Adding support for Ubiquiti UniFi 6 Plus (U6+)

[elbertmai]

Ubiquiti makes an upgraded version of the U6 Lite called the U6+. My local Micro Center has a ton of these in stock, so I've decided to try getting OpenWrt running on it. Unlike the U6 Lite, the U6+ supports WiFi 6 on both 2.4 GHz and 5 GHz bands. Despite this, Ubiquiti claims 9 W maximum power consumption, vs 12 W for the U6 Lite. Both use the same mount and are the exact same size. I've physically opened the device to inspect the hardware.

System Components

• System-on-Chips:
  • MediaTek MT7981A dual-core ARM Cortex-A53 processor @ 1.3 GHz
  • MediaTek MT7976C dual-band WiFi 6 + Bluetooth radio
• Memories:
  • Nanya NT5CB128M16JR-FL 256 MB DDR3-2133 RAM
  • Macronix MX25L12833F 16 MB SPI NOR Flash
  • Kingston EMMC04G-MK27 4 GB eMMC Flash
• Interfaces:
  • 1 Gigabit Ethernet LAN and 802.3af/at PoE PD Port
    • Monolithic Power MP8009 PoE Interface and Flyback/Forward Controller
    • 9 W maximum power consumption
  • 2 x 2 MIMO dual-band WiFi 6
    • 573.5 Mbps 2.4 GHz bandwidth
    • 2402 Mbps 5 GHz bandwidth
    • 2 stamped metal antennas, each antenna is dual-band
    • 1 of the 2 antennas also used for Bluetooth
  • 115200 baud 8N1 UART serial console, pin headers not populated
  • 1 reset button
  • 1 blue LED
  • 1 white LED
• Mechanical:
  • 100% mechanically compatible with U6 Lite
  • 160 mm (6.3 inch) diameter
  • 33 mm (1.3 inch) thick

According to this post, support for MT7981A/MT7986A has been merged into Linux, so shouldn't be massively difficult to add support for U6+. I can program/debug/cross-compile so I can try taking a stab at this, but I would appreciate some pointers on how to get started with porting OpenWrt for this particular device.

[elbertmai]

Here's the boot log I've taken from the UART, posted separately to stay within character count limits:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 103F 0000
F3: 0000 0000 [0200]
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [2000]
T0: 0000 01A0 [010F]
Jump to BL

NOTICE:  BL2: v2.7(release):50aa1a6-dirty.........
NOTICE:  BL2: Built : 18:27:01, Aug 23 2022.........
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a083f1 000003ff 00100000 00000000
1001d040 | 00000000 00000000 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0x8
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 564, worse bit 0, min window 68
Window Sum 560, worse bit 11, min window 68
Window Sum 382, worse bit 1, min window 46
Window Sum 392, worse bit 9, min window 48
Window Sum 400, worse bit 1, min window 48
Window Sum 404, worse bit 14, min window 48
Window Sum 408, worse bit 1, min window 48
Window Sum 414, worse bit 8, min window 50
Window Sum 420, worse bit 1, min window 50
Window Sum 430, worse bit 14, min window 52
Window Sum 428, worse bit 1, min window 52
Window Sum 434, worse bit 15, min window 52
Window Sum 444, worse bit 1, min window 54
Window Sum 442, worse bit 9, min window 54
Window Sum 446, worse bit 1, min window 54
Window Sum 452, worse bit 9, min window 54
Window Sum 456, worse bit 3, min window 54
Window Sum 452, worse bit 8, min window 56
Window Sum 456, worse bit 9, min window 56
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.7(release):50aa1a6
NOTICE:  BL31: Built : 11:15:19, Dec  6 2022
NOTICE:  Hello BL31!!!


U-Boot 2022.04-00011-g9f2bed5188 (Dec 06 2022 - 11:15:03 +0800)

CPU:   MediaTek MT7981
Model: mt7981-rfb
DRAM:  256 MiB
Core:  38 devices, 17 uclasses, devicetree: embed
MMC:   mmc@11230000: 0
Loading Environment from SPIFlash... SF: Detected mx25l12805d with page size 256 Bytes, erase size 4 KiB, total 16 MiB
SF: Detected mx25l12805d with page size 256 Bytes, erase size 4 KiB, total 16 MiB
device 0 offset 0x0, size 0x14
SF: 20 bytes @ 0x0 Read: OK
OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:   eth0: ethernet@15100000
Autobooting in 2 seconds, press "<Esc><Esc>" to stop
ubnt boot ...

MMC read: dev # 0, block # 541824, count 1 ... 1 blocks read: OK
## Starting application at 0x440000B0 ...
Board: Ubiquiti Networks mt7981 board (a642-16.0000)
WARNING:Boot selection logic magic mismatch!
UBNT application initialized
## Application terminated, rc = 0x0
## Starting application at 0x440000B0 ...
## Application terminated, rc = 0x0
## Starting application at 0x440000B0 ...
## Application terminated, rc = 0x0

MMC read: dev # 0, block # 17536, count 1 ... 1 blocks read: OK

MMC read: dev # 0, block # 17536, count 23373 ... 23373 blocks read: OK
## Starting application at 0x440000B0 ...
## Application terminated, rc = 0x0
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-a642' configuration
   Verifying Hash Integrity ... OK
   Trying 'kernel-1' kernel subimage
     Description:  UAP6 kernel and ramdisk
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000d8
     Data Size:    11928317 Bytes = 11.4 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48080000
     Entry Point:  0x48080000
     Hash algo:    sha1
     Hash value:   de011d33005843eff5f3a734523bc91b24f8451c
     Sign algo:    sha1,rsa2048:uap6_mt7981 (required)
     Sign value:   8e550dbd0af5b6dd5fcb5093d909af67e39f5214ff911394d81e18e13caba55e90ec702a01c819934e6f418a94b9e5d694e12eeba02bea5f4c5ede4126d7d0d7461108906d9be9a424bf95e7c963b6805d27fab761c511c52519c93b9a933fe5981fbe6cd94c5c9508551dc9c6f0a9cab6dbdedfa299be3914c9d861221f1a785621dbb485ebfbebb946d94d1110e67f432b2f254fc0ef2671b269d9be0b3c49645848e9dccf7813bf6e7b9778570991fb543a1b59166052e12b9e090e0394a0fecfa7b37e207ed37db235ef7323a0bec8847c87b3ff10cc5ff620df3c9bfa982aaab40939637df7096c5db323f4c0d83cbcb259cca80b4f7e3560d2f2ec56c2
   Verifying Hash Integrity ... sha1,rsa2048:uap6_mt7981+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-a642' configuration
   Verifying Hash Integrity ... OK
   Trying 'fdt-u6-plus' fdt subimage
     Description:  u6-plus-fdt
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x46b60674
     Data Size:    16917 Bytes = 16.5 KiB
     Architecture: AArch64
     Hash algo:    sha1
     Hash value:   88d17130a3b09d0862f029fd706339e84fe4a394
     Sign algo:    sha1,rsa2048:uap6_mt7981 (required)
     Sign value:   8b8b2cdfbc8d72b8ad999e654ace4c124358fe48bc587ba89aa8228ff95ba75ab135f33b17ce7deefa01f072d9ce53b89e11346af333ff78586f0907f465495208718a279c5955391a4fe417f636847618db48addd47fadfc0b5c17149bb9b76a21a778beb10a6dbe900cb1933c505b8d393b448016c2d41c852c62aa5606e086f589dd4a7b64c5638bc485c7e2a109071161fb77e8958eb3bcdcd1bc812abe163e9b4ce03007641071bc7e9802de91d8eab915be4702d3fc05826f46a7528f97f99357af5857e1538d5c5c59ca64a5cbf302005618d9fe89a094b87722a4daa3daf28fedeb68080e5d3298d1225d42383b2d80006cf69ed64acf2310c631c48
   Verifying Hash Integrity ... sha1,rsa2048:uap6_mt7981+ sha1+ OK
   Booting using the fdt blob at 0x46b60674
   Uncompressing Kernel Image
## Starting application at 0x440000B0 ...
## Application terminated, rc = 0x0
device 0 offset 0x10000, size 0x4
SF: 4 bytes @ 0x10000 Read: OK
   Loading Device Tree to 000000004f7f3000, end 000000004f7fa214 ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.4.188 (builder@link-owrt1505-builder) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3979-2252731af4)) #0 SMP Thu Aug 30 12:10:54 2018
[    0.000000] Machine model: Ubiquiti Networks, Inc. U6+
[    0.000000] Memory limited to 255MB
[    0.000000] On node 0 totalpages: 64584
[    0.000000]   DMA32 zone: 1024 pages used for memmap
[    0.000000]   DMA32 zone: 0 pages reserved
[    0.000000]   DMA32 zone: 64584 pages, LIFO batch:15
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] percpu: Embedded 20 pages/cpu s43712 r8192 d30016 u81920
[    0.000000] pcpu-alloc: s43712 r8192 d30016 u81920 alloc=20*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 63560
[    0.000000] Kernel command line: ubootver= ramoops.mem_address=0x42fe0000 ramoops.mem_size=1048576 ramoops.ecc=1 ramoops.record_size=262144 console=ttyS0,115200n1 mem=262112K ubntbootid=0
[    0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 193484K/258336K available (7038K kernel code, 412K rwdata, 1744K rodata, 36608K init, 419K bss, 64852K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     CONFIG_RCU_FANOUT set to non-default value of 32.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] GICv3: Distributor has no Range Selector support
[    0.000000] GICv3: 16 PPIs implemented
[    0.000000] GICv3: no VLPI support, no direct LPI support
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000004] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.000110] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=52000)
[    0.000117] pid_max: default: 32768 minimum: 301
[    0.000179] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.000185] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.000835] ASID allocator initialised with 65536 entries
[    0.000884] rcu: Hierarchical SRCU implementation.
[    0.001124] smp: Bringing up secondary CPUs ...
[    0.001372] Detected VIPT I-cache on CPU1
[    0.001391] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.001413] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.001470] smp: Brought up 1 node, 2 CPUs
[    0.001478] SMP: Total of 2 processors activated.
[    0.001482] CPU features: detected: 32-bit EL0 Support
[    0.001486] CPU features: detected: CRC32 instructions
[    0.001586] CPU: All CPU(s) started at EL2
[    0.001596] alternatives: patching kernel code
[    0.003485] random: get_random_u32 called from bucket_table_alloc.isra.29+0x64/0x168 with crng_init=0
[    0.003646] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.003666] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.003736] pinctrl core: initialized pinctrl subsystem
[    0.004261] NET: Registered protocol family 16
[    0.004506] DMA: preallocated 256 KiB pool for atomic allocations
[    0.004551] ramoops: using module parameters
[    0.004710] ramoops: uncorrectable error in header
[    0.004790] ramoops: uncorrectable error in header
[    0.004863] ramoops: uncorrectable error in header
[    0.004933] ramoops: uncorrectable error in header
[    0.005005] ramoops: uncorrectable error in header
[    0.005073] ramoops: uncorrectable error in header
[    0.005140] ramoops: uncorrectable error in header
[    0.005288] pstore: Registered ramoops as persistent store backend
[    0.005293] ramoops: using 0x100000@0x42fe0000, ecc: 16
[    0.005995] ramoops: already initialized
[    0.006010] ramoops: probe of 42fe0000.ramoops failed with error -22
[    0.019687] SCSI subsystem initialized
[    0.019825] libata version 3.00 loaded.
[    0.019990] usbcore: registered new interface driver usbfs
[    0.020022] usbcore: registered new interface driver hub
[    0.020049] usbcore: registered new device driver usb
[    0.020504] lo: assigned ifindex: 1
[    0.020792] Bluetooth: Core ver 2.22
[    0.020831] NET: Registered protocol family 31
[    0.020835] Bluetooth: HCI device and connection manager initialized
[    0.020847] Bluetooth: HCI socket layer initialized
[    0.020852] Bluetooth: L2CAP socket layer initialized
[    0.020862] Bluetooth: SCO socket layer initialized
[    0.021093] rbus 18000000.wbsys: PCI host bridge to bus 0000:00
[    0.021105] pci_bus 0000:00: root bus resource [mem 0x18000000-0x18ffffff]
[    0.021111] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.021116] pci_bus 0000:00: scanning bus
[    0.021133] pci 0000:00:00.0: [14c3:7981] type 00 class 0x000280
[    0.021147] pci 0000:00:00.0: reg 0x10: [mem 0x18000000-0x1800000f 64bit]
[    0.021153] pci 0000:00:00.0: reg 0x18: [mem 0x00000000-0x0000000f]
[    0.021159] pci 0000:00:00.0: reg 0x1c: [mem 0x00000000-0x0000000f]
[    0.021164] pci 0000:00:00.0: reg 0x20: [mem 0x00000000-0x0000000f]
[    0.021170] pci 0000:00:00.0: reg 0x24: [mem 0x00000000-0x0000000f]
[    0.022009] pci_bus 0000:00: fixups for bus
[    0.022017] pci_bus 0000:00: bus scan returning with max=00
[    0.022357] clocksource: Switched to clocksource arch_sys_counter
[    0.022801] thermal_sys: Registered thermal governor 'fair_share'
[    0.022803] thermal_sys: Registered thermal governor 'bang_bang'
[    0.022810] thermal_sys: Registered thermal governor 'step_wise'
[    0.022813] thermal_sys: Registered thermal governor 'user_space'
[    0.022816] thermal_sys: Registered thermal governor 'power_allocator'
[    0.022971] NET: Registered protocol family 2
[    0.023036] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.023266] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.023277] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.023298] TCP bind hash table entries: 2048 (order: 3, 32768 bytes, linear)
[    0.023327] TCP: Hash tables configured (established 2048 bind 2048)
[    0.023375] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.023389] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.023442] NET: Registered protocol family 1
[    0.023758] PCI: CLS 0 bytes, default 64
[    0.100211] workingset: timestamp_bits=62 max_order=16 bucket_order=0
[    0.102842] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.102850] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.115991] phy phy-usb-phy@11e10000.1: type_sw - reg 0x218, index 0
[    0.125168] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    0.125806] printk: console [ttyS0] disabled
[    0.145922] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 12, base_baud = 2500000) is a ST16650V2
[    0.862785] printk: console [ttyS0] enabled
[    0.867536] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.875647] loop: module loaded
[    0.878910] mediatek,mt2701-ice_debug ice_debug: get dbg_sel clock fail: -2
[    0.885872] mediatek,mt2701-ice_debug: probe of ice_debug failed with error -2
[    0.894424] spi-nor spi0.0: mx25l12805d (16384 Kbytes)
[    0.899704] 2 fixed-partitions partitions found on MTD device spi0.0
[    0.906058] Creating 2 MTD partitions on "spi0.0":
[    0.910905] 0x000000000000-0x000000010000 : "EEPROM"
[    0.916347] 0x000000010000-0x000000090000 : "u-boot-env"
[    0.923143] [mtk_hw_init] reset_lock:0, force:0
[    0.927710] [mtk_hw_init] execute fe cold reset
[    0.963867] MediaTek MT7981 PHY mdio-bus:00: TX-VCM SW cal result: 0x3
[    0.971353] eth0: assigned ifindex: 2
[    0.975278] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc013d80000, irq 75
[    0.984339] (unnamed net_device) (dummy): netif_napi_add() called with weight 256
[    0.992101] xhci-mtk 11200000.xhci: 11200000.xhci supply vbus not found, using dummy regulator
[    1.000753] xhci-mtk 11200000.xhci: 11200000.xhci supply vusb33 not found, using dummy regulator
[    1.009647] phy phy-usb-phy@11e10000.0: try to get sw efuse
[    1.015219] phy phy-usb-phy@11e10000.1: try to get sw efuse
[    1.020783] phy phy-usb-phy@11e10000.1: try to get sw efuse+
[    1.026454] phy phy-usb-phy@11e10000.1: u3 efuse - intr 2a, rx_imp 10, tx_imp f
[    1.033789] phy_efuse_set set efuse, tx_imp f, rx_imp 10 intr 2a
[    1.039878] xhci-mtk 11200000.xhci: xHCI Host Controller
[    1.045206] xhci-mtk 11200000.xhci: new USB bus registered, assigned bus number 1
[    1.055652] xhci-mtk 11200000.xhci: hcc params 0x01403f99 hci version 0x110 quirks 0x0000000000210010
[    1.064903] xhci-mtk 11200000.xhci: irq 85, io mem 0x11200000
[    1.071070] hub 1-0:1.0: USB hub found
[    1.074840] hub 1-0:1.0: 1 port detected
[    1.079007] xhci-mtk 11200000.xhci: xHCI Host Controller
[    1.084336] xhci-mtk 11200000.xhci: new USB bus registered, assigned bus number 2
[    1.091817] xhci-mtk 11200000.xhci: Host supports USB 3.2 Enhanced SuperSpeed
[    1.098993] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    1.107390] hub 2-0:1.0: USB hub found
[    1.111164] hub 2-0:1.0: 1 port detected
[    1.115489] usbcore: registered new interface driver uas
[    1.120863] usbcore: registered new interface driver usb-storage
[    1.126962] i2c /dev entries driver
[    1.131370] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    1.139328] device-mapper: ioctl: 4.41.0-ioctl (2019-09-16) initialised: dm-devel@redhat.com
[    1.147861] Bluetooth: HCI UART driver ver 2.3
[    1.152331] Bluetooth: HCI UART protocol H4 registered
[    1.157461] Bluetooth: HCI UART protocol BCSP registered
[    1.162850] Bluetooth: HCI UART protocol Broadcom registered
[    1.168518] Bluetooth: HCI UART protocol QCA registered
[    1.200188] NET: Registered protocol family 10
[    1.205202] Segment Routing with IPv6
[    1.208920] NET: Registered protocol family 17
[    1.213385] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.226384] 8021q: 802.1Q VLAN Support v1.8
[    1.240552] hctosys: unable to open rtc device (rtc0)
[    1.246041] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[    1.254658] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[    1.278807] Freeing unused kernel memory: 36608K
[    1.290361] Run /init as init process
[    1.297922] init: Console is alive
[    1.301448] init: - watchdog -
[    1.307140] mmc0: new high speed MMC card at address 0001
[    1.313633] mmcblk0: mmc0:0001 MK2704 3.53 GiB
[    1.314099] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.318888] mmcblk0boot0: mmc0:0001 MK2704 partition 1 2.00 MiB
[    1.331678] mmcblk0boot1: mmc0:0001 MK2704 partition 2 2.00 MiB
[    1.331841] conninfra@(mtk_conninfra_drv_init:644) Before platform_driver_register
[    1.337645] mmcblk0rpmb: mmc0:0001 MK2704 partition 3 512 KiB, chardev (250:0)
[    1.345265] Get Index(0-TOP_MISC_BASE) phy_addr(0x11d10000) vir_addr=(0xffffffc012e37000) size=(0x1000)
[    1.361779] Get Index(1-TOPRGU_BASE) phy_addr(0x1001c000) vir_addr=(0xffffffc012e39000) size=(0x1000)
[    1.370999] Get Index(2-GPIO_BASE) phy_addr(0x11d00000) vir_addr=(0xffffffc012e4f000) size=(0x1000)
[    1.380031] Get Index(3-IOCFG_TR_BASE) phy_addr(0x11f00000) vir_addr=(0xffffffc012e51000) size=(0x1000)
[    1.389412] Get Index(4-IOCFG_TL_BASE) phy_addr(0x11f10000) vir_addr=(0xffffffc012e53000) size=(0x1000)
[    1.398790] Get Index(5-INFRACFG_AO_BASE) phy_addr(0x10003000) vir_addr=(0xffffffc012e57000) size=(0x1000)
[    1.408429] Get Index(6-CONN_INFRA_CFG_BASE) phy_addr(0x18001000) vir_addr=(0xffffffc012e59000) size=(0x1000)
[    1.418329] Get Index(7-CONN_INFRA_SYSRAM_BASE) phy_addr(0x18050000) vir_addr=(0xffffffc012e67000) size=(0x1000)
[    1.428488] Get Index(8-CONN_INFRA_CLKGEN_ON_TOP_BASE) phy_addr(0x18009000) vir_addr=(0xffffffc012e69000) size=(0x1000)
[    1.439255] Get Index(9-CONN_HOST_CSR_TOP_BASE) phy_addr(0x18060000) vir_addr=(0xffffffc012fb8000) size=(0x1000)
[    1.449414] Get Index(10-CONN_INFRA_BUS_CR_BASE) phy_addr(0x1800e000) vir_addr=(0xffffffc012fba000) size=(0x1000)
[    1.459661] Get Index(11-CONN_INFRA_RGU_BASE) phy_addr(0x18000000) vir_addr=(0xffffffc012fcd000) size=(0x1000)
[    1.469647] Get Index(12-CONN_WT_SLP_CTL_REG_BASE) phy_addr(0x18005000) vir_addr=(0xffffffc012fcf000) size=(0x1000)
[    1.480066] Get Index(13-INST2_CONN_WT_SLP_CTL_REG_BASE) phy_addr(0x18085000) vir_addr=(0xffffffc012fd1000) size=(0x1000)
[    1.491007] Get Index(14-CONN_RF_SPI_MST_REG_BASE) phy_addr(0x18004000) vir_addr=(0xffffffc012fd3000) size=(0x1000)
[    1.501427] Get Index(15-INST2_CONN_RF_SPI_MST_REG_BASE) phy_addr(0x18084000) vir_addr=(0xffffffc012fd5000) size=(0x1000)
[    1.512369] Get Index(16-CONN_SEMAPHORE_BASE) phy_addr(0x18070000) vir_addr=(0xffffffc013220000) size=(0x10000)
[    1.522442] Get Index(17-CONN_AFE_CTL_BASE) phy_addr(0x18003000) vir_addr=(0xffffffc012fd7000) size=(0x1000)
[    1.532254] Get Index(18-CONN_AFE_CTL_2ND_BASE) phy_addr(0x18083000) vir_addr=(0xffffffc012fd9000) size=(0x1000)
[    1.542414] Get Index(19-WF_TOP_SLPPROT_ON_BASE) phy_addr(0x184c0000) vir_addr=(0xffffffc013240000) size=(0x10000)
[    1.552747] Get Index(20-WF_TOP_CFG_BASE) phy_addr(0x184b0000) vir_addr=(0xffffffc012fdb000) size=(0x1000)
[    1.562386] Get Index(21-WF_MCU_CONFIG_LS_BASE) phy_addr(0x184f0000) vir_addr=(0xffffffc012fdd000) size=(0x1000)
[    1.572545] Get Index(22-WF_MCU_BUS_CR_BASE) phy_addr(0x18400000) vir_addr=(0xffffffc012fdf000) size=(0x1000)
[    1.582444] Get Index(23-WF_MCUSYS_INFRA_BUS_FULL_U_DEBUG_CTRL_AO_BASE) phy_addr(0x18500000) vir_addr=(0xffffffc012fe1000) size=(0x1000)
[    1.594686] Get Index(24-WF_TOP_CFG_ON_BASE) phy_addr(0x184c0000) vir_addr=(0xffffffc013260000) size=(0x10000)
[    1.604671] conninfra@(consys_plt_hw_init:162) adie_cfg_type = 1, one_adie_dbdc = 1
[    1.612319] [emi_mng_init] gConEmiPhyBase = [0x47c80000] size = [0x100000] fw size = [0x100000] ops=[(____ptrval____)]
[    1.623090] conninfra@(mtk_conninfra_drv_init:650) After platform_driver_register
[    1.630756] Alternate GPT is invalid, using primary GPT.
[    1.636110]  mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10
[    1.636323] ConnInfra Dev: init (0)
[    1.646016] conninfra@(_consys_polling_chipid_int:306) Read CONNSYS HW IP version successfully! (0x02090000)
[    1.655860] conninfra@(connsys_d_die_cfg:365) D-die efuse: 0x00000000
[    1.663323] conninfra@(_connsys_a_die_cfg_7976:919) adie_idx[0], A-die CHIP ID = 0x7976, HW Version = 0x8a10
[    1.674151] conninfra@(consys_spi_write_nolock:501) addr=0x0a00, val=0xffffffff
[    1.682455] conninfra@(consys_spi_write_nolock:501) addr=0x04ac, val=0x0000001c
[    1.690758] conninfra@(consys_spi_write_nolock:501) addr=0x0144, val=0x00000002
[    1.700071] conninfra@(consys_spi_write_nolock:501) addr=0x0148, val=0x00000000
[    1.709382] conninfra@(consys_spi_write_nolock:501) addr=0x0148, val=0x43a60000
[    1.722723] conninfra@(connsys_a_die_efuse_read_nolock:737) efuse = [0x00000001, 0x00c40000, 0x008800bd, 0x00000000]
[    1.734235] conninfra@(consys_spi_write_nolock:501) addr=0x0144, val=0x00000002
[    1.743545] conninfra@(consys_spi_write_nolock:501) addr=0x0148, val=0x23a6003a
[    1.752856] conninfra@(consys_spi_write_nolock:501) addr=0x0148, val=0x63a7003a
[    1.766197] conninfra@(connsys_a_die_efuse_read_nolock:737) efuse = [0x00000001, 0x00c40000, 0x008800bd, 0x00000000]
[    1.777709] conninfra@(consys_spi_write_nolock:501) addr=0x0144, val=0x00000002
[    1.787019] conninfra@(consys_spi_write_nolock:501) addr=0x0148, val=0x23a7003a
[    1.796332] conninfra@(consys_spi_write_nolock:501) addr=0x0148, val=0x63ac003a
[    1.809673] conninfra@(connsys_a_die_efuse_read_nolock:737) efuse = [0x00000001, 0x00c40000, 0x008800bd, 0x00000000]
[    1.821186] conninfra@(consys_spi_write_nolock:501) addr=0x0038, val=0x4a563b00
[    1.829490] conninfra@(consys_spi_write_nolock:501) addr=0x065c, val=0x1d59080f
[    1.837791] conninfra@(consys_spi_write_nolock:501) addr=0x0664, val=0x34c00fe0
[    1.846096] conninfra@(consys_spi_write_nolock:501) addr=0x0070, val=0x88888005
[    1.855358] conninfra@(consys_spi_write_nolock:501) addr=0x0070, val=0x00000005
[    1.863595] conninfra@(_consys_polling_chipid_int:306) Read CONNSYS HW IP version successfully! (0x02090000)
[    1.873409] conninfra@(_consys_hw_conninfra_wakeup:470) conninfra_wakeup refcnt=[0]->[1] wakeup!!
[    1.882274] conninfra@(_consys_hw_conninfra_sleep:490) conninfra_sleep refcnt=[1]->[0] sleep!!
[    1.890874] conninfra@(opfunc_power_on_internal:241) [Conninfra Pwr On] BT=[0] FM=[0] GPS=[0] WF=[0] CONNINFRA=[1]
[    1.904502] input: gpio-keys-polled as /devices/platform/gpio-keys-polled/input/input0
[    1.912648] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    1.922629] init: - preinit -
[    1.952757] mtk_soc_eth 15100000.ethernet eth0: PHY [mdio-bus:00] driver [MediaTek MT7981 PHY]
[    1.965050] mtk_soc_eth 15100000.ethernet eth0: configuring for phy/gmii link mode
[    1.978784] Creating /dev/mmcblk block devices
/etc/rc.common: /etc/init.d/dropbear: line 13: extra_command: not found
[    2.185930] random: fast init done
[    2.341818] EXT4-fs (mmcblk0p10): mounted filesystem with ordered data mode. Opts: (null)
[    2.341833] random: procd: uninitialized urandom read (4 bytes read)
[    2.391449] ubnt_framework attached!
[    2.396973] ubnt_common: module license 'Proprietary' taints kernel.
[    2.403351] Disabling lock debugging due to kernel taint
[    2.409847] [UBNT_STA_HT] Initialize hash table
[    2.414418] [UBNT_STA_HT] done
[    2.417460] creating /proc/ubnt_peek/
[    2.421122] creating /proc/ubnt_peek/peek_disable
[    2.425819] creating /proc/ubnt_peek/loop_check
[    2.430342] creating /proc/ubnt_peek/loop_debug
[    2.434864] creating /proc/ubnt_peek/loop_uif
[    2.439212] creating /proc/ubnt_peek/tcp_debug_mac
[    2.443994] creating /proc/ubnt_peek/tcp_debug_connections
[    2.449479] qos: registered
[    2.452266] creating /proc/ubnt_frame_id/
[    2.456268] creating /proc/ubnt_frame_id/netdevs
[    2.460887] ubnt_nfbypass: registered
[    2.464540] creating /proc/nfbypass/
[    2.468108] creating /proc/nfbypass/netdevs
[    2.472283] creating /proc/ui_bandsteer/
[    2.476197] Initialize connection observer
[    2.505786] ubnthal: Ubiquiti U6+
[    2.509700] creating procfs for ubnthal
[    2.513561] creating proc entry for system.info
[    2.518090] creating proc entry for board
[    2.522100] Registering char device sflash (200) succeeds
[    2.527489] creating procfs for status
[    2.531231] creating proc entry for IsDefault
[    2.535578] creating proc entry for IsLocated
[    2.539926] creating proc entry for IsIsolated
[    2.544360] creating proc entry for IsLte
[    2.548361] creating proc entry for ControllerPort
[    2.553141] creating proc entry for ControllerHost
[    2.557923] creating proc entry for MeshStatus
[    2.731090] conninfra@(conninfra_pwr_on:120) [conninfra_pwr_on] drv=[3]
[    2.738636] conninfra@(_consys_polling_chipid_int:306) Read CONNSYS HW IP version successfully! (0x02090000)
[    2.756506] Adie Type: 0x7976
[    2.756507] SKU Type: 3000
[    2.760423] conninfra@(opfunc_power_on_internal:241) [Conninfra Pwr On] BT=[0] FM=[0] GPS=[0] WF=[1] CONNINFRA=[1]
[    2.774493] WiFi@C12L1,get_dbg_setting_by_profile() 4355: debug level setting=INDEX0_debug_level not found!!
[    2.784336] WiFi@C12L1,get_dbg_setting_by_profile() 4378: debug option setting=INDEX0_debug_option not found!!
[    2.794381] mt_rbus 0000:00:00.0: runtime IRQ mapping not provided by arch
[    2.807112] mt7981_init()-->
[    2.809987] Use the default iPAiLNA bin image!
[    2.814470] <--mt7981_init()
[    2.817363] RtmpRaDevCtrlInit(): MCS_LUT not used becasue MacTb size(544) > 128!
[    2.824881] WiFi@C12L1,match_index_by_chipname() 566: not find chip name INDEX1
[    2.832207] WiFi@C12L1,match_index_by_chipname() 566: not find chip name INDEX2
[    2.839522] WiFi@C12L1,match_index_by_chipname() 566: not find chip name INDEX3
[    2.846835] WiFi@C12L1,match_index_by_chipname() 566: not find chip name INDEX4
[    2.854149] WiFi@C12L1,match_index_by_chipname() 566: not find chip name INDEX5
[    2.861462] WiFi@C12L1,match_index_by_chipname() 566: not find chip name INDEX6
[    2.868776] WiFi@C12L1,match_index_by_chipname() 566: not find chip name INDEX7
[    2.876094] WiFi@C12L1,match_index_by_chipname() 566: not find chip name INDEX8
[    2.883408] WiFi@C12L1,match_index_by_chipname() 566: not find chip name INDEX9
[    2.890708] WiFi@C12L2,match_index_by_chipname() 571: Not find slot id, back to old rule.
[    2.898981] msta_ifname not found
[    2.902359] wevent: registered
[    2.907915] 80211> CFG80211_Register
[    2.911498] ra0: VLAN features updated vwire/vport[0]!
[    2.916633] ra0: assigned ifindex: 3
[    3.103220] creating /proc/gpio/
[    3.106468]          /proc/gpio/ledbar_control
[    3.110905]          /proc/gpio/led_pattern
[    3.115083]          /proc/gpio/led_tempo
[    3.119083]          /proc/gpio/poe_passthrough
[    3.123603]          /proc/gpio/ble_reset
[    3.127603]          /proc/gpio/ble_normalmode
[    3.893797] sh (679): drop_caches: 1
[    4.555475] procd: - early -
[    4.558417] procd: - watchdog -
[    4.641964] procd: Could not find firmware /lib/firmware/regulatory.db
[    4.648761] cfg80211: failed to load regulatory.db
[    5.150292] procd: - watchdog -
[    5.153553] procd: - ubus -
[    5.157969] random: ubusd: uninitialized urandom read (4 bytes read)
[    5.206031] random: ubusd: uninitialized urandom read (4 bytes read)
[    5.212486] random: ubusd: uninitialized urandom read (4 bytes read)
[    5.219118] procd: - init -
Please press Enter to activate this console.
[    5.265159] kmodloader: loading kernel modules from /etc/modules.d.sysinit/*
[    5.285728] Bridge firewalling registered
[    5.306362] xt_time: kernel timezone is -0000
[    5.314307] kmodloader: done loading kernel modules from /etc/modules.d.sysinit/*
[    5.327506] kmodloader: loading kernel modules from /etc/modules.d/*
[    5.351353] hidraw: raw HID events driver (C) Jiri Kosina
[    5.361043] u32 classifier
[    5.363755]     input device check on
[    5.367408]     Actions configured
[    5.371646] Mirror/redirect action on
[    5.375985] kmodloader: done loading kernel modules from /etc/modules.d/*
ubntconf: ERROR: wevent: unifi.mcip not found
ubntconf: ERROR: wevent: unifi.key not found
ubntconf: ERROR: route: add ip 224.0.0.0, netmask 224.0.0.0, gw default, dev br0 failed
ubntconf: ERROR: route: del ip 224.0.0.0, netmask 224.0.0.0, gw default, dev br0 failed

[mTek]

Hi, have you made any more progress on this hardware?

[frollic]

you do realize most hw take more than a week to add to openwrt, right ?

[mTek]

Yes, I do. Do you know that unless you're the one doing the work you're just making a nonsense post?

Not everyone has time to work on projects weekly and I understand that. I also understand that if we don't engage with them often they will quietly get this working and may not upstream their patch.

[robimarko]

You will achieve the opposite effect by pinging people working on stuff, it will be done when its done in FOSS.

[frollic]

@mTek

if we don't engage with them often they will quietly get this working and may not upstream their patch.

I'd have the opposite effect on me, but I guess people are different...
Want it sooner than when it's ready, pay for it.

[bmork]

@elbertmai

I can program/debug/cross-compile so I can try taking a stab at this, but I would appreciate some pointers on how to get started with porting OpenWrt for this particular device.

First figure out what the stock booloader allows you to do. Can you boot an image from RAM? That makes testing a lot easier. Does it support/need the same "devmode" workaround as the U6 Lite? If so, then great.

As for images - Use the DTS from one of the supported MT7981 devices as a template, and adapt to the U6+ hardware. It doesn't need to be perfect as long as you're booting from memory. Fetching the DTB stock images and from a booted firmware makes it easier to map the hardware.

Very interesting device. I was about to buy another U6 Lite. So this was just in time for me Thanks for the hardware breakdown

[elbertmai]

I forgot that running from RAM is an option, I'll definitely try that out first. What stumped me at first was that the operating system is stored on eMMC instead of SPI flash like how it was on U6 lite. In fact, that was what motivated me to open the thing because cat /proc/mtd only showed two entries, none of which stores the kernel:

U6-Plus-BZ.6.5.28# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00010000 00010000 "EEPROM"
mtd1: 00080000 00010000 "u-boot-env"

But I can worry about that after I get something other than stock booted on the device.

As for the device tree, I was able to scp -r ubnt@192.168.1.20:/proc/device-tree . onto my development machine and did dtc -I fs -O dts device-tree. It appears to work, I'll provide it in a separate post. I plan to diff this with this commit and go from there.

[elbertmai]

Here's the DTS I was able to generate from /proc/device-tree:

/dts-v1/;

/ {
	compatible = "mediatek,mt7981-emmc-rfb";
	model = "Ubiquiti Networks, Inc. U6+";
	interrupt-parent = <0x01>;
	#size-cells = <0x02>;
	#address-cells = <0x02>;

	oscillator@0 {
		phandle = <0x1f>;
		compatible = "fixed-clock";
		clock-frequency = <0x2625a00>;
		#clock-cells = <0x00>;
		clock-output-names = "clkxtal";
	};

	gpio-keys-polled {
		compatible = "gpio-keys-polled";
		poll-interval = <0x14>;
		#size-cells = <0x00>;
		#address-cells = <0x01>;

		reset {
			linux,code = <0x198>;
			gpios = <0x0c 0x01 0x01>;
			label = "reset";
		};
	};

	ubnthal {

		write-protect {
			compatible = "ubnthal,write-protect";
			default-write-policy = "rw";

			explicit-write-policy {

				disk {

					mmcblk0@0 {

						partition@3 {
							write-policy = "rw";
							label = "log";
						};

						partition@1 {
							write-policy = "rw";
							label = "bs";
						};

						partition@0 {
							write-policy = "rw";
							label = "u-boot-env";
						};

						partition@2 {
							write-policy = "rw";
							label = "cfg";
						};
					};
				};

				mtd {

					partition@0 {
						write-policy = "rw";
						label = "u-boot-env";
					};
				};
			};

			bus {

				mmc@0 {
					bus = "*.mmc";
					default-write-policy = "ro";
				};

				spi@1 {
					bus = "*.spi";
					default-write-policy = "ro";
				};
			};
		};
	};

	snfi@11005000 {
		reg-names = "nfi\0ecc";
		reg = <0x00 0x11005000 0x00 0x1000 0x00 0x11006000 0x00 0x1000>;
		assigned-clock-parents = <0x08 0x06 0x08 0x06>;
		interrupts = <0x00 0x79 0x04>;
		compatible = "mediatek,mt7986-snand";
		clock-names = "pad_clk\0nfi_clk\0nfi_hclk";
		assigned-clocks = <0x08 0x4d 0x08 0x4c>;
		status = "disabled";
		#size-cells = <0x00>;
		clocks = <0x02 0x24 0x02 0x23 0x02 0x25>;
		#address-cells = <0x01>;
	};

	syscon@15000000 {
		phandle = <0x0d>;
		reg = <0x00 0x15000000 0x00 0x1000>;
		compatible = "mediatek,mt7981-ethsys\0syscon";
		#reset-cells = <0x01>;
		#size-cells = <0x01>;
		#address-cells = <0x01>;
		#clock-cells = <0x01>;

		reset-controller {
			ti,reset-bits = <0x34 0x04 0x34 0x04 0x34 0x04 0x28>;
			phandle = <0x07>;
			compatible = "ti,syscon-reset";
			#reset-cells = <0x01>;
		};
	};

	spi@1100a000 {
		reg = <0x00 0x1100a000 0x00 0x100>;
		interrupts = <0x00 0x8c 0x04>;
		compatible = "mediatek,ipm-spi-quad";
		clock-names = "parent-clk\0sel-clk\0spi-clk\0spi-hclk";
		status = "disabled";
		clocks = <0x08 0x02 0x08 0x4e 0x02 0x26 0x02 0x28>;
	};

	xhci@11200000 {
		mediatek,u3p-dis-msk = <0x00>;
		reg-names = "mac\0ippc";
		reg = <0x00 0x11200000 0x00 0x2e00 0x00 0x11203e00 0x00 0x100>;
		interrupts = <0x00 0xad 0x04>;
		compatible = "mediatek,mt7986-xhci\0mediatek,mtk-xhci";
		clock-names = "sys_ck\0xhci_ck\0ref_ck\0mcu_ck\0dma_ck";
		status = "okay";
		#size-cells = <0x02>;
		clocks = <0x1b 0x1b 0x1b 0x1b 0x1b>;
		#address-cells = <0x02>;
		phys = <0x1a 0x03 0x0a 0x04>;
	};

	consys@10000000 {
		reg = <0x00 0x10000000 0x00 0x8600000>;
		compatible = "mediatek,mt7981-consys";
		memory-region = <0x19>;
	};

	crypto@10320000 {
		reg = <0x00 0x10320000 0x00 0x40000>;
		assigned-clock-parents = <0x08 0x15>;
		interrupts = <0x00 0x74 0x04 0x00 0x75 0x04 0x00 0x76 0x04 0x00 0x77 0x04>;
		compatible = "inside-secure,safexcel-eip97";
		interrupt-names = "ring0\0ring1\0ring2\0ring3";
		clock-names = "top_eip97_ck";
		assigned-clocks = <0x08 0x63>;
		clocks = <0x08 0x42>;
	};

	efuse@11f20000 {
		reg = <0x00 0x11f20000 0x00 0x1000>;
		compatible = "mediatek,efuse";
		#size-cells = <0x01>;
		#address-cells = <0x01>;

		calib@8dc {
			phandle = <0x13>;
			reg = <0x8dc 0x10>;
		};

		calib@274 {
			phandle = <0x06>;
			reg = <0x274 0x0c>;
		};

		usb3-tx-imp@8c8 {
			phandle = <0x1e>;
			bits = <0x05 0x05>;
			reg = <0x8c8 0x02>;
		};

		usb3-intr@8c9 {
			phandle = <0x1c>;
			bits = <0x02 0x06>;
			reg = <0x8c9 0x01>;
		};

		usb3-rx-imp@8c8 {
			phandle = <0x1d>;
			bits = <0x00 0x05>;
			reg = <0x8c8 0x01>;
		};
	};

	regulator-3p3v {
		phandle = <0x16>;
		compatible = "regulator-fixed";
		regulator-name = "fixed-3.3V";
		regulator-always-on;
		regulator-boot-on;
		regulator-min-microvolt = <0x325aa0>;
		regulator-max-microvolt = <0x325aa0>;
	};

	wed@15010000 {
		reg = <0x00 0x15010000 0x00 0x1000 0x00 0x15011000 0x00 0x1000>;
		interrupts = <0x00 0xcd 0x04 0x00 0xce 0x04>;
		compatible = "mediatek,wed";
		interrupt-parent = <0x01>;
		pci_slot_map = <0x00 0x01>;
		wed_num = <0x02>;
	};

	apmixedsys@1001E000 {
		phandle = <0x05>;
		reg = <0x00 0x1001e000 0x00 0x1000>;
		compatible = "mediatek,mt7981-apmixedsys\0syscon";
		#clock-cells = <0x01>;
	};

	infracfg@10001040 {
		phandle = <0x09>;
		reg = <0x00 0x10001068 0x00 0x1000>;
		compatible = "mediatek,mt7981-infracfg\0syscon";
		#clock-cells = <0x01>;
	};

	ap2woccif@151A5000 {
		reg = <0x00 0x151a5000 0x00 0x1000 0x00 0x151ad000 0x00 0x1000>;
		interrupts = <0x00 0xd3 0x04 0x00 0xd4 0x04>;
		compatible = "mediatek,ap2woccif";
		interrupt-parent = <0x01>;
	};

	wdma@15104800 {
		reg = <0x00 0x15104800 0x00 0x400 0x00 0x15104c00 0x00 0x400>;
		compatible = "mediatek,wed-wdma";
	};

	mmc@11230000 {
		pinctrl-1 = <0x15>;
		non-removable;
		bus-width = <0x08>;
		reg = <0x00 0x11230000 0x00 0x1000 0x00 0x11c20000 0x00 0x1000>;
		assigned-clock-parents = <0x08 0x02 0x08 0x1c>;
		interrupts = <0x00 0x8f 0x04>;
		compatible = "mediatek,mt7986-mmc\0mediatek,mt7981-mmc";
		clock-names = "source\0hclk\0source_cg";
		assigned-clocks = <0x08 0x54 0x08 0x55>;
		status = "okay";
		clocks = <0x08 0x33 0x08 0x34 0x02 0x2b>;
		cap-mmc-highspeed;
		max-frequency = <0x3197500>;
		vmmc-supply = <0x16>;
		pinctrl-names = "default\0state_uhs";
		pinctrl-0 = <0x14>;
	};

	ethernet@15100000 {
		reg = <0x00 0x15100000 0x00 0x80000>;
		mediatek,sgmiisys = <0x0e 0x0f>;
		assigned-clock-parents = <0x08 0x1b 0x08 0x22>;
		interrupts = <0x00 0xc4 0x04 0x00 0xc5 0x04 0x00 0xc6 0x04 0x00 0xc7 0x04>;
		compatible = "mediatek,mt7981-eth";
		clock-names = "fe\0gp2\0gp1\0wocpu0\0sgmii_tx250m\0sgmii_rx250m\0sgmii_cdr_ref\0sgmii_cdr_fb\0sgmii2_tx250m\0sgmii2_rx250m\0sgmii2_cdr_ref\0sgmii2_cdr_fb";
		assigned-clocks = <0x08 0x60 0x08 0x61>;
		status = "okay";
		#reset-cells = <0x01>;
		mediatek,ethsys = <0x0d>;
		#size-cells = <0x00>;
		mediatek,infracfg = <0x10>;
		clocks = <0x0d 0x00 0x0d 0x01 0x0d 0x02 0x0d 0x03 0x0e 0x00 0x0e 0x01 0x0e 0x02 0x0e 0x03 0x0f 0x00 0x0f 0x01 0x0f 0x02 0x0f 0x03>;
		#address-cells = <0x01>;

		mac@1 {
			phy-handle = <0x12>;
			reg = <0x01>;
			compatible = "mediatek,eth-mac";
			mac-address = [f4 e2 c6 43 38 a4];
			mtd-mac-address = <0x11 0x00>;
			phy-mode = "gmii";
		};

		mdio-bus {
			#size-cells = <0x00>;
			#address-cells = <0x01>;

			ethernet-phy@0 {
				phandle = <0x12>;
				reg = <0x00>;
				compatible = "ethernet-phy-id03a2.9461";
				nvmem-cell-names = "phy-cal-data";
				phy-mode = "gmii";
				nvmem-cells = <0x13>;
			};
		};
	};

	interrupt-controller@c000000 {
		phandle = <0x01>;
		#interrupt-cells = <0x03>;
		reg = <0x00 0xc000000 0x00 0x40000 0x00 0xc080000 0x00 0x200000>;
		interrupts = <0x01 0x09 0x04>;
		compatible = "arm,gic-v3";
		interrupt-controller;
		interrupt-parent = <0x01>;
	};

	i2c@11007000 {
		reg = <0x00 0x11007000 0x00 0x1000 0x00 0x10217080 0x00 0x80>;
		interrupts = <0x00 0x88 0x04>;
		compatible = "mediatek,mt7981-i2c";
		clock-names = "main\0dma";
		status = "disabled";
		#size-cells = <0x00>;
		clocks = <0x02 0x1d 0x02 0x19>;
		#address-cells = <0x01>;
		clock-div = <0x01>;
	};

	topmisc@11d10000 {
		phandle = <0x10>;
		reg = <0x00 0x11d10000 0x00 0x10000>;
		compatible = "mediatek,mt7981-topmisc\0syscon";
		#clock-cells = <0x01>;
	};

	topckgen@1001B000 {
		phandle = <0x08>;
		reg = <0x00 0x1001b000 0x00 0x1000>;
		compatible = "mediatek,mt7981-topckgen\0syscon";
		#clock-cells = <0x01>;
	};

	reserved-memory {
		ranges;
		#size-cells = <0x02>;
		#address-cells = <0x02>;

		wocpu_data@47DC0000 {
			reg = <0x00 0x47dc0000 0x00 0x240000>;
			compatible = "mediatek,wocpu_data";
			no-map;
			shared = <0x01>;
		};

		wocpu0_emi@47D80000 {
			reg = <0x00 0x47d80000 0x00 0x40000>;
			compatible = "mediatek,wocpu0_emi";
			no-map;
			shared = <0x00>;
		};

		ramoops@42fe0000 {
			reg = <0x00 0x42fe0000 0x00 0x100000>;
			compatible = "ramoops";
			console-size = <0x1000>;
			ftrace-size = <0x1000>;
			pmsg-size = <0x1000>;
			record-size = <0x1000>;
		};

		wmcpu-reserved@47C80000 {
			phandle = <0x19>;
			reg = <0x00 0x47c80000 0x00 0x100000>;
			compatible = "mediatek,wmcpu-reserved";
			no-map;
		};

		secmon@43e00000 {
			reg = <0x00 0x43e00000 0x00 0x30000>;
			no-map;
		};
	};

	spi@11009000 {
		reg = <0x00 0x11009000 0x00 0x100>;
		interrupts = <0x00 0x8e 0x04>;
		compatible = "mediatek,ipm-spi-quad";
		clock-names = "parent-clk\0sel-clk\0spi-clk\0spi-hclk";
		status = "okay";
		clocks = <0x08 0x02 0x08 0x4e 0x02 0x21 0x02 0x22>;
		pinctrl-names = "default";
		pinctrl-0 = <0x18>;

		spi_nor@0 {
			reg = <0x00>;
			spi-rx-buswidth = <0x04>;
			compatible = "jedec,spi-nor";
			#size-cells = <0x01>;
			spi-max-frequency = <0x3197500>;
			spi-tx-buswidth = <0x04>;
			#address-cells = <0x01>;

			partition@100000 {
				reg = <0x10000 0x80000>;
				label = "u-boot-env";
			};

			partition@00000 {
				phandle = <0x11>;
				reg = <0x00 0x10000>;
				label = "EEPROM";
			};
		};
	};

	chosen {
		bootargs = "ubootver= ramoops.mem_address=0x42fe0000 ramoops.mem_size=1048576 ramoops.ecc=1 ramoops.record_size=262144 console=ttyS0,115200n1 mem=262112K ubntbootid=0";
	};

	ice_debug {
		compatible = "mediatek,mt7981-ice_debug\0mediatek,mt2701-ice_debug";
		clock-names = "ice_dbg";
		clocks = <0x02 0x18>;
	};

	spi@1100b000 {
		reg = <0x00 0x1100b000 0x00 0x100>;
		interrupts = <0x00 0x8d 0x04>;
		compatible = "mediatek,ipm-spi-single";
		clock-names = "parent-clk\0sel-clk\0spi-clk\0spi-hclk";
		status = "disabled";
		clocks = <0x08 0x02 0x08 0x4f 0x02 0x27 0x02 0x29>;
		pinctrl-names = "default";
		pinctrl-0 = <0x17>;
	};

	thermal@1100c800 {
		phandle = <0x03>;
		reg = <0x00 0x1100c800 0x00 0x800>;
		interrupts = <0x00 0x8a 0x04>;
		#thermal-sensor-cells = <0x01>;
		compatible = "mediatek,mt7981-thermal";
		clock-names = "therm\0auxadc\0adc_32k";
		mediatek,apmixedsys = <0x05>;
		clocks = <0x02 0x1c 0x02 0x2f 0x02 0x30>;
		nvmem-cell-names = "calibration-data";
		mediatek,auxadc = <0x04>;
		nvmem-cells = <0x06>;
	};

	serial@11004000 {
		reg = <0x00 0x11004000 0x00 0x400>;
		assigned-clock-parents = <0x08 0x00 0x09 0x01>;
		interrupts = <0x00 0x7d 0x04>;
		compatible = "mediatek,mt6577-uart";
		assigned-clocks = <0x08 0x50 0x02 0x02>;
		status = "disabled";
		clocks = <0x02 0x20>;
	};

	psci {
		compatible = "arm,psci-0.2";
		method = "smc";
	};

	thermal-zones {

		cpu-thermal {
			polling-delay-passive = <0x3e8>;
			polling-delay = <0x3e8>;
			thermal-sensors = <0x03 0x00>;
		};
	};

	wocpu0_ilm@151E0000 {
		reg = <0x00 0x151e0000 0x00 0x8000>;
		compatible = "mediatek,wocpu0_ilm";
	};

	pinctrl@11d00000 {
		reg-names = "gpio_base\0iocfg_rt_base\0iocfg_rm_base\0iocfg_rb_base\0iocfg_lb_base\0iocfg_bl_base\0iocfg_tm_base\0iocfg_tl_base\0eint";
		phandle = <0x0c>;
		#interrupt-cells = <0x02>;
		reg = <0x00 0x11d00000 0x00 0x1000 0x00 0x11c00000 0x00 0x1000 0x00 0x11c10000 0x00 0x1000 0x00 0x11d20000 0x00 0x1000 0x00 0x11e00000 0x00 0x1000 0x00 0x11e20000 0x00 0x1000 0x00 0x11f00000 0x00 0x1000 0x00 0x11f10000 0x00 0x1000 0x00 0x1000b000 0x00 0x1000>;
		interrupts = <0x00 0xe1 0x04>;
		compatible = "mediatek,mt7981-pinctrl";
		gpio-ranges = <0x0c 0x00 0x00 0x38>;
		interrupt-controller;
		interrupt-parent = <0x01>;
		gpio-controller;
		#gpio-cells = <0x02>;

		spi1-pins {
			phandle = <0x17>;

			mux {
				groups = "spi1_1";
				function = "spi";
			};
		};

		spi2-pins {
			phandle = <0x18>;

			mux {
				groups = "spi2\0spi2_wp_hold";
				function = "spi";
			};
		};

		mmc0-pins-default {
			phandle = <0x14>;

			mux {
				groups = "emmc_45";
				function = "flash";
			};
		};

		mmc0-pins-uhs {
			phandle = <0x15>;

			mux {
				groups = "emmc_45";
				function = "flash";
			};
		};
	};

	serial@11002000 {
		reg = <0x00 0x11002000 0x00 0x400>;
		assigned-clock-parents = <0x08 0x00 0x09 0x01>;
		interrupts = <0x00 0x7b 0x04>;
		compatible = "mediatek,mt6577-uart";
		assigned-clocks = <0x08 0x50 0x02 0x00>;
		status = "okay";
		clocks = <0x02 0x1e>;
	};

	wocpu_boot@15194000 {
		reg = <0x00 0x15194000 0x00 0x1000>;
		compatible = "mediatek,wocpu_boot";
	};

	dummy_gpt_clk {
		compatible = "fixed-clock";
		clock-frequency = <0x1312d00>;
		#clock-cells = <0x00>;
	};

	wed_pcie@10003000 {
		reg = <0x00 0x10003000 0x00 0x10>;
		compatible = "mediatek,wed_pcie";
	};

	memory {
		device_type = "memory";
		reg = <0x00 0x40000000 0x00 0xfff8000>;
	};

	adc@1100d000 {
		phandle = <0x04>;
		reg = <0x00 0x1100d000 0x00 0x1000>;
		compatible = "mediatek,mt7981-auxadc\0mediatek,mt7622-auxadc";
		clock-names = "main\032k";
		clocks = <0x02 0x2f 0x02 0x30>;
		#io-channel-cells = <0x01>;
	};

	serial@11003000 {
		reg = <0x00 0x11003000 0x00 0x400>;
		assigned-clock-parents = <0x08 0x00 0x09 0x01>;
		interrupts = <0x00 0x7c 0x04>;
		compatible = "mediatek,mt6577-uart";
		assigned-clocks = <0x08 0x50 0x02 0x01>;
		status = "disabled";
		clocks = <0x02 0x1f>;
	};

	pcie@11280000 {
		ranges = <0x82000000 0x00 0x20000000 0x00 0x20000000 0x00 0x10000000>;
		reg-names = "pcie-mac";
		device_type = "pci";
		#interrupt-cells = <0x01>;
		reg = <0x00 0x11280000 0x00 0x4000>;
		interrupts = <0x00 0xa8 0x04>;
		interrupt-map = <0x00 0x00 0x00 0x01 0x0b 0x00 0x00 0x00 0x00 0x02 0x0b 0x01 0x00 0x00 0x00 0x03 0x0b 0x02 0x00 0x00 0x00 0x04 0x0b 0x03>;
		compatible = "mediatek,mt7981-pcie\0mediatek,mt7986-pcie";
		status = "disabled";
		phy-names = "pcie-phy";
		#size-cells = <0x02>;
		clocks = <0x02 0x38 0x02 0x39 0x02 0x3a 0x02 0x3b>;
		#address-cells = <0x03>;
		phys = <0x0a 0x02>;
		bus-range = <0x00 0xff>;
		interrupt-map-mask = <0x00 0x00 0x00 0x07>;

		interrupt-controller {
			phandle = <0x0b>;
			#interrupt-cells = <0x01>;
			interrupt-controller;
			#address-cells = <0x00>;
		};
	};

	timer {
		interrupts = <0x01 0x0d 0x08 0x01 0x0e 0x08 0x01 0x0b 0x08 0x01 0x0a 0x08>;
		compatible = "arm,armv8-timer";
		interrupt-parent = <0x01>;
		clock-frequency = <0xc65d40>;
	};

	usb-phy@11e10000 {
		ranges;
		compatible = "mediatek,mt7986\0mediatek,generic-tphy-v2";
		status = "okay";
		#size-cells = <0x02>;
		#address-cells = <0x02>;

		usb-phy@11e10700 {
			phandle = <0x0a>;
			reg = <0x00 0x11e10700 0x00 0x900>;
			clock-names = "ref";
			status = "okay";
			mediatek,syscon-type = <0x10 0x218 0x00>;
			clocks = <0x1b>;
			nvmem-cell-names = "intr\0rx_imp\0tx_imp";
			#phy-cells = <0x01>;
			nvmem-cells = <0x1c 0x1d 0x1e>;
		};

		usb-phy@11e10000 {
			phandle = <0x1a>;
			reg = <0x00 0x11e10000 0x00 0x700>;
			clock-names = "ref";
			status = "okay";
			clocks = <0x1b>;
			#phy-cells = <0x01>;
		};
	};

	watchdog@1001c000 {
		reg = <0x00 0x1001c000 0x00 0x1000>;
		interrupts = <0x00 0x6e 0x04>;
		compatible = "mediatek,mt7622-wdt\0mediatek,mt6589-wdt";
		status = "okay";
		#reset-cells = <0x01>;
	};

	syscon@10060000 {
		phandle = <0x0e>;
		reg = <0x00 0x10060000 0x00 0x1000>;
		compatible = "mediatek,mt7981-sgmiisys_0\0syscon";
		pn_swap;
		#clock-cells = <0x01>;
	};

	dummy_system_clk {
		phandle = <0x1b>;
		compatible = "fixed-clock";
		clock-frequency = <0x2625a00>;
		#clock-cells = <0x00>;
	};

	wocpu_dlm@151E8000 {
		reg = <0x00 0x151e8000 0x00 0x2000 0x00 0x151f8000 0x00 0x2000>;
		compatible = "mediatek,wocpu_dlm";
		resets = <0x07 0x00>;
		reset-names = "wocpu_rst";
	};

	clkitg {
		compatible = "simple-bus";

		bring-up {
			compatible = "mediatek,clk-bring-up";
			clock-names = "0\01\02\03\04\05\06\07\08\09\010\011\012\013\014\015\016\017\018\019\020\021\022\023\024\025\026\027\028\029\030\031\032\033\034\035\036\037\038\039\040\041\042\043\044\045\046\047\048\049\050\051\052\053\054\055\056\057\058\059\060\061\062\063\064\065\066\067\068\069\070\071\072\073\074\075\076\077\078\079\080\081\082\083\084\085\086\087\088\089\090\091\092\093\094\095\096\097\098\099\0100\0101\0102\0103\0104\0105\0106\0107\0108\0109\0110\0111\0112\0113\0114\0115\0116\0117\0118\0119\0120\0121\0122\0123\0124\0125\0126\0127\0128\0129\0130\0131\0132\0133\0134\0135\0136\0137\0138\0139\0140\0141\0142\0143\0144\0145\0146\0147\0148\0149\0150\0151\0152\0153\0154\0155\0156\0157\0158\0159\0160\0161\0162\0163\0164\0165\0166\0167\0168\0169\0170\0171\0172\0173\0174\0175\0176\0177\0178\0179\0180\0181\0182\0183";
			clocks = <0x05 0x00 0x05 0x01 0x05 0x02 0x05 0x03 0x05 0x04 0x05 0x05 0x05 0x06 0x05 0x07 0x09 0x00 0x1f 0x09 0x02 0x09 0x03 0x09 0x04 0x1f 0x09 0x06 0x09 0x07 0x1f 0x1f 0x1f 0x1f 0x09 0x0c 0x09 0x0d 0x09 0x0e 0x09 0x0f 0x09 0x10 0x09 0x11 0x1f 0x1f 0x1f 0x1f 0x1f 0x09 0x17 0x09 0x18 0x09 0x1a 0x09 0x1b 0x09 0x1c 0x09 0x1d 0x09 0x1e 0x09 0x1f 0x09 0x20 0x09 0x21 0x1f 0x09 0x23 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x02 0x0b 0x1f 0x1f 0x1f 0x1f 0x02 0x11 0x1f 0x1f 0x1f 0x1f 0x1f 0x02 0x17 0x1f 0x02 0x19 0x02 0x1a 0x02 0x1b 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x1f 0x02 0x2a 0x02 0x2b 0x02 0x2c 0x02 0x2d 0x02 0x2e 0x1f 0x1f 0x02 0x31 0x02 0x32 0x02 0x33 0x02 0x34 0x02 0x35 0x02 0x36 0x02 0x37 0x1f 0x1f 0x1f 0x08 0x01 0x1f 0x08 0x05 0x08 0x06 0x08 0x07 0x08 0x04 0x08 0x09 0x08 0x0c 0x08 0x0f 0x08 0x10 0x08 0x12 0x08 0x14 0x08 0x15 0x08 0x16 0x08 0x17 0x08 0x19 0x08 0x1a 0x1f 0x08 0x1d 0x08 0x1e 0x08 0x21 0x1f 0x08 0x24 0x08 0x25 0x1f 0x08 0x29 0x08 0x26 0x08 0x2b 0x08 0x2a 0x1f 0x08 0x31 0x1f 0x1f 0x1f 0x08 0x56 0x08 0x37 0x08 0x3d 0x08 0x3e 0x08 0x3f 0x08 0x45 0x08 0x41 0x08 0x46 0x08 0x47 0x08 0x48 0x08 0x49 0x08 0x4a 0x08 0x3a 0x1f 0x1f 0x1f 0x1f 0x08 0x52 0x1f 0x1f 0x1f 0x08 0x56 0x08 0x57 0x08 0x58 0x08 0x59 0x08 0x5a 0x08 0x5b 0x08 0x5c 0x08 0x5d 0x08 0x5e 0x08 0x5f 0x1f 0x1f 0x08 0x62 0x08 0x5e 0x1f 0x08 0x64 0x08 0x56 0x08 0x69 0x08 0x6a 0x08 0x6b 0x08 0x6c>;
		};
	};

	infracfg_ao@10001000 {
		phandle = <0x02>;
		reg = <0x00 0x10001000 0x00 0x68>;
		compatible = "mediatek,mt7981-infracfg_ao\0syscon";
		#clock-cells = <0x01>;
	};

	pwm@10048000 {
		reg = <0x00 0x10048000 0x00 0x1000>;
		compatible = "mediatek,mt7981-pwm";
		clock-names = "top\0main\0pwm1\0pwm2\0pwm3";
		clocks = <0x02 0x0d 0x02 0x0c 0x02 0x0e 0x02 0x0f 0x02 0x10>;
		#pwm-cells = <0x02>;
	};

	trng@1020f000 {
		compatible = "mediatek,mt7981-rng";
	};

	cpus {
		#size-cells = <0x00>;
		#address-cells = <0x01>;

		cpu@0 {
			device_type = "cpu";
			enable-method = "psci";
			reg = <0x00>;
			compatible = "arm,cortex-a53";
		};

		cpu@1 {
			device_type = "cpu";
			enable-method = "psci";
			reg = <0x01>;
			compatible = "arm,cortex-a53";
		};
	};

	audio-controller@11210000 {
		reg = <0x00 0x11210000 0x00 0x9000>;
		assigned-clock-parents = <0x08 0x10 0x08 0x12 0x08 0x10 0x08 0x12>;
		interrupts = <0x00 0x6a 0x04>;
		compatible = "mediatek,mt79xx-audio";
		clock-names = "aud_bus_ck\0aud_26m_ck\0aud_l_ck\0aud_aud_ck\0aud_eg2_ck\0aud_sel";
		assigned-clocks = <0x08 0x65 0x08 0x66 0x08 0x67 0x08 0x68>;
		status = "disabled";
		clocks = <0x02 0x12 0x02 0x13 0x02 0x14 0x02 0x15 0x02 0x16 0x08 0x65>;
	};

	gpio-leds {
		compatible = "gpio-leds";

		wifi {
			linux,default-trigger = "external1";
			gpios = <0x0c 0x23 0x00>;
			label = "ubnt:blue:personality";
		};

		power {
			linux,default-trigger = "external0";
			gpios = <0x0c 0x22 0x00>;
			label = "ubnt:white:personality";
		};
	};

	wbsys@18000000 {
		reg = <0x00 0x18000000 0x00 0x1000000>;
		interrupts = <0x00 0xd5 0x04 0x00 0xd6 0x04 0x00 0xd7 0x04 0x00 0xd8 0x04>;
		compatible = "mediatek,wbsys";
		chip_id = <0x7981>;
	};

	syscon@10070000 {
		phandle = <0x0f>;
		reg = <0x00 0x10070000 0x00 0x1000>;
		compatible = "mediatek,mt7981-sgmiisys_1\0syscon";
		#clock-cells = <0x01>;
	};

	hnat@15000000 {
		mtketh-max-gmac = <0x02>;
		reg = <0x00 0x15100000 0x00 0x80000>;
		compatible = "mediatek,mtk-hnat_v4";
		resets = <0x0d 0x00>;
		status = "okay";
		mtketh-wan = "eth1";
		reset-names = "mtketh";
		mtketh-lan = "lan";
	};
};

[elbertmai]

@mTek @frollic @robimarko I don't mind some prodding here and there. I'm glad to know there is enough interest to justify putting some effort into this. Especially since I'm flying by the seat of my pants here.

I've quickly hacked together a UART "jig" consisting of a Raspberry Pi Debug Probe and a rubber band so it should be a lot easier to talk to u-boot. Right now I'm attempting to set up the toolchain for cross-compiling an image. I was able to get a device tree from stock firmware so I should be able to get somewhere without guessing too much.

[elbertmai]

@bmork

First figure out what the stock booloader allows you to do. Can you boot an image from RAM? That makes testing a lot easier. Does it support/need the same "devmode" workaround as the U6 Lite? If so, then great.

The stock bootloader is U-Boot 2022.04-00011-g9f2bed5188, it looks like I can try using bootp to load over TFTP. I don't know yet if I need fw_setenv devmode TRUE or not, I need to get the OpenWrt toolchain up and running first.

[elbertmai]

TLDR Update: I can boot OpenWrt images off TFTP, kernel starts but crashes after unpacking initramfs.

I can confirm that the fw_setenv devmode TRUE is needed, just like on the U6 Lite. I have these U-Boot variables set up for the time being:

devmode=TRUE
boot_openwrt=fdt addr $(fdtcontroladdr); fdt rm /signature; bootm

I run a TFTP server at 192.168.1.2 and issue these U-Boot commands on the UART:

tftpboot
run boot_openwrt

It appears to be able to load the image OK:

MT7981# tftpboot
*** Warning: no boot file name; using 'C0A80114.img'
Using ethernet@15100000 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.20
Filename 'C0A80114.img'.
Load address: 0x46000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###
         5.1 MiB/s
done
Bytes transferred = 7667712 (750000 hex)
MT7981# run boot_openwrt
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Verifying Hash Integrity ... OK
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.130
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000ec
     Data Size:    3865208 Bytes = 3.7 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   e2b38746
     Hash algo:    sha1
     Hash value:   15588c83a29415db3748323443e4389a7af6d3dc
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Verifying Hash Integrity ... OK
   Trying 'initrd-1' ramdisk subimage
     Description:  ARM64 OpenWrt ubnt_unifi-6-plus initrd
     Type:         RAMDisk Image
     Compression:  Unknown Compression
     Data Start:   0x463afca0
     Data Size:    3753656 Bytes = 3.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: unavailable
     Entry Point:  unavailable
     Hash algo:    crc32
     Hash value:   a7012ead
     Hash algo:    sha1
     Hash value:   23cf8a291deddb3c6ea3d5ec2a4ad67f05775180
   Verifying Hash Integrity ... crc32+ sha1+ OK
WARNING: 'compression' nodes for ramdisks are deprecated, please fix your .its file!
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Verifying Hash Integrity ... OK
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt ubnt_unifi-6-plus device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x46744468
     Data Size:    18966 Bytes = 18.5 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   ddeaec0b
     Hash algo:    sha1
     Hash value:   a3caa005d132ead112a84caf7f72a582d95dd4d1
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x46744468
   Uncompressing Kernel Image
   Loading Ramdisk to 4f466000, end 4f7fa6b8 ... OK
   Loading Device Tree to 000000004f45e000, end 000000004f465a15 ... OK

Unfortunately the kernel crashes almost immediately after unpacking initramfs:

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.130 (emai@dev) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23885-703d667a0c) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Tue Sep 5 14:05:32 2023
[    0.000000] Machine model: Ubiquiti UniFi 6 Plus
[    0.000000] Memory limited to 255MB
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000004fff7fff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x0000000047c7ffff]
[    0.000000]   node   0: [mem 0x0000000047c80000-0x0000000047ffffff]
[    0.000000]   node   0: [mem 0x0000000048000000-0x000000004fff7fff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000004fff7fff]
[    0.000000] On node 0, zone DMA: 8 pages in unavailable ranges
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] percpu: Embedded 17 pages/cpu s29592 r8192 d31848 u69632
[    0.000000] pcpu-alloc: s29592 r8192 d31848 u69632 alloc=17*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64504
[    0.000000] Kernel command line: ubootver= ramoops.mem_address=0x42fe0000 ramoops.mem_size=1048576 ramoops.ecc=1 ramoops.record_size=262144 console=ttyS0,115200n1 mem=262112K ubntbootid=0
[    0.000000] Unknown kernel command line parameters "ubootver= ubntbootid=0", will be passed to user space.
[    0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 237264K/262112K available (8128K kernel code, 896K rwdata, 2220K rodata, 448K init, 288K bss, 24848K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] GICv3: Distributor has no Range Selector support
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv3: 16 PPIs implemented
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000000] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.000114] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[    0.000124] pid_max: default: 32768 minimum: 301
[    0.000405] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.000414] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.001664] rcu: Hierarchical SRCU implementation.
[    0.001986] smp: Bringing up secondary CPUs ...
[    0.002296] Detected VIPT I-cache on CPU1
[    0.002319] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.002346] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.002408] smp: Brought up 1 node, 2 CPUs
[    0.002423] SMP: Total of 2 processors activated.
[    0.002427] CPU features: detected: 32-bit EL0 Support
[    0.002432] CPU features: detected: CRC32 instructions
[    0.002458] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.002517] CPU: All CPU(s) started at EL2
[    0.002529] alternatives: patching kernel code
[    0.005360] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.005382] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.005521] pinctrl core: initialized pinctrl subsystem
[    0.006151] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.006510] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.006538] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.006561] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.006618] ramoops: using module parameters
[    0.012243] printk: console [ramoops-1] enabled
[    0.012380] pstore: Registered ramoops as persistent store backend
[    0.012430] ramoops: using 0x100000@0x42fe0000, ecc: 16
[    0.012805] thermal_sys: Registered thermal governor 'fair_share'
[    0.012809] thermal_sys: Registered thermal governor 'bang_bang'
[    0.012859] thermal_sys: Registered thermal governor 'step_wise'
[    0.012947] thermal_sys: Registered thermal governor 'user_space'
[    0.013193] ASID allocator initialised with 65536 entries
[    0.013669] ramoops: already initialized
[    0.013760] ramoops: probe of 42ff0000.ramoops failed with error -22
[    0.022280] cryptd: max_cpu_qlen set to 1000
[    0.024553] SCSI subsystem initialized
[    0.024840] libata version 3.00 loaded.
[    0.025983] clocksource: Switched to clocksource arch_sys_counter
[    0.026706] NET: Registered PF_INET protocol family
[    0.026841] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.027256] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.027319] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.027414] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.027518] TCP bind hash table entries: 2048 (order: 3, 32768 bytes, linear)
[    0.027592] TCP: Hash tables configured (established 2048 bind 2048)
[    0.027740] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.027843] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.028000] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.028115] PCI: CLS 0 bytes, default 64
[    0.028456] Unpacking initramfs...
[    0.030269] workingset: timestamp_bits=46 max_order=16 bucket_order=0
[    0.034023] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.034094] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.069869] pwm-mediatek 10048000.pwm: clock: top fail: -517
[    0.078360] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    0.079034] printk: console [ttyS0] disabled
[    0.099264] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 17, base_baud = 2500000) is a ST16650V2
[    0.770345] printk: console [ttyS0] enabled
[    0.775487] Unable to handle kernel paging request at virtual address ffffffc061b97019
[    0.775494] Mem abort info:
[    0.775495]   ESR = 0x0000000096000045
[    0.775497]   EC = 0x25: DABT (current EL), IL = 32 bits
[    0.775501]   SET = 0, FnV = 0
[    0.775503]   EA = 0, S1PTW = 0
[    0.775505]   FSC = 0x05: level 1 translation fault
[    0.775507] Data abort info:
[    0.775509]   ISV = 0, ISS = 0x00000045
[    0.775511]   CM = 0, WnR = 1
[    0.775513] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000048a2f000
[    0.775517] [ffffffc061b97019] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[    0.775526] Internal error: Oops: 96000045 [#1] SMP
[    0.775530] Modules linked in:
[    0.775535] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.15.130 #0
[    0.775541] Hardware name: Ubiquiti UniFi 6 Plus (DT)
[    0.775544] pstate: 004000c5 (nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    0.775550] pc : __memcpy_toio+0xc/0x90
[    0.775562] lr : persistent_ram_write+0xec/0x11c
[    0.775570] sp : ffffffc008bdb3c0
[    0.775573] x29: ffffffc008bdb3c0 x28: ffffffc008aa8830 x27: 0000000000000000
[    0.775580] x26: 000000000000002f x25: 0000000058fa000e x24: 0000000058f9f229
[    0.775588] x23: 00000000a7060e06 x22: ffffffbfafbe953e x21: 000000000000002f
[    0.775595] x20: 0000000058fa000e x19: ffffff8000146d00 x18: 0000000000000005
[    0.775602] x17: 3d20647561625f65 x16: 736162202c373120 x15: 0000000000000006
[    0.775609] x14: 0000000000000000 x13: 64656c62616e6520 x12: 5d30537974745b20
[    0.775615] x11: fffffffffffe1d98 x10: 000000000000005d x9 : 00000000000bc129
[    0.775622] x8 : ffffffc008bdb4f0 x7 : 0000000000000000 x6 : 000000002eb51926
[    0.775629] x5 : 00ffffffffffffff x4 : 0000000000000e14 x3 : 000000000000005b
[    0.775636] x2 : 00000000a7060e06 x1 : ffffffc008b88739 x0 : ffffffc061b97019
[    0.775643] Call trace:
[    0.775646]  __memcpy_toio+0xc/0x90
[    0.775652]  ramoops_pstore_write+0x148/0x1d0
[    0.775659]  pstore_console_write+0x60/0x70
[    0.775665]  console_unlock+0x35c/0x450
[    0.775673]  vprintk_emit+0xf8/0x240
[    0.775679]  vprintk_default+0x34/0x40
[    0.775685]  vprintk+0x8c/0xa0
[    0.775692]  _printk+0x48/0x50
[    0.775697]  register_console+0x194/0x284
[    0.775703]  uart_add_one_port+0x440/0x590
[    0.775710]  serial8250_register_8250_port+0x2b8/0x440
[    0.775716]  mtk8250_probe+0x1dc/0x2d0
[    0.775721]  platform_probe+0x64/0xbc
[    0.775728]  really_probe.part.0+0x98/0x2f4
[    0.775734]  __driver_probe_device+0x94/0x16c
[    0.775739]  driver_probe_device+0x40/0x114
[    0.775744]  __driver_attach+0x8c/0x180
[    0.775750]  bus_for_each_dev+0x5c/0x90
[    0.775755]  driver_attach+0x20/0x2c
[    0.775760]  bus_add_driver+0x100/0x1f0
[    0.775765]  driver_register+0x74/0x120
[    0.775770]  __platform_driver_register+0x24/0x30
[    0.775777]  mtk8250_platform_driver_init+0x18/0x20
[    0.775785]  do_one_initcall+0x4c/0x1b0
[    0.775789]  kernel_init_freeable+0x230/0x294
[    0.775798]  kernel_init+0x20/0x120
[    0.775802]  ret_from_fork+0x10/0x20
[    0.775811] Code: 00000000 b50000e2 14000020 38401423 (39000003) 
[    0.775829] ---[ end trace 6279d9991a603aac ]---
[    0.779972] Kernel panic - not syncing: Oops: Fatal exception
[    0.779976] SMP: stopping secondary CPUs
[    0.779986] Kernel Offset: disabled
[    0.779987] CPU features: 0x0,00000000,20000802
[    0.779991] Memory Limit: 255 MB

The device then proceeds to boot to stock firmware. Now I'm stumped at this point. Any ideas? (I'll show the DTS and Makefile in a separate post.)

[elbertmai]

I've added file target/linux/mediatek/dts/mt7981a-ubnt-unifi-6-plus.dts:

/dts-v1/;

#include "mt7981.dtsi"

/ {
	model = "Ubiquiti UniFi 6 Plus";
	compatible = "ubnt,unifi-6-lite", "mediatek,mt7981";

	aliases {
		led-boot = &led_lightblue;
		led-failsafe = &led_lightblue;
		led-running = &led_white;
		led-upgrade = &led_lightblue;
		serial0 = &uart0;
	};

	chosen {
		stdout-path = "serial0:115200n8";
	};

	gpio-keys {
		compatible = "gpio-keys";

		reset {
			label = "reset";
			linux,code = <KEY_RESTART>;
			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
		};
	};

	leds {
		compatible = "gpio-leds";

		led_lightblue: led@0 {
			label = "blue:run";
			gpios = <&pio 0x23 GPIO_ACTIVE_LOW>;
		};

		led_white: led@1 {
			label = "white:system";
			gpios = <&pio 0x22 GPIO_ACTIVE_LOW>;
		};
	};
};

&uart0 {
	status = "okay";
};

I've added this to target/linux/mediatek/image/filogic.mk:

define Device/ubnt_unifi-6-plus
  DEVICE_VENDOR := Ubiquiti
  DEVICE_MODEL := UniFi 6 Plus
  DEVICE_DTS := mt7981a-ubnt-unifi-6-plus
  DEVICE_DTS_DIR := ../dts
  DEVICE_PACKAGES := kmod-mt7981-firmware mt7981-wo-firmware
  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
  IMAGE_SIZE := 32768k
endef
TARGET_DEVICES += ubnt_unifi-6-plus

Then I did make menuconfig and selected the appropriate options to build an initramfs image for this target. I was hoping this "minimal" setup will at least get me to a shell prompt, but I'm clearly missing something here.

[bmork]

Nice!

Strange that it crashes immediately on enabling the uart console. I don't know if it is relalted, but I notice that there seems to be some inconsistency in the definittion of the ramoops device:

@elbertmai

[    0.006618] ramoops: using module parameters
[    0.012243] printk: console [ramoops-1] enabled
[    0.012380] pstore: Registered ramoops as persistent store backend
[    0.012430] ramoops: using 0x100000@0x42fe0000, ecc: 16
...
[    0.013669] ramoops: already initialized
[    0.013760] ramoops: probe of 42ff0000.ramoops failed with error -22

And this is a bit suspicious since ramoops is registered as console until the uart is running.

Note that the bootloader could be adding device nodes here. Maybe that creates some conflict?

EDIT: I see from the downloaded device-tree you posted earlier that we have this, which is consistent with your boot log:

	ramoops@42fe0000 {
			reg = <0x00 0x42fe0000 0x00 0x100000>;
			compatible = "ramoops";
			console-size = <0x1000>;
			ftrace-size = <0x1000>;
			pmsg-size = <0x1000>;
			record-size = <0x1000>;
		};

Maybe you need to disable the ramoops node in arch/arm64/boot/dts/mediatek/mt7981.dtsi ?

(there's currently no way to do that, but that should be added if this device requires it)

EDIT2: Trying to figure out where we got that default ramoops@42ff0000 device from. We have the same for MT7986 as an OpenWrt spcific patch: target/linux/mediatek/patches-5.15/194-dts-mt7968a-add-ramoops.patch

That patch was added by commit 7a0ec001ff79 ("mediatek: sync MT7986 device trees with upstream") without any further justification. But there is no such node upstream: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/arm64/boot/dts/mediatek/mt7986a.dtsi#n67

I wonder if this isn't something that should be device specific, and possibly left for the bootloader to fill in on devices doing that.

Any comments @daniel ?

[daniel]

@bmork

Any comments @daniel ?

The default node is most likely added by U-Boot, and by mistake it differs from what is defined in mt7981.dtsi (which we need anyway because only few boards use our U-Boot built from source).
It should not be device specific if we chose a memory region not used by the vendor bootloader -- and even if it does get touched by the bootloader, the worst case would be not being able to recover the crashlog.

[bmork]

OK. I wonder if there are more than just one mistake here. The ramoops buffer size is also weird, making it conflict with our

                /* 192 KiB reserved for ARM Trusted Firmware (BL31) */
                secmon_reserved: secmon@43000000 {
                        reg = <0 0x43000000 0 0x30000>;
                        no-map;
                };

I wonder if that's maybe the reason it crashes? Not sure how conflicting regions are handled. Note that the stock bootloader maps this to

	secmon@43e00000 {
			reg = <0x00 0x43e00000 0x00 0x30000>;
			no-map;
		};

[elbertmai]

U6+ now fully boots to an OpenWrt shell prompt!

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.130 (emai@dev) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23885-703d667a0c) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Tue Sep 5 14:05:32 2023
[    0.000000] Machine model: Ubiquiti UniFi 6 Plus
[    0.000000] Memory limited to 255MB
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000004fff7fff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000043dfffff]
[    0.000000]   node   0: [mem 0x0000000043e00000-0x0000000043e2ffff]
[    0.000000]   node   0: [mem 0x0000000043e30000-0x0000000047c7ffff]
[    0.000000]   node   0: [mem 0x0000000047c80000-0x0000000047ffffff]
[    0.000000]   node   0: [mem 0x0000000048000000-0x000000004fff7fff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000004fff7fff]
[    0.000000] On node 0, zone DMA: 8 pages in unavailable ranges
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] percpu: Embedded 17 pages/cpu s29592 r8192 d31848 u69632
[    0.000000] pcpu-alloc: s29592 r8192 d31848 u69632 alloc=17*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64504
[    0.000000] Kernel command line: ubootver= ramoops.mem_address=0x42fe0000 ramoops.mem_size=1048576 ramoops.ecc=1 ramoops.record_size=262144 console=ttyS0,115200n1 mem=262112K ubntbootid=0
[    0.000000] Unknown kernel command line parameters "ubootver= ubntbootid=0", will be passed to user space.
[    0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 237264K/262112K available (8128K kernel code, 896K rwdata, 2220K rodata, 448K init, 288K bss, 24848K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] GICv3: Distributor has no Range Selector support
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv3: 16 PPIs implemented
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000000] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.000115] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[    0.000125] pid_max: default: 32768 minimum: 301
[    0.000406] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.000415] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.001662] rcu: Hierarchical SRCU implementation.
[    0.001982] smp: Bringing up secondary CPUs ...
[    0.002291] Detected VIPT I-cache on CPU1
[    0.002315] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.002341] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.002403] smp: Brought up 1 node, 2 CPUs
[    0.002417] SMP: Total of 2 processors activated.
[    0.002421] CPU features: detected: 32-bit EL0 Support
[    0.002426] CPU features: detected: CRC32 instructions
[    0.002452] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.002511] CPU: All CPU(s) started at EL2
[    0.002522] alternatives: patching kernel code
[    0.005350] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.005372] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.005509] pinctrl core: initialized pinctrl subsystem
[    0.006139] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.006496] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.006524] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.006546] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.006602] ramoops: using module parameters
[    0.006763] ramoops: uncorrectable error in header
[    0.006849] ramoops: uncorrectable error in header
[    0.006924] ramoops: uncorrectable error in header
[    0.006993] ramoops: uncorrectable error in header
[    0.007062] ramoops: uncorrectable error in header
[    0.007130] ramoops: uncorrectable error in header
[    0.007198] ramoops: uncorrectable error in header
[    0.012948] printk: console [ramoops-1] enabled
[    0.013044] pstore: Registered ramoops as persistent store backend
[    0.013134] ramoops: using 0x100000@0x42fe0000, ecc: 16
[    0.013470] thermal_sys: Registered thermal governor 'fair_share'
[    0.013474] thermal_sys: Registered thermal governor 'bang_bang'
[    0.013524] thermal_sys: Registered thermal governor 'step_wise'
[    0.013614] thermal_sys: Registered thermal governor 'user_space'
[    0.013861] ASID allocator initialised with 65536 entries
[    0.014337] ramoops: already initialized
[    0.014388] ramoops: probe of 42fe0000.ramoops failed with error -22
[    0.022958] cryptd: max_cpu_qlen set to 1000
[    0.025204] SCSI subsystem initialized
[    0.025490] libata version 3.00 loaded.
[    0.026632] clocksource: Switched to clocksource arch_sys_counter
[    0.027357] NET: Registered PF_INET protocol family
[    0.027491] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.027909] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.027972] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.028066] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.028171] TCP bind hash table entries: 2048 (order: 3, 32768 bytes, linear)
[    0.028245] TCP: Hash tables configured (established 2048 bind 2048)
[    0.028390] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.028459] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.028621] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.028736] PCI: CLS 0 bytes, default 64
[    0.029076] Unpacking initramfs...
[    0.030881] workingset: timestamp_bits=46 max_order=16 bucket_order=0
[    0.034617] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.034686] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.070031] pwm-mediatek 10048000.pwm: clock: top fail: -517
[    0.078482] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    0.079150] printk: console [ttyS0] disabled
[    0.099374] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 17, base_baud = 2500000) is a ST16650V2
[    0.803963] printk: console [ttyS0] enabled
[    0.809105] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.818720] loop: module loaded
[    0.823852] i2c_dev: i2c /dev entries driver
[    0.829736] NET: Registered PF_INET6 protocol family
[    0.839339] Segment Routing with IPv6
[    0.843137] In-situ OAM (IOAM) with IPv6
[    0.847194] NET: Registered PF_PACKET protocol family
[    0.852539] 8021q: 802.1Q VLAN Support v1.8
[    0.857915] pstore: Using crash dump compression: deflate
[    1.121837] Freeing initrd memory: 3664K
[    1.126487] Freeing unused kernel memory: 448K
[    1.197336] Run /init as init process
[    1.201050]   with arguments:
[    1.204090]     /init
[    1.206395]   with environment:
[    1.209588]     HOME=/
[    1.211982]     TERM=linux
[    1.214761]     ubootver=
[    1.217451]     ubntbootid=0
[    1.371822] init: Console is alive
[    1.379524] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.389100] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    1.406701] init: - preinit -
ip: SIOCGIFFLAGS: No such device
[    1.503195] random: procd: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    3.536162] procd: - early -
[    4.050074] procd: - ubus -
[    4.055430] random: ubusd: uninitialized urandom read (4 bytes read)
[    4.102673] random: ubusd: uninitialized urandom read (4 bytes read)
[    4.109332] random: ubusd: uninitialized urandom read (4 bytes read)
[    4.116936] procd: - init -
Please press Enter to activate this console.
[    4.251603] kmodloader: loading kernel modules from /etc/modules.d/*
[    4.266881] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
[    4.305127] Loading modules backported from Linux version v6.1.24-0-g0102425ac76b
[    4.312729] Backport generated by backports.git v5.15.92-1-44-gd6ea70fafd36
[    4.368274] PPP generic driver version 2.4.2
[    4.373800] NET: Registered PF_PPPOX protocol family
[    4.383654] kmodloader: done loading kernel modules from /etc/modules.d/*
[    4.481797] urngd: v1.0.2 started.
[    4.641583] random: crng init done
[    4.645076] random: 23 urandom warning(s) missed due to ratelimiting




BusyBox v1.36.1 (2023-09-05 14:05:32 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r23885-703d667a0c
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#

@bmork was on the right track with ramoops and secmon. To "fix" this I made a copy of mt7981.dtsi and changed the ramoops and secmon_reserved nodes:

$ diff files-5.15/arch/arm64/boot/dts/mediatek/mt7981.dtsi dts/mt7981-fixed.dtsi 
169c169
<               ramoops@42ff0000 {
---
>               ramoops@42fe0000 {
171c171
<                       reg = <0 0x42ff0000 0 0x10000>;
---
>                       reg = <0 0x42fe0000 0 0x10000>;
176,177c176,177
<               secmon_reserved: secmon@43000000 {
<                       reg = <0 0x43000000 0 0x30000>;
---
>               secmon_reserved: secmon@43e00000 {
>                       reg = <0 0x43e00000 0 0x30000>;

I put "fix" in quotes because I'm sure there's a better way to make this change than copying an entire DTS for an SoC just to change 4 lines. Perhaps I can make a device-specific patch file? Any guidance on this is welcome. Also, there might be more discrepancies between stock and OpenWrt DTS that needs to change.

Sidebar

By the way, I realized while checking the bootloader that it has this variable set:

bootargs=ubootver= ramoops.mem_address=0x42fe0000 ramoops.mem_size=1048576 ramoops.ecc=1 ramoops.record_size=262144 console=ttyS0,115200n1 mem=262112K ubntbootid=0

Maybe changing ramoops.mem_address from 0x42fe0000 to 0x42ff0000 also fixes the crash without changing mt7981.dtsi. However, I'd rather keep the bootloader as "original" as possible so users don't forget to change it back if they're flashing to stock firmware.

Next steps

I'm going to try getting the flash memories and Ethernet working next. For wireless I need to figure out where the radio calibration data is located first and how that gets loaded. Again, any input on this is highly appreciated.

[mTek]

Wow! You've gotten quite a bit done in a couple of days. I'm just here following along.

[bmork]

@elbertmai

I'm going to try getting the flash memories and Ethernet working next.

You're probably already there, but in case not... I got one of these too. And based on your code with these additions:

diff --git a/target/linux/mediatek/dts/mt7981a-ubnt-unifi-6-plus.dts b/target/linux/mediatek/dts/mt7981a-ubnt-unifi-6-plus.dts
index ccb4dca4ed55..cc8571eda753 100644
--- a/target/linux/mediatek/dts/mt7981a-ubnt-unifi-6-plus.dts
+++ b/target/linux/mediatek/dts/mt7981a-ubnt-unifi-6-plus.dts
@@ -43,6 +43,119 @@
 	};
 };
 
+/* the bootloader adds conflicting ramoops and secmon nodes */
+&ramoops_reserved {
+	status = "disabled";
+};
+
+&secmon_reserved {
+	status = "disabled";
+};
+
 &uart0 {
 	status = "okay";
-};
\ No newline at end of file
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&mmc0 {
+	pinctrl-names = "default", "state_uhs";
+	pinctrl-0 = <&mmc0_pins_default>;
+	pinctrl-1 = <&mmc0_pins_uhs>;
+	bus-width = <8>;
+	max-frequency = <52000000>;
+	cap-mmc-highspeed;
+	mmc-hs200-1_8v;
+	mmc-hs400-1_8v;
+	hs400-ds-delay = <0x14014>;
+	vmmc-supply = <&reg_3p3v>;
+	non-removable;
+	status = "okay";
+};
+
+&spi2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi2_flash_pins>;
+	status = "okay";
+
+	flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@00000 {
+				label = "EEPROM";
+				reg = <0x00000 0x10000>;
+				read-only;
+			};
+
+			partition@10000 {
+				label = "u-boot-env";
+				reg = <0x10000 0x80000>;
+			};
+		};
+	};
+};
+
+&pio {
+	spi2_flash_pins: spi2-pins {
+		mux {
+			function = "spi";
+			groups = "spi2", "spi2_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <8>;
+			bias-pull-up = <103>;
+		};
+
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <8>;
+			bias-pull-down = <103>;
+		};
+	};
+
+	mmc0_pins_default: mmc0-pins-default {
+		mux {
+			function = "flash";
+			groups = "emmc_45";
+		};
+	};
+
+	mmc0_pins_uhs: mmc0-pins-uhs {
+
+		mux {
+			function = "flash";
+			groups = "emmc_45";
+		};
+	};
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+	status = "okay";
+
+	mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+	};
+};
+
diff --git a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7981.dtsi b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7981.dtsi
index 05d4b7d91da1..b772ca74de4f 100644
--- a/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7981.dtsi
+++ b/target/linux/mediatek/files-5.15/arch/arm64/boot/dts/mediatek/mt7981.dtsi
@@ -166,7 +166,7 @@
 		ranges;
 
 		/* 64 KiB reserved for ramoops/pstore */
-		ramoops@42ff0000 {
+		ramoops_reserved: ramoops@42ff0000 {
 			compatible = "ramoops";
 			reg = <0 0x42ff0000 0 0x10000>;
 			record-size = <0x1000>;
diff --git a/target/linux/mediatek/files-6.1/arch/arm64/boot/dts/mediatek/mt7981.dtsi b/target/linux/mediatek/files-6.1/arch/arm64/boot/dts/mediatek/mt7981.dtsi
index 05d4b7d91da1..b772ca74de4f 100644
--- a/target/linux/mediatek/files-6.1/arch/arm64/boot/dts/mediatek/mt7981.dtsi
+++ b/target/linux/mediatek/files-6.1/arch/arm64/boot/dts/mediatek/mt7981.dtsi
@@ -166,7 +166,7 @@
 		ranges;
 
 		/* 64 KiB reserved for ramoops/pstore */
-		ramoops@42ff0000 {
+		ramoops_reserved: ramoops@42ff0000 {
 			compatible = "ramoops";
 			reg = <0 0x42ff0000 0 0x10000>;
 			record-size = <0x1000>;

I got ethernet, nor flash and mmc:

[    0.839549] spi spi0.0: setup: ignoring unsupported mode bits a00
[    0.846129] spi-nor spi0.0: mx25l12805d (16384 Kbytes)
[    1.121395] Freeing initrd memory: 3668K
[    1.132973] 2 fixed-partitions partitions found on MTD device spi0.0
[    1.139398] Creating 2 MTD partitions on "spi0.0":
[    1.144266] 0x000000000000-0x000000010000 : "EEPROM"
[    1.149677] 0x000000010000-0x000000090000 : "u-boot-env"
[    1.287762] mtk_soc_eth 15100000.ethernet: generated random MAC address 86:6b:5e:d4:d7:f4
[    1.314460] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc009400000, irq 75
..
[    1.449012] mmc0: mmc_select_hs200 failed, error -74
[    1.457919] mmc0: new high speed MMC card at address 0001
[    1.464694] mmcblk0: mmc0:0001 MK2704 3.53 GiB 
[    1.470395] Alternate GPT is invalid, using primary GPT.
[    1.475821]  mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10
[    1.483001] mmcblk0boot0: mmc0:0001 MK2704 2.00 MiB 
[    1.490059] mmcblk0boot1: mmc0:0001 MK2704 2.00 MiB 
[    1.495546] mmcblk0rpmb: mmc0:0001 MK2704 512 KiB, chardev (250:0)
[    1.602727] init: Console is alive
[    1.606324] init: - watchdog -
[    1.614733] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.624652] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    1.642184] init: - preinit -
[    1.744981] mtk_soc_eth 15100000.ethernet eth0: PHY [mdio-bus:00] driver [MediaTek MT7981 PHY] (irq=POLL)
[    1.757388] mtk_soc_eth 15100000.ethernet eth0: configuring for phy/gmii link mode

Need to fix that mac address and figure out what the mmc_select_hs200 error is.

root@OpenWrt:/# ifconfig eth0 192.168.1.20 up
root@OpenWrt:/# ping 192.168.1.2 -c 3
PING 192.168.1.2 (192.168.1.2): 56 data bytes
64 bytes from 192.168.1.2: seq=0 ttl=64 time=0.379 ms
64 bytes from 192.168.1.2: seq=1 ttl=64 time=0.803 ms
64 bytes from 192.168.1.2: seq=2 ttl=64 time=0.771 ms

--- 192.168.1.2 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.379/0.651/0.803 ms

root@OpenWrt:/# strings /dev/mtd1
baudrate=115200
bootargs=ubootver= ramoops.mem_address=0x42fe0000 ramoops.mem_size=1048576 ramoops.ecc=1 ramoops.record_size=262144 console=ttyS0,115200n1 mem=262112K ubntbootid=0
bootcmd=bootubnt
bootdelay=2
ethaddr=e4:38:83:e5:85:d4
fdtaddr=46b60674
fdtcontroladdr=4ffc0460
ipaddr=192.168.1.20
is_default=true
loadaddr=0x46000000
netmask=255.255.255.0
serverip=192.168.1.2
stderr=serial@11002000
stdin=serial@11002000
stdout=serial@11002000
ubntaddr=440000b0
root@OpenWrt:/# 

root@OpenWrt:/# hexdump -n 200 -C /dev/mmcblk0p6
00000000  d0 0d fe ed 00 b6 99 a7  00 00 00 38 00 b6 95 14  |...........8....|
00000010  00 00 00 28 00 00 00 11  00 00 00 10 00 00 00 00  |...(............|
00000020  00 00 00 ca 00 b6 94 dc  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 01 00 00 00 00  |................|
00000040  00 00 00 03 00 00 00 04  00 00 00 83 5b 87 de ce  |............[...|
00000050  00 00 00 03 00 00 00 1d  00 00 00 00 4b 65 72 6e  |............Kern|
00000060  65 6c 20 61 6e 64 20 76  61 72 69 6f 75 73 20 46  |el and various F|
00000070  44 54 20 62 6c 6f 62 73  00 00 00 00 00 00 00 03  |DT blobs........|
00000080  00 00 00 04 00 00 00 0c  00 00 00 01 00 00 00 01  |................|
00000090  69 6d 61 67 65 73 00 00  00 00 00 01 6b 65 72 6e  |images......kern|
000000a0  65 6c 2d 31 00 00 00 00  00 00 00 03 00 00 00 18  |el-1............|
000000b0  00 00 00 00 55 41 50 36  20 6b 65 72 6e 65 6c 20  |....UAP6 kernel |
000000c0  61 6e 64 20 72 61 6d 64                           |and ramd|
000000c8