OpenWrt support for Xiaomi AX9000

@kirdes Adding bootcount solved the sysupgrade issue.
Meanwhile, I did some more work on the fan controller driver.
Basic PWM-based mode now works fine along with the tachometer, RPM target mode does not unfortunately work.
I need to add the PWM output type configuration as it requires push-pull mode instead of open-drain.
Currently, it can be manually set with:
i2cset -f -y 0 0x2f 0x2b 0x01

2 Likes

I did the SSH method today, and it is working on AX6000 using the latest firmware (1.0.55). Thanks for the information!

This isn't working for me, I just get:

i2cset -f -y 0 0x2f 0x2b 0x01

Error: Write failed

EMC driver is loaded:

emc2305 0-002f: emc2301 detected

Strange thing is, i2cdetect doesn't even detect the i2c adapter:

i2cdetect -y  0
Warning: Can't use SMBus Quick Write command, will skip some addresses
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:                                                 
10:                                                 
20:                                                 
30: -- -- -- -- -- -- -- --                         
40:                                                 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60:                                                 
70:              

remap-ic2 is also loaded.

Do you have an idea?

You need the full i2c-tools, Busybox implementation does not work for SMBus

All-right, thanks.

I have a hacky way to parse that from DT in order to automatically set the mode but it needs to be reworked.

@Apache14 I went chasing where the hell does PCI Gen2 port get stuck, and actually found the place.
Its failing on init, actually even before init, it fails on a simple:

static inline u16 dw_pcie_readw_dbi(struct dw_pcie *pci, u32 reg)
{
	return dw_pcie_read_dbi(pci, reg, 0x2);
}

And then it cant get the offset to actually init the device, it hangs here and then WDT kicks in.
This is really weird I must say.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/pci/controller/dwc/pcie-qcom.c?h=v5.13-rc7#n1029

Hm, I can move the read later after resets and clocks were asserted and then it will actually not hang but fail on that read.
PHY will still link up, but ath10k cannot init the card, so there is still an issue like with the Gen3 PCIe.

But under OpenWrt PCI actually works with this, it also requires the PHY to be enabled before acessing the register space unlike other IP revisions.

@kirdes That solves the Gen2 PCI and gets the IoT radio working.

That's really odd, but are you saying mainline is broken but OpenWRT can init the PCIE fine ?

I'm confused as to why ipq807X seems to be very hit and miss on the initialization process, after that things seem pretty stable.

Yes, on 5.13 for both Gen3 and Gen2 it will init it and PHY will link up, you will be able to see the device on the bus but then if the ath11k or ath10k tries to init it you will get weird cannot poke CE engine and the rest of PCI not actually working errors.

Off course, Gen2 requires some fixup before.

On OpenWrt it works fine after the fixup.

Example bootlog on 5.13-rc7.

Jumping to AARCH64 kernel via monitor
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.13.0-rc7-00015-gbc312f18389c-dirty (robimarko@localhost.localdomain) (aarch64-linux-gcc.br_real (Buildroot 2021.02.2) 10.3.0, GNU ld (GNU Binutils) 2.35.2) #83 SMP PREEMPT Fri Jun 25 23:43:23 CEST 2021
[    0.000000] Machine model: Xiaomi AX9000
[    0.000000] earlycon: msm_serial_dm0 at MMIO 0x00000000078b3000 (options '')
[    0.000000] printk: bootconsole [msm_serial_dm0] enabled
[    0.000000] NUMA: No NUMA configuration found
[    0.000000] NUMA: Faking a node at [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000] NUMA: NODE_DATA [mem 0x7fde1c00-0x7fde3fff]
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000] cma: Reserved 32 MiB at 0x000000007cc00000
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] percpu: Embedded 22 pages/cpu s50328 r8192 d31592 u90112
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: ARM erratum 845719
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 258048
[    0.000000] Policy zone: DMA
[    0.000000] Kernel command line: earlycon=msm_serial_dm,0x078b3000 console=ttyMSM0,115200n8
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 974228K/1048576K available (9152K kernel code, 980K rwdata, 3128K rodata, 7296K init, 371K bss, 41580K reserved, 32768K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Preemptible hierarchical RCU implementation.
[    0.000000] rcu:     RCU event tracing is enabled.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=256 to nr_cpu_ids=4.
[    0.000000]  Trampoline variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=4
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] random: get_random_bytes called from start_kernel+0x34c/0x530 with crng_init=0
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[    0.000001] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[    0.010921] Console: colour dummy device 80x25
[    0.018806] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=76800)
[    0.023272] pid_max: default: 32768 minimum: 301
[    0.033671] LSM: Security Framework initializing
[    0.038337] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.042887] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.051917] rcu: Hierarchical SRCU implementation.
[    0.058523] smp: Bringing up secondary CPUs ...
[    0.063314] Detected VIPT I-cache on CPU1
[    0.063384] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.064051] Detected VIPT I-cache on CPU2
[    0.064097] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.064755] Detected VIPT I-cache on CPU3
[    0.064798] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.064876] smp: Brought up 1 node, 4 CPUs
[    0.098704] SMP: Total of 4 processors activated.
[    0.102775] CPU features: detected: 32-bit EL0 Support
[    0.107567] CPU features: detected: CRC32 instructions
[    0.119501] CPU: All CPU(s) started at EL1
[    0.119555] alternatives: patching kernel code
[    0.123756] devtmpfs: initialized
[    0.130725] KASLR disabled due to lack of seed
[    0.130972] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.134661] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.145830] pinctrl core: initialized pinctrl subsystem
[    0.152418] NET: Registered protocol family 16
[    0.158242] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.161010] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.168255] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.175887] audit: initializing netlink subsys (disabled)
[    0.183696] audit: type=2000 audit(0.128:1): state=initialized audit_enabled=0 res=1
[    0.184297] thermal_sys: Registered thermal governor 'step_wise'
[    0.189005] thermal_sys: Registered thermal governor 'power_allocator'
[    0.196928] cpuidle: using governor menu
[    0.209263] NET: Registered protocol family 42
[    0.213332] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[    0.217562] ASID allocator initialised with 65536 entries
[    0.224461] Serial: AMBA PL011 UART driver
[    0.279170] HugeTLB registered 1.00 GiB page size, pre-allocated 0 pages
[    0.279215] HugeTLB registered 32.0 MiB page size, pre-allocated 0 pages
[    0.284967] HugeTLB registered 2.00 MiB page size, pre-allocated 0 pages
[    0.291641] HugeTLB registered 64.0 KiB page size, pre-allocated 0 pages
[    0.299574] cryptd: max_cpu_qlen set to 1000
[    0.307279] iommu: Default domain type: Translated 
[    0.309586] SCSI subsystem initialized
[    0.314064] usbcore: registered new interface driver usbfs
[    0.317705] usbcore: registered new interface driver hub
[    0.323177] usbcore: registered new device driver usb
[    0.328730] pps_core: LinuxPPS API ver. 1 registered
[    0.333562] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.338618] PTP clock support registered
[    0.347749] EDAC MC: Ver: 3.0.0
[    0.353305] clocksource: Switched to clocksource arch_sys_counter
[    0.354588] VFS: Disk quotas dquot_6.6.0
[    0.360808] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes)
[    0.372165] NET: Registered protocol family 2
[    0.372314] IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.376629] tcp_listen_portaddr_hash hash table entries: 512 (order: 1, 8192 bytes, linear)
[    0.383376] TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.391471] TCP bind hash table entries: 8192 (order: 5, 131072 bytes, linear)
[    0.399532] TCP: Hash tables configured (established 8192 bind 8192)
[    0.406501] UDP hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.412941] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.419405] NET: Registered protocol family 1
[    0.427500] PCI: CLS 0 bytes, default 64
[    0.431307] hw perfevents: enabled with armv8_cortex_a53 PMU driver, 7 counters available
[    0.439040] Initialise system trusted keyrings
[    0.443132] workingset: timestamp_bits=42 max_order=18 bucket_order=0
[    0.508209] Key type asymmetric registered
[    0.508256] Asymmetric key parser 'x509' registered
[    0.511343] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 247)
[    0.516835] qcom-qmp-phy 78000.phy: supply vdda-phy not found, using dummy regulator
[    0.523980] qcom-qmp-phy 78000.phy: supply vdda-pll not found, using dummy regulator
[    0.532552] qcom-qmp-phy 78000.phy: Registered Qcom-QMP phy
[    0.540352] qcom-qmp-phy 8e000.phy: Registered Qcom-QMP phy
[    0.544948] qcom-qusb2-phy 79000.phy: supply vdda-pll not found, using dummy regulator
[    0.550229] qcom-qusb2-phy 79000.phy: supply vdda-phy-dpdm not found, using dummy regulator
[    0.558230] qcom-qusb2-phy 79000.phy: Registered Qcom-QUSB2 phy
[    0.567194] qcom-pcie 10000000.pci: host bridge /soc/pci@10000000 ranges:
[    0.572165] qcom-pcie 10000000.pci:       IO 0x0010200000..0x001020ffff -> 0x0010200000
[    0.579063] qcom-pcie 10000000.pci:      MEM 0x0010220000..0x001fffffff -> 0x0010220000
[    0.594716] qcom-pcie 10000000.pci: Before offset
[    0.646186] qcom-pcie 10000000.pci: Read DBI address failed
[    0.646228] qcom-pcie 10000000.pci: After offset
[    0.758954] qcom-pcie 10000000.pci: iATU unroll: disabled
[    0.759000] qcom-pcie 10000000.pci: Detected iATU regions: 32 outbound, 8 inbound
[    0.863485] qcom-pcie 10000000.pci: Link up
[    0.863717] qcom-pcie 10000000.pci: PCI host bridge to bus 0001:00
[    0.866521] pci_bus 0001:00: root bus resource [bus 00-ff]
[    0.872772] pci_bus 0001:00: root bus resource [io  0x0000-0xffff] (bus address [0x10200000-0x1020ffff])
[    0.878233] pci_bus 0001:00: root bus resource [mem 0x10220000-0x1fffffff]
[    0.888038] pci 0001:00:00.0: [17cb:0302] type 01 class 0x060400
[    0.894577] pci 0001:00:00.0: reg 0x10: [mem 0x00000000-0x00000fff]
[    0.900821] pci 0001:00:00.0: PME# supported from D0 D3hot D3cold
[    0.908448] pci 0001:01:00.0: [168c:0050] type 00 class 0x028000
[    0.913110] pci 0001:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    0.919234] pci 0001:01:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    0.926178] pci 0001:01:00.0: supports D1
[    0.932483] pci 0001:01:00.0: PME# supported from D0 D1 D3hot
[    0.946673] pci 0001:00:00.0: BAR 14: assigned [mem 0x10300000-0x105fffff]
[    0.946713] pci 0001:00:00.0: BAR 0: assigned [mem 0x10220000-0x10220fff]
[    0.952542] pci 0001:01:00.0: BAR 0: assigned [mem 0x10400000-0x105fffff 64bit]
[    0.959404] pci 0001:01:00.0: BAR 6: assigned [mem 0x10300000-0x1030ffff pref]
[    0.966455] pci 0001:00:00.0: PCI bridge to [bus 01-ff]
[    0.973731] pci 0001:00:00.0:   bridge window [mem 0x10300000-0x105fffff]
[    0.978879] pci 0001:00:00.0: Max Payload Size set to  128/ 128 (was  128), Max Read Rq  512
[    0.985849] pci 0001:01:00.0: Max Payload Size set to  128/ 256 (was  128), Max Read Rq  512
[    0.996773] pcieport 0001:00:00.0: PME: Signaling with IRQ 26
[    1.003574] bam-dma-engine 704000.dma: num-channels unspecified in dt
[    1.008364] bam-dma-engine 704000.dma: num-ees unspecified in dt
[    1.020823] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[    1.022463] msm_serial 78b3000.serial: msm_serial: detected port #0
[    1.026889] msm_serial 78b3000.serial: uartclk = 3686400
[    1.033216] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 20, base_baud = 230400)[    1.047169] printk: console [ttyMSM0] enabled
[    1.047169] printk: console [ttyMSM0] enabled
[    1.050513] printk: bootconsole [msm_serial_dm0] disabled
[    1.050513] printk: bootconsole [msm_serial_dm0] disabled
[    1.060608] msm_serial: driver initialized
[    1.072886] loop: module loaded
[    1.075096] nand: device found, Manufacturer ID: 0xef, Chip ID: 0xaa
[    1.075137] nand: Winbond W29N02GZ
[    1.081462] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.090591] spmi spmi-0: PMIC arbiter version v2 (0x20010000)
[    1.092910] libphy: Fixed MDIO Bus: probed
[    1.099497] ath10k_pci 0001:01:00.0: enabling device (0000 -> 0002)
[    1.102513] ath10k_pci 0001:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0
[    1.194366] ath10k_pci 0001:01:00.0: failed to poke copy engine: -16
[    1.282125] ath10k_pci 0001:01:00.0: failed to poke copy engine: -16
[    1.370125] ath10k_pci 0001:01:00.0: failed to poke copy engine: -16
[    1.425644] VFIO - User Level meta-driver version: 0.3
[    1.427439] dwc3-qcom 8af8800.usb: IRQ hs_phy_irq not found
[    1.429685] dwc3-qcom 8af8800.usb: IRQ dp_hs_phy_irq not found
[    1.435151] dwc3-qcom 8af8800.usb: IRQ dm_hs_phy_irq not found
[    1.441049] dwc3-qcom 8af8800.usb: IRQ ss_phy_irq not found
[    1.449569] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    1.452341] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1
[    1.458063] xhci-hcd xhci-hcd.0.auto: hcc params 0x0220fe65 hci version 0x110 quirks 0x0000000002010010
[    1.465534] xhci-hcd xhci-hcd.0.auto: irq 28, io mem 0x08a00000
[    1.475637] hub 1-0:1.0: USB hub found
[    1.480747] hub 1-0:1.0: 1 port detected
[    1.484848] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    1.488635] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2
[    1.493927] xhci-hcd xhci-hcd.0.auto: Host supports USB 3.0 SuperSpeed
[    1.501522] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    1.508621] hub 2-0:1.0: USB hub found
[    1.515081] ath10k_pci 0001:01:00.0: failed to poke copy engine: -16
[    1.516335] hub 2-0:1.0: 1 port detected
[    1.526798] usbcore: registered new interface driver usb-storage
[    1.530293] i2c /dev entries driver
[    1.538966] sdhci: Secure Digital Host Controller Interface driver
[    1.539478] sdhci: Copyright(c) Pierre Ossman
[    1.545748] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.551339] ledtrig-cpu: registered to indicate activity on CPUs
[    1.559500] NET: Registered protocol family 10
[    1.562850] Segment Routing with IPv6
[    1.566208] NET: Registered protocol family 17
[    1.569907] 8021q: 802.1Q VLAN Support v1.8
[    1.574249] Key type dns_resolver registered
[    1.578693] registered taskstats version 1
[    1.582809] Loading compiled-in X.509 certificates
[    1.605402] genirq: irq_chip msmgpio did not update eff. affinity mask of irq 47
[    1.605723] input: keys as /devices/platform/keys/inp�[    1.621148] Freeing unused kernel memory: 7296K
[    1.629379] Run /init as init process
Starting syslogd: OK
Starting klogd: OK
Running sysctl: OK
Populating /dev using udev: [    1.706255] ath10k_pci 0001:01:00.0: failed to poke copy engine: -16
[    1.707718] udevd[160]: starting version 3.2.9
[    1.712548] random: udevd: uninitialized urandom read (16 bytes read)
[    1.716374] random: udevd: uninitialized urandom read (16 bytes read)
[    1.722772] random: udevd: uninitialized urandom read (16 bytes read)
[    1.736490] udevd[161]: starting eudev-3.2.9
[    1.773156] ath10k_pci 0001:01:00.0: Failed to get pcie state addr: -16
[    1.773214] ath10k_pci 0001:01:00.0: failed to setup init config: -16
[    1.779002] ath10k_pci 0001:01:00.0: could not power on hif bus (-16)
[    1.785480] ath10k_pci 0001:01:00.0: could not probe fw (-16)

BTW, IPQ6018 has the same issue which makes sense as the IP revision is the same.

hi freind,

Updating firmware or reset default factory ax9000, the ssh is closed.
Will it be possible to activate it permanently?

I will be able to make permanent mode with this tutorial the same way as the ax3600 with HxD??
https://www.wutaijie.cn/?p=254

Regards

Rootfs needs to be modified like xqrepack does it.

Do you have a tutorial with xqrepack?

No as I dont care about the stock FW, it was just a way to get UART working.

thank you :wink:

Note that xqrepack wont work out of the box on AX9000 firmware as Xiaomi changed it a bit.

Nice.

BTW: im working on that pwm-ipq driver.
I fetched all the commits i could find from the ipq-5.4 repo. And I added the required DTS nodes (hopefully)

It compiles and gets loaded. I can export the pwm0, pwm1 and pwm3, but enabling them seems not to change the LED brightness (duty_cycle is 5 and period is 10 by default, so this should lead to 50% brightness i think)

You wrote, that driver in the ipq-5.4 repo is broken, that exactly do you meant by that?

Then you should take a look at
https://patchwork.kernel.org/project/linux-arm-msm/patch/f97c32aa98c9cdd977fac22cd504ad97448949e9.1624348502.git.baruch@tkos.co.il/

Its the same driver but updated for mainline to actually work, note that he dropped IPQ7074 and IPQ40xx which use the older revision HW.

You can check the discussion in v1 and v2 to see that it was broken by design before

@kirdes I pushed the updated EMC2301 driver that has a much better DT awarness and updated AX9000 DTS so it configures the PWM mode by default.
Unfortunately, the RPM target mode still does not work properly so by default it will spin at 100% PWM.

Great, we can reduce the fan speed by changing pwm1 value in hwmon sysfs.

1 Like

Yes as I dont think that setting it via DT will fly upstream.