s) started at EL1
[    0.012934] alternatives: applying system-wide alternatives
[    0.024243] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, ma                                                                                                                                   x_idle_ns: 19112604462750000 ns
[    0.024270] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.026000] pinctrl core: initialized pinctrl subsystem
[    0.028113] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.028683] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.028722] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allo                                                                                                                                   cations
[    0.028756] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic al                                                                                                                                   locations
[    0.029160] thermal_sys: Registered thermal governor 'step_wise'
[    0.029218] cpuidle: using governor menu
[    0.029439] ASID allocator initialised with 65536 entries
[    0.036897] /soc@0/phy@84000/phy@84200: Fixed dependency cycle(s) with /soc@0                                                                                                                                   /gcc@1800000
[    0.036989] /soc@0/gcc@1800000: Fixed dependency cycle(s) with /soc@0/phy@840                                                                                                                                   00/phy@84200
[    0.037940] /soc@0/phy@84000: Fixed dependency cycle(s) with /soc@0/gcc@18000                                                                                                                                   00
[    0.037957] /soc@0/phy@84000/phy@84200: Fixed dependency cycle(s) with /soc@0                                                                                                                                   /gcc@1800000
[    0.040082] /soc@0/phy@84000/phy@84200: Fixed dependency cycle(s) with /soc@0                                                                                                                                   /gcc@1800000
[    0.040151] /soc@0/phy@84000: Fixed dependency cycle(s) with /soc@0/gcc@18000                                                                                                                                   00
[    0.040420] /soc@0/gcc@1800000: Fixed dependency cycle(s) with /soc@0/phy@840                                                                                                                                   00/phy@84200
[    0.088076] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count:                                                                                                                                    4
[    0.090292] Modules: 25600 pages in range for non-PLT usage
[    0.090300] Modules: 517120 pages in range for PLT usage
[    0.095077] SCSI subsystem initialized
[    0.095284] usbcore: registered new interface driver usbfs
[    0.095318] usbcore: registered new interface driver hub
[    0.095354] usbcore: registered new device driver usb
[    0.095801] qcom_scm: convention: smc arm 64
[    0.097558] clocksource: Switched to clocksource arch_sys_counter
[    0.101341] NET: Registered PF_INET protocol family
[    0.101499] IP idents hash table entries: 16384 (order: 5, 131072 bytes, line                                                                                                                                   ar)
[    0.104041] tcp_listen_portaddr_hash hash table entries: 512 (order: 1, 8192                                                                                                                                    bytes, linear)
[    0.104065] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes,                                                                                                                                    linear)
[    0.104080] TCP established hash table entries: 8192 (order: 4, 65536 bytes,                                                                                                                                    linear)
[    0.104165] TCP bind hash table entries: 8192 (order: 6, 262144 bytes, linear                                                                                                                                   )
[    0.104435] TCP: Hash tables configured (established 8192 bind 8192)
[    0.104962] MPTCP token hash table entries: 1024 (order: 2, 24576 bytes, line                                                                                                                                   ar)
[    0.105141] UDP hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.105178] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.105623] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.105663] PCI: CLS 0 bytes, default 64
[    0.119437] workingset: timestamp_bits=46 max_order=18 bucket_order=0
[    0.120005] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.120016] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORIT                                                                                                                                   Y) (c) 2001-2006 Red Hat, Inc.
[    0.130163] qcom-qmp-usb-phy 58000.phy: supply vdda-phy not found, using dumm                                                                                                                                   y regulator
[    0.130349] qcom-qmp-usb-phy 58000.phy: supply vdda-pll not found, using dumm                                                                                                                                   y regulator
[    0.131860] qcom-qmp-usb-phy 78000.phy: supply vdda-phy not found, using dumm                                                                                                                                   y regulator
[    0.132000] qcom-qmp-usb-phy 78000.phy: supply vdda-pll not found, using dumm                                                                                                                                   y regulator
[    0.133899] qcom-qusb2-phy 59000.phy: supply vdd not found, using dummy regul                                                                                                                                   ator
[    0.134054] qcom-qusb2-phy 59000.phy: supply vdda-pll not found, using dummy                                                                                                                                    regulator
[    0.134133] qcom-qusb2-phy 59000.phy: supply vdda-phy-dpdm not found, using d                                                                                                                                   ummy regulator
[    0.134303] qcom-qusb2-phy 59000.phy: Registered Qcom-QUSB2 phy
[    0.134516] qcom-qusb2-phy 79000.phy: supply vdd not found, using dummy regul                                                                                                                                   ator
[    0.134640] qcom-qusb2-phy 79000.phy: supply vdda-pll not found, using dummy                                                                                                                                    regulator
[    0.134682] qcom-qusb2-phy 79000.phy: supply vdda-phy-dpdm not found, using d                                                                                                                                   ummy regulator
[    0.134843] qcom-qusb2-phy 79000.phy: Registered Qcom-QUSB2 phy
[    0.137341] gpio-export lcm_boot0: 3 gpio(s) exported
[    0.138779] qcom-pcie 20000000.pci: host bridge /soc@0/pci@20000000 ranges:
[    0.138841] qcom-pcie 20000000.pci:       IO 0x0020200000..0x002020ffff -> 0x                                                                                                                                   0000000000
[    0.138868] qcom-pcie 20000000.pci:      MEM 0x0020220000..0x002fffffff -> 0x                                                                                                                                   0020220000
[    0.146175] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.147240] msm_serial 78af000.serial: msm_serial: detected port #2
[    0.147283] msm_serial 78af000.serial: uartclk = 19200000
[    0.147668] 78af000.serial: ttyMSM2 at MMIO 0x78af000 (irq = 20, base_baud =                                                                                                                                    1200000) is a MSM
[    0.148180] msm_serial 78b1000.serial: msm_serial: detected port #1
[    0.148215] msm_serial 78b1000.serial: uartclk = 19200000
[    0.148571] 78b1000.serial: ttyMSM1 at MMIO 0x78b1000 (irq = 23, base_baud =                                                                                                                                    1200000) is a MSM
[    0.149022] msm_serial 78b3000.serial: msm_serial: detected port #0
[    0.149071] msm_serial 78b3000.serial: uartclk = 3686400
[    0.149406] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 24, base_baud =                                                                                                                                    230400) is a MSM
[    0.149435] msm_serial: console setup on port #0
[    0.149475] printk: console [ttyMSM0] enabled
[    0.269141] qcom-pcie 20000000.pci: iATU: unroll T, 8 ob, 8 ib, align 4K, lim                                                                                                                                   it 1024G
[    0.271210] msm_serial: driver initialized
[    1.136340] loop: module loaded
[    1.137969] nand: device found, Manufacturer ID: 0xef, Chip ID: 0xaa
[    1.138300] nand: Winbond W29N02GZ
[    1.144889] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB siz                                                                                                                                   e: 64
[    1.267646] qcom-pcie 20000000.pci: Phy link never came up
[    1.268159] qcom-pcie 20000000.pci: PCI host bridge to bus 0000:00
[    1.272050] pci_bus 0000:00: root bus resource [bus 00-ff]
[    1.278245] pci_bus 0000:00: root bus resource [io  0x0000-0xffff]
[    1.283674] pci_bus 0000:00: root bus resource [mem 0x20220000-0x2fffffff]
[    1.289896] pci 0000:00:00.0: [17cb:1002] type 01 class 0x060400
[    1.296752] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x00000fff]
[    1.302961] pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
[    1.312277] 1 fixed-partitions partitions found on MTD device qcom_nand.0
[    1.312764] pci 0000:00:00.0: BAR 0: assigned [mem 0x20220000-0x20220fff]
[    1.315097] Creating 1 MTD partitions on "qcom_nand.0":
[    1.321889] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    1.328643] 0x000000000000-0x000010000000 : "ubi"
[    1.336475] pcieport 0000:00:00.0: PME: Signaling with IRQ 26
[    1.344066] pcieport 0000:00:00.0: AER: enabled with IRQ 26
[    1.540113] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    1.541037] spi-nor spi0.0: mx25u6435f (8192 Kbytes)
[    1.565492] 21 fixed-partitions partitions found on MTD device spi0.0
[    1.565549] Creating 21 MTD partitions on "spi0.0":
[    1.570954] 0x000000000000-0x000000050000 : "0:SBL1"
[    1.576230] 0x000000050000-0x000000060000 : "0:MIBIB"
[    1.581430] 0x000000060000-0x000000080000 : "0:BOOTCONFIG"
[    1.586248] 0x000000080000-0x0000000a0000 : "0:BOOTCONFIG1"
[    1.591690] 0x0000000a0000-0x000000220000 : "0:QSEE"
[    1.597078] 0x000000220000-0x0000003a0000 : "0:QSEE_1"
[    1.602315] 0x0000003a0000-0x0000003b0000 : "0:DEVCFG"
[    1.607284] 0x0000003b0000-0x0000003c0000 : "0:DEVCFG_1"
[    1.612435] 0x0000003c0000-0x0000003d0000 : "0:APDP"
[    1.617889] 0x0000003d0000-0x0000003e0000 : "0:APDP_1"
[    1.622853] 0x0000003e0000-0x000000420000 : "0:RPM"
[    1.627763] 0x000000420000-0x000000460000 : "0:RPM_1"
[    1.632508] 0x000000460000-0x000000470000 : "0:CDT"
[    1.637816] 0x000000470000-0x000000480000 : "0:CDT_1"
[    1.642398] 0x000000480000-0x000000490000 : "0:u-boot-env"
[    1.647659] 0x000000490000-0x000000530000 : "0:u-boot"
[    1.653004] 0x000000530000-0x0000005d0000 : "0:u-boot2"
[    1.658188] 0x0000005d0000-0x000000610000 : "0:ART"
[    1.663271] 0x000000610000-0x000000620000 : "0:eeprom"
[    1.668129] 0x000000620000-0x000000690000 : "0:reserved"
[    1.673342] 0x000000690000-0x0000006a0000 : "0:prst"
[    1.687242] spmi spmi-0: PMIC arbiter version v2 (0x20010000)
[    1.801844] i2c_dev: i2c /dev entries driver
[    1.809710] sdhci: Secure Digital Host Controller Interface driver
[    1.809756] sdhci: Copyright(c) Pierre Ossman
[    1.814791] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.821242] remoteproc remoteproc0: releasing cd00000.q6v5_wcss
[    1.828602] NET: Registered PF_INET6 protocol family
[    1.832007] Segment Routing with IPv6
[    1.835836] In-situ OAM (IOAM) with IPv6
[    1.839483] NET: Registered PF_PACKET protocol family
[    1.843513] 8021q: 802.1Q VLAN Support v1.8
[    1.879605] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count:                                                                                                                                    4
[    1.879943] cpr4_ipq807x_apss_read_fuse_data: apc_corner: speed bin = 0
[    1.885732] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR fusing revision                                                                                                                                    = 1
[    1.892384] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR misc fuse value                                                                                                                                    = 0
[    1.900023] cpr4_ipq807x_apss_read_fuse_data: apc_corner: Voltage boost fuse                                                                                                                                    config = 0 boost = disable
[    1.907526] cpr3_mem_acc_init: apc: not using memory accelerator regulator
[    1.916635] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused                                                                                                                                         SVS: open-loop= 704000 uV
[    1.923606] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused                                                                                                                                         NOM: open-loop= 816000 uV
[    1.933593] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused                                                                                                                                       TURBO: open-loop= 880000 uV
[    1.943405] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused                                                                                                                                      STURBO: open-loop= 960000 uV
[    1.953287] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused                                                                                                                                         SVS: quot[ 7]= 736, quot_offset[ 7]=   0
[    1.963021] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused                                                                                                                                         NOM: quot[ 7]= 945, quot_offset[ 7]= 205
[    1.973872] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused                                                                                                                                       TURBO: quot[ 7]=1053, quot_offset[ 7]= 105
[    1.984807] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused                                                                                                                                      STURBO: quot[ 7]=1196, quot_offset[ 7]= 140
[    1.995974] cpr3_regulator_init_ctrl: apc: Default CPR mode = closed-loop
[    1.999341] cpufreq: cpufreq_online: CPU0: Running at unlisted initial freque                                                                                                                                   ncy: 800000 KHz, changing to: 1017600 KHz
[    2.015306] remoteproc remoteproc0: cd00000.q6v5_wcss is available
[    2.024432] ubi0: attaching mtd0
[    2.667557] random: crng init done
[    3.166504] ubi0: scanning is finished
[    3.174459] ubi0: attached mtd0 (name "ubi", size 256 MiB)
[    3.174500] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.178860] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.185705] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.192569] ubi0: good PEBs: 2048, bad PEBs: 0, corrupted PEBs: 0
[    3.199338] ubi0: user volume: 10, internal volumes: 1, max. volumes count: 1                                                                                                                                   28
[    3.205585] ubi0: max/mean erase counter: 42/26, WL threshold: 4096, image se                                                                                                                                   quence number: 553677150
[    3.212718] ubi0: available PEBs: 418, total reserved PEBs: 1630, PEBs reserv                                                                                                                                   ed for bad PEB handling: 40
[    3.222098] ubi0: background thread "ubi_bgt0d" started, PID 698
[    3.232217] block ubiblock0_5: created from ubi0:5(rootfs)
[    3.237639] ubiblock: device ubiblock0_5 (rootfs) set to be root filesý[    3                                                                                                                                   .256879] Freeing unused kernel memory: 16320K
[    3.257005] Run /init as init process
[    3.520014] init: Console is alive
[    3.520136] init: - watchdog -
[    3.531779] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.545874] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    3.546452] gpio-keys: probe of gpio_keys failed with error -16
[    3.563357] ssdk_dt_parse_interrupt[941]:INFO:intr-gpio does not exist
[    3.993707] regi_init[2525]:INFO:Initializing HPPE Done!!
[    3.993851] regi_init[2574]:INFO:qca-ssdk module init succeeded!
[    4.000401] EDMA ver 1 hw init
[    4.004390] EDMA HW Reset completed succesfully
[    4.007065] Num rings - TxDesc:1 (23-23) TxCmpl:1 (7-7)
[    4.011479] RxDesc:1 (15-15) RxFill:1 (7-7)
[    4.208332] Qualcomm QCA8075 90000.mdio-1:00: attached PHY driver (mii_bus:ph                                                                                                                                   y_addr=90000.mdio-1:00, irq=POLL)
[    4.209446] GMAC2(ffffff8002ef2900) Invalid MAC@ - using 16:91:0f:70:cb:f8
[    4.287923] Qualcomm QCA8075 90000.mdio-1:01: attached PHY driver (mii_bus:ph                                                                                                                                   y_addr=90000.mdio-1:01, irq=POLL)
[    4.289009] GMAC3(ffffff80077da900) Invalid MAC@ - using 82:ae:12:76:12:6c
[    4.357918] Qualcomm QCA8075 90000.mdio-1:02: attached PHY driver (mii_bus:ph                                                                                                                                   y_addr=90000.mdio-1:02, irq=POLL)
[    4.358938] GMAC4(ffffff80077d9900) Invalid MAC@ - using 0e:3b:9a:48:cb:0f
[    4.437893] Qualcomm QCA8075 90000.mdio-1:03: attached PHY driver (mii_bus:ph                                                                                                                                   y_addr=90000.mdio-1:03, irq=POLL)
[    4.527909] Qualcomm QCA8075 90000.mdio-1:04: attached PHY driver (mii_bus:ph                                                                                                                                   y_addr=90000.mdio-1:04, irq=POLL)
[    4.528747] **********************************************************
[    4.536823] * NSS Data Plane driver
[    4.543339] **********************************************************
[    4.563551] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    4.563599] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus nu                                                                                                                                   mber 1
[    4.568075] xhci-hcd xhci-hcd.1.auto: hcc params 0x0220fe65 hci version 0x110                                                                                                                                    quirks 0x0000008002000010
[    4.575528] xhci-hcd xhci-hcd.1.auto: irq 46, io mem 0x08a00000
[    4.584951] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    4.590773] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus nu                                                                                                                                   mber 2
[    4.596326] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed
[    4.604283] hub 1-0:1.0: USB hub found
[    4.610556] hub 1-0:1.0: 1 port detected
[    4.614456] usb usb2: We don't know the algorithms for LPM for this host, dis                                                                                                                                   abling LPM.

A-Somebody_8272 · May 8, 2025, 6:10pm

part 2 of the bootlog:

abling LPM.
[    4.618773] hub 2-0:1.0: USB hub found
[    4.626374] hub 2-0:1.0: 1 port detected
[    4.630424] xhci-hcd xhci-hcd.2.auto: xHCI Host Controller
[    4.633998] xhci-hcd xhci-hcd.2.auto: new USB bus registered, assigned bus nu                                                                                                                                   mber 3
[    4.639463] xhci-hcd xhci-hcd.2.auto: hcc params 0x0220fe65 hci version 0x110                                                                                                                                    quirks 0x0000008002000010
[    4.646883] xhci-hcd xhci-hcd.2.auto: irq 47, io mem 0x08c00000
[    4.656305] xhci-hcd xhci-hcd.2.auto: xHCI Host Controller
[    4.662128] xhci-hcd xhci-hcd.2.auto: new USB bus registered, assigned bus nu                                                                                                                                   mber 4
[    4.667689] xhci-hcd xhci-hcd.2.auto: Host supports USB 3.0 SuperSpeed
[    4.675590] hub 3-0:1.0: USB hub found
[    4.681850] hub 3-0:1.0: 1 port detected
[    4.685812] usb usb4: We don't know the algorithms for LPM for this host, dis                                                                                                                                   abling LPM.
[    4.689950] hub 4-0:1.0: USB hub found
[    4.697731] hub 4-0:1.0: 1 port detected
[    4.702601] kmodloader: done loading kernel modules from /etc/modules-boot.d/                                                                                                                                   *
[    4.707983] init: - preinit -
Cannot parse config file '/etc/fw_env.config': No such file or directory
Failed to find NVMEM device
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    4.977566] usb 3-1: new full-speed USB device number 2 using xhci-hcd
[    8.007749] nss-dp 3a001000.dp1 lan1: PHY Link up speed: 1000
[    8.929442] nss-dp 3a001000.dp1 lan1: PHY Link is down
[    8.933072] procd: - early -
[    8.933536] procd: - watchdog -
[    9.463357] procd: - watchdog -
[    9.463602] procd: - ubus -
[    9.517074] procd: - init -
Please press Enter to activate this console.
[    9.662402] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.775654] hid: raw HID events driver (C) Jiri Kosina
[    9.776415] GACT probability on
[    9.780427] Mirror/redirect action on
[    9.786239] u32 classifier
[    9.786540]     input device check on
[    9.789163]     Actions configured
[    9.802551] Bluetooth: Core ver 2.22
[    9.802679] NET: Registered PF_BLUETOOTH protocol family
[    9.805199] Bluetooth: HCI device and connection manager initialized
[    9.810537] Bluetooth: HCI socket layer initialized
[    9.816831] Bluetooth: L2CAP socket layer initialized
[    9.821448] Bluetooth: SCO socket layer initialized
[    9.823728] urngd: v1.0.2 started.
[    9.831511] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[    9.834800] Bluetooth: BNEP filters: protocol multicast
[    9.840284] Bluetooth: BNEP socket layer initialized
[    9.845741] Loading modules backported from Linux version v6.12.6-0-ge9d65b48                                                                                                                                   ce1a
[    9.850450] Backport generated by backports.git v6.1.110-1-35-g410656ef04d2
[    9.858556] Bluetooth: HCI UART driver ver 2.3
[    9.864573] Bluetooth: HCI UART protocol H4 registered
[    9.869102] Bluetooth: HCI UART protocol BCSP registered
[    9.875000] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[    9.879707] Bluetooth: HIDP socket layer initialized
[    9.902427] NET: Registered PF_QIPCRTR protocol family
[    9.904202] Bluetooth: RFCOMM TTY layer initialized
[    9.906470] Bluetooth: RFCOMM socket layer initialized
[    9.911336] Bluetooth: RFCOMM ver 1.11
[    9.925567] xt_time: kernel timezone is -0000
[    9.957045] PPP generic driver version 2.4.2
[    9.957944] NET: Registered PF_PPPOX protocol family
[    9.962051] wireguard: WireGuard 1.0.0 loaded. See www.wireguard.com for info                                                                                                                                   rmation.
[    9.965336] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c                                                                                                                                   4.com>. All Rights Reserved.
[    9.991795] ath11k c000000.wifi: ipq8074 hw2.0
[    9.991828] ath11k c000000.wifi: FW memory mode: 0
[   10.013169] remoteproc remoteproc0: powering up cd00000.q6v5_wcss
[   10.013268] remoteproc remoteproc0: Booting fw image IPQ8074/q6_fw.mdt, size                                                                                                                                    668
[   10.364249] remoteproc remoteproc0: remote processor cd00000.q6v5_wcss is now                                                                                                                                    up
[   10.408208] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3                                                                                                                                    dump mem req
[   10.415647] ath11k c000000.wifi: chip_id 0x0 chip_family 0x0 board_id 0xff so                                                                                                                                   c_id 0xffffffff
[   10.415683] ath11k c000000.wifi: fw_version 0x290b84a5 fw_build_timestamp 202                                                                                                                                   4-09-23 11:32 fw_build_id WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1
[   15.700798] remoteproc remoteproc0: stopped remote processor cd00000.q6v5_wcs                                                                                                                                   s
[   15.700840] remoteproc remoteproc0: powering up cd00000.q6v5_wcss
[   15.706981] remoteproc remoteproc0: Booting fw image IPQ8074/q6_fw.mdt, size                                                                                                                                    668
[   16.056997] remoteproc remoteproc0: remote processor cd00000.q6v5_wcss is now                                                                                                                                    up
[   16.060556] kmodloader: done loading kernel modules from /etc/modules.d/*
[   16.100678] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3                                                                                                                                    dump mem req
[   16.108137] ath11k c000000.wifi: chip_id 0x0 chip_family 0x0 board_id 0xff so                                                                                                                                   c_id 0xffffffff
[   16.108173] ath11k c000000.wifi: fw_version 0x290b84a5 fw_build_timestamp 202                                                                                                                                   4-09-23 11:32 fw_build_id WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1
[   16.407473] ath11k c000000.wifi: htt event 48 not handled
[   20.499939] br-lan: port 1(lan1) entered blocking state
[   20.499984] br-lan: port 1(lan1) entered disabled state
[   20.504017] nss-dp 3a001000.dp1 lan1: entered allmulticast mode
[   20.509514] nss-dp 3a001000.dp1 lan1: entered promiscuous mode
[   20.524034] br-lan: port 2(lan2) entered blocking state
[   20.524078] br-lan: port 2(lan2) entered disabled state
[   20.528191] nss-dp 3a001200.dp2 lan2: entered allmulticast mode
[   20.533493] nss-dp 3a001200.dp2 lan2: entered promiscuous mode
[   20.545624] br-lan: port 3(lan3) entered blocking state
[   20.545670] br-lan: port 3(lan3) entered disabled state
[   20.550313] nss-dp 3a001400.dp3 lan3: entered allmulticast mode
[   20.555639] nss-dp 3a001400.dp3 lan3: entered promiscuous mode
[   20.565332] br-lan: port 4(lan4) entered blocking state
[   20.567228] br-lan: port 4(lan4) entered disabled state
[   20.572451] nss-dp 3a001600.dp4 lan4: entered allmulticast mode
[   20.578009] nss-dp 3a001600.dp4 lan4: entered promiscuous mode
[   23.607847] nss-dp 3a001000.dp1 lan1: PHY Link up speed: 1000
[   23.607907] br-lan: port 1(lan1) entered blocking state
[   23.612587] br-lan: port 1(lan1) entered forwarding state



BusyBox v1.37.0 (2025-05-06 04:13:46 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r29478-62bba515d2
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------

 OpenWrt recently switched to the "apk" package manager!

 OPKG Command           APK Equivalent      Description
 ------------------------------------------------------------------
 opkg install <pkg>     apk add <pkg>       Install a package
 opkg remove <pkg>      apk del <pkg>       Remove a package
 opkg upgrade           apk upgrade         Upgrade all packages
 opkg files <pkg>       apk info -L <pkg>   List package contents
 opkg list-installed    apk info            List installed packages
 opkg update            apk update          Update package lists
 opkg search <pkg>      apk search <pkg>    Search for packages
 ------------------------------------------------------------------

For more https://openwrt.org/docs/guide-user/additional-software/opkg-to-apk-cheatsheet

professor_jonny · May 9, 2025, 11:07pm

Found some bugs in the stock device posted on their forums:

Amplify Alien Router AFI-ALN-R PCIE perst-gpio address and smem_ptable entry bug. | Ubiquiti Community

professor_jonny · May 9, 2025, 11:35pm

Also of note in the stock device the lcm module uses a binary in usr\bin called uictld to communicate with the lcd so it seems.

There is an init script in etc\init.d with the same name that goes with it.

The gpio in the dts attached to the lcm I have updated with info how to put it into dfu firmware mode to update the firmware, there is scripts to do this from the stock dts with a binary to push firmware to it.

You can extract the firmware and replace images from the firmware so it seems, I'm no reverse engineer but one could pick apart the firmware and binary to make a simple translation layer between OpenWrt and the lcm module and ubus.

If you had a device and enough time you could likely work out the message format with a serial debugger and play with it and get it going without too much hassle.
the message format is likely just (command) (data) and you get a reply you could run sercom or something on your stock device and dump the chatter.

I also found this and it has info about enabling debug mode with the device.

(https://github.com/alexanderhenne/AFi-R):
alexanderhenne/AFi-R: Explains how to communicate with and flash custom firmware onto the AFi-R router

A-Somebody_8272 · May 10, 2025, 12:27am

Thanks for the detailed info! I’ll take a look at /usr/bin/uictld and the init script on stock later today, see how it’s launched, and try to run strings or trace the communication. I’ll also try to log the UART traffic during boot and activity to analyze the message format. Good to know there’s DFU support and firmware image extraction too — that opens up possibilities later on. Appreciate all the digging, I’ll report back once I capture some data.

A-Somebody_8272 · May 10, 2025, 12:31am

That’s an awesome breakdown—really appreciated the effort on the PCIe reset GPIO and SMEM layout bugs. It definitely clears up why the NAND was acting odd and PCIe wasn’t functional at first. With the corrected partitioning and working serial interfaces, it feels like we’re finally at the base we need.

I’ll get started later on gathering more LCM details (uictld, serial spy, firmware dump) from stock so we can start figuring out the message format. The whole DFU firmware update flow looks promising too. Will keep you posted!

professor_jonny · May 10, 2025, 1:49am

Yip the smem is all messed up but it is hopefully correct now.
of note there is no uboot args in any of the dumps you posted.
so if you can redump every mtd with the last image and post it that would be awesome.

We will know if the dump is good if SBL1 is 0x50000 in size.

I think because of the smem it just dumped the invalid smem partition map from it so it is all junk, I thaught smem was translating the addresses but that is not the case.

You will notice every partition from spi is exactly half the size of the nand one, I'd be guessing they slapped on a smaller spi chip in production and just decided to fix the partition map in the dts.

spi_nor from stock dts:

mtd0: 00050000 00010000 "SBL1"
mtd1: 00010000 00010000 "MIBIB"
mtd2: 00020000 00010000 "BOOTCONFIG"
mtd3: 00020000 00010000 "BOOTCONFIG1"
mtd4: 00180000 00010000 "QSEE"
mtd5: 00180000 00010000 "QSEE_1"
mtd6: 00010000 00010000 "DEVCFG"
mtd7: 00010000 00010000 "DEVCFG_1"
mtd8: 00010000 00010000 "APDP"
mtd9: 00010000 00010000 "APDP_1"
mtd10: 00040000 00010000 "RPM"
mtd11: 00040000 00010000 "RPM_1"
mtd12: 00010000 00010000 "CDT"
mtd13: 00010000 00010000 "CDT_1"
mtd14: 00010000 00010000 "u-boot-env"
mtd15: 000a0000 00010000 "u-boot"
mtd16: 000a0000 00010000 "u-boot2"
mtd17: 00040000 00010000 "ART"
mtd18: 00010000 00010000 "eeprom"
mtd19: 00070000 00010000 "reserved"
mtd20: 00010000 00010000 "prst"

nand smem :

mtd0: 000a0000 00020000 "0:sbl1"
mtd1: 00020000 00020000 "0:mibib"
mtd2: 00040000 00020000 "0:bootconfig"
mtd3: 00040000 00020000 "0:bootconfig1"
mtd4: 00300000 00020000 "0:qsee"
mtd5: 00300000 00020000 "0:qsee_1"
mtd6: 00020000 00020000 "0:devcfg"
mtd7: 00020000 00020000 "0:devcfg_1"
mtd8: 00020000 00020000 "0:apdp"
mtd9: 00020000 00020000 "0:apdp_1"
mtd10: 00080000 00020000 "0:rpm"
mtd11: 00080000 00020000 "0:rpm_1"
mtd12: 00020000 00020000 "0:cdt"
mtd13: 00020000 00020000 "0:cdt_1"
mtd14: 00020000 00020000 "0:appsblenv"
mtd15: 00140000 00020000 "0:appsbl"
mtd16: 00140000 00020000 "0:appsbl_1"
mtd17: 00080000 00020000 "0:art"
mtd18: 00020000 00020000 "0:eeprom"
mtd19: 000e0000 00020000 "0:reserved"
mtd20: 00020000 00020000 "0:prst"
mtd21: 07800000 00020000 "rootfs"
mtd22: 00800000 00020000 "0:wififw"
mtd23: 03400000 00020000 "rootfs_1"
mtd24: 00800000 00020000 "0:wififw_1"

This is the actual layout of nand (big difference!!):

mtd0: 10000000 00020000 "ubi"

Here is conformation of ubi.mtd image:

The other thing smem is all in lower case when in dts it is not.

professor_jonny · May 10, 2025, 2:07am

I have created a new image It might fix mtd ordering or it may muck up by over writing the partition map with smem entries. if you could try this at some stage.

I managed to use binwalk to extract images from the lcm module's firmware too

A-Somebody_8272 · May 10, 2025, 12:47pm

Hey, thanks for all the updates! I’m about to flash the latest image you uploaded.

Once it’s up, I’ll:
• check the MTD layout (looking for the corrected SBL1 size),
• verify if UBI is mounting cleanly,
• and run the debug dump script again with clean partitions.

I’ll also double-check the outputs from dmesg, cat /proc/mtd, and other key stuff to confirm everything looks correct now.

Once I have the full set of clean dumps, I’ll upload and share the archive link here.

Also, if you have the LCM firmware binwalk-extracted contents, could you send those over? I might poke around in them and see what’s possible on that front too.

A-Somebody_8272 · May 10, 2025, 12:50pm

I saw, I commented on it.

That guy wants you to change the TAG to AmpliFi I guess.

A-Somebody_8272 · May 10, 2025, 1:53pm

Here’s the latest full dump and debug log from the new image you built:

Download:

It includes:

debug_logs/: Full dmesg, /proc/mtd, tty, hwmon, mount status, ubinfo, MACs, and all partition hexdumps
nand_dumps/: Raw dumps of all MTD partitions (mtdblock0 through mtdblock21)

Let me know if anything’s missing or needs retesting!

professor_jonny · May 10, 2025, 9:26pm

What device has the mac address: 24:5a:4c:82:48:2e as that picked up the correct one?

by chance can you use setenv then saveenv from uboot and alter the IP address or something then dump the mtd again and see which one has a different CRC I still cantt find the envargs it is not in the env or eeprom it looks to be in the uboot partition but it is only 0xf8 in size as there is stuff straight after and it seems very small even smaller than the block size, so that just might be the default and until you change something it might not write any env args in another location.

This address is at address 6CA73 in mtd16 (uboot)

This is the actual uboot partition and we need to get this correct as it will brick the device if the envargs overwrite any thing important if we have the address wrong.

A-Somebody_8272 · May 10, 2025, 10:29pm

“Got it, I’ll try that later and let you know once I’ve done the tests.”

professor_jonny · May 11, 2025, 1:29am

In regards to extracting the images from the LCM you first need to extract the nand and one of those partitions in it is the lcm image.
You just need ubireader and binwalk and sasquatch.
you might have to patch and compile sasquatch as currently it is not building on ubuntu.

The process will be something like below:

ubireader_extract_images -l mtd21-ubi.bin             ( extract 256mb nand into the mtd components)
binwalk -e mtd31-lcm.bin                              (extract lcm image)
binwalk --dd=".*" alien-lcm-fw-ext-flash.bin          (dump files from firmware package)
find . -type f -exec mv '{}' '{}'.jpg \;              ( append extensions to dumped files)

Of note as they have used something like bin to hex and the other files are appended to each other when you dump them.
So each new jpeg has the rest of the jpgs following them in the file appended to the end of them.
This makes each 40*40 odd pixel jpg take up about 4MB and less as they get near the end so the original 14MB file becomes something like 1TB for 4000 odd images
I did not have the enthusiasm to edit the jpeg's and upload them I could not think of a way to script the dumping I'll leave that up to you...

A-Somebody_8272 · May 11, 2025, 8:47pm

Hey! I’ll likely be busy for the next 1–2 days, so I probably won’t get a chance to test or dump anything until then. I’ll pick things back up as soon as I can. Thanks again for all your work on this! See ya later😃.

A-Somebody_8272 · May 11, 2025, 8:51pm

I’m guessing the jpeg images are for the devices that connect to it, just the images of the devices.

But yea we will see later.

professor_jonny · May 15, 2025, 11:53am

I have setup a wiki page:

ubiquiti afi-aln-r