Looking for support (or just advices) for Asus RP-AC66

tsb · December 8, 2021, 12:34pm

Hi all,

I have this neat old Asus RP-AC66 Repeater and I'm looking for ideas how to pop OpenWrt on it.
Since it is a repeater, I'm not even sure this is possible to do, but I don't really know much details about the device. The original Asus GUI differs not much from a small router, however the HW is surely much more handicapped in contrast.

I didn't find anything about this exact model, so all I was able to do so far was disassembling it -> ofc one cannot see anything, all the stuff is under a soldered metal shield.

Other thing I have is the device syslog (attached) and from that one can see some basic things. I was thinking to try something like a generic OpenWrt image to flash, but since I don't have much details, I'm completely not sure how to do this. Maybe even the device is compatible with some other HW out there as well.

Question is; is it possible to have support for it?
If someone thinks, it is similar to some other already supported stuff, I'm happy to experiment with it, if possible at all?

TiA

Edit: Link to Asus https://www.asus.com/uk/Networking-IoT-Servers/Range-Extenders-/All-series/RP-AC66/

Here the syslog:

May  5 07:05:03 syslogd started: BusyBox v1.17.4
May  5 07:05:03 INIT: firmware version: 3.0.0.4_382_50772-gdcf817e
May  5 07:05:03 kernel: klogd started: BusyBox v1.17.4 (2018-07-12 10:27:40 CST)
May  5 07:05:03 kernel: Linux version 3.3.8 (root@asus) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Thu Jul 12 10:30:30 CST 2018
May  5 07:05:03 kernel: Zone PFN ranges:
May  5 07:05:03 kernel:   Normal   0x00000000 -> 0x00004000
May  5 07:05:03 kernel: Movable zone start PFN for each node
May  5 07:05:03 kernel: Early memory PFN ranges
May  5 07:05:03 kernel:     0: 0x00000000 -> 0x00004000
May  5 07:05:03 kernel: Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 16256
May  5 07:05:03 kernel: Kernel command line:  board=AP152 console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs mem=64M
May  5 07:05:03 kernel: Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
May  5 07:05:03 kernel: Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
May  5 07:05:03 kernel: registering PCI controller with io_map_base unset
May  5 07:05:03 kernel: m25p80 spi0.0: found mx25l12805d, expected m25p80
May  5 07:05:03 kernel: Creating 7 MTD partitions on "ath79-nor0":
May  5 07:05:03 kernel: 0x000000000000-0x000000040000 : "Bootloader"
May  5 07:05:03 kernel: 0x000000040000-0x000000050000 : "nvram"
May  5 07:05:03 kernel: 0x000000050000-0x000000060000 : "Factory"
May  5 07:05:03 kernel: 0x000000060000-0x000000f80000 : "linux"
May  5 07:05:03 kernel: 0x00000015e080-0x000000f80000 : "rootfs"
May  5 07:05:03 kernel: 0x000000f80000-0x000001000000 : "jffs2"
May  5 07:05:03 kernel: 0x000000000000-0x000001000000 : "ALL"
May  5 07:05:03 kernel: offset 0x9000 elapse 0ms
May  5 07:05:03 kernel: asf: module license 'Proprietary' taints kernel.
May  5 07:05:03 kernel: Disabling lock debugging due to kernel taint
May  5 07:05:03 kernel: ****Address of trace_timer :83be6690 
May  5 07:05:03 kernel: ath_hal: Unknown parameter `ce_level'
May  5 07:05:03 kernel: ath_tx99: Version 2.0
May  5 07:05:03 kernel: Copyright (c) 2010 Atheros Communications, Inc, All Rights Reserved
May  5 07:05:03 kernel: __ath_attach: Set global_scn[0]
May  5 07:05:03 kernel: *** All the minfree values should be <= ATH_TXBUF-32, otherwise default value will be used instead ***
May  5 07:05:03 kernel: ACBKMinfree = 48
May  5 07:05:03 kernel: ACBEMinfree = 32
May  5 07:05:03 kernel: ACVIMinfree = 16
May  5 07:05:03 kernel: ACVOMinfree = 0
May  5 07:05:03 kernel: CABMinfree = 48
May  5 07:05:03 kernel: UAPSDMinfree = 0
May  5 07:05:03 kernel: ATH_TXBUF=540
May  5 07:05:03 kernel: ART Version : 49.517
May  5 07:05:03 kernel: SW Image Version : 0.20.-13.3.3
May  5 07:05:03 kernel: Board Revision : 6 
May  5 07:05:03 kernel: ar9300_attach: nf_2_nom -110 nf_2_max -60 nf_2_min -125 
May  5 07:05:03 kernel: SPECTRAL : get_capability not registered
May  5 07:05:03 kernel: HAL_CAP_PHYDIAG : Capable
May  5 07:05:03 kernel: SPECTRAL : Need to fix the capablity check for RADAR (spectral_attach : 231)
May  5 07:05:03 kernel: SPECTRAL : get_capability not registered
May  5 07:05:03 kernel: HAL_CAP_RADAR   : Capable
May  5 07:05:03 kernel: SPECTRAL : Need to fix the capablity check for SPECTRAL
May  5 07:05:03 kernel:  (spectral_attach : 236)
May  5 07:05:03 kernel: SPECTRAL : get_capability not registered
May  5 07:05:03 kernel: HAL_CAP_SPECTRAL_SCAN : Capable
May  5 07:05:03 kernel: SPECTRAL : get_tsf64 not registered
May  5 07:05:03 kernel: spectral_init_netlink 65 NULL SKB
May  5 07:05:03 kernel: SPECTRAL : No ADVANCED SPECTRAL SUPPORT
May  5 07:05:03 kernel: SPECTRAL :----- module attached
May  5 07:05:03 kernel: Green-AP : Green-AP : Attached
May  5 07:05:04 kernel: ath_get_caps[6267] rx chainmask mismatch actual 7 sc_chainmak 0
May  5 07:05:04 kernel: ath_get_caps[6242] tx chainmask mismatch actual 7 sc_chainmak 0
May  5 07:05:04 kernel: band steering initialized for direct attach hardware 
May  5 07:05:04 kernel: ieee80211_bsteering_attach: Band steering initialized
May  5 07:05:04 kernel: ath_attach_dfs[12799] dfsdomain 1
May  5 07:05:04 kernel: SPECTRAL : module already attached
May  5 07:05:04 kernel: ath_tx_paprd_init sc 82f68000 PAPRD disabled in HAL
May  5 07:05:04 kernel: PCI device id is 003c :003c
May  5 07:05:04 kernel: PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
May  5 07:05:04 kernel:  ol_ath_pci_configure : num_desired MSI set to 0
May  5 07:05:04 kernel:  Using PCI Legacy Interrupt
May  5 07:05:04 kernel: CE_per_engine_handler_adjust, base=827fee00 offset=00057400 
May  5 07:05:04 kernel: CE_per_engine_handler_adjust, base=827fee00 offset=00057800 
May  5 07:05:04 kernel: __ol_ath_attach: ath_attach TODO
May  5 07:05:04 kernel: __ol_ath_attach: dev name wifi1
May  5 07:05:04 kernel: ol_ath_set_default_tgt_config : AC Minfree buffer allocation through module param (umac.ko)
May  5 07:05:04 kernel:  OL_ACBKMinfree : 0
May  5 07:05:04 kernel:  OL_ACBEMinfree : 0
May  5 07:05:04 kernel:  OL_ACVIMinfree : 0
May  5 07:05:04 kernel:  OL_ACVOMinfree : 0
May  5 07:05:04 kernel: ol_ath_attach() BMI inited.
May  5 07:05:04 kernel: ol_ath_attach() BMI Get Target Info.
May  5 07:05:04 kernel: ol_ath_attach() TARGET TYPE: 7 Vers 0x4100016c
May  5 07:05:04 kernel: NUM_DEV=1 FWMODE=0x2 FWSUBMODE=0x0 FWBR_BUF 0
May  5 07:05:04 kernel: ol_ath_attach() configure Target .
May  5 07:05:04 kernel: ath_nand_local_read: cal_part [Factory] from 5000 len 844
May  5 07:05:04 kernel: ath_nand_local_read: cal_part [Factory] from d188 len 2
May  5 07:05:04 kernel: qc98xx_verify_checksum: flash checksum passed: 0xac98
May  5 07:05:04 kernel: ol_transfer_bin_file 2274: Download Flash data len 2116
May  5 07:05:04 kernel:  Download AR9888v2_bin
May  5 07:05:04 kernel: ol_transfer_bin_file 2170: Download Firmware data len 235840
May  5 07:05:04 kernel: ol_ath_attach() Download FW. 
May  5 07:05:04 kernel: ol_ath_attach() HT Create .
May  5 07:05:04 kernel: ol_ath_attach() HIF Claim.
May  5 07:05:04 kernel: ol_ath_attach() BMI Done. 
May  5 07:05:04 kernel: ol_ath_attach() WMI attached. wmi_handle 82850000 
May  5 07:05:04 kernel: +HWT
May  5 07:05:04 kernel: SOC_RESET_CONTROL_ADDRESS : 800
May  5 07:05:04 kernel: CPU_INTR_ADDRESS = [0]
May  5 07:05:04 kernel: SOC_GLOBAL_RESET_ADDRESS = [0]
May  5 07:05:04 kernel: Rx_Filter : [0]
May  5 07:05:04 kernel: CE_per_engine_handler_adjust, base=827fee00 offset=00057400 
May  5 07:05:04 kernel: CE_per_engine_handler_adjust, base=827fee00 offset=00057800 
May  5 07:05:04 kernel: CE_per_engine_handler_adjust, base=827fee00 offset=00057c00 
May  5 07:05:04 kernel: CE_per_engine_handler_adjust, base=827fee00 offset=00058000 
May  5 07:05:04 kernel: CE_per_engine_handler_adjust, base=827fee00 offset=00058400 
May  5 07:05:04 kernel: CE_per_engine_handler_adjust, base=827fee00 offset=00058800 
May  5 07:05:04 kernel: CE_recv_buf_enqueue 653 Populate last entry 512 for CE 5
May  5 07:05:04 kernel: CE_recv_buf_enqueue 662 CE 5 wi 511 dest_ptr 0x201ec40 nbytes 0 recv_ctxt 0x82015600
May  5 07:05:04 nat: apply redirect rules
May  5 07:05:04 kernel: Target:83d22000 HTC Service:0x0001, ULpipe:0 DLpipe:1 id:0 Ready
May  5 07:05:04 kernel: -HWT
May  5 07:05:04 kernel: Target:83d22000 HTC Service:0x0300, ULpipe:4 DLpipe:5 id:1 Ready
May  5 07:05:04 kernel: HTC Service:0x0300 ep:1 TX flow control disabled
May  5 07:05:04 kernel: CE_pkt_dl_len_set CE 4 Pkt download length 64
May  5 07:05:04 kernel: ol_txrx_pdev_attach: 1424 tx desc's allocated ; range starts from 81c60000
May  5 07:05:04 kernel: Target:83d22000 HTC Service:0x0100, ULpipe:3 DLpipe:2 id:2 Ready
May  5 07:05:04 kernel: HTC Service:0x0100 ep:2 TX flow control disabled
May  5 07:05:04 kernel: wmi_service_ready_event_rx:  WMI UNIFIED SERVICE READY event 
May  5 07:05:04 WAN Connection: Don't connect the AP yet.
May  5 07:05:04 kernel: num_rf_chain : 00000003
May  5 07:05:04 kernel: ht_cap_info: : 0000085b
May  5 07:05:04 kernel: vht_cap_info : 338001b2
May  5 07:05:04 kernel: vht_supp_mcs : 0000ffea
May  5 07:05:04 kernel: LARGE_AP enabled. num_peers 144, num_vdevs 16, num_tids 256, lteu_support 0
May  5 07:05:04 kernel: idx 0 req 1  num_units 0 num_unit_info 2 unit size 440 actual units 145 
May  5 07:05:04 kernel: chunk 0 len 63800 requested ,ptr  0x1c70000 
May  5 07:05:04 kernel: FIRMWARE:P 145 V 16 T 443
May  5 07:05:04 kernel:  
May  5 07:05:04 kernel: FIRMWARE:_wlan_rtt_enable 
May  5 07:05:04 kernel: wmi_ready_event_rx:  WMI UNIFIED READY event 
May  5 07:05:04 kernel: ol_ath_connect_htc() WMI is ready
May  5 07:05:04 kernel: ol_ath_set_host_app_area TODO
May  5 07:05:04 kernel: target uses HTT version 2.1; host uses 2.1
May  5 07:05:04 kernel: ol_ath_attach() connect HTC. 
May  5 07:05:04 kernel: bypasswmi : 0
May  5 07:05:04 kernel: ol_regdmn_start: reg-domain param: regdmn=0, countryName=, wModeSelect=FFFFFFFF, netBand=FFFFFFFF, extendedChanMode=0.
May  5 07:05:04 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2) flags 0x2150
May  5 07:05:04 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4) flags 0xa0
May  5 07:05:04 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x8) flags 0xc0
May  5 07:05:04 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x20) flags 0xd0
May  5 07:05:04 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x40) flags 0x150
May  5 07:05:04 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x800) flags 0x10080
May  5 07:05:04 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2000) flags 0x20080
May  5 07:05:04 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4000) flags 0x40080
May  5 07:05:04 kernel: Add VHT80 channel: 5210
May  5 07:05:04 kernel: Add VHT80 channel: 5775
May  5 07:05:04 kernel: Skipping VHT80 channel 5825
May  5 07:05:04 kernel: ol_ath_phyerr_attach: called
May  5 07:05:04 kernel: OL Resmgr Init-ed
May  5 07:05:04 kernel: ieee80211_bsteering_attach: Band steering initialized
May  5 07:05:04 kernel: ol_if_spectral_setup
May  5 07:05:04 kernel: SPECTRAL : get_capability not registered
May  5 07:05:04 kernel: HAL_CAP_PHYDIAG : Capable
May  5 07:05:04 kernel: SPECTRAL : Need to fix the capablity check for RADAR (spectral_attach : 231)
May  5 07:05:04 kernel: SPECTRAL : get_capability not registered
May  5 07:05:04 kernel: HAL_CAP_RADAR   : Capable
May  5 07:05:04 kernel: SPECTRAL : Need to fix the capablity check for SPECTRAL
May  5 07:05:04 kernel:  (spectral_attach : 236)
May  5 07:05:04 kernel: SPECTRAL : get_capability not registered
May  5 07:05:04 kernel: HAL_CAP_SPECTRAL_SCAN : Capable
May  5 07:05:04 kernel: SPECTRAL : get_tsf64 not registered
May  5 07:05:04 kernel: spectral_init_netlink 65 NULL SKB
May  5 07:05:04 kernel: Green-AP : Green-AP : Attached
May  5 07:05:04 kernel: Green-AP : Attached
May  5 07:05:04 kernel: ol_if_dfs_setup: called 
May  5 07:05:04 kernel: ol_if_dfs_attach: called; ptr=81ca1974, radar_info=836f7b78
May  5 07:05:04 RP-AC66: start httpd:80
May  5 07:05:04 kernel: ol_ath_rtt_meas_report_attach: called
May  5 07:05:04 kernel: ol_ath_attach() UMAC attach . 
May  5 07:05:04 kernel: ol_if_dfs_configure: called
May  5 07:05:04 kernel: ol_if_dfs_configure: UNINIT domain
May  5 07:05:04 kernel: ol_if_dfs_disable: called
May  5 07:05:04 kernel: ol_ath_attach: Calling ol_if_dfs_configure
May  5 07:05:04 kernel: __ol_ath_attach: init tx/rx TODO
May  5 07:05:04 kernel: __ol_ath_attach: hard_header_len reservation 58
May  5 07:05:04 kernel: sc nodebug 0 
May  5 07:05:04 kernel: ath_attach_dfs[12799] dfsdomain 1
May  5 07:05:04 kernel: isCountryCodeValid: EEPROM regdomain 0x0
May  5 07:05:04 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2) flags 0x2150
May  5 07:05:04 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4) flags 0xa0
May  5 07:05:04 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x8) flags 0xc0
May  5 07:05:05 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x20) flags 0xd0
May  5 07:05:05 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x40) flags 0x150
May  5 07:05:05 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x800) flags 0x10080
May  5 07:05:05 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2000) flags 0x20080
May  5 07:05:05 kernel: ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4000) flags 0x40080
May  5 07:05:05 kernel: Add VHT80 channel: 5210
May  5 07:05:05 kernel: Add VHT80 channel: 5290
May  5 07:05:05 kernel: Add VHT80 channel: 5530
May  5 07:05:05 kernel: Skipping VHT80 channel 5580
May  5 07:05:05 kernel: Skipping VHT80 channel 5660
May  5 07:05:05 kernel: Skipping VHT80 channel 5680
May  5 07:05:05 kernel: Skipping VHT80 channel 5700
May  5 07:05:05 kernel: [wifi1] FWLOG: [20827] WAL_DBGID_TX_AC_BUFFER_SET ( 0x3, 0x1e, 0x460, 0x460, 0x0 )
May  5 07:05:05 kernel: [wifi1] FWLOG: [20827] WAL_DBGID_TX_AC_BUFFER_SET ( 0x12, 0x1e, 0x460, 0x460, 0x0 )
May  5 07:05:05 kernel: [wifi1] FWLOG: [20827] WAL_DBGID_TX_AC_BUFFER_SET ( 0x45, 0x1e, 0x460, 0x460, 0x0 )
May  5 07:05:05 kernel: [wifi1] FWLOG: [20827] WAL_DBGID_TX_AC_BUFFER_SET ( 0x67, 0x1e, 0x460, 0x460, 0x0 )
May  5 07:05:05 kernel: [wifi1] FWLOG: [20832] WHAL_ERROR_RECV_STOPPCU ( 0x110298a, 0x3 )
May  5 07:05:05 kernel: [wifi1] FWLOG: [20832] WHAL_ERROR_RESET_PM (  )
May  5 07:05:05 kernel: [wifi1] FWLOG: [20839] WAL_DBGID_DEV_RESET ( 0x1, 0x1, 0x1 )
May  5 07:05:05 kernel: [wifi1] FWLOG: [21017] ANI Enable:  1
May  5 07:05:05 kernel: [wifi1] FWLOG: [21024] WAL_DBGID_DEV_RESET ( 0x1, 0x1, 0x1 )
May  5 07:05:05 kernel: wlan_vap_create : enter. devhandle=0x82f70380, opmode=IEEE80211_M_HOSTAP, flags=0x1
May  5 07:05:05 kernel: wlan_vap_create : exit. devhandle=0x82f70380, opmode=IEEE80211_M_HOSTAP, flags=0x1.
May  5 07:05:05 kernel: VAP device ath0 created osifp: (81d3cb80) os_if: (831e8000)
May  5 07:05:05 kernel: ath_ioctl: SIOC80211IFCREATE CALLED
May  5 07:05:05 kernel: wmi_unified_vdev_create_send: ID = 0 VAP Addr = 88:d7:f6:a3:a6:26:
May  5 07:05:05 kernel: Setting dscp for vap id: 0
May  5 07:05:05 kernel: VAP device ath1 created osifp: (81d3e380) os_if: (83158000)
May  5 07:05:05 kernel: wlan_vap_create : enter. devhandle=0x82f70380, opmode=IEEE80211_M_STA, flags=0x3
May  5 07:05:05 kernel: wlan_vap_create : exit. devhandle=0x82f70380, opmode=IEEE80211_M_STA, flags=0x3.
May  5 07:05:05 kernel: VAP device sta0 created osifp: (81d3fb80) os_if: (81d64000)
May  5 07:05:05 kernel: Set freq vap 0 stop send + 83158000
May  5 07:05:05 kernel: OL vap_stop +
May  5 07:05:05 kernel: wmi_unified_vdev_stop_send for vap 0 (82850000)
May  5 07:05:05 kernel: OL vap_stop -
May  5 07:05:05 kernel: STOPPED EVENT for vap 0 (82850000)
May  5 07:05:05 kernel: Set freq vap 0 stop send -83158000
May  5 07:05:05 kernel: Set wait done --83158000
May  5 07:05:05 kernel: DCS: ol_ath_disable_dcsim dcs state 0 
May  5 07:05:05 kernel: ieee80211_ioctl_getparam : parameter 0x284 not supported 
May  5 07:05:05 syslog: Generating SSL certificate...
May  5 07:05:05 kernel:  
May  5 07:05:05 kernel:  DES SSID SET=************ 
May  5 07:05:05 kernel: [ieee80211_ioctl_setmlme] set desired bssid *****************
May  5 07:05:05 kernel: Getting extcaps from Scan Entry 
May  5 07:05:05 kernel: wlan_mlme_join_infra.. SETTING CHANNEL NUMBER 1 CURR CHANNEl is 1 flags 0x10080
May  5 07:05:05 kernel: Getting extcaps from Scan Entry 
May  5 07:05:05 kernel: wlan_mlme_join_infra.. SETTING CHANNEL NUMBER 1 CURR CHANNEl is 1 flags 0x10080
May  5 07:05:08 kernel:  
May  5 07:05:08 kernel:  DES SSID SET=************ 
May  5 07:05:08 kernel:  ieee80211_ioctl_siwmode: imr.ifm_active=66176, new mode=3, valid=1 
May  5 07:05:08 kernel:  DEVICE IS DOWN ifname=ath1
May  5 07:05:08 kernel:  DEVICE IS DOWN ifname=ath1
May  5 07:05:08 kernel: OL vap_stop +
May  5 07:05:08 kernel: wmi_unified_vdev_stop_send for vap 0 (82850000)
May  5 07:05:08 kernel: OL vap_stop -
May  5 07:05:08 kernel: STOPPED EVENT for vap 0 (82850000)
May  5 07:05:08 kernel: OL vap_start +
May  5 07:05:08 kernel: wmi_unified_vdev_start_send for vap 0 (82850000)
May  5 07:05:08 kernel: OL vap_start -
May  5 07:05:08 kernel: ol_vdev_start_resp_ev for vap 0 (82850000)
May  5 07:05:08 kernel: ol_ath_vap_join: join operation is only for STA/IBSS mode
May  5 07:05:08 kernel: ol_ath_wmm_update:
May  5 07:05:09 kernel: ol_if_dfs_configure: called
May  5 07:05:09 kernel: ol_if_dfs_configure: ETSI domain
May  5 07:05:09 kernel: ol_if_dfs_disable: called
May  5 07:05:09 kernel: ol_if_dfs_enable: called
May  5 07:05:09 kernel: cac_start chan 5260 timeout 62 sec, curr time: 4294688 sec
May  5 07:05:09 kernel: Notification to UMAC VAP layer
May  5 07:05:09 kernel: [wifi1] FWLOG: [31442] WAL_DBGID_SECURITY_ENCR_EN (  )
May  5 07:05:09 kernel: [wifi1] FWLOG: [31442] WAL_DBGID_SECURITY_MCAST_KEY_SET ( 0x1 )
May  5 07:05:14 rc_service: wlcconnect 231:notify_rc restart_wlcmode 1
May  5 07:05:14 kernel: wmi_unified_vdev_stop_send for vap 0 (82850000)
May  5 07:05:14 kernel: STOPPED EVENT for vap 0 (82850000)
May  5 07:05:14 kernel: OL vap_stop +
May  5 07:05:14 kernel: wmi_unified_vdev_stop_send for vap 0 (82850000)
May  5 07:05:14 kernel: OL vap_stop -
May  5 07:05:14 kernel: STOPPED EVENT for vap 0 (82850000)
May  5 07:05:14 kernel: OL vap_start +
May  5 07:05:14 kernel: wmi_unified_vdev_start_send for vap 0 (82850000)
May  5 07:05:14 kernel: OL vap_start -
May  5 07:05:15 kernel: ol_vdev_start_resp_ev for vap 0 (82850000)
May  5 07:05:15 kernel: ol_ath_vap_join: join operation is only for STA/IBSS mode
May  5 07:05:15 kernel: ol_ath_wmm_update:
May  5 07:05:15 kernel: ol_if_dfs_configure: called
May  5 07:05:15 kernel: ol_if_dfs_configure: ETSI domain
May  5 07:05:15 kernel: ol_if_dfs_disable: called
May  5 07:05:15 kernel: ol_if_dfs_enable: called
May  5 07:05:15 kernel: cac_start chan 5260 timeout 62 sec, curr time: 4294694 sec
May  5 07:05:15 kernel: Notification to UMAC VAP layer
May  5 07:05:23 RP-AC66: start httpd:80
May  5 07:05:23 rc_service: udhcpc_lan 350:notify_rc start_dnsmasq
May  5 07:05:23 ntp: start NTP update
Dec  7 11:11:06 notify wanduck: wlc_state change!
Dec  7 11:11:09 kernel: [wifi1] FWLOG: [49362] WAL_DBGID_SECURITY_MCAST_KEY_SET ( 0x2 )
Dec  7 11:11:11 nat: apply nat rules (/tmp/nat_rules_repeater)
Dec  7 11:11:59 kernel: cac_timeout cac expired, chan 5260 curr time 4294756
Dec  7 11:11:59 kernel: wmi_unified_vdev_up_send for vap 0 (82850000)
Dec  7 11:17:21 kernel:

slh · December 9, 2021, 1:46am

https://wikidevi.wi-cat.ru/ASUS_RP_series suggests QCA956x/QCA8033, without a lot of details. If correct -and your logs do indicate Atheros and ath79 as well- it shouldn't be too hard to port OpenWrt to it (unless the vendor worked on making that extra hard). 16 MB flash and 64 MB RAM would be a tad odd, but still possible.

In the end it depends on someone with the hardware on their desk working on it, at this point you'd be the only candidate.

tsb · December 9, 2021, 12:58pm

Thanx for your input and the details, do you mean I'd better off building a custom fw like explained here: https://openwrt.org/docs/guide-developer/toolchain/beginners-build-guide or would it make more sense to look somehow for a generic build, or even an already existing build for a similar HW?

TiA

slh · December 9, 2021, 9:28pm

There is no such thing as a 'generic' version of OpenWrt for embedded targets like mips or arm. If you want to see your device to be supported by OpenWrt, you'll have to go the long way round and port it to your device properly.

https://openwrt.org/docs/guide-developer/toolchain/beginners-build-guide is part of that journey, but by far the most trivial one, you'd first have to develop the necessary bits and pieces on the source level. https://openwrt.org/docs/guide-developer/add.new.device might provide some hints.

tsb · December 10, 2021, 8:26am

I was doing some research, built some images too, but it looks like this QCA device is not available, at least I didn't see it in menuconfig. Is it still possible that it is in some older branches? Can you tell me please an effective way, how to find if and where the QCA956x was supported?
TiA

jdwl1o1 · December 11, 2021, 12:33am

Hi tsb,

You won't find menuconfig options for a particular SOC, the descriptions have to be unique to each supported device due to manufacturers implementing a particular SOC differently - to suit their purposes.

The big items manufacturers change is the amount and type of RAM and flash they have added to create the board.

To create an image for your Asus device you need;

a unique dts (device descriptor) file that suits that device. If the device isn't mainline already then you will need to create this yourself, or extract it from the source files of the manufacturer of the device. Usually creating the dts is the hardest part of bringing up a device.
then you need to build openwrt from source with your dts added to the source tree AND any required edits made to the source. The absolutely bare minimum is to edit the makefiles to tell the build process about your custom dts.

In short, don't worry whether QCA956x is supported - if the factory image is linux then the SOC is supported. The issue is telling the openwrt build process that this particular implementation of the SOC exists and what parameters the particular implementation needs to be bootable.

Go through the add new device steps linked above and have a go at building an image. Once you have one attempt booting the initramfs image via tftp or from usb to see if the image is viable. If it works, sysupgrade to write your image to flash.
If it doesn't, share the bootlogs and maybe folks can help you out.

tsb · December 11, 2021, 12:41pm

Thanx for your helpful info; I'm still at the beginning of this whole stuff

It just happened, that I found the original source of the latest build on Asus' website: https://dlcdnets.asus.com/pub/ASUS/wireless/RP-AC66/GPL_RP_AC66_300438250772.zip
Interestingly it has OpenWrt packages in the tools folder however on first look(!) I didn't see dts files, nor mach files for this device, but still have to look deeper.

I have the hope with the source it is possible to create the dts for the device, however I'm pretty new to this. Do you maybe have some advice on which way to proceed?

TiA!

jdwl1o1 · December 11, 2021, 8:37pm

Hey, happy to give some pointers - everyone starts somewhere.

The first thing you're going to need is serial access and a uBoot log. The SOC in this box has many variants, without knowing exactly what cpu it is it will be impossible to create a dts.

Once you have serial and can see what the unit actually is - then find a preexisting dts for a similar unit. DTS can be found in the mainline kernels and Openwrt source tree.

Grab the dts from a device that has the same SOC, CPU and ram and flash sizes and then edit it to add or remove anything your unit has that the example device doesn't.

Key things that will have to change are ram layout (maybe) and flash layout (dts absolutely must match the device layout). If the flash description in the dts doesn't match your device it won't boot and you cannot install wrt to the flash.

With the limited info provided this box may be similar;

And the full table of potentially similar devices;

tsb · December 11, 2021, 9:07pm

Hey, this is so far I collected from the source and from the device itself:

config RPAC66	bool "RP-AC66 (QCA9563 + QCA9880 + QCA8033)"



@RP-AC66:/tmp/home/root# cat /proc/cmdline
 board=AP152 console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs mem=64M



@RP-AC66:/tmp/home/root# cat /proc/cpuinfo
system type             : Qualcomm Atheros QCA956X rev 0
machine                 : Qualcomm Atheros AP152 reference board
processor               : 0
cpu model               : MIPS 74Kc V5.0
BogoMIPS                : 385.84
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0ffc, 0x0ffb, 0x0ff8]
ASEs implemented        : mips16 dsp
shadow register sets    : 1
kscratch registers      : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available



@RP-AC66:/tmp/home/root# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "Bootloader"
mtd1: 00010000 00010000 "nvram"
mtd2: 00010000 00010000 "Factory"
mtd3: 00f20000 00010000 "linux"
mtd4: 00e21f80 00010000 "rootfs"
mtd5: 00080000 00010000 "jffs2"
mtd6: 01000000 00010000 "ALL"



@RP-AC66:/tmp/home/root# dmesg
Linux version 3.3.8 (root@asus) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Thu Jul 12 10:30:30 CST 2018
CPU revision is: 00019750 (MIPS 74Kc)
SoC: Qualcomm Atheros QCA956X rev 0
Clocks: CPU:775.000MHz, DDR:650.000MHz, AHB:258.333MHz, Ref:25.000MHz
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
Early memory PFN ranges
    0: 0x00000000 -> 0x00004000
On node 0 totalpages: 16384
free_area_init_node: node 0, pgdat 80311660, node_mem_map 81000000
  Normal zone: 128 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 16256 pages, LIFO batch:3
pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
pcpu-alloc: [0] 0
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 16256
Kernel command line:  board=AP152 console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs mem=64M
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 61396k/65536k available (2263k kernel code, 4140k reserved, 496k data, 188k init, 0k highmem)
SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:83
Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
gpiochip_add: registered GPIOs 0 to 22 on device: ath79
MIPS: machine is Qualcomm Atheros AP152 reference board
registering PCI controller with io_map_base unset
ar71xx: using random MAC address for eth0
bio: create slab <bio-0> at 0
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
pci_bus 0000:00: root bus resource [io  0x0001]
pci 0000:00:00.0: [168c:003c] type 0 class 0x000280
pci 0000:00:00.0: reg 10: [mem 0x00000000-0x001fffff 64bit]
pci 0000:00:00.0: reg 30: [mem 0x00000000-0x0000ffff pref]
pci 0000:00:00.0: supports D1
pci 0000:00:00.0: PME# supported from D0 D1 D3hot
pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
pci 0000:00:00.0: using irq 40 for pin 1
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
PCI: CLS 0 bytes, default 32
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 119
alg: No test for xz (xz-generic)
alg: No test for stdrng (krng)
io scheduler noop registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
console [ttyS0] enabled
brd: module loaded
m25p80 spi0.0: found mx25l12805d, expected m25p80
m25p80 spi0.0: mx25l12805d (16384 Kbytes)
Creating 7 MTD partitions on "ath79-nor0":
0x000000000000-0x000000040000 : "Bootloader"
0x000000040000-0x000000050000 : "nvram"
0x000000050000-0x000000060000 : "Factory"
0x000000060000-0x000000f80000 : "linux"
0x00000015e080-0x000000f80000 : "rootfs"
0x000000f80000-0x000001000000 : "jffs2"
0x000000000000-0x000001000000 : "ALL"
IMQ driver loaded successfully. (numdevs = 8, numqueues = 1)
        Hooking IMQ after NAT on PREROUTING.
        Hooking IMQ before NAT on POSTROUTING.
ag71xx_mdio: probed
eth0: Atheros AG71xx at 0xb9000000, irq 4, MAC C6:58:D6:3B:2A:B5
ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.0:03 [uid=004dd074, driver=Qualcomm Atheros AR8033 PHY]
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
u32 classifier
nf_conntrack version 0.5.0 (959 buckets, 3836 max)
xt_time: kernel timezone is -0000
GRE over IPv4 demultiplexor driver
ip_tables: (C) 2000-2006 Netfilter Core Team
arp_tables: (C) 2002 David S. Miller
TCP cubic registered
NET: Registered protocol family 17
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
8021q: 802.1Q VLAN Support v1.8
### of_selftest(): No testcase data in device tree; not running tests
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 188k freed
offset 0x9800 elapse 0ms
found private data block and skip it
asf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
****Address of trace_timer :8340e690
ath_hal: Unknown parameter `ce_level'
ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_spectral: Version 2.0.0
Copyright (c) 2005-2009 Atheros Communications, Inc. All Rights Reserved
SPECTRAL module built on Jul 12 2018 10:36:01
ath_tx99: Version 2.0
Copyright (c) 2010 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
__ath_attach: Set global_scn[0]
*** All the minfree values should be <= ATH_TXBUF-32, otherwise default value will be used instead ***
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
ATH_TXBUF=540
Enterprise mode: 0x03bda000
Restoring Cal data from DRAM

ART Version : 49.517
SW Image Version : 0.20.-13.3.3
Board Revision : 6
ar9300_attach: nf_2_nom -110 nf_2_max -60 nf_2_min -125
SPECTRAL : get_capability not registered
HAL_CAP_PHYDIAG : Capable
SPECTRAL : Need to fix the capablity check for RADAR (spectral_attach : 231)
SPECTRAL : get_capability not registered
HAL_CAP_RADAR   : Capable
SPECTRAL : Need to fix the capablity check for SPECTRAL
 (spectral_attach : 236)
SPECTRAL : get_capability not registered
HAL_CAP_SPECTRAL_SCAN : Capable
SPECTRAL : get_tsf64 not registered
spectral_init_netlink 65 NULL SKB
SPECTRAL : No ADVANCED SPECTRAL SUPPORT
SPECTRAL :----- module attached
Green-AP : Green-AP : Attached

ath_get_caps[6267] rx chainmask mismatch actual 7 sc_chainmak 0
ath_get_caps[6242] tx chainmask mismatch actual 7 sc_chainmak 0
band steering initialized for direct attach hardware
ieee80211_bsteering_attach: Band steering initialized
ath_attach_dfs[12799] dfsdomain 1
SPECTRAL : module already attached
osif_wrap_attach:296 osif wrap attached
osif_wrap_devt_init:916 osif wrap dev table init done
ath_tx_paprd_init sc 82f58000 PAPRD disabled in HAL
wifi0: Atheros 956X: mem=0xb8100000, irq=47
ath_pci: SmartAntenna-DRT-0.1 (Atheros/multi-bss)
ath_pci_probe
PCI device id is 003c :003c
ath_pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
ath_pci 0000:00:00.0: ath DEBUG: sc=0x82aa7e00

 ol_ath_pci_configure : num_desired MSI set to 0

 Using PCI Legacy Interrupt
CE_per_engine_handler_adjust, base=82aa7e00 offset=00057400
CE_per_engine_handler_adjust, base=82aa7e00 offset=00057800
__ol_ath_attach: ath_attach TODO
__ol_ath_attach: dev name wifi1
ol_ath_set_default_tgt_config : AC Minfree buffer allocation through module param (umac.ko)
 OL_ACBKMinfree : 0
 OL_ACBEMinfree : 0
 OL_ACVIMinfree : 0
 OL_ACVOMinfree : 0
ol_ath_attach() BMI inited.
ol_ath_attach() BMI Get Target Info.
ol_ath_attach() TARGET TYPE: 7 Vers 0x4100016c
NUM_DEV=1 FWMODE=0x2 FWSUBMODE=0x0 FWBR_BUF 0
ol_ath_attach() configure Target .
ath_nand_local_read: cal_part [Factory] from 5000 len 844
ath_nand_local_read: cal_part [Factory] from d188 len 2
qc98xx_verify_checksum: flash checksum passed: 0xac98
ol_transfer_bin_file 2274: Download Flash data len 2116
 Download AR9888v2_bin
ol_transfer_bin_file 2170: Download Firmware data len 235840
ol_ath_attach() Download FW.
ol_ath_attach() HT Create .
ol_ath_attach() HIF Claim.
ol_ath_attach() BMI Done.
ol_ath_attach() WMI attached. wmi_handle 82840000
+HWT
SOC_RESET_CONTROL_ADDRESS : 800
CPU_INTR_ADDRESS = [0]
SOC_GLOBAL_RESET_ADDRESS = [0]
Rx_Filter : [0]
CE_per_engine_handler_adjust, base=82aa7e00 offset=00057400
CE_per_engine_handler_adjust, base=82aa7e00 offset=00057800
CE_per_engine_handler_adjust, base=82aa7e00 offset=00057c00
CE_per_engine_handler_adjust, base=82aa7e00 offset=00058000
CE_per_engine_handler_adjust, base=82aa7e00 offset=00058400
CE_per_engine_handler_adjust, base=82aa7e00 offset=00058800
CE_recv_buf_enqueue 653 Populate last entry 512 for CE 5
CE_recv_buf_enqueue 662 CE 5 wi 511 dest_ptr 0x200ec40 nbytes 0 recv_ctxt 0x82003600
Target:83d22000 HTC Service:0x0001, ULpipe:0 DLpipe:1 id:0 Ready
-HWT
Target:83d22000 HTC Service:0x0300, ULpipe:4 DLpipe:5 id:1 Ready
HTC Service:0x0300 ep:1 TX flow control disabled
CE_pkt_dl_len_set CE 4 Pkt download length 64
ol_txrx_pdev_attach: 1424 tx desc's allocated ; range starts from 81c50000
Target:83d22000 HTC Service:0x0100, ULpipe:3 DLpipe:2 id:2 Ready
HTC Service:0x0100 ep:2 TX flow control disabled
wmi_service_ready_event_rx:  WMI UNIFIED SERVICE READY event
num_rf_chain : 00000003
ht_cap_info: : 0000085b
vht_cap_info : 338001b2
vht_supp_mcs : 0000ffea
LARGE_AP enabled. num_peers 144, num_vdevs 16, num_tids 256, lteu_support 0
idx 0 req 1  num_units 0 num_unit_info 2 unit size 440 actual units 145
chunk 0 len 63800 requested ,ptr  0x1c60000
FIRMWARE:P 145 V 16 T 443

FIRMWARE:_wlan_rtt_enable
wmi_ready_event_rx:  WMI UNIFIED READY event
ol_ath_connect_htc() WMI is ready
ol_ath_set_host_app_area TODO
target uses HTT version 2.1; host uses 2.1
ol_ath_attach() connect HTC.
bypasswmi : 0
ol_regdmn_start: reg-domain param: regdmn=0, countryName=, wModeSelect=FFFFFFFF, netBand=FFFFFFFF, extendedChanMode=0.
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2) flags 0x2150
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4) flags 0xa0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x8) flags 0xc0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x20) flags 0xd0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x40) flags 0x150
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x800) flags 0x10080
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2000) flags 0x20080
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4000) flags 0x40080
Add VHT80 channel: 5210
Add VHT80 channel: 5775
Skipping VHT80 channel 5825
ol_ath_phyerr_attach: called
OL Resmgr Init-ed
ieee80211_bsteering_attach: Band steering initialized
ol_if_spectral_setup
SPECTRAL : get_capability not registered
HAL_CAP_PHYDIAG : Capable
SPECTRAL : Need to fix the capablity check for RADAR (spectral_attach : 231)
SPECTRAL : get_capability not registered
HAL_CAP_RADAR   : Capable
SPECTRAL : Need to fix the capablity check for SPECTRAL
 (spectral_attach : 236)
SPECTRAL : get_capability not registered
HAL_CAP_SPECTRAL_SCAN : Capable
SPECTRAL : get_tsf64 not registered
spectral_init_netlink 65 NULL SKB
Green-AP : Green-AP : Attached

Green-AP : Attached
ol_if_dfs_setup: called
ol_if_dfs_attach: called; ptr=81c4d974, radar_info=837b7b78
ol_ath_rtt_meas_report_attach: called
ol_ath_attach() UMAC attach .
ol_if_dfs_configure: called
ol_if_dfs_configure: UNINIT domain
ol_if_dfs_disable: called
ol_ath_attach: Calling ol_if_dfs_configure
osif_wrap_attach:296 osif wrap attached
osif_wrap_devt_init:916 osif wrap dev table init done
__ol_ath_attach: init tx/rx TODO
__ol_ath_attach: hard_header_len reservation 58
sc nodebug 0
ath_attach_dfs[12799] dfsdomain 1
isCountryCodeValid: EEPROM regdomain 0x0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2) flags 0x2150
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4) flags 0xa0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x8) flags 0xc0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x20) flags 0xd0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x40) flags 0x150
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x800) flags 0x10080
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2000) flags 0x20080
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4000) flags 0x40080
Add VHT80 channel: 5210
Add VHT80 channel: 5290
Add VHT80 channel: 5530
Skipping VHT80 channel 5580
Skipping VHT80 channel 5660
Skipping VHT80 channel 5680
Skipping VHT80 channel 5700
[wifi1] FWLOG: [20818] WAL_DBGID_TX_AC_BUFFER_SET ( 0x3, 0x1e, 0x460, 0x460, 0x0 )
[wifi1] FWLOG: [20818] WAL_DBGID_TX_AC_BUFFER_SET ( 0x12, 0x1e, 0x460, 0x460, 0x0 )
[wifi1] FWLOG: [20818] WAL_DBGID_TX_AC_BUFFER_SET ( 0x45, 0x1e, 0x460, 0x460, 0x0 )
[wifi1] FWLOG: [20818] WAL_DBGID_TX_AC_BUFFER_SET ( 0x67, 0x1e, 0x460, 0x460, 0x0 )
[wifi1] FWLOG: [20823] WHAL_ERROR_RECV_STOPPCU ( 0x110298a, 0x3 )
[wifi1] FWLOG: [20823] WHAL_ERROR_RESET_PM (  )
[wifi1] FWLOG: [20829] WAL_DBGID_DEV_RESET ( 0x1, 0x1, 0x1 )
[wifi1] FWLOG: [21008] ANI Enable:  1
[wifi1] FWLOG: [21015] WAL_DBGID_DEV_RESET ( 0x1, 0x1, 0x1 )
wlan_vap_create : enter. devhandle=0x82a80380, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x82a80380, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created osifp: (81d2cb80) os_if: (83144000)
[wifi1] FWLOG: [23280] WAL_DBGID_BB_WDOG_TRIGGERED ( 0x5af0, 0x2300000a, 0x1030, 0x5 )
ath_ioctl: SIOC80211IFCREATE CALLED
wmi_unified_vdev_create_send: ID = 0 VAP Addr = 88:d7:f6:a3:a6:26:
Setting dscp for vap id: 0
VAP device ath1 created osifp: (81d2e380) os_if: (81d50000)
device eth0 entered promiscuous mode
device ath0 entered promiscuous mode
device ath1 entered promiscuous mode
        DCS for CW interference mitigation:   0
        DCS for WLAN interference mitigation: 0
Ebtables v2.0 registered
eth0: link up (1000Mbps/Full duplex)
br0: port 1(eth0) entered forwarding state
br0: port 1(eth0) entered forwarding state

I also found some similar dts files around, mainly from Tp-Link devices, so I will research there more.
Ofc if serial access is needed, I'll have to do that too. As I looked around in the source, it seemed the device accepts only "real" trx flash files, so probably I have to do some serial flash in the end.

tsb · December 13, 2021, 7:40pm

And here we go with a serial log, may it also help someone out there:


U-Boot 1.1.4-g2f741f5f-dirty (Jul 20 2015 - 09:50:50)

RP-AC66 bootloader version: 1.0.0.2
ap152 - Dragonfly 1.0DRAM:
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0xe, 0xe, 0xe, 0xe)
64 MB
ASUS RP-AC66 gpio init : wps / reset pin
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Maximum malloc length: 128 KBytes
mem_malloc_start/brk/end: 0x83f98000/83f98000/83fc8000
*** Warning - bad CRC, using default environment

plat_dev_init: read 16384 bytes from offset 9fff1000 of WLANCAL fail! (r = -1)
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
Fetching MAC Address from 0x83fecbec
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly ---->8033 PHY*
AR8033 PHY init
athrs_ar8033_reg_init: Done 8111 (phyid: 3)
Max resets limit reached exiting...
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 88:d7:f6:a3:a6:24
eth0 up
eth0
ath_set_tuning_caps: read WLANCAL fail!!! (r = -1)

Please choose the operation:
   1: Load System code to SDRAM via TFTP.
   2: Load System code then write to Flash via TFTP.
   3: Boot System code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.                                                                                                 0
   3: Boot System code via Flash (default).

RP-AC66 bootloader version: 1.0.0.2
MAC Address: 88:D7:F6:A3:A6:24
## Checking 1st firmware at 9f060000 ...
   Image Name:
   Created:      2018-07-12   2:48:36 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    11816776 Bytes = 11.3 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
## Giving linux ramsize: 67108864 (64 MB)

Starting kernel ...

Linux version 3.3.8 (root@asus) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Thu Jul 12 10:30:30 CST 2018
CPU revision is: 00019750 (MIPS 74Kc)
SoC: Qualcomm Atheros QCA956X rev 0
Clocks: CPU:775.000MHz, DDR:650.000MHz, AHB:258.333MHz, Ref:25.000MHz
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
Early memory PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 16256
Kernel command line:  board=AP152 console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs mem=64M
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 61396k/65536k available (2263k kernel code, 4140k reserved, 496k data, 188k init, 0k highmem)
SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:83
Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
gpiochip_add: registered GPIOs 0 to 22 on device: ath79
MIPS: machine is Qualcomm Atheros AP152 reference board
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
pci_bus 0000:00: root bus resource [io  0x0001]
pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
pci 0000:00:00.0: using irq 40 for pin 1
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 119
alg: No test for xz (xz-generic)
alg: No test for stdrng (krng)
io scheduler noop registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
console [ttyS0] enabled
brd: module loaded
m25p80 spi0.0: found mx25l12805d, expected m25p80
m25p80 spi0.0: mx25l12805d (16384 Kbytes)
Creating 7 MTD partitions on "ath79-nor0":
0x000000000000-0x000000040000 : "Bootloader"
0x000000040000-0x000000050000 : "nvram"
0x000000050000-0x000000060000 : "Factory"
0x000000060000-0x000000f80000 : "linux"
0x00000015e080-0x000000f80000 : "rootfs"
0x000000f80000-0x000001000000 : "jffs2"
0x000000000000-0x000001000000 : "ALL"
IMQ driver loaded successfully. (numdevs = 8, numqueues = 1)
        Hooking IMQ after NAT on PREROUTING.
        Hooking IMQ before NAT on POSTROUTING.
ag71xx_mdio: probed
eth0: Atheros AG71xx at 0xb9000000, irq 4, MAC C6:58:D6:3B:2A:B5
ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.0:03 [uid=004dd074, driver=Qualcomm Atheros AR8033 PHY]
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
u32 classifier
nf_conntrack version 0.5.0 (959 buckets, 3836 max)
xt_time: kernel timezone is -0000
GRE over IPv4 demultiplexor driver
ip_tables: (C) 2000-2006 Netfilter Core Team
arp_tables: (C) 2002 David S. Miller
TCP cubic registered
NET: Registered protocol family 17
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
8021q: 802.1Q VLAN Support v1.8
### of_selftest(): No testcase data in device tree; not running tests
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 188k freed
/dev/nvram: No such device or address
/dev/nvram: No such device or address
offset 0x9800 elapse 0ms
1: set_action 0


Hit ENTER for console...

firmware version: 3.0.0.4.382_50772-gdcf817e
bootloader version: RP-AC66-01-00-00-02
firmware version: 3.0.0.4
[1 init:init_nvram +5] init_nvram for model(69)
set_basic_ifname_vars: WAN eth0 LAN eth0 2G ath0 5G ath1 60G N/A USB (null) AP_LAN eth0 DW_WAN (null) DW_LAN (null) force_dwlan 0, sw_mode 3
wan_ifnames:
get_wan_mac_name: Define WAN MAC address for model 69
get_wan_mac_name: Define WAN MAC address for model 69
config_switch(0x01e5): link down all ports
config_qca8337_LANWANPartition: LAN/WAN/WANS_LAN portmask 0000003c/00000002/00000000
__mask_to_portnumber_str: mask(0000003d) untag(0000003d) portstr[0  2  3  4  5  ]
config_switch(0x037c): link up wan port(s)
asf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
****Address of trace_timer :83ba6690
ath_hal: Unknown parameter `ce_level'
ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_spectral: Version 2.0.0
Copyright (c) 2005-2009 Atheros Communications, Inc. All Rights Reserved
SPECTRAL module built on Jul 12 2018 10:36:01
ath_tx99: Version 2.0
Copyright (c) 2010 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
__ath_attach: Set global_scn[0]
*** All the minfree values should be <= ATH_TXBUF-32, otherwise default value will be used instead ***
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
ATH_TXBUF=540
Enterprise mode: 0x03bda000
Restoring Cal data from DRAM

ART Version : 49.517
SW Image Version : 0.20.-13.3.3
Board Revision : 6
ar9300_attach: nf_2_nom -110 nf_2_max -60 nf_2_min -125
SPECTRAL : get_capability not registered
HAL_CAP_PHYDIAG : Capable
SPECTRAL : Need to fix the capablity check for RADAR (spectral_attach : 231)
SPECTRAL : get_capability not registered
HAL_CAP_RADAR   : Capable
SPECTRAL : Need to fix the capablity check for SPECTRAL
 (spectral_attach : 236)
SPECTRAL : get_capability not registered
HAL_CAP_SPECTRAL_SCAN : Capable
SPECTRAL : get_tsf64 not registered
spectral_init_netlink 65 NULL SKB
SPECTRAL : No ADVANCED SPECTRAL SUPPORT
SPECTRAL :----- module attached
Green-AP : Green-AP : Attached

ath_get_caps[6267] rx chainmask mismatch actual 7 sc_chainmak 0
ath_get_caps[6242] tx chainmask mismatch actual 7 sc_chainmak 0
band steering initialized for direct attach hardware
ieee80211_bsteering_attach: Band steering initialized
ath_attach_dfs[12799] dfsdomain 1
SPECTRAL : module already attached
osif_wrap_attach:296 osif wrap attached
osif_wrap_devt_init:916 osif wrap dev table init done
ath_tx_paprd_init sc 82f68000 PAPRD disabled in HAL
wifi0: Atheros 956X: mem=0xb8100000, irq=47
ath_pci: SmartAntenna-DRT-0.1 (Atheros/multi-bss)
ath_pci_probe
PCI device id is 003c :003c
ath_pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
ath_pci 0000:00:00.0: ath DEBUG: sc=0x82af3e00

 ol_ath_pci_configure : num_desired MSI set to 0

 Using PCI Legacy Interrupt
hotplug net INTERFACE=wifi0 ACTION=add
CE_per_engine_handler_adjust, base=82af3e00 offset=00057400
CE_per_engine_handler_adjust, base=82af3e00 offset=00057800
__ol_ath_attach: ath_attach TODO
__ol_ath_attach: dev name wifi1
ol_ath_set_default_tgt_config : AC Minfree buffer allocation through module param (umac.ko)
 OL_ACBKMinfree : 0
 OL_ACBEMinfree : 0
 OL_ACVIMinfree : 0
 OL_ACVOMinfree : 0
ol_ath_attach() BMI inited.
ol_ath_attach() BMI Get Target Info.
ol_ath_attach() TARGET TYPE: 7 Vers 0x4100016c
NUM_DEV=1 FWMODE=0x2 FWSUBMODE=0x0 FWBR_BUF 0
ol_ath_attach() configure Target .
ath_nand_local_read: cal_part [Factory] from 5000 len 844
ath_nand_local_read: cal_part [Factory] from d188 len 2
qc98xx_verify_checksum: flash checksum passed: 0xac98
ol_transfer_bin_file 2274: Download Flash data len 2116
 Download AR9888v2_bin
ol_transfer_bin_file 2170: Download Firmware data len 235840
ol_ath_attach() Download FW.
ol_ath_attach() HT Create .
ol_ath_attach() HIF Claim.
ol_ath_attach() BMI Done.
ol_ath_attach() WMI attached. wmi_handle 82850000
+HWT
SOC_RESET_CONTROL_ADDRESS : 800
CPU_INTR_ADDRESS = [0]
SOC_GLOBAL_RESET_ADDRESS = [0]
Rx_Filter : [0]
CE_per_engine_handler_adjust, base=82af3e00 offset=00057400
CE_per_engine_handler_adjust, base=82af3e00 offset=00057800
CE_per_engine_handler_adjust, base=82af3e00 offset=00057c00
CE_per_engine_handler_adjust, base=82af3e00 offset=00058000
CE_per_engine_handler_adjust, base=82af3e00 offset=00058400
CE_per_engine_handler_adjust, base=82af3e00 offset=00058800
CE_recv_buf_enqueue 653 Populate last entry 512 for CE 5
CE_recv_buf_enqueue 662 CE 5 wi 511 dest_ptr 0x2020c40 nbytes 0 recv_ctxt 0x82015600
Target:83d22000 HTC Service:0x0001, ULpipe:0 DLpipe:1 id:0 Ready
-HWT
Target:83d22000 HTC Service:0x0300, ULpipe:4 DLpipe:5 id:1 Ready
HTC Service:0x0300 ep:1 TX flow control disabled
CE_pkt_dl_len_set CE 4 Pkt download length 64
ol_txrx_pdev_attach: 1424 tx desc's allocated ; range starts from 81c60000
Target:83d22000 HTC Service:0x0100, ULpipe:3 DLpipe:2 id:2 Ready
HTC Service:0x0100 ep:2 TX flow control disabled
wmi_service_ready_event_rx:  WMI UNIFIED SERVICE READY event
num_rf_chain : 00000003
ht_cap_info: : 0000085b
vht_cap_info : 338001b2
vht_supp_mcs : 0000ffea
LARGE_AP enabled. num_peers 144, num_vdevs 16, num_tids 256, lteu_support 0
idx 0 req 1  num_units 0 num_unit_info 2 unit size 440 actual units 145
chunk 0 len 63800 requested ,ptr  0x1c70000
FIRMWARE:P 145 V 16 T 443

FIRMWARE:_wlan_rtt_enable
wmi_ready_event_rx:  WMI UNIFIED READY event
ol_ath_connect_htc() WMI is ready
ol_ath_set_host_app_area TODO
target uses HTT version 2.1; host uses 2.1
ol_ath_attach() connect HTC.
bypasswmi : 0
ol_regdmn_start: reg-domain param: regdmn=0, countryName=, wModeSelect=FFFFFFFF, netBand=FFFFFFFF, extendedChanMode=0.
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2) flags 0x2150
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4) flags 0xa0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x8) flags 0xc0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x20) flags 0xd0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x40) flags 0x150
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x800) flags 0x10080
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2000) flags 0x20080
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4000) flags 0x40080
Add VHT80 channel: 5210
Add VHT80 channel: 5775
Skipping VHT80 channel 5825
ol_ath_phyerr_attach: called
OL Resmgr Init-ed
ieee80211_bsteering_attach: Band steering initialized
ol_if_spectral_setup
SPECTRAL : get_capability not registered
HAL_CAP_PHYDIAG : Capable
SPECTRAL : Need to fix the capablity check for RADAR (spectral_attach : 231)
SPECTRAL : get_capability not registered
HAL_CAP_RADAR   : Capable
SPECTRAL : Need to fix the capablity check for SPECTRAL
 (spectral_attach : 236)
SPECTRAL : get_capability not registered
HAL_CAP_SPECTRAL_SCAN : Capable
SPECTRAL : get_tsf64 not registered
spectral_init_netlink 65 NULL SKB
Green-AP : Green-AP : Attached

Green-AP : Attached
ol_if_dfs_setup: called
ol_if_dfs_attach: called; ptr=81c5d974, radar_info=835e7b78
ol_ath_rtt_meas_report_attach: called
ol_ath_attach() UMAC attach .
ol_if_dfs_configure: called
ol_if_dfs_configure: UNINIT domain
ol_if_dfs_disable: called
ol_ath_attach: Calling ol_if_dfs_configure
osif_wrap_attach:296 osif wrap attached
osif_wrap_devt_init:916 osif wrap dev table init done
__ol_ath_attach: init tx/rx TODO
__ol_ath_attach: hard_header_len reservation 58
hotplug net INTERFACE=wifi1 ACTION=add
sc nodebug 0
ath_attach_dfs[12799] dfsdomain 1
isCountryCodeValid: EEPROM regdomain 0x0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2) flags 0x2150
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4) flags 0xa0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x8) flags 0xc0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x20) flags 0xd0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x40) flags 0x150
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x800) flags 0x10080
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2000) flags 0x20080
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4000) flags 0x40080
Add VHT80 channel: 5210
Add VHT80 channel: 5290
Add VHT80 channel: 5530
Skipping VHT80 channel 5580
Skipping VHT80 channel 5660
Skipping VHT80 channel 5680
Skipping VHT80 channel 5700
[wifi1] FWLOG: [20818] WAL_DBGID_TX_AC_BUFFER_SET ( 0x3, 0x1e, 0x460, 0x460, 0x0 )
[wifi1] FWLOG: [20818] WAL_DBGID_TX_AC_BUFFER_SET ( 0x12, 0x1e, 0x460, 0x460, 0x0 )
[wifi1] FWLOG: [20818] WAL_DBGID_TX_AC_BUFFER_SET ( 0x45, 0x1e, 0x460, 0x460, 0x0 )
[wifi1] FWLOG: [20818] WAL_DBGID_TX_AC_BUFFER_SET ( 0x67, 0x1e, 0x460, 0x460, 0x0 )
[wifi1] FWLOG: [20823] WHAL_ERROR_RECV_STOPPCU ( 0x110298a, 0x3 )
[wifi1] FWLOG: [20823] WHAL_ERROR_RESET_PM (  )
[wifi1] FWLOG: [20830] WAL_DBGID_DEV_RESET ( 0x1, 0x1, 0x1 )
[wifi1] FWLOG: [21008] ANI Enable:  1
[wifi1] FWLOG: [21015] WAL_DBGID_DEV_RESET ( 0x1, 0x1, 0x1 )
init_wl(0x053d): init_wl:create wi node
init_wl: Unknown wl-99 band, ifname [eth0]!
init_wl(0x0567):
create a wifi node ath0 from wifi0
wlan_vap_create : enter. devhandle=0x82f70380, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x82f70380, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created osifp: (81d40b80) os_if: (831ec000)
ath0
hotplug net INTERFACE=ath0 ACTION=add
init_wl(0x0567):
create a wifi node ath1 from wifi1
ath_ioctl: SIOC80211IFCREATE CALLED
wmi_unified_vdev_create_send: ID = 0 VAP Addr = 88:d7:f6:a3:a6:26:
Setting dscp for vap id: 0
VAP device ath1 created osifp: (81d42380) os_if: (83170000)
ath1
hotplug net INTERFACE=ath1 ACTION=add
start_logger:
update_lan_state(lan_, 0, 0)
/ # hotplug net INTERFACE=br0 ACTION=add
_ifconfig: name=eth0 flags=1243 IFUP addr= netmask=
start_lan: setting MAC address of bridge br0 as 88:D7:F6:A3:A6:24
_ifconfig: name=br0 flags=1243 IFUP addr=192.168.1.1 netmask=255.255.255.0
gen qca config
mac_filter[0] = 0
gen qca config
mac_filter[0] = 0
_ifconfig: name=ath0 flags=0000  addr= netmask=
_ifconfig: name=ath1 flags=0000  addr= netmask=
List Flushed
        DCS for CW interference mitigation:   0
        DCS for WLAN interference mitigation: 0
List Flushed
_ifconfig: name=lo flags=1043 IFUP addr=127.0.0.1 netmask=255.0.0.0
route_manip: cmd=ADD name=lo addr=127.0.0.0 netmask=255.0.0.0 gateway=0.0.0.0 metric=0
lan_up(br0)
[1 init:start_dnsmasq +16] begin
[1 init:stop_dnsmasq +16] begin
[1 init:stop_dnsmasq +16] end
route_manip: cmd=ADD name=br0 addr=0.0.0.0 netmask=0.0.0.0 gateway= metric=0
starting ntp...
update_lan_state(lan_, 2, 0)
start_lan 2739
# wanduck: Got LAN(-1) information:

# AP mode: Enable direct rule(DISCONN)
[1 init:start_dnsmasq +16] begin
[1 init:stop_dnsmasq +16] begin
killall_tk: waiting name=dnsmasq n=9
[1 init:stop_dnsmasq +16] end

# Enable direct rule
start_lan_port(0) 1
Write Reg: 0x00000000: Oldval = 0x00003100 Newval = 0x00003100
TZ watchdog
msgget ok
[1 init:init_main +17] recv signal 14 from pid [1:/sbin/init] (from user)

jdwl1o1 · December 13, 2021, 11:01pm

uBoot log looks good, device supports booting from TFTP.

If you press '4' to access the uBoot command line what options does the 'help' command give?

I'd suggest trying to boot an initrd image for one of the similar devices you identified from tftp and see what works and what doesn't. Likely failures will be the onboard flash storage (mtds), but they are easy to fix.

If openwrt boots from tftp then you will be very close to having a working device.

jdwl1o1 · December 13, 2021, 11:35pm

As for which Device is closest in specs, I'd suggest the dlink DIR-859. Same flash and ram size and the same WLAN2 hardware.

Initramfs image for the 859 is here; https://downloads.openwrt.org/releases/21.02.1/targets/ath79/generic/openwrt-21.02.1-ath79-generic-dlink_dir-859-a1-initramfs-kernel.bin

Should be possible to boot this via tftp from uBoot. Note: uboot won't care about TRX images or anything - send them image via tftp and it should be happy to boot it.

tsb · December 14, 2021, 4:13pm

Thanx again for your help! Just tried the DIR-859 via tftpboot, but it was popping up Bad magic number. I don't really know what causes this, maybe I'll need a newer U-boot?

However I tried this guy (which is a bit less similar to the HW) and it was starting via bootm 0x81000000:
https://openwrt.org/toh/hwdata/tp-link/tp-link_tl-wr1043n_v5
Well it was panicing, but it started
I think I try around some more (similar) firmwares too.

tsb · December 14, 2021, 5:02pm

Here we have bootlog, booting to this guy: https://openwrt.org/toh/hwdata/phicomm/phicomm_k2t

Filename 'openwrt-21.02.1-ath79-generic-phicomm_k2t-initramfs-kernel.bin'.
Load address: 0x81000000
Loading: T Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###########################################################
done
Bytes transferred = 4956357 (4ba0c5 hex)
NetBootFileXferSize= 004ba0c5
Automatic boot of image at addr 0x81000000 ...
## Checking image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-5.4.154
   Created:      2021-10-24   9:01:35 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    4956293 Bytes =  4.7 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
## Giving linux ramsize: 67108864 (64 MB)

Starting kernel ...

[    0.000000] Linux version 5.4.154 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16325-88151b8303)) #0 Sun Oct 24 09:01:35 2021
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is Phicomm K2T
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 48248K/65536K available (5252K kernel code, 191K rwdata, 688K rodata, 10244K init, 205K bss, 17288K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] random: get_random_bytes called from 0x8065fa28 with crng_init=0
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000007] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008226] Calibrating delay loop... 385.02 BogoMIPS (lpj=770048)
[    0.046712] pid_max: default: 32768 minimum: 301
[    0.051709] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.059421] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.071412] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.081730] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.089015] pinctrl core: initialized pinctrl subsystem
[    0.096895] NET: Registered protocol family 16
[    0.124227] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[    0.137814] clocksource: Switched to clocksource MIPS
[    0.144083] thermal_sys: Registered thermal governor 'step_wise'
[    0.144402] NET: Registered protocol family 2
[    0.155506] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.163806] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.172691] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.180785] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.188230] TCP: Hash tables configured (established 1024 bind 1024)
[    0.195051] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.201992] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.209640] NET: Registered protocol family 1
[    0.214289] PCI: CLS 0 bytes, default 32
[    0.396145] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.409213] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.415408] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.439225] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.450457] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.457469] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.466339] printk: console [ttyS0] disabled
[    0.470928] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.480038] printk: console [ttyS0] enabled
[    0.480038] printk: console [ttyS0] enabled
[    0.489092] printk: bootconsole [early0] disabled
[    0.489092] printk: bootconsole [early0] disabled
[    0.508752] spi-nor spi0.0: mx25l12805d (16384 Kbytes)
[    0.514159] 5 fixed-partitions partitions found on MTD device spi0.0
[    0.520734] Creating 5 MTD partitions on "spi0.0":
[    0.525702] 0x000000000000-0x000000030000 : "u-boot"
[    0.531690] 0x000000030000-0x000000040000 : "config"
[    0.537696] 0x000000040000-0x000000090000 : "permanent"
[    0.543960] 0x000000090000-0x000000ff0000 : "firmware"
[    0.564036] 0x000000ff0000-0x000001000000 : "art"
[    0.571529] libphy: Fixed MDIO Bus: probed
[    0.578849] ag71xx 19000000.eth: invalid MAC address, using random address
[    1.149808] random: fast init done
[    1.218200] libphy: ag71xx_mdio: probed
[    1.222327] mdio_bus mdio.0: MDIO device at address 0 is missing.
[    1.228705] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    1.236809] i2c /dev entries driver
[    1.242539] NET: Registered protocol family 10
[    1.251791] Segment Routing with IPv6
[    1.255736] NET: Registered protocol family 17
[    1.260403] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.273793] 8021q: 802.1Q VLAN Support v1.8
[    1.278943] PCI host bridge /ahb/pcie-controller@18250000 ranges:
[    1.285309]  MEM 0x0000000012000000..0x0000000013ffffff
[    1.290714]   IO 0x0000000000000000..0x0000000000000000
[    1.296283] PCI host bridge to bus 0000:00
[    1.300557] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    1.307662] pci_bus 0000:00: root bus resource [io  0x0000]
[    1.313421] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    1.320436] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.328651] pci 0000:00:00.0: [168c:003c] type 00 class 0x028000
[    1.334911] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    1.341971] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    1.348967] pci 0000:00:00.0: supports D1
[    1.353118] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    1.359924] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    1.366803] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    1.374382] pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[    1.382290] ag71xx 19000000.eth: invalid MAC address, using random address
[    1.702900] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    1.711167] ag71xx 19000000.eth: invalid MAC address, using random address
[    2.034881] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    2.042792] hctosys: unable to open rtc device (rtc0)
[    2.104110] Freeing unused kernel memory: 10244K
[    2.108901] This architecture does not have kernel memory protection.
[    2.115551] Run /init as init process
[    2.588412] init: Console is alive
[    2.592247] init: - watchdog -
[    2.612656] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.621961] ag71xx 19000000.eth: invalid MAC address, using random address
[    2.629647] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.647548] init: - preinit -
[    2.887803] random: jshn: uninitialized urandom read (4 bytes read)
[    2.942960] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    3.006761] random: jshn: uninitialized urandom read (4 bytes read)
/bin/board_detect: /etc/board.d/02_network: line 22: arithmetic syntax error
/bin/board_detect: /etc/board.d/02_network: line 22: arithmetic syntax error
[    3.191635] random: jshn: uninitialized urandom read (4 bytes read)
Failed to connect to the switch. Use the "list" command to see which switches are available.
Failed to connect to the switch. Use the "list" command to see which switches are available.
Failed to connect to the switch. Use the "list" command to see which switches are available.
Failed to connect to the switch. Use the "list" command to see which switches are available.
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    6.596643] procd: - early -
[    6.599768] procd: - watchdog -
[    7.163956] procd: - watchdog -
[    7.167594] procd: - ubus -
[    7.178315] urandom_read: 5 callbacks suppressed
[    7.178323] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.221277] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.230980] procd: - init -
Please press Enter to activate this console.
[    7.775787] kmodloader: loading kernel modules from /etc/modules.d/*
[    7.808890] Loading modules backported from Linux version v5.10.68-0-g4d8524048a35
[    7.816777] Backport generated by backports.git v5.10.68-1-0-ga4f9ba32
[    7.876613] xt_time: kernel timezone is -0000
[    7.996050] PPP generic driver version 2.4.2
[    8.004290] urngd: v1.0.2 started.
[    8.008842] NET: Registered protocol family 24
[    8.109411] Data bus error, epc == 802ad844, ra == 831a32b8
[    8.115174] Oops[#1]:
[    8.117523] CPU: 0 PID: 659 Comm: kmodloader Not tainted 5.4.154 #0
[    8.123986] $ 0   : 00000000 00000001 deadc0de 831e1cb4
[    8.129379] $ 4   : b81143fc 000143fc 82ef7a64 00000004
[    8.134773] $ 8   : 00000000 8057ac3c ffffff7f 61746839
[    8.140167] $12   : 0012b097 3c028b13 00000402 00000114
[    8.145560] $16   : 00000018 83da8080 82ef7a64 82ef7a68
[    8.150954] $20   : 82ef7e63 80000003 00010000 00014000
[    8.156348] $24   : 00000001 2bd2cbdc
[    8.161742] $28   : 82ef6000 82ef79f0 00031018 831a32b8
[    8.167136] Hi    : 00004b33
[    8.170103] Lo    : 58ba0000
[    8.173072] epc   : 802ad844 0x802ad844
[    8.177037] ra    : 831a32b8 0x831a32b8 [ath9k_hw@(ptrval)+0x55560]
[    8.183498] Status: 1100cc03 KERNEL EXL IE
[    8.187818] Cause : 4080801c (ExcCode 07)
[    8.191948] PrId  : 00019750 (MIPS 74Kc)
[    8.195987] Modules linked in: ath9k(+) ath9k_common pppoe ppp_async iptable_nat ath9k_hw ath xt_state xt_nat xt_conntrack xt_REDIRECT xt_MASQUERADE xt_FLOWOFFLOAD xt_CT pppox ppp_generic nf_nat nf_flow_table_hw nf_flow_table nf_conntrack mac80211 ipt_REJECT cfg80211 xt_time xt_tcpudp xt_multiport xt_mark xt_mac xt_limit xt_comment xt_TCPMSS xt_LOG slhc nf_reject_ipv4 nf_log_ipv4 nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_filter ip_tables crc_ccitt compat nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 gpio_button_hotplug
[    8.249760] Process kmodloader (pid: 659, threadinfo=(ptrval), task=(ptrval), tls=77e57ec8)
[    8.258376] Stack : 00000402 00000114 00000094 83da8080 00002710 00007044 000003ff 00000220
[    8.267003]         83635000 83da8080 83da80a8 00000100 831a0000 00000000 83da85b8 831a41b0
[    8.275632]         80001e5c 83da8080 00020000 00007000 ffffffe0 83da80a8 00000000 831d2650
[    8.284252]         83d8e084 83da8080 800054d0 82ef9de0 000186a0 ffffffff 83da8080 831d0cc0
[    8.292880]         99999999 00008000 83da80a8 00000100 00000001 00000000 831d0000 83195968
[    8.301500]         ...
[    8.304018] Call Trace:
[    8.304053] [<831a0000>] 0x831a0000 [ath9k_hw@(ptrval)+0x55560]
[    8.312680] [<831a41b0>] 0x831a41b0 [ath9k_hw@(ptrval)+0x55560]
[    8.318809] [<83195968>] 0x83195968 [ath9k_hw@(ptrval)+0x55560]
[    8.324925] [<83186e64>] 0x83186e64 [ath9k_hw@(ptrval)+0x55560]
[    8.331044] [<800a0000>] 0x800a0000
[    8.334650] [<831e28e8>] 0x831e28e8 [ath9k@(ptrval)+0x19450]
[    8.340489] [<800bd2fc>] 0x800bd2fc
[    8.344104] [<831f01b4>] 0x831f01b4 [ath9k@(ptrval)+0x19450]
[    8.349949] [<802c44b4>] 0x802c44b4
[    8.353552] [<80219c70>] 0x80219c70
[    8.357164] [<80334e70>] 0x80334e70
[    8.360771] [<80332f84>] 0x80332f84
[    8.364371] [<803336f4>] 0x803336f4
[    8.367970] [<803336cc>] 0x803336cc
[    8.371569] [<803336f4>] 0x803336f4
[    8.375163] [<8033354c>] 0x8033354c
[    8.378757] [<803315dc>] 0x803315dc
[    8.382361] [<80333754>] 0x80333754
[    8.385963] [<803336f4>] 0x803336f4
[    8.389561] [<80330f38>] 0x80330f38
[    8.393156] [<80564574>] 0x80564574
[    8.396763] [<803322a4>] 0x803322a4
[    8.400361] [<80333d14>] 0x80333d14
[    8.403963] [<831ff000>] 0x831ff000 [ath9k@(ptrval)+0x19450]
[    8.409802] [<80333dc0>] 0x80333dc0
[    8.413404] [<831ff018>] 0x831ff018 [ath9k@(ptrval)+0x19450]
[    8.419248] [<80167e0c>] 0x80167e0c
[    8.422850] [<80060930>] 0x80060930
[    8.426456] [<8016d758>] 0x8016d758
[    8.430051] [<80168c58>] 0x80168c58
[    8.433648] [<800e01f8>] 0x800e01f8
[    8.437255] [<800e1cd8>] 0x800e1cd8
[    8.440849] [<80167a8c>] 0x80167a8c
[    8.444450] [<800df4a8>] 0x800df4a8
[    8.448055] [<800e2044>] 0x800e2044
[    8.451664] [<8006dcac>] 0x8006dcac
[    8.455268]
[    8.456804] Code: 0000000f  8c820000  0000000f <03e00008> 00000000  0000000f  aca40000  03e00008  00000000
[    8.466865]
[    8.468436] ---[ end trace 72f5edfbd94a9798 ]---
[    8.473213] Kernel panic - not syncing: Fatal exception
[    8.478609] Rebooting in 1 seconds..

jdwl1o1 · December 14, 2021, 8:03pm

If you're looking for an image from another device that 'just works' sadly that is very unlikely.

Some TPlink devices can share images, but this is because tplink use the same board in multiple models.

Now that you know it can boot, even with a kernel panic due to the hardware being 'wrong' for the image, you now need to create your own DTS and build a custom image.

I would still suggest the dlink device is the closest and will give the best base for a new DTS. My suspicion is the initramfs image for the DIR859 was too large. Perhaps try this dlink one; https://downloads.openwrt.org/releases/21.02.1/targets/ath79/generic/openwrt-21.02.1-ath79-generic-dlink_dir-825-b1-initramfs-kernel.bin (which is 800k smaller) to see if it still throws bad magic.

If you're making your own image I don't think bad magic is likely - as whatever is being done to the dlink image won't apply to one you make yourself.

To create the DTS, go through your factory bootlog and make the DTS match the memory locations / devices etc.

tsb · December 14, 2021, 8:36pm

Nice, I was already on the same way, now to play around with all the Dts and HW setup. I already built a new image, just without any changes, but including more and specific options/drivers/etc and it booted up pretty nice, but ofc only until the ominous oops, so with the basics I'm on some good way it seems.

The other Dlink image is indeed booting up, thanx for the suggestion, but sadly it completely freezes after a couple of lines of kernel log. I'll however look into this variant too, maybe it is easier to start from.

Thanx again!

tsb · December 16, 2021, 10:30pm

So far so good, I have already mapped the partitions (not completely good yet anyway), but the two wlan devices are up and running. Eth is still nowhere, but that's like lower prio.
I have to mention, that thanx to you, I was going on the DIR-859 way, just needed to get rid of the SEAMA, which is some sort of Dlink signature, thus not needed here (causes the bad magic number).
Maybe I'll really ending up having a modern device?

jdwl1o1 · December 16, 2021, 11:33pm

Congratulations!

Post a serial bootlog and I’ll see if anything sticks out as causing the Ethernet to fail.

Be good to see your work in progress DTS as well. My gut feel is the phy setup isn’t correct.

tsb · December 17, 2021, 12:15pm

Cheers, I fixed the eth, needed to switch the phy0 to reg=3 (it was reg=0 for Dlink), as per original fw logs:

ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.0:03 [uid=004dd074, driver=Qualcomm Atheros AR8033 PHY]

Here goes the last dmesg, where things are popping all up the first time. However eth has still unknown MAC address, still need to find this somewhere.

[    0.000000] Linux version 5.10.83 (osboxes@osboxes) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r18355-9090e0be4d) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 Thu Dec 16 19:27:07 2021
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is D-Link DIR-859 A1
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] On node 0 totalpages: 16384
[    0.000000]   Normal zone: 144 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 16384 pages, LIFO batch:3
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 47228K/65536K available (5435K kernel code, 594K rwdata, 1196K rodata, 10172K init, 201K bss, 18308K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] random: get_random_bytes called from start_kernel+0x3c0/0x5b0 with crng_init=0
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000008] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008221] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.074759] pid_max: default: 32768 minimum: 301
[    0.079753] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.087469] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.097329] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.107646] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.118051] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.125328] pinctrl core: initialized pinctrl subsystem
[    0.131769] NET: Registered protocol family 16
[    0.186562] clocksource: Switched to clocksource MIPS
[    0.192989] NET: Registered protocol family 2
[    0.197764] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.205872] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.214783] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.222876] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.230324] TCP: Hash tables configured (established 1024 bind 1024)
[    0.237156] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.244064] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.251700] NET: Registered protocol family 1
[    0.256325] PCI: CLS 0 bytes, default 32
[    0.405811] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.416049] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.422259] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.436035] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.442585] gpio-export gpio-export: 1 gpio(s) exported
[    0.448899] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.456222] printk: console [ttyS0] disabled
[    0.460838] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.469951] printk: console [ttyS0] enabled
[    0.479008] printk: bootconsole [early0] disabled
[    0.499418] spi-nor spi0.0: mx25l12805d (16384 Kbytes)
[    0.504792] 6 fixed-partitions partitions found on MTD device spi0.0
[    0.511407] Creating 6 MTD partitions on "spi0.0":
[    0.516361] 0x000000000000-0x000000040000 : "u-boot"
[    0.524898] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.531289] 0x000000050000-0x000000060000 : "art"
[    0.538499] 0x000000060000-0x000000f80000 : "firmware"
[    0.544609] 0x00000015e080-0x000000f80000 : "rootfs"
[    0.552013] mtd: device 4 (rootfs) set to be root filesystem
[    0.558049] 1 squashfs-split partitions found on MTD device rootfs
[    0.564444] 0x000000bb0000-0x000000f80000 : "rootfs_data"
[    0.570832] 0x000000f80000-0x000001000000 : "rootfs_data"
[    0.583330] libphy: Fixed MDIO Bus: probed
[    0.590905] ag71xx 19000000.eth: invalid MAC address, using random address
[    1.277223] libphy: ag71xx_mdio: probed
[    1.377338] ag71xx 19000000.eth: connected to PHY at mdio.0:03 [uid=004dd074, driver=Qualcomm Atheros AR8031/AR8033]
[    1.388789] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii
[    1.395366] i2c /dev entries driver
[    1.400723] NET: Registered protocol family 10
[    1.410925] Segment Routing with IPv6
[    1.414817] NET: Registered protocol family 17
[    1.419525] 8021q: 802.1Q VLAN Support v1.8
[    1.424551] PCI host bridge /ahb/pcie-controller@18250000 ranges:
[    1.430929]  MEM 0x0000000012000000..0x0000000013ffffff
[    1.436326]   IO 0x0000000000000000..0x0000000000000000
[    1.441890] PCI host bridge to bus 0000:00
[    1.446135] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    1.453260] pci_bus 0000:00: root bus resource [io  0x0000]
[    1.459020] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    1.466025] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.474254] pci 0000:00:00.0: [168c:003c] type 00 class 0x028000
[    1.480497] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    1.487557] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    1.494543] pci 0000:00:00.0: supports D1
[    1.498698] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    1.505502] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    1.512384] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    1.519965] pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[    1.583933] Freeing unused kernel memory: 10172K
[    1.588737] This architecture does not have kernel memory protection.
[    1.595391] Run /init as init process
[    1.599175]   with arguments:
[    1.599179]     /init
[    1.599183]   with environment:
[    1.599186]     HOME=/
[    1.599190]     TERM=linux
[    2.014649] init: Console is alive
[    2.018698] init: - watchdog -
[    2.044745] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.065203] usbcore: registered new interface driver usbfs
[    2.070985] usbcore: registered new interface driver hub
[    2.076590] usbcore: registered new device driver usb
[    2.089395] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    2.098997] ehci-fsl: Freescale EHCI Host controller driver
[    2.106308] ehci-platform: EHCI generic platform driver
[    2.115152] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.133118] init: - preinit -
[    2.404927] random: jshn: uninitialized urandom read (4 bytes read)
[    2.534428] random: jshn: uninitialized urandom read (4 bytes read)
[    2.719064] random: jshn: uninitialized urandom read (4 bytes read)
[    4.826556] random: fast init done
[    5.228103] eth0: link up (1000Mbps/Full duplex)
[    5.232907] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    5.239761] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
[    7.261082] eth0: link down
[    7.282479] procd: - early -
[    7.285796] procd: - watchdog -
[    7.862291] procd: - watchdog -
[    7.867091] procd: - ubus -
[    7.878506] urandom_read: 5 callbacks suppressed
[    7.878514] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.920180] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.930266] procd: - init -
[    8.574303] kmodloader: loading kernel modules from /etc/modules.d/*
[    8.910372] urngd: v1.0.2 started.
[    9.064789] Loading modules backported from Linux version v5.15.8-0-g43e577d7a2cb
[    9.072584] Backport generated by backports.git v5.15.8-1-0-g83f664bb
[    9.091450] random: crng init done
[    9.153949] xt_time: kernel timezone is -0000
[    9.289430] PPP generic driver version 2.4.2
[    9.307595] NET: Registered protocol family 24
[    9.392968] ath10k 5.15 driver, optimized for CT firmware, probing pci device: 0x3c.
[    9.417619] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002)
[    9.424269] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[   13.131412] ath10k_pci 0000:00:00.0: qca988x hw2.0 target 0x4100016c chip_id 0x043202ff sub 0000:0000
[   13.140994] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   13.152940] ath10k_pci 0000:00:00.0: firmware ver 10.1-ct-8x-__fW-022-ecad3248 api 2 features wmi-10.x,has-wmi-mgmt-tx,mfp,txstatus-noack,wmi-10.x-CT,ratemask-CT,txrate-CT,get-temp-CT,tx-rc-CT,cust-stats-CT,retry-gt2-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT crc32 3e4cf97f
[   13.559744] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id N/A crc32 bebc7c08
[   14.520175] ath10k_pci 0000:00:00.0: 10.1 wmi init: vdevs: 16  peers: 127  tid: 256
[   14.536978] ath10k_pci 0000:00:00.0: wmi print 'P 128 V 8 T 410'
[   14.543204] ath10k_pci 0000:00:00.0: wmi print 'msdu-desc: 1424  sw-crypt: 0 ct-sta: 0'
[   14.551535] ath10k_pci 0000:00:00.0: wmi print 'alloc rem: 24984 iram: 38672'
[   14.604405] ath10k_pci 0000:00:00.0: htt-ver 2.1 wmi-op 2 htt-op 2 cal file max-sta 128 raw 0 hwcrypto 1
[   14.617353] ath10k_pci 0000:00:00.0: NOTE:  Firmware DBGLOG output disabled in debug_mask: 0x10000000
[   14.758060] ath: EEPROM regdomain sanitized
[   14.758074] ath: EEPROM regdomain: 0x64
[   14.758079] ath: EEPROM indicates we should expect a direct regpair map
[   14.758098] ath: Country alpha2 being used: 00
[   14.758103] ath: Regpair used: 0x64
[   14.837383] ath9k 18100000.wmac: Direct firmware load for ath9k-eeprom-ahb-18100000.wmac.bin failed with error -2
[   14.848041] ath9k 18100000.wmac: Falling back to sysfs fallback for: ath9k-eeprom-ahb-18100000.wmac.bin
[   15.500471] ath: EEPROM regdomain sanitized
[   15.500487] ath: EEPROM regdomain: 0x64
[   15.500492] ath: EEPROM indicates we should expect a direct regpair map
[   15.500513] ath: Country alpha2 being used: 00
[   15.500517] ath: Regpair used: 0x64
[   15.512339] ieee80211 phy1: Selected rate control algorithm 'minstrel_ht'
[   15.514211] ieee80211 phy1: Atheros AR9561 Rev:0 mem=0xb8100000, irq=2
[   15.551117] kmodloader: done loading kernel modules from /etc/modules.d/*
[   44.623190] br-lan: port 1(eth0.1) entered blocking state
[   44.628820] br-lan: port 1(eth0.1) entered disabled state
[   44.634657] device eth0.1 entered promiscuous mode
[   44.639667] device eth0 entered promiscuous mode
[   47.708095] eth0: link up (1000Mbps/Full duplex)
[   47.712902] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   47.722074] br-lan: port 1(eth0.1) entered blocking state
[   47.727715] br-lan: port 1(eth0.1) entered forwarding state
[   47.733707] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.2: link becomes ready
[   47.786649] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
root@OpenWrt:/#

The original nor layout as per original fw is:

Creating 7 MTD partitions on "ath79-nor0":
0x000000000000-0x000000040000 : "Bootloader"
0x000000040000-0x000000050000 : "nvram"
0x000000050000-0x000000060000 : "Factory"
0x000000060000-0x000000f80000 : "linux"
0x00000015e080-0x000000f80000 : "rootfs"
0x000000f80000-0x000001000000 : "jffs2"
0x000000000000-0x000001000000 : "ALL"

And my experimental mappings are like:

&spi {

	status = "okay";



	flash@0 {

		compatible = "jedec,spi-nor";

		reg = <0>;

		spi-max-frequency = <25000000>;



		partitions {

			compatible = "fixed-partitions";

			#address-cells = <1>;

			#size-cells = <1>;



			partition@0 {

				label = "u-boot";

				reg = <0x000000 0x40000>;

				read-only;

			};



			partition@40000 {

				label = "u-boot-env";

				reg = <0x040000 0x10000>;

				read-only;

			};



			art: partition@50000 {

				label = "art";

				reg = <0x050000 0x10000>;

				read-only;

			};



			partition@60000 {

				label = "firmware";

				reg = <0x060000 0xf20000>;

			};



			partition@15e080 {

        			label = "rootfs";

				reg = <0x15e080 0xe21f80>;

				read-only;

			};



			partition@f80000 {

        			label = "rootfs_data";

				reg = <0xf80000 0x80000>;

				read-only;

			};

		};

	};

};

Here goes also an ifconfig output:

root@OpenWrt:/# ifconfig -a
br-lan    Link encap:Ethernet  HWaddr B2:29:92:2A:7A:89
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fd3b:fd70:dfe::1/60 Scope:Global
          inet6 addr: fe80::b029:92ff:fe2a:7a89/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:1942 (1.8 KiB)

eth0      Link encap:Ethernet  HWaddr B2:29:92:2A:7A:89
          inet6 addr: fe80::b029:92ff:fe2a:7a89/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1077 errors:0 dropped:6 overruns:0 frame:0
          TX packets:365 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:159575 (155.8 KiB)  TX bytes:113508 (110.8 KiB)
          Interrupt:4

eth0.1    Link encap:Ethernet  HWaddr B2:29:92:2A:7A:89
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:1942 (1.8 KiB)

eth0.2    Link encap:Ethernet  HWaddr B2:29:92:2A:7A:89
          inet6 addr: fe80::b029:92ff:fe2a:7a89/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:331 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:108136 (105.6 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:508 errors:0 dropped:0 overruns:0 frame:0
          TX packets:508 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:39664 (38.7 KiB)  TX bytes:39664 (38.7 KiB)

wlan0     Link encap:Ethernet  HWaddr 88:D7:F6:A3:A6:26
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wlan1     Link encap:Ethernet  HWaddr 88:D7:F6:A3:A6:24
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

Please let me know of suggestions/corrections/etc, you know I'm pretty new to this whole subject

Thanx again for the help!

jdwl1o1 · December 17, 2021, 10:30pm

Hey, looking good. Are you booting from tftp still or from the nand?

To figure out how asus is loading the mac address from uboot or from flash can you;

stop booting in uBoot and do a 'printenv' and post them here. You're looking for an entry that appends that ethernet mac to kernel command line or similar.
from uBoot or Openwrt take backups of all the factory nand partitions and post the separate files here or share via a file share site. You should extract a single file per partition.
For these backups dd will be fine.
With the backups I'll see if there's a factory DTS appended to the Asus kernel.

Asus don't include the kernel or uBoot image with the firmware updates for this box!