Hey guys,
I've successfully booted a custom OpenWrt initramfs on the Jio JIDU6111 (Arcadyan, IPQ9574 SoC) and wanted to share the unlock method and hardware map to help speed up development [1.1.2].
1. U-Boot Password Extraction
-
Older Firmware (pre-v19.5): Use the config backup UI exploit (Dual WAN trigger) to get root SSH, then run: /usr/bin/jioMfgData get ubootPasswd.
-
Newer Firmware: Dump the NAND physically (using a CH341A and WSON-8 pogo probe) and run strings on the MFG (mtd27) or 0:APPSBLENV (mtd17) partitions.
-
U-Boot Credentials: Username is the last 8 characters of your Router Serial Number (RSN) . Password is the 16-character string extracted above.
2. Hardware Map (Stock DTS)
-
Switch/PHY: No Aquantia PHY. All 5 ports (4 LAN + 1 WAN) run on a standard Qualcomm QCA8075 (MHT-PHY) via independent SGMII lanes.
-
Port Mapping: WAN is port@1, LAN 1-3 are port@2 to port@4, LAN 4 (Port 5) is port@5.
-
LEDs: Red (GPIO 6), Green (GPIO 16), Blue (GPIO 17) - Active High.
-
Reset: GPIO 10 (Active Low, KEY_RESTART) [1.1.2].
-
Flash Partitions (256MB Winbond NAND):
-
0x00000000 - 0x00180000: 0:SBL1
-
0x01100000 - 0x01180000: 0:APPSBLENV
-
0x01180000 - 0x01300000: 0:APPSBL
-
0x01480000 - 0x01580000: 0:ART
-
0x01580000 - 0x01680000: 0:ETHPHYFW
-
0x01700000 - 0x06700000: rootfs
-
3. OpenWrt Boot Status
-
Standard ap-al02-c4 TFTP boot crashes because it tries to initialize a nonexistent 10G WAN SFP port on UNIPHY1 (gcc_uniphy1_sys_clk stuck at off).
-
Using Zilogic's feed-ipq on OpenWrt 24.10 targeting ipq9574-rdp433-mht-phy and disabling Ports 5 & 6 (to prevent the clock crash), I got LAN 1-3 working successfully. [1.1.1] SSH/pings (<1ms) are fully active.
-
Current Bug: Hot-plugging Ethernet freezes the driver (known issue on 6.12 kernel, works much better on 6.18 draft) [1.2.3].
If you want to help test/debug, hit me up on Telegram: @cutiekitsu .
uart pinout for 6411 and 6111, I dont have 6911 or any other 6x11 models to share their pinout, feel free to do that if you do.
