Yeah i set the rootfs to be the exact /dev/ node for a start, I think renaming rootfs -> ubi in DTS would also fix this.
But after fixing the login tty device it booted fully via serial
U-Boot 2016.01 (Feb 19 2020 - 10:39:20 +0000), Build: jenkins-r3600_ota_publish-25
DRAM: smem ram ptable found: ver: 1 len: 4
512 MiB
NAND: ONFI device found
ID = 1590aaef
Vendor = ef
Device = aa
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC: sdhci: Node Not found, skipping initialization
PCI Link Intialized
PCI1 is not defined in the device tree
In: serial@78B3000
Out: serial@78B3000
Err: serial@78B3000
machid: 8010010
MMC Device 0 not found
eth5 MAC Address from ART is not valid
write phy_id=1, reg(0x8074):0x0670
write phy_id=2, reg(0x8074):0x0670
write phy_id=3, reg(0x8074):0x0670
write phy_id=4, reg(0x8074):0x0670
bootwait is on, bootdelay=5
Hit any key to stop autoboot: 0
trigger button release!
boot from rootfs 0
miwifi: check crash in rmem !
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: volume 2 ("rootfs_data") re-sized from 9 to 192 LEBs
ubi0: attached mtd1 (name "mtd=0", size 35 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 286, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1593889211
ubi0: available PEBs: 0, total reserved PEBs: 286, PEBs reserved for bad PEB handling: 40
Read 0 bytes from volume kernel to 44000000
No size specified -> Using max size (4825088)
Could not find PCI in device tree
Erasing NAND...
Erasing at 0x6e0000 -- 100% complete.
Writing to NAND... OK
## Loading kernel from FIT Image at 44000000 ...
Using 'config@ac04' configuration
Trying 'kernel@1' kernel subimage
Description: ARM64 OpenWrt Linux-5.4.48
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x440000e8
Data Size: 4735701 Bytes = 4.5 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x41080000
Entry Point: 0x41080000
Hash algo: crc32
Hash value: 90fe6d35
Hash algo: sha1
Hash value: fe02e722dc38a6ec316fac931db09044d84d040d
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
Using 'config@ac04' configuration
Trying 'fdt@1' fdt subimage
Description: ARM64 OpenWrt xiaomi_ax3600 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x44484500
Data Size: 9982 Bytes = 9.7 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: 22391323
Hash algo: sha1
Hash value: 9722e3b7c007aa540a9b7ef0a6b33b9885abafc5
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x44484500
Uncompressing Kernel Image ... OK
Loading Device Tree to 4a3fa000, end 4a3ff6fd ... OK
Using machid 0x8010010 from environment
Starting kernel ...
Jumping to AARCH64 kernel via monitor
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[ 0.000000] Linux version 5.4.48 (shane@wasp) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r13686-78b632134f)) #0 SMP PREEMPT Sat Jul 4 19:00:11 2020
[ 0.000000] Machine model: AX3600
[ 0.000000] efi: Getting EFI parameters from FDT:
[ 0.000000] efi: UEFI not found.
[ 0.000000] psci: probing for conduit method from DT.
[ 0.000000] psci: PSCIv1.0 detected in firmware.
[ 0.000000] psci: Using standard PSCI v0.2 function IDs
[ 0.000000] psci: MIGRATE_INFO_TYPE not supported.
[ 0.000000] psci: SMC Calling Convention v1.0
[ 0.000000] psci: OSI mode supported.
[ 0.000000] percpu: Embedded 21 pages/cpu s48408 r8192 d29416 u86016
[ 0.000000] Detected VIPT I-cache on CPU0
[ 0.000000] CPU features: detected: ARM erratum 845719
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 129024
[ 0.000000] Kernel command line: ubi.mtd=rootfs root=/dev/ubiblock0_1 rootfstype=squashfs rootwait
[ 0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 495272K/524288K available (6908K kernel code, 408K rwdata, 2164K rodata, 576K init, 274K bss, 29016K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] rcu: Preemptible hierarchical RCU implementation.
[ 0.000000] Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[ 0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[ 0.000000] random: get_random_bytes called from start_kernel+0x2ec/0x44c with crng_init=0
[ 0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[ 0.000005] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[ 0.000114] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=76800)
[ 0.000126] pid_max: default: 32768 minimum: 301
[ 0.000251] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.000262] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.023975] ASID allocator initialised with 32768 entries
[ 0.031972] rcu: Hierarchical SRCU implementation.
[ 0.040103] EFI services will not be available.
[ 0.048010] smp: Bringing up secondary CPUs ...
[ 0.080309] Detected VIPT I-cache on CPU1
[ 0.080360] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[ 0.112338] Detected VIPT I-cache on CPU2
[ 0.112374] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[ 0.144403] Detected VIPT I-cache on CPU3
[ 0.144435] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[ 0.144507] smp: Brought up 1 node, 4 CPUs
[ 0.144528] SMP: Total of 4 processors activated.
[ 0.144536] CPU features: detected: 32-bit EL0 Support
[ 0.144543] CPU features: detected: CRC32 instructions
[ 0.144588] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[ 0.144597] CPU: All CPU(s) started at EL1
[ 0.144619] alternatives: patching kernel code
[ 0.148598] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[ 0.148618] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[ 0.148810] pinctrl core: initialized pinctrl subsystem
[ 0.149261] DMI not present or invalid.
[ 0.149548] NET: Registered protocol family 16
[ 0.149890] DMA: preallocated 256 KiB pool for atomic allocations
[ 0.150292] cpuidle: using governor ladder
[ 0.150318] cpuidle: using governor menu
[ 0.150458] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[ 0.217211] pps_core: LinuxPPS API ver. 1 registered
[ 0.217223] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[ 0.217241] PTP clock support registered
[ 0.217452] Advanced Linux Sound Architecture Driver Initialized.
[ 0.218106] clocksource: Switched to clocksource arch_sys_counter
[ 0.218719] thermal_sys: Registered thermal governor 'step_wise'
[ 0.218722] thermal_sys: Registered thermal governor 'user_space'
[ 0.218908] NET: Registered protocol family 2
[ 0.219310] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.219332] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.219380] TCP bind hash table entries: 4096 (order: 4, 65536 bytes, linear)
[ 0.219458] TCP: Hash tables configured (established 4096 bind 4096)
[ 0.219536] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.219560] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.219710] NET: Registered protocol family 1
[ 0.219737] PCI: CLS 0 bytes, default 64
[ 0.221046] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[ 0.225598] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.225606] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.249134] msm_serial 78b3000.serial: msm_serial: detected port #0
[ 0.249165] msm_serial 78b3000.serial: uartclk = 3686400
[ 0.249200] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 8, base_baud = 230400) is a MSM
[ 0.249218] msm_serial: console setup on port #0
[ 0.741616] printk: console [ttyMSM0] enabled
[ 0.746474] msm_serial 78b1000.serial: msm_serial: detected port #1
[ 0.750478] msm_serial 78b1000.serial: uartclk = 19200000
[ 0.756562] 78b1000.serial: ttyMSM1 at MMIO 0x78b1000 (irq = 10, base_baud = 1200000) is a MSM
[ 0.762265] msm_serial: driver initialized
[ 0.777064] brd: module loaded
[ 0.784521] nand: device found, Manufacturer ID: 0xef, Chip ID: 0xaa
[ 0.784551] nand: Winbond W29N02GZ
[ 0.789959] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[ 0.793244] 17 fixed-partitions partitions found on MTD device qcom_nand.0
[ 0.800712] Creating 17 MTD partitions on "qcom_nand.0":
[ 0.807571] 0x000000000000-0x000000100000 : "0:SBL1"
[ 0.814542] 0x000000100000-0x000000200000 : "0:MIBIB"
[ 0.819407] 0x000000200000-0x000000500000 : "0:QSEE"
[ 0.826138] 0x000000500000-0x000000580000 : "0:DEVCFG"
[ 0.828932] 0x000000580000-0x000000600000 : "0:RPM"
[ 0.833900] 0x000000600000-0x000000680000 : "0:CDT"
[ 0.838764] 0x000000680000-0x000000700000 : "0:APPSBLENV"
[ 0.843570] 0x000000700000-0x000000800000 : "0:APPSBL"
[ 0.849510] 0x000000800000-0x000000880000 : "0:ART"
[ 0.854170] 0x000000880000-0x000000900000 : "bdata"
[ 0.858896] 0x000000900000-0x000000980000 : "crash"
[ 0.863803] 0x000000980000-0x000000a00000 : "crash_syslog"
[ 0.868638] 0x000000a00000-0x000002dc0000 : "rootfs"
[ 0.877917] random: fast init done
[ 0.904225] mtd: device 12 (rootfs) set to be root filesystem
[ 0.904508] mtdsplit: no squashfs found in "rootfs"
[ 0.908968] 0x000002dc0000-0x00000adc0000 : "rootfs_1"
[ 1.021749] 0x00000adc0000-0x00000cc80000 : "overlay"
[ 1.048215] 0x00000cc80000-0x00000cd00000 : "rsvd0"
[ 1.049224] 0x00000cd00000-0x00000d600000 : "0:WIFIFW"
[ 1.060757] libphy: Fixed MDIO Bus: probed
[ 1.060777] i2c /dev entries driver
[ 1.064841] sdhci: Secure Digital Host Controller Interface driver
[ 1.067139] sdhci: Copyright(c) Pierre Ossman
[ 1.073381] sdhci-pltfm: SDHCI platform and OF driver helper
[ 1.079162] NET: Registered protocol family 10
[ 1.084340] Segment Routing with IPv6
[ 1.087867] NET: Registered protocol family 17
[ 1.091556] 8021q: 802.1Q VLAN Support v1.8
[ 1.113036] ubi0: default fastmap pool size: 10
[ 1.113062] ubi0: default fastmap WL pool size: 5
[ 1.116400] ubi0: attaching mtd12
[ 1.244140] ubi0: scanning is finished
[ 1.249931] ubi0 warning: ubi_eba_init: cannot reserve enough PEBs for bad PEB handling, reserved 38, need 40
[ 1.250522] ubi0: attached mtd12 (name "rootfs", size 35 MiB)
[ 1.258832] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 1.264557] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 1.271329] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 1.278188] ubi0: good PEBs: 286, bad PEBs: 0, corrupted PEBs: 0
[ 1.284955] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
[ 1.291209] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1593889211
[ 1.298243] ubi0: available PEBs: 0, total reserved PEBs: 286, PEBs reserved for bad PEB handling: 38
[ 1.307544] ubi0: background thread "ubi_bgt0d" started, PID 82
[ 1.310147] block ubiblock0_1: created from ubi0:1(rootfs)
[ 1.322389] hctosys: unable to open rtc device (rtc0)
[ 1.328675] ALSA devi�[ 1.344606] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[ 1.344964] Freeing unused kernel memory: 576K
[ 1.366176] Run /sbin/init as init process
[ 1.677302] init: Console is alive
[ 1.828507] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 1.828643] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 1.839007] init: - preinit -
[ 2.239215] random: jshn: uninitialized urandom read (4 bytes read)
[ 2.246866] random: jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 6.342294] UBIFS (ubi0:2): default file-system created
[ 6.342833] UBIFS (ubi0:2): Mounting in unauthenticated mode
[ 6.346475] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 145
[ 6.369151] random: procd: uninitialized urandom read (4 bytes read)
[ 6.397893] UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "rootfs_data"
[ 6.397927] UBIFS (ubi0:2): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 6.404727] UBIFS (ubi0:2): FS size: 23109632 bytes (22 MiB, 182 LEBs), journal size 1142784 bytes (1 MiB, 9 LEBs)
[ 6.414612] UBIFS (ubi0:2): reserved for root: 1091524 bytes (1065 KiB)
[ 6.424851] UBIFS (ubi0:2): media format: w4/r0 (latest is w5/r0), UUID D1E2AB3B-3232-48C5-86A4-8942FE69C3E9, small LPT model
[ 6.432844] mount_root: overlay filesystem has not been fully initialized yet
[ 6.443061] mount_root: switching to ubifs overlay
[ 6.457178] overlayfs: upper fs does not support xattr, falling back to index=off and metacopy=off.
[ 6.458977] urandom-seed: Seed file not found (/etc/urandom.seed)
[ 6.500483] procd: - early -
[ 7.052759] procd: - ubus -
[ 7.077965] random: ubusd: uninitialized urandom read (4 bytes read)
[ 7.131046] random: ubusd: uninitialized urandom read (4 bytes read)
[ 7.131927] procd: - init -
Please press Enter to activate this console.
[ 7.300392] kmodloader: loading kernel modules from /etc/modules.d/*
[ 7.335550] urngd: v1.0.2 started.
[ 7.348498] xt_time: kernel timezone is -0000
[ 7.360550] PPP generic driver version 2.4.2
[ 7.361821] NET: Registered protocol family 24
[ 7.370794] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 7.372820] random: crng init done
[ 7.376565] random: 5 urandom warning(s) missed due to ratelimiting
BusyBox v1.31.1 () built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt SNAPSHOT, r13686-78b632134f
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# mount
/dev/root on /rom type squashfs (ro,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,noatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,noatime)
cgroup on /sys/fs/cgroup type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset,cpu,cpuacct,blkio,memory,devices,freezer,net_cls,net_prio,pids)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)
/dev/ubi0_2 on /overlay type ubifs (rw,noatime,assert=read-only,ubi=0,vol=2)
overlayfs:/overlay on / type overlay (rw,noatime,lowerdir=/,upperdir=/overlay/upper,workdir=/overlay/work)
tmpfs on /dev type tmpfs (rw,nosuid,relatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,mode=600,ptmxmode=000)
debugfs on /sys/kernel/debug type debugfs (rw,noatime)
root@OpenWrt:/#