Ipq806x: LEDE support for TP-Link Archer VR2600v

Zeraphim · November 22, 2016, 12:23am

Hi,

I am starting this thread in order to document my findings about the VR2600v and my attempts of bringing LEDE to this device. I also hope that I will find other developers who are interested in bringing LEDE to this hardware in fully.

I bought this router as I thought it would be quite similar to the Archer C2600. With additions for xDSL modem and telephony/DECT support. But as it seems that TP-Link did also change a lot in it's firmware.

From hardware perspective I can see currently:

ipq806x platform with Atheros Wifi chipset quite similar to Archer C2600
Additional BCM63168 for xDSL and probably POTS / DECT
Different NOR Flash: Winbond W25Q128 which has 16MiB and a different page size of 64KiB

The good news is that the UART on the ipq806x is easy accessible. Just solder a four pin header to the unoccupied JP2 place and it is ready to go. It seems the logic converter is already in place.

With this I was able to collect a bootlog from the TP-Link firmware: http://pastebin.com/QjC2by90

The next was to get a look at the upgrade image provide by TP-Link. You can instantly see the header at the beginning 0x200 bytes:
hexdump Archer_VR2600vv1_1.3.0_0.8.0_up_boot\(160622\)_2016-06-22_10.18.36.bin -n 512 -C 00000000 03 00 00 03 0b a0 a9 ba 2a 33 90 1f 22 85 0b 54 |........*3.."..T| 00000010 82 65 62 7e 00 11 22 33 44 55 66 77 88 99 aa bb |.eb~.."3DUfw....| 00000020 cc dd ee ff 03 73 95 9b dc 33 29 ee ec f8 7e b0 |.....s...3)...~.| 00000030 42 e3 d2 34 01 5f dc 43 4f 00 00 00 00 00 00 00 |B..4._.CO.......| 00000040 8b 9c 2f 3a 55 75 32 cb 92 45 6e 4e 55 96 7b 93 |../:Uu2..EnNU.{.| 00000050 00 00 00 00 55 aa 55 aa f1 e2 d3 c4 e5 a6 6a 5e |....U.U.......j^| 00000060 4c 3d 2e 1f aa 55 aa 55 00 80 00 c0 00 80 00 c0 |L=...U.U........| 00000070 00 02 f8 00 00 02 00 00 c8 c1 1c 00 00 00 20 00 |.............. .| 00000080 3c f8 97 00 00 00 00 00 00 00 32 00 03 01 aa 55 |<.........2....U| 00000090 00 08 00 a5 00 00 00 00 57 ff 4e d2 ff ff ff ff |........W.N.....| 000000a0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| * 000000d0 c8 d3 2f b1 d9 10 e2 db c3 de 30 95 f1 cd 3b 9d |../.......0...;.| 000000e0 a6 07 d3 ed 20 99 78 eb 5e 8f e8 97 c9 53 a5 25 |.... .x.^....S.%| 000000f0 53 47 ea 32 90 69 83 20 4c 36 df c4 0e e5 5e f3 |SG.2.i. L6....^.| 00000100 81 fc 02 b1 04 d9 c4 d1 8a 5a 39 67 02 e9 2f 7f |.........Z9g../.| 00000110 4d ef 4e d6 10 61 b1 1a 09 4e 6b 72 8e e9 4b 8e |M.N..a...Nkr..K.| 00000120 05 11 1a ee c2 c2 07 80 4e 00 f8 77 f8 9e 27 ce |........N..w..'.| 00000130 1c 15 57 98 d8 fc b8 b7 b7 b2 45 c2 b0 7d 9d c4 |..W.......E..}..| 00000140 c9 cd 02 89 b5 d3 65 ea 5e e7 ac 2a 34 52 6a 5b |......e.^..*4Rj[| 00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 000001d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| * 00000200
The format looks similar to the TP-Link v3 header but it' somehow more binary. But it's possible to recognize the MD5 checksum and the RSA signature. Also recognize the magic number: It's 03 00 00 03. A version 3.3? However this is a bad sign. The original firmware does a signature check during update. As we don't know the private key it's not possible to create factory update images.
Also interesting: The image contains just all partitions up to the rootfs. After the ipq image at offset 0xf80200 follows an image for an Archer VR900v with an TP-Link v1 header. I suspect this to be the image for the BCM63168.

With the available serial connection it was possible to dump the complete flash to a binary to inspect. I came up the with the following partitions:
0x000000000000-0x000000020000 : "SBL1" 0x000000020000-0x000000040000 : "MIBIB" 0x000000040000-0x000000080000 : "SBL2" 0x000000080000-0x000000100000 : "SBL3" 0x000000100000-0x000000110000 : "DDRCONFIG" 0x000000110000-0x000000120000 : "SSD" 0x000000120000-0x0000001a0000 : "TZ" 0x0000001a0000-0x000000220000 : "RPM" 0x000000220000-0x0000002a0000 : "APPSBL" 0x0000002a0000-0x0000002e0000 : "APPSBLENV" 0x0000002e0000-0x000000320000 : "OLDART" 0x000000320000-0x000000520000 : "kernel" 0x000000520000-0x000000f80000 : "rootfs" 0x000000faf100-0x000000faf300 : "default-mac" 0x000000fc0000-0x000001000000 : "ART"
This matches also the SMEM information with some modifications for default-mac and ART. Why they moved the ART partion and left the OLDART empty know probably only the guys in Shenzhen. The new ART is just the same size.

Also noticable: The kernel partition contains also the dumped header from above. A quick check in the GPL code concludes that this header is untouched by u-boot. The search position of the uImage magic number is just skipped by 0x200 with some dirty hack:
#ifndef CONFIG_TP_IMAGE sfi->hlos.offset); #else (sfi->hlos.offset + TAG_LEN)); #endif /* CONFIG_TP_IMAGE */
So I tested it with the kernel from C2600 flashed to flash position 0x320200 and it was found and booted wohoo.
With this information it was possible to create an initial support commit which is handled in pull request #541

The LEDE build process will come up with an sysupgrade image which will handle the kernel start offset and is recognized by sysupgrade for convenient update mechanism. It must be initial flashed via u-boot. So serial connection is necessary. The bootlog can be found here: http://pastebin.com/ZirfYpKB

It can clearly be seen that Wifi is currently not working. There seems to be a problem with the ART partition. It does not look that different from the C2600 partition. So I am currently stuck here. Here you can find the ART partitions for reference:

VR2600v: https ://obiwan.home.quilitz-net.com/owncloud/index.php/s/ezUI1bqrqIFEYQ3 (please remove spaces from links)
C2600: https ://obiwan.home.quilitz-net.com/owncloud/index.php/s/F5nNeNFVV5vcIQO

Also not working: Setting the MAC addresses. At the partition I added the correct MAC can be found. But somehow the mechanism is not working. Probably not high priority but not good.

Also still unfunctional: xDSL, DECT and POTS. No work has been done here yet.

But there is also good news. The following is already working:

Ethernet including WAN and LAN
Switch configuration
Sysupgrade
LEDs and Buttons (where was already some help from @mkresin and @Heinz)

I hope that this information provided will be helpful to someone.

mkresin · November 22, 2016, 6:16am

At least from the initialisation everything is fine. The error from your old bootlog pasted in the PR is gone since you fixed the art partition size. The offsets to the art partition is right as well. Should work.

You are aware that wifi is disabled by default in LEDE? Either remove the disabled line for each radio in /etc/config/wireless and run wifi up or hit the button with the RF_KILL key code to do the same.

If this doesn't work. What happens? Anything in the logfile (logread)?

Please elaborate what you mean with doesn't not work? How do you notice that it does not work? Please past the output of ifconfig -a.

Heinz · November 22, 2016, 7:37am

I Think this is two device on one board like Archer D7/D9. Can You make photo of board?

Zeraphim · November 22, 2016, 11:40am

Hi,
thank you both for your time, help and approving my PR.

[   11.146328] ath10k_pci 0000:01:00.0: enabling device (0140 -> 0142)
[   11.146863] ath10k_pci 0000:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0
[   11.281964] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/pre-cal-pci-0000:01:00.0.bin failed with error -2
[   11.282003] ath10k_pci 0000:01:00.0: Falling back to user helper
[   11.330630] firmware ath10k!pre-cal-pci-0000:01:00.0.bin: firmware_loading_store: map pages failed
[   11.886226] ath10k_pci 0000:01:00.0: qca99x0 hw2.0 target 0x01000000 chip_id 0x003b01ff sub 168c:0002
[   11.886279] ath10k_pci 0000:01:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 1
[   11.897727] ath10k_pci 0000:01:00.0: firmware ver 10.4.1.00030-1 api 5 features no-p2p crc32 d2901e01
[   11.903426] ath10k_pci 0000:01:00.0: failed to fetch board data for bus=pci,vendor=168c,device=0040,subsystem-vendor=168c,subsystem-device=0002 from ath10k/QCA99X0/hw2.0/board-2.bin
[   11.913619] ath10k_pci 0000:01:00.0: board_file api 1 bmi_id N/A crc32 7e56fd07
[   13.098554] ath10k_pci 0000:01:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal file max-sta 512 raw 0 hwcrypto 1

This does not look right to me. And as said it is not working: http://pastebin.com/mLkf0EmE

That means that ethernet is working well but it uses the MAC addresses that have been passed on from u-boot.

br-lan    Link encap:Ethernet  HWaddr 00:03:7F:BA:DB:02  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::203:7fff:feba:db02/64 Scope:Link
          inet6 addr: fdbb:38f:a382::1/60 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3977 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3662 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:429165 (419.1 KiB)  TX bytes:882537 (861.8 KiB)

eth0      Link encap:Ethernet  HWaddr 00:AA:BB:CC:DD:EE  
          inet6 addr: fe80::2aa:bbff:fecc:ddee/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:547 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:181623 (177.3 KiB)
          Interrupt:29 

eth1      Link encap:Ethernet  HWaddr 00:03:7F:BA:DB:02  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4076 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3692 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:496425 (484.7 KiB)  TX bytes:885706 (864.9 KiB)
          Interrupt:30 

ip6tnl0   Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          NOARP  MTU:1452  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:1280 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1280 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:83588 (81.6 KiB)  TX bytes:83588 (81.6 KiB)``

The correct base MAC address is stored in the partition default-mac. All MACs should derive from that one.
hexdump -C -n 6 /dev/mtd14 00000000 50 c7 bf 0c c4 f6 |P.....|
This matches the MAC labeled on my device.

I think so, too. But I am still missing how they are connected. I was expecting Ethernet as this would ease up PPPoE. Maybe I flash back the original firmware to have a look. I remember they were messing around a lot with VLANs.
Nevertheless I am uncertain on how to work on the BCM63168. Leave it with the firmware that is on it and just figure out the communication protocol or also bring LEDE to it?

Picture can be found here, but you won't see much yet. I have still the radiators on: https://obiwan.home.quilitz-net.com/owncloud/index.php/s/2Mo1Wr9ICFgdJwO
There are two additional pin headers I guess one of them is connected to the BCM63168.

jpereira · November 22, 2016, 7:48pm

Hi Team,

Below my dmesg output using the lede r2220+24

     _________
    /        /\      _    ___ ___  ___
   /  LE    /  \    | |  | __|   \| __|
  /    DE  /    \   | |__| _|| |) | _|
 /________/  LE  \  |____|___|___/|___|                      lede-project.org \        \   DE /
  \    LE  \    /  -----------------------------------------------------------
   \  DE    \  /    Reboot (HEAD, r2220+24)
    \________\/  
root@mulambo:~# dmesg
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.4.32 (hyniu@o2.pl) (gcc version 5.4.0 (LEDE GCC 5.4.0 r2098+1) ) #0 SMP Sat Nov 19 16:57:09 2016
[    0.000000] CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c5787d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] Machine model: TP-Link Archer C2600
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] On node 0 totalpages: 122880
[    0.000000] free_area_init_node: node 0, pgdat c07f1480, node_mem_map ddc39000
[    0.000000]   Normal zone: 960 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 122880 pages, LIFO batch:31
[    0.000000] PERCPU: Embedded 11 pages/cpu @ddc0f000 s13824 r8192 d23040 u45056
[    0.000000] pcpu-alloc: s13824 r8192 d23040 u45056 alloc=11*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 121920                                    
[    0.000000] Kernel command line:
[    0.000000] Bootloader command line (ignored): console=ttyHSL1,115200n8 root=mtd:rootfs rootfstype=squashfs
[    0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)[    0.000000] Memory: 480536K/491520K available (4261K kernel code, 246K rwdata, 1548K rodata, 220K init, 228K bss, 10984K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] Virtual kernel memory layout:
                   vector  : 0xffff0000 - 0xffff1000   (   4 kB)
                   fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
                   vmalloc : 0xde800000 - 0xff800000   ( 528 MB)
                   lowmem  : 0xc0000000 - 0xde000000   ( 480 MB)
                   pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
                   modules : 0xbf000000 - 0xbfe00000   (  14 MB)
                     .text : 0xc0208000 - 0xc07b49d8   (5811 kB)
                     .init : 0xc07b5000 - 0xc07ec000   ( 220 kB)
                     .data : 0xc07ec000 - 0xc0829980   ( 247 kB)
                      .bss : 0xc082c000 - 0xc0865080   ( 229 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000]  RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000] RCU: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] NR_IRQS:16 nr_irqs:16 16
[    0.000000] clocksource: dg_timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 305801671480 ns
[    0.000008] sched_clock: 32 bits at 6MHz, resolution 160ns, wraps every 343597383600ns
[    0.000024] Switching to timer-based delay loop, resolution 160ns
[    0.000209] Calibrating delay loop (skipped), value calculated using timer frequency.. 12.50 BogoMIPS (lpj=62500)
[    0.000232] pid_max: default: 32768 minimum: 301
[    0.000331] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000346] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000950] CPU: Testing write buffer coherency: ok
[    0.001307] Setting up static identity map for 0x42208280 - 0x422082d8
[    0.004357] Brought up 2 CPUs
[    0.004376] SMP: Total of 2 processors activated (25.00 BogoMIPS).
[    0.004386] CPU: All CPU(s) started in SVC mode.
[    0.013580] VFP support v0.3: implementor 51 architecture 64 part 4d variant 2 rev 0
[    0.013817] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.013961] pinctrl core: initialized pinctrl subsystem
[    0.015342] NET: Registered protocol family 16
[    0.016597] DMA: preallocated 2048 KiB pool for atomic coherent allocations
[    0.041483] cpuidle: using governor ladder
[    0.072497] cpuidle: using governor menu
[    0.084419] gpiochip_add: registered GPIOs 0 to 68 on device: 800000.pinmux
[    0.084441] GPIO chip 800000.pinmux: created GPIO range 0->68 ==> 800000.pinmux PIN 0->68
[    0.085949] qcom_rpm 108000.rpm: RPM firmware 3.0.16777342
[    0.126740] pps_core: LinuxPPS API ver. 1 registered
[    0.126756] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.126799] PTP clock support registered
[    0.127997] clocksource: Switched to clocksource dg_timer
[    0.129252] NET: Registered protocol family 2
[    0.129812] TCP established hash table entries: 4096 (order: 2, 16384 bytes)
[    0.129855] TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
[    0.129907] TCP: Hash tables configured (established 4096 bind 4096)
[    0.129952] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.129974] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.130170] NET: Registered protocol family 1
[    0.130231] PCI: CLS 0 bytes, default 64
[    0.131489] futex hash table entries: 512 (order: 3, 32768 bytes)
[    0.131587] No memory allocated for crashlog
[    0.138715] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.138741] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.141578] io scheduler noop registered
[    0.141599] io scheduler deadline registered (default)
[    0.142217] of_get_named_gpiod_flags: parsed 'gpios' property of node '/gpio_export/usb1_power[0]' - status (0)
[    0.142358] of_get_named_gpiod_flags: parsed 'gpios' property of node '/gpio_export/usb2_power[0]' - status (0)
[    0.142463] gpio-export gpio_export: 2 gpio(s) exported
[    0.142974] qcom-pcie 1b500000.pci: GPIO lookup for consumer perst
[    0.142991] qcom-pcie 1b500000.pci: using device tree for GPIO lookup
[    0.143013] of_get_named_gpiod_flags: parsed 'perst-gpios' property of node '/soc/pci@1b500000[0]' - status (0)
[    0.143099] 1b500000.pci supply vdda not found, using dummy regulator
[    0.143184] 1b500000.pci supply vdda_phy not found, using dummy regulator
[    0.143264] 1b500000.pci supply vdda_refclk not found, using dummy regulator                                               
[    0.143679] PCI host bridge /soc/pci@1b500000 ranges:
[    0.143717]    IO 0x0fe00000..0x0fefffff -> 0x0fe00000
[    0.143740]   MEM 0x08000000..0x0fdfffff -> 0x08000000
[    0.176026] qcom-pcie 1b500000.pci: PCI host bridge to bus 0000:00
[    0.176047] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.176066] pci_bus 0000:00: root bus resource [io  0x0000-0xfffff] (bus address [0xfe00000-0xfefffff])
[    0.176080] pci_bus 0000:00: root bus resource [mem 0x08000000-0x0fdfffff][    0.176095] pci_bus 0000:00: scanning bus
[    0.176140] pci 0000:00:00.0: [17cb:0101] type 01 class 0x060400
[    0.176246] pci 0000:00:00.0: calling pci_fixup_ide_bases+0x0/0x44
[    0.176300] pci 0000:00:00.0: supports D1
[    0.176316] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.176334] pci 0000:00:00.0: PME# disabled
[    0.176562] pci_bus 0000:00: fixups for bus
[    0.176587] PCI: bus0: Fast back to back transfers disabled
[    0.176605] pci 0000:00:00.0: scanning [bus 01-01] behind bridge, pass 0
[    0.176740] pci_bus 0000:01: scanning bus
[    0.176886] pci 0000:01:00.0: [168c:0040] type 00 class 0x028000
[    0.177200] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    0.177565] pci 0000:01:00.0: calling pci_fixup_ide_bases+0x0/0x44
[    0.177943] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[    0.177980] pci 0000:01:00.0: PME# disabled
[    0.178344] pci_bus 0000:01: fixups for bus
[    0.178416] PCI: bus1: Fast back to back transfers disabled
[    0.178431] pci_bus 0000:01: bus scan returning with max=01
[    0.178451] pci 0000:00:00.0: scanning [bus 01-01] behind bridge, pass 1
[    0.178471] pci_bus 0000:00: bus scan returning with max=01
[    0.178536] pci 0000:00:00.0: fixup irq: got 133
[    0.178549] pci 0000:00:00.0: assigning IRQ 133
[    0.178611] pci 0000:01:00.0: fixup irq: got 133
[    0.178624] pci 0000:01:00.0: assigning IRQ 133
[    0.178686] pci 0000:00:00.0: BAR 8: assigned [mem 0x08000000-0x081fffff]
[    0.178709] pci 0000:01:00.0: BAR 0: assigned [mem 0x08000000-0x081fffff 64bit]
[    0.178814] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.178834] pci 0000:00:00.0:   bridge window [mem 0x08000000-0x081fffff]
[    0.179175] aer 0000:00:00.0:pcie02: service driver aer loaded
[    0.179423] qcom-pcie 1b700000.pci: GPIO lookup for consumer perst
[    0.179436] qcom-pcie 1b700000.pci: using device tree for GPIO lookup
[    0.179457] of_get_named_gpiod_flags: parsed 'perst-gpios' property of node '/soc/pci@1b700000[0]' - status (0)
[    0.179529] 1b700000.pci supply vdda not found, using dummy regulator
[    0.179611] 1b700000.pci supply vdda_phy not found, using dummy regulator
[    0.179691] 1b700000.pci supply vdda_refclk not found, using dummy regulator                                               
[    0.180089] PCI host bridge /soc/pci@1b700000 ranges:
[    0.180121]    IO 0x31e00000..0x31efffff -> 0x31e00000
[    0.180140]   MEM 0x2e000000..0x31dfffff -> 0x2e000000
[    0.209104] qcom-pcie 1b700000.pci: PCI host bridge to bus 0001:00
[    0.209124] pci_bus 0001:00: root bus resource [bus 00-ff]
[    0.209140] pci_bus 0001:00: root bus resource [mem 0x2e000000-0x31dfffff][    0.209155] pci_bus 0001:00: scanning bus
[    0.209195] pci 0001:00:00.0: [17cb:0101] type 01 class 0x060400
[    0.209283] pci 0001:00:00.0: calling pci_fixup_ide_bases+0x0/0x44
[    0.209329] pci 0001:00:00.0: supports D1
[    0.209344] pci 0001:00:00.0: PME# supported from D0 D1 D3hot
[    0.209361] pci 0001:00:00.0: PME# disabled
[    0.209587] pci_bus 0001:00: fixups for bus
[    0.209608] PCI: bus0: Fast back to back transfers disabled
[    0.209624] pci 0001:00:00.0: scanning [bus 01-01] behind bridge, pass 0
[    0.209758] pci_bus 0001:01: scanning bus
[    0.209907] pci 0001:01:00.0: [168c:0040] type 00 class 0x028000
[    0.210219] pci 0001:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    0.210582] pci 0001:01:00.0: calling pci_fixup_ide_bases+0x0/0x44
[    0.210958] pci 0001:01:00.0: PME# supported from D0 D3hot D3cold
[    0.210996] pci 0001:01:00.0: PME# disabled
[    0.211291] pci_bus 0001:01: fixups for bus
[    0.211352] PCI: bus1: Fast back to back transfers disabled
[    0.211365] pci_bus 0001:01: bus scan returning with max=01
[    0.211382] pci 0001:00:00.0: scanning [bus 01-01] behind bridge, pass 1
[    0.211401] pci_bus 0001:00: bus scan returning with max=01
[    0.211446] pcieport 0000:00:00.0: fixup irq: got 133
[    0.211459] pcieport 0000:00:00.0: assigning IRQ 133
[    0.211519] pci 0000:01:00.0: fixup irq: got 133
[    0.211531] pci 0000:01:00.0: assigning IRQ 133
[    0.211598] pci 0001:00:00.0: fixup irq: got 166
[    0.211610] pci 0001:00:00.0: assigning IRQ 166
[    0.211668] pci 0001:01:00.0: fixup irq: got 166
[    0.211680] pci 0001:01:00.0: assigning IRQ 166
[    0.211732] pci 0001:00:00.0: BAR 8: assigned [mem 0x2e000000-0x2e1fffff]
[    0.211754] pci 0001:01:00.0: BAR 0: assigned [mem 0x2e000000-0x2e1fffff 64bit]
[    0.211854] pci 0001:00:00.0: PCI bridge to [bus 01]
[    0.211872] pci 0001:00:00.0:   bridge window [mem 0x2e000000-0x2e1fffff]
[    0.212192] aer 0001:00:00.0:pcie02: service driver aer loaded
[    0.214418] gsbi 16300000.gsbi: GSBI port protocol: 6 crci: 0
[    0.215464] gsbi 1a200000.gsbi: GSBI port protocol: 3 crci: 0
[    0.216490] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.219388] msm_serial 16340000.serial: msm_serial: detected port #0
[    0.219496] msm_serial 16340000.serial: uartclk = 1843200
[    0.219558] 16340000.serial: ttyMSM0 at MMIO 0x16340000 (irq = 167, base_baud = 115200) is a MSM
[    0.219594] msm_serial: console setup on port #0
[    0.865839] console [ttyMSM0] enabled
[    0.870650] msm_serial: driver initialized
[    0.880434] loop: module loaded
[    0.881703] spi_qup 1a280000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    0.882456] of_get_named_gpiod_flags: parsed 'cs-gpios' property of node '/soc/gsbi@1a200000/spi@1a280000[0]' - status (0)
[    0.883733] m25p80 spi32766.0: mx25u25635f (32768 Kbytes)
[    0.889949] 25 ofpart partitions found on MTD device spi32766.0
[    0.895054] Creating 25 MTD partitions on "spi32766.0":
[    0.900879] 0x000000000000-0x000000020000 : "SBL1"
[    0.907024] 0x000000020000-0x000000040000 : "MIBIB"
[    0.911898] 0x000000040000-0x000000060000 : "SBL2"
[    0.916589] 0x000000060000-0x000000090000 : "SBL3"
[    0.921518] 0x000000090000-0x0000000a0000 : "DDRCONFIG"
[    0.926193] 0x0000000a0000-0x0000000b0000 : "SSD"
[    0.931280] 0x0000000b0000-0x0000000e0000 : "TZ"
[    0.936187] 0x0000000e0000-0x000000100000 : "RPM"
[    0.940981] 0x000000100000-0x000000170000 : "fs-uboot"
[    0.945463] 0x000000170000-0x0000001b0000 : "uboot-env"
[    0.950603] 0x0000001b0000-0x0000001f0000 : "radio"
[    0.955511] 0x0000001f0000-0x0000003f0000 : "os-image"
[    0.960606] 0x0000003f0000-0x000001ef0000 : "rootfs"
[    0.965706] mtd: device 12 (rootfs) set to be root filesystem
[    0.970168] 1 squashfs-split partitions found on MTD device rootfs
[    0.975526] 0x0000007a0000-0x000001ef0000 : "rootfs_data"
[    0.982628] 0x000001ef0000-0x000001ef0200 : "default-mac"
[    0.988028] 0x000001ef0200-0x000001ef0400 : "pin"
[    0.993391] 0x000001ef0400-0x000001f00000 : "product-info"
[    0.998136] 0x000001f00000-0x000001f10000 : "partition-table"
[    1.003370] 0x000001f10000-0x000001f20000 : "soft-version"
[    1.009516] 0x000001f20000-0x000001f30000 : "support-list"
[    1.014789] 0x000001f30000-0x000001f40000 : "profile"
[    1.020359] 0x000001f40000-0x000001f50000 : "default-config"
[    1.025401] 0x000001f50000-0x000001f90000 : "user-config"
[    1.030951] 0x000001f90000-0x000001fd0000 : "qos-db"
[    1.036223] 0x000001fd0000-0x000001fe0000 : "usb-config"
[    1.041345] 0x000001fe0000-0x000002000000 : "log"
[    1.047338] libphy: Fixed MDIO Bus: probed
[    1.050605] of_get_named_gpiod_flags: parsed 'gpios' property of node '/soc/mdio[0]' - status (0)
[    1.050630] of_get_named_gpiod_flags: parsed 'gpios' property of node '/soc/mdio[1]' - status (0)
[    1.050646] of_get_named_gpiod_flags: can't parse 'gpios' property of node '/soc/mdio[2]'
[    1.050772] libphy: GPIO Bitbanged MDIO: probed
[    1.076347] switch0: Atheros AR8337 rev. 2 switch registered on gpio-0
[    1.303507] of_get_named_gpiod_flags: can't parse 'link-gpios' property of node '/soc/ethernet@37200000/fixed-link[0]'
[    1.304090] stmmac - user ID: 0x10, Synopsys ID: 0x37
[    1.304116]  Ring mode enabled
[    1.308112]  DMA HW capability register supported
[    1.311158]  Enhanced/Alternate descriptors
[    1.315837]  Enabled extended descriptors
[    1.319893]  RX Checksum Offload Engine supported (type 2)
[    1.324000]  TX Checksum insertion supported
[    1.329451]  Wake-Up On Lan supported
[    1.333807]  Enable RX Mitigation via HW Watchdog Timer
[    1.338387] of_get_named_gpiod_flags: can't parse 'link-gpios' property of node '/soc/ethernet@37400000/fixed-link[0]'
[    1.338880] stmmac - user ID: 0x10, Synopsys ID: 0x37
[    1.342403]  Ring mode enabled
[    1.347608]  DMA HW capability register supported
[    1.350657]  Enhanced/Alternate descriptors
[    1.355333]  Enabled extended descriptors
[    1.359412]  RX Checksum Offload Engine supported (type 2)
[    1.363497]  TX Checksum insertion supported
[    1.368939]  Wake-Up On Lan supported
[    1.373302]  Enable RX Mitigation via HW Watchdog Timer
[    1.377493] i2c /dev entries driver
[    1.387828] Speed bin: 0
[    1.387849] PVS bin: 1
[    1.389937] cpuidle: enable-method property 'qcom,kpss-acc-v1' found operations
[    1.391628] cpuidle: enable-method property 'qcom,kpss-acc-v1' found operations
[    1.399020] sdhci: Secure Digital Host Controller Interface driver
[    1.406088] sdhci: Copyright(c) Pierre Ossman
[    1.412438] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.418750] L2 @ QSB rate. Forcing new rate.
[    1.422605] L2 @ 384000 KHz
[    1.426867] CPU0 @ 800000 KHz
[    1.429362] CPU1 @ QSB rate. Forcing new rate.
[    1.432463] CPU1 @ 384000 KHz
[    1.438413] NET: Registered protocol family 10
[    1.441015] NET: Registered protocol family 17
[    1.444183] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    1.448955] 8021q: 802.1Q VLAN Support v1.8
[    1.461471] Registering SWP/SWPB emulation handler
[    1.467351] cpu: dev_pm_opp_of_cpumask_add_table: couldn't find opp table for cpu:0, -19                                   
[    1.470809] cpu: dev_pm_opp_of_cpumask_add_table: couldn't find opp table for cpu:1, -19                                   
[    1.478748] hctosys: unable to open rtc device (rtc0)
[    1.500100] VFS: Mounted root (squashfs filesystem) readonly on device 31:12.
[    1.500291] Freeing unused kernel memory: 220K (c07b5000 - c07ec000)
[    1.721952] random: nonblocking pool is initialized
[    3.159038] init: Console is alive
[    3.159193] init: - watchdog -
[    5.817096] usbcore: registered new interface driver usbfs
[    5.817169] usbcore: registered new interface driver hub
[    5.821601] usbcore: registered new device driver usb
[    5.833177] of_get_named_gpiod_flags: parsed 'gpios' property of node '/gpio-keys/wifi[0]' - status (0)
[    5.833196] of_get_named_gpiod_flags: parsed 'gpios' property of node '/gpio-keys/reset[0]' - status (0)
[    5.833212] of_get_named_gpiod_flags: parsed 'gpios' property of node '/gpio-keys/wps[0]' - status (0)
[    5.833226] of_get_named_gpiod_flags: parsed 'gpios' property of node '/gpio-keys/ledgeneral[0]' - status (0)
[    5.836013] SCSI subsystem initialized
[    5.838613] libata version 3.00 loaded.
[    5.841673] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    5.842082] ehci-platform: EHCI generic platform driver
[    5.849690] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    5.852644] ohci-platform: OHCI generic platform driver
[    5.960418] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    5.960500] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1
[    5.965044] xhci-hcd xhci-hcd.0.auto: hcc params 0x0228f065 hci version 0x100 quirks 0x00010010
[    5.972524] xhci-hcd xhci-hcd.0.auto: irq 169, io mem 0x11000000
[    5.982324] hub 1-0:1.0: USB hub found
[    5.987360] hub 1-0:1.0: 1 port detected
[    5.991424] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    5.994941] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2
[    6.000557] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    6.008908] hub 2-0:1.0: USB hub found
[    6.016169] hub 2-0:1.0: 1 port detected
[    6.020364] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    6.023779] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 3
[    6.029353] xhci-hcd xhci-hcd.1.auto: hcc params 0x0228f065 hci version 0x100 quirks 0x00010010
[    6.036663] xhci-hcd xhci-hcd.1.auto: irq 170, io mem 0x10000000
[    6.046060] hub 3-0:1.0: USB hub found
[    6.051591] hub 3-0:1.0: 1 port detected
[    6.055264] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    6.059225] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 4
[    6.064542] usb usb4: We don't know the algorithms for LPM for this host, disabling LPM.
[    6.072488] hub 4-0:1.0: USB hub found
[    6.080431] hub 4-0:1.0: 1 port detected
[    6.084672] of_get_named_gpiod_flags: parsed 'gpios' property of node '/gpio-leds/lan[0]' - status (0)
[    6.084759] of_get_named_gpiod_flags: parsed 'gpios' property of node '/gpio-leds/usb4[0]' - status (0)
[    6.084828] of_get_named_gpiod_flags: parsed 'gpios' property of node '/gpio-leds/usb2[0]' - status (0)
[    6.084901] of_get_named_gpiod_flags: parsed 'gpios' property of node '/gpio-leds/wps[0]' - status (0)
[    6.084967] of_get_named_gpiod_flags: parsed 'gpios' property of node '/gpio-leds/wan_red[0]' - status (0)
[    6.085040] of_get_named_gpiod_flags: parsed 'gpios' property of node '/gpio-leds/wan_blue[0]' - status (0)
[    6.085114] of_get_named_gpiod_flags: parsed 'gpios' property of node '/gpio-leds/status[0]' - status (0)
[    6.085185] of_get_named_gpiod_flags: parsed 'gpios' property of node '/gpio-leds/ledgnr[0]' - status (0)
[    6.086497] usbcore: registered new interface driver usb-storage
[    6.091901] init: - preinit -
[    6.584065] usb 4-1: new SuperSpeed USB device number 2 using xhci-hcd
[    6.624781] usb-storage 4-1:1.0: USB Mass Storage device detected
[    6.625194] scsi host0: usb-storage 4-1:1.0
[    7.630325] scsi 0:0:0:0: Direct-Access     Samsung  D3 Station       0202 PQ: 0 ANSI: 6
[    7.632359] sd 0:0:0:0: [sda] 732566645 4096-byte logical blocks: (3.00 TB/2.73 TiB)
[    7.638498] sd 0:0:0:0: [sda] Write Protect is off
[    7.645226] sd 0:0:0:0: [sda] Mode Sense: 2b 00 10 08
[    7.645946] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, supports DPO and FUA
[    7.731446]  sda: sda1 sda2 sda3
[    7.735697] sd 0:0:0:0: [sda] Attached SCSI disk
[    9.403011] ipq806x-gmac-dwmac 37400000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off
[   10.590235] mount_root: loading kmods from internal overlay
[   13.018705] jffs2: notice: (169) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   13.019494] block: attempting to load /tmp/jffs_cfg/upper/etc/config/fstab[   13.161880] EXT4-fs (sda1): recovery complete
[   13.162117] EXT4-fs (sda1): mounted filesystem with ordered data mode. Opts:
[   13.236973] mount_root: switched to extroot
[   13.239794] urandom-seed: Seeding with /etc/urandom.seed
[   13.447740] procd: - early -
[   13.447843] procd: - watchdog -
[   14.116695] procd: - ubus -
[   14.187785] procd: - init -
[   16.111139] tun: Universal TUN/TAP device driver, 1.6
[   16.111163] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[   16.123795] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   16.128483] Netfilter messages via NETLINK v0.30.
[   16.129889] ip_set: protocol 6
[   16.143928] uhci_hcd: USB Universal Host Controller Interface driver
[   16.145178] Loading modules backported from Linux version wt-2016-10-03-1-g6fcb1a6
[   16.149451] Backport generated by backports.git backports-20160324-9-g0e38f5c
[   16.174069] ath10k_pci 0000:01:00.0: enabling device (0140 -> 0142)
[   16.174150] ath10k_pci 0000:01:00.0: enabling bus mastering
[   16.174587] ath10k_pci 0000:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0
[   16.328618] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/pre-cal-pci-0000:01:00.0.bin failed with error -2     
[   16.328676] ath10k_pci 0000:01:00.0: Falling back to user helper
[   17.291933] Adding 131068k swap on /dev/sda2.  Priority:-1 extents:1 across:131068k
[   18.805607] EXT4-fs (sda3): recovery complete
[   18.806953] EXT4-fs (sda3): mounted filesystem with ordered data mode. Opts:
[   38.139856] firmware ath10k!pre-cal-pci-0000:01:00.0.bin: firmware_loading_store: map pages failed                         
[   38.585854] ath10k_pci 0000:01:00.0: qca99x0 hw2.0 target 0x01000000 chip_id 0x003b01ff sub 168c:0002
[   38.585889] ath10k_pci 0000:01:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 1
[   38.595570] ath10k_pci 0000:01:00.0: firmware ver 10.4.1.00030-1 api 5 features no-p2p crc32 d2901e01
[   38.620734] ath10k_pci 0000:01:00.0: failed to fetch board data for bus=pci,vendor=168c,device=0040,subsystem-vendor=168c,subsystem-device=0002 from ath10k/QCA99X0/hw2.0/board-2.bin
[   38.620933] ath10k_pci 0000:01:00.0: board_file api 1 bmi_id N/A crc32 7e56fd07
[   39.810314] ath10k_pci 0000:01:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal file max-sta 512 raw 0 hwcrypto 1
[   39.879084] ath: EEPROM regdomain: 0x0
[   39.879107] ath: EEPROM indicates default country code should be used
[   39.879124] ath: doing EEPROM country->regdmn map search
[   39.879147] ath: country maps to regdmn code: 0x3a
[   39.879166] ath: Country alpha2 being used: US
[   39.879183] ath: Regpair used: 0x3a
[   39.888459] ath10k_pci 0001:01:00.0: enabling device (0140 -> 0142)
[   39.888600] ath10k_pci 0001:01:00.0: enabling bus mastering
[   39.889213] ath10k_pci 0001:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0
[   40.019897] ath10k_pci 0001:01:00.0: Direct firmware load for ath10k/pre-cal-pci-0001:01:00.0.bin failed with error -2     
[   40.019935] ath10k_pci 0001:01:00.0: Falling back to user helper
[   40.179308] firmware ath10k!pre-cal-pci-0001:01:00.0.bin: firmware_loading_store: map pages failed                         
[   40.180405] ath10k_pci 0001:01:00.0: qca99x0 hw2.0 target 0x01000000 chip_id 0x003b01ff sub 168c:0002
[   40.187181] ath10k_pci 0001:01:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 1
[   40.198662] ath10k_pci 0001:01:00.0: firmware ver 10.4.1.00030-1 api 5 features no-p2p crc32 d2901e01
[   40.204988] ath10k_pci 0001:01:00.0: failed to fetch board data for bus=pci,vendor=168c,device=0040,subsystem-vendor=168c,subsystem-device=0002 from ath10k/QCA99X0/hw2.0/board-2.bin
[   40.213971] ath10k_pci 0001:01:00.0: board_file api 1 bmi_id N/A crc32 7e56fd07
[   41.396776] ath10k_pci 0001:01:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal file max-sta 512 raw 0 hwcrypto 1
[   41.459105] ath: EEPROM regdomain: 0x0
[   41.459130] ath: EEPROM indicates default country code should be used
[   41.459146] ath: doing EEPROM country->regdmn map search
[   41.459170] ath: country maps to regdmn code: 0x3a
[   41.459189] ath: Country alpha2 being used: US
[   41.459206] ath: Regpair used: 0x3a
[   41.477707] u32 classifier
[   41.477743]     input device check on
[   41.479449]     Actions configured
[   41.486635] Mirror/redirect action on
[   41.609451] Bridge firewalling registered
[   41.610741] ip_tables: (C) 2000-2006 Netfilter Core Team
[   41.618063] nf_conntrack version 0.5.0 (7511 buckets, 30044 max)
[   41.619261] ctnetlink v0.93: registering with nfnetlink.
[   41.735687] xt_time: kernel timezone is -0000
[   41.743367] PPP generic driver version 2.4.2
[   41.745019] NET: Registered protocol family 24
[   44.572630] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
[   44.580648] device eth1.3 entered promiscuous mode
[   44.580672] device eth1 entered promiscuous mode
[   44.587637] IPv6: ADDRCONF(NETDEV_UP): br-guest: link is not ready
[   44.598071] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   45.274916] ath10k_pci 0001:01:00.0: DFS region 0x0 not supported, will trigger radar for every pulse                      
[   45.274978] ath10k_pci 0000:01:00.0: DFS region 0x0 not supported, will trigger radar for every pulse                      
[   46.558395] ipq806x-gmac-dwmac 37400000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off
[   46.608396] ipq806x-gmac-dwmac 37200000.ethernet eth0: Link is Up - 1Gbps/Full - flow control off
[   47.678453] IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready
[   47.679987] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
[   47.683329] br-lan: port 1(eth1) entered forwarding state
[   47.689560] br-lan: port 1(eth1) entered forwarding state
[   47.707668] device wlan1 entered promiscuous mode
[   47.884924] ath10k_pci 0001:01:00.0: no channel configured; ignoring frame(s)!                                             
[   47.973046] ath10k_pci 0001:01:00.0: no channel configured; ignoring frame(s)!                                             
[   47.977072] ath10k_pci 0001:01:00.0: no channel configured; ignoring frame(s)!                                             
[   48.026495] ath10k_pci 0001:01:00.0: no channel configured; ignoring frame(s)!                                             
[   48.029622] ath10k_pci 0001:01:00.0: no channel configured; ignoring frame(s)!                                             
[   48.144920] ath10k_pci 0001:01:00.0: no channel configured; ignoring frame(s)!                                             
[   48.343589] ath10k_pci 0001:01:00.0: no channel configured; ignoring frame(s)!                                             
[   48.972970] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[   48.973245] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   48.978002] br-guest: port 1(eth1.3) entered forwarding state
[   48.984451] br-guest: port 1(eth1.3) entered forwarding state
[   48.996515] device wlan0 entered promiscuous mode
[   49.010405] IPv6: ADDRCONF(NETDEV_CHANGE): br-guest: link becomes ready
[   49.688348] br-lan: port 1(eth1) entered forwarding state
[   50.978476] br-guest: port 1(eth1.3) entered forwarding state
[   51.223270] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[   51.223438] br-lan: port 2(wlan1) entered forwarding state
[   51.228871] br-lan: port 2(wlan1) entered forwarding state
[   51.238612] device wlan1-1 entered promiscuous mode
[   51.243997] IPv6: ADDRCONF(NETDEV_UP): wlan1-1: link is not ready
[   51.244248] br-guest: port 2(wlan1-1) entered forwarding state
[   51.250609] br-guest: port 2(wlan1-1) entered forwarding state
[   51.353764] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1-1: link becomes ready
[   53.228346] br-lan: port 2(wlan1) entered forwarding state
[   53.248366] br-guest: port 2(wlan1-1) entered forwarding state
[   65.057310] device wlan0 left promiscuous mode
[   65.057569] br-lan: port 3(wlan0) entered disabled state
[   66.515121] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[   66.581804] device wlan0 entered promiscuous mode
root@mulambo:~#

Possible issues.

The 5Ghz is a little bit slow than 2.4Ghz. Exist some options to boost the performance/range?
Some warnings during the wireless driver load.
Can't detect the internal sensors (i2c issue?)?

The sensors output is

root@mulambo:~# sensors 
tsens_tz_sensor0-virtual-0
Adapter: Virtual device
temp1:         +0.1°C  (crit =  +0.1°C)

tsens_tz_sensor1-virtual-0
Adapter: Virtual device
temp1:         +0.1°C  (crit =  +0.1°C)

tsens_tz_sensor2-virtual-0
Adapter: Virtual device
temp1:         +0.1°C  (crit =  +0.1°C)

tsens_tz_sensor3-virtual-0
Adapter: Virtual device
temp1:         +0.1°C  (crit =  +0.1°C)

tsens_tz_sensor4-virtual-0
Adapter: Virtual device
temp1:         +0.1°C  (crit =  +0.1°C)

tsens_tz_sensor5-virtual-0
Adapter: Virtual device
temp1:         +0.1°C  (crit =  +0.1°C)

tsens_tz_sensor6-virtual-0
Adapter: Virtual device
temp1:         +0.1°C  (crit =  +0.1°C)

tsens_tz_sensor7-virtual-0
Adapter: Virtual device
temp1:         +0.1°C  (crit =  +0.1°C)

tsens_tz_sensor8-virtual-0
Adapter: Virtual device
temp1:         +0.1°C  (crit =  +0.1°C)

tsens_tz_sensor9-virtual-0
Adapter: Virtual device
temp1:         +0.1°C  (crit =  +0.1°C)

tsens_tz_sensor10-virtual-0
Adapter: Virtual device
temp1:         +0.1°C  (crit =  +0.1°C)

root@mulambo:~#

Zeraphim · November 23, 2016, 4:27pm

I think thermal sensors for ipq806x is work in progress. Have a look here: Supporting thermal sensors on ipq806x - #29 by dissent1

I got an update on MAC addresses and Wifi. With the hint from from @Heinz to the offset inside the default-mac partition the MACs are now setup correctly. I also changed the MACs of Wifi interfaces accordingly now they come up. So Wifi is now working on VR2600v. Thank you @Heinz

br-lan    Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fdd0:21d6:9315::1/60 Scope:Global
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3632 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3535 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:344277 (336.2 KiB)  TX bytes:1178429 (1.1 MiB)

eth0      Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F7  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f7/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:656 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:218185 (213.0 KiB)
          Interrupt:29 

eth1      Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3728 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3580 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:404578 (395.0 KiB)  TX bytes:1182580 (1.1 MiB)
          Interrupt:30 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:1488 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1488 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:96720 (94.4 KiB)  TX bytes:96720 (94.4 KiB)

wlan0     Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F5  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f5/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:212 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:19823 (19.3 KiB)

wlan1     Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:209 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:19577 (19.1 KiB)

Zeraphim · November 26, 2016, 4:41pm

Now with Ethernet and Wifi running I thought on proceeding on the xDSL part. Therfore I did some investigations. I certainly know now that there is an Ethernet connection between those processors. From the GPL package I got the information that this is GMAC0:

#ifdef CONFIG_TP_IMAGE
		pdata = (struct msm_nss_gmac_platform_data *)nss_gmac_0.dev.platform_data; 
		pdata->phy_mdio_addr = NSS_GMAC_NO_MDIO_PHY; 
		pdata->poll_required = 0; 
		pdata->rgmii_delay = 0; 
		pdata->phy_mii_type = PHY_INTERFACE_MODE_RGMII; 
		pdata->emulation = 0; 
		pdata->forced_speed = SPEED_1000; 
		pdata->forced_duplex = DUPLEX_FULL; 
		pdata->socver = socinfo_get_version();
#endif

I also flashed again the original firmware and did some investigations. On this Ethernet device is setup an VLAN but no IPv4 addresses. Well this would be enough to get PPPoE over this interface. But I still wonder how the processors exchange status information.

For test purposes I tried to activate the GMAC0 interface in the dts:

	gmac0: ethernet@37000000 {
			status = "ok";
			phy-mode = "rgmii";
			qcom,id = <0>;

			mtd-mac-address = <&defaultmac 0>;
			mtd-mac-address-increment = <2>;

			fixed-link {
				speed = <1000>;
				full-duplex;
			};
		};

But the interface will not come up:

[  166.918559] stmmac_hw_setup: DMA engine initialization failed
[  166.918585] stmmac_open: Hw setup failed

I tested the other pin headers on the board and found the one connected to BCM63168 processor. It's the one right next to the USB devices. I was able to create this bootlog which also contains some first tests: http://pastebin.com/qu0xTUQL

Heinz · November 26, 2016, 9:22pm

On Archer D7 connection between the router and modem by eth. all the status data are also in this connection. If I use command: ifconfig ethX down the webinterface lose any data from "modem"
Look here: http://tplink-forum.pl/uploader/uploads/1422556118.png
It looks like "modem" its connected to "router" switch.
http://tplink-forum.pl/index.php?/topic/3026-archer-d7/

I try install openwrt on Archer D7, but it cant run. When I change uboot from C7 then openwrt run, but modem have bootloop.

Did You try check if swconfig see "link" on other ports?
Normaly on C2600 GMAC0 and GMAC6 is connected to switch chip ( port 0 and 6)

Zeraphim · November 27, 2016, 1:40pm

The switch has only 7 ports. Two are connected to the ipq, 4 are for LAN with PHY and there is an additional WAN Ethernet which is the last port on the switch. This is similar to the C2600. The modem processor is connected on GMAC0. This is from the factory ipq firmware:

ath0      Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:2290  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ath5      Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F8  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:2290  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br0       Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:816 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3182 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:59648 (58.2 KiB)  TX bytes:751260 (733.6 KiB)

eth0      Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:816 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12242 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:76190 (74.4 KiB)  TX bytes:3198281 (3.0 MiB)
          Interrupt:2 

eth0.2    Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:816 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3186 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:61502 (60.0 KiB)  TX bytes:796176 (777.5 KiB)

eth0.3    Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3018 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:784335 (765.9 KiB)

eth0.4    Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3017 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:784205 (765.8 KiB)

eth0.5    Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3017 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:784205 (765.8 KiB)

eth1      Link encap:Ethernet  HWaddr 9A:C7:BF:0C:C4:F7  
          inet addr:10.42.21.167  Bcast:10.42.21.255  Mask:255.255.255.0
          inet6 addr: fe80::98c7:bfff:fe0c:c4f7/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1228 errors:0 dropped:0 overruns:0 frame:0
          TX packets:538 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:170409 (166.4 KiB)  TX bytes:45266 (44.2 KiB)
          Interrupt:255 

eth2      Link encap:Ethernet  HWaddr 76:0E:D1:BC:E0:66  
          inet6 addr: fe80::740e:d1ff:febc:e066/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:341 errors:0 dropped:0 overruns:0 frame:0
          TX packets:51 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:53078 (51.8 KiB)  TX bytes:6484 (6.3 KiB)
          Interrupt:252 

eth2.1    Link encap:Ethernet  HWaddr 76:0E:D1:BC:E0:66  
          inet6 addr: fe80::740e:d1ff:febc:e066/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:341 errors:0 dropped:301 overruns:0 frame:0
          TX packets:47 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:46940 (45.8 KiB)  TX bytes:5888 (5.7 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:18 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:4961 (4.8 KiB)  TX bytes:4961 (4.8 KiB)

wifi0     Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:539 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:68 Memory:e1800000-e1a00000 

wifi1     Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F8  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:539 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:90 Memory:e1c00000-e1e00000

Sadly my tests did not bring up the Ethernet interface yet. In the factory image they are doing some stuff on the Ethernet controller's registers while bringing up the interface in /etc/init.d/rcS:

# for dsl remote
ifconfig eth2 up
devmem2 0x00801020 w 0x1C0
#devmem2 0x00801420 w 0x1C1
devmem2 0x00801420 w 0x3C3
vconfig add eth2 1
ifconfig eth2.1 up
# end

On the BCM63168 there is a process named msgapp which could do the communication. But it's clearly not doing it over IPv4 as there are no addresses setup. So the communication is either via IPv6 or some other protocol.

Did you try to flash the modem processor or just the main processor?

bjo · January 12, 2017, 1:37pm

BTW, is the VR600v the small brother of the VR2600v? Is has also the BCM63168.

por · April 15, 2017, 8:51pm

Would anyone know whether the sysupgrade image for the vr2600v can be installed on a vr2600 (so without the "voice" stuff) ?

por · April 15, 2017, 8:55pm

Another question:
Would the u-boot TFTP recovery procedure boot an initramfs image ?
If so, that would allow a sysupgrade from there end opening the case and soldering a serial header could be skipped.

Zeraphim · April 17, 2017, 12:26pm

The VR600v uses only the BCM63168 as far as I know. The VR2600v has an ipq806x as main processor and an BCM63168 as co procesor to do the xDSL stuff.

It might be possible. Can you post a photo of the PCB? Maybe than we can say more. They might have just not assembled the DSP for DECT and POTS.

I have not tested that. Might be possible. If I find time I will have a look into it.

Keep in mind that the VR2600v image provided only Ethernet and Wifi. The xDSL is still not working as I did not manage to get the Ethernet device between the two processors up.

por · April 17, 2017, 12:55pm

Came to realize that the xDSL is still unsupported after I ordered the vr2600; which is a mistake since it would replace a modem/router at a customers site. I will try to deploy it first as kind of C2600 in combination with the old modem set to bridge mode - or run it with the stock firmware, though that would leave me with other problems (VLAN etc.) . Once xDSL works the old modem can be dropped. Before deployment I'll try to run some tests, but first the vr2600 has to arrive.

jpereira · April 24, 2017, 8:03pm

Somebody knows if the latest release LEDE v17.01.1 contemplates the stability with Acher C2600 v1.1? somebody did some tests?

nebkas · June 21, 2017, 9:13pm

Any news here ?

nebkas · June 23, 2017, 12:41pm

@Zeraphim

I'm a bit new to TP Link, but have experience with AVM devices, Banana Pi R1 etc. Please could you or someone else post a picture from the jp2 solder pins. I dont have a multimeter right now by my hand. I would look forwart to contribute to this device

nebkas · June 23, 2017, 6:00pm

It's me again I got it and made a picture.

But now I'm in trouble. I can get the Lede image via 'tftpboot lede-17.01.2-ipq806x-VR2600v-squashfs-sysupgrade.bin' to my device, but I dont know how to write this into nand? could somebody help me out?

Zeraphim · July 11, 2017, 11:47pm

Hi nebkas,

Sorry for not seeing your post sooner. You did find the right connector. You should see there the output of the serial console. Interrupt the bootloader by pressing any key. It should look like this:

U-Boot 2012.07 [Standard IPQ806X.LN,r40858] (Dec 08 2015 - 15:14:35)

smem ram ptable found: ver: 0 len: 5
DRAM:  491 MiB
NAND:  ipq_nand: unknown NAND device manufacturer: 0 device: 0
ipq_nand: failed to identify device
SF: we have a match, call probe
SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x1000000
16 MiB
MMC:   
*** Warning - bad CRC, using default environment

PCI0 Link Intialized
PCI1 Link Intialized
In:    serial
Out:   serial
Err:   serial
Net:   No ART partition found
MAC1 addr:0:3:7f:ba:db:1
S17c athrs17_init_switch  done.
WJL: athrs17_reg_init() reg-0x30=0x80000700.1.
WJL: athrs17_reg_init() reg-0x30=0x80000401.2.
WJL: athrs17_reg_init: PAD config after SOFT_RESET. 
WJL: athrs17_reg_init: 0x0000007c=0x00001080.1.
WJL: athrs17_reg_init: 0x00000094=0x00001080.2.
athrs17_reg_init: complete
S17c init done (WJL-07-10-1829, uboot task - internal loopback)
MAC2 addr:0:3:7f:ba:db:2
eth0
Warning: eth0 MAC addresses don't match:
Address in SROM is         00:03:7f:ba:db:01
Address in environment is  00:aa:bb:cc:dd:ee
, eth1
Hit any key to stop autoboot:  0 
athrs17_vlan_config ...done
(IPQ) #

What you need in in order to flash the box is a TFTP server. Connect it somehow to one of the Ethernet ports of the box and copy the sysupgrade image to it. I renamed the file to just sysupgrade.bin on my server for easier typing.

First thing you have to do is setup the ip address of the box and the TFTP server. Also disabling autoboot and probing for the serial flash. This will enable you to write to the flash:

(IPQ) # setenv ipaddr 10.42.21.50
(IPQ) # setenv serverip 10.42.21.200
(IPQ) # setenv autoboot false
(IPQ) # sf probe

The ping command is available in the bootloader. You could check the connection to your server before proceeding. What has to be done now is transfer the image from the TFTP server to the RAM and then writing it to the flash. Careful here. Any badly written value can brick your box! Note that the erase command will take some time to finish.

(IPQ) # tftpboot 0x44000000 sysupgrade.bin
Using eth0 device
TFTP from server 10.42.21.200; our IP address is 10.42.21.50
Filename 'sysupgrade.bin'.
Load address: 0x44000000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ###############
done
Bytes transferred = 4980906 (4c00aa hex)
(IPQ) # sf erase 0x320000 0xc60000
(IPQ) # sf write 0x44000000 0x320000 0x4c00aa

Note that I used the same amount of data that was read from TFTP to write it to the flash (0x4c00aa). You should do the same. Reboot the box and enjoy LEDE.

Once you have booted LEDE you can just use the sysupgrade command for further flashing.

philjohn · July 29, 2017, 3:13pm

Looking through the GPL dump for the VR900, msgapp is an elf binary in the tar file, running strings on in gives some interesting things: https://pastebin.com/rNbPvJYv