Add OpenWrt support for Xiaomi "Redmi AX6000"

It's based on 18.06.0 so you may be able to set up the appropriate opkg sources and install it that way. Otherwise, wait for a real OpenWrt image. Think (slightly over) the majority of the heavy lifting is done here.

I'm looking forward to the real openwrt image. I just read about xiaomi ax6000 (not redmi) that there is no free space and there is no way to delete something due to the read-only system partition. When my redmi AX6000 comes to me, I will definitely try to install openvpn. Thank you.

Does not allow to install openvpn, says there is no free space. I will be waiting for the real openwrt image.

root@XiaoQiang:~# opkg install openvpn-openssl openvpn-easy-rsa
Installing openvpn-openssl (2.4.5-4.2) to root...
Installing openvpn-easy-rsa (3.0.4-1) to root...
Collected errors:
 * verify_pkg_installable: Only have 0kb available on filesystem /overlay, pkg openvpn-openssl needs 180
 * opkg_install_cmd: Cannot install package openvpn-openssl.
 * verify_pkg_installable: Only have 0kb available on filesystem /overlay, pkg openvpn-easy-rsa needs 17
 * opkg_install_cmd: Cannot install package openvpn-easy-rsa.

you have to mount overlay first.
here's tutorial(not tested on AX6000 yet):
https://www.right.com.cn/forum/thread-4060726-1-1.html

in case you don't understand Chinese, here's translation:

  1. create /etc/init.d/miwifi_overlay with contents below (vi /etc/init.d/miwifi_overlay, i, paste, :wq)
#!/bin/sh /etc/rc.common

START=00

. /lib/functions/preinit.sh

start() {
        [ -e /data/overlay ] || mkdir /data/overlay
        [ -e /data/overlay/upper ] || mkdir /data/overlay/upper
        [ -e /data/overlay/work ] || mkdir /data/overlay/work

        mount --bind /data/overlay /overlay
        fopivot /overlay/upper /overlay/work /rom 1

        #Fixup miwifi misc, and DO NOT use /overlay/upper/etc instead, /etc/uci-defaults/* may be already removed
        /bin/mount -o noatime,move /rom/data /data 2>&-
        /bin/mount -o noatime,move /rom/etc /etc 2>&-
        /bin/mount -o noatime,move /rom/ini /ini 2>&-
        /bin/mount -o noatime,move /rom/userdisk /userdisk 2>&-

        return 0
}

2.chmod 755 /etc/init.d/miwifi_overlay
3. /etc/init.d/miwifi_overlay enable
4. sync
5. reboot
after reboot, you may able to use opkg install. if you update firmware, you should repeat steps above

2 Likes

This looks like a ton of progress. It's probably time to finally replace my tried-and-true WRT1900AC. I'm thinking of getting myself an AX6000 as it seems to be the best device available today, with a good perspective to run OpenWrt in the near future.

Unfortunately, I'm not a developer by any means, and my Linux knowledge is limited. But I'm used to running trunk builds (when created by others) and hopefully will be able to help with testing and validation.

1 Like

Can it change to US country code for higher tx power?

I got it starting to boot a dedicated build, however it appears to have issues with pcie. Likely a dts issue :confused:

   0.860083] pstore: Using crash dump compression: deflate
[    0.869863] mtk-pcie-gen3 11280000.pcie: host bridge /soc/pcie@11280000 ranges:
[    0.877201] mtk-pcie-gen3 11280000.pcie: Parsing ranges property...
[    0.883457] mtk-pcie-gen3 11280000.pcie:      MEM 0x0020000000..0x002fffffff -> 0x0020000000
[    1.103091] mtk-pcie-gen3 11280000.pcie: PCIe link down, ltssm reg val: 0x1000001
[    1.110586] mtk-pcie-gen3: probe of 11280000.pcie failed with error -110
[    1.134928] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000ac
[    1.143703] Mem abort info:
[    1.146483]   ESR = 0x96000005
[    1.149523]   EC = 0x25: DABT (current EL), IL = 32 bits
[    1.151516] mt7530 mdio-bus:00: configuring for fixed/2500base-x link mode
[    1.154816]   SET = 0, FnV = 0
[    1.154818]   EA = 0, S1PTW = 0
[    1.154819]   FSC = 0x05: level 1 translation fault
[    1.154822] Data abort info:
[    1.154823]   ISV = 0, ISS = 0x00000005
[    1.154825]   CM = 0, WnR = 0
[    1.154826] [00000000000000ac] user address but active_mm is swapper
[    1.154830] Internal error: Oops: 96000005 [#1] SMP
[    1.162116] mt7530 mdio-bus:00: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    1.164719] Modules linked in:
[    1.164724] CPU: 0 PID: 286 Comm: irq/69-mt7530 Not tainted 5.15.64 #0
[    1.171458] mt7530 mdio-bus:00 wan (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=127)
[    1.172706] Hardware name: Xiaomi Redmi Router AX6000 (DT)
[    1.185499] mt7530 mdio-bus:00 lan1 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=128)
[    1.188663] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    1.203161] mt7530 mdio-bus:00 lan2 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=129)
[    1.203752] pc : handle_nested_irq+0x34/0x1c0
[    1.219896] mt7530 mdio-bus:00 lan3 (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7531 PHY] (irq=130)
[    1.220053] lr : handle_nested_irq+0x14/0x1c0
[    1.226428] DSA: tree 0 setup
[    1.235401] sp : ffffffc00d89bd30
[    1.235403] x29: ffffffc00d89bd30 x28: ffffff80000542e0 x27: 0000000000000000
[    1.235409] x26: ffffff80000542ac x25: ffffffc008087454 x24: ffffff80051cf600
[   1.291251] x23: 00000000000000ac x22: ffffff80008ce540 x21: 0000000000000008
[    1.291488] Freeing unused kernel memory: 448K
[    1.298284] x20: 0000000000000000 x19: 0000000000000003 x18: 00000000bbc363b3
[    1.298290] x17: 0000000000000005 x16: 0000000000000001 x15: 0000000000000000
[    1.298295] x14: 0000000000000000 x13: ffffffc008827660 x12: 00000000fa83b2da
[    1.324048] x11: 0000000000000040 x10: ffffffc008b4a2a8 x9 : ffffffc008b4a2a0
[    1.331164] x8 : ffffff8000400270 x7 : 0000000000000000 x6 : 0000000000000000
[    1.338280] x5 : ffffff8000400248 x4 : ffffff8000400270 x3 : 0000000000000000
[    1.345395] x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000000
[    1.352510] Call trace:
[    1.354942]  handle_nested_irq+0x34/0x1c0
[    1.358936]  mt7530_irq_thread_fn+0x98/0xa0
[    1.363106]  irq_thread_fn+0x28/0x8c
[    1.366666]  irq_thread+0x118/0x220
[    1.370138]  kthread+0x11c/0x130
[    1.373355]  ret_from_fork+0x10/0x20
[    1.376919] Code: d2800000 9102b297 52800022 f98002f1 (885ffee1) 
[    1.382992] ---[ end trace 2d60a5c2f4f20605 ]---
[    1.389212] Kernel panic - not syncing: Oops: Fatal exception
[    1.394937] SMP: stopping secondary CPUs
[    1.398844] Kernel Offset: disabled
[    1.402316] CPU features: 0x00000000,20000802
[    1.406656] Memory Limit: none
[    1.411322] Rebooting in 1 seconds..

Was an issue with my eth node. Got it booted without that. Need to correct it.

2 Likes

Unfortunately this is right about the part where I completely fall off. I'm far too inexperienced to finish the device tree source as most resources online say "find a similar device and work with it". Doesn't really fly too well with this one as only the BPI R3 is really similar, and I can't find much detailed documentation for beginners. If someone is willing to teach me the process of creating one from scratch, I'm all ears.

Anyways, you can build an image from here, just make menuconfig and select Mediatek ARM arch, Filogic 830 target and Xiaomi Redmi AX6000 device then make it. After rooting the device as described here or here, reboot and connect serial console. Hold your keyboard's down arrow key to pop into u-boot and then press the bottom entry. Press another key to stop autoboot.

Connect a tftp server with the initramfs image you build and tftpboot then bootm the image. It should boot into vanilla OpenWrt (albeit with almost no hardware available as the device tree is broken). You may get one ethernet port up.

Enjoy!

root@OpenWrt:/# ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP qlen 1000
    link/ether fe:a5:d4:ec:b4:11 brd ff:ff:ff:ff:ff:ff
root@OpenWrt:/# uname -a
Linux OpenWrt 5.15.64 #0 SMP Fri Sep 9 00:53:15 2022 aarch64 GNU/Linux
root@OpenWrt:/# cat /etc/os-release 
NAME="OpenWrt"
VERSION="SNAPSHOT"
ID="openwrt"
ID_LIKE="lede openwrt"
PRETTY_NAME="OpenWrt SNAPSHOT"
VERSION_ID="snapshot"
HOME_URL="https://openwrt.org/"
BUG_URL="https://bugs.openwrt.org/"
SUPPORT_URL="https://forum.openwrt.org/"
BUILD_ID="r20537-7c92b99da8"
OPENWRT_BOARD="mediatek/filogic"
OPENWRT_ARCH="aarch64_cortex-a53"
OPENWRT_TAINTS="no-all"
OPENWRT_DEVICE_MANUFACTURER="OpenWrt"
OPENWRT_DEVICE_MANUFACTURER_URL="https://openwrt.org/"
OPENWRT_DEVICE_PRODUCT="Generic"
OPENWRT_DEVICE_REVISION="v0"
OPENWRT_RELEASE="OpenWrt SNAPSHOT r20537-7c92b99da8"
9 Likes

It works, but before the reboot, after the reboot, the /etc/init.d/miwifi_overlay file disappears, like other created files and all installed packages

Looks like we got ethernet working!

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1504 qdisc fq_codel state UP qlen 1000
    link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
3: lan1@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
4: lan2@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
5: lan3@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/etherxx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
6: wan@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
7: br-lan: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN qlen 1000
    link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff

Pinging my tftp server

root@OpenWrt:/# ping 192.168.31.100
PING 192.168.31.100 (192.168.31.100): 56 data bytes
64 bytes from 192.168.31.100: seq=0 ttl=64 time=0.388 ms
64 bytes from 192.168.31.100: seq=1 ttl=64 time=0.233 ms
4 Likes

Make sure the port labels are correct as well. They're not always in the order that one expects. Just watch the log for up/down matching the labels on the case.

Then after that you can move onto making sure you have pci-e and wifi defined correctly, leds etc.

After confirming all of that is down right, you can probably start testing that flashing and sysupgrade work.

1 Like

I’ll check that when I’m with the router again. Was doing this all remotely tonight.

Any tips for Wi-Fi in a DTS? Was looking at the AX6S dts and only saw wmac node.

Can you test if this works?

its works for Redmi AX5400??

No, that’s a Qualcomm device. This is Mediatek.

I’ll check later, looks like this was pulled from BPI-R3 yeah?

Yes. Also with this https://git01.mediatek.com/plugins/gitiles/openwrt/feeds/mtk-openwrt-feeds/+/125799ceb1d0bfeaef953c03652f9547c7e9efe6/target/linux/mediatek/files-5.4/arch/arm64/boot/dts/mediatek/mt7986b-spim-nand-rfb.dts

Yep we have wlan0 and wlan1 now :slight_smile: They're not pulling the right MAC addresses yet (neither are ethernet interfaces, but that's a later thing)

2 Likes

The mac address is generated by mt76 reading the eeprom from the factory partition. If the mac address is wrong, it may be because the correct eeprom is not read. So is the wireless signal strength normal? Can you upload kernel log and the contents of your factory partition?

I prefer to keep the identifying data the private but here's the boot log:

## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.64
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000e8
     Data Size:    3943889 Bytes = 3.8 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   d3f2f082
     Hash algo:    sha1
     Hash value:   54f24adec166feaa6b1d6d3b85c369abb34ae984
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'initrd-1' ramdisk subimage
     Description:  ARM64 OpenWrt xiaomi_redmi-router-ax6000 initrd
     Type:         RAMDisk Image
     Compression:  Unknown Compression
     Data Start:   0x463c3000
     Data Size:    4152464 Bytes = 4 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: unavailable
     Entry Point:  unavailable
     Hash algo:    crc32
     Hash value:   236ad2ce
     Hash algo:    sha1
     Hash value:   4f2d9a1f793decd46588c5cceb3c5ff772fc9c35
   Verifying Hash Integrity ... crc32+ sha1+ OK
WARNING: 'compression' nodes for ramdisks are deprecated, please fix your .its file!
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt xiaomi_redmi-router-ax6000 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x467b8da8
     Data Size:    32768 Bytes = 32 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   a60440fd
     Hash algo:    sha1
     Hash value:   f638eac552d7e732fd0644cf095c530c5d27d492
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x467b8da8
   Uncompressing Kernel Image
   Loading Ramdisk to 5f405000, end 5f7fac90 ... OK
   Loading Device Tree to 000000005f3fa000, end 000000005f404fff ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.64 (alamarche@dev) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r20543-f8db464701) 11.3.0,2
[    0.000000] Machine model: Xiaomi Redmi Router AX6000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x000000004fbfffff]
[    0.000000]   node   0: [mem 0x000000004fc00000-0x000000004fcfffff]
[    0.000000]   node   0: [mem 0x000000004fd00000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] percpu: Embedded 17 pages/cpu s29592 r8192 d31848 u69632
[    0.000000] pcpu-alloc: s29592 r8192 d31848 u69632 alloc=17*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 129024
[    0.000000] Kernel command line: console=ttyS0,115200n1 loglevel=8 firmware=0 uart_en=1
[    0.000000] Unknown kernel command line parameters "firmware=0 uart_en=1", will be passed to user space.
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 496372K/524288K available (8256K kernel code, 882K rwdata, 2220K rodata, 448K init, 293K bss, 27916K reserve)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] GICv3: Distributor has no Range Selector support
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv3: 16 PPIs implemented
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000001] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.000098] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[    0.000105] pid_max: default: 32768 minimum: 301
[    0.000183] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.000191] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.001027] rcu: Hierarchical SRCU implementation.
[    0.001109] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.001265] smp: Bringing up secondary CPUs ...
[    0.001507] Detected VIPT I-cache on CPU1
[    0.001530] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.001557] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.001815] Detected VIPT I-cache on CPU2
[    0.001827] GICv3: CPU2: found redistributor 2 region 0:0x000000000c0c0000
[    0.001838] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.002063] Detected VIPT I-cache on CPU3
[    0.002074] GICv3: CPU3: found redistributor 3 region 0:0x000000000c0e0000
[    0.002083] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.002108] smp: Brought up 1 node, 4 CPUs
[    0.002123] SMP: Total of 4 processors activated.
[    0.002127] CPU features: detected: 32-bit EL0 Support
[    0.002130] CPU features: detected: CRC32 instructions
[    0.002205] CPU: All CPU(s) started at EL2
[    0.002215] alternatives: patching kernel code
[    0.003757] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.003776] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.003888] pinctrl core: initialized pinctrl subsystem
[    0.004332] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.004545] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.004568] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.004588] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.004807] thermal_sys: Registered thermal governor 'fair_share'
[    0.004810] thermal_sys: Registered thermal governor 'bang_bang'
[    0.004813] thermal_sys: Registered thermal governor 'step_wise'
[    0.004816] thermal_sys: Registered thermal governor 'user_space'
[    0.004895] ASID allocator initialised with 65536 entries
[    0.005239] pstore: Registered ramoops as persistent store backend
[    0.005243] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.011190] cryptd: max_cpu_qlen set to 1000
[    0.012538] SCSI subsystem initialized
[    0.012613] libata version 3.00 loaded.
[    0.012693] usbcore: registered new interface driver usbfs
[    0.012713] usbcore: registered new interface driver hub
[    0.012730] usbcore: registered new device driver usb
[    0.013297] clocksource: Switched to clocksource arch_sys_counter
[    0.013633] NET: Registered PF_INET protocol family
[    0.013707] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.013961] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.013973] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.013980] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.014002] TCP bind hash table entries: 4096 (order: 4, 65536 bytes, linear)
[    0.014045] TCP: Hash tables configured (established 4096 bind 4096)
[    0.014093] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.014105] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.014185] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.014204] PCI: CLS 0 bytes, default 64
[    0.014311] Unpacking initramfs...
[    0.025183] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    0.027141] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.027153] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.050157] mtk-pcie-gen3 11280000.pcie: host bridge /soc/pcie@11280000 ranges:
[    0.050183] mtk-pcie-gen3 11280000.pcie: Parsing ranges property...
[    0.050192] mtk-pcie-gen3 11280000.pcie:      MEM 0x0020000000..0x002fffffff -> 0x0020000000
[    0.050267] /soc/pcie@11280000: Failed to get clk index: 0 ret: -517
[    0.050277] mtk-pcie-gen3 11280000.pcie: failed to get clocks
[    0.052185] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    0.052710] printk: console [ttyS0] disabled
[    0.072896] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 121, base_baud = 2500000) is a ST16650V2
[    0.770081] printk: console [ttyS0] enabled
[    0.774896] mtk_rng 1020f000.trng: registered RNG driver
[    0.774954] hwrng: no data available
[    0.780531] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.792332] loop: module loaded
[    0.795523] Freeing initrd memory: 4052K
[    0.808940] mtk_soc_eth 15100000.ethernet: generated random MAC address 1e:f2:6a:44:8d:90
[    0.817380] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc00d580000, irq 123
[    0.826865] i2c_dev: i2c /dev entries driver
[    0.831438] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    0.839704] NET: Registered PF_INET6 protocol family
[    0.845259] Segment Routing with IPv6
[    0.848929] In-situ OAM (IOAM) with IPv6
[    0.852861] NET: Registered PF_PACKET protocol family
[    0.857995] 8021q: 802.1Q VLAN Support v1.8
[    0.862932] pstore: Using crash dump compression: deflate
[    0.872698] mtk-pcie-gen3 11280000.pcie: host bridge /soc/pcie@11280000 ranges:
[    0.880035] mtk-pcie-gen3 11280000.pcie: Parsing ranges property...
[    0.886301] mtk-pcie-gen3 11280000.pcie:      MEM 0x0020000000..0x002fffffff -> 0x0020000000
[    1.113304] mtk-pcie-gen3 11280000.pcie: PCIe link down, ltssm reg val: 0x1000001
[    1.120792] mtk-pcie-gen3: probe of 11280000.pcie failed with error -110
[    1.179688] mt7530 mdio-bus:1f: configuring for fixed/2500base-x link mode
[    1.187019] mt7530 mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    1.196618] mt7530 mdio-bus:1f wan (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=131)
[    1.216366] mt7530 mdio-bus:1f lan1 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=132)
[    1.235912] mt7530 mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=133)
[    1.255441] mt7530 mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7531 PHY] (irq=134)
[    1.266245] DSA: tree 0 setup
[    1.270137] Freeing unused kernel memory: 448K
[    1.363377] Run /init as init process
[    1.367025]   with arguments:
[    1.369976]     /init
[    1.372233]   with environment:
[    1.375365]     HOME=/
[    1.377710]     TERM=linux
[    1.380401]     firmware=0
[    1.383091]     uart_en=1
[    1.480050] init: Console is alive
[    1.483548] init: - watchdog -
[    1.489593] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.497527] gpio-keys: probe of keys failed with error -2
[    1.503472] leds-gpio: probe of leds failed with error -2
[    1.509072] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    1.517110] init: - preinit -
[    1.551331] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[    1.559791] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    1.565318] mt7530 mdio-bus:1f lan1: configuring for phy/gmii link mode
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    3.608796] procd: - early -
[    3.611715] procd: - watchdog -
[    4.122250] procd: - watchdog -
[    4.125605] procd: - ubus -
[    4.130298] random: ubusd: uninitialized urandom read (4 bytes read)
[    4.177969] random: ubusd: uninitialized urandom read (4 bytes read)
[    4.184416] random: ubusd: uninitialized urandom read (4 bytes read)
[    4.191380] procd: - init -
Please press Enter to activate this console.
[    4.262036] urngd: v1.0.2 started.
[    4.278674] kmodloader: loading kernel modules from /etc/modules.d/*
[    4.280523] random: crng init done
[    4.288559] random: 22 urandom warning(s) missed due to ratelimiting
[    4.298171] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
[    4.311890] Loading modules backported from Linux version v5.15.58-0-g7d8048d4e064
[    4.319477] Backport generated by backports.git v5.15.58-1-0-g42a95ce7
[    4.675681] mt7986-wmac 18000000.wmac: HW/SW Version: 0x8a108a10, Build Time: 20220113162543a
[    4.675681] 
[    4.694207] mt7986-wmac 18000000.wmac: WM Firmware Version: ____000000, Build Time: 20220113162641
[    4.732633] mt7986-wmac 18000000.wmac: WA Firmware Version: DEV_000000, Build Time: 20220113163034
[    4.876917] mt7986-wmac 18000000.wmac: eeprom load fail, use default bin
[    8.667796] PPP generic driver version 2.4.2
[    8.672641] NET: Registered PF_PPPOX protocol family
[    8.679862] kmodloader: done loading kernel modules from /etc/modules.d/*
[   10.540242] mtk_soc_eth 15100000.ethernet eth0: Link is Down
[   10.548788] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[   10.557239] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[   10.558311] mt7530 mdio-bus:1f lan1: configuring for phy/gmii link mode
[   10.573114] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   10.579528] br-lan: port 1(lan1) entered blocking state
[   10.584748] br-lan: port 1(lan1) entered disabled state
[   10.591368] device lan1 entered promiscuous mode
[   10.596032] device eth0 entered promiscuous mode
[   10.608381] mt7530 mdio-bus:1f lan2: configuring for phy/gmii link mode
[   10.618056] br-lan: port 2(lan2) entered blocking state
[   10.619767] mt7530 mdio-bus:1f lan2: Link is Up - 1Gbps/Full - flow control rx/tx
[   10.623314] br-lan: port 2(lan2) entered disabled state
[   10.637723] device lan2 entered promiscuous mode
[   10.644583] br-lan: port 2(lan2) entered blocking state
[   10.649818] br-lan: port 2(lan2) entered forwarding state
[   10.656098] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   10.665117] mt7530 mdio-bus:1f lan3: configuring for phy/gmii link mode
[   10.674565] br-lan: port 3(lan3) entered blocking state
[   10.679784] br-lan: port 3(lan3) entered disabled state
[   10.686855] device lan3 entered promiscuous mode
[   10.703255] mt7530 mdio-bus:1f wan: configuring for phy/gmii link mode
^[


BusyBox v1.35.0 (2022-09-09 05:05:46 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r20543-f8db464701
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# 

I suspect this is our clue:

[    4.675681] mt7986-wmac 18000000.wmac: HW/SW Version: 0x8a108a10, Build Time: 20220113162543a
[    4.675681] 
[    4.694207] mt7986-wmac 18000000.wmac: WM Firmware Version: ____000000, Build Time: 20220113162641
[    4.732633] mt7986-wmac 18000000.wmac: WA Firmware Version: DEV_000000, Build Time: 20220113163034
[    4.876917] mt7986-wmac 18000000.wmac: eeprom load fail, use default bin

Factory partition on this device is at 0x180000 and is very similar to the Redmi AX6S (see the dts here).

Factory: 0x180000
WLAN0 (2.4G): 0x180004
WLAN1 (5G): 0x180010
ETH0 (LAN) is WLAN0 MAC - 1 (not in factory partition)
ETH1 (WAN) is only in Bdata partition.

2 Likes