I missed the part for qcn6122. It's there too.
Great! So in BDF you only changed regdb and removed regdomain? Can you check if they work the same without ath11k_remove_regdomain?
I’ve upgraded to the latest template version that comes with 2.12, replaced regdb, and removed reg domains. Will create a new one though because the current one is based on EU, will use FCC.
Last thing remaining is to create a ubifs image as this Linksys device has put its kernel in a UBI container (first I’m aware of), then test stock to factory, sysupgrade, and back to stock.
regdomain remove isnt mandatory. i do it normally. but the whole regdb.bin which is included in the bdf has 2 different formats depending on the firmware version you use. this must be correct in order to match the firmware. the correct regdb file is normally shipped together with the firmware files including the reference bdfs. i have 6 ghz fully working in the linksys mr7500 which is a different chipset of course. but i remember that i had to deal with this issue. and then you must do a hostapd config which does support colocated feature. otherwise most clients including the iphone will not show you any 6 ghz frequency even if it works. they simply do not scan in the 6 ghz band but looking for 6 ghz bss informations in the 5 and/or 2.4 ghz beacons
Hit any key to stop autoboot: 0
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 50 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 400, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 3/1, WL threshold: 4096, image sequence number: 1383242256
ubi0: available PEBs: 0, total reserved PEBs: 400, PEBs reserved for bad PEB handling: 40
Read 0 bytes from volume kernel to 44000000
No size specified -> Using max size (5586944)
Kernel image authentication failed
BUG: failure at board/qca/arm/common/cmd_bootqca.c:661/do_boot_signedimg()!
BUG!
resetting ...
is this a dead end?
this is the recipe:
define Device/linksys_mx6200
$(call Device/FitImage)
$(call Device/UbiFit)
DEVICE_VENDOR := Linksys
DEVICE_MODEL := MX6200
BLOCKSIZE := 128k
PAGESIZE := 2048
DEVICE_DTS_CONFIG := config@mp03.5-c1
KERNEL_SIZE := 8192k
IMAGE_SIZE := 51200k
NAND_SIZE := 256m
SOC := ipq5018
IMAGES += factory.bin
IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi | linksys-image type=$$$$(DEVICE_MODEL)
DEVICE_PACKAGES := -ath11k-firmware-ipq5018 \
ath11k-firmware-ipq5018-qcn6122 \
ipq-wifi-linksys_mx6200
endef
TARGET_DEVICES += linksys_mx6200
So secure boot is enabled?
The same problem was with AX9000, but it could be bypassed with the atf variable: https://raelize.com/upload/research/2025/kuw_2025_EL3vated_privileges.pdf
1 Like
seems like they patched that too as they're not checking for an environment variable anymore but rather a value in trust zone via an scm call.
From uboot source:
#ifndef CONFIG_DISABLE_SIGNED_BOOT
ret = qca_scm_call(SCM_SVC_FUSE, QFPROM_IS_AUTHENTICATE_CMD, &buf, sizeof(char));
/*
|| if atf is enable in env ,do_boot_signedimg is skip.
|| Note: This features currently support in ipq50XX.
*/
if (ret == 0 && buf == 1 && !is_atf_enabled()) {
ret = do_boot_signedimg(cmdtp, flag, argc, argv);
} else if (ret == 0 || ret == -EOPNOTSUPP)
#endif
{
ret = do_boot_unsignedimg(cmdtp, flag, argc, argv);
}
and:
int is_atf_enabled(void)
{
int ret;
u32 val[2] = {0};
if (likely(atf_status != ATF_STATE_UNKNOWN))
return (atf_status == ATF_STATE_ENABLED);
/*
* Understanding is this smc call will not be implemented in ATF in
* future as well. If its implemented, Bit 7 should be made to 1.
*/
atf_status = ATF_STATE_DISABLED;
ret = is_scm_sec_auth_available(SCM_SVC_INFO, GET_SECURE_STATE_CMD);
if (ret > 0) {
ret = qca_scm_get_secure_state(&val, sizeof(val));
if ((ret == 0) && (val[0] & 0x80))
atf_status = ATF_STATE_ENABLED;
} else
atf_status = ATF_STATE_ENABLED;
return (atf_status == ATF_STATE_ENABLED);
}
I've tried setting atf by: setenv atf 1 in uboot.
I don't think it's necessary to specify the configuration. But that's not important right now...
From OEM:
Can you post u-boot printenv and bootipq debug output?
printenv
IPQ5018# printenv
altkern=4880000
auto_recovery=yes
baudrate=115200
boot_part=2
boot_part_ready=3
boot_ver=7.1.25
bootargs=console=ttyMSM0,115200n8
bootcmd=bootipq
bootdelay=3
config_name=config@1
dload_dis=1
eth1addr=00:11:22:33:44:56
ethact=eth0
ethaddr=00:03:7f:ba:db:ad
fdt_high=0x4A400000
fdtcontroladdr=4a9d4004
flash_type=11
flashimg=tftp $loadaddr $image && nand erase $prikern $imgsize && nand write $loadaddr $prikern $filesize
flashimg2=tftp $loadaddr $image && nand erase $altkern $imgsize && nand write $loadaddr $altkern $filesize
image=MX6200.img
imgsize=3200000
ipaddr=192.168.1.1
kernsize=800000
loadaddr=44000000
machid=8040004
netmask=255.255.255.0
prikern=1680000
serverip=192.168.1.254
soc_hw_version=20180101
soc_version_major=1
soc_version_minor=1
stderr=serial@78AF000
stdin=serial@78AF000
stdout=serial@78AF000
tftpboot=tftp $loadaddr openwrt-qualcommax-ipq50xx-linksys_mx6200-initramfs-uImage.itb && bootm $loadaddr
bootipq debug
IPQ5018# bootipq debug
Using nand device 0
bootargs=console=ttyMSM0,115200n8 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait
Booting from flash
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 50 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 400, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 728048624
ubi0: available PEBs: 0, total reserved PEBs: 400, PEBs reserved for bad PEB handling: 40
ubi read 0x44000000 kernel && Read 0 bytes from volume kernel to 44000000
No size specified -> Using max size (4829616)
runcmd: ubi read 0x45000028 ubi_rootfs &&
Read 0 bytes from volume ubi_rootfs to 45000028
No size specified -> Using max size (38854656)
Rootfs image authentication successful
Manual device tree config selected!
bootm 0x44000028#config@1
## Loading kernel from FIT Image at 44000028 ...
Using 'config@1' configuration
Trying 'kernel@1' kernel subimage
Description: ARM OpenWrt Linux-5.4.164
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x4400010c
Data Size: 4770511 Bytes = 4.5 MiB
Architecture: ARM
OS: Linux
Load Address: 0x41208000
Entry Point: 0x41208000
Hash algo: crc32
Hash value: a8446d27
Hash algo: sha1
Hash value: 6e66b1eeaf288e00b77a161d9d946ef2b2892d17
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000028 ...
Using 'config@1' configuration
Trying 'fdt@1' fdt subimage
Description: ARM OpenWrt Maple device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x4448cd0c
Data Size: 44361 Bytes = 43.3 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 687eb99b
Hash algo: sha1
Hash value: a04ebe1c21bec2c9c47eaa40babfe2d72765ffda
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x4448cd0c
Uncompressing Kernel Image ... OK
Loading Device Tree to 4a3f2000, end 4a3ffd48 ... OK
Using machid 0x8040004 from environment
Starting kernel ...
Are the sources you're building the image from available anywhere?
You could try running OpenWrt like this:
setenv bootargs console=ttyMSM0,115200n8 ubi.mtd=rootfs root=mtd:rootfs rootfstype=squashfs rootwait
ubi part rootfs 2048
ubi read $loadaddr kernel $kernsize
bootm $loadaddr
IPQ5018# ubi part rootfs 2048
mtdids not defined, no default present
Error initializing mtdparts!
I then tried setting mtdids and mtdparts, but no joy either:
IPQ5018# mtd list
partition size too small (2)
printenv
IPQ5018# mtd list
partition size too small (2)
IPQ5018# printenv
altkern=4880000
auto_recovery=yes
baudrate=115200
boot_part=1
boot_part_ready=3
boot_ver=7.1.25
bootargs=console=ttyMSM0,115200n8 ubi.mtd=rootfs root=mtd:rootfs rootfstype=squashfs rootwait
bootcmd=bootipq
bootdelay=3
config_name=config@1
dload_dis=1
eth1addr=00:11:22:33:44:56
ethact=eth0
ethaddr=00:03:7f:ba:db:ad
fdt_high=0x4A400000
fdtcontroladdr=4a9d4004
flash_type=11
flashimg=tftp $loadaddr $image && nand erase $prikern $imgsize && nand write $loadaddr $prikern $filesize
flashimg2=tftp $loadaddr $image && nand erase $altkern $imgsize && nand write $loadaddr $altkern $filesize
image=MX6200.img
imgsize=3200000
ipaddr=192.168.1.1
kernsize=800000
loadaddr=44000000
machid=8040004
mtdids=nand0=spi.0
mtdparts=mtdparts=spi.0:1M(0:SBL1),1M(0:MIBIB),256K(0:BOOTCONFIG),256K(0:BOOTCONFIG1),2M(0:QSEE),2M(0:QSEE_1),1M(0:DEVCFG),1M(0:DEVCFG_1),1M(0:CDT),1M(0:CDT_1),1M(ppinfo),2.5M(0:APPSBL),2.5M(0:APPSBL_1),2M(0:ART),1M(0:TRAINING),1M(u_env),1M(s_env),1M(devinfo),50M(otfs),50M(otfs_1),2M(sysdiag),130M(syscfg)
netmask=255.255.255.0
prikern=1680000
serverip=192.168.1.254
soc_hw_version=20180101
soc_version_major=1
soc_version_minor=1
stderr=serial@78AF000
stdin=serial@78AF000
stdout=serial@78AF000
tftpboot=tftp $loadaddr openwrt-qualcommax-ipq50xx-linksys_mx6200-initramfs-uImage.itb && bootm $loadaddr
Environment size: 1385/262140 bytes
Do you have the partition layout as in this log: OpenWrt support for Linksys MX6200 - #3 by xrx54 ?
Try these values:
setenv mtdids nand0=nand0
setenv mtdparts mtdparts=nand0:0x3200000@0x1680000(rootfs_1),0x3200000@0x4880000(rootfs)
If I'm not mistaken, dual boot is not used here, the system always boots from the second rootfs partition.
we're getting somewhere:
bootlog
IPQ5018# ubi part rootfs 2048
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: volume 2 ("rootfs_data") re-sized from 9 to 240 LEBs
ubi0: attached mtd1 (name "mtd=1", size 50 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 400, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 763023220
ubi0: available PEBs: 0, total reserved PEBs: 400, PEBs reserved for bad PEB handling: 40
IPQ5018# ubi read $loadaddr kernel $kernsize
Read 8388608 bytes from volume kernel to 44000000
IPQ5018# bootm $loadaddr
## Loading kernel from FIT Image at 44000000 ...
Using 'config@mp03.5-c1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-6.12.54
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x440000e8
Data Size: 5463052 Bytes = 5.2 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x41000000
Entry Point: 0x41000000
Hash algo: crc32
Hash value: 33791c6f
Hash algo: sha1
Hash value: bcae8fc396aa36508394087fc69be6f52e47f161
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
Using 'config@mp03.5-c1' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt linksys_mx6200 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x44535e34
Data Size: 26925 Bytes = 26.3 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: a34e2c6e
Hash algo: sha1
Hash value: 06a4b2644e79d3103fa522d02f1d21bb17ae5764
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x44535e34
Uncompressing Kernel Image ... OK
Loading Device Tree to 4a3f6000, end 4a3ff92c ... OK
fdt_fixup_qpic: QPIC: unable to find node '/soc/qpic-nand@79b0000'
parse_fdt_fixup: unable to find node '/soc/qpic-nand@79b0000/'
Using machid 0x8040004 from environment
Starting kernel ...
Jumping to AARCH64 kernel via monitor
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x51af8014]
[ 0.000000] Linux version 6.12.54 (george@sl2-ubuntu) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r30807+6-4d3a35f36891) 14.3.0, GNU ld (GNU Binutils) 2.44) #0 SMP Sun Oct 26 08:37:39 2025
[ 0.000000] Machine model: Linksys MX6200
[ 0.000000] OF: reserved mem: 0x000000004a400000..0x000000004a7fffff (4096 KiB) nomap non-reusable tz_apps@4a400000
[ 0.000000] OF: reserved mem: 0x000000004a800000..0x000000004a9fffff (2048 KiB) nomap non-reusable bootloader@4a800000
[ 0.000000] OF: reserved mem: 0x000000004ab00000..0x000000004abfffff (1024 KiB) nomap non-reusable smem@4ab00000
[ 0.000000] OF: reserved mem: 0x000000004ac00000..0x000000004adfffff (2048 KiB) nomap non-reusable tz@4ac00000
[ 0.000000] OF: reserved mem: 0x000000004b000000..0x000000004fcfffff (78848 KiB) nomap non-reusable wcss@4b000000
[ 0.000000] Zone ranges:
[ 0.000000] DMA [mem 0x0000000040000000-0x000000005fffffff]
[ 0.000000] DMA32 empty
[ 0.000000] Normal empty
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000040000000-0x000000004a3fffff]
[ 0.000000] node 0: [mem 0x000000004a400000-0x000000004a9fffff]
[ 0.000000] node 0: [mem 0x000000004aa00000-0x000000004aafffff]
[ 0.000000] node 0: [mem 0x000000004ab00000-0x000000004adfffff]
[ 0.000000] node 0: [mem 0x000000004ae00000-0x000000004affffff]
[ 0.000000] node 0: [mem 0x000000004b000000-0x000000004fcfffff]
[ 0.000000] node 0: [mem 0x000000004fd00000-0x000000005fffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[ 0.000000] psci: probing for conduit method from DT.
[ 0.000000] psci: PSCIv1.0 detected in firmware.
[ 0.000000] psci: Using standard PSCI v0.2 function IDs
[ 0.000000] psci: MIGRATE_INFO_TYPE not supported.
[ 0.000000] psci: SMC Calling Convention v1.0
[ 0.000000] psci: OSI mode supported.
[ 0.000000] psci: [Firmware Bug]: failed to set PC mode: -1
[ 0.000000] percpu: Embedded 20 pages/cpu s43224 r8192 d30504 u81920
[ 0.000000] Detected VIPT I-cache on CPU0
[ 0.000000] CPU features: detected: Spectre-v4
[ 0.000000] alternatives: applying boot alternatives
[ 0.000000] Kernel command line: console=ttyMSM0,115200n8 ubi.mtd=rootfs root=mtd:rootfs rootfstype=squashfs rootwait root=/dev/ubiblock0_0 coherent_pool=2M
[ 0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 131072
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 0MB
[ 0.000000] software IO TLB: area num 2.
[ 0.000000] software IO TLB: mapped [mem 0x000000005f580000-0x000000005f600000] (0MB)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[ 0.000000] rcu: Hierarchical RCU implementation.
[ 0.000000] rcu: RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[ 0.000000] Tracing variant of Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[ 0.000000] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
[ 0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[ 0.000000] Root IRQ handler: gic_handle_irq
[ 0.000000] GICv2m: range[mem 0x0b00a000-0x0b00aff7], SPI[448:479]
[ 0.000000] GICv2m: range[mem 0x0b00b000-0x0b00bff7], SPI[480:511]
[ 0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[ 0.000000] arch_timer: cp15 and mmio timer(s) running at 24.00MHz (virt/virt).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
[ 0.000001] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
[ 0.000124] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
[ 0.000144] pid_max: default: 32768 minimum: 301
[ 0.005079] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.005106] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.011712] rcu: Hierarchical SRCU implementation.
[ 0.011729] rcu: Max phase no-delay instances is 1000.
[ 0.012299] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[ 0.012949] smp: Bringing up secondary CPUs ...
[ 0.014057] Detected VIPT I-cache on CPU1
[ 0.014207] CPU1: Booted secondary processor 0x0000000001 [0x51af8014]
[ 0.014448] smp: Brought up 1 node, 2 CPUs
[ 0.014469] SMP: Total of 2 processors activated.
[ 0.014474] CPU: All CPU(s) started at EL1
[ 0.014479] CPU features: detected: 32-bit EL0 Support
[ 0.014486] CPU features: detected: CRC32 instructions
[ 0.014572] alternatives: applying system-wide alternatives
[ 0.014818] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[ 0.015074] Memory: 409828K/524288K available (8704K kernel code, 900K rwdata, 2764K rodata, 960K init, 287K bss, 112616K reserved, 0K cma-reserved)
[ 0.022324] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.022358] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[ 0.022496] 29312 pages in range for non-PLT usage
[ 0.022507] 520832 pages in range for PLT usage
[ 0.024680] pinctrl core: initialized pinctrl subsystem
[ 0.027485] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.028569] DMA: preallocated 2048 KiB GFP_KERNEL pool for atomic allocations
[ 0.028922] DMA: preallocated 2048 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[ 0.029249] DMA: preallocated 2048 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[ 0.029868] thermal_sys: Registered thermal governor 'step_wise'
[ 0.030168] cpuidle: using governor menu
[ 0.030490] ASID allocator initialised with 65536 entries
[ 0.035762] /soc@0/interrupt-controller@b000000: Fixed dependency cycle(s) with /soc@0/interrupt-controller@b000000
[ 0.076548] SCSI subsystem initialized
[ 0.076869] usbcore: registered new interface driver usbfs
[ 0.076972] usbcore: registered new interface driver hub
[ 0.077038] usbcore: registered new device driver usb
[ 0.077443] qcom_scm: convention: smc arm 64
[ 0.080193] clocksource: Switched to clocksource arch_sys_counter
[ 0.084503] NET: Registered PF_INET protocol family
[ 0.084755] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[ 0.086962] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.087002] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.087027] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.087084] TCP bind hash table entries: 4096 (order: 5, 131072 bytes, linear)
[ 0.087269] TCP: Hash tables configured (established 4096 bind 4096)
[ 0.087879] MPTCP token hash table entries: 512 (order: 1, 12288 bytes, linear)
[ 0.088103] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.088140] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.088759] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.088828] PCI: CLS 0 bytes, default 64
[ 0.092207] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[ 0.092883] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.092897] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.114431] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 0.116621] msm_serial 78af000.serial: msm_serial: detected port #0
[ 0.116803] msm_serial 78af000.serial: uartclk = 1843199
[ 0.117645] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 21, base_baud = 115199) is a MSM
[ 0.117804] msm_serial: console setup on port #0
[ 0.117888] printk: legacy console [ttyMSM0] enabled
[ 0.845584] msm_serial: driver initialized
[ 0.859600] loop: module loaded
[ 0.866220] spi-nand spi0.0: GigaDevice SPI NAND was found.
[ 0.866287] spi-nand spi0.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[ 0.873064] 22 fixed-partitions partitions found on MTD device spi0.0
[ 0.878973] Creating 22 MTD partitions on "spi0.0":
[ 0.885484] 0x000000000000-0x000000100000 : "0:SBL1"
[ 0.893325] 0x000000100000-0x000000200000 : "0:MIBIB"
[ 0.898118] 0x000000200000-0x000000240000 : "0:BOOTCONFIG"
[ 0.901983] 0x000000240000-0x000000280000 : "0:BOOTCONFIG1"
[ 0.907355] 0x000000280000-0x000000480000 : "0:QSEE"
[ 0.915667] 0x000000480000-0x000000680000 : "0:QSEE_1"
[ 0.920921] 0x000000680000-0x000000780000 : "0:DEVCFG"
[ 0.924570] 0x000000780000-0x000000880000 : "0:DEVCFG_1"
[ 0.929384] 0x000000880000-0x000000980000 : "0:CDT"
[ 0.934941] 0x000000980000-0x000000a80000 : "0:CDT_1"
[ 0.939459] 0x000000a80000-0x000000b80000 : "ppinfo"
[ 0.944646] 0x000000b80000-0x000000e00000 : "0:APPSBL"
[ 0.952496] 0x000000e00000-0x000001080000 : "0:APPSBL_1"
[ 0.958244] 0x000001080000-0x000001280000 : "0:ART"
[ 0.963084] 0x000001280000-0x000001380000 : "0:TRAINING"
[ 0.966118] 0x000001380000-0x000001480000 : "u_env"
[ 0.970684] 0x000001480000-0x000001580000 : "s_env"
[ 0.975149] 0x000001580000-0x000001680000 : "devinfo"
[ 0.980358] 0x000001680000-0x000004880000 : "rootfs"
[ 1.068512] mtd: setting mtd18 (rootfs) as root device
[ 1.069212] mtdsplit: no squashfs found in "rootfs"
[ 1.072636] 0x000004880000-0x000007a80000 : "rootfs_1"
[ 1.162054] 0x000007a80000-0x000007c80000 : "sysdiag"
[ 1.166714] 0x000007c80000-0x00000fe80000 : "syscfg"
[ 1.538432] i2c_dev: i2c /dev entries driver
[ 1.543778] sdhci: Secure Digital Host Controller Interface driver
[ 1.543832] sdhci: Copyright(c) Pierre Ossman
[ 1.548868] sdhci-pltfm: SDHCI platform and OF driver helper
[ 1.557077] remoteproc remoteproc0: releasing cd00000.remoteproc
[ 1.816122] NET: Registered PF_INET6 protocol family
[ 1.817980] Segment Routing with IPv6
[ 1.820306] In-situ OAM (IOAM) with IPv6
[ 1.823827] NET: Registered PF_PACKET protocol family
[ 1.828114] 8021q: 802.1Q VLAN Support v1.8
[ 1.883516] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 799999 KHz, changing to: 800000 KHz
[ 1.886615] remoteproc remoteproc0: cd00000.remoteproc is available
[ 1.893401] qcom-q6-mpd cd00000.remoteproc: pd-1 node found
[ 1.900971] remoteproc remoteproc1: pd-1 is available
[ 1.904900] qcom-q6-mpd cd00000.remoteproc: pd-2 node found
[ 1.911535] remoteproc remoteproc2: pd-2 is available
[ 1.915490] qcom-q6-mpd cd00000.remoteproc: pd-3 node found
[ 1.922173] remoteproc remoteproc3: pd-3 is available
[ 1.927706] ubi0: attaching mtd18
[ 2.300291] random: crng init done
[ 2.324004] ubi0: scanning is finished
[ 2.391541] ubi0: attached mtd18 (name "rootfs", size 50 MiB)
[ 2.391616] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 2.396305] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 2.403176] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 2.409935] ubi0: good PEBs: 400, bad PEBs: 0, corrupted PEBs: 0
[ 2.416733] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[ 2.422979] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 728048624
[ 2.429988] ubi0: available PEBs: 0, total reserved PEBs: 400, PEBs reserved for bad PEB handling: 40
[ 2.455391] Waiting for root device /dev/ubiblock0_0..., PID 576
now need to figure out the right boot args
In dts you need to set root=/dev/ubiblock0_1 for bootargs.
2 Likes
that worked, openwrt successfully boots from nand, great! thanks @lytr
now need to change bootcmd to check for multiple variables: autorecovery, boot_part, and a new one to indicate whether to boot from stock or openwrt.
so far:
owrt=1
owrtboot=setenv bootargs console=ttyMSM0,115200n8 ubi.mtd=rootfs_1 root=mtd:ubi_rootfs rootfstype=squashfs rootwait; ubi part rootfs_1 2048; ubi read $loadaddr kernel $kernsize; bootm $loadaddr
bootcmd=if test -n $owrt; then run owrtboot; else bootipq; fi
this works. But if you know of any way to throw in auto_recovery, boot_part and a way to identify dynamically whether the partition contains stock or openwrt, let me know! 
2 Likes
I'm glad it worked out.
It would be nice to have a firmware image that can be used through the OEM interface, like in other models in this series.
Could you prepare an image with the rootfs volume renamed to ubi_rootfs: https://github.com/openwrt/openwrt/blob/main/scripts/ubinize-image.sh#L93
and try running it with the bootipq command?
After a failed run of bootipq you can also show what this command sets in variables using printenv.
@georgem83 I'm looking forward for that PR. I couldn't figure out 2nd qcn6122 support for my board even with your tip