Adding OpenWrt support for Xiaomi AX3600 (Part 1)

gmzhuo · July 20, 2020, 3:25pm

I still need to use the first patch to make the nandc stable.
Yes, I have copied the partitions from the original firmware.(reverted from /sys/firmware/fdt)

I enabled the UBI:
CONFIG_MTD_UBI=y
CONFIG_MTD_UBI_WL_THRESHOLD=4096
CONFIG_MTD_UBI_BEB_LIMIT=20
CONFIG_MTD_UBI_FASTMAP=y
CONFIG_MTD_UBI_GLUEBI=y
CONFIG_MTD_UBI_BLOCK=y

and use command line console=ttyMSM0,115200,n8 ubi.mtd=rootfs_1 root=mtd:ubi_rootfs rootfstype=squashfs rootwait

But I still failed to mount root from mtd:ubi_rootfs, any Idea?

Apache14 · July 20, 2020, 4:09pm

What errors are you seeing (can you post the boot log), I was going to compile an initramfs with ubiattach built in so I can manually attach rootfs / rootfs_1

gmzhuo · July 20, 2020, 5:04pm

UBI attach info:

[    2.844470] ubi0: attaching mtd13
[    3.027554] ubi0: scanning is finished
[    3.034214] ubi0: attached mtd13 (name "rootfs_1", size 35 MiB)
[    3.034241] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.038950] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.045897] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.052749] ubi0: good PEBs: 286, bad PEBs: 0, corrupted PEBs: 0
[    3.059518] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    3.065770] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 620917598
[    3.072807] ubi0: available PEBs: 28, total reserved PEBs: 258, PEBs reserved for bad PEB handling: 40

Failed to mount rootfs:
[    3.477815] VFS: Cannot open root device "mtd:ubi_rootfs" or unknown-block(0,0): error -2
[    3.481146] Please append a correct "root=" boot option; here are the available partitions:

gmzhuo · July 20, 2020, 5:05pm

And maybe we can use NIC driver essedma for ipq40xx for ipq807x.

Apache14 · July 20, 2020, 5:27pm

That looks like its just not mounted as mtd:ubi_rootfs

check /dev/ubi* you should see the UBI volumes. You will probably see something like /dev/ubiblock0_1

Apache14 · July 20, 2020, 7:07pm

Yeah UBI is definitely working, when i boot with the same kernel command line i get the following

Command Line

root@(none):/# cat /proc/cmdline 
ubi.mtd=rootfs_1 root=mtd:ubi_rootfs rootfstype=squashfs rootwait

UBI Kernel Log

[    1.156148] ubi0: default fastmap pool size: 50
[    1.156174] ubi0: default fastmap WL pool size: 25
[    1.159515] ubi0: attaching mtd13
[    1.663547] random: crng init done
[    1.782054] ubi0: scanning is finished
[    1.788351] ubi0 warning: ubi_eba_init: cannot reserve enough PEBs for bad PEB handling, reserved 38, need 40
[    1.789107] ubi0: attached mtd13 (name "rootfs_1", size 128 MiB)
[    1.797258] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    1.803325] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    1.810009] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    1.816867] ubi0: good PEBs: 1024, bad PEBs: 0, corrupted PEBs: 0
[    1.823639] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
[    1.829922] ubi0: max/mean erase counter: 4/1, WL threshold: 4096, image sequence number: 954500077
[    1.837012] ubi0: available PEBs: 0, total reserved PEBs: 1024, PEBs reserved for bad PEB handling: 38
[    1.845965] ubi0: background thread "ubi_bgt0d" started, PID 82

UBI devices under dev and sys

root@(none):/# cat /sys/devices/virtual/ubi/ubi0/ubi0_0/name 
kernel
root@(none):/# cat /sys/devices/virtual/ubi/ubi0/ubi0_1/name 
ubi_rootfs
root@(none):/# cat /sys/devices/virtual/ubi/ubi0/ubi0_2/name 
rootfs_data

root@(none):/# ls /dev/ubi*
/dev/ubi0      /dev/ubi0_0    /dev/ubi0_1    /dev/ubi0_2    /dev/ubi_ctrl

Partitions within /proc/mtd after ubi attached

root@(none):/# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00100000 00020000 "0:SBL1"
mtd1: 00100000 00020000 "0:MIBIB"
mtd2: 00300000 00020000 "0:QSEE"
mtd3: 00080000 00020000 "0:DEVCFG"
mtd4: 00080000 00020000 "0:RPM"
mtd5: 00080000 00020000 "0:CDT"
mtd6: 00080000 00020000 "0:APPSBLENV"
mtd7: 00100000 00020000 "0:APPSBL"
mtd8: 00080000 00020000 "0:ART"
mtd9: 00080000 00020000 "bdata"
mtd10: 00080000 00020000 "crash"
mtd11: 00080000 00020000 "crash_syslog"
mtd12: 023c0000 00020000 "rootfs"
mtd13: 08000000 00020000 "rootfs_1"
mtd14: 01ec0000 00020000 "overlay"
mtd15: 00080000 00020000 "rsvd0"
mtd16: 00900000 00020000 "0:WIFIFW"
mtd17: 00554000 0001f000 "kernel"
mtd18: 019cb000 0001f000 "ubi_rootfs"
mtd19: 0578d000 0001f000 "rootfs_data"

Overall it looks like the root= command line argument needs updating for mainline openwrt

gmzhuo · July 21, 2020, 3:03am

You know, I'm testing it with yocto, not openwrt, I even don't enable the MTD_BLOCK.
I have enabled the MTD_BLOCK now and I can mount the rootfs with root=31:17, I still can't mount the rootfs with root=mtd:ubi_rootfs.

Dose only the kernel from openwrt can parse the mtd:ubi_rootfs?

Apache14 · July 21, 2020, 7:29am

I have only booted from initramfs for now, I haven't been able to get uboot to accept the UBI image built from openwrt and boot from it. It throws an error 22.

juppin · July 21, 2020, 11:24am

As you got basic nand support now, can you share your patches or push it to your OpenWrt Github fork?
This would give everybody a very quick starting point to do some experiments and probably make some progress to support more hardware.

Apache14 · July 21, 2020, 11:28am

Definitely, I will get that pushed later today

To update this thread, full bootlog / NAND boot to OpenWRT shell (serial only)

U-Boot 2016.01 (Feb 19 2020 - 10:39:20 +0000), Build: jenkins-r3600_ota_publish-25

DRAM:  smem ram ptable found: ver: 1 len: 4
512 MiB
NAND:  ONFI device found
ID = 1590aaef
Vendor = ef
Device = aa
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC:   sdhci: Node Not found, skipping initialization

PCI Link Intialized
PCI1 is not defined in the device tree
In:    serial@78B3000
Out:   serial@78B3000
Err:   serial@78B3000
machid: 8010010
MMC Device 0 not found
eth5 MAC Address from ART is not valid
write phy_id=1, reg(0x8074):0x0670
write phy_id=2, reg(0x8074):0x0670
write phy_id=3, reg(0x8074):0x0670
write phy_id=4, reg(0x8074):0x0670
bootwait is on, bootdelay=5
Hit any key to stop autoboot:  0 
 trigger button release!
boot from rootfs 0
  miwifi: check crash in rmem !  
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: volume 2 ("rootfs_data") re-sized from 9 to 192 LEBs
ubi0: attached mtd1 (name "mtd=0", size 35 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 286, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1593889211
ubi0: available PEBs: 0, total reserved PEBs: 286, PEBs reserved for bad PEB handling: 40
Read 0 bytes from volume kernel to 44000000
No size specified -> Using max size (4825088)
Could not find PCI in device tree
Erasing NAND...
Erasing at 0x6e0000 -- 100% complete.
Writing to NAND... OK
## Loading kernel from FIT Image at 44000000 ...
   Using 'config@ac04' configuration
   Trying 'kernel@1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.4.48
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x440000e8
     Data Size:    4735701 Bytes = 4.5 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x41080000
     Entry Point:  0x41080000
     Hash algo:    crc32
     Hash value:   90fe6d35
     Hash algo:    sha1
     Hash value:   fe02e722dc38a6ec316fac931db09044d84d040d
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
   Using 'config@ac04' configuration
   Trying 'fdt@1' fdt subimage
     Description:  ARM64 OpenWrt xiaomi_ax3600 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x44484500
     Data Size:    9982 Bytes = 9.7 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   22391323
     Hash algo:    sha1
     Hash value:   9722e3b7c007aa540a9b7ef0a6b33b9885abafc5
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x44484500
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 4a3fa000, end 4a3ff6fd ... OK
Using machid 0x8010010 from environment

Starting kernel ...

Jumping to AARCH64 kernel via monitor
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.4.48 (shane@wasp) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r13686-78b632134f)) #0 SMP PREEMPT Sat Jul 4 19:00:11 2020
[    0.000000] Machine model: AX3600
[    0.000000] efi: Getting EFI parameters from FDT:
[    0.000000] efi: UEFI not found.
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] psci: OSI mode supported.
[    0.000000] percpu: Embedded 21 pages/cpu s48408 r8192 d29416 u86016
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: ARM erratum 845719
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 129024
[    0.000000] Kernel command line: ubi.mtd=rootfs root=/dev/ubiblock0_1 rootfstype=squashfs rootwait
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 495272K/524288K available (6908K kernel code, 408K rwdata, 2164K rodata, 576K init, 274K bss, 29016K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Preemptible hierarchical RCU implementation.
[    0.000000]  Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] random: get_random_bytes called from start_kernel+0x2ec/0x44c with crng_init=0
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[    0.000005] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[    0.000114] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=76800)
[    0.000126] pid_max: default: 32768 minimum: 301
[    0.000251] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.000262] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.023975] ASID allocator initialised with 32768 entries
[    0.031972] rcu: Hierarchical SRCU implementation.
[    0.040103] EFI services will not be available.
[    0.048010] smp: Bringing up secondary CPUs ...
[    0.080309] Detected VIPT I-cache on CPU1
[    0.080360] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.112338] Detected VIPT I-cache on CPU2
[    0.112374] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.144403] Detected VIPT I-cache on CPU3
[    0.144435] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.144507] smp: Brought up 1 node, 4 CPUs
[    0.144528] SMP: Total of 4 processors activated.
[    0.144536] CPU features: detected: 32-bit EL0 Support
[    0.144543] CPU features: detected: CRC32 instructions
[    0.144588] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.144597] CPU: All CPU(s) started at EL1
[    0.144619] alternatives: patching kernel code
[    0.148598] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.148618] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.148810] pinctrl core: initialized pinctrl subsystem
[    0.149261] DMI not present or invalid.
[    0.149548] NET: Registered protocol family 16
[    0.149890] DMA: preallocated 256 KiB pool for atomic allocations
[    0.150292] cpuidle: using governor ladder
[    0.150318] cpuidle: using governor menu
[    0.150458] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[    0.217211] pps_core: LinuxPPS API ver. 1 registered
[    0.217223] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.217241] PTP clock support registered
[    0.217452] Advanced Linux Sound Architecture Driver Initialized.
[    0.218106] clocksource: Switched to clocksource arch_sys_counter
[    0.218719] thermal_sys: Registered thermal governor 'step_wise'
[    0.218722] thermal_sys: Registered thermal governor 'user_space'
[    0.218908] NET: Registered protocol family 2
[    0.219310] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.219332] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.219380] TCP bind hash table entries: 4096 (order: 4, 65536 bytes, linear)
[    0.219458] TCP: Hash tables configured (established 4096 bind 4096)
[    0.219536] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.219560] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.219710] NET: Registered protocol family 1
[    0.219737] PCI: CLS 0 bytes, default 64
[    0.221046] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    0.225598] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.225606] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.249134] msm_serial 78b3000.serial: msm_serial: detected port #0
[    0.249165] msm_serial 78b3000.serial: uartclk = 3686400
[    0.249200] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 8, base_baud = 230400) is a MSM
[    0.249218] msm_serial: console setup on port #0
[    0.741616] printk: console [ttyMSM0] enabled
[    0.746474] msm_serial 78b1000.serial: msm_serial: detected port #1
[    0.750478] msm_serial 78b1000.serial: uartclk = 19200000
[    0.756562] 78b1000.serial: ttyMSM1 at MMIO 0x78b1000 (irq = 10, base_baud = 1200000) is a MSM
[    0.762265] msm_serial: driver initialized
[    0.777064] brd: module loaded
[    0.784521] nand: device found, Manufacturer ID: 0xef, Chip ID: 0xaa
[    0.784551] nand: Winbond W29N02GZ
[    0.789959] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    0.793244] 17 fixed-partitions partitions found on MTD device qcom_nand.0
[    0.800712] Creating 17 MTD partitions on "qcom_nand.0":
[    0.807571] 0x000000000000-0x000000100000 : "0:SBL1"
[    0.814542] 0x000000100000-0x000000200000 : "0:MIBIB"
[    0.819407] 0x000000200000-0x000000500000 : "0:QSEE"
[    0.826138] 0x000000500000-0x000000580000 : "0:DEVCFG"
[    0.828932] 0x000000580000-0x000000600000 : "0:RPM"
[    0.833900] 0x000000600000-0x000000680000 : "0:CDT"
[    0.838764] 0x000000680000-0x000000700000 : "0:APPSBLENV"
[    0.843570] 0x000000700000-0x000000800000 : "0:APPSBL"
[    0.849510] 0x000000800000-0x000000880000 : "0:ART"
[    0.854170] 0x000000880000-0x000000900000 : "bdata"
[    0.858896] 0x000000900000-0x000000980000 : "crash"
[    0.863803] 0x000000980000-0x000000a00000 : "crash_syslog"
[    0.868638] 0x000000a00000-0x000002dc0000 : "rootfs"
[    0.877917] random: fast init done
[    0.904225] mtd: device 12 (rootfs) set to be root filesystem
[    0.904508] mtdsplit: no squashfs found in "rootfs"
[    0.908968] 0x000002dc0000-0x00000adc0000 : "rootfs_1"
[    1.021749] 0x00000adc0000-0x00000cc80000 : "overlay"
[    1.048215] 0x00000cc80000-0x00000cd00000 : "rsvd0"
[    1.049224] 0x00000cd00000-0x00000d600000 : "0:WIFIFW"
[    1.060757] libphy: Fixed MDIO Bus: probed
[    1.060777] i2c /dev entries driver
[    1.064841] sdhci: Secure Digital Host Controller Interface driver
[    1.067139] sdhci: Copyright(c) Pierre Ossman
[    1.073381] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.079162] NET: Registered protocol family 10
[    1.084340] Segment Routing with IPv6
[    1.087867] NET: Registered protocol family 17
[    1.091556] 8021q: 802.1Q VLAN Support v1.8
[    1.113036] ubi0: default fastmap pool size: 10
[    1.113062] ubi0: default fastmap WL pool size: 5
[    1.116400] ubi0: attaching mtd12
[    1.244140] ubi0: scanning is finished
[    1.249931] ubi0 warning: ubi_eba_init: cannot reserve enough PEBs for bad PEB handling, reserved 38, need 40
[    1.250522] ubi0: attached mtd12 (name "rootfs", size 35 MiB)
[    1.258832] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    1.264557] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    1.271329] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    1.278188] ubi0: good PEBs: 286, bad PEBs: 0, corrupted PEBs: 0
[    1.284955] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
[    1.291209] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1593889211
[    1.298243] ubi0: available PEBs: 0, total reserved PEBs: 286, PEBs reserved for bad PEB handling: 38
[    1.307544] ubi0: background thread "ubi_bgt0d" started, PID 82
[    1.310147] block ubiblock0_1: created from ubi0:1(rootfs)
[    1.322389] hctosys: unable to open rtc device (rtc0)
[    1.328675] ALSA devi�[    1.344606] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    1.344964] Freeing unused kernel memory: 576K
[    1.366176] Run /sbin/init as init process
[    1.677302] init: Console is alive
[    1.828507] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.828643] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    1.839007] init: - preinit -
[    2.239215] random: jshn: uninitialized urandom read (4 bytes read)
[    2.246866] random: jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    6.342294] UBIFS (ubi0:2): default file-system created
[    6.342833] UBIFS (ubi0:2): Mounting in unauthenticated mode
[    6.346475] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 145
[    6.369151] random: procd: uninitialized urandom read (4 bytes read)
[    6.397893] UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "rootfs_data"
[    6.397927] UBIFS (ubi0:2): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    6.404727] UBIFS (ubi0:2): FS size: 23109632 bytes (22 MiB, 182 LEBs), journal size 1142784 bytes (1 MiB, 9 LEBs)
[    6.414612] UBIFS (ubi0:2): reserved for root: 1091524 bytes (1065 KiB)
[    6.424851] UBIFS (ubi0:2): media format: w4/r0 (latest is w5/r0), UUID D1E2AB3B-3232-48C5-86A4-8942FE69C3E9, small LPT model
[    6.432844] mount_root: overlay filesystem has not been fully initialized yet
[    6.443061] mount_root: switching to ubifs overlay
[    6.457178] overlayfs: upper fs does not support xattr, falling back to index=off and metacopy=off.
[    6.458977] urandom-seed: Seed file not found (/etc/urandom.seed)
[    6.500483] procd: - early -
[    7.052759] procd: - ubus -
[    7.077965] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.131046] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.131927] procd: - init -
Please press Enter to activate this console.
[    7.300392] kmodloader: loading kernel modules from /etc/modules.d/*
[    7.335550] urngd: v1.0.2 started.
[    7.348498] xt_time: kernel timezone is -0000
[    7.360550] PPP generic driver version 2.4.2
[    7.361821] NET: Registered protocol family 24
[    7.370794] kmodloader: done loading kernel modules from /etc/modules.d/*
[    7.372820] random: crng init done
[    7.376565] random: 5 urandom warning(s) missed due to ratelimiting



BusyBox v1.31.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r13686-78b632134f
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#

Crect · July 21, 2020, 1:08pm

So all that is needed after a proper device tree is for the mainline drivers to mature and then a kernel bump in openwrt to support this device?

Apache14 · July 21, 2020, 2:18pm

Yes, in theory ath11k should work for wifi, however the ipq8074 development device that has a maintained DTS in mainline Linux seems to be lacking all of the related DTS fields.

Also there doesn't seem to be any compatible drivers for the Ethernet on this SoC, yet.

Apache14 · July 21, 2020, 4:24pm

@juppin

I have pushed my changes here https://github.com/BuzzBumbleBee/openwrt/commits/ax3600

Currently -

Serial access only !
No ethernet drivers
No wifi drivers
NAND boot works
LEDS (gpio) works

One thing to note is, for now I have set the kernel command line via kernel config (we need to port the rootfs command line argument merge changes from ipq806x).

zxcvgm · July 21, 2020, 5:26pm

Thanks for the awesome work done so far! While we are waiting for the porting, I made some scripts that can patch the official firmware to maintain ssh_en and uart_en so we can upgrade to newer versions in the meantime.

I'm still not sure of the actual mechanism behind the A/B partition switching, but setting flag_ota_reboot=1 seems to do it. I suspect it may be U-Boot doing the switching.

I just upgraded my router to 1.0.67 with this, but I make no guarantees.

Crect · July 21, 2020, 5:45pm

Is the official firmware safe to use in regards to privacy and call home?

zxcvgm · July 22, 2020, 3:09am

To be honest, I don't really trust it. That's why I'm looking forward to installing vanilla OpenWRT on it.

I've seen some code within the firmware that collects logs and uploads them, but didn't investigate further. If you just look at their web UI, it's already tracking your clicks with your unique router ID to api.miwifi.com, but you can block these with an ad blocker. It's terrible.

gmzhuo · July 22, 2020, 4:16am

Failed to enable essdma driver from qsdk:
[ 1.116362] ess_edma 3ab00000.edma: IRQ index 4 not found
[ 1.118938] ess_edma 3ab00000.edma: IRQ index 5 not found
[ 1.124501] ess_edma 3ab00000.edma: IRQ index 6 not found
[ 1.129873] ess_edma 3ab00000.edma: IRQ index 7 not found
[ 1.135255] ess_edma 3ab00000.edma: IRQ index 8 not found
[ 1.140635] ess_edma 3ab00000.edma: IRQ index 9 not found
[ 1.146017] ess_edma 3ab00000.edma: IRQ index 10 not found
[ 1.151400] ess_edma 3ab00000.edma: IRQ index 11 not found
[ 1.156781] ess_edma 3ab00000.edma: IRQ index 12 not found
[ 1.162251] ess_edma 3ab00000.edma: IRQ index 13 not found
[ 1.167719] ess_edma 3ab00000.edma: IRQ index 14 not found
[ 1.173188] ess_edma 3ab00000.edma: IRQ index 15 not found
[ 1.178656] ess_edma 3ab00000.edma: IRQ index 16 not found
[ 1.184126] ess_edma 3ab00000.edma: IRQ index 18 not found
[ 1.189593] ess_edma 3ab00000.edma: IRQ index 20 not found
[ 1.195062] ess_edma 3ab00000.edma: IRQ index 22 not found

gmzhuo · July 22, 2020, 5:03am

It seems that the essdma driver will request irqs for each rx/tx queue, but in dts it sets only 4 irqs, so the driver failed to allocate the irq for tx queue.

Double-G · July 22, 2020, 12:59pm

qxrepack sounds great, thank you so much.
I hope that I can upgrade the firmware now and keep SSH.

When trying it out with the latest firmware, I run on error.

Extraction:

 ubireader_extract_images -w miwifi_r3600_firmware_f7f3e_1.0.67.bin 
/usr/local/lib/python3.8/dist-packages/ubi_reader-0.6.7-py3.8.egg/ubireader/debug.py:37: SyntaxWarning: "is" with a literal. Did you mean "=="?
/usr/local/lib/python3.8/dist-packages/ubi_reader-0.6.7-py3.8.egg/ubireader/debug.py:37: SyntaxWarning: "is" with a literal. Did you mean "=="?
read Error: Block ends at 29491884 which is greater than file size 29361084
extract_blocks Error: PEB: 224: Bad Read Offset Request

Besides that,it seems to work:

Patching:

fakeroot -- ./repack-squashfs.sh ubifs-root/miwifi_r3600_firmware_f7f3e_1.0.67.bin/img-267845145_vol-ubi_rootfs.ubifs 
/usr/bin/unsquashfs
unpacking squashfs...
Parallel unsquashfs: Using 2 processors
4103 inodes (4256 blocks) to write

[=====================================================================================================================================\] 4256/4256 100%

created 3646 files
created 249 directories
created 456 symlinks
created 1 devices
created 0 fifos
repacking squashfs...
Parallel mksquashfs: Using 2 processors
Creating 4.0 filesystem on ubifs-root/miwifi_r3600_firmware_f7f3e_1.0.67.bin/img-267845145_vol-ubi_rootfs.ubifs.new, block size 262144.
[=====================================================================================================================================-] 3799/3799 100%

Exportable Squashfs 4.0 filesystem, xz compressed, data block size 262144
	compressed data, compressed metadata, compressed fragments,
	no xattrs, compressed ids
	duplicates are removed
Filesystem size 23174.98 Kbytes (22.63 Mbytes)
	26.64% of uncompressed filesystem size (87002.44 Kbytes)
Inode table size 30372 bytes (29.66 Kbytes)
	21.06% of uncompressed inode table size (144222 bytes)
Directory table size 41402 bytes (40.43 Kbytes)
	41.44% of uncompressed directory table size (99910 bytes)
Number of duplicate files found 557
Number of inodes 4352
Number of files 3646
Number of fragments 158
Number of symbolic links  456
Number of device nodes 1
Number of fifo nodes 0
Number of socket nodes 0
Number of directories 249
Number of ids (unique uids + gids) 1
Number of uids 1
	root (0)
Number of gids 1
	root (0)

Recombining:

./ubinize.sh ubifs-root/miwifi_r3600_firmware_f7f3e_1.0.67.bin/img-267845145_vol-kernel.ubifs ubifs-root/miwifi_r3600_firmware_f7f3e_1.0.67.bin/img-267845145_vol-ubi_rootfs.ubifs.new 
ubinize: volume size was not specified in section "kernel", assume minimum to fit image "ubifs-root/miwifi_r3600_firmware_f7f3e_1.0.67.bin/img-267845145_vol-kernel.ubifs"4317184 bytes (4.1 MiB)
ubinize: volume size was not specified in section "rootfs", assume minimum to fit image "ubifs-root/miwifi_r3600_firmware_f7f3e_1.0.67.bin/img-267845145_vol-ubi_rootfs.ubifs.new"23732224 bytes (22.6 MiB)
done.

Result:

./ubinize.sh ubifs-root/miwifi_r3600_firmware_f7f3e_1.0.67.bin/img-267845145_vol-kernel.ubifs ubifs-root/miwifi_r3600_firmware_f7f3e_1.0.67.bin/img-267845145_vol-ubi_rootfs.ubifs.new 
ubinize: volume size was not specified in section "kernel", assume minimum to fit image "ubifs-root/miwifi_r3600_firmware_f7f3e_1.0.67.bin/img-267845145_vol-kernel.ubifs"4317184 bytes (4.1 MiB)
ubinize: volume size was not specified in section "rootfs", assume minimum to fit image "ubifs-root/miwifi_r3600_firmware_f7f3e_1.0.67.bin/img-267845145_vol-ubi_rootfs.ubifs.new"23732224 bytes (22.6 MiB)
done.

zxcvgm · July 22, 2020, 1:36pm

That's normal. ubi_reader seems to very strict when parsing UBI images.