Apparently, a non-release channel build has leaked again.
miwifi_rb06_firmware_stable_1.2.2(1).bin 5b4cbb33ai5483c035abe1c0857108c8
Looks like it's fresh out of their build system as well. Sat, 11 Jun 2022 05:09:35 +0000
I guess they weren't seeing the sales numbers they wanted to see (sarcasm)
Edit: Users allege that it does not enable telnet anyway so, meh.
Quad-core 2.0Ghz SoC is really nice. Sadly no USB port is available which highly limits its capability
I bought one and it's available here. Where to start? Expecting an alpha binary soon for this...
You could start by connecting UART, getting boot logs, seeing if the console is password protected, and whatever else you can find.
Seems mine got lost in customs. Been stuck for over a week.
Please DO NOT post the link to the Xiaomi AX6000's tool in the Redmi AX6000's post.
Bootlog here in 2 parts:
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 022F [010F]
Jump to BL
NOTICE: BL2: v2.6(release):2598dbc2a6-dirty
NOTICE: BL2: Built : 13:34:54, Mar 12 2022
INFO: BL2: Doing platform setup
NOTICE: WDT: disabled
NOTICE: CPU: MT7986 (2000MHz)
NOTICE: EMI: Using DDR4 settings
before ctrl3 = 0x0
clear request & ack
after ctrl3 = 0x0
DVFSRC_SUCCESS 0
dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a083f1 000003ff 00100000 00000000
1001d040 | 00000000 00000000 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0x8
toprgu: 80 = 0x0
[DDR Reserve] ddr reserve mode not be enabled yet
Save DRM_DEBUG_CTL(0xa083f1)
DRM_LATCH_CTL : 0x27e71
DRM_LATCH_CTL2: 0x200a0
drm_update_reg: 1, bits: 0x8000, addr: 0x1001d030, val: 0xa083f1
drm_update_reg: 0, bits: 0x80000, addr: 0x1001d030, val: 0xa083f1
drm_update_reg: 0, bits: 0x200, addr: 0x1001d034, val: 0x1ff
drm_update_reg: 0, bits: 0x200000, addr: 0x1001d034, val: 0x1ff
drm_update_reg: 0, bits: 0x100, addr: 0x1001d034, val: 0xff
MTK_DRM_DEBUG_CTL : 0xa083f1
MTK_DRM_DEBUG_CTL2: 0xff
drm_update_reg: 0, bits: 0x4000, addr: 0x1001d030, val: 0xa083f1
DRM DDR reserve mode FAIL! a083f1
DDR RESERVE Success 0
drm_update_reg: 0, bits: 0x2000, addr: 0x1001d030, val: 0xa083f1
drm_update_reg: 0, bits: 0x1000, addr: 0x1001d030, val: 0xa083f1
[DRAM] into mt_set_emi
[EMI] ComboMCP not ready, using default setting
Init_DRAM:2139: init PCDDR4 dram Start
[MD32_INIT] in c code >>>>>>
[MD32_INIT] 3
[MD32_INIT] 4
[MD32_INIT] 5
[MD32_INIT] 6
[MD32_INIT] V22 add 1
[MD32_INIT] V22 add 1 end
[MD32_INIT] 7
[MD32_INIT] 8
[MD32_INIT] 9
[MD32_INIT] 10
[MD32_INIT] 11
[MD32_INIT] 12
[MD32_INIT] 13
[MD32_INIT] 14
[MD32_INIT] 15
[MD32_INIT] 16
[MD32_INIT] 17
[MD32_INIT] 18
[MD32_INIT] 19
[MD32_INIT] 20
[MD32_INIT] 21
[MD32_INIT] 22
[MD32_INIT] 23
[MD32_INIT] 28
[MD32_INIT] 29
[MD32_INIT] 30 for RTMRW, if have
[MD32_INIT] in c code <<<<<<
[Set_DRAM_Pinmux_Sel] DRAMPinmux = 0
[Bian_co] ETT version 0.0.0.1
dram_type 4, R0 cbt_mode 0, R1 cbt_mode 0 VENDOR=136
Read voltage for 1600, 0
Vio18 = 0
Vcore = 0
Vdram = 0
Vddq = 0
Vmddr = 0
== DRAMC_CTX_T ==
support_channel_num: 1
channel: 0
support_rank_num: 1
rank: 0
freq_sel: 22
shu_type: 0
dram_type: 4
dram_fsp: 0
odt_onoff: 1
DBI_R_onoff: 0, 0
DBI_W_onoff: 0, 0
data_width: 16
test2_1: 0x55000000
test2_2: 0xaa000100
frequency: 1600
freqGroup: 1600
u1PLLMode: 0
dram type 6
===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
OCD DRVP=0 ,CALOUT=0
OCD DRVP=1 ,CALOUT=0
OCD DRVP=2 ,CALOUT=0
OCD DRVP=3 ,CALOUT=0
OCD DRVP=4 ,CALOUT=0
OCD DRVP=5 ,CALOUT=0
OCD DRVP=6 ,CALOUT=0
OCD DRVP=7 ,CALOUT=0
OCD DRVP=8 ,CALOUT=0
OCD DRVP=9 ,CALOUT=1
OCD DRVP calibration OK! DRVP=9
OCD DRVN=0 ,CALOUT=1
OCD DRVN=1 ,CALOUT=1
OCD DRVN=2 ,CALOUT=1
OCD DRVN=3 ,CALOUT=1
OCD DRVN=4 ,CALOUT=1
OCD DRVN=5 ,CALOUT=1
OCD DRVN=6 ,CALOUT=0
OCD DRVN calibration OK! DRVN=6
[SwImpedanceCal] DRVP=9, DRVN=6
freq_region=0, Reg: DRVP=11, DRVN=8, ODTP=6
MEM_TYPE=6, freq_sel=22
[ModeRegister CWL Config] data_rate:3200-MR_CWL:[ModeRegister CL Config] data_rate:3200-MR_CL:[ModeRegister WR Config] data_rate:3200-MR_WR:===================================
PCDDR4 DRAM CONFIGURATION
===================================
CWL = 0x7
RTT_NORM = 0x6
CL = 0xb
AL = 0x0
BL = 0x0
RBT = 0x0
WR = 0x8
===================================
===================================
ANA top config
===================================
ASYNC_MODE = 3
DLL_ASYNC_EN = 1
ALL_SLAVE_EN = 0
NEW_RANK_MODE = 0
DLL_IDLE_MODE = 1
LP45_APHY_COMB_EN = 1
TX_ODT_DIS = 0
NEW_8X_MODE = 0
===================================
===================================
data_rate = 3200
CKR = 1
DQ_P2S_RATIO = 8
===================================
CA_P2S_RATIO = 8
DQ_CA_OPEN = 0
DQ_SEMI_OPEN = 0
CA_SEMI_OPEN = 0
CA_FULL_RATE = 0
DQ_CKDIV4_EN = 0
CA_CKDIV4_EN = 0
CA_PREDIV_EN = 0
PH8_DLY = 31
SEMI_OPEN_CA_PICK_MCK_RATIO= 0
DQ_AAMCK_DIV = 4
CA_AAMCK_DIV = 4
CA_ADMCK_DIV = 4
DQ_TRACK_CA_EN = 0
CA_PICK = 1600
CA_MCKIO = 1600
MCKIO_SEMI = 0
PLL_FREQ = 3200
DQ_UI_PI_RATIO = 32
CA_UI_PI_RATIO = 0
===================================
===================================
memory_type:PCDDR4
GP_NUM : 1
SRAM_EN : 1
MD32_EN : 0
===================================
===========================================
HW_ZQCAL_config
===========================================
ZQCALL is 0
TZQLAT is 27
ZQCSDUAL is 0
ZQCSCNT is 511
===========================================
[ANA_INIT] >>>>>>>>>>>>>>
[ANA_ClockOff_Sequence] flow start
WLY_DEBUG::ANA_ClockOff_Sequence delay 100ns start
WLY_DEBUG::ANA_ClockOff_Sequence delay 100ns end
[ANA_ClockOff_Sequence] flow end
============ PULL DRAM RESETB DOWN ============
========== PULL DRAM RESETB DOWN end =========
============ SUSPEND_ON ============
============ SUSPEND_ON end ============
============ SPM_control ============
============ SPM_control end ============
<<<<<< [CONFIGURE PHASE]: ANA_TX
>>>>>> [CONFIGURE PHASE][SHUFFLE]: PLL
===================================
data_rate = 3200,PCW = 0X7800
===================================
<<<<<< [CONFIGURE PHASE][SHUFFLE]: PLL
INFO: RG_ARDQ_REV_B0_TEMP_VALUE= 0x0
INFO: RG_ARDQ_REV_B0_TEMP_VALUE= 0x0
INFO: RG_ARDQ_REV_B1_TEMP_VALUE= 0x0
INFO: RG_ARDQ_REV_B1_TEMP_VALUE= 0x0
INFO: RG_ARDQ_REV_B2_TEMP_VALUE= 0x0
INFO: RG_ARDQ_REV_B1_TEMP_VALUE= 0x0
INFO: RG_ARCMD_REV_TEMP_VALUE= 0x0
INFO: RG_ARCMD_REV_TEMP_VALUE= 0x60
>>>>>> [CONFIGURE PHASE][SHUFFLE]: ANA CLOCK DIV configuration
INFO: RG_ARDQ_REV_B0_TEMP_VALUE= 0x0
INFO: RG_ARDQ_REV_B0_TEMP_VALUE= 0x0 PH8_DLY= 0x1f
INFO: RG_ARDQ_REV_B1_TEMP_VALUE= 0x0
INFO: RG_ARDQ_REV_B1_TEMP_VALUE= 0x0 PH8_DLY= 0x1f
INFO: RG_ARDQ_REV_B2_TEMP_VALUE= 0x0
INFO: RG_ARDQ_REV_B2_TEMP_VALUE= 0x0 PH8_DLY= 0x1f
INFO: RG_ARCMD_REV_TEMP_VALUE= 0x60
INFO: RG_ARCMD_REV_TEMP_VALUE= 0x60 PH8_DLY= 0x1f
<<<<<< [CONFIGURE PHASE][SHUFFLE]: ANA CLOCK DIV configuration
>>>>>> [CONFIGURE PHASE][SHUFFLE]: DLL
INFO: RG_ARCMD_REV_TEMP_VALUE= 0x60
INFO: RG_ARCMD_REV_TEMP_VALUE= 0x61
<<<<<< [CONFIGURE PHASE][SHUFFLE]: DLL
[ANA_INIT] flow start
[ANA_INIT] PLL >>>>>>>>
[ANA_INIT] PLL <<<<<<<<
[ANA_INIT] MIDPI >>>>>>>>
[ANA_INIT] MIDPI <<<<<<<<
[ANA_INIT] DLL >>>>>>>>
[ANA_INIT] DLL <<<<<<<<
[ANA_INIT] flow end
[ANA_INIT] <<<<<<<<<<<<<
[Flow] [DDRPHY] DIG_CONFIG_NONSHUF_DCM <<<<<
[Flow] [DDRPHY] DIG_CONFIG_NONSHUF_DCM <<<<<
[Flow] Enable top DCM control >>>>>
[Flow] Enable top DCM control <<<<<
Enable DLL master slave shuffle
==============================================================
Gating Mode config
==============================================================
Config description:
RX_GATING_MODE 0: Pulse Mode 1: Burst Mode(8UI) 2: Burst Mode(7UI) 3: Original Burst Mode
RX_GATING_TRACK_MODE 0: Valid DLY Mode 1: Valid Mode (Jade-like) 2: FIFO mode
SELPH_MODE 0: By rank 1: By Phase
==============================================================
GAT_TRACK_EN = 1
RX_GATING_MODE = 2
RX_GATING_TRACK_MODE = 2
SELPH_MODE = 1
PICG_EARLY_EN = 1
VALID_LAT_VALUE = 0
==============================================================
Enter into Gating configuration >>>>
Exit from Gating configuration <<<<
[DIG_HW_NONSHUF_ZQCAL_CFG],Configuration Enter
[DIG_HW_NONSHUF_ZQCAL_CFG_FOR_PCDDR],Configuration Enter
[DIG_HW_NONSHUF_ZQCAL_CFG],Configuration Enter
[DIG_HW_NONSHUF_ZQCAL_CFG_FOR_PCDDR],Configuration Enter
Enter into PICG configuration >>>>
Exit from PICG configuration <<<<
[DIG_SHUF_CONFIG] DCM_FUNCTION >>>>>>, group_id=0
[DIG_SHUF_CONFIG] DCM_FUNCTION <<<<<<, group_id=0
[DIG_FREQ_CONFIG][TX_CA][Delay] ch_id:0, group_id:0 >>>>>
[DIG_FREQ_CONFIG][TX_CA][Delay] ch_id:0, group_id:0 <<<<<
[DIG_HW_SHUF_ZQCAL_CFG] Group:0, Configuration Enter
[ModeRegister CWL Config] data_rate:3200-MR_CWL:[ModeRegister CL Config] data_rate:3200-MR_CL:[ModeRegister WR Config] data_rate:3200-MR_WR:===================================
PCDDR4 DRAM CONFIGURATION
===================================
CWL = 0x7
RTT_NORM = 0x6
CL = 0xb
AL = 0x0
BL = 0x0
RBT = 0x0
WR = 0x8
===================================
[ReadLatency GET] MR_CL:[ReadLatency GET] MR_CL:UI_MCK_least is 1
RX_GW_selph_by_ps[0] is 12464
RX_GW_selph_by_ps[1] is 12464
RX_GW_selph_by_ps[2] is 12464
RX_GW_selph_by_ps[3] is 12464
===================================
RX_path CONFIGURATION
===================================
data_rate is 3200
dq_p2s_ratio is 8
ca_default_delay is 1
ca_ser_latency is 7
cs2RL_start is 1
byte_num is 2
rank_num is 2
RL[0] is 24
RL[1] is 24
RL_min is 24
RL_max is 24
TDQSCK[0] is 0
TDQSCK[1] is 0
TDQSCK[2] is 0
TDQSCK[3] is 0
dqsien_default_delay is 0
dqsien_ser_latency is 7
oe_ser_latency is 4
gating_window_ahead_dqs is 2
aphy_slice_delay is 11
aphy_dtc_delay is 100
aphy_lead_lag_margin is 16
dram_ui_ratio is 2
dq_ui_unit is 312
ca_ui_unit is 312
MCK_unit is 2496
dramc_dram_ratio is 4
CKR is 1
tRPRE_toggle is 0
tRPRE_static is 2
tRPST is 0
DQSIENMODE is 1
BL is 16
FAKE_1TO16_MODE is 0
SVA_1_10_t2_SPEC is 11
read_cmd_out is 1
ca_MCKIO_ui_unit is 312
ca_p2s_ratio is 8
TDQSCK_min_SPEC is 0
TDQSCK_max_SPEC is 360
TX_pipeline is 1
RX_pipeline is 1
NEW_RANK_MODE is 0
close_loop_mode is 1
===================================
===================================
RX_path RG value
===================================
RX_UI_P0[0] is 15
RX_UI_P0[1] is 15
RX_UI_P0[2] is 15
RX_UI_P0[3] is 15
RX_UI_P1[0] is 19
RX_UI_P1[1] is 19
RX_UI_P1[2] is 19
RX_UI_P1[3] is 19
RX_PI[0] is 31
RX_PI[1] is 31
RX_PI[2] is 31
RX_PI[3] is 31
DQSINCTL is 3
DATLAT_DSEL is 11
DATLAT is 12
DATLAT_DSEL_PHY is 12
DLE_EXTEND is 1
RX_IN_GATE_EN_HEAD is 0
RX_IN_GATE_EN_TAIL is 0
RX_IN_BUFF_EN_HEAD is 2
RX_IN_BUFF_EN_TAIL is 0
RX_IN_GATE_EN_PRE_OFFSET is 2
RANKINCTL_ROOT1 is 1
RANKINCTL is 1
RANKINCTL_STB is 2
RANKINCTL_RXDLY is 0
SHU_GW_THRD_POS is 42
SHU_GW_THRD_NEG is 0
RDSEL_TRACK_EN is 0
RDSEL_HWSAVE_MSK is 1
DMDATLAT_i is 12
RODTEN is 0
RODT is 1229813737
RODTE is 1
RODTE2 is 1
ODTEN_MCK_P0[4] is 0
ODTEN_MCK_P1[4] is 0
ODTEN_UI_P0[4] is 0
ODTEN_UI_P1[4] is 0
RX_RANK_DQS_LAT is 0
RX_RANK_DQ_LAT is 1
RANKINCTL_PHY is 5
RANK_SEL_LAT_CA is 0
RANK_SEL_LAT_B0 is 0
RANK_SEL_LAT_B1 is 0
RANK_SEL_STB_EN is 0
RANK_SEL_RXDLY_TRACK is 0
RANK_SEL_STB_TRACK is 1
RANK_SEL_STB_PHASE_EN is 1
RANK_SEL_PHSINCTL is 2
RANK_SEL_STB_UI_MINUS is 2
RANK_SEL_STB_UI_PLUS is 0
RANK_SEL_MCK_P0 is 0
RANK_SEL_UI_P0 is 0
RANK_SEL_MCK_P1 is 1
RANK_SEL_UI_P1 is 0
R0DQSIENLLMTEN is 1
R0DQSIENLLMT is 96
R0DQSIENHLMTEN is 1
R0DQSIENHLMT is 63
R1DQSIENLLMTEN is 1
R1DQSIENLLMT is 96
R1DQSIENHLMTEN is 1
R1DQSIENHLMT is 63
DQSIEN_FIFO_DEPTH_HALF is 1
===================================
[ModeRegister CWL Config] data_rate:3200-MR_CWL:[ModeRegister CL Config] data_rate:3200-MR_CL:[ModeRegister WR Config] data_rate:3200-MR_WR:===================================
PCDDR4 DRAM CONFIGURATION
===================================
CWL = 0x7
RTT_NORM = 0x6
CL = 0xb
AL = 0x0
BL = 0x0
RBT = 0x0
WR = 0x8
===================================
[WriteLatency GET] MR_CWL:[WriteLatency GET] MR_CWL:=====================================
print TX_path_config
=====================================
data_ratio is 3200
dq_p2s_ratio is 8
cs2WL_start is 1
byte_num is 2
rank_num is 2
CKR is 1
DBI_WR is 0
dly_1T_by_FDIV2 is 0
WL[0] is 20
WL[1] is 20
TDQSS[0][0] is 156
TDQSS[0][1] is 156
TDQSS[1][0] is 156
TDQSS[1][1] is 156
TDQS2DQ[0][0] is 0
TDQS2DQ[0][1] is 0
TDQS2DQ[1][0] is 0
TDQS2DQ[1][1] is 0
ca_p2s_ratio is 8
ca_default_dly is 1
ca_default_pi is 0
ca_ser_latency is 7
dqs_ser_laterncy is 7
dqs_default_dly is 5
dqs_oe_default_dly is 2
dq_ser_laterncy is 7
MCK_unit is 2496
dq_ui_unit is 312
ca_unit is 312
ca_MCKIO_unit is 312
ca_frate is 0
TX_ECC is 0
TWPRE is 4
OE_pre_margin is 400
OE_pst_margin is 500
OE_downgrade is 1
aphy_slice_dly is 11
aphy_dtc_dly is 100
aphy_tx_dly is 16
DDRPHY_CLK_EN_COMB_TX_OPT is 1
NEW_RANK_MODE is 0
close_loop_mode is 1
TXP_WORKAROUND_OPT is 0
ui2pi_ratio is 32
XRTW2W_PI_mute_time is 7
fake_mode is 0
===========================================
TX_DQ_UI_OE_pre is 2
TX_DQS_UI_OE_pre is 1
data_ratio 3200, TX_dq_latency_ps is 8112, TX_dq_latency_MCK is 3
data_ratio 3200, TX_dq_latency_ps is 8112, TX_dq_latency_MCK is 3
data_ratio 3200, TX_dq_latency_ps is 8112, TX_dq_latency_MCK is 3
data_ratio 3200, TX_dq_latency_ps is 8112, TX_dq_latency_MCK is 3
===========================================
print TX_path_attribution
===========================================
TX_DQ_MCK_OE[0][0] is 2
TX_DQ_MCK_OE[0][1] is 2
TX_DQ_MCK_OE[1][0] is 2
TX_DQ_MCK_OE[1][1] is 2
TX_DQ_UI_OE[0][0] is 6
TX_DQ_UI_OE[0][1] is 6
TX_DQ_UI_OE[1][0] is 6
TX_DQ_UI_OE[1][1] is 6
TX_DQ_MCK[0][0] is 3
TX_DQ_MCK[0][1] is 3
TX_DQ_MCK[1][0] is 3
TX_DQ_MCK[1][1] is 3
TX_DQ_UI[0][0] is 2
TX_DQ_UI[0][1] is 2
TX_DQ_UI[1][0] is 2
TX_DQ_UI[1][1] is 2
TX_DQ_PI[0][0] is 0
TX_DQ_PI[0][1] is 0
TX_DQ_PI[1][0] is 0
TX_DQ_PI[1][1] is 0
TX_DQ_UIPI_all[0][0] is 0
TX_DQ_UIPI_all[0][1] is 0
TX_DQ_UIPI_all[1][0] is 0
TX_DQ_UIPI_all[1][1] is 0
TX_DQ_dlyline[0][0] is 0
TX_DQ_dlyline[0][1] is 0
TX_DQ_dlyline[1][0] is 0
TX_DQ_dlyline[1][1] is 0
TX_DQS_MCK_OE[0][0] is 2
TX_DQS_MCK_OE[0][1] is 2
TX_DQS_MCK_OE[1][0] is 2
TX_DQS_MCK_OE[1][1] is 2
TX_DQS_UI_OE[0][0] is 6
TX_DQS_UI_OE[0][1] is 6
TX_DQS_UI_OE[1][0] is 6
TX_DQS_UI_OE[1][1] is 6
TX_DQS_MCK[0][0] is 3
TX_DQS_MCK[0][1] is 3
TX_DQS_MCK[1][0] is 3
TX_DQS_MCK[1][1] is 3
TX_DQS_UI[0][0] is 1
TX_DQS_UI[0][1] is 1
TX_DQS_UI[1][0] is 1
TX_DQS_UI[1][1] is 1
DDRPHY_CLK_EN_COMB_TX_OPT is 1
TX_DQS_PI[0][0] is 16
TX_DQS_PI[0][1] is 16
TX_DQS_PI[1][0] is 16
TX_DQS_PI[1][1] is 16
DDRPHY_CLK_EN_COMB_TX_PICG_CNT is 2
DDRPHY_CLK_EN_COMB_TX_DQS_SEL_P0 is 3
DDRPHY_CLK_EN_COMB_TX_DQS_SEL_P1 is 4
DDRPHY_CLK_EN_COMB_TX_DQ_RK0_SEL_P0 is 3
DDRPHY_CLK_EN_COMB_TX_DQ_RK0_SEL_P1 is 4
DDRPHY_CLK_EN_COMB_TX_DQ_RK1_SEL_P0 is 3
DDRPHY_CLK_EN_COMB_TX_DQ_RK1_SEL_P1 is 4
DPHY_TX_DCM_EXTCNT is 0
TX_PI_UPD_MODE is 1
TX_PI_UPDCTL_B0 is 0
TX_PI_UPDCTL_B1 is 0
TX_RANKINCTL_ROOT is 0
TX_RANKINCTL is 1
TX_RANKINCTL_TXDLY is 2
DDRPHY_CLK_DYN_GATING_SEL is 5
DDRPHY_CLK_EN_OPT is 1
ARPI_CMD is 0
TDMY is 9
TXOEN_AUTOSET_DQ_OFFSET is 3
TXOEN_AUTOSET_DQS_OFFSET is 3
TXOEN_AUTOSET_EN is 1
TXPICG_AUTOSET_OPT is 0
TXPICG_AUTOSET_EN is 1
TXPICG_DQ_MCK_OFFSET_LAG is 0
TXPICG_DQS_MCK_OFFSET_LAG is 0
TXPICG_DQ_UI_OFFSET_LEAD is 0
TXPICG_DQ_UI_OFFSET_LAG is 1
TXPICG_DQS_UI_OFFSET_LEAD is 1
TXPICG_DQS_UI_OFFSET_LAG is 0
===========================================
set APHY_PI_CKCGH_CNT is 4 when not fake_mode, cur data_rate is 3200
[DIG_SHUF_CONFIG] MISC >>>>>, group_id=0
[DIG_SHUF_CONFIG] MISC <<<<<<, group_id=0
[DIG_SHUF_CONFIG] DBI >>>>>>, group_id=0
[DIG_SHUF_CONFIG] DBI <<<<<<, group_id=0
dramc_dram_ratio: 4
DDR4_DivMode: 1
freq_index: 1600
match AC timing 1
[DDR4_ac_timing_setting]start
[PC4 WR preamble settings]>>>>>>>> group_id = 0.
[PC4 WR preamble settings]<<<<<<<< group_id = 0.
clk_dramc_ref_sel FREQ=16
fmem_ck_bfe_dcm_ch0 FREQ=253
fmem_ck_aft_dcm_ch0 FREQ=253
SetClkFreeRun enter => DRAM clock free run mode = ON.
[DDR4] Pull Down reset.
[DDR4] cke fix low 10ns at least.
[DDR4] Delay 200 us.
[DDR4] Pull Up reset.
[DDR4] Delay 500 us.
[DDR4] DRAM initilization RK:0 Enter >>>>>>>>
[DDR4] Delay TXPR TRFC+10ns - 350ns(8Gb density)+10ns
[DDR4_MRS] RK:0-MA:2-OP:0x[DDR4_MRS] RK:0-MA:3-OP:0x[DDR4_MRS] RK:0-MA:1-OP:0x[DDR4_MRS] RK:0-MA:4-OP:0x[DDR4_MRS] RK:0-MA:5-OP:0x[DDR4] DQ Vref calibration>>>>>>>
[DDR4] DQ Vref Enable DQ vref calibration.
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4] wait tVREFDQE-150ns
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4] DQ Vref modify range and value
[DDR4] DQ Vref Exit DQ vref calibration.
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4] wait tVREFDQx-150ns
[DDR4] DQ Vref calibration<<<<<<<
[DDR4_MRS] RK:0-MA:0-OP:0x[DDR4_ZQ] RK:0 Enter >>>>>>>>
[DDR4_ZQ] RK:0 Exit <<<<<<<<
[DDR4] Delay ZQinit - 718ns for 1333 at least max(512Mck,640ns)
[DDR4] DRAM initilization RK:0 Exit <<<<<<<
[DDR4] Enable refresh.....All bank refresh only
SetClkFreeRun enter => DRAM clock free run mode = OFF.
[DIG_HW_NONSHUF_ZQCAL_SWITCH],Configuration Enter
[DIG_HW_NONSHUF_DQSG_SWITCH],Configuration Enter
SET_CKE_2_RANK_INDEPENDENT_RUN_TIME: ON
[MiockJmeterHQA]
===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
[DramcMiockJmeter] u1RxGatingPI = 0
0 : 2281, 2281
1 : 2271, 2271
2 : 2271, 2271
3 : 2276, 2276
4 : 2271, 2271
5 : 2272, 2272
6 : 2272, 2272
7 : 2272, 2272
8 : 2271, 2271
9 : 2271, 2271
10 : 2271, 2271
11 : 2272, 2272
12 : 2271, 2271
13 : 2271, 2271
14 : 2276, 2276
15 : 2272, 2272
16 : 2271, 2271
17 : 2267, 2267
18 : 2272, 2272
19 : 2266, 2266
20 : 2272, 2272
21 : 2271, 2271
22 : 2271, 2271
23 : 2271, 2271
24 : 2272, 2272
25 : 2271, 2271
26 : 2271, 2271
27 : 2272, 2272
28 : 2276, 2276
29 : 2271, 2271
30 : 2272, 2272
31 : 2271, 2271
32 : 2272, 2272
33 : 2271, 2271
34 : 2272, 2272
35 : 2271, 2271
36 : 2271, 1976
37 : 2271, 0
38 : 2272, 0
39 : 2271, 0
40 : 2276, 0
41 : 2271, 0
42 : 2266, 0
43 : 2272, 0
44 : 2266, 0
45 : 2267, 0
46 : 2266, 0
47 : 2271, 0
48 : 2271, 0
49 : 2271, 0
50 : 2271, 0
51 : 2271, 0
52 : 2276, 0
53 : 2272, 0
54 : 2276, 0
55 : 2271, 0
56 : 2271, 0
57 : 2272, 0
58 : 2271, 0
59 : 2276, 0
60 : 2271, 0
61 : 2271, 0
62 : 2272, 0
63 : 2271, 0
64 : 2276, 0
65 : 2271, 0
66 : 2271, 0
67 : 2276, 0
68 : 2271, 0
69 : 2276, 0
70 : 2276, 0
71 : 2271, 0
72 : 2271, 0
73 : 2271, 0
74 : 2276, 0
75 : 2271, 0
76 : 2272, 0
77 : 2271, 0
78 : 2272, 0
79 : 2276, 0
80 : 2271, 0
81 : 2272, 0
82 : 2272, 0
83 : 2271, 0
84 : 2271, 0
85 : 2271, 1417
86 : 2276, 2275
87 : 2271, 2271
88 : 2276, 2276
89 : 2271, 2271
90 : 2271, 2271
91 : 2272, 2272
92 : 2271, 2271
93 : 2271, 2271
94 : 2272, 2272
95 : 2271, 2271
96 : 2272, 2272
97 : 2271, 2271
98 : 2272, 2272
99 : 2276, 2276
100 : 2271, 2271
101 : 2271, 2271
102 : 2272, 2272
103 : 2271, 2271
104 : 2271, 2271
105 : 2271, 2271
106 : 2266, 2266
107 : 2272, 2272
108 : 2271, 2271
109 : 2272, 2272
110 : 2276, 2276
111 : 2271, 2271
112 : 2271, 2271
113 : 2271, 2271
114 : 2271, 2271
115 : 2276, 2276
116 : 2276, 2276
117 : 2271, 2271
118 : 2272, 2272
119 : 2272, 2272
120 : 2276, 2276
121 : 2272, 2272
122 : 2271, 2271
123 : 2272, 2272
124 : 2272, 2272
125 : 2271, 2271
126 : 2271, 2073
127 : 2271, 181
MIOCK jitter meter ch=0
1T = (127-37) = 90 dly cells
Clock freq = 1560 MHz, period = 641 ps, 1 dly cell = 712/100 ps
----->DramcWriteLeveling(PI) begin...
===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
Begin: 0, End: 63, Step: 1, Bound: 64
[DDR4_MRS] RK:0-MA:2-OP:0x[DDR4_MRS] RK:0-MA:1-OP:0x[Write Leveling]
delay byte0 byte1 byte2 byte3
0 O1( 1 1
1 O1( 1 1
2 O1( 1 1
3 O1( 1 1
4 O1( 1 1
5 O1( 1 1
6 O1( 1 1
7 O1( 1 1
8 O1( 1 1
9 O1( 1 0
10 O1( 1 0
11 O1( 1 0
12 O1( 1 0
13 O1( 1 0
14 O1( 0 0
15 O1( 0 0
16 O1( 0 0
17 O1( 0 0
18 O1( 0 0
19 O1( 0 0
20 O1( 0 0
21 O1( 0 0
22 O1( 0 0
23 O1( 0 0
24 O1( 0 0
25 O1( 0 0
26 O1( 0 0
27 O1( 0 0
28 O1( 0 0
29 O1( 0 0
30 O1( 0 0
31 O1( 0 0
32 O1( 0 0
33 O1( 0 0
34 O1( 0 0
35 O1( 0 0
36 O1( 0 0
37 O1( 0 0
38 O1( 0 0
39 O1( 0 1
40 O1( 0 1
41 O1( 1 1
42 O1( 1 1
43 O1( 1 1
44 O1( 1 1
45 O1( 1 1
46 O1( 1 1
47 O1( 1 1
Early breakpass bytecount = 0xff (0xff: all bytes pass)
[DDR4_MRS] RK:0-MA:1-OP:0x[DDR4_MRS] RK:0-MA:2-OP:0xWrite leveling (Byte 0): 41 => 41
Write leveling (Byte 1): 39 => 39
DramcWriteLeveling(PI) end<-----
===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
[Gating] SW mode calibration
[get_gating_start_pos] calculated gating ui = 15
12 0 | B1->B0 | 1919 1515 | 1 1 | (0 0) (0 0)
12 4 | B1->B0 | 1515 1313 | 1 1 | (0 0) (0 0)
12 8 | B1->B0 | 1919 1212 | 1 1 | (1 0) (0 1)
12 12 | B1->B0 | 1111 1515 | 1 1 | (0 0) (0 1)
12 16 | B1->B0 | f0f 1212 | 1 1 | (1 1) (1 1)
12 20 | B1->B0 | 1414 1111 | 1 1 | (1 1) (1 1)
12 24 | B1->B0 | 1414 1212 | 1 1 | (1 1) (1 1)
12 28 | B1->B0 | 1414 1212 | 1 1 | (0 0) (1 1)
13 0 | B1->B0 | 1111 1212 | 0 0 | (1 1) (1 1)
13 4 | B1->B0 | 1414 1212 | 1 1 | (0 0) (1 1)
13 8 | B1->B0 | 2121 2323 | 1 1 | (0 0) (0 0)
13 12 | B1->B0 | 2222 2323 | 1 1 | (0 0) (0 0)
13 16 | B1->B0 | 2222 2323 | 1 1 | (0 0) (0 0)
13 20 | B1->B0 | 2222 2323 | 1 1 | (1 1) (0 0)
13 24 | B1->B0 | 2222 2323 | 1 1 | (0 0) (0 0)
13 28 | B1->B0 | 2222 2323 | 1 1 | (0 0) (0 0)
14 0 | B1->B0 | 2222 2323 | 1 1 | (1 1) (0 0)
14 4 | B1->B0 | 2121 2323 | 1 1 | (1 1) (0 0)
14 8 | B1->B0 | 1f1f 2323 | 1 1 | (0 0) (0 0)
14 12 | B1->B0 | 2121 2323 | 0 0 | (1 1) (0 1)
14 16 | B1->B0 | 1d1d 2222 | 1 1 | (0 0) (0 1)
14 20 | B1->B0 | 2121 2222 | 0 0 | (1 1) (1 1)
14 24 | B1->B0 | 1f1f 2222 | 1 1 | (0 0) (1 1)
14 28 | B1->B0 | 2020 2222 | 0 0 | (1 1) (0 0)
15 0 | B1->B0 | 2222 2323 | 0 0 | (1 1) (1 1)
15 4 | B1->B0 | 2222 2222 | 0 0 | (1 1) (1 1)
15 8 | B1->B0 | 2222 2323 | 0 0 | (1 1) (1 1)
15 12 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
15 16 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
15 20 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
15 24 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
15 28 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
16 0 | B1->B0 | 2323 2323 | 0 0 | (0 0) (1 1)
16 4 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
16 8 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
16 12 | B1->B0 | 2323 2323 | 0 0 | (1 1) (0 1)
16 16 | B1->B0 | 2323 2323 | 0 0 | (1 1) (0 1)
16 20 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
16 24 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
16 28 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 0 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 4 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 8 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 12 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 16 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 20 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 24 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 28 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
18 0 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
18 4 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
18 8 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 0)
18 12 | B1->B0 | 2323 2323 | 0 0 | (0 0) (1 0)
18 16 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
18 20 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
18 24 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
18 28 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
19 0 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
19 4 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
19 8 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
19 12 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
best dqsien dly found for B1: (18, 10)
19 16 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
best dqsien dly found for B0: (18, 10)
best DQS0 dly(UI, PI) = (18, 10)
best DQS1 dly(UI, PI) = (18, 10)
[Gating] SW calibration Done
[DDR4_MRS] RK:0-MA:3-OP:0x===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
Start DQ dly to find pass range UseTestEngine =0
UseTestEngine: 0
RX Vref Scan: 0
RX Vref 0 -> 0, step: 1
RX Delay -48 -> 63, step: 4
-48, [0] xxxxxxxx xxxxxxxx [MSB]
-44, [0] xxxxxxxx xxxxxxxx [MSB]
-40, [0] xxxxxxxx xxxxxxxx [MSB]
-36, [0] xxxxxxxx xxxxxxxx [MSB]
-32, [0] xxxxxxxx xxxxxxxx [MSB]
-28, [0] xxxxxxxx xxxxxxxx [MSB]
-24, [0] xxxxxxxx xxxxxxxx [MSB]
-20, [0] xxxxxxxx xxxxxxxx [MSB]
-16, [0] xxxxxxxx xxxxxxxx [MSB]
-12, [0] xxxxxxxx xxxxxxxx [MSB]
-8, [0] xxxxxxxx xxxxxxxx [MSB]
-4, [0] xxxxxxox xxxxxxxx [MSB]
0, [0] xxoxoxox xxxxxxxx [MSB]
4, [0] oxoooooo oxoxoooo [MSB]
8, [0] oooooooo oooooooo [MSB]
12, [0] oooooooo oooooooo [MSB]
16, [0] oooooooo oooooooo [MSB]
20, [0] oooooooo oooooooo [MSB]
24, [0] oooooooo oooooooo [MSB]
28, [0] oooooooo oooooooo [MSB]
32, [0] oooooooo oooooooo [MSB]
36, [0] ooxoooxo oooooooo [MSB]
40, [0] ooxoxoxo ooooxooo [MSB]
44, [0] xoxxxxxx xoxxxxxx [MSB]
48, [0] xxxxxxxx xxxxxxxx [MSB]
RX Vref B0= 0, Window Sum 316, worse bit 2, min window 36
iDelay=48, Bit 0, Center 23 (4 ~ 43) 40
iDelay=48, Bit 1, Center 27 (8 ~ 47) 40
iDelay=48, Bit 2, Center 17 (0 ~ 35) 36
iDelay=48, Bit 3, Center 23 (4 ~ 43) 40
iDelay=48, Bit 4, Center 19 (0 ~ 39) 40
iDelay=48, Bit 5, Center 23 (4 ~ 43) 40
iDelay=48, Bit 6, Center 15 (-4 ~ 35) 40
iDelay=48, Bit 7, Center 23 (4 ~ 43) 40
RX Vref B1= 0, Window Sum 312, worse bit 11, min window 36
iDelay=48, Bit 8, Center 23 (4 ~ 43) 40
iDelay=48, Bit 9, Center 27 (8 ~ 47) 40
iDelay=48, Bit 10, Center 23 (4 ~ 43) 40
iDelay=48, Bit 11, Center 25 (8 ~ 43) 36
iDelay=48, Bit 12, Center 21 (4 ~ 39) 36
iDelay=48, Bit 13, Center 23 (4 ~ 43) 40
iDelay=48, Bit 14, Center 23 (4 ~ 43) 40
iDelay=48, Bit 15, Center 23 (4 ~ 43) 40
[DDR4_MRS] RK:0-MA:3-OP:0x===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
DQS Delay:
DQS0 = 0, DQS1 = 0
DQM Delay:
DQM0 = 21, DQM1 = 23
DQ Delay:
DQ0 =23, DQ1 =27, DQ2 =17, DQ3 =23
DQ4 =19, DQ5 =23, DQ6 =15, DQ7 =23
DQ8 =23, DQ9 =27, DQ10 =23, DQ11 =25
DQ12 =21, DQ13 =23, DQ14 =23, DQ15 =23
===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
[TxWindowPerbitCal] caltype:2 Autok:0
TX Vref Scan disable
807 |3 0 39|[0] xxxxxxox xxxxxxxx [MSB]
809 |3 0 41|[0] xxoxxxox xxxxoxxx [MSB]
811 |3 0 43|[0] xxoxxxox oooooooo [MSB]
813 |3 0 45|[0] oxoxoxox oooooooo [MSB]
815 |3 0 47|[0] oxoxoxoo oooooooo [MSB]
827 |3 0 59|[0] oooooooo ooxxoooo [MSB]
829 |3 0 61|[0] oooooooo ooxxxooo [MSB]
831 |3 0 63|[0] oooooooo ooxxxxxx [MSB]
833 |3 2 1|[0] xoxoxoxo xxxxxxxx [MSB]
835 |3 2 3|[0] xxxxxxxo xxxxxxxx [MSB]
837 |3 2 5|[0] xxxxxxxx xxxxxxxx [MSB]
TX Bit0 (813~831) 20 822, Bit8 (811~831) 22 821,
TX Bit1 (817~833) 18 825, Bit9 (811~831) 22 821,
TX Bit2 (809~831) 24 820, Bit10 (811~825) 16 818,
TX Bit3 (817~833) 18 825, Bit11 (811~825) 16 818,
TX Bit4 (813~831) 20 822, Bit12 (809~827) 20 818,
TX Bit5 (817~833) 18 825, Bit13 (811~829) 20 820,
TX Bit6 (807~831) 26 819, Bit14 (811~829) 20 820,
TX Bit7 (815~835) 22 825, Bit15 (811~829) 20 820,
== TX Byte 0 ==
Update DQ dly =822 (3 ,0, 54) DQ OEN =(2 ,5)
Update DQM dly =822 (3 ,0, 54) DQM OEN =(2 ,5)
== TX Byte 1 ==
Update DQ dly =819 (3 ,0, 51) DQ OEN =(2 ,5)
Update DQM dly =819 (3 ,0, 51) DQM OEN =(2 ,5)
===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
[TxWindowPerbitCal] caltype:0 Autok:0
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 3
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 5
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 7
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 9
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 11
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 13
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 15
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 17
TX Vref=3, minBit 1, minWin=16, winSum=294
TX Vref=5, minBit 10, minWin=16, winSum=300
TX Vref=7, minBit 10, minWin=16, winSum=304
TX Vref=9, minBit 10, minWin=16, winSum=312
TX Vref=11, minBit 10, minWin=16, winSum=316
TX Vref=13, minBit 10, minWin=17, winSum=325
TX Vref=15, minBit 10, minWin=17, winSum=329
TX Vref=17, minBit 10, minWin=17, winSum=333
[TxChooseVref] Worse bit 10, Min win 17, Win sum 333, Final Vref 17
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 17
Final TX Range 1 Vref 17
===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
[TxWindowPerbitCal] caltype:0 Autok:0
TX Vref Scan disable
807 |3 0 39|[0] xxxxxxxx xxxxxxxx [MSB]
808 |3 0 40|[0] xxxxxxxx xxxxxxxx [MSB]
809 |3 0 41|[0] xxxxxxox xxxxoxxx [MSB]
810 |3 0 42|[0] xxoxxxox oooooooo [MSB]
811 |3 0 43|[0] xxoxxxox oooooooo [MSB]
812 |3 0 44|[0] oxoxoxox oooooooo [MSB]
813 |3 0 45|[0] oxoxoxox oooooooo [MSB]
814 |3 0 46|[0] oxoxooox oooooooo [MSB]
815 |3 0 47|[0] oxoooooo oooooooo [MSB]
827 |3 0 59|[0] oooooooo ooxooooo [MSB]
828 |3 0 60|[0] oooooooo ooxxoooo [MSB]
829 |3 0 61|[0] oooooooo ooxxxooo [MSB]
830 |3 0 62|[0] oooooooo ooxxxooo [MSB]
831 |3 0 63|[0] oooooooo ooxxxooo [MSB]
832 |3 2 0|[0] xoooooxo ooxxxxxx [MSB]
833 |3 2 1|[0] xoxoxoxo xxxxxxxx [MSB]
834 |3 2 2|[0] xoxoxoxo xxxxxxxx [MSB]
835 |3 2 3|[0] xxxxxxxo xxxxxxxx [MSB]
836 |3 2 4|[0] xxxxxxxo xxxxxxxx [MSB]
837 |3 2 5|[0] xxxxxxxx xxxxxxxx [MSB]
TX Bit0 (812~831) 20 821, Bit8 (810~832) 23 821,
TX Bit1 (816~834) 19 825, Bit9 (810~832) 23 821,
TX Bit2 (810~832) 23 821, Bit10 (810~826) 17 818,
TX Bit3 (815~834) 20 824, Bit11 (810~827) 18 818,
TX Bit4 (812~832) 21 822, Bit12 (809~828) 20 818,
TX Bit5 (814~834) 21 824, Bit13 (810~831) 22 820,
TX Bit6 (809~831) 23 820, Bit14 (810~831) 22 820,
TX Bit7 (815~836) 22 825, Bit15 (810~831) 22 820,
[TX_PER_BIT_DELAY_CELL] DelayCellTimex100 =712/100 ps
== TX Byte 0 ==
u2DelayCellOfst[0]=1 cells (1 PI)
u2DelayCellOfst[1]=6 cells (5 PI)
u2DelayCellOfst[2]=1 cells (1 PI)
u2DelayCellOfst[3]=5 cells (4 PI)
u2DelayCellOfst[4]=2 cells (2 PI)
u2DelayCellOfst[5]=5 cells (4 PI)
u2DelayCellOfst[6]=0 cells (0 PI)
u2DelayCellOfst[7]=6 cells (5 PI)
Update DQ dly =820 (3 ,0, 52) DQ OEN =(2 ,5)
Update DQM dly =822 (3 ,0, 54) DQM OEN =(2 ,5)
== TX Byte 1 ==
u2DelayCellOfst[8]=4 cells (3 PI)
u2DelayCellOfst[9]=4 cells (3 PI)
u2DelayCellOfst[10]=0 cells (0 PI)
u2DelayCellOfst[11]=0 cells (0 PI)
u2DelayCellOfst[12]=0 cells (0 PI)
u2DelayCellOfst[13]=2 cells (2 PI)
u2DelayCellOfst[14]=2 cells (2 PI)
u2DelayCellOfst[15]=2 cells (2 PI)
Update DQ dly =818 (3 ,0, 50) DQ OEN =(2 ,5)
Update DQM dly =819 (3 ,0, 51) DQM OEN =(2 ,5)
===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
DATLAT Default: 0xc
0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0x10, 0x11, 0x12, 0x13, 0xbest_step = 11
===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
Start DQ dly to find pass range UseTestEngine =1
UseTestEngine: 1
RX Vref Scan: 1
Set Vref Range= 9 -> 21
RX Vref 9 -> 21, step: 1
RX Delay -14 -> 63, step: 2
Set Vref, RX VrefLevel [Byte0]: 9 [Byte1]: 9
RX Vref B0= 9, Window Sum 218, worse bit 2, min window 26
RX Vref B1= 9, Window Sum 202, worse bit 10, min window 22
Set Vref, RX VrefLevel [Byte0]: 10 [Byte1]: 10
RX Vref B0= 10, Window Sum 228, worse bit 1, min window 28
RX Vref B1= 10, Window Sum 218, worse bit 8, min window 26
Set Vref, RX VrefLevel [Byte0]: 11 [Byte1]: 11
RX Vref B0= 11, Window Sum 234, worse bit 2, min window 28
RX Vref B1= 11, Window Sum 222, worse bit 10, min window 26
Set Vref, RX VrefLevel [Byte0]: 12 [Byte1]: 12
RX Vref B0= 12, Window Sum 248, worse bit 0, min window 30
RX Vref B1= 12, Window Sum 238, worse bit 10, min window 28
Set Vref, RX VrefLevel [Byte0]: 13 [Byte1]: 13
RX Vref B0= 13, Window Sum 254, worse bit 1, min window 30
RX Vref B1= 13, Window Sum 240, worse bit 10, min window 28
Set Vref, RX VrefLevel [Byte0]: 14 [Byte1]: 14
RX Vref B0= 14, Window Sum 256, worse bit 3, min window 30
RX Vref B1= 14, Window Sum 250, worse bit 10, min window 28
Set Vref, RX VrefLevel [Byte0]: 15 [Byte1]: 15
RX Vref B0= 15, Window Sum 272, worse bit 3, min window 32
RX Vref B1= 15, Window Sum 258, worse bit 10, min window 30
Set Vref, RX VrefLevel [Byte0]: 16 [Byte1]: 16
RX Vref B0= 16, Window Sum 278, worse bit 1, min window 34
RX Vref B1= 16, Window Sum 264, worse bit 8, min window 32
Set Vref, RX VrefLevel [Byte0]: 17 [Byte1]: 17
RX Vref B0= 17, Window Sum 282, worse bit 2, min window 34
Set Vref, RX VrefLevel [Byte0]: 18 [Byte1]: 18
RX Vref B1= 18, Window Sum 274, worse bit 10, min window 32
Set Vref, RX VrefLevel [Byte0]: 19 [Byte1]: 19
Set Vref, RX VrefLevel [Byte0]: 20 [Byte1]: 20
Set Vref, RX VrefLevel [Byte0]: 21 [Byte1]: 21
Final RX Vref Byte 0 = 17 to rank0 to rank1
Final RX Vref Byte 1 = 18 to rank0 to rank1
===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
DQS Delay:
DQS0 = 0, DQS1 = 0
DQM Delay:
DQM0 = 21, DQM1 = 24
DQ Delay:
DQ0 =23, DQ1 =27, DQ2 =18, DQ3 =24
DQ4 =20, DQ5 =23, DQ6 =15, DQ7 =23
DQ8 =24, DQ9 =25, DQ10 =23, DQ11 =27
DQ12 =22, DQ13 =25, DQ14 =22, DQ15 =25
[DualRankRxdatlatCal] RK0: 11, RK1: 0, Final_Datlat 11
[Calibration Summary] Freqency 1600
CH 0, Rank 0
SW Impedance : PASS
DUTY Scan : NO K
ZQ Calibration : PASS
Jitter Meter : NO K
CBT Training : NO K
Write leveling : PASS
RX DQS gating : PASS
RX DQ/DQS(RDDQC) : PASS
TX DQ/DQS : PASS
RX DATLAT : PASS
RX DQ/DQS(Engine): PASS
TX OE : NO K
All Pass.
TX_TRACKING: OFF
[AUTO] write start address pass, BASE_ADDR : 0x0, OFFSET : 0x3
[AUTO] Detect DramSize: 0x8000000
[AUTO] BASE_ADDR : 0x8000000, OFFSET : 0x3
[AUTO] BASE_ADDR : 0x0, OFFSET : 0x3
[AUTO] Detect DramSize: 0x10000000
[AUTO] BASE_ADDR : 0x10000000, OFFSET : 0x3
[AUTO] BASE_ADDR : 0x0, OFFSET : 0x3
[AUTO] Detect DramSize: 0x20000000
[AUTO] BASE_ADDR : 0x20000000, OFFSET : 0x3
[AUTO] BASE_ADDR : 0x0, OFFSET : 0x3
[AUTO] TA2 read check fail, u4err_value = 65535, 3
[AUTO] Detect full size
u4DramSize 0x20000000
NOTICE: EMI: Detected DRAM size: 512MB
[MEM_TEST] 02: After DFS, before run time config
[MEM_TEST] Rank 0 OK.(uiFixedAddr 0x40000000, Pass count = 16384, Fail count = 0)
[TA2_TEST]
=== TA2 HW
=== OFFSET:0x200
TA2 PAT: 3
TA2 Trigger Write
HW channel(0) Rank(0), TA2 pass, pass_cnt:1, err_cnt:0
[DramcRunTimeConfig]: ON
PHYPLL
DPM_CONTROL_AFTERK: ON
PER_BANK_REFRESH: OFF
REFRESH_OVERHEAD_REDUCTION: ON
CMD_PICG_NEW_MODE: OFF
TX_TRACKING: OFF
RDSEL_TRACKING: OFF
DQS Precalculation for DVFS: OFF
RX_TRACKING: OFF
DDR_HW_GATING DBG: ON
DDR_ZQCS_ENABLE: ON
RX_PICG_NEW_MODE: ON
TX_PICG_NEW_MODE: ON
ENABLE_RX_DCM_DPHY: ON
LOWPOWER_GOLDEN_SETTINGS(DCM): ON
DUMMY_READ_FOR_TRACKING: OFF
!!! SPM_CONTROL_AFTERK: OFF
!!! SPM could not control APHY
IMPEDANCE_TRACKING: OFF
HW_SAVE_FOR_SR: OFF
CLK_FREE_FUN_FOR_DRAMC_PSEL: OFF
PA_IMPROVEMENT_FOR_DRAMC_ACTIVE_POWER: OFF
Read ODT Tracking: OFF
Refresh Rate DeBounce: OFF
DFS_NO_QUEUE_FLUSH: OFF
DFS_NO_QUEUE_FLUSH_LATENCY_CNT: OFF
ENABLE_DFS_RUNTIME_MRW: OFF
DDR_RESERVE_NEW_MODE: ON
=========================
[MEM_TEST] 03: After run time config
[MEM_TEST] Rank 0 OK.(uiFixedAddr 0x40000000, Pass count = 16384, Fail count = 0)
[TA2_TEST]
=== TA2 HW
=== OFFSET:0x200
TA2 Trigger Write
HW channel(0) Rank(0), TA2 pass, pass_cnt:2, err_cnt:0
Init_DRAM:2480: init PCDDR4 dram End
EMI: complex real chip dram calibration
Verify pattern 1 (0x00~0xff)...
EMI: mem8_base[0] = pattern8 = 0x0
Verify pattern 2 (0x00~0xffff)...
EMI: mem16_base[0] = pattern16 = 0x0
Verify pattern 3 (0x00~0xffffffff)...
EMI: mem32_base[0] = pattern32 = 0x0
NOTICE: EMI: complex R/W mem test passed
drm_dram_reserved: MTK_DRM_MODE(22000000)
NOTICE: SPI_NAND parses attributes from parameter page.
NOTICE: SPI_NAND Detected ID 0x0
NOTICE: Page size 2048, Block size 131072, size 134217728
NOTICE: Initializing NMBM ...
NOTICE: Signature found at block 1023 [0x07fe0000]
NOTICE: First info table with writecount 0 found in block 960
NOTICE: Second info table with writecount 0 found in block 963
NOTICE: NMBM has been successfully attached in read-only mode
INFO: BL2: Loading image id 3
INFO: Loading image id=3 at address 0x42000000
INFO: Image id=3 loaded: 0x42000000 - 0x42009061
INFO: BL2: Loading image id 5
INFO: Loading image id=5 at address 0x42000000
INFO: Image id=5 loaded: 0x42000000 - 0x420ae288
NOTICE: BL2: Booting BL31
INFO: Entry point address = 0x43001000
INFO: SPSR = 0x3cd
INFO: Total CPU count: 4
INFO: MCUSYS: Disable 512KB L2C shared SRAM
INFO: check_ver = 0
INFO: Secondary bootloader is AArch64
INFO: GICv3 without legacy support detected.
INFO: ARM GICv3 driver initialized in EL3
INFO: Maximum SPI INTID supported: 671
INFO: SPMC: Changed to SPMC mode
NOTICE: BL31: v2.6(release):2598dbc2a6-dirty
NOTICE: BL31: Built : 13:34:54, Mar 12 2022
INFO: [MPU](Region0)sa:0x0300, ea:0x0302
INFO: [MPU](Region0)apc0:0x80b6db69, apc1:0x00b6db6d
INFO: [MPU](Region1)sa:0x0000, ea:0x0000
INFO: [MPU](Region1)apc0:0x00000000, apc1:0x00000000
INFO: [MPU](Region2)sa:0x0000, ea:0x0000
INFO: [MPU](Region2)apc0:0x00000000, apc1:0x00000000
INFO: [MPU](Region3)sa:0x0000, ea:0x0000
INFO: [MPU](Region3)apc0:0x00000000, apc1:0x00000000
INFO: [DEVAPC] devapc_init done
INFO: BL31: Initializing runtime services
INFO: BL31: Preparing for EL3 exit to normal world
INFO: Entry point address = 0x41e00000
INFO: SPSR = 0x3c9
It's hard to open case. The back side nails are really hard to open.
So I located UART port from internal pictures (at bottom of 3.rd antenna) and use attaches to reach the UART port.
Unfortunately, It looks like shell is disabled completely. No echo available at screen...
Does this router is NO GO for OpenWRT?
Thanks for sharing @EUA. This is super interesting. Doesn't look like it's using u-boot at first glance which is already going to make things harder. It also looks like it's a 3-stage bootloader (BL1 doesn't seem to appear anywhere in the log you shared).
Some questions:
I'll be back shortly with some more comments.
Okay so, this looks like Arm Trusted Firmware: https://trustedfirmware-a.readthedocs.io/en/latest/design/firmware-design.html
The TL;DR is if they did it right, probably game over. I'm not super well versed here but from what I understand it's not easy to get around. The flash chip they use is also a WSON package which is painful to clip to and dump without desoldering (meaning dumping the firmware is going to be a lot harder/more tedious).
You could try looking for some pads near the flash chip (it's at the top right next to UART) and try grounding them while booting. Sometimes you can drop into the bootloader's console if it can't find anything to boot and then you may be able to poke around there.
U-Boot should be later on in the log there, but it looks like they cut it off just before that. They're almost certainly using it, as they still have the boot logic based on the env variables partition they need to handle.
UART is typically ignored within Xiaomi stock roms without the env var uart_en=1, and their u-boot are set by default to instantly boot without chance to interrupt. Ie. boot_wait=off
The presence of ATF does not imply secure boot, as basically all their modern arm stuff will be using it in some manner for hardware init and memory training as seen here.
I mean they could, it's just not something you could declare from just looking at that boot log. And despite how noisy the memory training and init stage is, I don't seem to see anything printed regarding actual boot chain verification...
True they very well could be and the bootlog was inconclusive. I have seen some (rare) devices not use u-boot and I have a hard time imagining they don't. So unless we can double check with @EUA's device, I'll have to wait till (if) mine arrives. I suppose the existence of the FIP partition would make me reconsider and lean more towards the side that u-boot does exist on it.
Yeah this is my first Xiaomi device. I'm not used to them yet but this is what I've seen grazing through the forums here. Not sure if anyone has ever tried shorting flash pads to try to kick the bootloader into the console when it fails to find an image.
Thanks for pointing that out! Learn something new every day. The only reason I suggested this is because one device I've looked at in the past that has ATF fully implemented stopped printing to the console roughly around the same stage (where you'd expect U-Boot to shine). Not sure if that's at all related, just where my head was going. Yeah we'd probably see something relevant to verification here if it was.
Boot is quick. Not waits somewhere. I press esc-enter and many keys to interrupt but...
I am www.samygo.tv hacker. Could de-solder wson packages also 
but not willing to do it right now. Might be xiaomi release a development firmware to allow us ssh 
soon.
Have you checked if the FW came with telnet or SSH open?
Definitely. And connection rejected. Also tried some telnet/ssh enable code by WebUI injection but they doesn't work.
They run most of the obvious stuff through sanitization functions in XQFunction.lua
Note that the majority of the lua is obfuscated.
There's the odd file that it'll trip over because they occassionally have the whole #!/bin/lua interpreter directive a the top before bytecode, but you can trim that out in a few lines of changes if needed. (In case you wanted to batch process all the lua)
I suspect most of the command injection vulnerabilities will most likely exist in the interaction with helper binaries and shell scripts.
However, I still suspect glitching out u-boot during recovery flash is unfixed and probably worth testing before devoting hours of static analysis looking for a lua bug.
I'd agree. I've never touched lua in my life so if all else fails, someone else may have to take this challenge on. FWIW, my device is still stuck presumably in customs. Dunno if it'll ever come out.
Wow, after nearly 3 weeks mine seems to have made its way out of customs! It’ll be here later today.
Alright, we got open ports on:
53 - DNS
80 - Web GUI (nginx)
443 - Web GUI (nginx)
784 - Unknown
8080 - Web GUI (nginx)
8098 - Web GUI (nginx)
8883 - Unknown (looks like mqtt for their app)
No SSH or telnet.
Mind you I'm new to Xiaomi devices so I don't really know what they look like historically.
For anyone else trying to open the device, after you remove the 4 rubber feet and screws beneath, stick a tiny flat head in between the bottom part of the case near the antenna and the whole bottom will pop out very easily.
I also left my serial adapter at work so will have to wait until tomorrow to hook up UART. Oops!
I believe they also sync configuration to mesh nodes here, if I recall.
That's their ubus listener for trafficd I think. I recall I've already tried to fuzz the few string inputs in there... Or I was trying to add non-existent lightbulbs as some other convoluted thing I was testing...
