OpenWrt support for Xiaomi AX9000

Do I understand correctly that ath11k enforces regulatory info through firmware? Because here it has:

root@openwrt:~# iw reg get
global
country RU: DFS-ETSI
        (2400 - 2483 @ 40), (N/A, 20), (N/A)
        (5150 - 5350 @ 160), (N/A, 20), (N/A), NO-OUTDOOR
        (5650 - 5850 @ 160), (N/A, 20), (N/A), NO-OUTDOOR
        (57000 - 66000 @ 2160), (N/A, 40), (N/A), NO-OUTDOOR

phy#3 (self-managed)
country RU: DFS-UNSET
        (2402 - 2472 @ 40), (N/A, 20), (N/A)
        (5170 - 5250 @ 80), (N/A, 23), (N/A), AUTO-BW
        (5250 - 5330 @ 80), (N/A, 23), (0 ms), DFS, AUTO-BW
        (5490 - 5730 @ 160), (N/A, 24), (0 ms), DFS, AUTO-BW
        (5735 - 5835 @ 80), (N/A, 30), (N/A), AUTO-BW

phy#2 (self-managed)
country RU: DFS-UNSET
        (2402 - 2472 @ 40), (N/A, 30), (N/A)
        (5170 - 5250 @ 80), (N/A, 23), (N/A), AUTO-BW
        (5250 - 5330 @ 80), (N/A, 23), (0 ms), DFS, AUTO-BW
        (5490 - 5730 @ 160), (N/A, 24), (0 ms), DFS, AUTO-BW
        (5735 - 5835 @ 80), (N/A, 30), (N/A), AUTO-BW

phy#1 (self-managed)
country RU: DFS-UNSET
        (2402 - 2472 @ 40), (N/A, 30), (N/A)
        (5170 - 5250 @ 80), (N/A, 23), (N/A), AUTO-BW
        (5250 - 5330 @ 80), (N/A, 23), (0 ms), DFS, AUTO-BW
        (5490 - 5730 @ 160), (N/A, 24), (0 ms), DFS, AUTO-BW
        (5735 - 5835 @ 80), (N/A, 30), (N/A), AUTO-BW

phy#0
country US: DFS-FCC
        (902 - 904 @ 2), (N/A, 30), (N/A)
        (904 - 920 @ 16), (N/A, 30), (N/A)
        (920 - 928 @ 8), (N/A, 30), (N/A)
        (2400 - 2472 @ 40), (N/A, 30), (N/A)
        (5150 - 5250 @ 80), (N/A, 23), (N/A), AUTO-BW
        (5250 - 5350 @ 80), (N/A, 24), (0 ms), DFS, AUTO-BW
        (5470 - 5730 @ 160), (N/A, 24), (0 ms), DFS
        (5730 - 5850 @ 80), (N/A, 30), (N/A), AUTO-BW
        (5850 - 5895 @ 40), (N/A, 27), (N/A), NO-OUTDOOR, AUTO-BW, PASSIVE-SCAN
        (5925 - 7125 @ 320), (N/A, 12), (N/A), NO-OUTDOOR, PASSIVE-SCAN
        (57240 - 71000 @ 2160), (N/A, 40), (N/A)

and obviously doesn't work on DFS channels.
(I changed RU definition in wireless-regdb/db.txt to be DFS-ETSI trying to fix things)

teardown here: https://www.acwifi.net/23365.html

thank you for sharing... clearly a device for the chinese market ! interesting remark about the low spec FEM chips being used to restrict the full use of the wifi HW !

1 Like

changing db.txt don't think it will work as the firmware will take precendence ...let me know if it has ...

Yes, dfs_region for phy is set from firmware wmi call response in ath11k_pull_reg_chan_list_update_ev. And it is NL80211_DFS_UNSET. Now the question is: how do I properly fix this?

Currently by modifying the BDF, from 2.7 FW you can load the external regulatory

1 Like

The license only allows redistributing unmodified version, so I don't count this as "proper fix". Should I contact Qualcomm on the issue? The ath11k regulatory info for Russia is plain wrong.

Which license?

For the BDF-s that are pulled out of stock FW, there isn't any license attached, but it would be ideal for QCA to sort that out as most of the regulatory info is outdated

Well, that is the thing, those BDF-s are not being used at all, we are pulling them from stock FW as they are board specific, so its all gray area.

my chinese friend bought uart ttl 1.8v for me from china..can't get in my country market so far

Hello. I have an International Router, when i upload the file to the router it says invalid format.. any tip? thanks

After flashing ...ax9000-initramfs-factory.ubi my International version goes into boot loop:

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00163
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B -       201 - PBL, Start
B -      2734 - bootable_media_detect_entry, Start
B -      3442 - bootable_media_detect_success, Start
B -      3447 - elf_loader_entry, Start
B -      6116 - auth_hash_seg_entry, Start
B -     43687 - auth_hash_seg_exit, Start
B -    105693 - elf_segs_hash_verify_entry, Start
B -    168552 - PBL, End
B -    268583 - SBL1, Start
B -    346053 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B -    355721 - pm_device_init, Start
B -    535641 - PM_SET_VAL:Skip
D -    178120 - pm_device_init, Delta
B -    538081 - pm_driver_init, Start
D -      5398 - pm_driver_init, Delta
B -    544394 - clock_init, Start
D -      2135 - clock_init, Delta
B -    548420 - boot_flash_init, Start
D -     12535 - boot_flash_init, Delta
B -    564646 - boot_config_data_table_init, Start
D -      3111 - boot_config_data_table_init, Delta - (575 Bytes)
B -    572149 - Boot Setting :  0x00000600
B -    576053 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:18
B -    583068 - sbl1_ddr_set_params, Start
B -    586789 - CPR configuration: 0x300
B -    590266 - cpr_init, Start
B -    593133 - Rail:0 Mode: 5 Voltage: 824000
B -    598227 - CL CPR settled at 776000mV
B -    601155 - Rail:1 Mode: 5 Voltage: 888000
B -    605333 - Rail:1 Mode: 7 Voltage: 928000
D -     16470 - cpr_init, Delta
B -    612196 - Pre_DDR_clock_init, Start
B -    616191 - Pre_DDR_clock_init, End
B -    619577 - DDR Type : PCDDR3
B -    625250 - do ddr sanity test, Start
D -      1037 - do ddr sanity test, Delta
B -    630099 - DDR: Start of HAL DDR Boot Training
B -    634735 - DDR: End of HAL DDR Boot Training
B -    640500 - DDR: Checksum to be stored on flash is 1210133128
B -    650839 - Image Load, Start
D -    507032 - QSEE Image Loaded, Delta - (1381328 Bytes)
B -   1157963 - Image Load, Start
D -        61 - SEC Image Loaded, Delta - (0 Bytes)
B -   1165649 - Image Load, Start
D -    293746 - DEVCFG Image Loaded, Delta - (32548 Bytes)
B -   1459455 - Image Load, Start
D -    305000 - RPM Image Loaded, Delta - (93060 Bytes)
B -   1764547 - Image Load, Start
D -    376919 - APPSBL Image Loaded, Delta - (583214 Bytes)
B -   2141588 - QSEE Execution, Start
D -        61 - QSEE Execution, Delta
B -   2147383 - USB D+ check, Start
D -         0 - USB D+ check, Delta
B -   2153788 - SBL1, End
D -   1887492 - SBL1, Delta
S - Flash Throughput, 6731 KB/s  (2091397 Bytes,  310666 us)
S - DDR Frequency, 466 MHz
S - Core 0 Frequency, 1651 MHz


U-Boot 2016.01 (May 08 2021 - 02:53:50 +0000), Build: jenkins-common_router_openwrt_ota_publish-1177

DRAM:  smem ram ptable found: ver: 1 len: 4
1 GiB
NAND:  Could not find nand_gpio in dts, using defaults
ONFI device found
ID = 1590aaef
Vendor = ef
Device = aa
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC:   sdhci: Node Not found, skipping initialization

PCI Link Intialized
PCI Link Intialized
In:    serial@78B3000
Out:   serial@78B3000
Err:   serial@78B3000
machid: 8010012
MMC Device 0 not found
bootwait is on, bootdelay=5
Hit any key to stop autoboot:  0
 trigger button release!
secure boot fuse is enabled
System is in factory mode.
Secure boot is enabled!
boot from rootfs 0
  miwifi: check crash in rmem !
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 56 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 448, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 1, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 81594439
ubi0: available PEBs: 308, total reserved PEBs: 140, PEBs reserved for bad PEB handling: 40
Read 0 bytes from volume kernel to 42000000
No size specified -> Using max size (12189696)
System is in factory mode.
Erasing NAND...
Erasing at 0xd60000 -- 100% complete.
Writing to NAND... OK
## Loading kernel from FIT Image at 42000000 ...
   Using 'config@hk14' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.86
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x420000e8
     Data Size:    12050277 Bytes = 11.5 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x41000000
     Entry Point:  0x41000000
     Hash algo:    crc32
     Hash value:   fd0d3e5a
     Hash algo:    sha1
     Hash value:   2afcc4c5bcfd0fcfd41fb2cb6dd44e6bc150160c
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 42000000 ...
   Using 'config@hk14' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt xiaomi_ax9000 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x42b7e190
     Data Size:    44415 Bytes = 43.4 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   dd586484
     Hash algo:    sha1
     Hash value:   5d5b9f2eac89e1a30e4b13666d7ec10331167666
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x42b7e190
   Uncompressing Kernel Image ... OK
ERROR: new format image overwritten - must RESET the board to recover
resetting ...

Environment:
IPQ807x# printenv
CountryCode=DE
SN=34289/F1Sxxxxxxx
atf=1
boot_wait=on
bootargs=ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait
bootcmd=tftp
bootdelay=5
color=100
eth1addr=64:64:4a:a0:49:31
eth2addr=64:64:4a:a0:49:31
eth3addr=64:64:4a:a0:49:31
eth4addr=64:64:4a:59:50:11
eth5addr=64:64:4a:59:50:11
ethact=eth0
ethaddr=64:64:4a:a0:49:31
fdt_high=0x4A400000
fdtcontroladdr=4a977f90
flag_boot_rootfs=0
flag_boot_success=1
flag_boot_type=2
flag_last_succes=1
flag_last_success=0
flag_ota_reboot=0
flag_sec_boot_enabled=1
flag_try_sys1_failed=0
flag_try_sys2_failed=0
flash_type=2
fsbootargs=ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs
ipaddr=192.168.31.1
machid=8010012
miot_did=reducted
miot_key=reducted
mode=Router
model=RA70
mtddevname=fs
mtddevnum=0
mtdids=nand0=nand0
mtdparts=mtdparts=nand0:0x3800000@0x1180000(fs),
no_wifi_dev_times=0
nv_wan_type=dhcp
partition=nand0,0
restore_defaults=0
serverip=192.168.31.100
soc_hw_version=200d0200
soc_version_major=2
soc_version_minor=0
ssh_en=1
stderr=serial@78B3000
stdin=serial@78B3000
stdout=serial@78B3000
telnet_en=0
uart_en=1
wl0_radio=1
wl0_ssid=xiaomi-router-ra70_miap5014_5G
wl1_radio=1
wl1_ssid=xiaomi-router-ra70_miap5014
wl2_ssid=xiaomi-router-ra70_5014_Game


1 Like

They changed the load address to 0x42000000 while every other board (including the CN model) uses 0x44000000 so there is not enough space.

I am gonna be traveling for about a week, but if you can build your own images, you can try tweaking the KERNEL_LOADADDR in:

Thanks I'll try. I have not been too succesfull yet.

Has anyone tried to override u-boot load_addr? I.e. setenv load_addr 44000000; saveenv; reset. It can be a much simpler solution if it works.

I would like to confirm the issue on my international version, please see my UART bootlog below. (the img is the last dual fs version from Robi.

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00163
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B -       201 - PBL, Start
B -      2735 - bootable_media_detect_entry, Start
B -      3442 - bootable_media_detect_success, Start
B -      3446 - elf_loader_entry, Start
B -      6109 - auth_hash_seg_entry, Start
B -     43642 - auth_hash_seg_exit, Start
B -    105497 - elf_segs_hash_verify_entry, Start
B -    168353 - PBL, End
B -    177510 - SBL1, Start
B -    228780 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B -    235185 - pm_device_init, Start
B -    354745 - PM_SET_VAL:Skip
D -    119133 - pm_device_init, Delta
B -    357155 - pm_driver_init, Start
D -      5337 - pm_driver_init, Delta
B -    363468 - clock_init, Start
D -      2104 - clock_init, Delta
B -    367494 - boot_flash_init, Start
D -     12505 - boot_flash_init, Delta
B -    383781 - boot_config_data_table_init, Start
D -      3080 - boot_config_data_table_init, Delta - (575 Bytes)
B -    391284 - Boot Setting :  0x00000600
B -    395188 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:18
B -    402203 - sbl1_ddr_set_params, Start
B -    406016 - CPR configuration: 0x300
B -    409401 - cpr_init, Start
B -    412268 - Rail:0 Mode: 5 Voltage: 816000
B -    417270 - CL CPR settled at 768000mV
B -    420290 - Rail:1 Mode: 5 Voltage: 880000
B -    424468 - Rail:1 Mode: 7 Voltage: 912000
D -     16470 - cpr_init, Delta
B -    431331 - Pre_DDR_clock_init, Start
B -    435357 - Pre_DDR_clock_init, End
B -    438651 - DDR Type : PCDDR3
B -    444385 - do ddr sanity test, Start
D -      1037 - do ddr sanity test, Delta
B -    449234 - DDR: Start of HAL DDR Boot Training
B -    453870 - DDR: End of HAL DDR Boot Training
B -    459635 - DDR: Checksum to be stored on flash is -314266808
B -    469974 - Image Load, Start
D -    507154 - QSEE Image Loaded, Delta - (1381328 Bytes)
B -    977220 - Image Load, Start
D -        61 - SEC Image Loaded, Delta - (0 Bytes)
B -    984875 - Image Load, Start
D -    293746 - DEVCFG Image Loaded, Delta - (32548 Bytes)
B -   1278712 - Image Load, Start
D -    305031 - RPM Image Loaded, Delta - (93060 Bytes)
B -   1583834 - Image Load, Start
D -    376919 - APPSBL Image Loaded, Delta - (583214 Bytes)
B -   1960875 - QSEE Execution, Start
D -        61 - QSEE Execution, Delta
B -   1966670 - USB D+ check, Start
D -         0 - USB D+ check, Delta
B -   1973075 - SBL1, End
D -   1797883 - SBL1, Delta
S - Flash Throughput, 6728 KB/s  (2091397 Bytes,  310849 us)
S - DDR Frequency, 466 MHz
S - Core 0 Frequency, 1651 MHz


U-Boot 2016.01 (May 08 2021 - 02:53:50 +0000), Build: jenkins-common_router_openwrt_ota_publish-1177

DRAM:  smem ram ptable found: ver: 1 len: 4
1 GiB
NAND:  Could not find nand_gpio in dts, using defaults
ONFI device found
ID = 1590aaef
Vendor = ef
Device = aa
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC:   sdhci: Node Not found, skipping initialization

## Error: flags type check failure for "ethaddr" <= ""00:AA:BB:CC:DD:10"" (type: m)
himport_r: can't insert "ethaddr="00:AA:BB:CC:DD:10"" into hash table
PCI Link Intialized
PCI Link Intialized
In:    serial@78B3000
Out:   serial@78B3000
Err:   serial@78B3000
machid: 8010012
MMC Device 0 not found
bootwait is on, bootdelay=5
Hit any key to stop autoboot:  0
 trigger button release!
secure boot fuse is enabled
boot from rootfs 0
  miwifi: check crash in rmem !
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 56 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 448, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1889279889
ubi0: available PEBs: 0, total reserved PEBs: 448, PEBs reserved for bad PEB handling: 40
Read 0 bytes from volume kernel to 42000000
No size specified -> Using max size (4825088)
## Loading kernel from FIT Image at 42000000 ...
   Using 'config@hk14' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.86
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x420000e8
     Data Size:    4775841 Bytes = 4.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x41000000
     Entry Point:  0x41000000
     Hash algo:    crc32
     Hash value:   c54a4ffe
     Hash algo:    sha1
     Hash value:   9a2fcebd1f370a85cb2f9af7ad7cf70fafce6023
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 42000000 ...
   Using 'config@hk14' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt xiaomi_ax9000 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x4248e1cc
     Data Size:    44563 Bytes = 43.5 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   12027822
     Hash algo:    sha1
     Hash value:   80bea90ec40cfe9f9458eb33e9b8e62c55999e7e
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x4248e1cc
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 4a3f2000, end 4a3ffe12 ... OK
Using machid 0x8010012 from environment

Starting kernel ...

Jumping to AARCH64 kernel via monitor
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.86 (ubuntu@buildbot) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r0-928dceb) 11.3.0, GNU ld (GNU Binutils) 2.39) #0 SMP Tue Jan 3 12:07:39 2023
[    0.000000] Machine model: Xiaomi AX9000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000040ffffff]
[    0.000000]   node   0: [mem 0x0000000041000000-0x000000004a3fffff]
[    0.000000]   node   0: [mem 0x000000004a400000-0x00000000510fffff]
[    0.000000]   node   0: [mem 0x0000000051100000-0x000000007fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] percpu: Embedded 17 pages/cpu s30808 r8192 d30632 u69632
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 258048
[    0.000000] Kernel command line: ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait uart_en=1 root=/dev/ubiblock0_1
[    0.000000] Unknown kernel command line parameters "uart_en=1", will be passed to user space.
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 887724K/1048576K available (7808K kernel code, 866K rwdata, 2128K rodata, 1280K init, 286K bss, 160852K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv2m: range[mem 0x0b00a000-0x0b00affc], SPI[448:479]
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[    0.000000] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[    0.000130] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=192000)
[    0.000147] pid_max: default: 32768 minimum: 301
[    0.000307] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.000324] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.001932] rcu: Hierarchical SRCU implementation.
[    0.002104] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.002723] smp: Bringing up secondary CPUs ...
[    0.003319] Detected VIPT I-cache on CPU1
[    0.003383] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.004004] Detected VIPT I-cache on CPU2
[    0.004046] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.004623] Detected VIPT I-cache on CPU3
[    0.004660] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.004726] smp: Brought up 1 node, 4 CPUs
[    0.004753] SMP: Total of 4 processors activated.
[    0.004761] CPU features: detected: 32-bit EL0 Support
[    0.004769] CPU features: detected: CRC32 instructions
[    0.004823] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.004833] CPU: All CPU(s) started at EL1
[    0.004855] alternatives: patching kernel code
[    0.013516] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.013551] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.013695] pinctrl core: initialized pinctrl subsystem
[    0.014980] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.015469] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.015512] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.015548] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.015881] thermal_sys: Registered thermal governor 'step_wise'
[    0.017424] cpuidle: using governor menu
[    0.017660] ASID allocator initialised with 65536 entries
[    0.040758] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    0.049773] SCSI subsystem initialized
[    0.049958] usbcore: registered new interface driver usbfs
[    0.050001] usbcore: registered new interface driver hub
[    0.050037] usbcore: registered new device driver usb
[    0.050490] qcom_scm: convention: smc arm 64
[    0.051908] clocksource: Switched to clocksource arch_sys_counter
[    0.052609] NET: Registered PF_INET protocol family
[    0.052749] IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.053680] tcp_listen_portaddr_hash hash table entries: 512 (order: 1, 8192 bytes, linear)
[    0.053711] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.053727] TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.053815] TCP bind hash table entries: 8192 (order: 5, 131072 bytes, linear)
[    0.053964] TCP: Hash tables configured (established 8192 bind 8192)
[    0.054051] UDP hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.054092] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.054263] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.054298] PCI: CLS 0 bytes, default 64
[    0.055462] workingset: timestamp_bits=46 max_order=18 bucket_order=0
[    0.059532] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.059550] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.060314] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 248)
[    0.061464] qcom-qmp-phy 78000.phy: supply vdda-phy not found, using dummy regulator
[    0.061613] qcom-qmp-phy 78000.phy: supply vdda-pll not found, using dummy regulator
[    0.062039] qcom-qmp-phy 78000.phy: Registered Qcom-QMP phy
[    0.062573] qcom-qmp-phy 84000.phy: Registered Qcom-QMP phy
[    0.063018] qcom-qmp-phy 8e000.phy: Registered Qcom-QMP phy
[    0.063848] qcom-qusb2-phy 79000.phy: supply vdda-pll not found, using dummy regulator
[    0.063979] qcom-qusb2-phy 79000.phy: supply vdda-phy-dpdm not found, using dummy regulator
[    0.064132] qcom-qusb2-phy 79000.phy: Registered Qcom-QUSB2 phy
[    0.066116] qcom-pcie 10000000.pci: host bridge /soc/pci@10000000 ranges:
[    0.066177] qcom-pcie 10000000.pci:       IO 0x0010200000..0x001020ffff -> 0x0010200000
[    0.066206] qcom-pcie 10000000.pci:      MEM 0x0010220000..0x001fffffff -> 0x0010220000
[    0.125243] qcom-pcie 10000000.pci: Read DBI address failed
[    0.233485] qcom-pcie 10000000.pci: iATU unroll: disabled
[    0.233500] qcom-pcie 10000000.pci: Detected iATU regions: 32 outbound, 8 inbound
[    0.333590] qcom-pcie 10000000.pci: Link up
[    0.333751] qcom-pcie 10000000.pci: PCI host bridge to bus 0001:00
[    0.333765] pci_bus 0001:00: root bus resource [bus 00-ff]
[    0.333782] pci_bus 0001:00: root bus resource [io  0x0000-0xffff] (bus address [0x10200000-0x1020ffff])
[    0.333795] pci_bus 0001:00: root bus resource [mem 0x10220000-0x1fffffff]
[    0.333844] pci 0001:00:00.0: [17cb:0302] type 01 class 0x060400
[    0.333870] pci 0001:00:00.0: reg 0x10: [mem 0x00000000-0x00000fff]
[    0.333948] pci 0001:00:00.0: PME# supported from D0 D3hot D3cold
[    0.337613] pci 0001:01:00.0: [168c:0050] type 00 class 0x028000
[    0.337760] pci 0001:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    0.337973] pci 00 10.365132] pci 0001:01:00.0: BAR 0: assigned [mem 0x10400000-0x105fffff 64bit]
[    0.365203] pci 0001:01:00.0: BAR 6: assigned [mem 0x10300000-0x1030ffff pref]
[    0.365217] pci 0001:00:00.0: PCI bridge to [bus 01-ff]
[    0.365231] pci 0001:00:00.0:   bridge window [mem 0x10300000-0x105fffff]
[    0.367159] pcieport 0001:00:00.0: PME: Signaling with IRQ 83
[    0.367464] pcieport 0001:00:00.0: AER: enabled with IRQ 83
[    0.368293] qcom-pcie 20000000.pci: host bridge /soc/pci@20000000 ranges:
[    0.368349] qcom-pcie 20000000.pci:       IO 0x0020200000..0x002020ffff -> 0x0020200000
[    0.368377] qcom-pcie 20000000.pci:      MEM 0x0020220000..0x002fffffff -> 0x0020220000
[    0.493459] qcom-pcie 20000000.pci: iATU unroll: enabled
[    0.493475] qcom-pcie 20000000.pci: Detected iATU regions: 8 outbound, 8 inbound
[    0.593538] qcom-pcie 20000000.pci: Link up
[    0.593687] qcom-pcie 20000000.pci: PCI host bridge to bus 0000:00
[    0.593701] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.593719] pci_bus 0000:00: root bus resource [io  0x10000-0x1ffff] (bus address [0x20200000-0x2020ffff])
[    0.593731] pci_bus 0000:00: root bus resource [mem 0x20220000-0x2fffffff]
[    0.593777] pci 0000:00:00.0: [17cb:1002] type 01 class 0x060400
[    0.593801] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x00000fff]
[    0.593873] pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
[    0.597504] pci 0000:01:00.0: [17cb:1104] type 00 class 0x028000
[    0.597608] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    0.598123] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[    0.598265] pci 0000:01:00.0: 7.876 Gb/s available PCIe bandwidth, limited by 8.0 GT/s PCIe x1 link at 0000:00:00.0 (capable of 15.752 Gb/s with 8.0 GT/s PCIe x2 link)
[    0.601592] pci 0000:00:00.0: BAR 8: assigned [mem 0x20400000-0x205fffff]
[    0.601617] pci 0000:00:00.0: BAR 9: assigned [mem 0x20600000-0x207fffff 64bit pref]
[    0.601631] pci 0000:00:00.0: BAR 0: assigned [mem 0x20220000-0x20220fff]
[    0.601647] pci 0000:00:00.0: BAR 7: assigned [io  0x10000-0x10fff]
[    0.601664] pci 0000:01:00.0: BAR 0: assigned [mem 0x20400000-0x205fffff 64bit]
[    0.601718] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    0.601730] pci 0000:00:00.0:   bridge window [io  0x10000-0x10fff]
[    0.601743] pci 0000:00:00.0:   bridge window [mem 0x20400000-0x205fffff]
[    0.601755] pci 0000:00:00.0:   bridge window [mem 0x20600000-0x207fffff 64bit pref]
[    0.603194] pcieport 0000:00:00.0: PME: Signaling with IRQ 84
[    0.603501] pcieport 0000:00:00.0: AER: enabled with IRQ 84
[    0.605093] bam-dma-engine 704000.dma-controller: num-channels unspecified in dt
[    0.605118] bam-dma-engine 704000.dma-controller: num-ees unspecified in dt
[    0.608456] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.610026] msm_serial 78b3000.serial: msm_serial: detected port #0
[    0.610058] msm_serial 78b3000.serial: uartclk = 3686400
[    0.610096] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 22, base_baud = 230400) is a MSM
[    0.610123] msm_serial: console setup on port #0
[    1.629652] printk: console [ttyMSM0] enabled
[    1.634791] msm_serial: driver initialized
[    1.642760] loop: module loaded
[    1.642832] Loading iSCSI transport class v2.0-870.
[    1.647405] nand: device found, Manufacturer ID: 0xef, Chip ID: 0xaa
[    1.650467] nand: Winbond W29N02GZ
[    1.657077] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.660552] 24 fixed-partitions partitions found on MTD device qcom_nand.0
[    1.667877] OF: Bad cell count for /soc/nand-controller@79b0000/nand@0/partitions
[    1.674788] OF: Bad cell count for /soc/nand-controller@79b0000/nand@0/partitions
[    1.682619] Creating 24 MTD partitions on "qcom_nand.0":
[    1.689702] 0x000000000000-0x000000100000 : "0:sbl1"
[    1.696372] 0x000000100000-0x000000200000 : "0:mibib"
[    1.701226] 0x000000200000-0x000000280000 : "0:bootconfig"
[    1.705855] 0x000000280000-0x000000300000 : "0:bootconfig1"
[    1.711135] 0x000000300000-0x000000600000 : "0:qsee"
[    1.718582] 0x000000600000-0x000000900000 : "0:qsee_1"
[    1.723718] 0x000000900000-0x000000980000 : "0:devcfg"
[    1.726736] 0x000000980000-0x000000a00000 : "0:devcfg_1"
[    1.731869] 0x000000a00000-0x000000a80000 : "0:apdp"
[    1.737385] 0x000000a80000-0x000000b00000 : "0:apdp_1"
[    1.742357] 0x000000b00000-0x000000b80000 : "0:rpm"
[    1.747231] 0x000000b80000-0x000000c00000 : "0:rpm_1"
[    1.752036] 0x000000c00000-0x000000c80000 : "0:cdt"
[    1.757246] 0x000000c80000-0x000000d00000 : "0:cdt_1"
[    1.761957] 0x000000d00000-0x000000d80000 : "0:appsblenv"
[    1.767138] 0x000000d80000-0x000000e80000 : "0:appsbl"
[    1.772929] 0x000000e80000-0x000000f80000 : "0:appsbl_1"
[    1.777918] 0x000000f80000-0x000001000000 : "0:art"
[    1.783051] 0x000001000000-0x000001080000 : "bdata"
[    1.787590] 0x000001080000-0x000001180000 : "pstore"
[    1.792898] 0x000001180000-0x000004980000 : "rootfs"
[    1.840695] mtd: setting mtd20 (rootfs) as root device
[    1.840982] mtdsplit: no squashfs found in "rootfs"
[    1.844752] 0x000004980000-0x000008180000 : "rootfs_1"
[    1.893350] 0x000008180000-0x000008280000 : "cfg_bak"



I will try. When and where exactly to issue these commands?

You have some different problem because your kernel boots.

Yes, thats a different image, where the kernel file is smaller.

I realized since the u-boot settings you mentioned, every day is a good day to learn something new :slight_smile: