Skip to content

Conversation

@aiamadeus
Copy link
Contributor

@aiamadeus aiamadeus commented Sep 12, 2022

Hardware specification:
SoC: MediaTek MT7986A 4x A53
Flash: ESMT F50L1G41LB 128 MB
RAM: K4A4G165WF-BCWE 512 MB
Ethernet: 4x 10/100/1000 Mbps
WiFi1: MT7976GN 2.4GHz ax 4x4
WiFi2: MT7976AN 5GHz ax 4x4
Button: Mesh, Reset

Flash instructions:

  1. Gain ssh and serial port access (see the link: https://openwrt.org/toh/xiaomi/redmi_ax6000#installation)
  2. Use ssh or serial port to log in to the router, and execute the following command:
    nvram set boot_wait=on
    nvram set flag_boot_rootfs=0
    nvram set flag_last_success=1
    nvram set flag_boot_success=1
    nvram set flag_try_sys1_failed=8
    nvram set flag_try_sys2_failed=8
    nvram commit
  3. Set a static ip on the ethernet interface of your computer (e.g. default: ip 192.168.31.100, gateway 192.168.31.1)
  4. Download the initramfs image, rename it to initramfs.bin, and host it with the tftp server.
  5. Interrupt U-Boot and run these commands:
    setenv mtdparts nmbm0:1024k(bl2),256k(Nvram),256k(Bdata),2048k(factory),2048k(fip),256k(crash),256k(crash_log),112640k(ubi)
    saveenv
    tftpboot initramfs.bin
    bootm
  6. After openwrt boots up, use scp or luci web to upload sysupgrade.bin to upgrade.

Note:

  1. I don't have this router, thanks to @pengchujin for providing a remote environment for debugging.
  2. The led chip (may be a spi) seems to lack driver, since I don't have this router, I'm not sure what that is.
  3. I haven't actually operated unlocking ssh/serial, my friend has done this, and it seems like it would be too long
    to write it into the commit message. Hope someone can help write the unlocking tutorial into the openwrt wiki.

Checklist:

  • spi-nand
  • ethernet
  • button
  • nmbm
  • wifi2g
  • wifi5g
  • mac
  • led

@soxrok2212
Copy link

soxrok2212 commented Sep 12, 2022

There is some instruction on the Wiki for rooting the device. https://openwrt.org/toh/xiaomi/redmi_ax6000#rooting

@Ansuel
Copy link
Member

Ansuel commented Sep 12, 2022

3. I haven't actually operated unlocking ssh/serial, my friend has done this, and it seems like it would be too long
to write it into the commit message. Hope someone can help write the unlocking tutorial into the openwrt wiki.

ideally we should first have some instruction and at least link them in the commit description

@soxrok2212
Copy link

Instructions worked great for me!

root@OpenWrt:~# uptime
 12:25:11 up 3 min,  load average: 0.23, 0.18, 0.08
root@OpenWrt:~# uname -a
Linux OpenWrt 5.15.67 #0 SMP Mon Sep 12 05:18:31 2022 aarch64 GNU/Linux
root@OpenWrt:~# cat /etc/os-release 
NAME="OpenWrt"
VERSION="SNAPSHOT"
ID="openwrt"
ID_LIKE="lede openwrt"
PRETTY_NAME="OpenWrt SNAPSHOT"
VERSION_ID="snapshot"
HOME_URL="https://openwrt.org/"
BUG_URL="https://bugs.openwrt.org/"
SUPPORT_URL="https://forum.openwrt.org/"
BUILD_ID="r20615-fbf70f4bca"
OPENWRT_BOARD="mediatek/filogic"
OPENWRT_ARCH="aarch64_cortex-a53"
OPENWRT_TAINTS="no-all"
OPENWRT_DEVICE_MANUFACTURER="OpenWrt"
OPENWRT_DEVICE_MANUFACTURER_URL="https://openwrt.org/"
OPENWRT_DEVICE_PRODUCT="Generic"
OPENWRT_DEVICE_REVISION="v0"
OPENWRT_RELEASE="OpenWrt SNAPSHOT r20615-fbf70f4bca"
root@OpenWrt:~# 

LED bar stays on and solid blue for me, so definitely not working but I can live with it for now.

@Ansuel Ansuel added target/mediatek pull request/issue for mediatek target new device pull request with new device labels Sep 12, 2022
@aiamadeus
Copy link
Contributor Author

There is some instruction on the Wiki for rooting the device. https://openwrt.org/toh/xiaomi/redmi_ax6000#rooting

Great, I'll add this link to the commit message.

LED bar stays on and solid blue for me, so definitely not working but I can live with it for now.

Can you see which chip the leds are connected to?
The original fdt has a strange node called HM0807A, I don't know what it is.

@soxrok2212
Copy link

Can you see which chip the leds are connected to?
The original fdt has a strange node called HM0807A, I don't know what it is.

As far as physical visibility, nope. The LEDs are connected via this header at the bottom:

@DragonBluep
Copy link
Contributor

I remember kernel size in mediatek target is very close to 4 MiB recently, so it's better to enlarge it to 8 MiB. And for NMBM reserved space, 8 MiB is enough. Refer to bootlog, block 960 start at 0x7800000:

NOTICE:  First info table with writecount 0 found in block 960
NOTICE:  Second info table with writecount 0 found in block 963

@aiamadeus
Copy link
Contributor Author

I remember kernel size in mediatek target is very close to 4 MiB recently, so it's better to enlarge it to 8 MiB. And for NMBM reserved space, 8 MiB is enough.

So I added this line KERNEL_SIZE := 4096k. Due to stock uboot limitations, the kernel must be included in the ubi partition.
And with nmbm, all partitions except ubi should be remapped, is it appropriate to directly change the size of bmt-remap-range? Sorry I don't know nmbm very well, so I'm a little confused.

@DragonBluep
Copy link
Contributor

I think enlarge bmt-remap-range won't hurt before kernel reach to the end of the remap range.
nmbm will use the last 8MiB as a spare tire. When there is a bad block in the bmt-remap-range, the NMBM layer picks a good block from the last 8MiB and creates a "link" that maps to the address of the bad block. Outside the remap range, it seems that mtd skips the bad blocks directly, which may cause u-boot that supports nmbm failed to load the kernel properly.
image

image

In first image u-boot will load part1+part2+part3, and in second image, u-boot load the wrong kernel (part1+random+part2)

Maybe using pad-to to control the size of the kernel to a fixed value is a good option. Although there will be some storage waste, but fortunately we still have 100 MiB+ of space

@soxrok2212
Copy link

After leaving my device running all day, I did a reboot an hour or two ago and it seems hard bricked. Bootloader appears corrupt, u-boot is busted, can't tftpboot, and UART is not working correctly. I'm not sure if I'm just a one-off, but something bad happened.

@DragonBluep
Copy link
Contributor

@soxrok2212 Can you try plugging in the power first and waiting for about 1~2 second, then connect the TTL GND to see if there is any output.

@aiamadeus
Copy link
Contributor Author

Maybe using pad-to to control the size of the kernel to a fixed value is a good option. Although there will be some storage waste, but fortunately we still have 100 MiB+ of space

Thank you so much for your suggestion. I tried to ask mtk, and their reply was that since the kernel is already in ubi, there is no need to care about the size of kernel.

@ptpt52
Copy link
Contributor

ptpt52 commented Sep 13, 2022

trying to make it possible to flash via ssh on stock system (and we don't like to use serial port to flash firmware.)
this patch to gen an initramfs-factory.ubi image to flash it to ubi1 mtd partition

diff --git a/target/linux/mediatek/image/filogic.mk b/target/linux/mediatek/image/filogic.mk
index 3015c7a86f..2c9ddcb86f 100644
--- a/target/linux/mediatek/image/filogic.mk
+++ b/target/linux/mediatek/image/filogic.mk
@@ -38,6 +38,20 @@ define Build/mt7986-gpt
        rm $@.tmp
 endef
 
+define Build/gen-ubi-initramfs
+       sh $(TOPDIR)/scripts/ubinize-image.sh \
+               $(if $(UBOOTENV_IN_UBI),--uboot-env) \
+               --kernel $(KDIR)/tmp/$(KERNEL_INITRAMFS_IMAGE) \
+               $(foreach part,$(UBINIZE_PARTS),--part $(part)) \
+               "$(1).tmp" \
+               -p $(BLOCKSIZE:%k=%KiB) -m $(PAGESIZE) \
+               $(if $(SUBPAGESIZE),-s $(SUBPAGESIZE)) \
+               $(if $(VID_HDR_OFFSET),-O $(VID_HDR_OFFSET)) \
+               $(UBINIZE_OPTS) && \
+       cat "$(1).tmp" > "$(1)" && rm "$(1).tmp" && \
+       $(CP) "$(1)" $(BIN_DIR)/
+endef
+
 define Device/bananapi_bpi-r3
   DEVICE_VENDOR := Bananapi
   DEVICE_MODEL := BPi-R3
@@ -136,6 +150,9 @@ define Device/xiaomi_redmi-router-ax6000
   BLOCKSIZE := 128k
   PAGESIZE := 2048
   KERNEL_IN_UBI := 1
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+       fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | \
+       gen-ubi-initramfs $(KDIR)/tmp/$$(KERNEL_INITRAMFS_PREFIX)-factory.ubi
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
 TARGET_DEVICES += xiaomi_redmi-router-ax6000

possible installation method:

  1. Gain ssh.
  2. login ssh and flash initramfs-factory.ubi to ubi1 mtd partition, via command:
ubiformat  /dev/mtdXX -y -f /tmp/initramfs-factory.ubi

where mtdXX is the ubi1 partition mtd device path.

  1. change nvram env to boot from ubi1
  2. boot into openwrt-initramfs and login ssh, do ubootenv setup, and then flash sysupgrade file via sysupgrade command.

I have no device to do test, I hope somebody can add more details

@nasbdh9
Copy link
Contributor

nasbdh9 commented Sep 13, 2022

It is best if stock u-boot can be replaced like Linksys E8450

@soxrok2212
Copy link

@soxrok2212 Can you try plugging in the power first and waiting for about 1~2 second, then connect the TTL GND to see if there is any output.

I was able to tftpboot again and refresh OpenWrt, but the device still refuses to boot it. Think the console was broken last night because of a bad ground pin.

@soxrok2212
Copy link

Here is how the UBI partition (mtd7) looks...

Screen Shot 2022-09-13 at 8 53 53 AM (2)

@soxrok2212
Copy link

soxrok2212 commented Sep 13, 2022

Looks like the sys upgrade isn't writing to UBI correctly. Sometimes it loops like the image above, others it writes a bunch of junk. Stuck in boot loop. I'm going to fresh build an image

I grabbed a dump of the flash from the forums and reset these:
setenv flag_try_sys1_failed 0
setenv flag_try_sys2_failed 0

sys1 was at 9 and sys2 was at 97. I presume some other nvram params need to be changed as the standard fw as 2 ubi partitions. https://openwrt.org/toh/xiaomi/redmi_ax6000#flash_layout Seems it got stuck looking at the second.

Unsure what triggered it to go bad. Bad gnd pin on uart made the rest look corrupt but seems okay. So I guess 2 things to figure out/adjust are:

  1. What made it go bad
  2. remove second boot option as original fw had 2 ubi partitions, looks like 2nd one sometimes gets stuck and fails: setenv boot_fw1 run boot_rd_img\;bootm

@aiamadeus
Copy link
Contributor Author

@soxrok2212 Can you try setting uboot env like this?

setenv boot_fw1 run boot_rd_img\;bootm
setenv flag_boot_rootfs 1
setenv flag_last_success 1

Then the router will boot from ubi or ubi1?

@soxrok2212
Copy link

@soxrok2212 Can you try setting uboot env like this?

setenv boot_fw1 run boot_rd_img\;bootm
setenv flag_boot_rootfs 1
setenv flag_last_success 1

Then the router will boot from ubi or ubi1?

This puts it into a boot loop, so yes looks like it tries booting from ubi1. From there, reset flag_try_sys1_failed and flag_try_sys2_failed both to 0 and it boots normally.

@aiamadeus
Copy link
Contributor Author

This puts it into a boot loop, so yes looks like it tries booting from ubi1. From there, reset flag_try_sys1_failed and flag_try_sys2_failed both to 0 and it boots normally.

So if flag_boot_rootfs=1 even if we change boot_rd_img2, will the router still boot from the ubi1 partition?
It looks like vendor uboot modifies the env by itself, not sure how redmi ax6s avoids this problem.

@soxrok2212
Copy link

soxrok2212 commented Sep 14, 2022

This puts it into a boot loop, so yes looks like it tries booting from ubi1. From there, reset flag_try_sys1_failed and flag_try_sys2_failed both to 0 and it boots normally.

So if flag_boot_rootfs=1 even if we change boot_rd_img2, will the router still boot from the ubi1 partition? It looks like vendor uboot modifies the env by itself, not sure how redmi ax6s avoids this problem.

Looks like its booting normally even though both flag_try_sys1_failed and flag_try_sys2_failed counters are not 0. The boot loader algorithm is here, from the forums. https://pastebin.com/xzRXCbzU (this is from the RB03 but looks to be the same on the RB06).

@dangowrt
Copy link
Member

It is best if stock u-boot can be replaced like Linksys E8450

Should be easily possible, just pick the right combination for storage and DRAM and check ARM Trusted Firmware and U-Boot are done for the Bananapi BPi-R3.

@github-actions github-actions bot added the core packages pull request/issue for core (in-tree) packages label Sep 15, 2022
@remittor
Copy link
Contributor

remittor commented Sep 15, 2022

  • Download the initramfs image, rename it to initramfs.bin, and host it with the tftp server.
  • Interrupt U-Boot and run these commands:
    setenv mtdparts nmbm0:1024k(bl2),256k(Nvram),256k(Bdata),2048k(factory),2048k(fip),256k(crash),256k(crash_log),112640k(ubi)
    saveenv
    tftpboot initramfs.bin
    bootm

And why is it so difficult? Users here can do terrible things!

Here is the simplest solution: https://forum.openwrt.org/t/adding-openwrt-support-for-xiaomi-redmi-router-ax6s-xiaomi-router-ax3200/111085/938

@soxrok2212
Copy link

For some users reverting would be great. I’ll personally never go back to a fw that calls home though… :)

@soxrok2212
Copy link

Perhaps we could make multiple (2) options like the RT3200/E8450? For those like myself who'd rather utilize all the available space and do not wish to ever return to stock fw this would be optimal. I'd imagine most users would like to stick with OpenWrt as the stock fw is only available in Chinese if no other reason.

@aiamadeus
Copy link
Contributor Author

@soxrok2212 Can you test the replacement of u-boot? I'm not sure if this will make it bricks.

@soxrok2212
Copy link

I’m a little hesitant to do that, especially now that setting flag_try_sys1_failed >= 6 and flag_try_sys2_failed >= 6 seems to have fixed that bricked device.

@remittor
Copy link
Contributor

remittor commented Sep 27, 2022

I'd imagine most users would like to stick with OpenWrt

The ability to easily return to stock firmware should be required!
#5063

the stock fw is only available in Chinese if no other reason.

I made a very easy to use stock firmware translator (EN/RU): https://forum.openwrt.org/t/adding-openwrt-support-for-xiaomi-redmi-router-ax6s-xiaomi-router-ax3200/111085/938
Sources: https://github.com/openwrt-xiaomi/xmir-patcher
This method supports all xiaomi routers.

@dangowrt
Copy link
Member

dangowrt commented Oct 2, 2022

I'd imagine most users would like to stick with OpenWrt

The ability to easily return to stock firmware should be required! See: #5063

Having the option to return to stock firmware is nice to have, especially while the device is still very new.
However, please consider that in OpenWrt we will most likely offer support for this hardware much longer than the vendor firmware will receive any updates. Today there are many devices which are 10+ years old are still actively maintained and supported in OpenWrt, vendors usually update firmware for about 2-3 years before declaring the hardware being EOL.
Having that in mind, I wouldn't accept any compromise in functionality when running OpenWrt just for being able to revert to stock -- because anyway this is only relevant now in the beginning of the shelf-life of a device till the vendor declares the firmware EOL, after that nobody will ever want to return to a then outdated stock firmware.

So having 10% less flash space is absolutely ok, of course. But if keeping compatibility with the stock firmware means having to live with more limiting choices of the vendor I'd always be in favor of getting the most out the device when running OpenWrt, because that's what the project is all about in the end.

@soxrok2212
Copy link

@dangowrt could we get your approval to start 1 of 6? :)

@EUA
Copy link

EUA commented Oct 3, 2022

Can you see which chip the leds are connected to?
The original fdt has a strange node called HM0807A, I don't know what it is.

As far as physical visibility, nope. The LEDs are connected via this header at the bottom:

4 pin for just a led? I bet that LED is controlled from I2C bus...

@rjocoleman
Copy link

@soxrok2212 Can you test the replacement of u-boot? I'm not sure if this will make it bricks.

@aiamadeus do you still need some testing on u-boot replacement? (or anything else) I have a couple of these. I'm going to dump the nand shortly and then should be able to do some testing if that would be helpful.

Manufacture date on the box is 2202.07 and came out of the box with 1.0.48 firmware. I've got root and checked that mtd7/mtd8 partitions are read-write.

The LEDs appear to have embedded drivers. I haven't identified which yet but they are on the SPI bus, the 4 pin header goes to a LED board under the heat sink with two packages on it.
IMG_4125

@soxrok2212
Copy link

What's left to get this merged in?

@PussAzuki
Copy link

Most of us can't open this lower cover perfectly, so I think we should give priority to submitting solutions that can be TTL-free?

@PussAzuki
Copy link

If using LEDs requires proprietary drivers, can we skip the LED-related ones first and then merge this new device in first?

@soxrok2212
Copy link

Up and stable for about 2 weeks for me. 0 issues so far. Device is rock stable and MT7986 is great :)

@Ansuel
Copy link
Member

Ansuel commented Oct 28, 2022

If using LEDs requires proprietary drivers, can we skip the LED-related ones first and then merge this new device in first?

imho this should be the best solution currently.

@shauno100
Copy link

shauno100 commented Oct 28, 2022

I'm a complete newbie when it comes to the code here, I have a Redmi AX6000 myself and am eagerly awaiting OpenWRT support. I can see that 6 approvers are required for this PR to be merged into the OpenWRT master branch. So far there's 1 approval and 2 with review comments so essentially 5 more approvals are needed. The PR seems to be sound code wise according to the comments here so apart from the LEDs which can be revisited later (would majority of users care about this if option for OpenWRT support was granted to begin with?), what is the hold up? The LED strip as far as i am concerned is a waste of time to begin with, all multiple dots of one color with no symbols showing what each LED means, purely aesthetics rather than usefulness in my opinion.

@stoickish
Copy link

stoickish commented Oct 29, 2022

I just got one of these devices yesterday, and I was able to get my device flashed successfully. My observations thus-far have been:

  • I had to resort to UART to get it working. I tried using SSH using this patch to create a 'factory.bin' and these instructions and it just put the device into a boot loop
  • I could just be stupid, but I couldn't find any information on the UART pinouts. For anyone who cares, if you're looking at the device from the bottom with the antennas at the top, UART pinouts (from left to right) seemed to be TX, GND, RX, VCC (3.3V)
  • Minor nitpick but it seems like the numbering of the ports as they're painted on the device don't line up with how they're labeled in OpenWRT. Like on the device, the WAN port is marked as "1" and the three LAN ports are 2-4, whereas in OpenWRT the LAN ports are 1-3 and in reverse order (like port '4' on the device correlates with 'lan1' in OpenWRT)
  • Not sure if it's a bug in OpenWRT itself or if it has something to do with this specific device, but I did note that if I configure an 802.1q VLAN on one of the LAN ports, and add that VLAN to a bridge, that it seems like wired devices on that VLAN can communicate with each other but NOT with wireless clients on the same bridge. This is a configuration I've used successfully on many other devices.

Hardware specification:
  SoC: MediaTek MT7986A 4x A53
  Flash: ESMT F50L1G41LB 128 MB
  RAM: K4A4G165WF-BCWE 512 MB
  Ethernet: 4x 10/100/1000 Mbps
  WiFi1: MT7976GN 2.4GHz ax 4x4
  WiFi2: MT7976AN 5GHz ax 4x4
  Button: Mesh, Reset

Flash instructions:
  1. Gain ssh and serial port access, see the link below:
     https://openwrt.org/toh/xiaomi/redmi_ax6000#installation
  2. Use ssh or serial port to log in to the router, and
     execute the following command:
     nvram set boot_wait=on
     nvram set flag_boot_rootfs=0
     nvram set flag_boot_success=1
     nvram set flag_last_success=1
     nvram set flag_try_sys1_failed=8
     nvram set flag_try_sys2_failed=8
     nvram commit
  3. Set a static ip on the ethernet interface of your computer
     (e.g. default: ip 192.168.31.100, gateway 192.168.31.1)
  4. Download the initramfs image, rename it to initramfs.bin,
     and host it with the tftp server.
  5. Interrupt U-Boot and run these commands:
     setenv mtdparts nmbm0:1024k(bl2),256k(Nvram),256k(Bdata),2048k(factory),2048k(fip),256k(crash),256k(crash_log),112640k(ubi)
     saveenv
     tftpboot initramfs.bin
     bootm
  6. After openwrt boots up, use scp or luci web
     to upload sysupgrade.bin to upgrade.

Revert to stock firmware:
  Restore mtdparts back to default, then use the
  vendor's recovery tool (Windows only).

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
@aiamadeus
Copy link
Contributor Author

  • Minor nitpick but it seems like the numbering of the ports as they're painted on the device don't line up with how they're labeled in OpenWRT. Like on the device, the WAN port is marked as "1" and the three LAN ports are 2-4, whereas in OpenWRT the LAN ports are 1-3 and in reverse order (like port '4' on the device correlates with 'lan1' in OpenWRT)

Can you try the latest code?

@stoickish
Copy link

  • Minor nitpick but it seems like the numbering of the ports as they're painted on the device don't line up with how they're labeled in OpenWRT. Like on the device, the WAN port is marked as "1" and the three LAN ports are 2-4, whereas in OpenWRT the LAN ports are 1-3 and in reverse order (like port '4' on the device correlates with 'lan1' in OpenWRT)

Can you try the latest code?

Yes, that fixed it. The OpenWRT UI seems to be consistent with what's printed on the device now. Thanks!

@dangowrt
Copy link
Member

Picked. Thank you!

@dangowrt dangowrt closed this Oct 30, 2022
@feitian124
Copy link

@dangowrt excuse me, may i know this pr is closed?

@dangowrt
Copy link
Member

dangowrt commented Nov 1, 2022

Because the commit has been picked into the main git branch.
641e4f2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

core packages pull request/issue for core (in-tree) packages new device pull request with new device target/mediatek pull request/issue for mediatek target

Projects

None yet

Development

Successfully merging this pull request may close these issues.