Add OpenWrt support for Xiaomi "Redmi AX6000"

Yes. Also with this https://git01.mediatek.com/plugins/gitiles/openwrt/feeds/mtk-openwrt-feeds/+/125799ceb1d0bfeaef953c03652f9547c7e9efe6/target/linux/mediatek/files-5.4/arch/arm64/boot/dts/mediatek/mt7986b-spim-nand-rfb.dts

Yep we have wlan0 and wlan1 now :slight_smile: They're not pulling the right MAC addresses yet (neither are ethernet interfaces, but that's a later thing)

2 Likes

The mac address is generated by mt76 reading the eeprom from the factory partition. If the mac address is wrong, it may be because the correct eeprom is not read. So is the wireless signal strength normal? Can you upload kernel log and the contents of your factory partition?

I prefer to keep the identifying data the private but here's the boot log:

## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.64
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000e8
     Data Size:    3943889 Bytes = 3.8 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   d3f2f082
     Hash algo:    sha1
     Hash value:   54f24adec166feaa6b1d6d3b85c369abb34ae984
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'initrd-1' ramdisk subimage
     Description:  ARM64 OpenWrt xiaomi_redmi-router-ax6000 initrd
     Type:         RAMDisk Image
     Compression:  Unknown Compression
     Data Start:   0x463c3000
     Data Size:    4152464 Bytes = 4 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: unavailable
     Entry Point:  unavailable
     Hash algo:    crc32
     Hash value:   236ad2ce
     Hash algo:    sha1
     Hash value:   4f2d9a1f793decd46588c5cceb3c5ff772fc9c35
   Verifying Hash Integrity ... crc32+ sha1+ OK
WARNING: 'compression' nodes for ramdisks are deprecated, please fix your .its file!
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt xiaomi_redmi-router-ax6000 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x467b8da8
     Data Size:    32768 Bytes = 32 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   a60440fd
     Hash algo:    sha1
     Hash value:   f638eac552d7e732fd0644cf095c530c5d27d492
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x467b8da8
   Uncompressing Kernel Image
   Loading Ramdisk to 5f405000, end 5f7fac90 ... OK
   Loading Device Tree to 000000005f3fa000, end 000000005f404fff ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.64 (alamarche@dev) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r20543-f8db464701) 11.3.0,2
[    0.000000] Machine model: Xiaomi Redmi Router AX6000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x000000004fbfffff]
[    0.000000]   node   0: [mem 0x000000004fc00000-0x000000004fcfffff]
[    0.000000]   node   0: [mem 0x000000004fd00000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] percpu: Embedded 17 pages/cpu s29592 r8192 d31848 u69632
[    0.000000] pcpu-alloc: s29592 r8192 d31848 u69632 alloc=17*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 129024
[    0.000000] Kernel command line: console=ttyS0,115200n1 loglevel=8 firmware=0 uart_en=1
[    0.000000] Unknown kernel command line parameters "firmware=0 uart_en=1", will be passed to user space.
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 496372K/524288K available (8256K kernel code, 882K rwdata, 2220K rodata, 448K init, 293K bss, 27916K reserve)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] GICv3: Distributor has no Range Selector support
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv3: 16 PPIs implemented
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000001] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.000098] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[    0.000105] pid_max: default: 32768 minimum: 301
[    0.000183] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.000191] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.001027] rcu: Hierarchical SRCU implementation.
[    0.001109] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.001265] smp: Bringing up secondary CPUs ...
[    0.001507] Detected VIPT I-cache on CPU1
[    0.001530] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.001557] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.001815] Detected VIPT I-cache on CPU2
[    0.001827] GICv3: CPU2: found redistributor 2 region 0:0x000000000c0c0000
[    0.001838] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.002063] Detected VIPT I-cache on CPU3
[    0.002074] GICv3: CPU3: found redistributor 3 region 0:0x000000000c0e0000
[    0.002083] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.002108] smp: Brought up 1 node, 4 CPUs
[    0.002123] SMP: Total of 4 processors activated.
[    0.002127] CPU features: detected: 32-bit EL0 Support
[    0.002130] CPU features: detected: CRC32 instructions
[    0.002205] CPU: All CPU(s) started at EL2
[    0.002215] alternatives: patching kernel code
[    0.003757] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.003776] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.003888] pinctrl core: initialized pinctrl subsystem
[    0.004332] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.004545] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.004568] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.004588] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.004807] thermal_sys: Registered thermal governor 'fair_share'
[    0.004810] thermal_sys: Registered thermal governor 'bang_bang'
[    0.004813] thermal_sys: Registered thermal governor 'step_wise'
[    0.004816] thermal_sys: Registered thermal governor 'user_space'
[    0.004895] ASID allocator initialised with 65536 entries
[    0.005239] pstore: Registered ramoops as persistent store backend
[    0.005243] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.011190] cryptd: max_cpu_qlen set to 1000
[    0.012538] SCSI subsystem initialized
[    0.012613] libata version 3.00 loaded.
[    0.012693] usbcore: registered new interface driver usbfs
[    0.012713] usbcore: registered new interface driver hub
[    0.012730] usbcore: registered new device driver usb
[    0.013297] clocksource: Switched to clocksource arch_sys_counter
[    0.013633] NET: Registered PF_INET protocol family
[    0.013707] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.013961] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.013973] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.013980] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.014002] TCP bind hash table entries: 4096 (order: 4, 65536 bytes, linear)
[    0.014045] TCP: Hash tables configured (established 4096 bind 4096)
[    0.014093] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.014105] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.014185] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.014204] PCI: CLS 0 bytes, default 64
[    0.014311] Unpacking initramfs...
[    0.025183] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    0.027141] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.027153] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.050157] mtk-pcie-gen3 11280000.pcie: host bridge /soc/pcie@11280000 ranges:
[    0.050183] mtk-pcie-gen3 11280000.pcie: Parsing ranges property...
[    0.050192] mtk-pcie-gen3 11280000.pcie:      MEM 0x0020000000..0x002fffffff -> 0x0020000000
[    0.050267] /soc/pcie@11280000: Failed to get clk index: 0 ret: -517
[    0.050277] mtk-pcie-gen3 11280000.pcie: failed to get clocks
[    0.052185] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    0.052710] printk: console [ttyS0] disabled
[    0.072896] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 121, base_baud = 2500000) is a ST16650V2
[    0.770081] printk: console [ttyS0] enabled
[    0.774896] mtk_rng 1020f000.trng: registered RNG driver
[    0.774954] hwrng: no data available
[    0.780531] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.792332] loop: module loaded
[    0.795523] Freeing initrd memory: 4052K
[    0.808940] mtk_soc_eth 15100000.ethernet: generated random MAC address 1e:f2:6a:44:8d:90
[    0.817380] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc00d580000, irq 123
[    0.826865] i2c_dev: i2c /dev entries driver
[    0.831438] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    0.839704] NET: Registered PF_INET6 protocol family
[    0.845259] Segment Routing with IPv6
[    0.848929] In-situ OAM (IOAM) with IPv6
[    0.852861] NET: Registered PF_PACKET protocol family
[    0.857995] 8021q: 802.1Q VLAN Support v1.8
[    0.862932] pstore: Using crash dump compression: deflate
[    0.872698] mtk-pcie-gen3 11280000.pcie: host bridge /soc/pcie@11280000 ranges:
[    0.880035] mtk-pcie-gen3 11280000.pcie: Parsing ranges property...
[    0.886301] mtk-pcie-gen3 11280000.pcie:      MEM 0x0020000000..0x002fffffff -> 0x0020000000
[    1.113304] mtk-pcie-gen3 11280000.pcie: PCIe link down, ltssm reg val: 0x1000001
[    1.120792] mtk-pcie-gen3: probe of 11280000.pcie failed with error -110
[    1.179688] mt7530 mdio-bus:1f: configuring for fixed/2500base-x link mode
[    1.187019] mt7530 mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    1.196618] mt7530 mdio-bus:1f wan (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=131)
[    1.216366] mt7530 mdio-bus:1f lan1 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=132)
[    1.235912] mt7530 mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=133)
[    1.255441] mt7530 mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7531 PHY] (irq=134)
[    1.266245] DSA: tree 0 setup
[    1.270137] Freeing unused kernel memory: 448K
[    1.363377] Run /init as init process
[    1.367025]   with arguments:
[    1.369976]     /init
[    1.372233]   with environment:
[    1.375365]     HOME=/
[    1.377710]     TERM=linux
[    1.380401]     firmware=0
[    1.383091]     uart_en=1
[    1.480050] init: Console is alive
[    1.483548] init: - watchdog -
[    1.489593] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.497527] gpio-keys: probe of keys failed with error -2
[    1.503472] leds-gpio: probe of leds failed with error -2
[    1.509072] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    1.517110] init: - preinit -
[    1.551331] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[    1.559791] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    1.565318] mt7530 mdio-bus:1f lan1: configuring for phy/gmii link mode
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    3.608796] procd: - early -
[    3.611715] procd: - watchdog -
[    4.122250] procd: - watchdog -
[    4.125605] procd: - ubus -
[    4.130298] random: ubusd: uninitialized urandom read (4 bytes read)
[    4.177969] random: ubusd: uninitialized urandom read (4 bytes read)
[    4.184416] random: ubusd: uninitialized urandom read (4 bytes read)
[    4.191380] procd: - init -
Please press Enter to activate this console.
[    4.262036] urngd: v1.0.2 started.
[    4.278674] kmodloader: loading kernel modules from /etc/modules.d/*
[    4.280523] random: crng init done
[    4.288559] random: 22 urandom warning(s) missed due to ratelimiting
[    4.298171] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
[    4.311890] Loading modules backported from Linux version v5.15.58-0-g7d8048d4e064
[    4.319477] Backport generated by backports.git v5.15.58-1-0-g42a95ce7
[    4.675681] mt7986-wmac 18000000.wmac: HW/SW Version: 0x8a108a10, Build Time: 20220113162543a
[    4.675681] 
[    4.694207] mt7986-wmac 18000000.wmac: WM Firmware Version: ____000000, Build Time: 20220113162641
[    4.732633] mt7986-wmac 18000000.wmac: WA Firmware Version: DEV_000000, Build Time: 20220113163034
[    4.876917] mt7986-wmac 18000000.wmac: eeprom load fail, use default bin
[    8.667796] PPP generic driver version 2.4.2
[    8.672641] NET: Registered PF_PPPOX protocol family
[    8.679862] kmodloader: done loading kernel modules from /etc/modules.d/*
[   10.540242] mtk_soc_eth 15100000.ethernet eth0: Link is Down
[   10.548788] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[   10.557239] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[   10.558311] mt7530 mdio-bus:1f lan1: configuring for phy/gmii link mode
[   10.573114] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   10.579528] br-lan: port 1(lan1) entered blocking state
[   10.584748] br-lan: port 1(lan1) entered disabled state
[   10.591368] device lan1 entered promiscuous mode
[   10.596032] device eth0 entered promiscuous mode
[   10.608381] mt7530 mdio-bus:1f lan2: configuring for phy/gmii link mode
[   10.618056] br-lan: port 2(lan2) entered blocking state
[   10.619767] mt7530 mdio-bus:1f lan2: Link is Up - 1Gbps/Full - flow control rx/tx
[   10.623314] br-lan: port 2(lan2) entered disabled state
[   10.637723] device lan2 entered promiscuous mode
[   10.644583] br-lan: port 2(lan2) entered blocking state
[   10.649818] br-lan: port 2(lan2) entered forwarding state
[   10.656098] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   10.665117] mt7530 mdio-bus:1f lan3: configuring for phy/gmii link mode
[   10.674565] br-lan: port 3(lan3) entered blocking state
[   10.679784] br-lan: port 3(lan3) entered disabled state
[   10.686855] device lan3 entered promiscuous mode
[   10.703255] mt7530 mdio-bus:1f wan: configuring for phy/gmii link mode
^[


BusyBox v1.35.0 (2022-09-09 05:05:46 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r20543-f8db464701
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# 

I suspect this is our clue:

[    4.675681] mt7986-wmac 18000000.wmac: HW/SW Version: 0x8a108a10, Build Time: 20220113162543a
[    4.675681] 
[    4.694207] mt7986-wmac 18000000.wmac: WM Firmware Version: ____000000, Build Time: 20220113162641
[    4.732633] mt7986-wmac 18000000.wmac: WA Firmware Version: DEV_000000, Build Time: 20220113163034
[    4.876917] mt7986-wmac 18000000.wmac: eeprom load fail, use default bin

Factory partition on this device is at 0x180000 and is very similar to the Redmi AX6S (see the dts here).

Factory: 0x180000
WLAN0 (2.4G): 0x180004
WLAN1 (5G): 0x180010
ETH0 (LAN) is WLAN0 MAC - 1 (not in factory partition)
ETH1 (WAN) is only in Bdata partition.

2 Likes

I would like to ask what does 0x180004 represent? Is this where your 2.4G MAC address is stored?
In addition, for the location of 0x180000 at the beginning of the factory partition, is the stored data 0x8679?

1 Like

Yes, 0x180000 is the beginning of the factory partition. 0x8679 are the first 2 bytes. at 0x180004-0x180009 is the wlan0 MAC address. 0x180010-0x180015 is wlan1.

Looks like the nand (nmbm) device is not working, doesn't show up in the boot log. See OpenWrt support for Asus RT-AX53U - #155 by gabest11 for reference, but I think something from the nand node in the ax6000 dts is missing.

1 Like

So the problem is that the nand driver does not work properly, resulting in the mt76 driver unable to read the eeprom information. I'll take a look at the nand part of the dts again.

2 Likes

Here's some quick benchmarks from an M2 MacBook Air (notice the severe 802.11ax low speed issue does not appear to be present here!). This is with a -82 RSSI, so far from perfect conditions. Channel 36 160MHz (not that the MacBook can use anything over 80 anyways...).

Sending:

[SUM]   0.00-10.00  sec   373 MBytes   313 Mbits/sec                  sender
[SUM]   0.00-10.02  sec   368 MBytes   308 Mbits/sec                  receiver

Receiving:

[SUM]   0.00-10.00  sec   455 MBytes   381 Mbits/sec    0             sender
[SUM]   0.00-10.00  sec   441 MBytes   370 Mbits/sec                  receiver

I also fixed the ethernet ports in the DTS -- they should be correct now, granted the physical device has wan labeled as port 1, then lan1-3 labeled as 2, 3, 4. Is there a preferred label for this? Should OpenWrt match exactly the physical device? Should it start at 0 instead of 1?

I will say however that it seems 802.11ac on 5GHz on the RT3200 and 802.11n on 2.4GHz performance on the RT3200 still seems better than 802.11ax performance on both bands on the AX6000.

1 Like

mt76 can't read eeprom now, so it can't get the correct wireless calibration information. If the mt76 can read the eeprom, the wireless performance will be much improved.
From my previous experience, reading the eeprom correctly has a big impact on wireless performance.

3 Likes

Good point. I'll head out for now and see if you come back with anything about reading eeprom. Goodnight and I (we) appreciate your contributions!

1 Like

aiamadeus compled the relevant adaptation, you can test the eeprom read and mac address.

7 Likes

I went ahead and installed this, everything but the LED bar seems to be working perfectly! Speeds are fantastic! I don't have a fast enough internet link to see how well SQM+Cake is on here, but at 100mbit it doesn't even break a sweat. I suspect this might get very close to gigabit, especially since my RT3200 with 2 cores @1.35Ghz could do ~4-500 and this is 4 cores@2GHz.

How about wifi speed after the eeprom was reading correctly? Could you please compare it with AC3200 AC mode again?I hope the performance of MT7986 open source driver can reach the level of proprietary driver.

Yes here's my findings. I'll compare them to my RT3200 again.

AX6000 5GHz, 80MHz channels: Performance on Apple devices is horrible (6-12mbps at -68 RSSI, one wall between device and AP). Other devices speeds are great, mostly 600-700mbps, even had a RT3200 hit over 1gbps.

AX6000 5GHz, 160MHz channels: Performance on Apple devices appears normal, 200-300mbps iperf3 tests. 160MHz does appear to nerf my other E8450 in Client WDS mode (stuck at ~144mbps, almost like it locks to 802.11n).

This also doesn't make sense because Apple devices don't support 160MHz so I don't really understand how the channel bandwidth "fixes" that part. I tested both channel 36 and 161 in 80MHz channel width, both tests showed 6-12mbps on Apple devices so channel is likely ruled out. I'll reiterate this part as I mentioned in the other thread, seems like Apple devices get stuck in low power mode when their RSSI goes past RSSI somewhere past -60 ish.

Thanks for your test. What is the speed and mcs information displayed in the openwrt wireless overview when the apple device is at an abnormally low speed?

Idle (80MHz):

6.0 Mbit/s, 20 MHz
432.3 Mbit/s, 80 MHz, HE-MCS 4, HE-NSS 2

Active (running iperf3, 80MHz):

36.0 Mbit/s, 80 MHz, HE-MCS 0, HE-NSS 1
864.8 Mbit/s, 80 MHz, HE-MCS 8, HE-NSS 2

When in 160MHz mode and the Apple device is idle, tx rate drops to 6.0mbit/s. When device is active, speeds pick up to several hundred mbps. In 80MHz mode, idle has tx at 6mbit/s as well. When active, tx stays between 6.0mbit/s or up to 36mbit/s.

It looks like the problem may be caused by hibernation. Have you ever tried closing TWT?

This is the relevant commit. https://github.com/openwrt/mt76/commit/2f9555a2f18f5d6775e08cd739631a5096a8a472

I don't see anything related to TWT in my hostapd run file, so it shouldn't even be enabled, no?

Sorry I don't understand the configuration options of the mac80211 wireless driver. But I saw mtk's patch for TWT in mtk sdk.

https://git01.mediatek.com/plugins/gitiles/openwrt/feeds/mtk-openwrt-feeds/+/e0cbe33aa0eb3941f1ed265382efb232bc64c98b/autobuild_mac80211_release/package/kernel/mac80211/patches/subsys/901-mac80211-check-twt-responder-when-setu-twt.patch

Looks like my board fried itself. had it running all day, went to reboot, didn't come back up. stuck in u-boot and the console is all garbage, can't tftpboot, networking is broken. Uh oh.