OpenWrt support for Xiaomi AX3000NE

For Developers
1

I just got a Xiaomi WR30U, which looks like an ISP custom version of Xiaomi AX3000NE.

Purchase link:

Teardown: https://www.acwifi.net/23700.html

Specifications

  • SoC : MediaTek MT7981B

  • RAM : DDR3 256MiB (Nanya NT5CB128M16JR-FL)

  • Flash : SPI-NAND 128 MiB (ESMT F50L1G41LB)

  • WLAN : MediaTek MT7976C (2.4G: 574Mbps + 5G: 2402Mbps)

  • Ethernet : MediaTek MT7531AE (4*1G ports)

  • Power : 12V DC, 1A

The filogic subtarget of OpenWrt only supports MT7986, and It seems that we need to backport a lot of patches to make Linux 5.15 support MT7981. Perhaps we should wait for the kernel to bump to 6.3 to support mt7981?

2

NOT the same device as Add OpenWrt support for Redmi AX3000 (256MB RAM) Wi-Fi 6 Mesh Router? :wink:

3

Just like other Xiaomi routers, setting uart_en=1 in the Bdata partition will enable UART output.

Here's the bootlog (full version:https://pastebin.com/zJSmqNY1):

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024F [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):12dffbfc4a-dirty
NOTICE:  BL2: Built : 05:20:26, Jul 15 2022
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a003f1 000000ff 00100000 00000000
1001d040 | 00027e71 000200a0 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0xc
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 552, worse bit 0, min window 68
Window Sum 548, worse bit 8, min window 68
Window Sum 410, worse bit 3, min window 48
Window Sum 396, worse bit 9, min window 46
Window Sum 416, worse bit 3, min window 48
Window Sum 410, worse bit 9, min window 48
Window Sum 430, worse bit 3, min window 52
Window Sum 416, worse bit 9, min window 48
Window Sum 426, worse bit 8, min window 52
Window Sum 444, worse bit 1, min window 54
Window Sum 440, worse bit 9, min window 52
Window Sum 450, worse bit 3, min window 54
Window Sum 458, worse bit 3, min window 54
Window Sum 454, worse bit 8, min window 54
Window Sum 466, worse bit 3, min window 56
Window Sum 466, worse bit 0, min window 58
Window Sum 458, worse bit 8, min window 54
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xc8
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 1023 [0x07fe0000]
NOTICE:  First info table with writecount 0 found in block 960
NOTICE:  Second info table with writecount 0 found in block 963
NOTICE:  NMBM has been successfully attached in read-only mode
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.6(release):12dffbfc4a-dirty
NOTICE:  BL31: Built : 05:20:26, Jul 15 2022
NOTICE:  Hello BL31!!!
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:   eth0: ethernet@15100000

  *** U-Boot Boot Menu ***

     1. Startup system (Default)
     2. Startup firmware0
     3. Startup firmware1
     4. Upgrade firmware
     5. Upgrade ATF BL2
     6. Upgrade ATF FIP
     7. Upgrade single image
     8. Load image
     0. U-Boot console


  Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit
detect button reset released!
Reading from 0x0 to 0x4f7fdd7c, size 0x4 ... OK
Reading from 0x0 to 0x4f7fdd7c, size 0x4 ... OK
Saving Environment to MTD... Erasing on MTD device 'nmbm0'... OK
Writing to MTD device 'nmbm0'... OK
OK
Booting System 0
ubi0: attaching mtd9
ubi0: scanning is finished
ubi0: attached mtd9 (name "ubi", size 34 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 857011981
ubi0: available PEBs: 89, total reserved PEBs: 183, PEBs reserved for bad PEB handling: 19
Reading from volume 'kernel' to 0x46000000, size 0x0 ... OK
## Loading kernel from FIT Image at 46000000 ...
   Using 'config@1' configuration
   Trying 'kernel@1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.4.171
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000e8
     Data Size:    2807637 Bytes = 2.7 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48080000
     Entry Point:  0x48080000
     Hash algo:    crc32
     Hash value:   4c33dcef
     Hash algo:    sha1
     Hash value:   57975b670389b6b2ad4f6fe4b35937373b81c98b
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
   Using 'config@1' configuration
   Trying 'fdt@1' fdt subimage
     Description:  ARM64 OpenWrt mt7981-WR30U device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x462ad97c
     Data Size:    19313 Bytes = 18.9 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   c8120657
     Hash algo:    sha1
     Hash value:   94cb2bc6ce380ee7365388796f0b71f4663ea59b
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x462ad97c
   Uncompressing Kernel Image
   Loading Device Tree to 000000004f7f1000, end 000000004f7f8b70 ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.4.171 (jenkins@ab8877e1f9e4) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 unknown)) #0 SMP Fri Jul 15 05:20:26 2022
[    0.000000] Machine model: MediaTek MT7981 RFB
[    0.000000] On node 0 totalpages: 64592
[    0.000000]   DMA32 zone: 1024 pages used for memmap
[    0.000000]   DMA32 zone: 0 pages reserved
[    0.000000]   DMA32 zone: 64592 pages, LIFO batch:15
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] percpu: Embedded 20 pages/cpu s43736 r8192 d29992 u81920
[    0.000000] pcpu-alloc: s43736 r8192 d29992 u81920 alloc=20*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 63568
[    0.000000] Kernel command line: console=ttyS0,115200n1 loglevel=8 swiotlb=512 rootfstype=squashfs firmware=0 mtd=ubi uart_en=1
[    0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 244536K/258368K available (5758K kernel code, 412K rwdata, 1636K rodata, 384K init, 276K bss, 13832K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     CONFIG_RCU_FANOUT set to non-default value of 32.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] GICv3: Distributor has no Range Selector support
[    0.000000] GICv3: 16 PPIs implemented
[    0.000000] GICv3: no VLPI support, no direct LPI support
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] random: get_random_bytes called from start_kernel+0x2d4/0x454 with crng_init=0
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000003] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.000131] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=52000)
[    0.000138] pid_max: default: 32768 minimum: 301
[    0.000216] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.000222] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.001040] ASID allocator initialised with 65536 entries
[    0.001095] rcu: Hierarchical SRCU implementation.
[    0.001372] smp: Bringing up secondary CPUs ...
[    0.001634] Detected VIPT I-cache on CPU1
[    0.001653] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.001674] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.001730] smp: Brought up 1 node, 2 CPUs
[    0.001738] SMP: Total of 2 processors activated.
[    0.001743] CPU features: detected: 32-bit EL0 Support
[    0.001747] CPU features: detected: CRC32 instructions
[    0.001845] CPU: All CPU(s) started at EL2
[    0.001854] alternatives: patching kernel code
[    0.004145] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.004160] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.004242] pinctrl core: initialized pinctrl subsystem
[    0.004753] NET: Registered protocol family 16
[    0.004988] DMA: preallocated 256 KiB pool for atomic allocations
[    0.005758] pstore: Registered ramoops as persistent store backend
[    0.005766] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.018446] rbus 18000000.wbsys: PCI host bridge to bus 0000:00
[    0.018458] pci_bus 0000:00: root bus resource [mem 0x18000000-0x18ffffff]
[    0.018465] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.018471] pci_bus 0000:00: scanning bus
[    0.018488] pci 0000:00:00.0: [14c3:7981] type 00 class 0x000280
[    0.018501] pci 0000:00:00.0: reg 0x10: [mem 0x18000000-0x1800000f 64bit]
[    0.018508] pci 0000:00:00.0: reg 0x18: [mem 0x00000000-0x0000000f]
[    0.018514] pci 0000:00:00.0: reg 0x1c: [mem 0x00000000-0x0000000f]
[    0.018520] pci 0000:00:00.0: reg 0x20: [mem 0x00000000-0x0000000f]
[    0.018527] pci 0000:00:00.0: reg 0x24: [mem 0x00000000-0x0000000f]
[    0.019495] pci_bus 0000:00: fixups for bus
[    0.019502] pci_bus 0000:00: bus scan returning with max=00
[    0.019878] clocksource: Switched to clocksource arch_sys_counter
[    0.020444] thermal_sys: Registered thermal governor 'fair_share'
[    0.020447] thermal_sys: Registered thermal governor 'bang_bang'
[    0.020457] thermal_sys: Registered thermal governor 'step_wise'
[    0.020461] thermal_sys: Registered thermal governor 'user_space'
[    0.020464] thermal_sys: Registered thermal governor 'power_allocator'
[    0.020686] NET: Registered protocol family 2
[    0.020758] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.021009] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.021022] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.021040] TCP bind hash table entries: 2048 (order: 3, 32768 bytes, linear)
[    0.021065] TCP: Hash tables configured (established 2048 bind 2048)
[    0.021120] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.021134] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.021205] NET: Registered protocol family 1
[    0.021229] PCI: CLS 0 bytes, default 64
[    0.022059] workingset: timestamp_bits=46 max_order=16 bucket_order=0
[    0.025460] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.038433] phy phy-usb-phy@11e10000.1: type_sw - reg 0x218, index 0
[    0.047639] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    0.048317] printk: console [ttyS0] disabled
[    0.068434] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 12, base_baud = 2500000) is a ST16650V2
[    0.659736] printk: console [ttyS0] enabled
[    0.664565] mtk_rng trng@1020f000: registered RNG driver
[    0.664582] random: fast init done
[    0.670025] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.673338] random: crng init done
[    0.681205] loop: module loaded
[    0.686027] mediatek,mt2701-ice_debug ice_debug: get dbg_sel clock fail: -2
[    0.692992] mediatek,mt2701-ice_debug: probe of ice_debug failed with error -2
[    0.700923] mt7981-pinctrl 11d00000.pinctrl: pin_config_set op failed for pin 19
[    0.708320] mtk-spi 1100a000.spi: Error applying setting, reverse things back
[    0.715990] spi-nand spi0.0: GigaDevice SPI NAND was found.
[    0.721603] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[    0.731071] Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
[    0.738852] libphy: Fixed MDIO Bus: probed
[    0.743184] tun: Universal TUN/TAP device driver, 1.6
[    0.748563] [mtk_hw_init] reset_lock:0, force:0
[    0.753116] [mtk_hw_init] execute fe cold reset
[    0.768824] libphy: mdio: probed
[    0.772368] mtk_soc_eth 15100000.ethernet: generated random MAC address 52:ea:39:70:2c:13
[    0.780839] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc011400000, irq 75
[    0.789912] mtk_soc_eth 15100000.ethernet: generated random MAC address a6:71:8f:f9:a9:8c
[    0.798352] mtk_soc_eth 15100000.ethernet eth1: mediatek frame engine at 0xffffffc011400000, irq 75
[    0.807394] (unnamed net_device) (dummy): netif_napi_add() called with weight 256
[    0.815032] i2c /dev entries driver
[    0.819464] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    0.827965] NET: Registered protocol family 10
[    0.833111] Segment Routing with IPv6
[    0.836872] NET: Registered protocol family 17
[    0.841351] Bridge firewalling registered
[    0.845354] 8021q: 802.1Q VLAN Support v1.8
[    0.850128] pstore: Using crash dump compression: deflate
[    0.863855] nmbm nmbm_spim_nand: Signature found at block 1023 [0x07fe0000]
[    0.871715] nmbm nmbm_spim_nand: First info table with writecount 0 found in block 960
[    0.882319] nmbm nmbm_spim_nand: Second info table with writecount 0 found in block 963
[    0.890323] nmbm nmbm_spim_nand: NMBM has been successfully attached
[    0.896929] 12 fixed-partitions partitions found on MTD device nmbm_spim_nand
[    0.904064] Creating 12 MTD partitions on "nmbm_spim_nand":
[    0.909636] 0x000000000000-0x000000100000 : "BL2"
[    0.914837] 0x000000100000-0x000000140000 : "Nvram"
[    0.920180] 0x000000140000-0x000000180000 : "Bdata"
[    0.925498] 0x000000180000-0x000000380000 : "Factory"
[    0.931003] 0x000000380000-0x000000580000 : "FIP"
[    0.936180] 0x000000580000-0x0000005c0000 : "crash"
[    0.941514] 0x0000005c0000-0x000000600000 : "crash_log"
[    0.947182] 0x000000600000-0x000002800000 : "ubi"
[    0.952386] 0x000002800000-0x000004a00000 : "ubi1"
[    0.957688] 0x000004a00000-0x000006a00000 : "overlay"
[    0.963245] 0x000006a00000-0x000007600000 : "data"
[    0.968521] 0x000007600000-0x000007640000 : "KF"
[    1.539880] mt753x gsw@0: LAN/WAN VLAN setting=llllw
[    1.545118] mt753x gsw@0: Switch is MediaTek MT7531AE rev 1
[    1.554544] mt753x gsw@0: HWSTRAP=0xff XTAL=25MHz
[    3.585131] libphy: mt753x_mdio: probed
[    5.208244] mt753x gsw@0: >>>>>>>>>>>>>>>>>>>>>>>>>>>>> START CALIBRATION:
[    5.216221] mt753x gsw@0: -------- gephy-calbration (port:0) --------
[    5.231423] CALDLY = 40
[    5.276226] 0x1e-e0 = 2626
[    5.280624] 0x1f-115 = 4
[    5.283144]   GE Rext AnaCal Done! (6)(0x26)
[    5.356330]  GE R50 AnaCal Done! (12) (0x30)(0xb0)
[    5.420456]  GE R50 AnaCal Done! (11) (0x31)(0xb1)
[    5.484584]  GE R50 AnaCal Done! (11) (0x31)(0xb1)
[    5.553264]  GE R50 AnaCal Done! (12) (0x30)(0xb0)
[    5.561114]  GE 1e_174(0xb0b1), 1e_175(0xb1b0)
[    5.612050]  GE Tx offset AnaCal Done! (pair-0)(5)(0x24) 0x1e_172=0x2420
[    5.632364]  GE Tx offset AnaCal Done! (pair-1)(1)(0x1) 0x1e_172=0x2401
[    5.670807]  GE Tx offset AnaCal Done! (pair-2)(5)(0x24) 0x1e_173=0x2420
[    5.695675]  GE Tx offset AnaCal Done! (pair-3)(2)(0x2) 0x1e_173=0x2402
[    5.843863]  GE Tx amp AnaCal Done! (pair-0)(1e_12 = 0x9826)
[    5.938449]  GE Tx amp AnaCal Done! (pair-1)(1e_17 = 0x2323)
[    6.047813]  GE Tx amp AnaCal Done! (pair-2)(1e_19 = 0x252d)
[    6.140192]  GE Tx amp AnaCal Done! (pair-3)(1e_21 = 0x232b)
[    6.186902] PORT 0 RX_DC_OFFSET
[    6.199570] before pairA output = e
[    6.204834] after pairA output = 1
[    6.209930] before pairB output = 1d
[    6.215279] after pairB output = 0
[    6.220375] before pairC output = f
[    6.225637] after pairC output = fe
[    6.230819] before pairD output = 1e
[    6.236170] after pairD output = fe
[    6.239902] mt753x gsw@0: -------- gephy-calbration (port:1) --------
[    6.255106] CALDLY = 40
[    6.326333]  GE R50 AnaCal Done! (13) (0x26)(0xa6)
[    6.395015]  GE R50 AnaCal Done! (12) (0x30)(0xb0)
[    6.459141]  GE R50 AnaCal Done! (11) (0x31)(0xb1)
[    6.527817]  GE R50 AnaCal Done! (12) (0x30)(0xb0)
[    6.535667]  GE 1e_174(0xa6b0), 1e_175(0xb1b0)
[    6.572939]  GE Tx offset AnaCal Done! (pair-0)(2)(0x21) 0x1e_172=0x2120
[    6.602363]  GE Tx offset AnaCal Done! (pair-1)(3)(0x22) 0x1e_172=0x2122
[    6.640897]  GE Tx offset AnaCal Done! (pair-2)(5)(0x24) 0x1e_173=0x2420
[    6.674875]  GE Tx offset AnaCal Done! (pair-3)(4)(0x23) 0x1e_173=0x2423
[    6.800494]  GE Tx amp AnaCal Done! (pair-0)(1e_12 = 0x8c23)
[    6.900749]  GE Tx amp AnaCal Done! (pair-1)(1e_17 = 0x2525)
[    7.027102]  GE Tx amp AnaCal Done! (pair-2)(1e_19 = 0x2931)
[    7.142130]  GE Tx amp AnaCal Done! (pair-3)(1e_21 = 0x272f)
[    7.188840] PORT 1 RX_DC_OFFSET
[    7.201507] before pairA output = 1e
[    7.206857] after pairA output = 0
[    7.211953] before pairB output = f
[    7.217211] after pairB output = 0
[    7.222306] before pairC output = f
[    7.227568] after pairC output = 0
[    7.232663] before pairD output = 1e
[    7.238012] after pairD output = 0
[    7.241662] mt753x gsw@0: -------- gephy-calbration (port:2) --------
[    7.256866] CALDLY = 40
[    7.318983]  GE R50 AnaCal Done! (11) (0x31)(0xb1)
[    7.378556]  GE R50 AnaCal Done! (10) (0x32)(0xb2)
[    7.433577]  GE R50 AnaCal Done! (9) (0x34)(0xb4)
[    7.483958]  GE R50 AnaCal Done! (8) (0x35)(0xb5)
[    7.491721]  GE 1e_174(0xb1b2), 1e_175(0xb4b5)
[    7.542659]  GE Tx offset AnaCal Done! (pair-0)(5)(0x24) 0x1e_172=0x2420
[    7.581196]  GE Tx offset AnaCal Done! (pair-1)(5)(0x24) 0x1e_172=0x2424
[    7.633392]  GE Tx offset AnaCal Done! (pair-2)(8)(0x27) 0x1e_173=0x2720
[    7.662814]  GE Tx offset AnaCal Done! (pair-3)(3)(0x22) 0x1e_173=0x2722
[    7.754454]  GE Tx amp AnaCal Done! (pair-0)(1e_12 = 0x781e)
[    7.883021]  GE Tx amp AnaCal Done! (pair-1)(1e_17 = 0x2929)
[    7.986721]  GE Tx amp AnaCal Done! (pair-2)(1e_19 = 0x262e)
[    8.016810]  GE Tx amp AnaCal Done! (pair-3)(1e_21 = 0x1820)
[    8.063520] PORT 2 RX_DC_OFFSET
[    8.076187] before pairA output = f
[    8.081445] after pairA output = 0
[    8.086541] before pairB output = 1d
[    8.091889] after pairB output = ff
[    8.097067] before pairC output = 1e
[    8.102416] after pairC output = 1
[    8.107512] before pairD output = 1e
[    8.112863] after pairD output = 0
[    8.116512] mt753x gsw@0: -------- gephy-calbration (port:3) --------
[    8.131714] CALDLY = 40
[    8.180173]  GE R50 AnaCal Done! (8) (0x35)(0xb5)
[    8.221438]  GE R50 AnaCal Done! (6) (0x40)(0xc0)
[    8.267256]  GE R50 AnaCal Done! (7) (0x37)(0xb7)
[    8.313074]  GE R50 AnaCal Done! (7) (0x37)(0xb7)
[    8.320837]  GE 1e_174(0xb5c0), 1e_175(0xb7b7)
[    8.362660]  GE Tx offset AnaCal Done! (pair-0)(3)(0x22) 0x1e_172=0x2220
[    8.405749]  GE Tx offset AnaCal Done! (pair-1)(6)(0x25) 0x1e_172=0x2225
[    8.430616]  GE Tx offset AnaCal Done! (pair-2)(2)(0x21) 0x1e_173=0x2120
[    8.460036]  GE Tx offset AnaCal Done! (pair-3)(3)(0x22) 0x1e_173=0x2122
[    8.534691]  GE Tx amp AnaCal Done! (pair-0)(1e_12 = 0x5415)
[    8.606633]  GE Tx amp AnaCal Done! (pair-1)(1e_17 = 0x2020)
[    8.653711]  GE Tx amp AnaCal Done! (pair-2)(1e_19 = 0x1c24)
[    8.717773]  GE Tx amp AnaCal Done! (pair-3)(1e_21 = 0x1f27)
[    8.764478] PORT 3 RX_DC_OFFSET
[    8.777140] before pairA output = e
[    8.782401] after pairA output = 0
[    8.787496] before pairB output = f
[    8.792758] after pairB output = 1
[    8.797853] before pairC output = d
[    8.803115] after pairC output = 0
[    8.808211] before pairD output = 1d
[    8.813555] after pairD output = ff
[    8.817292] mt753x gsw@0: -------- gephy-calbration (port:4) --------
[    8.832494] CALDLY = 40
[    8.876393]  GE R50 AnaCal Done! (7) (0x37)(0xb7)
[    8.922210]  GE R50 AnaCal Done! (7) (0x37)(0xb7)
[    8.963475]  GE R50 AnaCal Done! (6) (0x40)(0xc0)
[    9.013849]  GE R50 AnaCal Done! (8) (0x35)(0xb5)
[    9.021612]  GE 1e_174(0xb7b7), 1e_175(0xc0b5)
[    9.077101]  GE Tx offset AnaCal Done! (pair-0)(6)(0x25) 0x1e_172=0x2520
[    9.111078]  GE Tx offset AnaCal Done! (pair-1)(4)(0x23) 0x1e_172=0x2523
[    9.145055]  GE Tx offset AnaCal Done! (pair-2)(4)(0x23) 0x1e_173=0x2320
[    9.192698]  GE Tx offset AnaCal Done! (pair-3)(7)(0x26) 0x1e_173=0x2326
[    9.278676]  GE Tx amp AnaCal Done! (pair-0)(1e_12 = 0x4c13)
[    9.344954]  GE Tx amp AnaCal Done! (pair-1)(1e_17 = 0x1010)
[    9.386370]  GE Tx amp AnaCal Done! (pair-2)(1e_19 = 0x151d)
[    9.416461]  GE Tx amp AnaCal Done! (pair-3)(1e_21 = 0x1921)
[    9.463168] PORT 4 RX_DC_OFFSET
[    9.475835] before pairA output = c
[    9.481092] after pairA output = 0
[    9.486188] before pairB output = 1d
[    9.491537] after pairB output = fe
[    9.496718] before pairC output = 1e
[    9.502066] after pairC output = ff
[    9.507249] before pairD output = c
[    9.512511] after pairD output = 1
[    9.518372] UBI: auto-attach mtd8
[    9.521715] ubi0: attaching mtd8
[    9.635999] ubi0: scanning is finished
[    9.644777] ubi0: attached mtd8 (name "ubi", size 34 MiB)
[    9.650177] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    9.657046] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    9.663823] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    9.670778] ubi0: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0
[    9.676773] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    9.683984] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 857011981
[    9.693014] ubi0: available PEBs: 89, total reserved PEBs: 183, PEBs reserved for bad PEB handling: 19
[    9.702313] ubi0: background thread "ubi_bgt0d" started, PID 647
[    9.708865] block ubiblock0_1: created from ubi0:1(rootfs)
[    9.714365] ubiblock: device ubiblock0_1 (rootfs) set to be root filesystem
[    9.734594] Failed to lock mtd obr
[    9.737760] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    9.748475] Freeing unused kernel memory: 384K
[    9.775871] Run /sbin/init as init process
[   10.031356] init: Console is alive
[   10.034896] init: - watchdog -
[   10.396142] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[   10.418814] conninfra@(mtk_conninfra_drv_init:644) Before platform_driver_register
[   10.426481] Get Index(0-TOP_MISC_BASE) phy_addr(0x11d10000) vir_addr=(0xffffffc01094d000) size=(0x1000)
[   10.435868] Get Index(1-TOPRGU_BASE) phy_addr(0x1001c000) vir_addr=(0xffffffc010955000) size=(0x1000)
[   10.445075] Get Index(2-GPIO_BASE) phy_addr(0x11d00000) vir_addr=(0xffffffc01095d000) size=(0x1000)
[   10.454108] Get Index(3-IOCFG_TR_BASE) phy_addr(0x11f00000) vir_addr=(0xffffffc01095f000) size=(0x1000)
[   10.463486] Get Index(4-IOCFG_TL_BASE) phy_addr(0x11f10000) vir_addr=(0xffffffc010961000) size=(0x1000)
[   10.472869] Get Index(5-INFRACFG_AO_BASE) phy_addr(0x10003000) vir_addr=(0xffffffc010963000) size=(0x1000)
[   10.482509] Get Index(6-CONN_INFRA_CFG_BASE) phy_addr(0x18001000) vir_addr=(0xffffffc010965000) size=(0x1000)
[   10.492409] Get Index(7-CONN_INFRA_SYSRAM_BASE) phy_addr(0x18050000) vir_addr=(0xffffffc01096d000) size=(0x1000)
[   10.502569] Get Index(8-CONN_INFRA_CLKGEN_ON_TOP_BASE) phy_addr(0x18009000) vir_addr=(0xffffffc010975000) size=(0x1000)
[   10.513336] Get Index(9-CONN_HOST_CSR_TOP_BASE) phy_addr(0x18060000) vir_addr=(0xffffffc01097d000) size=(0x1000)
[   10.523496] Get Index(10-CONN_INFRA_BUS_CR_BASE) phy_addr(0x1800e000) vir_addr=(0xffffffc01097f000) size=(0x1000)
[   10.533743] Get Index(11-CONN_INFRA_RGU_BASE) phy_addr(0x18000000) vir_addr=(0xffffffc010981000) size=(0x1000)
[   10.543729] Get Index(12-CONN_WT_SLP_CTL_REG_BASE) phy_addr(0x18005000) vir_addr=(0xffffffc010983000) size=(0x1000)
[   10.554149] Get Index(13-INST2_CONN_WT_SLP_CTL_REG_BASE) phy_addr(0x18085000) vir_addr=(0xffffffc010985000) size=(0x1000)
[   10.565090] Get Index(14-CONN_RF_SPI_MST_REG_BASE) phy_addr(0x18004000) vir_addr=(0xffffffc010987000) size=(0x1000)
[   10.575513] Get Index(15-INST2_CONN_RF_SPI_MST_REG_BASE) phy_addr(0x18084000) vir_addr=(0xffffffc010989000) size=(0x1000)
[   10.586454] Get Index(16-CONN_SEMAPHORE_BASE) phy_addr(0x18070000) vir_addr=(0xffffffc0109d0000) size=(0x10000)
[   10.596528] Get Index(17-CONN_AFE_CTL_BASE) phy_addr(0x18003000) vir_addr=(0xffffffc0109e1000) size=(0x1000)
[   10.606341] Get Index(18-CONN_AFE_CTL_2ND_BASE) phy_addr(0x18083000) vir_addr=(0xffffffc0109e3000) size=(0x1000)
[   10.616502] Get Index(19-WF_TOP_SLPPROT_ON_BASE) phy_addr(0x184c0000) vir_addr=(0xffffffc010c10000) size=(0x10000)
[   10.626835] Get Index(20-WF_TOP_CFG_BASE) phy_addr(0x184b0000) vir_addr=(0xffffffc0109e5000) size=(0x1000)
[   10.636475] Get Index(21-WF_MCU_CONFIG_LS_BASE) phy_addr(0x184f0000) vir_addr=(0xffffffc0109e7000) size=(0x1000)
[   10.646635] Get Index(22-WF_MCU_BUS_CR_BASE) phy_addr(0x18400000) vir_addr=(0xffffffc0109e9000) size=(0x1000)
[   10.656535] Get Index(23-WF_MCUSYS_INFRA_BUS_FULL_U_DEBUG_CTRL_AO_BASE) phy_addr(0x18500000) vir_addr=(0xffffffc0109eb000) size=(0x1000)
[   10.668776] Get Index(24-WF_TOP_CFG_ON_BASE) phy_addr(0x184c0000) vir_addr=(0xffffffc010c40000) size=(0x10000)
[   10.678764] conninfra@(consys_plt_hw_init:162) adie_cfg_type = 1, one_adie_dbdc = 1
[   10.686412] [emi_mng_init] gConEmiPhyBase = [0x47c80000] size = [0x100000] fw size = [0x100000] ops=[00000000d8811b64]
[   10.697181] conninfra@(mtk_conninfra_drv_init:650) After platform_driver_register
[   10.705017] ConnInfra Dev: init (0)
[   10.709944] conninfra@(_consys_polling_chipid_int:306) Read CONNSYS HW IP version successfully! (0x02090000)
[   10.719784] conninfra@(connsys_d_die_cfg:365) D-die efuse: 0x00000000
[   10.727241] conninfra@(_connsys_a_die_cfg_7976:919) adie_idx[0], A-die CHIP ID = 0x7976, HW Version = 0x8a10
[   10.738060] conninfra@(consys_spi_write_nolock:501) addr=0x0a00, val=0xffffffff
[   10.746362] conninfra@(consys_spi_write_nolock:501) addr=0x04ac, val=0x0000001c
[   10.754666] conninfra@(consys_spi_write_nolock:501) addr=0x0144, val=0x00000002
[   10.763976] conninfra@(consys_spi_write_nolock:501) addr=0x0148, val=0x00000000
[   10.773284] conninfra@(consys_spi_write_nolock:501) addr=0x0148, val=0x43a60000
[   10.786624] conninfra@(connsys_a_die_efuse_read_nolock:737) efuse = [0x00000001, 0x00c40000, 0x008700b9, 0x00000000]
[   10.798136] conninfra@(consys_spi_write_nolock:501) addr=0x0144, val=0x00000002
[   10.807446] conninfra@(consys_spi_write_nolock:501) addr=0x0148, val=0x23a6003a
[   10.816755] conninfra@(consys_spi_write_nolock:501) addr=0x0148, val=0x63a7003a
[   10.830095] conninfra@(connsys_a_die_efuse_read_nolock:737) efuse = [0x00000001, 0x00c40000, 0x008700b9, 0x00000000]
[   10.841606] conninfra@(consys_spi_write_nolock:501) addr=0x0144, val=0x00000002
[   10.850916] conninfra@(consys_spi_write_nolock:501) addr=0x0148, val=0x23a7003a
[   10.860225] conninfra@(consys_spi_write_nolock:501) addr=0x0148, val=0x63ac003a
[   10.873564] conninfra@(connsys_a_die_efuse_read_nolock:737) efuse = [0x00000001, 0x00c40000, 0x008700b9, 0x00000000]
[   10.885075] conninfra@(consys_spi_write_nolock:501) addr=0x0038, val=0x4a563b00
[   10.893377] conninfra@(consys_spi_write_nolock:501) addr=0x065c, val=0x1d59080f
[   10.901679] conninfra@(consys_spi_write_nolock:501) addr=0x0664, val=0x34c00fe0
[   10.909984] conninfra@(consys_spi_write_nolock:501) addr=0x0070, val=0x88888005
[   10.919245] conninfra@(consys_spi_write_nolock:501) addr=0x0070, val=0x00000005
[   10.927481] conninfra@(_consys_polling_chipid_int:306) Read CONNSYS HW IP version successfully! (0x02090000)
[   10.937294] conninfra@(_consys_hw_conninfra_wakeup:470) conninfra_wakeup refcnt=[0]->[1] wakeup!!
[   10.946157] conninfra@(_consys_hw_conninfra_sleep:490) conninfra_sleep refcnt=[1]->[0] sleep!!
[   10.954756] conninfra@(opfunc_power_on_internal:241) [Conninfra Pwr On] BT=[0] FM=[0] GPS=[0] WF=[0] CONNINFRA=[1]
[   10.965714] Button Hotplug driver version 0.4.1
[   10.973889] mediatek_soc_hnat 15100000.hnat: wan = eth1
[   10.979123] mediatek_soc_hnat 15100000.hnat: lan = eth0
[   10.984348] mediatek_soc_hnat 15100000.hnat: ppd = eth0
[   10.989565] mediatek_soc_hnat 15100000.hnat: gmac num = 2
[   10.994955] mediatek_soc_hnat 15100000.hnat: ppe num = 1
[   11.000812] mediatek_soc_hnat 15100000.hnat: PPE0 entry number = 8192
[   11.017576] mediatek_soc_hnat 15100000.hnat: PPE0 hwnat start
[   11.035869] hnat roaming work enable
[   11.042339] warp_module_init(): module init and register callback for warp
[   11.049235] create warp_ctrl ok!!!
[   11.052667] wed_get_slot_map(): assign slot_id:0 for entry: 0!
[   11.058504] wed_get_slot_map(): assign slot_id:1 for entry: 1!
[   11.064835] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[   11.075080] init: - preinit -
[   11.336784] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[   11.345114] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   14.447789] mount_root: mounting /dev/root
[   14.812376] ubi1: attaching mtd10
[   14.920511] ubi1: scanning is finished
[   14.929454] ubi1: attached mtd10 (name "overlay", size 32 MiB)
[   14.935291] ubi1: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[   14.942160] ubi1: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[   14.948938] ubi1: VID header offset: 2048 (aligned 2048), data offset: 4096
[   14.955888] ubi1: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
[   14.961884] ubi1: user volume: 1, internal volumes: 1, max. volumes count: 128
[   14.969095] ubi1: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 310177179
[   14.978126] ubi1: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 19
[   14.987337] ubi1: background thread "ubi_bgt1d" started, PID 758
UBI device number 1, total 256 LEBs (32505856 bytes, 31.0 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
ubimkvol: error!: UBI device doe[   15.006621] UBIFS (ubi1:0): Mounting in unauthenticated mode
s not have free [   15.012904] UBIFS (ubi1:0): background thread "ubifs_bgt1_0" started, PID 769
logical eraseblocks
[   15.065780] UBIFS (ubi1:0): UBIFS: mounted UBI device 1, volume 0, name "data"
[   15.073011] UBIFS (ubi1:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   15.082914] UBIFS (ubi1:0): FS size: 28315648 bytes (27 MiB, 223 LEBs), journal size 1396736 bytes (1 MiB, 11 LEBs)
[   15.093335] UBIFS (ubi1:0): reserved for root: 1337417 bytes (1306 KiB)
4

Here's the dts:

/dts-v1/;

/ {
	compatible = "mediatek,mt7981-spim-snand-rfb";
	interrupt-parent = <0x01>;
	#address-cells = <0x02>;
	#size-cells = <0x02>;
	model = "MediaTek MT7981 RFB";

	cpus {
		#address-cells = <0x01>;
		#size-cells = <0x00>;

		cpu@0 {
			device_type = "cpu";
			compatible = "arm,cortex-a53";
			enable-method = "psci";
			reg = <0x00>;
		};

		cpu@1 {
			device_type = "cpu";
			compatible = "arm,cortex-a53";
			enable-method = "psci";
			reg = <0x01>;
		};
	};

	pwm@10048000 {
		compatible = "mediatek,mt7981-pwm";
		reg = <0x00 0x10048000 0x00 0x1000>;
		#pwm-cells = <0x02>;
		clocks = <0x02 0x0d 0x02 0x0c 0x02 0x0e 0x02 0x0f 0x02 0x10>;
		clock-names = "top\0main\0pwm1\0pwm2\0pwm3";
	};

	thermal-zones {

		cpu-thermal {
			polling-delay-passive = <0x3e8>;
			polling-delay = <0x3e8>;
			thermal-sensors = <0x03 0x00>;
		};
	};

	thermal@1100c800 {
		#thermal-sensor-cells = <0x01>;
		compatible = "mediatek,mt7981-thermal";
		reg = <0x00 0x1100c800 0x00 0x800>;
		interrupts = <0x00 0x8a 0x04>;
		clocks = <0x02 0x1c 0x02 0x2f 0x02 0x30>;
		clock-names = "therm\0auxadc\0adc_32k";
		mediatek,auxadc = <0x04>;
		mediatek,apmixedsys = <0x05>;
		nvmem-cells = <0x06>;
		nvmem-cell-names = "calibration-data";
		phandle = <0x03>;
	};

	adc@1100d000 {
		compatible = "mediatek,mt7981-auxadc\0mediatek,mt7622-auxadc";
		reg = <0x00 0x1100d000 0x00 0x1000>;
		clocks = <0x02 0x2f 0x02 0x30>;
		clock-names = "main\032k";
		#io-channel-cells = <0x01>;
		phandle = <0x04>;
	};

	wed@15010000 {
		compatible = "mediatek,wed";
		wed_num = <0x02>;
		pci_slot_map = <0x00 0x01>;
		reg = <0x00 0x15010000 0x00 0x1000 0x00 0x15011000 0x00 0x1000>;
		interrupt-parent = <0x01>;
		interrupts = <0x00 0xcd 0x04 0x00 0xce 0x04>;
	};

	wdma@15104800 {
		compatible = "mediatek,wed-wdma";
		reg = <0x00 0x15104800 0x00 0x400 0x00 0x15104c00 0x00 0x400>;
	};

	ap2woccif@151A5000 {
		compatible = "mediatek,ap2woccif";
		reg = <0x00 0x151a5000 0x00 0x1000 0x00 0x151ad000 0x00 0x1000>;
		interrupt-parent = <0x01>;
		interrupts = <0x00 0xd3 0x04 0x00 0xd4 0x04>;
	};

	wocpu0_ilm@151E0000 {
		compatible = "mediatek,wocpu0_ilm";
		reg = <0x00 0x151e0000 0x00 0x8000>;
	};

	wocpu_dlm@151E8000 {
		compatible = "mediatek,wocpu_dlm";
		reg = <0x00 0x151e8000 0x00 0x2000 0x00 0x151f8000 0x00 0x2000>;
		resets = <0x07 0x00>;
		reset-names = "wocpu_rst";
	};

	wocpu_boot@15194000 {
		compatible = "mediatek,wocpu_boot";
		reg = <0x00 0x15194000 0x00 0x1000>;
	};

	reserved-memory {
		#address-cells = <0x02>;
		#size-cells = <0x02>;
		ranges;

		ramoops@42ff0000 {
			compatible = "ramoops";
			reg = <0x00 0x42ff0000 0x00 0x10000>;
			record-size = <0x10000>;
			console-size = <0x00>;
			ftrace-size = <0x00>;
			pmsg-size = <0x00>;
		};

		secmon@43000000 {
			reg = <0x00 0x43000000 0x00 0x30000>;
			no-map;
		};

		wmcpu-reserved@47C80000 {
			compatible = "mediatek,wmcpu-reserved";
			no-map;
			reg = <0x00 0x47c80000 0x00 0x100000>;
			phandle = <0x15>;
		};

		wocpu0_emi@47D80000 {
			compatible = "mediatek,wocpu0_emi";
			no-map;
			reg = <0x00 0x47d80000 0x00 0x40000>;
			shared = <0x00>;
		};

		wocpu_data@47DC0000 {
			compatible = "mediatek,wocpu_data";
			no-map;
			reg = <0x00 0x47dc0000 0x00 0x240000>;
			shared = <0x01>;
		};
	};

	psci {
		compatible = "arm,psci-0.2";
		method = "smc";
	};

	oscillator@0 {
		compatible = "fixed-clock";
		#clock-cells = <0x00>;
		clock-frequency = <0x2625a00>;
		clock-output-names = "clkxtal";
		phandle = <0x1b>;
	};

	infracfg_ao@10001000 {
		compatible = "mediatek,mt7981-infracfg_ao\0syscon";
		reg = <0x00 0x10001000 0x00 0x68>;
		#clock-cells = <0x01>;
		phandle = <0x02>;
	};

	infracfg@10001040 {
		compatible = "mediatek,mt7981-infracfg\0syscon";
		reg = <0x00 0x10001068 0x00 0x1000>;
		#clock-cells = <0x01>;
		phandle = <0x09>;
	};

	topckgen@1001B000 {
		compatible = "mediatek,mt7981-topckgen\0syscon";
		reg = <0x00 0x1001b000 0x00 0x1000>;
		#clock-cells = <0x01>;
		phandle = <0x08>;
	};

	apmixedsys@1001E000 {
		compatible = "mediatek,mt7981-apmixedsys\0syscon";
		reg = <0x00 0x1001e000 0x00 0x1000>;
		#clock-cells = <0x01>;
		phandle = <0x05>;
	};

	dummy_system_clk {
		compatible = "fixed-clock";
		clock-frequency = <0x2625a00>;
		#clock-cells = <0x00>;
		phandle = <0x17>;
	};

	dummy_gpt_clk {
		compatible = "fixed-clock";
		clock-frequency = <0x1312d00>;
		#clock-cells = <0x00>;
	};

	timer {
		compatible = "arm,armv8-timer";
		interrupt-parent = <0x01>;
		clock-frequency = <0xc65d40>;
		interrupts = <0x01 0x0d 0x08 0x01 0x0e 0x08 0x01 0x0b 0x08 0x01 0x0a 0x08>;
	};

	watchdog@1001c000 {
		compatible = "mediatek,mt7622-wdt\0mediatek,mt6589-wdt";
		reg = <0x00 0x1001c000 0x00 0x1000>;
		interrupts = <0x00 0x6e 0x04>;
		#reset-cells = <0x01>;
		status = "okay";
	};

	interrupt-controller@c000000 {
		compatible = "arm,gic-v3";
		#interrupt-cells = <0x03>;
		interrupt-parent = <0x01>;
		interrupt-controller;
		reg = <0x00 0xc000000 0x00 0x40000 0x00 0xc080000 0x00 0x200000>;
		interrupts = <0x01 0x09 0x04>;
		phandle = <0x01>;
	};

	trng@1020f000 {
		compatible = "mediatek,mt7981-rng";
	};

	serial@11002000 {
		compatible = "mediatek,mt6577-uart";
		reg = <0x00 0x11002000 0x00 0x400>;
		interrupts = <0x00 0x7b 0x04>;
		clocks = <0x02 0x1e>;
		assigned-clocks = <0x08 0x50 0x02 0x00>;
		assigned-clock-parents = <0x08 0x00 0x09 0x01>;
		status = "okay";
	};

	serial@11003000 {
		compatible = "mediatek,mt6577-uart";
		reg = <0x00 0x11003000 0x00 0x400>;
		interrupts = <0x00 0x7c 0x04>;
		clocks = <0x02 0x1f>;
		assigned-clocks = <0x08 0x50 0x02 0x01>;
		assigned-clock-parents = <0x08 0x00 0x09 0x01>;
		status = "disabled";
	};

	serial@11004000 {
		compatible = "mediatek,mt6577-uart";
		reg = <0x00 0x11004000 0x00 0x400>;
		interrupts = <0x00 0x7d 0x04>;
		clocks = <0x02 0x20>;
		assigned-clocks = <0x08 0x50 0x02 0x02>;
		assigned-clock-parents = <0x08 0x00 0x09 0x01>;
		status = "disabled";
	};

	i2c@11007000 {
		compatible = "mediatek,mt7981-i2c";
		reg = <0x00 0x11007000 0x00 0x1000 0x00 0x10217080 0x00 0x80>;
		interrupts = <0x00 0x88 0x04>;
		clock-div = <0x01>;
		clocks = <0x02 0x1d 0x02 0x19>;
		clock-names = "main\0dma";
		#address-cells = <0x01>;
		#size-cells = <0x00>;
		status = "disabled";
		pinctrl-names = "default";
		pinctrl-0 = <0x0a>;

		wm8960@1a {
			compatible = "wlf,wm8960";
			reg = <0x1a>;
			phandle = <0x20>;
		};
	};

	pcie@11280000 {
		compatible = "mediatek,mt7981-pcie\0mediatek,mt7986-pcie";
		device_type = "pci";
		reg = <0x00 0x11280000 0x00 0x4000>;
		reg-names = "pcie-mac";
		#address-cells = <0x03>;
		#size-cells = <0x02>;
		interrupts = <0x00 0xa8 0x04>;
		bus-range = <0x00 0xff>;
		ranges = <0x82000000 0x00 0x20000000 0x00 0x20000000 0x00 0x10000000>;
		status = "disabled";
		clocks = <0x02 0x38 0x02 0x39 0x02 0x3a 0x02 0x3b>;
		phys = <0x0b 0x02>;
		phy-names = "pcie-phy";
		#interrupt-cells = <0x01>;
		interrupt-map-mask = <0x00 0x00 0x00 0x07>;
		interrupt-map = <0x00 0x00 0x00 0x01 0x0c 0x00 0x00 0x00 0x00 0x02 0x0c 0x01 0x00 0x00 0x00 0x03 0x0c 0x02 0x00 0x00 0x00 0x04 0x0c 0x03>;

		interrupt-controller {
			interrupt-controller;
			#address-cells = <0x00>;
			#interrupt-cells = <0x01>;
			phandle = <0x0c>;
		};
	};

	crypto@10320000 {
		compatible = "inside-secure,safexcel-eip97";
		reg = <0x00 0x10320000 0x00 0x40000>;
		interrupts = <0x00 0x74 0x04 0x00 0x75 0x04 0x00 0x76 0x04 0x00 0x77 0x04>;
		interrupt-names = "ring0\0ring1\0ring2\0ring3";
		clocks = <0x08 0x42>;
		clock-names = "top_eip97_ck";
		assigned-clocks = <0x08 0x63>;
		assigned-clock-parents = <0x08 0x15>;
	};

	pinctrl@11d00000 {
		compatible = "mediatek,mt7981-pinctrl";
		reg = <0x00 0x11d00000 0x00 0x1000 0x00 0x11c00000 0x00 0x1000 0x00 0x11c10000 0x00 0x1000 0x00 0x11d20000 0x00 0x1000 0x00 0x11e00000 0x00 0x1000 0x00 0x11e20000 0x00 0x1000 0x00 0x11f00000 0x00 0x1000 0x00 0x11f10000 0x00 0x1000 0x00 0x1000b000 0x00 0x1000>;
		reg-names = "gpio_base\0iocfg_rt_base\0iocfg_rm_base\0iocfg_rb_base\0iocfg_lb_base\0iocfg_bl_base\0iocfg_tm_base\0iocfg_tl_base\0eint";
		gpio-controller;
		#gpio-cells = <0x02>;
		gpio-ranges = <0x0d 0x00 0x00 0x38>;
		interrupt-controller;
		interrupts = <0x00 0xe1 0x04>;
		interrupt-parent = <0x01>;
		#interrupt-cells = <0x02>;
		phandle = <0x0d>;

		i2c-pins-g0 {
			phandle = <0x0a>;

			mux {
				function = "i2c";
				groups = "i2c0_0";
			};
		};

		pcm-pins-g0 {
			phandle = <0x1c>;

			mux {
				function = "pcm";
				groups = "pcm";
			};
		};

		pwm0-pin-g0 {

			mux {
				function = "pwm";
				groups = "pwm0_0";
			};
		};

		pwm1-pin-g0 {

			mux {
				function = "pwm";
				groups = "pwm1_0";
			};
		};

		pwm2-pin {

			mux {
				function = "pwm";
				groups = "pwm2";
			};
		};

		spi0-pins {
			phandle = <0x13>;

			mux {
				function = "spi";
				groups = "spi0\0spi0_wp_hold";
			};

			conf-pu {
				pins = "SPI0_CS\0SPI0_HOLD\0SPI0_WP";
				drive-strength = <0x08>;
				bias-pull-down = <0x64>;
			};

			conf-pd {
				pins = "SPI0_CLK\0SPI0_MOSI\0SPI0_MISO";
				drive-strength = <0x08>;
				bias-pull-down = <0x64>;
			};
		};

		spi1-pins {
			phandle = <0x14>;

			mux {
				function = "spi";
				groups = "spi1_1";
			};
		};

		uart1-pins-g1 {

			mux {
				function = "uart";
				groups = "uart1_1";
			};
		};

		uart2-pins-g1 {

			mux {
				function = "uart";
				groups = "uart2_1";
			};
		};
	};

	syscon@15000000 {
		#address-cells = <0x01>;
		#size-cells = <0x01>;
		compatible = "mediatek,mt7981-ethsys\0syscon";
		reg = <0x00 0x15000000 0x00 0x1000>;
		#clock-cells = <0x01>;
		#reset-cells = <0x01>;
		phandle = <0x0e>;

		reset-controller {
			compatible = "ti,syscon-reset";
			#reset-cells = <0x01>;
			ti,reset-bits = <0x34 0x04 0x34 0x04 0x34 0x04 0x28>;
			phandle = <0x07>;
		};
	};

	ethernet@15100000 {
		compatible = "mediatek,mt7981-eth";
		reg = <0x00 0x15100000 0x00 0x80000>;
		interrupts = <0x00 0xc4 0x04 0x00 0xc5 0x04 0x00 0xc6 0x04 0x00 0xc7 0x04>;
		clocks = <0x0e 0x00 0x0e 0x01 0x0e 0x02 0x0e 0x03 0x0f 0x00 0x0f 0x01 0x0f 0x02 0x0f 0x03 0x10 0x00 0x10 0x01 0x10 0x02 0x10 0x03>;
		clock-names = "fe\0gp2\0gp1\0wocpu0\0sgmii_tx250m\0sgmii_rx250m\0sgmii_cdr_ref\0sgmii_cdr_fb\0sgmii2_tx250m\0sgmii2_rx250m\0sgmii2_cdr_ref\0sgmii2_cdr_fb";
		assigned-clocks = <0x08 0x60 0x08 0x61>;
		assigned-clock-parents = <0x08 0x1b 0x08 0x22>;
		mediatek,ethsys = <0x0e>;
		mediatek,sgmiisys = <0x0f 0x10>;
		mediatek,infracfg = <0x11>;
		#reset-cells = <0x01>;
		#address-cells = <0x01>;
		#size-cells = <0x00>;
		status = "okay";

		mac@0 {
			compatible = "mediatek,eth-mac";
			reg = <0x00>;
			phy-mode = "2500base-x";

			fixed-link {
				speed = <0x9c4>;
				full-duplex;
				pause;
			};
		};

		mac@1 {
			compatible = "mediatek,eth-mac";
			reg = <0x01>;
			phy-mode = "2500base-x";

			fixed-link {
				speed = <0x9c4>;
				full-duplex;
				pause;
			};
		};

		mdio-bus {
			#address-cells = <0x01>;
			#size-cells = <0x00>;
			phandle = <0x1d>;

			ethernet-phy@0 {
				compatible = "ethernet-phy-id03a2.9461";
				reg = <0x00>;
				phy-mode = "gmii";
				nvmem-cells = <0x12>;
				nvmem-cell-names = "phy-cal-data";
			};
		};
	};

	hnat@15000000 {
		compatible = "mediatek,mtk-hnat_v4";
		reg = <0x00 0x15100000 0x00 0x80000>;
		resets = <0x0e 0x00>;
		reset-names = "mtketh";
		status = "okay";
		mtketh-wan = "eth1";
		mtketh-lan = "eth0";
		mtketh-max-gmac = <0x02>;
	};

	syscon@10060000 {
		compatible = "mediatek,mt7981-sgmiisys_0\0syscon";
		reg = <0x00 0x10060000 0x00 0x1000>;
		pn_swap;
		#clock-cells = <0x01>;
		phandle = <0x0f>;
	};

	syscon@10070000 {
		compatible = "mediatek,mt7981-sgmiisys_1\0syscon";
		reg = <0x00 0x10070000 0x00 0x1000>;
		#clock-cells = <0x01>;
		phandle = <0x10>;
	};

	topmisc@11d10000 {
		compatible = "mediatek,mt7981-topmisc\0syscon";
		reg = <0x00 0x11d10000 0x00 0x10000>;
		#clock-cells = <0x01>;
		phandle = <0x11>;
	};

	snfi@11005000 {
		compatible = "mediatek,mt7986-snand";
		reg = <0x00 0x11005000 0x00 0x1000 0x00 0x11006000 0x00 0x1000>;
		reg-names = "nfi\0ecc";
		interrupts = <0x00 0x79 0x04>;
		clocks = <0x02 0x24 0x02 0x23 0x02 0x25>;
		clock-names = "pad_clk\0nfi_clk\0nfi_hclk";
		assigned-clocks = <0x08 0x4d 0x08 0x4c>;
		assigned-clock-parents = <0x08 0x06 0x08 0x06>;
		#address-cells = <0x01>;
		#size-cells = <0x00>;
		status = "disabled";
	};

	mmc@11230000 {
		compatible = "mediatek,mt7986-mmc\0mediatek,mt7981-mmc";
		reg = <0x00 0x11230000 0x00 0x1000 0x00 0x11c20000 0x00 0x1000>;
		interrupts = <0x00 0x8f 0x04>;
		clocks = <0x08 0x33 0x08 0x34 0x02 0x2b>;
		assigned-clocks = <0x08 0x54 0x08 0x55>;
		assigned-clock-parents = <0x08 0x02 0x08 0x1c>;
		clock-names = "source\0hclk\0source_cg";
		status = "disabled";
	};

	wbsys@18000000 {
		compatible = "mediatek,wbsys";
		reg = <0x00 0x18000000 0x00 0x1000000>;
		interrupts = <0x00 0xd5 0x04 0x00 0xd6 0x04 0x00 0xd7 0x04 0x00 0xd8 0x04>;
		chip_id = <0x7981>;
	};

	wed_pcie@10003000 {
		compatible = "mediatek,wed_pcie";
		reg = <0x00 0x10003000 0x00 0x10>;
	};

	spi@1100a000 {
		compatible = "mediatek,ipm-spi-quad";
		reg = <0x00 0x1100a000 0x00 0x100>;
		interrupts = <0x00 0x8c 0x04>;
		clocks = <0x08 0x02 0x08 0x4e 0x02 0x26 0x02 0x28>;
		clock-names = "parent-clk\0sel-clk\0spi-clk\0spi-hclk";
		status = "okay";
		pinctrl-names = "default";
		pinctrl-0 = <0x13>;

		spi_nand@0 {
			#address-cells = <0x01>;
			#size-cells = <0x01>;
			compatible = "spi-nand";
			reg = <0x00>;
			spi-max-frequency = <0x3197500>;
			spi-tx-buswidth = <0x04>;
			spi-rx-buswidth = <0x04>;
			phandle = <0x1e>;
		};
	};

	spi@1100b000 {
		compatible = "mediatek,ipm-spi-single";
		reg = <0x00 0x1100b000 0x00 0x100>;
		interrupts = <0x00 0x8d 0x04>;
		clocks = <0x08 0x02 0x08 0x4f 0x02 0x27 0x02 0x29>;
		clock-names = "parent-clk\0sel-clk\0spi-clk\0spi-hclk";
		status = "okay";
		pinctrl-names = "default";
		pinctrl-0 = <0x14>;

		proslic_spi@0 {
			compatible = "silabs,proslic_spi";
			reg = <0x00>;
			spi-max-frequency = <0x989680>;
			spi-cpha = <0x01>;
			spi-cpol = <0x01>;
			channel_count = <0x01>;
			debug_level = <0x04>;
			reset_gpio = <0x0d 0x0f 0x00>;
			ig,enable-spi = <0x01>;
			phandle = <0x21>;
		};
	};

	spi@11009000 {
		compatible = "mediatek,ipm-spi-quad";
		reg = <0x00 0x11009000 0x00 0x100>;
		interrupts = <0x00 0x8e 0x04>;
		clocks = <0x08 0x02 0x08 0x4e 0x02 0x21 0x02 0x22>;
		clock-names = "parent-clk\0sel-clk\0spi-clk\0spi-hclk";
		status = "disabled";
	};

	consys@10000000 {
		compatible = "mediatek,mt7981-consys";
		reg = <0x00 0x10000000 0x00 0x8600000>;
		memory-region = <0x15>;
	};

	xhci@11200000 {
		compatible = "mediatek,mt7986-xhci\0mediatek,mtk-xhci";
		reg = <0x00 0x11200000 0x00 0x2e00 0x00 0x11203e00 0x00 0x100>;
		reg-names = "mac\0ippc";
		interrupts = <0x00 0xad 0x04>;
		phys = <0x16 0x03 0x0b 0x04>;
		clocks = <0x17 0x17 0x17 0x17 0x17>;
		clock-names = "sys_ck\0xhci_ck\0ref_ck\0mcu_ck\0dma_ck";
		#address-cells = <0x02>;
		#size-cells = <0x02>;
		mediatek,u3p-dis-msk = <0x00>;
		status = "okay";
	};

	usb-phy@11e10000 {
		compatible = "mediatek,mt7986\0mediatek,generic-tphy-v2";
		#address-cells = <0x02>;
		#size-cells = <0x02>;
		ranges;
		status = "okay";

		usb-phy@11e10000 {
			reg = <0x00 0x11e10000 0x00 0x700>;
			clocks = <0x17>;
			clock-names = "ref";
			#phy-cells = <0x01>;
			status = "okay";
			phandle = <0x16>;
		};

		usb-phy@11e10700 {
			reg = <0x00 0x11e10700 0x00 0x900>;
			clocks = <0x17>;
			clock-names = "ref";
			#phy-cells = <0x01>;
			mediatek,syscon-type = <0x11 0x218 0x00>;
			nvmem-cells = <0x18 0x19 0x1a>;
			nvmem-cell-names = "intr\0rx_imp\0tx_imp";
			status = "okay";
			phandle = <0x0b>;
		};
	};

	regulator-3p3v {
		compatible = "regulator-fixed";
		regulator-name = "fixed-3.3V";
		regulator-min-microvolt = <0x325aa0>;
		regulator-max-microvolt = <0x325aa0>;
		regulator-boot-on;
		regulator-always-on;
	};

	clkitg {
		compatible = "simple-bus";

		bring-up {
			compatible = "mediatek,clk-bring-up";
			clocks = <0x05 0x00 0x05 0x01 0x05 0x02 0x05 0x03 0x05 0x04 0x05 0x05 0x05 0x06 0x05 0x07 0x09 0x00 0x1b 0x09 0x02 0x09 0x03 0x09 0x04 0x1b 0x09 0x06 0x09 0x07 0x1b 0x1b 0x1b 0x1b 0x09 0x0c 0x09 0x0d 0x09 0x0e 0x09 0x0f 0x09 0x10 0x09 0x11 0x1b 0x1b 0x1b 0x1b 0x1b 0x09 0x17 0x09 0x18 0x09 0x1a 0x09 0x1b 0x09 0x1c 0x09 0x1d 0x09 0x1e 0x09 0x1f 0x09 0x20 0x09 0x21 0x1b 0x09 0x23 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x02 0x0b 0x1b 0x1b 0x1b 0x1b 0x02 0x11 0x1b 0x1b 0x1b 0x1b 0x1b 0x02 0x17 0x1b 0x02 0x19 0x02 0x1a 0x02 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x02 0x2a 0x02 0x2b 0x02 0x2c 0x02 0x2d 0x02 0x2e 0x1b 0x1b 0x02 0x31 0x02 0x32 0x02 0x33 0x02 0x34 0x02 0x35 0x02 0x36 0x02 0x37 0x1b 0x1b 0x1b 0x08 0x01 0x1b 0x08 0x05 0x08 0x06 0x08 0x07 0x08 0x04 0x08 0x09 0x08 0x0c 0x08 0x0f 0x08 0x10 0x08 0x12 0x08 0x14 0x08 0x15 0x08 0x16 0x08 0x17 0x08 0x19 0x08 0x1a 0x1b 0x08 0x1d 0x08 0x1e 0x08 0x21 0x1b 0x08 0x24 0x08 0x25 0x1b 0x08 0x29 0x08 0x26 0x08 0x2b 0x08 0x2a 0x1b 0x08 0x31 0x1b 0x1b 0x1b 0x08 0x56 0x08 0x37 0x08 0x3d 0x08 0x3e 0x08 0x3f 0x08 0x45 0x08 0x41 0x08 0x46 0x08 0x47 0x08 0x48 0x08 0x49 0x08 0x4a 0x08 0x3a 0x1b 0x1b 0x1b 0x1b 0x08 0x52 0x1b 0x1b 0x1b 0x08 0x56 0x08 0x57 0x08 0x58 0x08 0x59 0x08 0x5a 0x08 0x5b 0x08 0x5c 0x08 0x5d 0x08 0x5e 0x08 0x5f 0x1b 0x1b 0x08 0x62 0x08 0x5e 0x1b 0x08 0x64 0x08 0x56 0x08 0x69 0x08 0x6a 0x08 0x6b 0x08 0x6c>;
			clock-names = "0\01\02\03\04\05\06\07\08\09\010\011\012\013\014\015\016\017\018\019\020\021\022\023\024\025\026\027\028\029\030\031\032\033\034\035\036\037\038\039\040\041\042\043\044\045\046\047\048\049\050\051\052\053\054\055\056\057\058\059\060\061\062\063\064\065\066\067\068\069\070\071\072\073\074\075\076\077\078\079\080\081\082\083\084\085\086\087\088\089\090\091\092\093\094\095\096\097\098\099\0100\0101\0102\0103\0104\0105\0106\0107\0108\0109\0110\0111\0112\0113\0114\0115\0116\0117\0118\0119\0120\0121\0122\0123\0124\0125\0126\0127\0128\0129\0130\0131\0132\0133\0134\0135\0136\0137\0138\0139\0140\0141\0142\0143\0144\0145\0146\0147\0148\0149\0150\0151\0152\0153\0154\0155\0156\0157\0158\0159\0160\0161\0162\0163\0164\0165\0166\0167\0168\0169\0170\0171\0172\0173\0174\0175\0176\0177\0178\0179\0180\0181\0182\0183";
		};
	};

	efuse@11f20000 {
		compatible = "mediatek,efuse";
		reg = <0x00 0x11f20000 0x00 0x1000>;
		#address-cells = <0x01>;
		#size-cells = <0x01>;

		calib@274 {
			reg = <0x274 0x0c>;
			phandle = <0x06>;
		};

		calib@8dc {
			reg = <0x8dc 0x10>;
			phandle = <0x12>;
		};

		usb3-rx-imp@8c8 {
			reg = <0x8c8 0x01>;
			bits = <0x00 0x05>;
			phandle = <0x19>;
		};

		usb3-tx-imp@8c8 {
			reg = <0x8c8 0x02>;
			bits = <0x05 0x05>;
			phandle = <0x1a>;
		};

		usb3-intr@8c9 {
			reg = <0x8c9 0x01>;
			bits = <0x02 0x06>;
			phandle = <0x18>;
		};
	};

	audio-controller@11210000 {
		compatible = "mediatek,mt79xx-audio";
		reg = <0x00 0x11210000 0x00 0x9000>;
		interrupts = <0x00 0x6a 0x04>;
		clocks = <0x02 0x12 0x02 0x13 0x02 0x14 0x02 0x15 0x02 0x16 0x08 0x65>;
		clock-names = "aud_bus_ck\0aud_26m_ck\0aud_l_ck\0aud_aud_ck\0aud_eg2_ck\0aud_sel";
		assigned-clocks = <0x08 0x65 0x08 0x66 0x08 0x67 0x08 0x68>;
		assigned-clock-parents = <0x08 0x10 0x08 0x12 0x08 0x10 0x08 0x12>;
		status = "okay";
		pinctrl-names = "default";
		pinctrl-0 = <0x1c>;
		phandle = <0x1f>;
	};

	ice_debug {
		compatible = "mediatek,mt7981-ice_debug\0mediatek,mt2701-ice_debug";
		clocks = <0x02 0x18>;
		clock-names = "ice_dbg";
	};

	chosen {
		bootargs = "console=ttyS0,115200n1 loglevel=8  \t\t\t\tearlycon=uart8250,mmio32,0x11002000";
	};

	leds {
		compatible = "gpio-leds";

		led_sys_blue {
			label = "led_blue";
			gpios = <0x0d 0x09 0x01>;
			default-state = "off";
		};

		led_sys_yellow {
			label = "led_yellow";
			gpios = <0x0d 0x0a 0x01>;
			default-state = "on";
		};

		led_net_blue {
			label = "net_blue";
			gpios = <0x0d 0x0b 0x01>;
			default-state = "off";
		};

		led_net_yellow {
			label = "net_yellow";
			gpios = <0x0d 0x0c 0x01>;
			default-state = "off";
		};
	};

	gpio-keys {
		compatible = "gpio-keys";
		#address-cells = <0x01>;
		#size-cells = <0x00>;

		reset {
			label = "reset";
			gpios = <0x0d 0x01 0x01>;
			linux,code = <0x198>;
		};

		mesh {
			label = "mesh";
			gpios = <0x0d 0x00 0x01>;
			linux,code = <0x109>;
		};
	};

	memory {
		reg = <0x00 0x40000000 0x00 0x10000000>;
	};

	gsw@0 {
		compatible = "mediatek,mt753x";
		mediatek,ethsys = <0x0e>;
		#address-cells = <0x01>;
		#size-cells = <0x00>;
		mediatek,mdio = <0x1d>;
		mediatek,portmap = "llllw";
		mediatek,mdio_master_pinmux = <0x00>;
		reset-gpios = <0x0d 0x27 0x00>;
		interrupt-parent = <0x0d>;
		interrupts = <0x26 0x04>;
		status = "okay";

		port@5 {
			compatible = "mediatek,mt753x-port";
			reg = <0x05>;
			phy-mode = "sgmii";

			fixed-link {
				speed = <0x9c4>;
				full-duplex;
			};
		};

		port@6 {
			compatible = "mediatek,mt753x-port";
			mediatek,ssc-on;
			reg = <0x06>;
			phy-mode = "sgmii";

			fixed-link {
				speed = <0x9c4>;
				full-duplex;
			};
		};
	};

	nmbm_spim_nand {
		compatible = "generic,nmbm";
		#address-cells = <0x01>;
		#size-cells = <0x01>;
		lower-mtd-device = <0x1e>;
		forced-create;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <0x01>;
			#size-cells = <0x01>;

			partition@0 {
				label = "BL2";
				reg = <0x00 0x100000>;
				read-only;
			};

			partition@100000 {
				label = "Nvram";
				reg = <0x100000 0x40000>;
			};

			partition@140000 {
				label = "Bdata";
				reg = <0x140000 0x40000>;
			};

			partition@180000 {
				label = "Factory";
				reg = <0x180000 0x200000>;
			};

			partition@380000 {
				label = "FIP";
				reg = <0x380000 0x200000>;
			};

			partition@580000 {
				label = "crash";
				reg = <0x580000 0x40000>;
			};

			partition@5c0000 {
				label = "crash_log";
				reg = <0x5c0000 0x40000>;
			};

			partition@600000 {
				label = "ubi";
				reg = <0x600000 0x2200000>;
			};

			partition@2800000 {
				label = "ubi1";
				reg = <0x2800000 0x2200000>;
			};

			partition@4a00000 {
				label = "overlay";
				reg = <0x4a00000 0x2000000>;
			};

			partition@6a00000 {
				label = "data";
				reg = <0x6a00000 0xc00000>;
			};

			partition@7600000 {
				label = "KF";
				reg = <0x7600000 0x40000>;
			};
		};
	};

	sound_wm8960 {
		compatible = "mediatek,mt79xx-wm8960-machine";
		mediatek,platform = <0x1f>;
		audio-routing = "Headphone\0HP_L\0Headphone\0HP_R\0LINPUT1\0AMIC\0RINPUT1\0AMIC";
		mediatek,audio-codec = <0x20>;
		status = "disabled";
	};

	sound_si3218x {
		compatible = "mediatek,mt79xx-si3218x-machine";
		mediatek,platform = <0x1f>;
		mediatek,ext-codec = <0x21>;
		status = "disabled";
	};
};
5

I'm afraid they are not the same device. This device uses MT7981, and the most notable feature is that devices using MT7981 have five external antennas.

6

good, then I'll edit my post :slight_smile:

7

The ttl is locked when enter BL3 by default. Is there a easy way to change the Bdata partition?

8

The exploit way to enable its ssh, which worked in other xiaomi router, seems not work in this router.
I use flash programmer to enable telnet in bdata, then it works.
According to the way how other people find specific way to enable it, lua files were successfully decompiled.

I checked some fiiles, for example:

  1. set_sys_time, it added input check
  2. extendwifi_connect_inited_router, its write_t_v method add string replace to avoid exploit.

So, did we do not have any way to enable telnet or ssh without flash programmer?

9

I saw the redmi ax6000 post also, maybe we need @remittor 's professional support for this device.
I have uploaded the rootfs of the device and misystem.lua to server.
Iet us see if we can get some help.
rootfs file https://hquu.net/r/rom/img-857011981_vol-rootfs.ubifs
lua file https://hquu.net/r/rom/wr30u_misystem.lua

10

@hquu
This device has Chinese firmware installed, so there is an additional ccode check:

11

Thank you for your reply !
I noticed the CN check code, which is different from redmi AX6000.

And I have checked it netmode, on dhcp client mode is 0, and wireless bridge mode it is 1.
on mesh controller mode it is 13 and mesh point mode is 14.
the vulnerability can not be exploited at any mode.

Not sure how to change the netmode to 4...

12

To do this, you need to set up a Mesh with other Xiaomi device.

13

Tried, but the netmode code is 13 and 14 depends on it is mesh controller or mesh point.

15

The Chinese have added two new states: 13 and 14

function isMeshCap()
    local uci = require("luci.model.uci").cursor()
    local mode = uci:get("xiaoqiang", "common", "NETMODE") or ""
    if mode:match("^whc_cap") then 
        return true
    end
    if mode:match("^lanapmode") then 
        local capmode = getCAPMode()
        if capmode == 1 then
            return true
        end
    end
    return false
end

function getCAPMode()
    local uci = require("luci.model.uci").cursor()
    local mode = uci:get("xiaoqiang", "common", "CAP_MODE") or ""
    if mode == "ap" then 
        return 1
    end
    return 0
end

function getNetMode()
    local uci = require("luci.model.uci").cursor()
    local mode = uci:get("xiaoqiang", "common", "NETMODE") or nil
    return mode
end

function getnetmode()
    local rec = miscRecovery()
    if rec == 1 then
        return 100
    end    
    local mode = getNetMode()
    if mode == "wifiapmode" then
        return 1
    end
    if mode == "lanapmode" then
        return 2
    end
    if mode == "whc_re" then
        return 3
    end
    if mode == "whc_cap" then
        return 4
    end
    if mode == "agent" then
        return 13
    end
    if mode == "controller" then
        return 14
    end
    return 0
end
16

This code comes from wr30u,So we can see that this is not the same as the ax6s and ax6000.Because netmode is 13 or 14 when someone sets it to mesh,but function setSysTime
Without isMeshController().so The redmi ax6000 method does not work.

function getSysTime()
  local cursor = require("luci.model.uci").cursor()
  local data = { 
    code = 0,
    time = os.date("%Y-%m-%d %H:%M:%S", os.time())
  }
  if isMeshMode() then
    local util = require("luci.util")
    local role = util.trim(util.exec("uci -q get xiaoqiang.common.NETMODE"))
    if isMeshController() then
      data.role = "controller"
    elseif isMeshCap() then
      data.role = "whc_cap"
    else
      data.role = role
    end
  end
  require("luci.jsonc").write_json(data)
end
function setSysTime = function()
  require("luci.http").prepare_content("application/json")
  local formvalue = require("luci.http").formvalue
  local write_json = require("luci.json").write
  local time = formvalue("time")
  local timezone = formvalue("timezone")
  local index = tonumber(formvalue("index")) or nil
  QSysUtil.setSysTime(time, timezone, index)
   LuciHttp.write_json(result)
end

function setSysTime = function(time, timezone, index)
  local isStrNil = require("xiaoqiang.util.XQFunction").isStrNil
  local fs = require("nixio.fs")
  local uci = require("luci.model.uci").cursor()
  local sys_tz = require("xiaoqiang.XQCountryCode").getCurrentCountryCode()
  local tz_value = nil
  local tz = TIME_ZONE[timezone]
  if tz then
    tz_value = tz[index+1]
  end
  if "CN" ~= sys_tz then
    tz_value = timezone
  end
  if not isStrNil(timezone) then
    uci:foreach("system", "system", function(s)
      if not isStrNil(s.timezone) then
        uci:set("system", s[".name"], "timezone", tz_value)
        uci:set("system", s[".name"], "timezoneindex", tostring(index))
      end
    end)
    uci:commit("system")
    fs.writefile("/tmp/TZ", timezone.."\n")
    if tz_value then
      fs.writefile("/tmp/TZ", tz_value.."\n")
      if require("xiaoqiang.util.XQFunction").isMeshCap() then
        local json = require("luci.json")
        local log = require("xiaoqiang.XQLog").log
        local msg = {
          cmd = "sync_time",
          timezone = tostring(timezone),
          index = tostring(index),
          tz_value = tostring(tz_value)
        }   
        log(6, " CAP call RE sync timezone msg:"..json.encode(msg))   
        require("xiaoqiang.util.XQFunction").forkExec("/sbin/whc_to_re_common_api.sh action '"..json.encode(msg).."'")
      end
    end
  end
  if not isStrNil(time) then
    local match = time:match("^%d+%-%d+%-%d+ %d+:%d+:%d+$")
    if match then
      require("xiaoqiang.util.XQFunction").forkExec("echo 'ok,xiaoqiang' > /tmp/ntp.status; sleep 3; date -s \""..time.."\"")
    end
  end
end

function isMeshCap()
  local uci_cur = require("luci.model.uci").cursor()
  local net_mode = uci_cur:get("xiaoqiang", "common", "NETMODE")
  if net_mode then
    if net_mode:match("^whc_cap") then
      return true
    elseif net_mode:match("^lanapmode") then
      if getCAPMode() == 1 then
        return true
      end
    end
  end
  return false
end

function getCAPMode()
    local uci = require("luci.model.uci").cursor()
    local mode = uci:get("xiaoqiang", "common", "CAP_MODE") or ""
    if mode == "ap" then 
        return 1
    end
    return 0
end

function getnetmode()
  local recoveryStatus = miscRecovery()
  if recoveryStatus == 1 then
    return 100
  else
    local netMode = getNetMode()
    if netMode == "lanapmode" then
      return 2
    elseif netMode == "wifiapmode" then
      return 1
    elseif netMode == "whc_re" then
      return 3
    elseif netMode == "whc_cap" then
      return 4
    elseif netMode == "agent" then
      return 13
    elseif netMode == "controller" then
      return 14
    else
      return 0
    end
  end
end
end

If you could give us some help, we would appreciate it very much.

2 Likes
17

Where did you get this code?

18

Some people use unliac to disassemble lua and then use chatgpt to remove intermediate variables to optimize the code, but because of the word limit, it can't be optimized all at once.

19

Wow. Very cool.

20

I and @hank9999 tried to study for three or four days but failed, I think we need your help, this is a complex project for us.

21

But chatgpt did not work very well. I start to find other ways to decompile it.
I found a project zh-explorer/mi_lua: xiaomi lua anti (github.com), this can convert mi luac to normal luac, then we can use many tools to decompile luac for the code.

This online tool Lua Decompiler (metaworm.site) worked very well!
The code decompiled by it is very clear to read.

2 Likes