IPQ807x SoC Investigation / Status [WIP]

castillofrancodamian · June 25, 2021, 11:48am

I meant that. To follow and see the development.

robimarko · June 25, 2021, 11:49am

Then the mailing list is ideal, previously it had its own patchwork but they moved to the generic wireless drivers patchwork.

dchard · June 25, 2021, 12:52pm

Well, I am not really a fan of this, but maybe putting some pressure on that mailing list might trigger something. You think I received anything from Valo about the regdb issues? Ridiculous...

robimarko · June 25, 2021, 12:53pm

Issue is that its pretty much just QCA and couple of users on that list.

perceival · July 2, 2021, 6:00pm

Not sure if that is right place but I've manage to brick my AX3600. I have already serial access. What can be done next?
Here is the log with boot loop:

U-Boot 2016.01 (Sep 28 2020 - 09:05:55 +0000), Build: jenkins-common_router_openwrt_ota_publish-383

DRAM:  smem ram ptable found: ver: 1 len: 4
512 MiB
NAND:  ONFI device found
ID = 1590aaef
Vendor = ef
Device = aa
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC:   sdhci: Node Not found, skipping initialization

PCI Link Intialized
PCI1 is not defined in the device tree
In:    serial@78B3000
Out:   serial@78B3000
Err:   serial@78B3000
machid: 8010010
MMC Device 0 not found
eth5 MAC Address from ART is not valid
write phy_id=1, reg(0x8074):0x0670
write phy_id=2, reg(0x8074):0x0670
write phy_id=3, reg(0x8074):0x0670
write phy_id=4, reg(0x8074):0x0670
bootwait is on, bootdelay=5
Hit any key to stop autoboot:  0
 restore_defaults is set, enlarge xqup detect time
 trigger button release!
boot from rootfs 1
  miwifi: check crash in rmem !
ubi0: attaching mtd1
UBI init error 22
Erasing NAND...
Erasing at 0x6e0000 -- 100% complete.
Writing to NAND... OK
resetting ...

And that is after booting router with reset button pressed:

U-Boot 2016.01 (Sep 28 2020 - 09:05:55 +0000), Build: jenkins-common_router_openwrt_ota_publish-383

DRAM:  smem ram ptable found: ver: 1 len: 4
512 MiB
NAND:  ONFI device found
ID = 1590aaef
Vendor = ef
Device = aa
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC:   sdhci: Node Not found, skipping initialization

PCI Link Intialized
PCI1 is not defined in the device tree
In:    serial@78B3000
Out:   serial@78B3000
Err:   serial@78B3000
machid: 8010010
MMC Device 0 not found
eth5 MAC Address from ART is not valid
write phy_id=1, reg(0x8074):0x0670
write phy_id=2, reg(0x8074):0x0670
write phy_id=3, reg(0x8074):0x0670
write phy_id=4, reg(0x8074):0x0670
bootwait is on, bootdelay=5
Hit any key to stop autoboot:  0
 restore_defaults is set, enlarge xqup detect time
 detect button press, continue check 15 secs
 detect button pressed 15 secs !
 confirm to launch xq_upgrade !
 cmd=dhcp

Net:   MAC0 addr:88:c3:97:ff:ff:ff
PHY ID1: 0x4d
PHY ID2: 0xd0b1
EDMA ver 1 hw init
Num rings - TxDesc:1 (0-0) TxCmpl:1 (7-7)
RxDesc:1 (15-15) RxFill:1 (7-7)
ipq807x_edma_alloc_rings: successfull
ipq807x_edma_setup_ring_resources: successfull
ipq807x_edma_configure_rings: successfull
ipq807x_edma_hw_init: successfull
board_eth_init: ipq807x_edma_init successed
eth0
ipq807x_eth_halt: done
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 up Speed :10 Full duplex
eth0 PHY2 up Speed :1000 Full duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
eth0 PHY5 Down Speed :10 Half duplex
ipq807x_eth_init: done
BOOTP broadcast 1
BOOTP broadcast 2
*** Unhandled DHCP Option in OFFER/ACK: 13
*** Unhandled DHCP Option in OFFER/ACK: 175
*** Unhandled DHCP Option in OFFER/ACK: 13
*** Unhandled DHCP Option in OFFER/ACK: 175
DHCP client bound to address 192.168.11.2 (5724 ms)
Using eth0 device
TFTP from server 192.168.11.1; our IP address is 192.168.11.2
Filename 'C0A80B0A.img'.
Load address: 0x44000000
Loading: *
Got TFTP_OACK: TFTP remote port: changes from 69 to 61039
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################
         2.3 MiB/s
done
Bytes transferred = 31728232 (1e42268 hex)
ipq807x_eth_halt: done
LoadAddr=44000000 NetBootFileXferSize= 1e42268
CRC verify success!
RSA signature verify success!
Erasing NAND...
Erasing at 0x6e0000 -- 100% complete.
Writing to NAND... OK
Upgrade xiaoqiang_version...
Upgrade uboot.bin...
 --- xq_flash_erase Erasing Nand...0x00700000~+0x00100000
Erasing at 0x7e0000 -- 100% complete.
common/proc_xqimage.c xqimage_upgrade 541 start:0x440002ac,subh->flash_addr:0xffffffff,len:0x100000
Upgrade root.ubi...
 --- xq_flash_erase Erasing Nand...0x00a00000~+0x023c0000
Erasing at 0x2da0000 -- 100% complete.
 --- xq_flash_erase Erasing Nand...0x02dc0000~+0x023c0000
Erasing at 0x5160000 -- 100% complete.
common/proc_xqimage.c xqimage_upgrade 541 start:0x440a2158,subh->flash_addr:0xffffffff,len:0x1da0000
Erasing NAND...
Erasing at 0x6e0000 -- 100% complete.
Writing to NAND... OK
========Upgrade success!========
Erasing NAND...
Erasing at 0x6e0000 -- 100% complete.
Writing to NAND... OK

Is there a chance to unbrick the router?

robimarko · July 2, 2021, 7:17pm

Since the bootloader is working you can use TFTP recovery or OpenWrt initramfs to simply flash the stock FW or OpenWrt back.

For the stock firmware TFTP recovery, you can check the AX3600 OpenWrt wiki, its documented there.

perceival · July 2, 2021, 7:27pm

That is the process I was following (with stock FW so far) however the LED never gets solid and the last messages are:

common/proc_xqimage.c xqimage_upgrade 541 start:0x440002ac,subh->flash_addr:0xffffffff,len:0x1b40000
Erasing NAND...
Erasing at 0x6e0000 -- 100% complete.
Writing to NAND... OK
========Upgrade success!========
Erasing NAND...
Erasing at 0x6e0000 -- 100% complete.
Writing to NAND... OK

Is it possible to switch NAND that is being used from serial interface?

robimarko · July 2, 2021, 7:29pm

Hm, that is weird.

I would then use OpenWrt initramfs image to simply write the firmware image directly to the 2 rootfs partitions using ubiformat.

robimarko · September 2, 2021, 6:57pm

@Ansuel I asked my contacts at QCA what are the NSS FW terms for redistribution as they are not updating the QUIC repo, well it turns out that that one should have been updated as soon as 11.4 launched.
So, they promised to push updated FW there so we can drop the 11.3 patch and use 11.4 FW directly.
Also, QSDK 11.5 should be releasing relatively soon and it looks like it may be 5.4 based.

I forgot to ask about IPQ806x FW, it would be great if that one gets released as well as its really out of date and IPQ806x is still supported officially in QSDK 11.4

Ansuel · September 2, 2021, 7:11pm

If you have time, try to ask about ipq806x... Considering they are starting to release them in public and they should have the same license... i can't see why they should not redistribuite also them. I mean it's the same source for a different target

But anyway should we consider porting qsdk 11.5? (and adapt that source for 11.4 the same way we did for 11.3?)

robimarko · September 2, 2021, 8:33pm

Sure, I will ask about IPQ806x.

No point in porting 11.5 yet as its not officially out.

solidus1983 · July 26, 2022, 8:06pm

Hi all, wondering what is needed to port the GL-AX1800 flint over which uses the same ipq807x/ipq6018 soc.

Currently having to use QDSK from gl-inet for my builds but would rather help if i can port it over to openwrt to be as native as possible.

Flint is currently on Kernel 5.4.164 on my current builds.

robimarko · July 26, 2022, 8:17pm

IPQ807x and IPQ60xx are not the same

solidus1983 · July 26, 2022, 8:21pm

Thanks for reply. Whats the best way to verify the SOC as GL-iNet has it using the target of the IPQ807x.

I do have board shots available. I can swap the Router over to i can TTL into the router too.

robimarko · July 26, 2022, 8:25pm

Flint is using IPQ6000, so bottom end IPQ60xx SoC, at least they used 512MB of RAM.

QSDK just recycled ipq807x target, nothing they did not do before and only got changed in recent QSDK-s.
gl-inet could have also forked OpenWrt and pretty much replace ipq807x target with QCA-s 5.4 kernel and everything

solidus1983 · July 26, 2022, 8:28pm

Thanks for the reply, I have noticed that they are now using QCA 5.4 kernel, using i have been pulling from their intra build repo.

|Firmware Version|OpenWrt 21.02-SNAPSHOT r16399+142-c67509efd7 / LuCI openwrt-22.03 branch git-21.284.67084-e4d24f0|
|---|---|
|Kernel Version|5.4.164|

So as its IPQ60xx i guess its best to wait and just continue to use the QCA 5.4 kernel.

robimarko · July 26, 2022, 8:30pm

I did some basic fixes for IPQ60xx mainline kernel, but its far from being complete.
If only I did not have a job and actually had developer boards

solidus1983 · July 26, 2022, 8:31pm

So true, does it have to be a Developer board? i take it you can't use a retail board?

Any ways will be quite now as not to derail the thread.

robimarko · July 26, 2022, 8:32pm

It doesnt, but it means I have to use 5+ retail boards to cover all of the peripherals, port speeds, CPU frequency rating etc like on IPQ807x.

I am lucky to have a mostly working CP01-C1 dev board with IPQ6018

vevere · September 2, 2022, 7:55pm

Hi,

I have an unused WAX218 at home (IPQ8072a, QCN5024, QCN5054)
Can I do anything with it that can help the community ?
Do I have any way to put OpenWRT on it ?