IPQ8074A Tp link deco x80 5g info thread

professor_jonny · November 1, 2023, 8:16pm

Hi I brought a TP link deco x80 5g modem router.

It uses a Qualcomm IPQ8074A chipset from the Networking Pro 1210 Platform with a Snapdragon X55 5G modem chip.

Is it possible to add support for this device?
I'm keen to Help with porting this as it is a stock device used in New Zealand Vodafone/ One network.
Soon it will be used to replace all other modems that will give a cellular rollover for fiber customers and also for use with wireless internet.
.

Deco X80-5G | 5G Whole Home Wi-Fi 6 Gateway (Availability based on regions) | TP-Link

P-Link Deco X80-5G Mesh Wi-Fi System | Ultra-Fast Broadband | Qualcomm

frollic · November 1, 2023, 8:38pm

if we assume it's using a SoC supported by Linux, it'll still land on your desk, you own the device.

slh · November 1, 2023, 11:36pm

If it is indeed a ipq807xA based SOC, it should be supportable - but there are many unknowns beyond that (also on the 5g modem side of things), and someone -you- will have to do the development necessary/ file a pull request with your changes.

professor_jonny · November 2, 2023, 2:00am

I plan to pull it apart and see if i can get UART access and get a dump of the NAND.

I have read the snapdragon x55 modem RF system is the name they call the chipset it is used in the Quectel 5G RM500Q-GL and is currently working with openwrt and is just a M.2 module that works with QMI.

5G RG50xQ series | Quectel

frollic · November 2, 2023, 6:27am

If it has anything in common with the non-5G X80 product, then it's Mediatek, according to FCC.

professor_jonny · November 2, 2023, 8:33am

It is listed on the Qualcomm web site as a product using their chipset.

It is possible later versions might have different chipsets but currently there is only a version 1 available.

professor_jonny · November 7, 2023, 8:52pm

So I have now pulled it apart it was a bit confusing to figure it out but:

It has a top cover you pry off to see the fan and there is four screws, there is also Four screws under the rubber feet once they are removed you can split the shell off.
there is 14 IPEX/ U.FL connectors you need to remove to separate the side plastics,
To remove the top/ fan assembly you need to desolder one of the earth straps to slide out the antenna PCB.

As you see below it has a IPQ8074A chipset.

I'm guessing but TP1,3,2 are likely the serial output?

professor_jonny · November 7, 2023, 9:01pm

slh · November 8, 2023, 1:39am

TP1/ TP2 would be hot candidates for serial (rx/ tx, TP3 probably being GND), but be careful (especially with TP-Link) and measure the voltages first (probably 1.8V).

professor_jonny · November 8, 2023, 2:54am

I'm sure my one is 3.3/ 5v only I will have to pick up one of them.

slh · November 8, 2023, 2:58am

For sure not 5V, but even 3.3V is unlikely.

The SOC voltage for ipq807x is 1.8V, some routers use a level shifter to bump that to 'standard' 3.3V, but TP-Link (or Xiaomi) rarely are, e.g. the ipq806x based Archer c2600 is using 1.8V as well.

professor_jonny · November 24, 2023, 10:04am

So it is defiantly 1.8v and two of those pins are TX and GND but it seems the other is not RX ir it is disabled or something and the close pad TP4 is not it either.
I soldered a standard pin header to the pads as they are sturdy enough with the ground plane attached to the ground pad.

Green is Ground (tp3)
Yellow is RX (tp2)
Orange is TX tp1

115200 8n1
1.8v logic

tp2 when connected it spits out gibberish on the console it seems there is bleed/ crossover from RX and TX and requires a 10K pullup to 1.8v

Below is my log of it booting:


Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00158
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B -       201 - PBL, Start
B -      2735 - bootable_media_detect_entry, Start
B -      3443 - bootable_media_detect_success, Start
B -      3448 - elf_loader_entry, Start
B -      6115 - auth_hash_seg_entry, Start
B -      6358 - auth_hash_seg_exit, Start
B -     68383 - elf_segs_hash_verify_entry, Start
B -    131226 - PBL, End
B -    143594 - SBL1, Start
B -    195932 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B -    202459 - pm_device_init, Start
B -    324794 - PM_SET_VAL:Skip
D -    121847 - pm_device_init, Delta
B -    327204 - pm_driver_init, Start
D -      5368 - pm_driver_init, Delta
B -    333578 - clock_init, Start
D -      2135 - clock_init, Delta
B -    337513 - boot_flash_init, Start
D -     12566 - boot_flash_init, Delta
B -    353861 - boot_config_data_table_init, Start
D -      3080 - boot_config_data_table_init, Delta - (575 Bytes)
B -    361364 - Boot Setting :  0x00000618
B -    365268 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:4,Subt
ype:0
B -    372191 - sbl1_ddr_set_params, Start
B -    376004 - CPR configuration: 0x30c
B -    379359 - cpr_init, Start
B -    382226 - Rail:0 Mode: 5 Voltage: 792000
B -    387350 - CL CPR settled at 744000mV
B -    390186 - Rail:1 Mode: 5 Voltage: 880000
B -    394456 - Rail:1 Mode: 7 Voltage: 888000
D -     16531 - cpr_init, Delta
B -    401258 - Pre_DDR_clock_init, Start
B -    405345 - Pre_DDR_clock_init, End
B -    408669 - DDR Type : PCDDR3
B -    414403 - do ddr sanity test, Start
D -      1067 - do ddr sanity test, Delta
B -    419161 - DDR: Start of HAL DDR Boot Training
B -    423889 - DDR: End of HAL DDR Boot Training
B -    429562 - DDR: Checksum to be stored on flash is 1377291785
B -    439993 - Image Load, Start
D -    224327 - QSEE Image Loaded, Delta - (1376448 Bytes)
B -    664412 - Image Load, Start
D -        61 - SEC Image Loaded, Delta - (0 Bytes)
B -    672067 - Image Load, Start
D -     10736 - DEVCFG Image Loaded, Delta - (26008 Bytes)
B -    682895 - Image Load, Start
D -     22051 - RPM Image Loaded, Delta - (86584 Bytes)
B -    705007 - Image Load, Start
D -    109068 - APPSBL Image Loaded, Delta - (672668 Bytes)
B -    814197 - QSEE Execution, Start
D -        61 - QSEE Execution, Delta
B -    819992 - USB D+ check, Start
D -         0 - USB D+ check, Delta
B -    826397 - SBL1, End
D -    685091 - SBL1, Delta
S - Flash Throughput, 6745 KB/s  (2162955 Bytes,  320669 us)
S - DDR Frequency, 466 MHz
S - Core 0 Frequency, 1651 MHz


U-Boot 2016.01 (Feb 25 2021 - 20:16:45 +0800)

DRAM:  smem ram ptable found: ver: 1 len: 4
1 GiB
NAND:  Could not find nand_gpio in dts, using defaults
ONFI device found
ID = 158061c8
Vendor = c8
Device = 61
SF: Unsupported flash IDs: manuf 00, jedec 1c78, ext_jedec 4a74
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
128 MiB
MMC:   <NULL>: 0
PCI0 is not defined in the device tree
PCI1 is not defined in the device tree
In:    serial@78B3000
Out:   serial@78B3000
Err:   serial@78B3000
machid: 8010400
Card did not respond to voltage select!
eth0 MAC Address from ART is not valid
eth1 MAC Address from ART is not valid
eth2 MAC Address from ART is not valid
eth3 MAC Address from ART is not valid
eth4 MAC Address from ART is not valid
eth5 MAC Address from ART is not valid
gpio 38 set BOARD_3V9_5V_EN_GPIO to high[1] 
gpio 64 set PHY_QCA8081_1V8_EN_GPIO to high[1] 
gpio 33 set PHY_AR8033_3V3_EN_GPIO to high[1] 
gpio 35 set ONOFF_MODULE_5G_GPIO to low[0] ... 1s 
gpio 35 set ONOFF_MODULE_5G_GPIO to high[1]
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 9 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 72, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 1, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 7/3, WL threshold: 4096, image sequence 
number: 1097309032
ubi0: available PEBs: 0, total reserved PEBs: 72, PEBs reserved for ba
d PEB handling: 20
Find no boot alter flag!
Enter magic string to stop autoboot in 1 seconds
Unmounting UBIFS volume ubi_factory_data!
ubi0: detaching mtd1
ubi0: mtd1 is detached
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 42 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 336, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence 
number: 273099923
ubi0: available PEBs: 108, total reserved PEBs: 228, PEBs reserved for
 bad PEB handling: 20
Read 0 bytes from volume kernel to 44000000
No size specified -> Using max size (5713920)
## Loading kernel from FIT Image at 44000000 ...
   Using 'config@hk01.c5' configuration
   Trying 'kernel@1' kernel subimage
     Description:  ARM64 OpenWrt Linux-4.4.60
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x440000e8
     Data Size:    3857929 Bytes = 3.7 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x41080000
     Entry Point:  0x41080000
     Hash algo:    crc32
     Hash value:   db19bb74
     Hash algo:    sha1
     Hash value:   80e8e02e244a73839be2d7cb2a6f845e49cb0cc8
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
   Using 'config@hk01.c5' configuration
   Trying 'fdt@hk01.c5' fdt subimage
     Description:  ARM64 OpenWrt qcom-ipq807x-hkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x443d8698
     Data Size:    92380 Bytes = 90.2 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   3f191698
     Hash algo:    sha1
     Hash value:   d0cbc4e75fecf605333dd4a95c21ed37d26c3df4
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x443d8698
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 4a3e6000, end 4a3ff8db ... OK
Could not find PCI in device tree
Using machid 0x8010400 from environment

Starting kernel ...

Jumping to AARCH64 kernel via monitor
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.4.60 (tplink@linuxci2-sp) (gcc version 
5.2.0 (OpenWrt GCC 5.2.0 34c568b+r49254) ) #1 SMP PREEMPT Mon Apr 10 2
1:40:48 CST 2023
[    0.000000] Boot CPU: AArch64 Processor [410fd034]
[    0.000000] Ignoring memory range 0x40000000 - 0x41000000
[    0.000000] Machine: Qualcomm Technologies, Inc. IPQ807x/AP-HK01-C5
[    0.000000] efi: Getting EFI parameters from FDT:
[    0.000000] efi: UEFI not found.
[    0.000000] Reserved memory: OVERLAP DETECTED!
[    0.000000] wifi_dump@51100000 (0x0000000051100000--0x0000000051700
000) overlaps with wigig_dump@51300000 (0x0000000051300000--0x00000000
51700000)
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] PERCPU: Embedded 14 pages/cpu @ffffffc03ef43000 s19328 
r8192 d29824 u57344
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: enabling workaround for ARM erratum 84571
9
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on. 
 Total pages: 225036
[    0.000000] Kernel command line: ubi.mtd=rootfs root=mtd:ubi_rootfs
 rootfstype=squashfs rootwait swiotlb=1
[    0.000000] PID hash table entries: 4096 (order: 3, 32768 bytes)
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048
576 bytes)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288
 bytes)
[    0.000000] software IO TLB [mem 0x7fd3c000-0x7fd7c000] (0MB) mappe
d at [ffffffc03ed3c000-ffffffc03ed7bfff]
[    0.000000] Memory: 886388K/914432K available (5258K kernel code, 6
09K rwdata, 2292K rodata, 220K init, 466K bss, 28044K reserved, 0K cma
-reserved)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vmalloc : 0xffffff8000000000 - 0xffffffbdbfff0000  
 (   246 GB)
[    0.000000]     vmemmap : 0xffffffbdc0000000 - 0xffffffbfc0000000  
 (     8 GB maximum)
[    0.000000]               0xffffffbdc0040000 - 0xffffffbdc1000000  
 (    15 MB actual)
[    0.000000]     fixed   : 0xffffffbffa7fd000 - 0xffffffbffac00000  
 (  4108 KB)
[    0.000000]     PCI I/O : 0xffffffbffae00000 - 0xffffffbffbe00000  
 (    16 MB)
[    0.000000]     modules : 0xffffffbffc000000 - 0xffffffc000000000  
 (    64 MB)
[    0.000000]     memory  : 0xffffffc000000000 - 0xffffffc03f000000  
 (  1008 MB)
[    0.000000]       .init : 0xffffffc0007e2000 - 0xffffffc000819000  
 (   220 KB)
[    0.000000]       .text : 0xffffffc000080000 - 0xffffffc0007e1844  
 (  7559 KB)
[    0.000000]       .data : 0xffffffc000828000 - 0xffffffc0008c0400  
 (   609 KB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Node
s=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000]  Build-time adjustment of leaf fanout to 64.
[    0.000000] NR_IRQS:64 nr_irqs:64 0
[    0.000000] Architected cp15 timer(s) running at 19.20MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff m
ax_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[    0.000005] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps e
very 4398046511078ns
[    0.000510] Calibrating delay loop (skipped), value calculated usin
g timer frequency.. 38.40 BogoMIPS (lpj=192000)
[    0.000522] pid_max: default: 32768 minimum: 301
[    0.000613] Mount-cache hash table entries: 2048 (order: 2, 16384 b
ytes)
[    0.000623] Mountpoint-cache hash table entries: 2048 (order: 2, 16
384 bytes)
[    0.001281] EFI services will not be available.
[    0.001307] ASID allocator initialised with 65536 entries
[    0.051943] MSM Memory Dump base table set up
[    0.051965] MSM Memory Dump apps data table set up
[    0.090040] Detected VIPT I-cache on CPU1
[    0.090083] CPU1: Booted secondary processor [410fd034]
[    0.120024] Detected VIPT I-cache on CPU2
[    0.120052] CPU2: Booted secondary processor [410fd034]
[    0.150051] Detected VIPT I-cache on CPU3
[    0.150078] CPU3: Booted secondary processor [410fd034]
[    0.150126] Brought up 4 CPUs
[    0.150152] SMP: Total of 4 processors activated.
[    0.150161] CPU: All CPU(s) started at EL1
[    0.150184] alternatives: patching kernel code
[    0.169540] DMI not present or invalid.
[    0.169774] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xff
ffffff, max_idle_ns: 19112604462750000 ns
[    0.169798] futex hash table entries: 1024 (order: 5, 131072 bytes)
[    0.169994] pinctrl core: initialized pinctrl subsystem
[    0.171110] NET: Registered protocol family 16
[    0.199987] cpuidle: using governor ladder
[    0.230004] cpuidle: using governor menu
[    0.230207] NET: Registered protocol family 42
[    0.230285] vdso: 2 pages (1 code @ ffffffc00082d000, 1 data @ ffff
ffc00082c000)
[    0.230396] DMA: preallocated 256 KiB pool for atomic allocations
[    0.230525] CPU: IPQ8074A, SoC Version: 2.0
[    0.230949] IPC logging disabled
[    0.230955] IPC logging disabled
[    0.230959] IPC logging disabled
[    0.230964] IPC logging disabled
[    0.230969] IPC logging disabled
[    0.233203] Soc version is not 1, changing clock offsets
[    0.241890] irq: no irq domain found for /soc/smp2p-wcss/slave-kern
el !
[    0.244578] irq: no irq domain found for /soc/smp2p-wcss/slave-kern
el !
[    0.247987] sps:sps is ready.
[    0.254980] spmi spmi-0: PMIC Arb Version-2 (0x20010000)
[    0.262936] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid f
use count: 4
[    0.263202] qcom,cpr3-npu-regulator a4000.npu-cpr: NPU CPR valid fu
se count: 2
[    0.301892] pps_core: LinuxPPS API ver. 1 registered
[    0.301899] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rod
olfo Giometti <giometti@linux.it>
[    0.301922] PTP clock support registered
[    0.302073] dmi: Firmware registration failed.
[    0.303580] Advanced Linux Sound Architecture Driver Initialized.
[    0.304206] clocksource: Switched to clocksource arch_sys_counter
[    0.307333] NET: Registered protocol family 2
[    0.307897] TCP established hash table entries: 8192 (order: 4, 655
36 bytes)
[    0.308005] TCP bind hash table entries: 8192 (order: 5, 131072 byt
es)
[    0.308194] TCP: Hash tables configured (established 8192 bind 8192
)
[    0.308248] UDP hash table entries: 512 (order: 2, 16384 bytes)
[    0.308285] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes
)
[    0.308455] NET: Registered protocol family 1
[    0.315810] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.315828] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMO
DE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.319129] Key type asymmetric registered
[    0.319146] Asymmetric key parser 'x509' registered
[    0.319173] io scheduler noop registered
[    0.319186] io scheduler deadline registered (default)
[    0.321571] 20000000.pci supply vdda not found, using dummy regulat
or
[    0.321617] 20000000.pci supply vdda_phy not found, using dummy reg
ulator
[    0.321654] 20000000.pci supply vdda_refclk not found, using dummy 
regulator
[    0.322618] PCI host bridge /soc/pci@20000000 ranges:
[    0.322646]    IO 0x20200000..0x2020ffff -> 0x20200000
[    0.322661]   MEM 0x20220000..0x2fffffff -> 0x20220000
[    0.575744] qcom-pcie 20000000.pci: link up
[    0.575891] qcom-pcie 20000000.pci: PCI host bridge to bus 0000:00
[    0.575905] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.575917] pci_bus 0000:00: root bus resource [io  0x0000-0xffff] 
(bus address [0x20200000-0x2020ffff])
[    0.575928] pci_bus 0000:00: root bus resource [mem 0x20220000-0x2f
ffffff]
[    0.576247] pci 0000:00:00.0: bridge configuration invalid ([bus 00
-00]), reconfiguring
[    0.577226] pci 0000:00:00.0: BAR 8: assigned [mem 0x20300000-0x204
fffff]
[    0.577240] pci 0000:00:00.0: BAR 9: assigned [mem 0x20500000-0x206
fffff 64bit pref]
[    0.577254] pci 0000:00:00.0: BAR 0: assigned [mem 0x20220000-0x202
20fff 64bit]
[    0.577270] pci 0000:00:00.0: BAR 7: assigned [io  0x1000-0x1fff]
[    0.577285] pci 0000:01:00.0: BAR 0: assigned [mem 0x20300000-0x203
00fff 64bit]
[    0.577337] pci 0000:01:00.0: BAR 2: assigned [mem 0x20301000-0x203
01fff 64bit]
[    0.577385] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.577396] pci 0000:00:00.0:   bridge window [io  0x1000-0x1fff]
[    0.577407] pci 0000:00:00.0:   bridge window [mem 0x20300000-0x204
fffff]
[    0.577418] pci 0000:00:00.0:   bridge window [mem 0x20500000-0x206
fffff 64bit pref]
[    0.577474] PCIe: RC0 enabled during bootup
[    0.577880] MDSS QPIC HW Base phy_Address=0x7980000 virt=ffffff8000
4c0000
[    0.578252] mdss_qpic_panel_probe: Panel Name = qpic lcd panel
[    0.579452] mdss_fb_register: FrameBuffer[0] 800x480 registered suc
cessfully!
[    0.583283] msm_rpm_log_probe: OK
[    0.583634] msm-dcc b3000.dcc: DCC XPU is not specified
[    0.583874] msm-dcc b3000.dcc: jiffies_64: 0xffff8b09, cntvct_64: 0
xb0837dd
[    0.583886] msm-dcc b3000.dcc: gcnt_hi: 0x00000000(0xffffff80003ce0
04)
[    0.583897] msm-dcc b3000.dcc: gcnt_lo: 0x0b0839ad(0xffffff80003ce0
00)
[    0.584534] TZ SMMU State: SMMU Stage2 Enabled
[    0.584613] TZ Log : Will warn on Access Violation, as paniconacces
sviolation is not set
[    0.586214] msm_serial 78b3000.serial: msm_serial: detected port #0
[    0.586253] msm_serial 78b3000.serial: uartclk = 3686400
[    0.586289] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 77, ba
se_baud = 230400) is a MSM
[    0.586307] msm_serial: console setup on port #0
[    1.412852] console [ttyMSM0] enabled
[    1.417843] msm_serial 78b1000.serial: msm_serial: detected port #1
[    1.421114] msm_serial 78b1000.serial: uartclk = 19200000
[    1.427198] 78b1000.serial: ttyMSM1 at MMIO 0x78b1000 (irq = 78, ba
se_baud = 1200000) is a MSM
[    1.433055] msm_serial: driver initialized
[    1.441552] msm_serial_hsl_init: driver initialized
[    1.453733] brd: module loaded
[    1.454960] flash_chrdev : flash_chrdev_init 
[    1.455672] flash_chrdev : flash_chrdev_init 
[    1.460933] QPIC controller hw version Major:1, Minor:5
[    1.464803] nand: device found, Manufacturer ID: 0xc8, Chip ID: 0x6
1
[    1.469481] nand: ONFI 10-Compliant GigaDevice PSR1GA30DT
[    1.476121] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 204
8, OOB size: 64
[    1.481451] 17 ofpart partitions found on MTD device qcom_nand.0
[    1.488850] Creating 17 MTD partitions on "qcom_nand.0":
[    1.495013] 0x000000000000-0x000000100000 : "0:SBL1"
[    1.501855] 0x000000100000-0x000000200000 : "0:MIBIB"
[    1.506732] 0x000000200000-0x000000280000 : "0:BOOTCONFIG"
[    1.511261] 0x000000280000-0x000000300000 : "0:BOOTCONFIG1"
[    1.516622] 0x000000300000-0x000000600000 : "0:QSEE"
[    1.524294] 0x000000600000-0x000000680000 : "0:DEVCFG"
[    1.527313] 0x000000680000-0x000000700000 : "0:APDP"
[    1.532231] 0x000000700000-0x000000780000 : "0:RPM"
[    1.537385] 0x000000780000-0x000000800000 : "0:CDT"
[    1.541945] 0x000000800000-0x000000980000 : "0:APPSBLENV"
[    1.547697] 0x000000980000-0x000000b80000 : "0:APPSBL"
[    1.553678] 0x000000b80000-0x000000c00000 : "0:ART"
[    1.557406] 0x000000c00000-0x000003600000 : "rootfs"
[    1.598448] mtd: device 12 (rootfs) set to be root filesystem
[    1.598770] mtdsplit: no squashfs found in "rootfs"
[    1.603170] 0x000003600000-0x000006000000 : "rootfs_1"
[    1.645170] 0x000006000000-0x000006080000 : "0:ETHPHYFW"
[    1.646219] 0x000006080000-0x000006980000 : "factory_data"
[    1.657911] 0x000006980000-0x000007a80000 : "runtime_data"
[    1.674247] libphy: Fixed MDIO Bus: probed
[    3.784967] gpio_set_value 44: 0 [1.5s~2s] gpio_set_value 44: 1
[    6.044226] gpio_set_value 37: 0 [1.5s~2s] gpio_set_value 37: 1
[    6.557233] qca-mdio 90000.mdio: Could not find phy-reset-gpio
[    6.557353] libphy: qca_mdio: probed
[    6.562712] qca-mdio 90000.mdio: qca-mdio driver was registered
[    6.565953] Unable to create IPC log context!
[    6.571591] Skip QCA8074V1 in V2 platform
[    6.576125] cnss: Platform driver probed successfully. plat ffffffc
03d102018 tgt 0xfffe
[    6.580076] i2c /dev entries driver
[    6.596342] sdhci: Secure Digital Host Controller Interface driver
[    6.596370] sdhci: Copyright(c) Pierre Ossman
[    6.601411] sdhci-pltfm: SDHCI platform and OF driver helper
[    6.606448] sdhci_msm 7824900.sdhci: sdhci_msm_probe: ICE device is
 not enabled
[    6.611615] sdhci_msm 7824900.sdhci: No vreg data found for vdd
[    6.618622] sdhci_msm 7824900.sdhci: No vreg data found for vdd-io
[    6.625816] sdhci_msm 7824900.sdhci: No vmmc regulator found
[    6.630752] sdhci_msm 7824900.sdhci: No vqmmc regulator found
[    6.674264] mmc0: SDHCI controller on 7824900.sdhci [7824900.sdhci]
 using ADMA 64-bit

professor_jonny · April 4, 2024, 8:09am

Ok so I had a bit of spare time and I got my scope out to have a look and the uart seems to be picking up some crosstalk between TX and TX.
I put a simple 10k pullup on the TX line from the router to the serial adaptors 1.8v supply and all seems to be working perfectly

professor_jonny · April 4, 2024, 8:57am

during booting it says:
Enter magic string to stop autoboot

would someone happen to know how to interrupt boot so I could dump the flash contents/ load a initramfs based image from U-Boot or can I do this from the current running OpenWrt based image?

I tried tpl and pressing enter as suggested elsewhere but that does not seem to work, I think the console is disabled as I don't seem to see any typed commands until the kernel loads.

It interrupts the console once the stock firmware is loaded but I don't know the password or username, but pressing f then enter operates failsafe mode and I have root access from there:

Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debu
g level
- failsafe -
/etc/preinit: line 1: telnetd: not found


BusyBox v1.22.1 (2023-04-10 20:55:41 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

ash: can't access tty; job control turned off
     MM           NM                    MMMMMMM          M       M
   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
  MMMMMMM:      MMMMMMM     M         MMMMMMMMMMMM  MMMMMMM MMMMMMM
    MMMMMM       MMMMN     M           MMMMMMMMM      MMMM    MMMM
     MMMM          M                    MMMMMMM        M       M
       M
 ---------------------------------------------------------------
   For those about to rock... (Chaos Calmer, 34c568b+r49254)
 ---------------------------------------------------------------
================= FAILSAFE MODE active ================
special commands:
* firstboot          reset settings to factory defaults
* mount_root     mount root-partition with config files

after mount_root:
* passwd                         change root's password
* /etc/config               directory with config files

for more help see:
http://wiki.openwrt.org/doc/howto/generic.failsafe
=======================================================

root@(none):/# tftp
BusyBox v1.22.1 (2023-04-10 20:55:41 CST) multi-call binary.

Usage: tftp [OPTIONS] HOST [PORT]

Transfer a file from/to tftp server

        -l FILE Local FILE
        -r FILE Remote FILE
        -g      Get file
        -p      Put file
        -b SIZE Transfer blocks of SIZE octets

root@(none):/#

professor_jonny · April 5, 2024, 9:48am

some stuff that may be of interest:

dmesg
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.4.60 (tplink@linuxci2-sp) (gcc version 5.2.0 (OpenWrt GCC 5.2.0 34c5
68b+r49254) ) #1 SMP PREEMPT Mon Apr 10 21:40:48 CST 2023
[    0.000000] Boot CPU: AArch64 Processor [410fd034]
[    0.000000] Ignoring memory range 0x40000000 - 0x41000000
[    0.000000] Machine: Qualcomm Technologies, Inc. IPQ807x/AP-HK01-C5
[    0.000000] efi: Getting EFI parameters from FDT:
[    0.000000] efi: UEFI not found.
[    0.000000] Reserved memory: OVERLAP DETECTED!
[    0.000000] wifi_dump@51100000 (0x0000000051100000--0x0000000051700000) overlaps with wigig_dump
@51300000 (0x0000000051300000--0x0000000051700000)
[    0.000000] On node 0 totalpages: 228608
[    0.000000]   DMA zone: 3572 pages used for memmap
[    0.000000]   DMA zone: 0 pages reserved
[    0.000000]   DMA zone: 228608 pages, LIFO batch:31
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] PERCPU: Embedded 14 pages/cpu @ffffffc03ef43000 s19328 r8192 d29824 u57344
[    0.000000] pcpu-alloc: s19328 r8192 d29824 u57344 alloc=14*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: enabling workaround for ARM erratum 845719
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 225036
[    0.000000] Kernel command line: ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait
 swiotlb=1
[    0.000000] PID hash table entries: 4096 (order: 3, 32768 bytes)
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes)
[    0.000000] software IO TLB [mem 0x7fd3c000-0x7fd7c000] (0MB) mapped at [ffffffc03ed3c000-ffffff
c03ed7bfff]
[    0.000000] Memory: 886388K/914432K available (5258K kernel code, 609K rwdata, 2292K rodata, 220
K init, 466K bss, 28044K reserved, 0K cma-reserved)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vmalloc : 0xffffff8000000000 - 0xffffffbdbfff0000   (   246 GB)
[    0.000000]     vmemmap : 0xffffffbdc0000000 - 0xffffffbfc0000000   (     8 GB maximum)
[    0.000000]               0xffffffbdc0040000 - 0xffffffbdc1000000   (    15 MB actual)
[    0.000000]     fixed   : 0xffffffbffa7fd000 - 0xffffffbffac00000   (  4108 KB)
[    0.000000]     PCI I/O : 0xffffffbffae00000 - 0xffffffbffbe00000   (    16 MB)
[    0.000000]     modules : 0xffffffbffc000000 - 0xffffffc000000000   (    64 MB)
[    0.000000]     memory  : 0xffffffc000000000 - 0xffffffc03f000000   (  1008 MB)
[    0.000000]       .init : 0xffffffc0007e2000 - 0xffffffc000819000   (   220 KB)
[    0.000000]       .text : 0xffffffc000080000 - 0xffffffc0007e1844   (  7559 KB)
[    0.000000]       .data : 0xffffffc000828000 - 0xffffffc0008c0400   (   609 KB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000]  Build-time adjustment of leaf fanout to 64.
[    0.000000] NR_IRQS:64 nr_irqs:64 0
[    0.000000] Architected cp15 timer(s) running at 19.20MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_i
dle_ns: 440795202767 ns
[    0.000005] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[    0.000509] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 Bog
oMIPS (lpj=192000)
[    0.000521] pid_max: default: 32768 minimum: 301
[    0.000612] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes)
[    0.000622] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes)
[    0.001279] EFI services will not be available.
[    0.001305] ASID allocator initialised with 65536 entries
[    0.051920] MSM Memory Dump base table set up
[    0.051941] MSM Memory Dump apps data table set up
[    0.090042] Detected V 
root@(none):/#

df
Filesystem           1K-blocks      Used Available Use% Mounted on
mtd:ubi_rootfs           19712     19712         0 100% /
tmpfs                      512         0       512   0% /dev
tmpfs                   443324        16    443308   0% /tmp
root@(none):/#

cat /proc/partitions
major minor  #blocks  name

   1        0       4096 ram0
   1        1       4096 ram1
   1        2       4096 ram2
   1        3       4096 ram3
   1        4       4096 ram4
   1        5       4096 ram5
   1        6       4096 ram6
   1        7       4096 ram7
   1        8       4096 ram8
   1        9       4096 ram9
   1       10       4096 ram10
   1       11       4096 ram11
   1       12       4096 ram12
   1       13       4096 ram13
   1       14       4096 ram14
   1       15       4096 ram15
  31        0       1024 mtdblock0
  31        1       1024 mtdblock1
  31        2        512 mtdblock2
  31        3        512 mtdblock3
  31        4       3072 mtdblock4
  31        5        512 mtdblock5
  31        6        512 mtdblock6
  31        7        512 mtdblock7
  31        8        512 mtdblock8
  31        9       1536 mtdblock9
  31       10       2048 mtdblock10
  31       11        512 mtdblock11
  31       12      43008 mtdblock12
  31       13      43008 mtdblock13
  31       14        512 mtdblock14
  31       15       9216 mtdblock15
  31       16      17408 mtdblock16
  31       17       5580 mtdblock17
  31       18      19716 mtdblock18
root@(none):/#

cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00020000 "0:SBL1"
mtd1: 00100000 00020000 "0:MIBIB"
mtd2: 00080000 00020000 "0:BOOTCONFIG"
mtd3: 00080000 00020000 "0:BOOTCONFIG1"
mtd4: 00300000 00020000 "0:QSEE"
mtd5: 00080000 00020000 "0:DEVCFG"
mtd6: 00080000 00020000 "0:APDP"
mtd7: 00080000 00020000 "0:RPM"
mtd8: 00080000 00020000 "0:CDT"
mtd9: 00180000 00020000 "0:APPSBLENV"
mtd10: 00200000 00020000 "0:APPSBL"
mtd11: 00080000 00020000 "0:ART"
mtd12: 02a00000 00020000 "rootfs"
mtd13: 02a00000 00020000 "rootfs_1"
mtd14: 00080000 00020000 "0:ETHPHYFW"
mtd15: 00900000 00020000 "factory_data"
mtd16: 01100000 00020000 "runtime_data"
mtd17: 00573000 0001f000 "kernel"
mtd18: 01341000 0001f000 "ubi_rootfs"
root@(none):/#

professor_jonny · April 5, 2024, 10:18am

cat /proc/devices
Character devices:
  1 mem
  5 /dev/tty
  5 /dev/console
  5 /dev/ptmx
 10 misc
 13 input
 29 fb
 89 i2c
 90 mtd
116 alsa
128 ptm
136 pts
153 spi
180 usb
189 usb_device
239 flash_chrdev
241 ubi0
242 subsys
243 nvme
244 ttyMSM
245 ttyMSM
246 dcc_sram
247 mhi_uci
248 watchdog
249 iio
250 ptp
251 pps
252 rtc
253 msm_sps
254 rpmsg

Block devices:
  1 ramdisk
259 blkext
 31 mtdblock
179 mmc
253 ubiblock
254 nvme
root@(none):/#

ls -aln /sys/devices/platform
drwxr-xr-x   16 0        0                0 Jan  1 00:43 .
drwxr-xr-x    5 0        0                0 Jan  1 00:00 ..
drwxr-xr-x    4 0        0                0 Jan  1 00:43 Fixed MDIO bus.0
drwxr-xr-x    3 0        0                0 Jan  1 00:43 alarmtimer
drwxr-xr-x    3 0        0                0 Jan  1 00:43 cpufreq-dt
drwxr-xr-x    3 0        0                0 Jan  1 00:43 firmware:qfprom
drwxr-xr-x    3 0        0                0 Jan  1 00:43 firmware:scm
drwxr-xr-x    4 0        0                0 Jan  1 00:43 fixed-regulator@0
drwxr-xr-x    3 0        0                0 Jan  1 00:43 mdss_fb.0
drwxr-xr-x    3 0        0                0 Jan  1 00:43 pmu
drwxr-xr-x    2 0        0                0 Jan  1 00:43 power
drwxr-xr-x    3 0        0                0 Jan  1 00:43 psci
drwxr-xr-x    3 0        0                0 Jan  1 00:43 qseecom
drwxr-xr-x    4 0        0                0 Jan  1 00:43 reg-dummy
drwxr-xr-x    3 0        0                0 Jan  1 00:43 snd-soc-dummy
drwxr-xr-x  128 0        0                0 Jan  1 00:43 soc
-rw-r--r--    1 0        0             4096 Jan  1 00:43 uevent
root@(none):/#

ls -aln /sys/class/leds/
drwxr-xr-x    2 0        0                0 Jan  1 00:46 .
drwxr-xr-x   41 0        0                0 Jan  1 00:45 ..
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 blue -> ../../devices/platform/soc/soc:led
s/leds/blue
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 blue_mix -> ../../devices/platform/soc/soc
:leds/leds/blue_mix
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 green -> ../../devices/platform/soc/soc:le
ds/leds/green
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 ipq::led0 -> ../../devices/platform/soc/19
1e000.ledc/leds/ipq::led0
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 ipq::led1 -> ../../devices/platform/soc/19
1e000.ledc/leds/ipq::led1
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 ipq::led10 -> ../../devices/platform/soc/1
91e000.ledc/leds/ipq::led10
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 ipq::led11 -> ../../devices/platform/soc/1
91e000.ledc/leds/ipq::led11
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 ipq::led12 -> ../../devices/platform/soc/1
91e000.ledc/leds/ipq::led12
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 ipq::led2 -> ../../devices/platform/soc/19
1e000.ledc/leds/ipq::led2
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 ipq::led3 -> ../../devices/platform/soc/19
1e000.ledc/leds/ipq::led3
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 ipq::led4 -> ../../devices/platform/soc/19
1e000.ledc/leds/ipq::led4
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 ipq::led5 -> ../../devices/platform/soc/19
1e000.ledc/leds/ipq::led5
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 ipq::led6 -> ../../devices/platform/soc/19
1e000.ledc/leds/ipq::led6
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 ipq::led7 -> ../../devices/platform/soc/19
1e000.ledc/leds/ipq::led7
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 ipq::led8 -> ../../devices/platform/soc/19
1e000.ledc/leds/ipq::led8
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 ipq::led9 -> ../../devices/platform/soc/19
1e000.ledc/leds/ipq::led9
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 mmc0:: -> ../../devices/platform/soc/78249
00.sdhci/leds/mmc0::
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 red -> ../../devices/platform/soc/soc:leds
/leds/red
lrwxrwxrwx    1 0        0                0 Jan  1 00:46 yellow_mix -> ../../devices/platform/soc/s
oc:leds/leds/yellow_mix
root@(none):/#

professor_jonny · April 7, 2024, 7:39am

I have Updated the Wiki here with this device:
[OpenWrt Wiki] TP-Link X80-5G V1

bobthebuilder · April 7, 2024, 8:26am

Have you tried just repeating "tpl" over and over as soon as you give the device power?

professor_jonny · April 7, 2024, 10:36am

Yes, I tried cut and paste it into the window, it seems as if input is blocked in the bootloader as I get no echo in the window, but I do when the kernel loads.

bobthebuilder · April 7, 2024, 10:39am

The Deco M4R doesn't give any feedback either. You just type 'tpl' over and over until you see that you're typing it into the command prompt of the bootloader.

Not clue if copy and paste even works there.