Can anybody provide a full bootlog with latest stock FW?
I think I used the wrong BDF, probably for 2G band and I don't have a stock bootlog anymore.
Thanks for the bootlog, no luck with it as it doesn't print which one it loads.
I checked some docs and bdwlan.ba0 should be the one, it's the one to use for 4x4 in 5GHz mode, it's also the same as bdwlan.bin so that should be it but it fails with the regulatory message.
Unless Xiaomi is doing some crazy regulatory runtime patching which I cannot find.
Even if you put it as the plain board.bin it complains, so its gotta be a really outdated format or something as the BDF format and features get updated with each release.
This is the only thing i noticed:
board_id 0xff
Did you set the board_Id to 160 in the dts for the wifi2 node?
Thats the default board ID as caldata doesn't include one.
Again, you cannot currently set the board-ID for PCI devices and ath11k.
But as long as the BDF matches that board-id it doesn't matter.
However, I discovered that the BDF doesn't have to include regulatory info at all.
It looks like I will need to boot Windows and see what QDART tells about the BDF file.
It also looks like that the wireless-regdb is embedded into the BDF and not the FW, this is kind of a bit better but still horrible as you cannot easily update it.
BTW: Another Wi-Fi 6E contender.
Not with those kinds of prices, I mean we are talking over 1k USD
Yeah, I know. Isn't it insane? AX9000 is way more value for the buck. Thanks for keeping up the good work!
Can you tell me how to open the BDF file in QDART? Can't seem to find where or in which mode to open it 
You got QDART?
Which version?
I am digging through chipcode to download it, had it a long time ago but not anymore
Mine is from 2018.04. Might be a bit old for AX radio calibration files....
Yeah, its too old.
Honestly, createpoint and chipcode just keep getting worse.
Cant find anything here
I can tell you that you need QDART connectivity, and that version for SPF11.4 CSU2 is 1.0.86
1 Like
Ok, so I managed to find the conversion scripts and its format is really, really old.
Also, I can confirm that no regulatory data is included, it's set to 0 and the regdb version is 0 as well.
Now, how the hell does Xiaomi use that at all?
Can somebody look in the /tmp folder while running the stock FW, maybe it has a runtime patched BDF there.
@dchard Found QDART as well, but no use for it here really as its meant for creating the calibration.
All the BDF tools are in the SPF releases themselves.
Honestly, got no idea how to solve this.
Is this the same for AX3600/AX6 ? I mean, if the reg data is not in the firmware nor in the BDF, then where the hell it is? On my AX6 even if I am using the stock BDF, I still have an incorrect regdb, but if I use the stock firmware, the regdb is correct (for example channel 13 becomes available).
I am talking specifically about the QCN9024 PCI card, it's only present in AX9000.
IPQ807x radios on the other hand have regdb embedded, I can see it being enabled.
I am interested as well in what hackery is Xiaomi doing as they are clearly ignoring or patching the regdb during runtime
You mean embedded in the BDF? If that is the case, why the regdb is not the same under OWRT if I am using the exact same BDF file as the stock fw?
Yes, I can see that it's enabled and from the docs, the regdb should be contained in the BDF-s and not the FW like I initially thought.
I honestly don't know why it differs as for ETSI only 14 should be disabled for 2.4 according to QCA regulatory docs.
So I suspect that Xiaomi is maybe patching it somehow or ignoring the regulatory info
But if its in the BDF, how can Xiaomi patch this out or ignore it? Or maybe the BDF is old and with the old wifi firmware they use, this is somehow ignored? Can it be that the newer wifi firmwares we use (2.5.0.1 for example) would require a newer BDF type?
I wouldn't be surprised that Xiaomi got something done custom from QCA, it's not unusual for a large customer.
They can actually runtime patch it, they know the offsets for that version and you can simply cut/paste parts of the BDF.
As far as I can tell, FW supports the older BDF-s as well but not ones newer than it as it needs to know how to interpret the fields.
Didnt people switch the "NVRAM" regions to CN on the international FW so they can run higher TX powers.
Because if so, then they must be able to somehow patch the BDF during runtime
I have put a dump of /tmp here: https://drive.google.com/file/d/1HGfu8kaO2PjDP8ZgAepTx3qjCMENf3el/view?usp=sharing