Add Openwrt support for Xiaomi "Redmi AX6000"

Apparently, a non-release channel build has leaked again.

miwifi_rb06_firmware_stable_1.2.2(1).bin 5b4cbb33ai5483c035abe1c0857108c8

Looks like it's fresh out of their build system as well. Sat, 11 Jun 2022 05:09:35 +0000

I guess they weren't seeing the sales numbers they wanted to see (sarcasm)

Edit: Users allege that it does not enable telnet anyway so, meh.

1 Like

Quad-core 2.0Ghz SoC is really nice. Sadly no USB port is available which highly limits its capability

1 Like

I bought one and it's available here. Where to start? Expecting an alpha binary soon for this...

You could start by connecting UART, getting boot logs, seeing if the console is password protected, and whatever else you can find.

Seems mine got lost in customs. Been stuck for over a week.

1 Like

Please DO NOT post the link to the Xiaomi AX6000's tool in the Redmi AX6000's post.

Bootlog here in 2 parts:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 022F [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):2598dbc2a6-dirty
NOTICE:  BL2: Built : 13:34:54, Mar 12 2022
INFO:    BL2: Doing platform setup
NOTICE:  WDT: disabled
NOTICE:  CPU: MT7986 (2000MHz)
NOTICE:  EMI: Using DDR4 settings
before ctrl3 = 0x0
clear request & ack
after ctrl3 = 0x0
DVFSRC_SUCCESS 0
dump drm registers data: 
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a083f1 000003ff 00100000 00000000
1001d040 | 00000000 00000000 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0x8 
toprgu: 80 = 0x0 
[DDR Reserve] ddr reserve mode not be enabled yet
Save DRM_DEBUG_CTL(0xa083f1)
DRM_LATCH_CTL : 0x27e71
DRM_LATCH_CTL2: 0x200a0
drm_update_reg: 1, bits: 0x8000, addr: 0x1001d030, val: 0xa083f1
drm_update_reg: 0, bits: 0x80000, addr: 0x1001d030, val: 0xa083f1
drm_update_reg: 0, bits: 0x200, addr: 0x1001d034, val: 0x1ff
drm_update_reg: 0, bits: 0x200000, addr: 0x1001d034, val: 0x1ff
drm_update_reg: 0, bits: 0x100, addr: 0x1001d034, val: 0xff
MTK_DRM_DEBUG_CTL : 0xa083f1
MTK_DRM_DEBUG_CTL2: 0xff
drm_update_reg: 0, bits: 0x4000, addr: 0x1001d030, val: 0xa083f1
DRM DDR reserve mode FAIL! a083f1
DDR RESERVE Success 0
drm_update_reg: 0, bits: 0x2000, addr: 0x1001d030, val: 0xa083f1
drm_update_reg: 0, bits: 0x1000, addr: 0x1001d030, val: 0xa083f1
[DRAM] into mt_set_emi
[EMI] ComboMCP not ready, using default setting

 Init_DRAM:2139: init PCDDR4 dram Start
[MD32_INIT] in c code >>>>>> 
[MD32_INIT] 3 
[MD32_INIT] 4 
[MD32_INIT] 5 
[MD32_INIT] 6 
[MD32_INIT] V22 add 1 
[MD32_INIT] V22 add 1 end 
[MD32_INIT] 7 
[MD32_INIT] 8 
[MD32_INIT] 9 
[MD32_INIT] 10 
[MD32_INIT] 11 
[MD32_INIT] 12 
[MD32_INIT] 13 
[MD32_INIT] 14 
[MD32_INIT] 15 
[MD32_INIT] 16 
[MD32_INIT] 17 
[MD32_INIT] 18 
[MD32_INIT] 19 
[MD32_INIT] 20 
[MD32_INIT] 21 
[MD32_INIT] 22 
[MD32_INIT] 23 
[MD32_INIT] 28 
[MD32_INIT] 29 
[MD32_INIT] 30 for RTMRW, if have 
[MD32_INIT] in c code <<<<<< 
 [Set_DRAM_Pinmux_Sel] DRAMPinmux = 0


[Bian_co] ETT version 0.0.0.1
 dram_type 4, R0 cbt_mode 0, R1 cbt_mode 0 VENDOR=136

Read voltage for 1600, 0
Vio18 = 0
Vcore = 0
Vdram = 0
Vddq = 0
Vmddr = 0
== DRAMC_CTX_T ==
support_channel_num:    1
channel:                0
support_rank_num:       1
rank:                   0
freq_sel:               22
shu_type:               0
dram_type:              4
dram_fsp:               0
odt_onoff:              1
DBI_R_onoff:            0, 0
DBI_W_onoff:            0, 0
data_width:             16
test2_1:             0x55000000
test2_2:             0xaa000100
frequency:              1600
freqGroup:              1600
u1PLLMode:              0
dram type 6 
===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
OCD DRVP=0 ,CALOUT=0
OCD DRVP=1 ,CALOUT=0
OCD DRVP=2 ,CALOUT=0
OCD DRVP=3 ,CALOUT=0
OCD DRVP=4 ,CALOUT=0
OCD DRVP=5 ,CALOUT=0
OCD DRVP=6 ,CALOUT=0
OCD DRVP=7 ,CALOUT=0
OCD DRVP=8 ,CALOUT=0
OCD DRVP=9 ,CALOUT=1

OCD DRVP calibration OK! DRVP=9

OCD DRVN=0 ,CALOUT=1
OCD DRVN=1 ,CALOUT=1
OCD DRVN=2 ,CALOUT=1
OCD DRVN=3 ,CALOUT=1
OCD DRVN=4 ,CALOUT=1
OCD DRVN=5 ,CALOUT=1
OCD DRVN=6 ,CALOUT=0

OCD DRVN calibration OK! DRVN=6

[SwImpedanceCal] DRVP=9, DRVN=6
freq_region=0, Reg: DRVP=11, DRVN=8, ODTP=6
MEM_TYPE=6, freq_sel=22
[ModeRegister CWL Config] data_rate:3200-MR_CWL:[ModeRegister CL Config] data_rate:3200-MR_CL:[ModeRegister WR Config] data_rate:3200-MR_WR:=================================== 
PCDDR4 DRAM CONFIGURATION
=================================== 
CWL      = 0x7
RTT_NORM = 0x6
CL       = 0xb
AL       = 0x0
BL       = 0x0
RBT      = 0x0
WR       = 0x8
=================================== 
=================================== 
ANA top config
=================================== 
ASYNC_MODE              = 3
DLL_ASYNC_EN            = 1
ALL_SLAVE_EN            = 0
NEW_RANK_MODE           = 0
DLL_IDLE_MODE           = 1
LP45_APHY_COMB_EN       = 1
TX_ODT_DIS              = 0
NEW_8X_MODE             = 0
=================================== 
=================================== 
data_rate                  = 3200
CKR                        = 1
DQ_P2S_RATIO               = 8
=================================== 
CA_P2S_RATIO               = 8
DQ_CA_OPEN                 = 0
DQ_SEMI_OPEN               = 0
CA_SEMI_OPEN               = 0
CA_FULL_RATE               = 0
DQ_CKDIV4_EN               = 0
CA_CKDIV4_EN               = 0
CA_PREDIV_EN               = 0
PH8_DLY                    = 31
SEMI_OPEN_CA_PICK_MCK_RATIO= 0
DQ_AAMCK_DIV               = 4
CA_AAMCK_DIV               = 4
CA_ADMCK_DIV               = 4
DQ_TRACK_CA_EN             = 0
CA_PICK                    = 1600
CA_MCKIO                   = 1600
MCKIO_SEMI                 = 0
PLL_FREQ                   = 3200
DQ_UI_PI_RATIO             = 32
CA_UI_PI_RATIO             = 0
=================================== 
=================================== 
memory_type:PCDDR4         
GP_NUM     : 1       
SRAM_EN    : 1       
MD32_EN    : 0       
=================================== 
=========================================== 
HW_ZQCAL_config
=========================================== 
ZQCALL              is 0
TZQLAT              is 27
ZQCSDUAL            is 0
ZQCSCNT             is 511
=========================================== 
[ANA_INIT] >>>>>>>>>>>>>> 
[ANA_ClockOff_Sequence] flow start 
WLY_DEBUG::ANA_ClockOff_Sequence delay 100ns start 
WLY_DEBUG::ANA_ClockOff_Sequence delay 100ns end 
[ANA_ClockOff_Sequence] flow end 
============ PULL DRAM RESETB DOWN ============
========== PULL DRAM RESETB DOWN end =========
============ SUSPEND_ON ============
============ SUSPEND_ON end ============
============ SPM_control ============
============ SPM_control end ============
<<<<<< [CONFIGURE PHASE]: ANA_TX
>>>>>> [CONFIGURE PHASE][SHUFFLE]: PLL
=================================== 
data_rate = 3200,PCW = 0X7800
=================================== 
<<<<<< [CONFIGURE PHASE][SHUFFLE]: PLL
INFO: RG_ARDQ_REV_B0_TEMP_VALUE= 0x0 
INFO: RG_ARDQ_REV_B0_TEMP_VALUE= 0x0 
INFO: RG_ARDQ_REV_B1_TEMP_VALUE= 0x0 
INFO: RG_ARDQ_REV_B1_TEMP_VALUE= 0x0 
INFO: RG_ARDQ_REV_B2_TEMP_VALUE= 0x0 
INFO: RG_ARDQ_REV_B1_TEMP_VALUE= 0x0 
INFO: RG_ARCMD_REV_TEMP_VALUE= 0x0 
INFO: RG_ARCMD_REV_TEMP_VALUE= 0x60 
>>>>>> [CONFIGURE PHASE][SHUFFLE]: ANA CLOCK DIV configuration
INFO: RG_ARDQ_REV_B0_TEMP_VALUE= 0x0 
INFO: RG_ARDQ_REV_B0_TEMP_VALUE= 0x0 PH8_DLY= 0x1f 
INFO: RG_ARDQ_REV_B1_TEMP_VALUE= 0x0 
INFO: RG_ARDQ_REV_B1_TEMP_VALUE= 0x0 PH8_DLY= 0x1f 
INFO: RG_ARDQ_REV_B2_TEMP_VALUE= 0x0 
INFO: RG_ARDQ_REV_B2_TEMP_VALUE= 0x0 PH8_DLY= 0x1f 
INFO: RG_ARCMD_REV_TEMP_VALUE= 0x60 
INFO: RG_ARCMD_REV_TEMP_VALUE= 0x60 PH8_DLY= 0x1f 
<<<<<< [CONFIGURE PHASE][SHUFFLE]: ANA CLOCK DIV configuration
>>>>>> [CONFIGURE PHASE][SHUFFLE]: DLL
INFO: RG_ARCMD_REV_TEMP_VALUE= 0x60 
INFO: RG_ARCMD_REV_TEMP_VALUE= 0x61 
<<<<<< [CONFIGURE PHASE][SHUFFLE]: DLL
[ANA_INIT] flow start 
[ANA_INIT] PLL >>>>>>>> 
[ANA_INIT] PLL <<<<<<<< 
[ANA_INIT] MIDPI >>>>>>>> 
[ANA_INIT] MIDPI <<<<<<<< 
[ANA_INIT] DLL >>>>>>>> 
[ANA_INIT] DLL <<<<<<<< 
[ANA_INIT] flow end 
[ANA_INIT] <<<<<<<<<<<<< 
[Flow] [DDRPHY] DIG_CONFIG_NONSHUF_DCM    <<<<< 
[Flow] [DDRPHY] DIG_CONFIG_NONSHUF_DCM    <<<<< 
[Flow] Enable top DCM control >>>>> 
[Flow] Enable top DCM control <<<<< 
Enable DLL master slave shuffle 
============================================================== 
Gating Mode config
============================================================== 
Config description: 
RX_GATING_MODE        0: Pulse Mode      1: Burst Mode(8UI)        2: Burst Mode(7UI)  3: Original Burst Mode
RX_GATING_TRACK_MODE  0: Valid DLY Mode  1: Valid Mode (Jade-like) 2: FIFO mode
SELPH_MODE            0: By rank         1: By Phase 
============================================================== 
GAT_TRACK_EN                 = 1
RX_GATING_MODE               = 2
RX_GATING_TRACK_MODE         = 2
SELPH_MODE                   = 1
PICG_EARLY_EN                = 1
VALID_LAT_VALUE              = 0
============================================================== 
Enter into Gating configuration >>>> 
Exit from Gating configuration <<<< 
[DIG_HW_NONSHUF_ZQCAL_CFG],Configuration Enter
[DIG_HW_NONSHUF_ZQCAL_CFG_FOR_PCDDR],Configuration Enter
[DIG_HW_NONSHUF_ZQCAL_CFG],Configuration Enter
[DIG_HW_NONSHUF_ZQCAL_CFG_FOR_PCDDR],Configuration Enter
Enter into PICG configuration >>>> 
Exit from PICG configuration <<<< 
[DIG_SHUF_CONFIG] DCM_FUNCTION >>>>>>, group_id=0 
[DIG_SHUF_CONFIG] DCM_FUNCTION <<<<<<, group_id=0 
[DIG_FREQ_CONFIG][TX_CA][Delay] ch_id:0, group_id:0 >>>>>
[DIG_FREQ_CONFIG][TX_CA][Delay] ch_id:0, group_id:0 <<<<<
[DIG_HW_SHUF_ZQCAL_CFG] Group:0, Configuration Enter
[ModeRegister CWL Config] data_rate:3200-MR_CWL:[ModeRegister CL Config] data_rate:3200-MR_CL:[ModeRegister WR Config] data_rate:3200-MR_WR:=================================== 
PCDDR4 DRAM CONFIGURATION
=================================== 
CWL      = 0x7
RTT_NORM = 0x6
CL       = 0xb
AL       = 0x0
BL       = 0x0
RBT      = 0x0
WR       = 0x8
=================================== 
[ReadLatency GET] MR_CL:[ReadLatency GET] MR_CL:UI_MCK_least is 1
RX_GW_selph_by_ps[0] is 12464
RX_GW_selph_by_ps[1] is 12464
RX_GW_selph_by_ps[2] is 12464
RX_GW_selph_by_ps[3] is 12464
=================================== 
RX_path CONFIGURATION
=================================== 
data_rate               is 3200
dq_p2s_ratio            is 8
ca_default_delay        is 1
ca_ser_latency          is 7
cs2RL_start             is 1
byte_num                is 2
rank_num                is 2
RL[0]                   is 24
RL[1]                   is 24
RL_min                  is 24
RL_max                  is 24
TDQSCK[0]               is 0
TDQSCK[1]               is 0
TDQSCK[2]               is 0
TDQSCK[3]               is 0
dqsien_default_delay    is 0
dqsien_ser_latency      is 7
oe_ser_latency          is 4
gating_window_ahead_dqs is 2
aphy_slice_delay        is 11
aphy_dtc_delay          is 100
aphy_lead_lag_margin    is 16
dram_ui_ratio           is 2
dq_ui_unit              is 312
ca_ui_unit              is 312
MCK_unit                is 2496
dramc_dram_ratio        is 4
CKR                     is 1
tRPRE_toggle            is 0
tRPRE_static            is 2
tRPST                   is 0
DQSIENMODE              is 1
BL                      is 16
FAKE_1TO16_MODE         is 0
SVA_1_10_t2_SPEC        is 11
read_cmd_out            is 1
ca_MCKIO_ui_unit        is 312
ca_p2s_ratio            is 8
TDQSCK_min_SPEC         is 0
TDQSCK_max_SPEC         is 360
TX_pipeline             is 1
RX_pipeline             is 1
NEW_RANK_MODE           is 0
close_loop_mode         is 1
=================================== 
=================================== 
RX_path RG value
=================================== 
RX_UI_P0[0]              is 15
RX_UI_P0[1]              is 15
RX_UI_P0[2]              is 15
RX_UI_P0[3]              is 15
RX_UI_P1[0]              is 19
RX_UI_P1[1]              is 19
RX_UI_P1[2]              is 19
RX_UI_P1[3]              is 19
RX_PI[0]                 is 31
RX_PI[1]                 is 31
RX_PI[2]                 is 31
RX_PI[3]                 is 31
DQSINCTL                 is 3
DATLAT_DSEL              is 11
DATLAT                   is 12
DATLAT_DSEL_PHY          is 12
DLE_EXTEND               is 1
RX_IN_GATE_EN_HEAD       is 0
RX_IN_GATE_EN_TAIL       is 0
RX_IN_BUFF_EN_HEAD       is 2
RX_IN_BUFF_EN_TAIL       is 0
RX_IN_GATE_EN_PRE_OFFSET is 2
RANKINCTL_ROOT1          is 1
RANKINCTL                is 1
RANKINCTL_STB            is 2
RANKINCTL_RXDLY          is 0
SHU_GW_THRD_POS          is 42
SHU_GW_THRD_NEG          is 0
RDSEL_TRACK_EN           is 0
RDSEL_HWSAVE_MSK         is 1
DMDATLAT_i               is 12
RODTEN                   is 0
RODT                     is 1229813737
RODTE                    is 1
RODTE2                   is 1
ODTEN_MCK_P0[4]          is 0
ODTEN_MCK_P1[4]          is 0
ODTEN_UI_P0[4]           is 0
ODTEN_UI_P1[4]           is 0
RX_RANK_DQS_LAT          is 0
RX_RANK_DQ_LAT           is 1
RANKINCTL_PHY            is 5
RANK_SEL_LAT_CA          is 0
RANK_SEL_LAT_B0          is 0
RANK_SEL_LAT_B1          is 0
RANK_SEL_STB_EN          is 0
RANK_SEL_RXDLY_TRACK     is 0
RANK_SEL_STB_TRACK       is 1
RANK_SEL_STB_PHASE_EN    is 1
RANK_SEL_PHSINCTL        is 2
RANK_SEL_STB_UI_MINUS    is 2
RANK_SEL_STB_UI_PLUS     is 0
RANK_SEL_MCK_P0          is 0
RANK_SEL_UI_P0           is 0
RANK_SEL_MCK_P1          is 1
RANK_SEL_UI_P1           is 0
R0DQSIENLLMTEN           is 1
R0DQSIENLLMT             is 96
R0DQSIENHLMTEN           is 1
R0DQSIENHLMT             is 63
R1DQSIENLLMTEN           is 1
R1DQSIENLLMT             is 96
R1DQSIENHLMTEN           is 1
R1DQSIENHLMT             is 63
DQSIEN_FIFO_DEPTH_HALF   is 1
=================================== 
[ModeRegister CWL Config] data_rate:3200-MR_CWL:[ModeRegister CL Config] data_rate:3200-MR_CL:[ModeRegister WR Config] data_rate:3200-MR_WR:=================================== 
PCDDR4 DRAM CONFIGURATION
=================================== 
CWL      = 0x7
RTT_NORM = 0x6
CL       = 0xb
AL       = 0x0
BL       = 0x0
RBT      = 0x0
WR       = 0x8
=================================== 
[WriteLatency GET] MR_CWL:[WriteLatency GET] MR_CWL:=====================================
print TX_path_config
=====================================
data_ratio                is 3200
dq_p2s_ratio              is 8
cs2WL_start               is 1
byte_num                  is 2
rank_num                  is 2
CKR                       is 1
DBI_WR                    is 0
dly_1T_by_FDIV2           is 0
WL[0]                     is 20
WL[1]                     is 20
TDQSS[0][0]               is 156
TDQSS[0][1]               is 156
TDQSS[1][0]               is 156
TDQSS[1][1]               is 156
TDQS2DQ[0][0]             is 0
TDQS2DQ[0][1]             is 0
TDQS2DQ[1][0]             is 0
TDQS2DQ[1][1]             is 0
ca_p2s_ratio              is 8
ca_default_dly            is 1
ca_default_pi             is 0
ca_ser_latency            is 7
dqs_ser_laterncy          is 7
dqs_default_dly           is 5
dqs_oe_default_dly        is 2
dq_ser_laterncy           is 7
MCK_unit                  is 2496
dq_ui_unit                is 312
ca_unit                   is 312
ca_MCKIO_unit             is 312
ca_frate                  is 0
TX_ECC                    is 0
TWPRE                     is 4
OE_pre_margin             is 400
OE_pst_margin             is 500
OE_downgrade              is 1
aphy_slice_dly            is 11
aphy_dtc_dly              is 100
aphy_tx_dly               is 16
DDRPHY_CLK_EN_COMB_TX_OPT is 1
NEW_RANK_MODE             is 0
close_loop_mode           is 1
TXP_WORKAROUND_OPT        is 0
ui2pi_ratio               is 32
XRTW2W_PI_mute_time       is 7
fake_mode                 is 0
===========================================
TX_DQ_UI_OE_pre  is 2
TX_DQS_UI_OE_pre is 1
data_ratio 3200, TX_dq_latency_ps is 8112, TX_dq_latency_MCK is 3 
data_ratio 3200, TX_dq_latency_ps is 8112, TX_dq_latency_MCK is 3 
data_ratio 3200, TX_dq_latency_ps is 8112, TX_dq_latency_MCK is 3 
data_ratio 3200, TX_dq_latency_ps is 8112, TX_dq_latency_MCK is 3 
===========================================
print TX_path_attribution
===========================================
TX_DQ_MCK_OE[0][0]                  is 2
TX_DQ_MCK_OE[0][1]                  is 2
TX_DQ_MCK_OE[1][0]                  is 2
TX_DQ_MCK_OE[1][1]                  is 2
TX_DQ_UI_OE[0][0]                   is 6
TX_DQ_UI_OE[0][1]                   is 6
TX_DQ_UI_OE[1][0]                   is 6
TX_DQ_UI_OE[1][1]                   is 6
TX_DQ_MCK[0][0]                     is 3
TX_DQ_MCK[0][1]                     is 3
TX_DQ_MCK[1][0]                     is 3
TX_DQ_MCK[1][1]                     is 3
TX_DQ_UI[0][0]                      is 2
TX_DQ_UI[0][1]                      is 2
TX_DQ_UI[1][0]                      is 2
TX_DQ_UI[1][1]                      is 2
TX_DQ_PI[0][0]                      is 0
TX_DQ_PI[0][1]                      is 0
TX_DQ_PI[1][0]                      is 0
TX_DQ_PI[1][1]                      is 0
TX_DQ_UIPI_all[0][0]                is 0
TX_DQ_UIPI_all[0][1]                is 0
TX_DQ_UIPI_all[1][0]                is 0
TX_DQ_UIPI_all[1][1]                is 0
TX_DQ_dlyline[0][0]                 is 0
TX_DQ_dlyline[0][1]                 is 0
TX_DQ_dlyline[1][0]                 is 0
TX_DQ_dlyline[1][1]                 is 0
TX_DQS_MCK_OE[0][0]                 is 2
TX_DQS_MCK_OE[0][1]                 is 2
TX_DQS_MCK_OE[1][0]                 is 2
TX_DQS_MCK_OE[1][1]                 is 2
TX_DQS_UI_OE[0][0]                  is 6
TX_DQS_UI_OE[0][1]                  is 6
TX_DQS_UI_OE[1][0]                  is 6
TX_DQS_UI_OE[1][1]                  is 6
TX_DQS_MCK[0][0]                    is 3
TX_DQS_MCK[0][1]                    is 3
TX_DQS_MCK[1][0]                    is 3
TX_DQS_MCK[1][1]                    is 3
TX_DQS_UI[0][0]                     is 1
TX_DQS_UI[0][1]                     is 1
TX_DQS_UI[1][0]                     is 1
TX_DQS_UI[1][1]                     is 1
DDRPHY_CLK_EN_COMB_TX_OPT           is 1
TX_DQS_PI[0][0]                     is 16
TX_DQS_PI[0][1]                     is 16
TX_DQS_PI[1][0]                     is 16
TX_DQS_PI[1][1]                     is 16
DDRPHY_CLK_EN_COMB_TX_PICG_CNT      is 2
DDRPHY_CLK_EN_COMB_TX_DQS_SEL_P0    is 3
DDRPHY_CLK_EN_COMB_TX_DQS_SEL_P1    is 4
DDRPHY_CLK_EN_COMB_TX_DQ_RK0_SEL_P0 is 3
DDRPHY_CLK_EN_COMB_TX_DQ_RK0_SEL_P1 is 4
DDRPHY_CLK_EN_COMB_TX_DQ_RK1_SEL_P0 is 3
DDRPHY_CLK_EN_COMB_TX_DQ_RK1_SEL_P1 is 4
DPHY_TX_DCM_EXTCNT                  is 0
TX_PI_UPD_MODE                      is 1
TX_PI_UPDCTL_B0                     is 0
TX_PI_UPDCTL_B1                     is 0
TX_RANKINCTL_ROOT                   is 0
TX_RANKINCTL                        is 1
TX_RANKINCTL_TXDLY                  is 2
DDRPHY_CLK_DYN_GATING_SEL           is 5
DDRPHY_CLK_EN_OPT                   is 1
ARPI_CMD                            is 0
TDMY                                is 9
TXOEN_AUTOSET_DQ_OFFSET             is 3
TXOEN_AUTOSET_DQS_OFFSET            is 3
TXOEN_AUTOSET_EN	                is 1
TXPICG_AUTOSET_OPT	                is 0
TXPICG_AUTOSET_EN	                is 1
TXPICG_DQ_MCK_OFFSET_LAG            is 0
TXPICG_DQS_MCK_OFFSET_LAG           is 0
TXPICG_DQ_UI_OFFSET_LEAD            is 0
TXPICG_DQ_UI_OFFSET_LAG             is 1
TXPICG_DQS_UI_OFFSET_LEAD           is 1
TXPICG_DQS_UI_OFFSET_LAG            is 0
===========================================
set APHY_PI_CKCGH_CNT is 4 when not fake_mode, cur data_rate is 3200
[DIG_SHUF_CONFIG] MISC >>>>>, group_id=0 
[DIG_SHUF_CONFIG] MISC <<<<<<, group_id=0 
[DIG_SHUF_CONFIG] DBI >>>>>>, group_id=0 
[DIG_SHUF_CONFIG] DBI <<<<<<, group_id=0 
dramc_dram_ratio: 4
DDR4_DivMode: 1
freq_index: 1600
match AC timing 1
[DDR4_ac_timing_setting]start
[PC4 WR preamble settings]>>>>>>>> group_id = 0.
[PC4 WR preamble settings]<<<<<<<< group_id = 0.
clk_dramc_ref_sel FREQ=16
fmem_ck_bfe_dcm_ch0 FREQ=253
fmem_ck_aft_dcm_ch0 FREQ=253
SetClkFreeRun enter => DRAM clock free run mode = ON.
[DDR4] Pull Down reset.
[DDR4] cke fix low 10ns at least.
[DDR4] Delay 200 us.
[DDR4] Pull Up reset.
[DDR4] Delay 500 us.
[DDR4] DRAM initilization  RK:0 Enter >>>>>>>>
[DDR4] Delay TXPR TRFC+10ns - 350ns(8Gb density)+10ns
[DDR4_MRS] RK:0-MA:2-OP:0x[DDR4_MRS] RK:0-MA:3-OP:0x[DDR4_MRS] RK:0-MA:1-OP:0x[DDR4_MRS] RK:0-MA:4-OP:0x[DDR4_MRS] RK:0-MA:5-OP:0x[DDR4] DQ Vref calibration>>>>>>>
[DDR4] DQ Vref Enable DQ vref calibration.
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4] wait tVREFDQE-150ns
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4] DQ Vref modify range and value
[DDR4] DQ Vref Exit DQ vref calibration.
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4] wait tVREFDQx-150ns
[DDR4] DQ Vref calibration<<<<<<<
[DDR4_MRS] RK:0-MA:0-OP:0x[DDR4_ZQ] RK:0  Enter >>>>>>>>
[DDR4_ZQ] RK:0  Exit <<<<<<<<
[DDR4] Delay ZQinit - 718ns for 1333 at least max(512Mck,640ns)
[DDR4] DRAM initilization  RK:0 Exit <<<<<<<
[DDR4] Enable refresh.....All bank refresh only
SetClkFreeRun enter => DRAM clock free run mode = OFF.
[DIG_HW_NONSHUF_ZQCAL_SWITCH],Configuration Enter
[DIG_HW_NONSHUF_DQSG_SWITCH],Configuration Enter
SET_CKE_2_RANK_INDEPENDENT_RUN_TIME: ON
[MiockJmeterHQA]
===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================

[DramcMiockJmeter] u1RxGatingPI = 0
0 : 2281, 2281
1 : 2271, 2271
2 : 2271, 2271
3 : 2276, 2276
4 : 2271, 2271
5 : 2272, 2272
6 : 2272, 2272
7 : 2272, 2272
8 : 2271, 2271
9 : 2271, 2271
10 : 2271, 2271
11 : 2272, 2272
12 : 2271, 2271
13 : 2271, 2271
14 : 2276, 2276
15 : 2272, 2272
16 : 2271, 2271
17 : 2267, 2267
18 : 2272, 2272
19 : 2266, 2266
20 : 2272, 2272
21 : 2271, 2271
22 : 2271, 2271
23 : 2271, 2271
24 : 2272, 2272
25 : 2271, 2271
26 : 2271, 2271
27 : 2272, 2272
28 : 2276, 2276
29 : 2271, 2271
30 : 2272, 2272
31 : 2271, 2271
32 : 2272, 2272
33 : 2271, 2271
34 : 2272, 2272
35 : 2271, 2271
36 : 2271, 1976
37 : 2271, 0
38 : 2272, 0
39 : 2271, 0
40 : 2276, 0
41 : 2271, 0
42 : 2266, 0
43 : 2272, 0
44 : 2266, 0
45 : 2267, 0
46 : 2266, 0
47 : 2271, 0
48 : 2271, 0
49 : 2271, 0
50 : 2271, 0
51 : 2271, 0
52 : 2276, 0
53 : 2272, 0
54 : 2276, 0
55 : 2271, 0
56 : 2271, 0
57 : 2272, 0
58 : 2271, 0
59 : 2276, 0
60 : 2271, 0
61 : 2271, 0
62 : 2272, 0
63 : 2271, 0
64 : 2276, 0
65 : 2271, 0
66 : 2271, 0
67 : 2276, 0
68 : 2271, 0
69 : 2276, 0
70 : 2276, 0
71 : 2271, 0
72 : 2271, 0
73 : 2271, 0
74 : 2276, 0
75 : 2271, 0
76 : 2272, 0
77 : 2271, 0
78 : 2272, 0
79 : 2276, 0
80 : 2271, 0
81 : 2272, 0
82 : 2272, 0
83 : 2271, 0
84 : 2271, 0
85 : 2271, 1417
86 : 2276, 2275
87 : 2271, 2271
88 : 2276, 2276
89 : 2271, 2271
90 : 2271, 2271
91 : 2272, 2272
92 : 2271, 2271
93 : 2271, 2271
94 : 2272, 2272
95 : 2271, 2271
96 : 2272, 2272
97 : 2271, 2271
98 : 2272, 2272
99 : 2276, 2276
100 : 2271, 2271
101 : 2271, 2271
102 : 2272, 2272
103 : 2271, 2271
104 : 2271, 2271
105 : 2271, 2271
106 : 2266, 2266
107 : 2272, 2272
108 : 2271, 2271
109 : 2272, 2272
110 : 2276, 2276
111 : 2271, 2271
112 : 2271, 2271
113 : 2271, 2271
114 : 2271, 2271
115 : 2276, 2276
116 : 2276, 2276
117 : 2271, 2271
118 : 2272, 2272
119 : 2272, 2272
120 : 2276, 2276
121 : 2272, 2272
122 : 2271, 2271
123 : 2272, 2272
124 : 2272, 2272
125 : 2271, 2271
126 : 2271, 2073
127 : 2271, 181

	MIOCK jitter meter	ch=0

1T = (127-37) = 90 dly cells
Clock freq = 1560 MHz, period = 641 ps, 1 dly cell = 712/100 ps

1 Like

----->DramcWriteLeveling(PI) begin...
===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
Begin: 0, End: 63, Step: 1, Bound: 64
[DDR4_MRS] RK:0-MA:2-OP:0x[DDR4_MRS] RK:0-MA:1-OP:0x[Write Leveling]
delay  byte0  byte1  byte2  byte3

  0      O1(  1     1   
  1      O1(  1     1   
  2      O1(  1     1   
  3      O1(  1     1   
  4      O1(  1     1   
  5      O1(  1     1   
  6      O1(  1     1   
  7      O1(  1     1   
  8      O1(  1     1   
  9      O1(  1     0   
  10      O1(  1     0   
  11      O1(  1     0   
  12      O1(  1     0   
  13      O1(  1     0   
  14      O1(  0     0   
  15      O1(  0     0   
  16      O1(  0     0   
  17      O1(  0     0   
  18      O1(  0     0   
  19      O1(  0     0   
  20      O1(  0     0   
  21      O1(  0     0   
  22      O1(  0     0   
  23      O1(  0     0   
  24      O1(  0     0   
  25      O1(  0     0   
  26      O1(  0     0   
  27      O1(  0     0   
  28      O1(  0     0   
  29      O1(  0     0   
  30      O1(  0     0   
  31      O1(  0     0   
  32      O1(  0     0   
  33      O1(  0     0   
  34      O1(  0     0   
  35      O1(  0     0   
  36      O1(  0     0   
  37      O1(  0     0   
  38      O1(  0     0   
  39      O1(  0     1   
  40      O1(  0     1   
  41      O1(  1     1   
  42      O1(  1     1   
  43      O1(  1     1   
  44      O1(  1     1   
  45      O1(  1     1   
  46      O1(  1     1   
  47      O1(  1     1   
 Early breakpass bytecount = 0xff (0xff: all bytes pass) 

[DDR4_MRS] RK:0-MA:1-OP:0x[DDR4_MRS] RK:0-MA:2-OP:0xWrite leveling (Byte 0): 41 => 41
Write leveling (Byte 1): 39 => 39
DramcWriteLeveling(PI) end<-----

===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
[Gating] SW mode calibration
[get_gating_start_pos] calculated gating ui = 15 
12 0 | B1->B0 | 1919 1515 | 1 1 | (0 0) (0 0)
12 4 | B1->B0 | 1515 1313 | 1 1 | (0 0) (0 0)
12 8 | B1->B0 | 1919 1212 | 1 1 | (1 0) (0 1)
12 12 | B1->B0 | 1111 1515 | 1 1 | (0 0) (0 1)
12 16 | B1->B0 | f0f 1212 | 1 1 | (1 1) (1 1)
12 20 | B1->B0 | 1414 1111 | 1 1 | (1 1) (1 1)
12 24 | B1->B0 | 1414 1212 | 1 1 | (1 1) (1 1)
12 28 | B1->B0 | 1414 1212 | 1 1 | (0 0) (1 1)
13 0 | B1->B0 | 1111 1212 | 0 0 | (1 1) (1 1)
13 4 | B1->B0 | 1414 1212 | 1 1 | (0 0) (1 1)
13 8 | B1->B0 | 2121 2323 | 1 1 | (0 0) (0 0)
13 12 | B1->B0 | 2222 2323 | 1 1 | (0 0) (0 0)
13 16 | B1->B0 | 2222 2323 | 1 1 | (0 0) (0 0)
13 20 | B1->B0 | 2222 2323 | 1 1 | (1 1) (0 0)
13 24 | B1->B0 | 2222 2323 | 1 1 | (0 0) (0 0)
13 28 | B1->B0 | 2222 2323 | 1 1 | (0 0) (0 0)
14 0 | B1->B0 | 2222 2323 | 1 1 | (1 1) (0 0)
14 4 | B1->B0 | 2121 2323 | 1 1 | (1 1) (0 0)
14 8 | B1->B0 | 1f1f 2323 | 1 1 | (0 0) (0 0)
14 12 | B1->B0 | 2121 2323 | 0 0 | (1 1) (0 1)
14 16 | B1->B0 | 1d1d 2222 | 1 1 | (0 0) (0 1)
14 20 | B1->B0 | 2121 2222 | 0 0 | (1 1) (1 1)
14 24 | B1->B0 | 1f1f 2222 | 1 1 | (0 0) (1 1)
14 28 | B1->B0 | 2020 2222 | 0 0 | (1 1) (0 0)
15 0 | B1->B0 | 2222 2323 | 0 0 | (1 1) (1 1)
15 4 | B1->B0 | 2222 2222 | 0 0 | (1 1) (1 1)
15 8 | B1->B0 | 2222 2323 | 0 0 | (1 1) (1 1)
15 12 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
15 16 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
15 20 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
15 24 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
15 28 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
16 0 | B1->B0 | 2323 2323 | 0 0 | (0 0) (1 1)
16 4 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
16 8 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
16 12 | B1->B0 | 2323 2323 | 0 0 | (1 1) (0 1)
16 16 | B1->B0 | 2323 2323 | 0 0 | (1 1) (0 1)
16 20 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
16 24 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
16 28 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 0 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 4 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 8 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 12 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 16 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 20 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 24 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
17 28 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
18 0 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
18 4 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 1)
18 8 | B1->B0 | 2323 2323 | 0 0 | (1 1) (1 0)
18 12 | B1->B0 | 2323 2323 | 0 0 | (0 0) (1 0)
18 16 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
18 20 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
18 24 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
18 28 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
19 0 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
19 4 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
19 8 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
19 12 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
best dqsien dly found for B1: (18, 10)
19 16 | B1->B0 | 2323 2323 | 0 0 | (0 0) (0 0)
best dqsien dly found for B0: (18, 10)
best DQS0 dly(UI, PI) = (18, 10)
best DQS1 dly(UI, PI) = (18, 10)

[Gating] SW calibration Done
[DDR4_MRS] RK:0-MA:3-OP:0x===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
Start DQ dly to find pass range UseTestEngine =0
UseTestEngine: 0
RX Vref Scan: 0

RX Vref 0 -> 0, step: 1

RX Delay -48 -> 63, step: 4
-48, [0] xxxxxxxx xxxxxxxx [MSB]
-44, [0] xxxxxxxx xxxxxxxx [MSB]
-40, [0] xxxxxxxx xxxxxxxx [MSB]
-36, [0] xxxxxxxx xxxxxxxx [MSB]
-32, [0] xxxxxxxx xxxxxxxx [MSB]
-28, [0] xxxxxxxx xxxxxxxx [MSB]
-24, [0] xxxxxxxx xxxxxxxx [MSB]
-20, [0] xxxxxxxx xxxxxxxx [MSB]
-16, [0] xxxxxxxx xxxxxxxx [MSB]
-12, [0] xxxxxxxx xxxxxxxx [MSB]
-8, [0] xxxxxxxx xxxxxxxx [MSB]
-4, [0] xxxxxxox xxxxxxxx [MSB]
0, [0] xxoxoxox xxxxxxxx [MSB]
4, [0] oxoooooo oxoxoooo [MSB]
8, [0] oooooooo oooooooo [MSB]
12, [0] oooooooo oooooooo [MSB]
16, [0] oooooooo oooooooo [MSB]
20, [0] oooooooo oooooooo [MSB]
24, [0] oooooooo oooooooo [MSB]
28, [0] oooooooo oooooooo [MSB]
32, [0] oooooooo oooooooo [MSB]
36, [0] ooxoooxo oooooooo [MSB]
40, [0] ooxoxoxo ooooxooo [MSB]
44, [0] xoxxxxxx xoxxxxxx [MSB]
48, [0] xxxxxxxx xxxxxxxx [MSB]
RX Vref B0= 0, Window Sum 316, worse bit 2, min window 36
iDelay=48, Bit 0, Center 23 (4 ~ 43) 40
iDelay=48, Bit 1, Center 27 (8 ~ 47) 40
iDelay=48, Bit 2, Center 17 (0 ~ 35) 36
iDelay=48, Bit 3, Center 23 (4 ~ 43) 40
iDelay=48, Bit 4, Center 19 (0 ~ 39) 40
iDelay=48, Bit 5, Center 23 (4 ~ 43) 40
iDelay=48, Bit 6, Center 15 (-4 ~ 35) 40
iDelay=48, Bit 7, Center 23 (4 ~ 43) 40
RX Vref B1= 0, Window Sum 312, worse bit 11, min window 36
iDelay=48, Bit 8, Center 23 (4 ~ 43) 40
iDelay=48, Bit 9, Center 27 (8 ~ 47) 40
iDelay=48, Bit 10, Center 23 (4 ~ 43) 40
iDelay=48, Bit 11, Center 25 (8 ~ 43) 36
iDelay=48, Bit 12, Center 21 (4 ~ 39) 36
iDelay=48, Bit 13, Center 23 (4 ~ 43) 40
iDelay=48, Bit 14, Center 23 (4 ~ 43) 40
iDelay=48, Bit 15, Center 23 (4 ~ 43) 40
[DDR4_MRS] RK:0-MA:3-OP:0x===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
DQS Delay:
DQS0 = 0, DQS1 = 0
DQM Delay:
DQM0 = 21, DQM1 = 23
DQ Delay:
DQ0 =23, DQ1 =27, DQ2 =17, DQ3 =23
DQ4 =19, DQ5 =23, DQ6 =15, DQ7 =23
DQ8 =23, DQ9 =27, DQ10 =23, DQ11 =25
DQ12 =21, DQ13 =23, DQ14 =23, DQ15 =23


===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
[TxWindowPerbitCal] caltype:2 Autok:0


	TX Vref Scan disable
807 |3 0 39|[0] xxxxxxox xxxxxxxx [MSB]
809 |3 0 41|[0] xxoxxxox xxxxoxxx [MSB]
811 |3 0 43|[0] xxoxxxox oooooooo [MSB]
813 |3 0 45|[0] oxoxoxox oooooooo [MSB]
815 |3 0 47|[0] oxoxoxoo oooooooo [MSB]
827 |3 0 59|[0] oooooooo ooxxoooo [MSB]
829 |3 0 61|[0] oooooooo ooxxxooo [MSB]
831 |3 0 63|[0] oooooooo ooxxxxxx [MSB]
833 |3 2 1|[0] xoxoxoxo xxxxxxxx [MSB]
835 |3 2 3|[0] xxxxxxxo xxxxxxxx [MSB]
837 |3 2 5|[0] xxxxxxxx xxxxxxxx [MSB]
TX Bit0 (813~831) 20 822,   Bit8 (811~831) 22 821,
TX Bit1 (817~833) 18 825,   Bit9 (811~831) 22 821,
TX Bit2 (809~831) 24 820,   Bit10 (811~825) 16 818,
TX Bit3 (817~833) 18 825,   Bit11 (811~825) 16 818,
TX Bit4 (813~831) 20 822,   Bit12 (809~827) 20 818,
TX Bit5 (817~833) 18 825,   Bit13 (811~829) 20 820,
TX Bit6 (807~831) 26 819,   Bit14 (811~829) 20 820,
TX Bit7 (815~835) 22 825,   Bit15 (811~829) 20 820,

 == TX Byte 0 ==
Update DQ  dly =822 (3 ,0, 54)  DQ  OEN =(2 ,5)
Update DQM dly =822 (3 ,0, 54)  DQM OEN =(2 ,5)

 == TX Byte 1 ==
Update DQ  dly =819 (3 ,0, 51)  DQ  OEN =(2 ,5)
Update DQM dly =819 (3 ,0, 51)  DQM OEN =(2 ,5)

===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
[TxWindowPerbitCal] caltype:0 Autok:0
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 3
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 5
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 7
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 9
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 11
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 13
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 15
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 17
TX Vref=3, minBit 1, minWin=16, winSum=294
TX Vref=5, minBit 10, minWin=16, winSum=300
TX Vref=7, minBit 10, minWin=16, winSum=304
TX Vref=9, minBit 10, minWin=16, winSum=312
TX Vref=11, minBit 10, minWin=16, winSum=316
TX Vref=13, minBit 10, minWin=17, winSum=325
TX Vref=15, minBit 10, minWin=17, winSum=329
TX Vref=17, minBit 10, minWin=17, winSum=333
[TxChooseVref] Worse bit 10, Min win 17, Win sum 333, Final Vref 17
[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DDR4_MRS] RK:0-MA:6-OP:0x[DramcTXSetVref] TX Vref : CH0 Rank0, TX Range 1 Vref 17

Final TX Range 1 Vref 17

===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
[TxWindowPerbitCal] caltype:0 Autok:0


	TX Vref Scan disable
807 |3 0 39|[0] xxxxxxxx xxxxxxxx [MSB]
808 |3 0 40|[0] xxxxxxxx xxxxxxxx [MSB]
809 |3 0 41|[0] xxxxxxox xxxxoxxx [MSB]
810 |3 0 42|[0] xxoxxxox oooooooo [MSB]
811 |3 0 43|[0] xxoxxxox oooooooo [MSB]
812 |3 0 44|[0] oxoxoxox oooooooo [MSB]
813 |3 0 45|[0] oxoxoxox oooooooo [MSB]
814 |3 0 46|[0] oxoxooox oooooooo [MSB]
815 |3 0 47|[0] oxoooooo oooooooo [MSB]
827 |3 0 59|[0] oooooooo ooxooooo [MSB]
828 |3 0 60|[0] oooooooo ooxxoooo [MSB]
829 |3 0 61|[0] oooooooo ooxxxooo [MSB]
830 |3 0 62|[0] oooooooo ooxxxooo [MSB]
831 |3 0 63|[0] oooooooo ooxxxooo [MSB]
832 |3 2 0|[0] xoooooxo ooxxxxxx [MSB]
833 |3 2 1|[0] xoxoxoxo xxxxxxxx [MSB]
834 |3 2 2|[0] xoxoxoxo xxxxxxxx [MSB]
835 |3 2 3|[0] xxxxxxxo xxxxxxxx [MSB]
836 |3 2 4|[0] xxxxxxxo xxxxxxxx [MSB]
837 |3 2 5|[0] xxxxxxxx xxxxxxxx [MSB]
TX Bit0 (812~831) 20 821,   Bit8 (810~832) 23 821,
TX Bit1 (816~834) 19 825,   Bit9 (810~832) 23 821,
TX Bit2 (810~832) 23 821,   Bit10 (810~826) 17 818,
TX Bit3 (815~834) 20 824,   Bit11 (810~827) 18 818,
TX Bit4 (812~832) 21 822,   Bit12 (809~828) 20 818,
TX Bit5 (814~834) 21 824,   Bit13 (810~831) 22 820,
TX Bit6 (809~831) 23 820,   Bit14 (810~831) 22 820,
TX Bit7 (815~836) 22 825,   Bit15 (810~831) 22 820,

[TX_PER_BIT_DELAY_CELL] DelayCellTimex100 =712/100 ps
 == TX Byte 0 ==
u2DelayCellOfst[0]=1 cells (1 PI)
u2DelayCellOfst[1]=6 cells (5 PI)
u2DelayCellOfst[2]=1 cells (1 PI)
u2DelayCellOfst[3]=5 cells (4 PI)
u2DelayCellOfst[4]=2 cells (2 PI)
u2DelayCellOfst[5]=5 cells (4 PI)
u2DelayCellOfst[6]=0 cells (0 PI)
u2DelayCellOfst[7]=6 cells (5 PI)
Update DQ  dly =820 (3 ,0, 52)  DQ  OEN =(2 ,5)
Update DQM dly =822 (3 ,0, 54)  DQM OEN =(2 ,5)

 == TX Byte 1 ==
u2DelayCellOfst[8]=4 cells (3 PI)
u2DelayCellOfst[9]=4 cells (3 PI)
u2DelayCellOfst[10]=0 cells (0 PI)
u2DelayCellOfst[11]=0 cells (0 PI)
u2DelayCellOfst[12]=0 cells (0 PI)
u2DelayCellOfst[13]=2 cells (2 PI)
u2DelayCellOfst[14]=2 cells (2 PI)
u2DelayCellOfst[15]=2 cells (2 PI)
Update DQ  dly =818 (3 ,0, 50)  DQ  OEN =(2 ,5)
Update DQM dly =819 (3 ,0, 51)  DQM OEN =(2 ,5)

===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
DATLAT Default: 0xc
0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0x10, 0x11, 0x12, 0x13, 0xbest_step = 11

===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
Start DQ dly to find pass range UseTestEngine =1
UseTestEngine: 1
RX Vref Scan: 1

Set Vref Range= 9 -> 21

RX Vref 9 -> 21, step: 1

RX Delay -14 -> 63, step: 2

Set Vref, RX VrefLevel [Byte0]: 9 [Byte1]: 9
RX Vref B0= 9, Window Sum 218, worse bit 2, min window 26
RX Vref B1= 9, Window Sum 202, worse bit 10, min window 22

Set Vref, RX VrefLevel [Byte0]: 10 [Byte1]: 10
RX Vref B0= 10, Window Sum 228, worse bit 1, min window 28
RX Vref B1= 10, Window Sum 218, worse bit 8, min window 26

Set Vref, RX VrefLevel [Byte0]: 11 [Byte1]: 11
RX Vref B0= 11, Window Sum 234, worse bit 2, min window 28
RX Vref B1= 11, Window Sum 222, worse bit 10, min window 26

Set Vref, RX VrefLevel [Byte0]: 12 [Byte1]: 12
RX Vref B0= 12, Window Sum 248, worse bit 0, min window 30
RX Vref B1= 12, Window Sum 238, worse bit 10, min window 28

Set Vref, RX VrefLevel [Byte0]: 13 [Byte1]: 13
RX Vref B0= 13, Window Sum 254, worse bit 1, min window 30
RX Vref B1= 13, Window Sum 240, worse bit 10, min window 28

Set Vref, RX VrefLevel [Byte0]: 14 [Byte1]: 14
RX Vref B0= 14, Window Sum 256, worse bit 3, min window 30
RX Vref B1= 14, Window Sum 250, worse bit 10, min window 28

Set Vref, RX VrefLevel [Byte0]: 15 [Byte1]: 15
RX Vref B0= 15, Window Sum 272, worse bit 3, min window 32
RX Vref B1= 15, Window Sum 258, worse bit 10, min window 30

Set Vref, RX VrefLevel [Byte0]: 16 [Byte1]: 16
RX Vref B0= 16, Window Sum 278, worse bit 1, min window 34
RX Vref B1= 16, Window Sum 264, worse bit 8, min window 32

Set Vref, RX VrefLevel [Byte0]: 17 [Byte1]: 17
RX Vref B0= 17, Window Sum 282, worse bit 2, min window 34

Set Vref, RX VrefLevel [Byte0]: 18 [Byte1]: 18
RX Vref B1= 18, Window Sum 274, worse bit 10, min window 32

Set Vref, RX VrefLevel [Byte0]: 19 [Byte1]: 19

Set Vref, RX VrefLevel [Byte0]: 20 [Byte1]: 20

Set Vref, RX VrefLevel [Byte0]: 21 [Byte1]: 21

Final RX Vref Byte 0 = 17 to rank0 to rank1

Final RX Vref Byte 1 = 18 to rank0 to rank1
===============================================================================
Dram Type= 4, Freq= 1600, CH_0, rank 0
fsp= 0, odt_onoff= 1, Byte mode= 0, DivMode= 1
===============================================================================
DQS Delay:
DQS0 = 0, DQS1 = 0
DQM Delay:
DQM0 = 21, DQM1 = 24
DQ Delay:
DQ0 =23, DQ1 =27, DQ2 =18, DQ3 =24
DQ4 =20, DQ5 =23, DQ6 =15, DQ7 =23
DQ8 =24, DQ9 =25, DQ10 =23, DQ11 =27
DQ12 =22, DQ13 =25, DQ14 =22, DQ15 =25


[DualRankRxdatlatCal] RK0: 11, RK1: 0, Final_Datlat 11


[Calibration Summary] Freqency 1600
CH 0, Rank 0
SW Impedance     : PASS
DUTY Scan        : NO K
ZQ Calibration   : PASS
Jitter Meter     : NO K
CBT Training     : NO K
Write leveling   : PASS
RX DQS gating    : PASS
RX DQ/DQS(RDDQC) : PASS
TX DQ/DQS        : PASS
RX DATLAT        : PASS
RX DQ/DQS(Engine): PASS
TX OE            : NO K
All Pass.

TX_TRACKING: OFF
[AUTO] write start address pass, BASE_ADDR : 0x0, OFFSET : 0x3
[AUTO] Detect DramSize: 0x8000000
[AUTO] BASE_ADDR : 0x8000000, OFFSET : 0x3
[AUTO] BASE_ADDR : 0x0, OFFSET : 0x3


[AUTO] Detect DramSize: 0x10000000
[AUTO] BASE_ADDR : 0x10000000, OFFSET : 0x3
[AUTO] BASE_ADDR : 0x0, OFFSET : 0x3


[AUTO] Detect DramSize: 0x20000000
[AUTO] BASE_ADDR : 0x20000000, OFFSET : 0x3
[AUTO] BASE_ADDR : 0x0, OFFSET : 0x3
[AUTO] TA2 read check fail, u4err_value = 65535, 3
[AUTO] Detect full size


u4DramSize 0x20000000
NOTICE:  EMI: Detected DRAM size: 512MB

[MEM_TEST] 02: After DFS, before run time config
[MEM_TEST] Rank 0 OK.(uiFixedAddr 0x40000000, Pass count = 16384, Fail count = 0)

[TA2_TEST]
=== TA2 HW
=== OFFSET:0x200
TA2 PAT: 3

TA2 Trigger Write
HW channel(0) Rank(0), TA2 pass, pass_cnt:1, err_cnt:0
[DramcRunTimeConfig]: ON
PHYPLL
DPM_CONTROL_AFTERK: ON
PER_BANK_REFRESH: OFF
REFRESH_OVERHEAD_REDUCTION: ON
CMD_PICG_NEW_MODE: OFF
TX_TRACKING: OFF
RDSEL_TRACKING: OFF
DQS Precalculation for DVFS: OFF
RX_TRACKING: OFF
DDR_HW_GATING DBG: ON
DDR_ZQCS_ENABLE: ON
RX_PICG_NEW_MODE: ON
TX_PICG_NEW_MODE: ON
ENABLE_RX_DCM_DPHY: ON
LOWPOWER_GOLDEN_SETTINGS(DCM): ON
DUMMY_READ_FOR_TRACKING: OFF
!!! SPM_CONTROL_AFTERK: OFF
!!! SPM could not control APHY
IMPEDANCE_TRACKING: OFF
HW_SAVE_FOR_SR: OFF
CLK_FREE_FUN_FOR_DRAMC_PSEL: OFF
PA_IMPROVEMENT_FOR_DRAMC_ACTIVE_POWER: OFF
Read ODT Tracking: OFF
Refresh Rate DeBounce: OFF
DFS_NO_QUEUE_FLUSH: OFF
DFS_NO_QUEUE_FLUSH_LATENCY_CNT: OFF
ENABLE_DFS_RUNTIME_MRW: OFF
DDR_RESERVE_NEW_MODE: ON
=========================

[MEM_TEST] 03: After run time config
[MEM_TEST] Rank 0 OK.(uiFixedAddr 0x40000000, Pass count = 16384, Fail count = 0)

[TA2_TEST]
=== TA2 HW
=== OFFSET:0x200

TA2 Trigger Write
HW channel(0) Rank(0), TA2 pass, pass_cnt:2, err_cnt:0

Init_DRAM:2480: init PCDDR4 dram End
EMI: complex real chip dram calibration
Verify pattern 1 (0x00~0xff)...
EMI: mem8_base[0] = pattern8 = 0x0
Verify pattern 2 (0x00~0xffff)...
EMI: mem16_base[0] = pattern16 = 0x0
Verify pattern 3 (0x00~0xffffffff)...
EMI: mem32_base[0] = pattern32 = 0x0
NOTICE:  EMI: complex R/W mem test passed

drm_dram_reserved: MTK_DRM_MODE(22000000)

NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0x0
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 1023 [0x07fe0000]
NOTICE:  First info table with writecount 0 found in block 960
NOTICE:  Second info table with writecount 0 found in block 963
NOTICE:  NMBM has been successfully attached in read-only mode
INFO:    BL2: Loading image id 3
INFO:    Loading image id=3 at address 0x42000000
INFO:    Image id=3 loaded: 0x42000000 - 0x42009061
INFO:    BL2: Loading image id 5
INFO:    Loading image id=5 at address 0x42000000
INFO:    Image id=5 loaded: 0x42000000 - 0x420ae288
NOTICE:  BL2: Booting BL31
INFO:    Entry point address = 0x43001000
INFO:    SPSR = 0x3cd
INFO:    Total CPU count: 4
INFO:    MCUSYS: Disable 512KB L2C shared SRAM
INFO:    check_ver = 0
INFO:    Secondary bootloader is AArch64
INFO:    GICv3 without legacy support detected.
INFO:    ARM GICv3 driver initialized in EL3
INFO:    Maximum SPI INTID supported: 671
INFO:    SPMC: Changed to SPMC mode
NOTICE:  BL31: v2.6(release):2598dbc2a6-dirty
NOTICE:  BL31: Built : 13:34:54, Mar 12 2022
INFO:    [MPU](Region0)sa:0x0300, ea:0x0302
INFO:    [MPU](Region0)apc0:0x80b6db69, apc1:0x00b6db6d
INFO:    [MPU](Region1)sa:0x0000, ea:0x0000
INFO:    [MPU](Region1)apc0:0x00000000, apc1:0x00000000
INFO:    [MPU](Region2)sa:0x0000, ea:0x0000
INFO:    [MPU](Region2)apc0:0x00000000, apc1:0x00000000
INFO:    [MPU](Region3)sa:0x0000, ea:0x0000
INFO:    [MPU](Region3)apc0:0x00000000, apc1:0x00000000
INFO:    [DEVAPC] devapc_init done
INFO:    BL31: Initializing runtime services
INFO:    BL31: Preparing for EL3 exit to normal world
INFO:    Entry point address = 0x41e00000
INFO:    SPSR = 0x3c9


2 Likes

It's hard to open case. The back side nails are really hard to open.
So I located UART port from internal pictures (at bottom of 3.rd antenna) and use attaches to reach the UART port.

Unfortunately, It looks like shell is disabled completely. No echo available at screen...
Does this router is NO GO for OpenWRT?

2 Likes

Thanks for sharing @EUA. This is super interesting. Doesn't look like it's using u-boot at first glance which is already going to make things harder. It also looks like it's a 3-stage bootloader (BL1 doesn't seem to appear anywhere in the log you shared).

Some questions:

  • You didn't see anywhere to stop or interrupt the boot process?
  • No echo or login is protected? Did you make it to a login prompt? It could be that your TX line is bad or contacting the wrong pin - I'd double check that to verify.

I'll be back shortly with some more comments.

1 Like

Okay so, this looks like Arm Trusted Firmware: https://trustedfirmware-a.readthedocs.io/en/latest/design/firmware-design.html

The TL;DR is if they did it right, probably game over. I'm not super well versed here but from what I understand it's not easy to get around. The flash chip they use is also a WSON package which is painful to clip to and dump without desoldering (meaning dumping the firmware is going to be a lot harder/more tedious).

You could try looking for some pads near the flash chip (it's at the top right next to UART) and try grounding them while booting. Sometimes you can drop into the bootloader's console if it can't find anything to boot and then you may be able to poke around there.

1 Like

U-Boot should be later on in the log there, but it looks like they cut it off just before that. They're almost certainly using it, as they still have the boot logic based on the env variables partition they need to handle.

UART is typically ignored within Xiaomi stock roms without the env var uart_en=1, and their u-boot are set by default to instantly boot without chance to interrupt. Ie. boot_wait=off

The presence of ATF does not imply secure boot, as basically all their modern arm stuff will be using it in some manner for hardware init and memory training as seen here.

I mean they could, it's just not something you could declare from just looking at that boot log. And despite how noisy the memory training and init stage is, I don't seem to see anything printed regarding actual boot chain verification...

1 Like

True they very well could be and the bootlog was inconclusive. I have seen some (rare) devices not use u-boot and I have a hard time imagining they don't. So unless we can double check with @EUA's device, I'll have to wait till (if) mine arrives. I suppose the existence of the FIP partition would make me reconsider and lean more towards the side that u-boot does exist on it.

Yeah this is my first Xiaomi device. I'm not used to them yet but this is what I've seen grazing through the forums here. Not sure if anyone has ever tried shorting flash pads to try to kick the bootloader into the console when it fails to find an image.

Thanks for pointing that out! Learn something new every day. The only reason I suggested this is because one device I've looked at in the past that has ATF fully implemented stopped printing to the console roughly around the same stage (where you'd expect U-Boot to shine). Not sure if that's at all related, just where my head was going. Yeah we'd probably see something relevant to verification here if it was.

Boot is quick. Not waits somewhere. I press esc-enter and many keys to interrupt but...
I am www.samygo.tv hacker. Could de-solder wson packages also :slight_smile: but not willing to do it right now. Might be xiaomi release a development firmware to allow us ssh :roll_eyes: soon.

Have you checked if the FW came with telnet or SSH open?

Definitely. And connection rejected. Also tried some telnet/ssh enable code by WebUI injection but they doesn't work.

They run most of the obvious stuff through sanitization functions in XQFunction.lua

Note that the majority of the lua is obfuscated.

There's the odd file that it'll trip over because they occassionally have the whole #!/bin/lua interpreter directive a the top before bytecode, but you can trim that out in a few lines of changes if needed. (In case you wanted to batch process all the lua)

I suspect most of the command injection vulnerabilities will most likely exist in the interaction with helper binaries and shell scripts.

However, I still suspect glitching out u-boot during recovery flash is unfixed and probably worth testing before devoting hours of static analysis looking for a lua bug.

1 Like

I'd agree. I've never touched lua in my life so if all else fails, someone else may have to take this challenge on. FWIW, my device is still stuck presumably in customs. Dunno if it'll ever come out.