Adding OpenWrt support for Xiaomi AX3600 (Part 1)

dchard · October 22, 2021, 8:20am

root@XAX6:~# uptime
 10:18:48 up 14:51,  load average: 0.00, 0.00, 0.00
root@XAX6:~#
root@XAX6:~#
root@XAX6:~# cat /proc/meminfo|grep Mem
MemTotal:         417756 kB
MemFree:           82924 kB
MemAvailable:      74196 kB

With 1 2.4G and 3 AC clients. Since I applied the 512MB patch, there is no OOM, the memory consumption is not going below 18%, it usually "recovers" to 25-30% when it hits that low level.

robimarko · October 22, 2021, 8:22am

Ok, the 512MB patch is cleary needed, I should have some time today to actually implement it.

tiagogaspar8 · October 22, 2021, 12:39pm

Hi guys,

I have some news, I have updated the device wiki to add more info, improve it's visuals and make it easier to understand.
If you can go and check it out, feedback is always appreciated!

ajw107 · October 22, 2021, 2:44pm

Brilliant work, thank you for doing this and making it loads clearer, very much appreciated. I just noticed a few mistakes and things that could be made clearer, I hope that is okay:
Serial Connection:

Can't seem to find anywhere that states this on the page (although there is a photo that shows it), but to save a lot of fried boards it should be made clear to 'Not Connect the VCC Cable' of the serial connection.
I also had to disable Flow Control to get putty to work over serial
I realise that 8N1 is standard notation, but for people not familiar with it stating Data Bits: 8, Stop Bits: 1, Parity: None may be clearer.

TFTP recovery:

You have the filename as /etc/C0A81F02.img, the directory should be /tmp/tftp/
You state the filename is important and should be C0A81F02.img, but in my experience this filename is generated on the device itself, and you have to watch either the output of dnsmasq or the serial connection output to find out what the filename it wants actually is.
You state the router will flash blue when the recovery is successfully complete, again in my experience this did not happen and I could only tell when it was successfully complete by looking at the serial connection output (it would say something along the lines of 'Upgrade was successful').
I found that if it can't connect after a few goes, I needed to use a Network Switch and only have the router and PC plugged into it. This should stop the problem where Linux doesn't bring the interface up quickly enough, before u-boot just gives up and restarts the interface again. It's also important to note that even when working it can still take a few cycles before the firmware starts to upload, again follow this via the serial connection or the output of dnsmasq.
You state 'If the recovery doesn't accept the downloaded file the led switches to solid white - if this is the case, restart the recovery process with other file', but sometimes the upload or verification can just fail, and if you are confident it is the right firmware, you can still use the file (or re-download it if you think it got corrupt somehow).

I hope these suggestions are okay. I would just make the changes myself, but I don;t want to undo your superb work.
Alex

uamarchuan · October 22, 2021, 3:16pm

Hi Guys,
Can you help me to clarify one point..
I have AX6 device, in your instruction how to flash partitions you mention this command:
ubiformat /dev/mtd12 -f /tmp/openwrt-ipq807x-generic-xiaomi_ax3600-squashfs-nand-factory.ubi -s 2048 -O 2048

Do the same parameters need to be used for the AX6 (...-s 2048 -O 2048)?
Thanks

robimarko · October 22, 2021, 7:53pm

I have added the 512MB memory DTS as well as the ath11k option.
DTS is auto included correctly, but the ath11k option must be selected manually in menuconfig.

Stat_headcrabed · October 23, 2021, 7:13am

802.11ax is not only for 5GHz band, but also 2.4GH, however you marked that as b/g/n only for 2.4GHz band.

castiel652 · October 23, 2021, 7:16am

It's not required

uamarchuan · October 23, 2021, 10:52am

Guys help please...
I have troubles with partition table.

bootwait is on, bootdelay=5
Hit any key to stop autoboot:  5  4  3  2  1  0 
 restore_defaults is set, enlarge xqup detect time 
 trigger button release!
boot from rootfs 1
  miwifi: check crash in rmem !  
ubi0: attaching mtd1

UBI init error 22

Erasing NAND...
Erasing at 0x6e0000 -- 100% complete.
Writing to NAND... OK
resetting ...

I have access to U-Boot via UART and need to restore mtd1 partition. I have a dump of this partition.

Theoretically i have to load mtd1 via tftp and flash/load to:
0x000000100000-0x000000200000 : "0:MIBIB"

Someone has experience with this? Can you advice me some commands to boot the device?
I tried to flash the original firmware but it does not overwrite the mtd1. So only one way to restore from dump.

I see next commands in the U-Boot:

?       - alias for 'help'
aq_load_fw- LOAD aq-fw-binary
aq_phy_restart- Restart Aquantia phy
base    - print or set address offset
bdinfo  - print Board Info structure
bootm   - boot application image from memory
bootmiwifi- bootmiwifi from flash device
bootp   - boot image via network using BOOTP/TFTP protocol
bootz   - boot Linux zImage image from memory
btnc    -  check reset button if pressed to 5s  - if so ret 1 

btni    -  init gpios for button 

chpart  - change active partition
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dcache  - enable or disable data cache
dhcp    - boot image via network using DHCP/TFTP protoco
dm      - Driver model low level access
echo    - echo args to console
env     - environment handling commands
erase   - erase FLASH memory
exectzt - execute TZT

exit    - exit script
false   - do nothing, unsuccessfully
fdt     - flattened device tree utility commands
flash   - flash part_name 
	flash part_name load_addr file_size 

flasherase- flerase part_name 


flinfo  - print FLASH memory information
fuseipq - fuse QFPROM registers from memory


go      - start application at address 'addr'
help    - print command description/usage
i2c     - I2C sub-system
icache  - enable or disable instruction cache
imxtract- extract a part of a multi-image
ipq_mdio- IPQ mdio utility commands
is_sec_boot_enabled- check secure boot fuse is enabled or not


itest   - return true/false on integer compare
loop    - infinite loop on address range
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
reset   - Perform RESET of the CPU
rmemcrash-  miwifi check and save crash buff to mtd
run     - run commands in an environment variable
runmulticore- Enable and schedule secondary cores
saveenv - save environment variables to persistent storage
secure_authenticate- authenticate the signed image

setenv  - set environment variables
sf      - SPI flash sub-system
showvar - print local hushshell variables
sleep   - delay execution for some time
smeminfo- print SMEM FLASH information
source  - run script from memory
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
tftpput - TFTP put command, for uploading files to a server
true    - do nothing, successfully
uart    - UART sub-system
ubi     - ubi commands
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version
xqup    -  load image and upgrade to flash

emptyteeth · October 23, 2021, 11:33am

this may help

flebourse · October 23, 2021, 12:08pm

The patch package/kernel/mac80211/patches/build/006-headers-Check-for-NULL-in-dev_put-and-dev_hold.patch appears to have already been applied and leads to a redefinition, no need for it.

uamarchuan · October 23, 2021, 12:26pm

Thank you. This is exactly what i need.

robimarko · October 23, 2021, 1:48pm

@flebourse Hauke will fix it for sure, Its still beta backports only

uamarchuan · October 23, 2021, 1:56pm

Can you help me with points 7, 8 and 9

i don't understand this phrase:

... remember the last hex is just a placeholder and you need to type in the tftpboot size from the upload.

is it necessary to erase segment before write new values?

IPQ807x# tftpboot mtd1.bin
ipq807x_eth_halt: done
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 up Speed :10 Full duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 up Speed :1000 Full duplex
eth0 PHY5 Down Speed :10 Half duplex
ipq807x_eth_init: done
Using eth0 device
TFTP from server 192.168.31.100; our IP address is 192.168.31.105
Filename 'mtd1.bin'.
Load address: 0x44000000
Loading: *
Got TFTP_OACK: TFTP remote port: changes from 69 to 53750
#################################################################
	 #################################################################
	 #################################################################
	 ##########
	 1.6 MiB/s
done
Bytes transferred = 1048576 (100000 hex)
ipq807x_eth_halt: done

IPQ807x# nand write 0x44000000 0x100000 0x362000
NAND write: device 0 offset 0x100000, size 0x362000
qpic_nand_read_oob: ecc failure while reading from 100800
NAND write to offset 100000 failed -5
 0 bytes written: ERROR
IPQ807x#

Bulkin · October 23, 2021, 2:05pm

Is NSS supposed to work on AX6 without any additional configuration? I'm getting a firmware loading failure:

[    9.287965] qca-nss 39000000.nss: Direct firmware load for qca-nss0.bin failed with error -2
[    9.288010] qca-nss 39000000.nss: Falling back to sysfs fallback for: qca-nss0.bin
[    9.463580] ffffffc008aee900: request_firmware failed with err code: -12
[    9.463592] ffffffc008aee900: firmware load from driver failed
[    9.469455] qca-nss: probe of 39000000.nss failed with error -12
[    9.490672] qca-nss 39400000.nss: Direct firmware load for qca-nss1.bin failed with error -2
[    9.490711] qca-nss 39400000.nss: Falling back to sysfs fallback for: qca-nss1.bin
[    9.546037] ffffffc008af6140: request_firmware failed with err code: -12
[    9.546048] ffffffc008af6140: firmware load from driver failed
[    9.551893] qca-nss: probe of 39400000.nss failed with error -12

Without NSS, running iperf between two pcs connected over the bridge interface results in 100% load on the 0-th core and memory consumption growing at a couple MB per second (the growth seems to be limited, when hitting the limit thoughput falls momentarily and a bunch of memory is freed). More concerning is WAN performance: over a couple of days, throughput to a remote server falls from 300 mb/s to under 100.

castiel652 · October 23, 2021, 2:23pm

Did you select the firmware?

Bulkin · October 23, 2021, 2:34pm

ath11k-firmware-ipq8074 is selected. Is something else required?

castiel652 · October 23, 2021, 2:42pm

You also need firmware for NSS
nss-firmware-ipq8074

Bulkin · October 23, 2021, 2:50pm

Thanks, works now! So obvious in retrospect... It's probably a good idea to add a depndency on the option in Kconfig.

dchard · October 23, 2021, 3:34pm

Want to do some 5.16 backporting already?